/mandos/release

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/release
237.7.354 by Teddy Hogeborn
Fix Debian dependency bugs and lintian checks.
1
#!/usr/bin/python
237.7.713 by Teddy Hogeborn
Server: Add scaffolding for tests
2
# -*- mode: python; after-save-hook: (lambda () (let ((command (if (fboundp 'file-local-name) (file-local-name (buffer-file-name)) (or (file-remote-p (buffer-file-name) 'localname) (buffer-file-name))))) (if (= (progn (if (get-buffer "*Test*") (kill-buffer "*Test*")) (process-file-shell-command (format "%s --check" (shell-quote-argument command)) nil "*Test*")) 0) (let ((w (get-buffer-window "*Test*"))) (if w (delete-window w))) (progn (with-current-buffer "*Test*" (compilation-mode)) (display-buffer "*Test*" '(display-buffer-in-side-window)))))); coding: utf-8 -*-
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3
#
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
4
# Mandos server - give out binary blobs to connecting clients.
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
5
#
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
6
# This program is partly derived from an example program for an Avahi
7
# service publisher, downloaded from
8
# <http://avahi.org/wiki/PythonPublishExample>.  This includes the
237.2.99 by Teddy Hogeborn
Code cleanup.
9
# methods "add", "remove", "server_state_changed",
10
# "entry_group_state_changed", "cleanup", and "activate" in the
11
# "AvahiService" class, and some lines in "main".
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
12
#
28 by Teddy Hogeborn
* server.conf: New file.
13
# Everything else is
237.7.517 by Teddy Hogeborn
Update copyright year to 2019
14
# Copyright © 2008-2019 Teddy Hogeborn
15
# Copyright © 2008-2019 Björn Påhlsson
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
16
#
237.7.455 by Teddy Hogeborn
Alter copyright notices slightly. Actual license is unchanged!
17
# This file is part of Mandos.
18
#
19
# Mandos is free software: you can redistribute it and/or modify it
20
# under the terms of the GNU General Public License as published by
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
21
# the Free Software Foundation, either version 3 of the License, or
22
# (at your option) any later version.
23
#
237.7.455 by Teddy Hogeborn
Alter copyright notices slightly. Actual license is unchanged!
24
#     Mandos is distributed in the hope that it will be useful, but
25
#     WITHOUT ANY WARRANTY; without even the implied warranty of
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
26
#     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
27
#     GNU General Public License for more details.
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
28
#
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
29
# You should have received a copy of the GNU General Public License
237.7.455 by Teddy Hogeborn
Alter copyright notices slightly. Actual license is unchanged!
30
# along with Mandos.  If not, see <http://www.gnu.org/licenses/>.
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
31
#
237.11.2 by Teddy Hogeborn
Change "fukt.bsnet.se" to "recompile.se" throughout.
32
# Contact the authors at <mandos@recompile.se>.
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
33
#
3 by Björn Påhlsson
Python based server
34
237.8.5 by teddy at bsnet
* mandos: Use unicode string literals.
35
from __future__ import (division, absolute_import, print_function,
36
                        unicode_literals)
10 by Teddy Hogeborn
* server.py: Bug fix: Do "from __future__ import division".
37
237.7.376 by Teddy Hogeborn
Server: Add Python 3 compatibility
38
try:
39
    from future_builtins import *
40
except ImportError:
41
    pass
237.7.127 by Teddy Hogeborn
* mandos: Use all new builtins.
42
237.7.297 by Teddy Hogeborn
mandos: Some more minor changes to prepare for Python 3.
43
try:
44
    import SocketServer as socketserver
45
except ImportError:
46
    import socketserver
3 by Björn Påhlsson
Python based server
47
import socket
237.7.22 by teddy at bsnet
* mandos: Use the new argparse library instead of optparse.
48
import argparse
3 by Björn Påhlsson
Python based server
49
import datetime
50
import errno
237.7.297 by Teddy Hogeborn
mandos: Some more minor changes to prepare for Python 3.
51
try:
52
    import ConfigParser as configparser
53
except ImportError:
54
    import configparser
4 by Teddy Hogeborn
* server.py (Client.created, Client.next_check): New.
55
import sys
9 by Teddy Hogeborn
* client.cpp (main): Get t_old early since it is used on error exits.
56
import re
57
import os
58
import signal
10 by Teddy Hogeborn
* server.py: Bug fix: Do "from __future__ import division".
59
import subprocess
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
60
import atexit
61
import stat
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
62
import logging
63
import logging.handlers
163 by Teddy Hogeborn
* Makefile (PIDDIR, USER, GROUP): Removed.
64
import pwd
237.2.174 by Teddy Hogeborn
More consistent terminology: Clients are no longer "invalid" - they
65
import contextlib
237.2.96 by Teddy Hogeborn
Minor code cleanup; one minor bug fix.
66
import struct
67
import fcntl
237.2.100 by Teddy Hogeborn
Code cleanup. Move some global stuff into main.
68
import functools
237.7.297 by Teddy Hogeborn
mandos: Some more minor changes to prepare for Python 3.
69
try:
70
    import cPickle as pickle
71
except ImportError:
72
    import pickle
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
73
import multiprocessing
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
74
import types
237.14.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
75
import binascii
76
import tempfile
237.18.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
77
import itertools
237.7.157 by Teddy Hogeborn
* clients.conf: Convert all time intervals to new RFC 3339 syntax.
78
import collections
237.7.299 by Teddy Hogeborn
mandos: Use codecs.open() and print() for PID file.
79
import codecs
237.7.713 by Teddy Hogeborn
Server: Add scaffolding for tests
80
import unittest
5 by Teddy Hogeborn
* server.py (server_metaclass): New.
81
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
82
import dbus
237.1.1 by Teddy Hogeborn
First steps of a D-Bus interface to the server.
83
import dbus.service
237.7.687 by Teddy Hogeborn
Update Python 3 compatibility
84
import gi
237.7.378 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
85
from gi.repository import GLib
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
86
from dbus.mainloop.glib import DBusGMainLoop
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
87
import ctypes
215 by Teddy Hogeborn
* mandos: Remove unused "select" module. Import "ctypes.util".
88
import ctypes.util
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
89
import xml.dom.minidom
90
import inspect
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
91
237.7.702 by Teddy Hogeborn
Simplification of Python 3 compatibility code
92
if sys.version_info.major == 2:
93
    __metaclass__ = type
94
237.7.714 by Teddy Hogeborn
Server: Show Python warnings
95
# Show warnings by default
96
if not sys.warnoptions:
97
    import warnings
98
    warnings.simplefilter("default")
99
237.7.400 by Teddy Hogeborn
mandos: Bug fix for Python 2.7 and the "--interface" option
100
# Try to find the value of SO_BINDTODEVICE:
237.2.94 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
101
try:
237.7.400 by Teddy Hogeborn
mandos: Bug fix for Python 2.7 and the "--interface" option
102
    # This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and
103
    # newer, and it is also the most natural place for it:
237.2.94 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
104
    SO_BINDTODEVICE = socket.SO_BINDTODEVICE
105
except AttributeError:
106
    try:
237.7.400 by Teddy Hogeborn
mandos: Bug fix for Python 2.7 and the "--interface" option
107
        # This is where SO_BINDTODEVICE was up to and including Python
108
        # 2.6, and also 3.2:
237.2.94 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
109
        from IN import SO_BINDTODEVICE
110
    except ImportError:
237.7.400 by Teddy Hogeborn
mandos: Bug fix for Python 2.7 and the "--interface" option
111
        # In Python 2.7 it seems to have been removed entirely.
112
        # Try running the C preprocessor:
113
        try:
114
            cc = subprocess.Popen(["cc", "--language=c", "-E",
115
                                   "/dev/stdin"],
116
                                  stdin=subprocess.PIPE,
117
                                  stdout=subprocess.PIPE)
118
            stdout = cc.communicate(
119
                "#include <sys/socket.h>\nSO_BINDTODEVICE\n")[0]
120
            SO_BINDTODEVICE = int(stdout.splitlines()[-1])
121
        except (OSError, ValueError, IndexError):
122
            # No value found
123
            SO_BINDTODEVICE = None
237.2.94 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
124
237.7.278 by Teddy Hogeborn
mandos: Replace unicode() with str().
125
if sys.version_info.major == 2:
126
    str = unicode
127
237.7.687 by Teddy Hogeborn
Update Python 3 compatibility
128
if sys.version_info < (3, 2):
129
    configparser.Configparser = configparser.SafeConfigParser
130
391 by Teddy Hogeborn
* Makefile (version): Change to 1.8.8.
131
version = "1.8.8"
237.14.2 by Teddy Hogeborn
Directory with persistent state can now be changed with the "statedir"
132
stored_state_file = "clients.pickle"
13 by Björn Påhlsson
Added following support:
133
237.11.20 by Teddy Hogeborn
* Makefile (run-server): Remove obsolete warning.
134
logger = logging.getLogger()
237.7.714 by Teddy Hogeborn
Server: Show Python warnings
135
logging.captureWarnings(True)   # Show warnings via the logging system
237.7.203 by Teddy Hogeborn
Allow self-tests to run without needing /dev/log.
136
syslogger = None
13 by Björn Påhlsson
Added following support:
137
237.12.5 by Björn Påhlsson
First run of python-lint. Fixed some *obviously* bad code and turned
138
try:
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
139
    if_nametoindex = ctypes.cdll.LoadLibrary(
140
        ctypes.util.find_library("c")).if_nametoindex
237.12.5 by Björn Påhlsson
First run of python-lint. Fixed some *obviously* bad code and turned
141
except (OSError, AttributeError):
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
142
237.12.5 by Björn Påhlsson
First run of python-lint. Fixed some *obviously* bad code and turned
143
    def if_nametoindex(interface):
144
        "Get an interface index the hard way, i.e. using fcntl()"
145
        SIOCGIFINDEX = 0x8933  # From /usr/include/linux/sockios.h
146
        with contextlib.closing(socket.socket()) as s:
147
            ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
237.7.277 by Teddy Hogeborn
mandos: Stop using str() and remove unnecessary unicode() calls.
148
                                struct.pack(b"16s16x", interface))
149
        interface_index = struct.unpack("I", ifreq[16:20])[0]
237.12.5 by Björn Påhlsson
First run of python-lint. Fixed some *obviously* bad code and turned
150
        return interface_index
151
152
237.7.376 by Teddy Hogeborn
Server: Add Python 3 compatibility
153
def copy_function(func):
154
    """Make a copy of a function"""
155
    if sys.version_info.major == 2:
156
        return types.FunctionType(func.func_code,
157
                                  func.func_globals,
158
                                  func.func_name,
159
                                  func.func_defaults,
160
                                  func.func_closure)
161
    else:
162
        return types.FunctionType(func.__code__,
163
                                  func.__globals__,
164
                                  func.__name__,
165
                                  func.__defaults__,
166
                                  func.__closure__)
167
168
237.7.78 by teddy at bsnet
* mandos (initlogger): Take new "debug" argument; all callers changed.
169
def initlogger(debug, level=logging.WARNING):
237.12.4 by Björn Påhlsson
restructured logger
170
    """init logger and add loglevel"""
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
171
237.7.246 by Teddy Hogeborn
Fix mandos server "--servicename" option, broken since 1.6.4.
172
    global syslogger
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
173
    syslogger = (logging.handlers.SysLogHandler(
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
174
        facility=logging.handlers.SysLogHandler.LOG_DAEMON,
175
        address="/dev/log"))
237.12.4 by Björn Påhlsson
restructured logger
176
    syslogger.setFormatter(logging.Formatter
177
                           ('Mandos [%(process)d]: %(levelname)s:'
178
                            ' %(message)s'))
179
    logger.addHandler(syslogger)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
180
237.7.78 by teddy at bsnet
* mandos (initlogger): Take new "debug" argument; all callers changed.
181
    if debug:
182
        console = logging.StreamHandler()
183
        console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
184
                                               ' [%(process)d]:'
185
                                               ' %(levelname)s:'
186
                                               ' %(message)s'))
187
        logger.addHandler(console)
237.12.4 by Björn Påhlsson
restructured logger
188
    logger.setLevel(level)
28 by Teddy Hogeborn
* server.conf: New file.
189
237.11.20 by Teddy Hogeborn
* Makefile (run-server): Remove obsolete warning.
190
237.12.9 by Björn Påhlsson
renamed variables
191
class PGPError(Exception):
192
    """Exception if encryption/decryption fails"""
237.14.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
193
    pass
194
195
237.7.702 by Teddy Hogeborn
Simplification of Python 3 compatibility code
196
class PGPEngine:
237.14.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
197
    """A simple class for OpenPGP symmetric encryption & decryption"""
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
198
237.14.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
199
    def __init__(self):
200
        self.tempdir = tempfile.mkdtemp(prefix="mandos-")
237.7.353 by Teddy Hogeborn
Use GnuPG 2 if available
201
        self.gpg = "gpg"
202
        try:
203
            output = subprocess.check_output(["gpgconf"])
204
            for line in output.splitlines():
237.7.376 by Teddy Hogeborn
Server: Add Python 3 compatibility
205
                name, text, path = line.split(b":")
237.7.353 by Teddy Hogeborn
Use GnuPG 2 if available
206
                if name == "gpg":
207
                    self.gpg = path
208
                    break
209
        except OSError as e:
210
            if e.errno != errno.ENOENT:
211
                raise
237.7.163 by Teddy Hogeborn
* mandos: Don't use the GnuPGInterface module.
212
        self.gnupgargs = ['--batch',
237.7.353 by Teddy Hogeborn
Use GnuPG 2 if available
213
                          '--homedir', self.tempdir,
237.7.163 by Teddy Hogeborn
* mandos: Don't use the GnuPGInterface module.
214
                          '--force-mdc',
237.7.397 by Teddy Hogeborn
mandos: Bug fix: Only use the --no-use-agent option for GPG 1
215
                          '--quiet']
216
        # Only GPG version 1 has the --no-use-agent option.
217
        if self.gpg == "gpg" or self.gpg.endswith("/gpg"):
218
            self.gnupgargs.append("--no-use-agent")
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
219
237.14.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
220
    def __enter__(self):
221
        return self
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
222
237.7.135 by Teddy Hogeborn
* Makefile (DOCBOOKTOMAN): Only run man --warnings if both "man" and
223
    def __exit__(self, exc_type, exc_value, traceback):
237.14.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
224
        self._cleanup()
225
        return False
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
226
237.14.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
227
    def __del__(self):
228
        self._cleanup()
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
229
237.14.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
230
    def _cleanup(self):
231
        if self.tempdir is not None:
232
            # Delete contents of tempdir
233
            for root, dirs, files in os.walk(self.tempdir,
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
234
                                             topdown=False):
237.14.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
235
                for filename in files:
236
                    os.remove(os.path.join(root, filename))
237
                for dirname in dirs:
238
                    os.rmdir(os.path.join(root, dirname))
239
            # Remove tempdir
240
            os.rmdir(self.tempdir)
241
            self.tempdir = None
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
242
237.14.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
243
    def password_encode(self, password):
244
        # Passphrase can not be empty and can not contain newlines or
245
        # NUL bytes.  So we prefix it and hex encode it.
237.7.178 by Teddy Hogeborn
* mandos (PGPEngine.password_encode): Bug fix: GnuPG can't handle
246
        encoded = b"mandos" + binascii.hexlify(password)
247
        if len(encoded) > 2048:
248
            # GnuPG can't handle long passwords, so encode differently
249
            encoded = (b"mandos" + password.replace(b"\\", b"\\\\")
250
                       .replace(b"\n", b"\\n")
251
                       .replace(b"\0", b"\\x00"))
252
        return encoded
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
253
237.14.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
254
    def encrypt(self, data, password):
237.7.163 by Teddy Hogeborn
* mandos: Don't use the GnuPGInterface module.
255
        passphrase = self.password_encode(password)
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
256
        with tempfile.NamedTemporaryFile(
257
                dir=self.tempdir) as passfile:
237.7.163 by Teddy Hogeborn
* mandos: Don't use the GnuPGInterface module.
258
            passfile.write(passphrase)
259
            passfile.flush()
237.7.353 by Teddy Hogeborn
Use GnuPG 2 if available
260
            proc = subprocess.Popen([self.gpg, '--symmetric',
237.7.163 by Teddy Hogeborn
* mandos: Don't use the GnuPGInterface module.
261
                                     '--passphrase-file',
262
                                     passfile.name]
263
                                    + self.gnupgargs,
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
264
                                    stdin=subprocess.PIPE,
265
                                    stdout=subprocess.PIPE,
266
                                    stderr=subprocess.PIPE)
267
            ciphertext, err = proc.communicate(input=data)
237.7.163 by Teddy Hogeborn
* mandos: Don't use the GnuPGInterface module.
268
        if proc.returncode != 0:
269
            raise PGPError(err)
237.14.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
270
        return ciphertext
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
271
237.14.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
272
    def decrypt(self, data, password):
237.7.163 by Teddy Hogeborn
* mandos: Don't use the GnuPGInterface module.
273
        passphrase = self.password_encode(password)
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
274
        with tempfile.NamedTemporaryFile(
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
275
                dir=self.tempdir) as passfile:
237.7.163 by Teddy Hogeborn
* mandos: Don't use the GnuPGInterface module.
276
            passfile.write(passphrase)
277
            passfile.flush()
237.7.353 by Teddy Hogeborn
Use GnuPG 2 if available
278
            proc = subprocess.Popen([self.gpg, '--decrypt',
237.7.163 by Teddy Hogeborn
* mandos: Don't use the GnuPGInterface module.
279
                                     '--passphrase-file',
280
                                     passfile.name]
281
                                    + self.gnupgargs,
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
282
                                    stdin=subprocess.PIPE,
283
                                    stdout=subprocess.PIPE,
284
                                    stderr=subprocess.PIPE)
285
            decrypted_plaintext, err = proc.communicate(input=data)
237.7.163 by Teddy Hogeborn
* mandos: Don't use the GnuPGInterface module.
286
        if proc.returncode != 0:
287
            raise PGPError(err)
237.14.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
288
        return decrypted_plaintext
289
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
290
237.7.376 by Teddy Hogeborn
Server: Add Python 3 compatibility
291
# Pretend that we have an Avahi module
237.7.702 by Teddy Hogeborn
Simplification of Python 3 compatibility code
292
class avahi:
237.7.636 by Teddy Hogeborn
mandos: Refactor; use classes, not instances, as namespaces
293
    """This isn't so much a class as it is a module-like namespace."""
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
294
    IF_UNSPEC = -1               # avahi-common/address.h
295
    PROTO_UNSPEC = -1            # avahi-common/address.h
296
    PROTO_INET = 0               # avahi-common/address.h
297
    PROTO_INET6 = 1              # avahi-common/address.h
237.7.376 by Teddy Hogeborn
Server: Add Python 3 compatibility
298
    DBUS_NAME = "org.freedesktop.Avahi"
299
    DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"
300
    DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"
301
    DBUS_PATH_SERVER = "/"
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
302
237.7.636 by Teddy Hogeborn
mandos: Refactor; use classes, not instances, as namespaces
303
    @staticmethod
304
    def string_array_to_txt_array(t):
237.7.376 by Teddy Hogeborn
Server: Add Python 3 compatibility
305
        return dbus.Array((dbus.ByteArray(s.encode("utf-8"))
306
                           for s in t), signature="ay")
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
307
    ENTRY_GROUP_ESTABLISHED = 2  # avahi-common/defs.h
308
    ENTRY_GROUP_COLLISION = 3    # avahi-common/defs.h
309
    ENTRY_GROUP_FAILURE = 4      # avahi-common/defs.h
310
    SERVER_INVALID = 0           # avahi-common/defs.h
311
    SERVER_REGISTERING = 1       # avahi-common/defs.h
312
    SERVER_RUNNING = 2           # avahi-common/defs.h
313
    SERVER_COLLISION = 3         # avahi-common/defs.h
314
    SERVER_FAILURE = 4           # avahi-common/defs.h
237.14.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
315
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
316
28 by Teddy Hogeborn
* server.conf: New file.
317
class AvahiError(Exception):
237.2.5 by Teddy Hogeborn
* mandos (AvahiError): Converted to use unicode. All users changed.
318
    def __init__(self, value, *args, **kwargs):
28 by Teddy Hogeborn
* server.conf: New file.
319
        self.value = value
237.7.277 by Teddy Hogeborn
mandos: Stop using str() and remove unnecessary unicode() calls.
320
        return super(AvahiError, self).__init__(value, *args,
321
                                                **kwargs)
28 by Teddy Hogeborn
* server.conf: New file.
322
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
323
28 by Teddy Hogeborn
* server.conf: New file.
324
class AvahiServiceError(AvahiError):
325
    pass
326
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
327
28 by Teddy Hogeborn
* server.conf: New file.
328
class AvahiGroupError(AvahiError):
329
    pass
330
331
237.7.702 by Teddy Hogeborn
Simplification of Python 3 compatibility code
332
class AvahiService:
45 by Teddy Hogeborn
* server.py: Cosmetic changes.
333
    """An Avahi (Zeroconf) service.
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
334
45 by Teddy Hogeborn
* server.py: Cosmetic changes.
335
    Attributes:
28 by Teddy Hogeborn
* server.conf: New file.
336
    interface: integer; avahi.IF_UNSPEC or an interface index.
337
               Used to optionally bind to the specified interface.
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
338
    name: string; Example: 'Mandos'
339
    type: string; Example: '_mandos._tcp'.
237.7.162 by Teddy Hogeborn
* mandos: Comment changes.
340
     See <https://www.iana.org/assignments/service-names-port-numbers>
45 by Teddy Hogeborn
* server.py: Cosmetic changes.
341
    port: integer; what port to announce
342
    TXT: list of strings; TXT record for the service
343
    domain: string; Domain to publish on, default to .local if empty.
344
    host: string; Host to publish records for, default is localhost
345
    max_renames: integer; maximum number of renames
346
    rename_count: integer; counter so we only rename after collisions
347
                  a sensible number of times
237.2.99 by Teddy Hogeborn
Code cleanup.
348
    group: D-Bus Entry Group
349
    server: D-Bus Server
237.2.101 by Teddy Hogeborn
* mandos: Minor doc string fixes.
350
    bus: dbus.SystemBus()
28 by Teddy Hogeborn
* server.conf: New file.
351
    """
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
352
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
353
    def __init__(self,
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
354
                 interface=avahi.IF_UNSPEC,
355
                 name=None,
356
                 servicetype=None,
357
                 port=None,
358
                 TXT=None,
359
                 domain="",
360
                 host="",
361
                 max_renames=32768,
362
                 protocol=avahi.PROTO_UNSPEC,
363
                 bus=None):
28 by Teddy Hogeborn
* server.conf: New file.
364
        self.interface = interface
365
        self.name = name
215 by Teddy Hogeborn
* mandos: Remove unused "select" module. Import "ctypes.util".
366
        self.type = servicetype
28 by Teddy Hogeborn
* server.conf: New file.
367
        self.port = port
237.1.2 by Teddy Hogeborn
Further steps towards a D-Bus server interface, plus minor syntax
368
        self.TXT = TXT if TXT is not None else []
28 by Teddy Hogeborn
* server.conf: New file.
369
        self.domain = domain
370
        self.host = host
371
        self.rename_count = 0
76 by Teddy Hogeborn
* plugins.d/password-request.c (init_gnutls_global): Renamed
372
        self.max_renames = max_renames
237.2.77 by Teddy Hogeborn
Support not using IPv6 in server:
373
        self.protocol = protocol
237.2.99 by Teddy Hogeborn
Code cleanup.
374
        self.group = None       # our entry group
375
        self.server = None
237.2.100 by Teddy Hogeborn
Code cleanup. Move some global stuff into main.
376
        self.bus = bus
237.7.30 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
377
        self.entry_group_state_changed_match = None
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
378
237.7.286 by Teddy Hogeborn
Handle local Zeroconf service name collisions.
379
    def rename(self, remove=True):
28 by Teddy Hogeborn
* server.conf: New file.
380
        """Derived from the Avahi example code"""
381
        if self.rename_count >= self.max_renames:
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
382
            logger.critical("No suitable Zeroconf service name found"
383
                            " after %i retries, exiting.",
215 by Teddy Hogeborn
* mandos: Remove unused "select" module. Import "ctypes.util".
384
                            self.rename_count)
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
385
            raise AvahiServiceError("Too many renames")
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
386
        self.name = str(
387
            self.server.GetAlternativeServiceName(self.name))
237.7.286 by Teddy Hogeborn
Handle local Zeroconf service name collisions.
388
        self.rename_count += 1
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
389
        logger.info("Changing Zeroconf service name to %r ...",
24.1.155 by Björn Påhlsson
mandos server: Added debuglevel that adjust at what level information
390
                    self.name)
237.7.286 by Teddy Hogeborn
Handle local Zeroconf service name collisions.
391
        if remove:
392
            self.remove()
24.1.160 by Björn Påhlsson
fixed bug with local name collisions after a non-local name collision
393
        try:
394
            self.add()
237.7.30 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
395
        except dbus.exceptions.DBusException as error:
237.7.286 by Teddy Hogeborn
Handle local Zeroconf service name collisions.
396
            if (error.get_dbus_name()
397
                == "org.freedesktop.Avahi.CollisionError"):
398
                logger.info("Local Zeroconf service name collision.")
399
                return self.rename(remove=False)
400
            else:
401
                logger.critical("D-Bus Exception", exc_info=error)
402
                self.cleanup()
403
                os._exit(1)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
404
28 by Teddy Hogeborn
* server.conf: New file.
405
    def remove(self):
406
        """Derived from the Avahi example code"""
237.7.30 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
407
        if self.entry_group_state_changed_match is not None:
408
            self.entry_group_state_changed_match.remove()
409
            self.entry_group_state_changed_match = None
237.7.31 by Teddy Hogeborn
* mandos: Never call .Reset() on a defunct Avahi entry group.
410
        if self.group is not None:
411
            self.group.Reset()
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
412
28 by Teddy Hogeborn
* server.conf: New file.
413
    def add(self):
414
        """Derived from the Avahi example code"""
237.7.30 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
415
        self.remove()
237.7.31 by Teddy Hogeborn
* mandos: Never call .Reset() on a defunct Avahi entry group.
416
        if self.group is None:
417
            self.group = dbus.Interface(
418
                self.bus.get_object(avahi.DBUS_NAME,
419
                                    self.server.EntryGroupNew()),
420
                avahi.DBUS_INTERFACE_ENTRY_GROUP)
237.7.30 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
421
        self.entry_group_state_changed_match = (
422
            self.group.connect_to_signal(
237.11.20 by Teddy Hogeborn
* Makefile (run-server): Remove obsolete warning.
423
                'StateChanged', self.entry_group_state_changed))
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
424
        logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
237.2.99 by Teddy Hogeborn
Code cleanup.
425
                     self.name, self.type)
426
        self.group.AddService(
427
            self.interface,
428
            self.protocol,
429
            dbus.UInt32(0),     # flags
430
            self.name, self.type,
431
            self.domain, self.host,
432
            dbus.UInt16(self.port),
433
            avahi.string_array_to_txt_array(self.TXT))
434
        self.group.Commit()
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
435
237.2.99 by Teddy Hogeborn
Code cleanup.
436
    def entry_group_state_changed(self, state, error):
437
        """Derived from the Avahi example code"""
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
438
        logger.debug("Avahi entry group state change: %i", state)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
439
237.2.99 by Teddy Hogeborn
Code cleanup.
440
        if state == avahi.ENTRY_GROUP_ESTABLISHED:
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
441
            logger.debug("Zeroconf service established.")
237.2.99 by Teddy Hogeborn
Code cleanup.
442
        elif state == avahi.ENTRY_GROUP_COLLISION:
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
443
            logger.info("Zeroconf service name collision.")
237.2.99 by Teddy Hogeborn
Code cleanup.
444
            self.rename()
445
        elif state == avahi.ENTRY_GROUP_FAILURE:
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
446
            logger.critical("Avahi: Error in group state changed %s",
237.7.278 by Teddy Hogeborn
mandos: Replace unicode() with str().
447
                            str(error))
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
448
            raise AvahiGroupError("State changed: {!s}".format(error))
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
449
237.2.99 by Teddy Hogeborn
Code cleanup.
450
    def cleanup(self):
451
        """Derived from the Avahi example code"""
237.7.31 by Teddy Hogeborn
* mandos: Never call .Reset() on a defunct Avahi entry group.
452
        if self.group is not None:
453
            try:
454
                self.group.Free()
455
            except (dbus.exceptions.UnknownMethodException,
237.12.5 by Björn Påhlsson
First run of python-lint. Fixed some *obviously* bad code and turned
456
                    dbus.exceptions.DBusException):
237.7.31 by Teddy Hogeborn
* mandos: Never call .Reset() on a defunct Avahi entry group.
457
                pass
458
            self.group = None
237.7.30 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
459
        self.remove()
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
460
237.7.30 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
461
    def server_state_changed(self, state, error=None):
237.2.99 by Teddy Hogeborn
Code cleanup.
462
        """Derived from the Avahi example code"""
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
463
        logger.debug("Avahi server state change: %i", state)
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
464
        bad_states = {
465
            avahi.SERVER_INVALID: "Zeroconf server invalid",
466
            avahi.SERVER_REGISTERING: None,
467
            avahi.SERVER_COLLISION: "Zeroconf server name collision",
468
            avahi.SERVER_FAILURE: "Zeroconf server failure",
469
        }
237.7.30 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
470
        if state in bad_states:
237.7.31 by Teddy Hogeborn
* mandos: Never call .Reset() on a defunct Avahi entry group.
471
            if bad_states[state] is not None:
472
                if error is None:
473
                    logger.error(bad_states[state])
474
                else:
475
                    logger.error(bad_states[state] + ": %r", error)
476
            self.cleanup()
237.2.99 by Teddy Hogeborn
Code cleanup.
477
        elif state == avahi.SERVER_RUNNING:
237.7.317 by Teddy Hogeborn
Handle local Zeroconf service name collisions on startup, too.
478
            try:
479
                self.add()
480
            except dbus.exceptions.DBusException as error:
481
                if (error.get_dbus_name()
482
                    == "org.freedesktop.Avahi.CollisionError"):
483
                    logger.info("Local Zeroconf service name"
484
                                " collision.")
485
                    return self.rename(remove=False)
486
                else:
487
                    logger.critical("D-Bus Exception", exc_info=error)
488
                    self.cleanup()
489
                    os._exit(1)
237.7.30 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
490
        else:
237.7.31 by Teddy Hogeborn
* mandos: Never call .Reset() on a defunct Avahi entry group.
491
            if error is None:
492
                logger.debug("Unknown state: %r", state)
493
            else:
494
                logger.debug("Unknown state: %r: %r", state, error)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
495
237.2.99 by Teddy Hogeborn
Code cleanup.
496
    def activate(self):
497
        """Derived from the Avahi example code"""
498
        if self.server is None:
499
            self.server = dbus.Interface(
237.2.100 by Teddy Hogeborn
Code cleanup. Move some global stuff into main.
500
                self.bus.get_object(avahi.DBUS_NAME,
237.7.30 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
501
                                    avahi.DBUS_PATH_SERVER,
502
                                    follow_name_owner_changes=True),
237.2.99 by Teddy Hogeborn
Code cleanup.
503
                avahi.DBUS_INTERFACE_SERVER)
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
504
        self.server.connect_to_signal("StateChanged",
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
505
                                      self.server_state_changed)
237.2.99 by Teddy Hogeborn
Code cleanup.
506
        self.server_state_changed(self.server.GetState())
237.2.1 by Teddy Hogeborn
First version of a somewhat complete D-Bus server interface. Also
507
237.7.130 by Teddy Hogeborn
* mandos (IPv6_TCPServer.server_bind): Bug fix: handle non-existing
508
237.11.20 by Teddy Hogeborn
* Makefile (run-server): Remove obsolete warning.
509
class AvahiServiceToSyslog(AvahiService):
237.7.286 by Teddy Hogeborn
Handle local Zeroconf service name collisions.
510
    def rename(self, *args, **kwargs):
237.11.20 by Teddy Hogeborn
* Makefile (run-server): Remove obsolete warning.
511
        """Add the new name to the syslog messages"""
237.7.474 by Teddy Hogeborn
Server bug fix: Correct bad argument list
512
        ret = super(AvahiServiceToSyslog, self).rename(*args, **kwargs)
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
513
        syslogger.setFormatter(logging.Formatter(
514
            'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
515
            .format(self.name)))
237.11.20 by Teddy Hogeborn
* Makefile (run-server): Remove obsolete warning.
516
        return ret
237.2.1 by Teddy Hogeborn
First version of a somewhat complete D-Bus server interface. Also
517
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
518
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
519
# Pretend that we have a GnuTLS module
237.7.702 by Teddy Hogeborn
Simplification of Python 3 compatibility code
520
class gnutls:
237.7.636 by Teddy Hogeborn
mandos: Refactor; use classes, not instances, as namespaces
521
    """This isn't so much a class as it is a module-like namespace."""
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
522
237.7.423 by Teddy Hogeborn
Fix bug where mandos server could not find GnuTLS library
523
    library = ctypes.util.find_library("gnutls")
524
    if library is None:
525
        library = ctypes.util.find_library("gnutls-deb0")
526
    _library = ctypes.cdll.LoadLibrary(library)
527
    del library
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
528
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
529
    # Unless otherwise indicated, the constants and types below are
530
    # all from the gnutls/gnutls.h C header file.
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
531
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
532
    # Constants
533
    E_SUCCESS = 0
237.7.350 by Teddy Hogeborn
Handle GnuTLS errors and partial sends in gnutls "module".
534
    E_INTERRUPTED = -52
535
    E_AGAIN = -28
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
536
    CRT_OPENPGP = 2
237.7.510 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
537
    CRT_RAWPK = 3
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
538
    CLIENT = 2
539
    SHUT_RDWR = 0
540
    CRD_CERTIFICATE = 1
541
    E_NO_CERTIFICATE_FOUND = -49
237.7.510 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
542
    X509_FMT_DER = 0
543
    NO_TICKETS = 1<<10
544
    ENABLE_RAWPK = 1<<18
545
    CTYPE_PEERS = 3
546
    KEYID_USE_SHA256 = 1        # gnutls/x509.h
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
547
    OPENPGP_FMT_RAW = 0         # gnutls/openpgp.h
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
548
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
549
    # Types
550
    class session_int(ctypes.Structure):
551
        _fields_ = []
552
    session_t = ctypes.POINTER(session_int)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
553
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
554
    class certificate_credentials_st(ctypes.Structure):
555
        _fields_ = []
556
    certificate_credentials_t = ctypes.POINTER(
557
        certificate_credentials_st)
558
    certificate_type_t = ctypes.c_int
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
559
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
560
    class datum_t(ctypes.Structure):
561
        _fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
562
                    ('size', ctypes.c_uint)]
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
563
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
564
    class openpgp_crt_int(ctypes.Structure):
565
        _fields_ = []
566
    openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
567
    openpgp_crt_fmt_t = ctypes.c_int  # gnutls/openpgp.h
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
568
    log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
237.7.372 by Teddy Hogeborn
Remove empty comment
569
    credentials_type_t = ctypes.c_int
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
570
    transport_ptr_t = ctypes.c_void_p
571
    close_request_t = ctypes.c_int
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
572
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
573
    # Exceptions
574
    class Error(Exception):
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
575
        def __init__(self, message=None, code=None, args=()):
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
576
            # Default usage is by a message string, but if a return
577
            # code is passed, convert it to a string with
578
            # gnutls.strerror()
237.7.350 by Teddy Hogeborn
Handle GnuTLS errors and partial sends in gnutls "module".
579
            self.code = code
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
580
            if message is None and code is not None:
237.7.636 by Teddy Hogeborn
mandos: Refactor; use classes, not instances, as namespaces
581
                message = gnutls.strerror(code)
582
            return super(gnutls.Error, self).__init__(
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
583
                message, *args)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
584
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
585
    class CertificateSecurityError(Error):
586
        pass
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
587
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
588
    # Classes
237.7.702 by Teddy Hogeborn
Simplification of Python 3 compatibility code
589
    class Credentials:
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
590
        def __init__(self):
591
            self._c_object = gnutls.certificate_credentials_t()
592
            gnutls.certificate_allocate_credentials(
593
                ctypes.byref(self._c_object))
594
            self.type = gnutls.CRD_CERTIFICATE
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
595
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
596
        def __del__(self):
597
            gnutls.certificate_free_credentials(self._c_object)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
598
237.7.702 by Teddy Hogeborn
Simplification of Python 3 compatibility code
599
    class ClientSession:
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
600
        def __init__(self, socket, credentials=None):
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
601
            self._c_object = gnutls.session_t()
237.7.510 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
602
            gnutls_flags = gnutls.CLIENT
237.7.678 by Teddy Hogeborn
Update Python 3 compatibility
603
            if gnutls.check_version(b"3.5.6"):
237.7.510 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
604
                gnutls_flags |= gnutls.NO_TICKETS
605
            if gnutls.has_rawpk:
606
                gnutls_flags |= gnutls.ENABLE_RAWPK
607
            gnutls.init(ctypes.byref(self._c_object), gnutls_flags)
608
            del gnutls_flags
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
609
            gnutls.set_default_priority(self._c_object)
610
            gnutls.transport_set_ptr(self._c_object, socket.fileno())
611
            gnutls.handshake_set_private_extensions(self._c_object,
612
                                                    True)
613
            self.socket = socket
614
            if credentials is None:
615
                credentials = gnutls.Credentials()
616
            gnutls.credentials_set(self._c_object, credentials.type,
617
                                   ctypes.cast(credentials._c_object,
618
                                               ctypes.c_void_p))
619
            self.credentials = credentials
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
620
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
621
        def __del__(self):
622
            gnutls.deinit(self._c_object)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
623
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
624
        def handshake(self):
625
            return gnutls.handshake(self._c_object)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
626
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
627
        def send(self, data):
628
            data = bytes(data)
237.7.350 by Teddy Hogeborn
Handle GnuTLS errors and partial sends in gnutls "module".
629
            data_len = len(data)
630
            while data_len > 0:
631
                data_len -= gnutls.record_send(self._c_object,
632
                                               data[-data_len:],
633
                                               data_len)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
634
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
635
        def bye(self):
636
            return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
637
237.7.350 by Teddy Hogeborn
Handle GnuTLS errors and partial sends in gnutls "module".
638
    # Error handling functions
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
639
    def _error_code(result):
640
        """A function to raise exceptions on errors, suitable
641
        for the 'restype' attribute on ctypes functions"""
642
        if result >= 0:
643
            return result
644
        if result == gnutls.E_NO_CERTIFICATE_FOUND:
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
645
            raise gnutls.CertificateSecurityError(code=result)
646
        raise gnutls.Error(code=result)
647
237.7.350 by Teddy Hogeborn
Handle GnuTLS errors and partial sends in gnutls "module".
648
    def _retry_on_error(result, func, arguments):
649
        """A function to retry on some errors, suitable
650
        for the 'errcheck' attribute on ctypes functions"""
651
        while result < 0:
652
            if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
653
                return _error_code(result)
654
            result = func(*arguments)
655
        return result
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
656
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
657
    # Unless otherwise indicated, the function declarations below are
658
    # all from the gnutls/gnutls.h C header file.
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
659
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
660
    # Functions
661
    priority_set_direct = _library.gnutls_priority_set_direct
662
    priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
663
                                    ctypes.POINTER(ctypes.c_char_p)]
664
    priority_set_direct.restype = _error_code
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
665
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
666
    init = _library.gnutls_init
667
    init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
668
    init.restype = _error_code
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
669
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
670
    set_default_priority = _library.gnutls_set_default_priority
671
    set_default_priority.argtypes = [session_t]
672
    set_default_priority.restype = _error_code
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
673
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
674
    record_send = _library.gnutls_record_send
675
    record_send.argtypes = [session_t, ctypes.c_void_p,
676
                            ctypes.c_size_t]
677
    record_send.restype = ctypes.c_ssize_t
237.7.350 by Teddy Hogeborn
Handle GnuTLS errors and partial sends in gnutls "module".
678
    record_send.errcheck = _retry_on_error
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
679
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
680
    certificate_allocate_credentials = (
681
        _library.gnutls_certificate_allocate_credentials)
682
    certificate_allocate_credentials.argtypes = [
683
        ctypes.POINTER(certificate_credentials_t)]
684
    certificate_allocate_credentials.restype = _error_code
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
685
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
686
    certificate_free_credentials = (
687
        _library.gnutls_certificate_free_credentials)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
688
    certificate_free_credentials.argtypes = [
689
        certificate_credentials_t]
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
690
    certificate_free_credentials.restype = None
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
691
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
692
    handshake_set_private_extensions = (
693
        _library.gnutls_handshake_set_private_extensions)
694
    handshake_set_private_extensions.argtypes = [session_t,
695
                                                 ctypes.c_int]
696
    handshake_set_private_extensions.restype = None
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
697
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
698
    credentials_set = _library.gnutls_credentials_set
699
    credentials_set.argtypes = [session_t, credentials_type_t,
700
                                ctypes.c_void_p]
701
    credentials_set.restype = _error_code
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
702
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
703
    strerror = _library.gnutls_strerror
704
    strerror.argtypes = [ctypes.c_int]
705
    strerror.restype = ctypes.c_char_p
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
706
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
707
    certificate_type_get = _library.gnutls_certificate_type_get
708
    certificate_type_get.argtypes = [session_t]
709
    certificate_type_get.restype = _error_code
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
710
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
711
    certificate_get_peers = _library.gnutls_certificate_get_peers
712
    certificate_get_peers.argtypes = [session_t,
713
                                      ctypes.POINTER(ctypes.c_uint)]
714
    certificate_get_peers.restype = ctypes.POINTER(datum_t)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
715
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
716
    global_set_log_level = _library.gnutls_global_set_log_level
717
    global_set_log_level.argtypes = [ctypes.c_int]
718
    global_set_log_level.restype = None
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
719
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
720
    global_set_log_function = _library.gnutls_global_set_log_function
721
    global_set_log_function.argtypes = [log_func]
722
    global_set_log_function.restype = None
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
723
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
724
    deinit = _library.gnutls_deinit
725
    deinit.argtypes = [session_t]
726
    deinit.restype = None
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
727
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
728
    handshake = _library.gnutls_handshake
729
    handshake.argtypes = [session_t]
730
    handshake.restype = _error_code
237.7.350 by Teddy Hogeborn
Handle GnuTLS errors and partial sends in gnutls "module".
731
    handshake.errcheck = _retry_on_error
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
732
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
733
    transport_set_ptr = _library.gnutls_transport_set_ptr
734
    transport_set_ptr.argtypes = [session_t, transport_ptr_t]
735
    transport_set_ptr.restype = None
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
736
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
737
    bye = _library.gnutls_bye
738
    bye.argtypes = [session_t, close_request_t]
739
    bye.restype = _error_code
237.7.350 by Teddy Hogeborn
Handle GnuTLS errors and partial sends in gnutls "module".
740
    bye.errcheck = _retry_on_error
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
741
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
742
    check_version = _library.gnutls_check_version
743
    check_version.argtypes = [ctypes.c_char_p]
744
    check_version.restype = ctypes.c_char_p
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
745
237.7.636 by Teddy Hogeborn
mandos: Refactor; use classes, not instances, as namespaces
746
    _need_version = b"3.3.0"
747
    if check_version(_need_version) is None:
748
        raise self.Error("Needs GnuTLS {} or later"
749
                         .format(_need_version))
750
751
    _tls_rawpk_version = b"3.6.6"
237.7.510 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
752
    has_rawpk = bool(check_version(_tls_rawpk_version))
753
754
    if has_rawpk:
755
        # Types
756
        class pubkey_st(ctypes.Structure):
757
            _fields = []
758
        pubkey_t = ctypes.POINTER(pubkey_st)
759
760
        x509_crt_fmt_t = ctypes.c_int
761
762
        # All the function declarations below are from gnutls/abstract.h
763
        pubkey_init = _library.gnutls_pubkey_init
764
        pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]
765
        pubkey_init.restype = _error_code
766
767
        pubkey_import = _library.gnutls_pubkey_import
768
        pubkey_import.argtypes = [pubkey_t, ctypes.POINTER(datum_t),
769
                                  x509_crt_fmt_t]
770
        pubkey_import.restype = _error_code
771
772
        pubkey_get_key_id = _library.gnutls_pubkey_get_key_id
773
        pubkey_get_key_id.argtypes = [pubkey_t, ctypes.c_int,
774
                                      ctypes.POINTER(ctypes.c_ubyte),
775
                                      ctypes.POINTER(ctypes.c_size_t)]
776
        pubkey_get_key_id.restype = _error_code
777
778
        pubkey_deinit = _library.gnutls_pubkey_deinit
779
        pubkey_deinit.argtypes = [pubkey_t]
780
        pubkey_deinit.restype = None
781
    else:
782
        # All the function declarations below are from gnutls/openpgp.h
783
784
        openpgp_crt_init = _library.gnutls_openpgp_crt_init
785
        openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
786
        openpgp_crt_init.restype = _error_code
787
788
        openpgp_crt_import = _library.gnutls_openpgp_crt_import
789
        openpgp_crt_import.argtypes = [openpgp_crt_t,
790
                                       ctypes.POINTER(datum_t),
791
                                       openpgp_crt_fmt_t]
792
        openpgp_crt_import.restype = _error_code
793
794
        openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
795
        openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
796
                                            ctypes.POINTER(ctypes.c_uint)]
797
        openpgp_crt_verify_self.restype = _error_code
798
799
        openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
800
        openpgp_crt_deinit.argtypes = [openpgp_crt_t]
801
        openpgp_crt_deinit.restype = None
802
803
        openpgp_crt_get_fingerprint = (
804
            _library.gnutls_openpgp_crt_get_fingerprint)
805
        openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
806
                                                ctypes.c_void_p,
807
                                                ctypes.POINTER(
808
                                                    ctypes.c_size_t)]
809
        openpgp_crt_get_fingerprint.restype = _error_code
810
237.7.678 by Teddy Hogeborn
Update Python 3 compatibility
811
    if check_version(b"3.6.4"):
237.7.510 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
812
        certificate_type_get2 = _library.gnutls_certificate_type_get2
813
        certificate_type_get2.argtypes = [session_t, ctypes.c_int]
814
        certificate_type_get2.restype = _error_code
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
815
237.7.350 by Teddy Hogeborn
Handle GnuTLS errors and partial sends in gnutls "module".
816
    # Remove non-public functions
817
    del _error_code, _retry_on_error
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
818
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
819
237.24.2 by Teddy Hogeborn
mandos (subprocess_call_pipe): Rename to "call_pipe" and take "func".
820
def call_pipe(connection,       # : multiprocessing.Connection
821
              func, *args, **kwargs):
237.24.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
822
    """This function is meant to be called by multiprocessing.Process
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
823
237.24.2 by Teddy Hogeborn
mandos (subprocess_call_pipe): Rename to "call_pipe" and take "func".
824
    This function runs func(*args, **kwargs), and writes the resulting
825
    return value on the provided multiprocessing.Connection.
237.24.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
826
    """
237.24.2 by Teddy Hogeborn
mandos (subprocess_call_pipe): Rename to "call_pipe" and take "func".
827
    connection.send(func(*args, **kwargs))
237.24.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
828
    connection.close()
237.7.130 by Teddy Hogeborn
* mandos (IPv6_TCPServer.server_bind): Bug fix: handle non-existing
829
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
830
237.7.702 by Teddy Hogeborn
Simplification of Python 3 compatibility code
831
class Client:
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
832
    """A representation of a client host served by this server.
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
833
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
834
    Attributes:
237.14.4 by Teddy Hogeborn
* mandos (_timedelta_to_milliseconds): Renamed to
835
    approved:   bool(); 'None' if not yet approved/disapproved
237.2.201 by Teddy Hogeborn
* mandos (Client.runtime_expansions): New attribute containing the
836
    approval_delay: datetime.timedelta(); Time to wait for approval
837
    approval_duration: datetime.timedelta(); Duration of one approval
237.7.680 by Teddy Hogeborn
Server: Reap zombies created by multiprocessing.Process()
838
    checker: multiprocessing.Process(); a running checker process used
839
             to see if the client lives. 'None' if no process is
840
             running.
237.7.378 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
841
    checker_callback_tag: a GLib event source tag, or None
237.2.201 by Teddy Hogeborn
* mandos (Client.runtime_expansions): New attribute containing the
842
    checker_command: string; External command which is run to check
843
                     if client lives.  %() expansions are done at
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
844
                     runtime with vars(self) as dict, so that for
845
                     instance %(name)s can be used in the command.
237.7.378 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
846
    checker_initiator_tag: a GLib event source tag, or None
237.2.201 by Teddy Hogeborn
* mandos (Client.runtime_expansions): New attribute containing the
847
    created:    datetime.datetime(); (UTC) object creation
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
848
    client_structure: Object describing what attributes a client has
849
                      and is used for storing the client at exit
237.2.78 by Teddy Hogeborn
* mandos (Client.current_checker_command): New attribute.
850
    current_checker_command: string; current running checker_command
237.7.378 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
851
    disable_initiator_tag: a GLib event source tag, or None
237.2.201 by Teddy Hogeborn
* mandos (Client.runtime_expansions): New attribute containing the
852
    enabled:    bool()
853
    fingerprint: string (40 or 32 hexadecimal digits); used to
237.7.510 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
854
                 uniquely identify an OpenPGP client
855
    key_id: string (64 hexadecimal digits); used to uniquely identify
856
            a client using raw public keys
237.2.201 by Teddy Hogeborn
* mandos (Client.runtime_expansions): New attribute containing the
857
    host:       string; available for use by the checker command
858
    interval:   datetime.timedelta(); How often to start a new checker
237.2.205 by Teddy Hogeborn
* DBUS-API: Document new "LastApprovalRequest" client property.
859
    last_approval_request: datetime.datetime(); (UTC) or None
237.2.201 by Teddy Hogeborn
* mandos (Client.runtime_expansions): New attribute containing the
860
    last_checked_ok: datetime.datetime(); (UTC) or None
237.7.69 by teddy at bsnet
* debian/control (mandos/Depends): Added "python-crypto".
861
    last_checker_status: integer between 0 and 255 reflecting exit
237.12.7 by Teddy Hogeborn
* mandos: Break long lines and fix some more white space.
862
                         status of last checker. -1 reflects crashed
237.7.104 by Teddy Hogeborn
* DBUS-API (se.recompile.Mandos.Client.LastCheckerStatus): New
863
                         checker, -2 means no checker completed yet.
237.24.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
864
    last_checker_signal: The signal which killed the last checker, if
865
                         last_checker_status is -1
237.14.3 by Teddy Hogeborn
Make "enabled" a client config option.
866
    last_enabled: datetime.datetime(); (UTC) or None
237.2.201 by Teddy Hogeborn
* mandos (Client.runtime_expansions): New attribute containing the
867
    name:       string; from the config file, used in log messages and
868
                        D-Bus identifiers
869
    secret:     bytestring; sent verbatim (over TLS) to client
870
    timeout:    datetime.timedelta(); How long from last_checked_ok
871
                                      until this client is disabled
237.7.100 by teddy at recompile
* mandos: Consistent terminology; use the term "secret" for the
872
    extended_timeout:   extra long timeout when secret has been sent
237.2.201 by Teddy Hogeborn
* mandos (Client.runtime_expansions): New attribute containing the
873
    runtime_expansions: Allowed attributes for runtime expansion.
237.7.45 by Teddy Hogeborn
* DBUS-API: Document new "Expires" and "ExtendedTimeout" properties.
874
    expires:    datetime.datetime(); time (UTC) when a client will be
24.1.179 by Björn Påhlsson
New feature:
875
                disabled, or None
237.7.165 by Teddy Hogeborn
* mandos: Bug fix: Don't print output from checkers when running in
876
    server_settings: The server_settings dict from main()
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
877
    """
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
878
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
879
    runtime_expansions = ("approval_delay", "approval_duration",
237.7.510 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
880
                          "created", "enabled", "expires", "key_id",
237.7.132 by Teddy Hogeborn
* mandos (Client.runtime_expansions): Add "expires" and (bug fix)
881
                          "fingerprint", "host", "interval",
882
                          "last_approval_request", "last_checked_ok",
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
883
                          "last_enabled", "name", "timeout")
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
884
    client_defaults = {
885
        "timeout": "PT5M",
886
        "extended_timeout": "PT15M",
887
        "interval": "PT2M",
888
        "checker": "fping -q -- %%(host)s",
889
        "host": "",
890
        "approval_delay": "PT0S",
891
        "approval_duration": "PT1S",
892
        "approved_by_default": "True",
893
        "enabled": "True",
894
    }
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
895
237.12.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
896
    @staticmethod
897
    def config_parser(config):
237.7.90 by Björn Påhlsson
fixed bug with bad stored config state for expires and last_checked_ok.
898
        """Construct a new dict of client settings of this form:
237.12.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
899
        { client_name: {setting_name: value, ...}, ...}
237.7.90 by Björn Påhlsson
fixed bug with bad stored config state for expires and last_checked_ok.
900
        with exceptions for any special settings as defined above.
901
        NOTE: Must be a pure function. Must return the same result
902
        value given the same arguments.
903
        """
237.12.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
904
        settings = {}
905
        for client_name in config.sections():
906
            section = dict(config.items(client_name))
907
            client = settings[client_name] = {}
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
908
237.12.15 by Björn Påhlsson
more refactoring in regards to how clients get created
909
            client["host"] = section["host"]
237.12.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
910
            # Reformat values from string types to Python types
911
            client["approved_by_default"] = config.getboolean(
912
                client_name, "approved_by_default")
237.7.91 by Teddy Hogeborn
* mandos: Break some long lines.
913
            client["enabled"] = config.getboolean(client_name,
914
                                                  "enabled")
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
915
237.7.510 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
916
            # Uppercase and remove spaces from key_id and fingerprint
917
            # for later comparison purposes with return value from the
918
            # key_id() and fingerprint() functions
919
            client["key_id"] = (section.get("key_id", "").upper()
920
                                .replace(" ", ""))
237.12.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
921
            client["fingerprint"] = (section["fingerprint"].upper()
922
                                     .replace(" ", ""))
923
            if "secret" in section:
237.7.376 by Teddy Hogeborn
Server: Add Python 3 compatibility
924
                client["secret"] = codecs.decode(section["secret"]
925
                                                 .encode("utf-8"),
926
                                                 "base64")
237.12.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
927
            elif "secfile" in section:
928
                with open(os.path.expanduser(os.path.expandvars
929
                                             (section["secfile"])),
930
                          "rb") as secfile:
931
                    client["secret"] = secfile.read()
932
            else:
237.23.5 by Teddy Hogeborn
Use the new auto-numbered "{}" syntax for the .format() string method.
933
                raise TypeError("No secret or secfile for section {}"
237.7.116 by Teddy Hogeborn
* mandos-monitor: Use new string format method.
934
                                .format(section))
237.12.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
935
            client["timeout"] = string_to_delta(section["timeout"])
936
            client["extended_timeout"] = string_to_delta(
937
                section["extended_timeout"])
938
            client["interval"] = string_to_delta(section["interval"])
939
            client["approval_delay"] = string_to_delta(
940
                section["approval_delay"])
941
            client["approval_duration"] = string_to_delta(
942
                section["approval_duration"])
237.12.15 by Björn Påhlsson
more refactoring in regards to how clients get created
943
            client["checker_command"] = section["checker"]
944
            client["last_approval_request"] = None
945
            client["last_checked_ok"] = None
237.7.104 by Teddy Hogeborn
* DBUS-API (se.recompile.Mandos.Client.LastCheckerStatus): New
946
            client["last_checker_status"] = -2
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
947
237.12.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
948
        return settings
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
949
950
    def __init__(self, settings, name=None, server_settings=None):
237.2.6 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
951
        self.name = name
237.7.165 by Teddy Hogeborn
* mandos: Bug fix: Don't print output from checkers when running in
952
        if server_settings is None:
953
            server_settings = {}
954
        self.server_settings = server_settings
237.12.15 by Björn Påhlsson
more refactoring in regards to how clients get created
955
        # adding all client settings
237.23.4 by Teddy Hogeborn
Use the .items() method instead of .iteritems().
956
        for setting, value in settings.items():
237.12.15 by Björn Påhlsson
more refactoring in regards to how clients get created
957
            setattr(self, setting, value)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
958
237.7.90 by Björn Påhlsson
fixed bug with bad stored config state for expires and last_checked_ok.
959
        if self.enabled:
960
            if not hasattr(self, "last_enabled"):
961
                self.last_enabled = datetime.datetime.utcnow()
962
            if not hasattr(self, "expires"):
963
                self.expires = (datetime.datetime.utcnow()
964
                                + self.timeout)
965
        else:
966
            self.last_enabled = None
967
            self.expires = None
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
968
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
969
        logger.debug("Creating client %r", self.name)
237.7.510 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
970
        logger.debug("  Key ID: %s", self.key_id)
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
971
        logger.debug("  Fingerprint: %s", self.fingerprint)
237.7.91 by Teddy Hogeborn
* mandos: Break some long lines.
972
        self.created = settings.get("created",
973
                                    datetime.datetime.utcnow())
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
974
237.12.15 by Björn Påhlsson
more refactoring in regards to how clients get created
975
        # attributes specific for this server instance
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
976
        self.checker = None
977
        self.checker_initiator_tag = None
237.2.2 by Teddy Hogeborn
* mandos (_datetime_to_dbus_struct): Renamed to "_datetime_to_dbus";
978
        self.disable_initiator_tag = None
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
979
        self.checker_callback_tag = None
237.2.78 by Teddy Hogeborn
* mandos (Client.current_checker_command): New attribute.
980
        self.current_checker_command = None
237.14.4 by Teddy Hogeborn
* mandos (_timedelta_to_milliseconds): Renamed to
981
        self.approved = None
24.1.150 by Björn Påhlsson
* mandos: Added ClientDBus.approve_pending property. Exposed
982
        self.approvals_pending = 0
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
983
        self.changedstate = multiprocessing_manager.Condition(
984
            multiprocessing_manager.Lock())
985
        self.client_structure = [attr
237.7.376 by Teddy Hogeborn
Server: Add Python 3 compatibility
986
                                 for attr in self.__dict__.keys()
237.7.69 by teddy at bsnet
* debian/control (mandos/Depends): Added "python-crypto".
987
                                 if not attr.startswith("_")]
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
988
        self.client_structure.append("client_structure")
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
989
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
990
        for name, t in inspect.getmembers(
991
                type(self), lambda obj: isinstance(obj, property)):
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
992
            if not name.startswith("_"):
993
                self.client_structure.append(name)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
994
237.7.68 by Björn Påhlsson
merge persistent state
995
    # Send notice to process children that client state has changed
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
996
    def send_changedstate(self):
237.7.68 by Björn Påhlsson
merge persistent state
997
        with self.changedstate:
998
            self.changedstate.notify_all()
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
999
237.2.2 by Teddy Hogeborn
* mandos (_datetime_to_dbus_struct): Renamed to "_datetime_to_dbus";
1000
    def enable(self):
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
1001
        """Start this client's checker and timeout hooks"""
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1002
        if getattr(self, "enabled", False):
237.2.104 by Teddy Hogeborn
Code cleanup and one bug fix.
1003
            # Already enabled
1004
            return
24.1.179 by Björn Påhlsson
New feature:
1005
        self.expires = datetime.datetime.utcnow() + self.timeout
237.2.2 by Teddy Hogeborn
* mandos (_datetime_to_dbus_struct): Renamed to "_datetime_to_dbus";
1006
        self.enabled = True
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1007
        self.last_enabled = datetime.datetime.utcnow()
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
1008
        self.init_checker()
237.7.129 by Teddy Hogeborn
* mandos (Client.enable, Client.disable, ClientDBus.approve): Call
1009
        self.send_changedstate()
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1010
237.2.165 by Teddy Hogeborn
* mandos (Client.disable): Rename keyword argument "log" to "quiet",
1011
    def disable(self, quiet=True):
237.2.2 by Teddy Hogeborn
* mandos (_datetime_to_dbus_struct): Renamed to "_datetime_to_dbus";
1012
        """Disable this client."""
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1013
        if not getattr(self, "enabled", False):
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
1014
            return False
237.2.165 by Teddy Hogeborn
* mandos (Client.disable): Rename keyword argument "log" to "quiet",
1015
        if not quiet:
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1016
            logger.info("Disabling client %s", self.name)
237.7.129 by Teddy Hogeborn
* mandos (Client.enable, Client.disable, ClientDBus.approve): Call
1017
        if getattr(self, "disable_initiator_tag", None) is not None:
237.7.378 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
1018
            GLib.source_remove(self.disable_initiator_tag)
237.2.2 by Teddy Hogeborn
* mandos (_datetime_to_dbus_struct): Renamed to "_datetime_to_dbus";
1019
            self.disable_initiator_tag = None
24.1.179 by Björn Påhlsson
New feature:
1020
        self.expires = None
237.7.129 by Teddy Hogeborn
* mandos (Client.enable, Client.disable, ClientDBus.approve): Call
1021
        if getattr(self, "checker_initiator_tag", None) is not None:
237.7.378 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
1022
            GLib.source_remove(self.checker_initiator_tag)
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
1023
            self.checker_initiator_tag = None
1024
        self.stop_checker()
237.2.2 by Teddy Hogeborn
* mandos (_datetime_to_dbus_struct): Renamed to "_datetime_to_dbus";
1025
        self.enabled = False
237.7.129 by Teddy Hogeborn
* mandos (Client.enable, Client.disable, ClientDBus.approve): Call
1026
        if not quiet:
1027
            self.send_changedstate()
237.7.378 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
1028
        # Do not run this again if called by a GLib.timeout_add
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
1029
        return False
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1030
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
1031
    def __del__(self):
237.2.2 by Teddy Hogeborn
* mandos (_datetime_to_dbus_struct): Renamed to "_datetime_to_dbus";
1032
        self.disable()
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1033
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
1034
    def init_checker(self):
1035
        # Schedule a new checker to be started an 'interval' from now,
1036
        # and every interval from then on.
237.7.129 by Teddy Hogeborn
* mandos (Client.enable, Client.disable, ClientDBus.approve): Call
1037
        if self.checker_initiator_tag is not None:
237.7.378 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
1038
            GLib.source_remove(self.checker_initiator_tag)
1039
        self.checker_initiator_tag = GLib.timeout_add(
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1040
            int(self.interval.total_seconds() * 1000),
1041
            self.start_checker)
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
1042
        # Schedule a disable() when 'timeout' has passed
237.7.129 by Teddy Hogeborn
* mandos (Client.enable, Client.disable, ClientDBus.approve): Call
1043
        if self.disable_initiator_tag is not None:
237.7.378 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
1044
            GLib.source_remove(self.disable_initiator_tag)
1045
        self.disable_initiator_tag = GLib.timeout_add(
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1046
            int(self.timeout.total_seconds() * 1000), self.disable)
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
1047
        # Also start a new checker *right now*.
1048
        self.start_checker()
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1049
237.7.304 by Teddy Hogeborn
Merge change to use multiprocessing module to run checkers.
1050
    def checker_callback(self, source, condition, connection,
1051
                         command):
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
1052
        """The checker has completed, so take appropriate actions."""
237.24.2 by Teddy Hogeborn
mandos (subprocess_call_pipe): Rename to "call_pipe" and take "func".
1053
        # Read return code from connection (see call_pipe)
237.24.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
1054
        returncode = connection.recv()
1055
        connection.close()
237.7.680 by Teddy Hogeborn
Server: Reap zombies created by multiprocessing.Process()
1056
        self.checker.join()
1057
        self.checker_callback_tag = None
1058
        self.checker = None
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1059
237.24.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
1060
        if returncode >= 0:
1061
            self.last_checker_status = returncode
1062
            self.last_checker_signal = None
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
1063
            if self.last_checker_status == 0:
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1064
                logger.info("Checker for %(name)s succeeded",
237.2.43 by Teddy Hogeborn
* mandos (Client.CheckerCompleted): Changed signature to "nxs"; return
1065
                            vars(self))
237.2.44 by Teddy Hogeborn
* mandos (Client.bump_timeout): Renamed to "checked_ok". All callers
1066
                self.checked_ok()
237.2.43 by Teddy Hogeborn
* mandos (Client.CheckerCompleted): Changed signature to "nxs"; return
1067
            else:
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1068
                logger.info("Checker for %(name)s failed", vars(self))
237.2.43 by Teddy Hogeborn
* mandos (Client.CheckerCompleted): Changed signature to "nxs"; return
1069
        else:
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
1070
            self.last_checker_status = -1
237.24.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
1071
            self.last_checker_signal = -returncode
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1072
            logger.warning("Checker for %(name)s crashed?",
13 by Björn Påhlsson
Added following support:
1073
                           vars(self))
237.24.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
1074
        return False
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1075
237.7.104 by Teddy Hogeborn
* DBUS-API (se.recompile.Mandos.Client.LastCheckerStatus): New
1076
    def checked_ok(self):
1077
        """Assert that the client has been seen, alive and well."""
1078
        self.last_checked_ok = datetime.datetime.utcnow()
1079
        self.last_checker_status = 0
237.24.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
1080
        self.last_checker_signal = None
237.7.104 by Teddy Hogeborn
* DBUS-API (se.recompile.Mandos.Client.LastCheckerStatus): New
1081
        self.bump_timeout()
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1082
237.7.104 by Teddy Hogeborn
* DBUS-API (se.recompile.Mandos.Client.LastCheckerStatus): New
1083
    def bump_timeout(self, timeout=None):
1084
        """Bump up the timeout for this client."""
24.1.179 by Björn Påhlsson
New feature:
1085
        if timeout is None:
1086
            timeout = self.timeout
237.11.17 by Teddy Hogeborn
* mandos (Client.checked_ok): Bug fix: Handle disabled client.
1087
        if self.disable_initiator_tag is not None:
237.7.378 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
1088
            GLib.source_remove(self.disable_initiator_tag)
237.7.129 by Teddy Hogeborn
* mandos (Client.enable, Client.disable, ClientDBus.approve): Call
1089
            self.disable_initiator_tag = None
237.11.17 by Teddy Hogeborn
* mandos (Client.checked_ok): Bug fix: Handle disabled client.
1090
        if getattr(self, "enabled", False):
237.7.378 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
1091
            self.disable_initiator_tag = GLib.timeout_add(
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1092
                int(timeout.total_seconds() * 1000), self.disable)
237.11.17 by Teddy Hogeborn
* mandos (Client.checked_ok): Bug fix: Handle disabled client.
1093
            self.expires = datetime.datetime.utcnow() + timeout
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1094
237.2.205 by Teddy Hogeborn
* DBUS-API: Document new "LastApprovalRequest" client property.
1095
    def need_approval(self):
1096
        self.last_approval_request = datetime.datetime.utcnow()
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1097
9 by Teddy Hogeborn
* client.cpp (main): Get t_old early since it is used on error exits.
1098
    def start_checker(self):
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
1099
        """Start a new checker subprocess if one is not running.
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1100
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
1101
        If a checker already exists, leave it running and do
1102
        nothing."""
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
1103
        # The reason for not killing a running checker is that if we
237.7.125 by Teddy Hogeborn
* mandos (Client.start_checker): Reworded comment.
1104
        # did that, and if a checker (for some reason) started running
1105
        # slowly and taking more than 'interval' time, then the client
1106
        # would inevitably timeout, since no checker would get a
1107
        # chance to run to completion.  If we instead leave running
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
1108
        # checkers alone, the checker would have to take more time
237.2.174 by Teddy Hogeborn
More consistent terminology: Clients are no longer "invalid" - they
1109
        # than 'timeout' for the client to be disabled, which is as it
1110
        # should be.
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1111
237.24.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
1112
        if self.checker is not None and not self.checker.is_alive():
1113
            logger.warning("Checker was not alive; joining")
1114
            self.checker.join()
1115
            self.checker = None
237.2.78 by Teddy Hogeborn
* mandos (Client.current_checker_command): New attribute.
1116
        # Start a new checker if needed
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
1117
        if self.checker is None:
237.7.131 by Teddy Hogeborn
* mandos (Client.start_checker): Remove undocumented support for "%%s"
1118
            # Escape attributes for the shell
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1119
            escaped_attrs = {
1120
                attr: re.escape(str(getattr(self, attr)))
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1121
                for attr in self.runtime_expansions}
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
1122
            try:
237.7.131 by Teddy Hogeborn
* mandos (Client.start_checker): Remove undocumented support for "%%s"
1123
                command = self.checker_command % escaped_attrs
1124
            except TypeError as error:
1125
                logger.error('Could not format string "%s"',
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1126
                             self.checker_command,
1127
                             exc_info=error)
1128
                return True     # Try again later
237.2.91 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1129
            self.current_checker_command = command
237.24.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
1130
            logger.info("Starting checker %r for %s", command,
1131
                        self.name)
1132
            # We don't need to redirect stdout and stderr, since
1133
            # in normal mode, that is already done by daemon(),
1134
            # and in debug mode we don't want to.  (Stdin is
1135
            # always replaced by /dev/null.)
1136
            # The exception is when not debugging but nevertheless
1137
            # running in the foreground; use the previously
1138
            # created wnull.
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1139
            popen_args = {"close_fds": True,
1140
                          "shell": True,
1141
                          "cwd": "/"}
237.24.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
1142
            if (not self.server_settings["debug"]
1143
                and self.server_settings["foreground"]):
1144
                popen_args.update({"stdout": wnull,
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1145
                                   "stderr": wnull})
1146
            pipe = multiprocessing.Pipe(duplex=False)
237.24.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
1147
            self.checker = multiprocessing.Process(
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1148
                target=call_pipe,
1149
                args=(pipe[1], subprocess.call, command),
1150
                kwargs=popen_args)
237.24.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
1151
            self.checker.start()
237.7.378 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
1152
            self.checker_callback_tag = GLib.io_add_watch(
237.7.715 by Teddy Hogeborn
Server: Use new GLib.io_add_watch() call signature
1153
                pipe[0].fileno(), GLib.PRIORITY_DEFAULT, GLib.IO_IN,
237.7.304 by Teddy Hogeborn
Merge change to use multiprocessing module to run checkers.
1154
                self.checker_callback, pipe[0], command)
237.7.378 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
1155
        # Re-run this periodically if run by GLib.timeout_add
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
1156
        return True
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1157
9 by Teddy Hogeborn
* client.cpp (main): Get t_old early since it is used on error exits.
1158
    def stop_checker(self):
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
1159
        """Force the checker process, if any, to stop."""
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
1160
        if self.checker_callback_tag:
237.7.378 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
1161
            GLib.source_remove(self.checker_callback_tag)
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
1162
            self.checker_callback_tag = None
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1163
        if getattr(self, "checker", None) is None:
9 by Teddy Hogeborn
* client.cpp (main): Get t_old early since it is used on error exits.
1164
            return
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1165
        logger.debug("Stopping checker for %(name)s", vars(self))
237.24.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
1166
        self.checker.terminate()
9 by Teddy Hogeborn
* client.cpp (main): Get t_old early since it is used on error exits.
1167
        self.checker = None
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
1168
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
1169
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1170
def dbus_service_property(dbus_interface,
1171
                          signature="v",
1172
                          access="readwrite",
1173
                          byte_arrays=False):
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1174
    """Decorators for marking methods of a DBusObjectWithProperties to
1175
    become properties on the D-Bus.
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1176
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1177
    The decorated method will be called with no arguments by "Get"
1178
    and with one argument by "Set".
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1179
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1180
    The parameters, where they are supported, are the same as
1181
    dbus.service.method, except there is only "signature", since the
1182
    type from Get() and the type sent to Set() is the same.
1183
    """
237.2.174 by Teddy Hogeborn
More consistent terminology: Clients are no longer "invalid" - they
1184
    # Encoding deeply encoded byte arrays is not supported yet by the
1185
    # "Set" method, so we fail early here:
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1186
    if byte_arrays and signature != "ay":
1187
        raise ValueError("Byte arrays not supported for non-'ay'"
237.23.5 by Teddy Hogeborn
Use the new auto-numbered "{}" syntax for the .format() string method.
1188
                         " signature {!r}".format(signature))
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1189
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1190
    def decorator(func):
1191
        func._dbus_is_property = True
1192
        func._dbus_interface = dbus_interface
1193
        func._dbus_signature = signature
1194
        func._dbus_access = access
1195
        func._dbus_name = func.__name__
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1196
        if func._dbus_name.endswith("_dbus_property"):
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1197
            func._dbus_name = func._dbus_name[:-14]
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1198
        func._dbus_get_args_options = {'byte_arrays': byte_arrays}
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1199
        return func
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1200
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1201
    return decorator
1202
1203
237.18.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
1204
def dbus_interface_annotations(dbus_interface):
237.7.121 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
1205
    """Decorator for marking functions returning interface annotations
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1206
237.18.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
1207
    Usage:
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1208
237.18.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
1209
    @dbus_interface_annotations("org.example.Interface")
1210
    def _foo(self):  # Function name does not matter
1211
        return {"org.freedesktop.DBus.Deprecated": "true",
1212
                "org.freedesktop.DBus.Property.EmitsChangedSignal":
1213
                    "false"}
1214
    """
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1215
237.18.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
1216
    def decorator(func):
1217
        func._dbus_is_interface = True
1218
        func._dbus_interface = dbus_interface
1219
        func._dbus_name = dbus_interface
1220
        return func
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1221
237.18.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
1222
    return decorator
1223
1224
237.19.1 by Teddy Hogeborn
Add D-Bus annotations support to methods, signals and properties.
1225
def dbus_annotations(annotations):
1226
    """Decorator to annotate D-Bus methods, signals or properties
1227
    Usage:
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1228
237.7.280 by Teddy Hogeborn
Emit D-Bus "org.freedesktop.DBus.Properties.PropertiesChanged" signal.
1229
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",
1230
                       "org.freedesktop.DBus.Property."
1231
                       "EmitsChangedSignal": "false"})
237.19.1 by Teddy Hogeborn
Add D-Bus annotations support to methods, signals and properties.
1232
    @dbus_service_property("org.example.Interface", signature="b",
1233
                           access="r")
1234
    def Property_dbus_property(self):
1235
        return dbus.Boolean(False)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1236
237.7.332 by Teddy Hogeborn
Refactor D-Bus annotation class out from D-Bus properties class.
1237
    See also the DBusObjectWithAnnotations class.
237.19.1 by Teddy Hogeborn
Add D-Bus annotations support to methods, signals and properties.
1238
    """
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1239
237.19.1 by Teddy Hogeborn
Add D-Bus annotations support to methods, signals and properties.
1240
    def decorator(func):
1241
        func._dbus_annotations = annotations
1242
        return func
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1243
237.19.1 by Teddy Hogeborn
Add D-Bus annotations support to methods, signals and properties.
1244
    return decorator
1245
1246
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1247
class DBusPropertyException(dbus.exceptions.DBusException):
1248
    """A base class for D-Bus property-related exceptions
1249
    """
237.7.277 by Teddy Hogeborn
mandos: Stop using str() and remove unnecessary unicode() calls.
1250
    pass
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1251
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1252
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1253
class DBusPropertyAccessException(DBusPropertyException):
1254
    """A property's access permissions disallows an operation.
1255
    """
1256
    pass
1257
1258
1259
class DBusPropertyNotFound(DBusPropertyException):
1260
    """An attempt was made to access a non-existing property.
1261
    """
1262
    pass
1263
1264
237.7.332 by Teddy Hogeborn
Refactor D-Bus annotation class out from D-Bus properties class.
1265
class DBusObjectWithAnnotations(dbus.service.Object):
1266
    """A D-Bus object with annotations.
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1267
237.7.332 by Teddy Hogeborn
Refactor D-Bus annotation class out from D-Bus properties class.
1268
    Classes inheriting from this can use the dbus_annotations
1269
    decorator to add annotations to methods or signals.
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1270
    """
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1271
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1272
    @staticmethod
237.18.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
1273
    def _is_dbus_thing(thing):
1274
        """Returns a function testing if an attribute is a D-Bus thing
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1275
237.18.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
1276
        If called like _is_dbus_thing("method") it returns a function
1277
        suitable for use as predicate to inspect.getmembers().
1278
        """
237.23.5 by Teddy Hogeborn
Use the new auto-numbered "{}" syntax for the .format() string method.
1279
        return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
237.18.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
1280
                                   False)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1281
237.18.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
1282
    def _get_all_dbus_things(self, thing):
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1283
        """Returns a generator of (name, attribute) pairs
1284
        """
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1285
        return ((getattr(athing.__get__(self), "_dbus_name", name),
237.18.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
1286
                 athing.__get__(self))
24.1.186 by Björn Påhlsson
transitional stuff actually working
1287
                for cls in self.__class__.__mro__
237.18.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
1288
                for name, athing in
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1289
                inspect.getmembers(cls, self._is_dbus_thing(thing)))
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1290
237.7.332 by Teddy Hogeborn
Refactor D-Bus annotation class out from D-Bus properties class.
1291
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1292
                         out_signature="s",
1293
                         path_keyword='object_path',
1294
                         connection_keyword='connection')
237.7.332 by Teddy Hogeborn
Refactor D-Bus annotation class out from D-Bus properties class.
1295
    def Introspect(self, object_path, connection):
1296
        """Overloading of standard D-Bus method.
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1297
237.7.332 by Teddy Hogeborn
Refactor D-Bus annotation class out from D-Bus properties class.
1298
        Inserts annotation tags on methods and signals.
1299
        """
1300
        xmlstring = dbus.service.Object.Introspect(self, object_path,
1301
                                                   connection)
1302
        try:
1303
            document = xml.dom.minidom.parseString(xmlstring)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1304
237.7.332 by Teddy Hogeborn
Refactor D-Bus annotation class out from D-Bus properties class.
1305
            for if_tag in document.getElementsByTagName("interface"):
1306
                # Add annotation tags
1307
                for typ in ("method", "signal"):
1308
                    for tag in if_tag.getElementsByTagName(typ):
1309
                        annots = dict()
1310
                        for name, prop in (self.
1311
                                           _get_all_dbus_things(typ)):
1312
                            if (name == tag.getAttribute("name")
1313
                                and prop._dbus_interface
1314
                                == if_tag.getAttribute("name")):
1315
                                annots.update(getattr(
1316
                                    prop, "_dbus_annotations", {}))
1317
                        for name, value in annots.items():
1318
                            ann_tag = document.createElement(
1319
                                "annotation")
1320
                            ann_tag.setAttribute("name", name)
1321
                            ann_tag.setAttribute("value", value)
1322
                            tag.appendChild(ann_tag)
1323
                # Add interface annotation tags
1324
                for annotation, value in dict(
1325
                    itertools.chain.from_iterable(
1326
                        annotations().items()
1327
                        for name, annotations
1328
                        in self._get_all_dbus_things("interface")
1329
                        if name == if_tag.getAttribute("name")
1330
                        )).items():
1331
                    ann_tag = document.createElement("annotation")
1332
                    ann_tag.setAttribute("name", annotation)
1333
                    ann_tag.setAttribute("value", value)
1334
                    if_tag.appendChild(ann_tag)
1335
                # Fix argument name for the Introspect method itself
1336
                if (if_tag.getAttribute("name")
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1337
                    == dbus.INTROSPECTABLE_IFACE):
237.7.332 by Teddy Hogeborn
Refactor D-Bus annotation class out from D-Bus properties class.
1338
                    for cn in if_tag.getElementsByTagName("method"):
1339
                        if cn.getAttribute("name") == "Introspect":
1340
                            for arg in cn.getElementsByTagName("arg"):
1341
                                if (arg.getAttribute("direction")
1342
                                    == "out"):
1343
                                    arg.setAttribute("name",
1344
                                                     "xml_data")
1345
            xmlstring = document.toxml("utf-8")
1346
            document.unlink()
1347
        except (AttributeError, xml.dom.DOMException,
1348
                xml.parsers.expat.ExpatError) as error:
1349
            logger.error("Failed to override Introspection method",
1350
                         exc_info=error)
1351
        return xmlstring
1352
1353
1354
class DBusObjectWithProperties(DBusObjectWithAnnotations):
1355
    """A D-Bus object with properties.
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1356
237.7.332 by Teddy Hogeborn
Refactor D-Bus annotation class out from D-Bus properties class.
1357
    Classes inheriting from this can use the dbus_service_property
1358
    decorator to expose methods as D-Bus properties.  It exposes the
1359
    standard Get(), Set(), and GetAll() methods on the D-Bus.
1360
    """
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1361
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1362
    def _get_dbus_property(self, interface_name, property_name):
1363
        """Returns a bound method if one exists which is a D-Bus
1364
        property with the specified name and interface.
1365
        """
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1366
        for cls in self.__class__.__mro__:
1367
            for name, value in inspect.getmembers(
1368
                    cls, self._is_dbus_thing("property")):
237.11.3 by Teddy Hogeborn
* mandos: Break long lines.
1369
                if (value._dbus_name == property_name
1370
                    and value._dbus_interface == interface_name):
24.1.186 by Björn Påhlsson
transitional stuff actually working
1371
                    return value.__get__(self)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1372
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1373
        # No such property
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1374
        raise DBusPropertyNotFound("{}:{}.{}".format(
1375
            self.dbus_object_path, interface_name, property_name))
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1376
237.7.333 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
1377
    @classmethod
1378
    def _get_all_interface_names(cls):
1379
        """Get a sequence of all interfaces supported by an object"""
1380
        return (name for name in set(getattr(getattr(x, attr),
1381
                                             "_dbus_interface", None)
1382
                                     for x in (inspect.getmro(cls))
1383
                                     for attr in dir(x))
1384
                if name is not None)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1385
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1386
    @dbus.service.method(dbus.PROPERTIES_IFACE,
1387
                         in_signature="ss",
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1388
                         out_signature="v")
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1389
    def Get(self, interface_name, property_name):
1390
        """Standard D-Bus property Get() method, see D-Bus standard.
1391
        """
1392
        prop = self._get_dbus_property(interface_name, property_name)
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1393
        if prop._dbus_access == "write":
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1394
            raise DBusPropertyAccessException(property_name)
1395
        value = prop()
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1396
        if not hasattr(value, "variant_level"):
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1397
            return value
1398
        return type(value)(value, variant_level=value.variant_level+1)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1399
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1400
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1401
    def Set(self, interface_name, property_name, value):
1402
        """Standard D-Bus property Set() method, see D-Bus standard.
1403
        """
1404
        prop = self._get_dbus_property(interface_name, property_name)
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1405
        if prop._dbus_access == "read":
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1406
            raise DBusPropertyAccessException(property_name)
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1407
        if prop._dbus_get_args_options["byte_arrays"]:
237.2.174 by Teddy Hogeborn
More consistent terminology: Clients are no longer "invalid" - they
1408
            # The byte_arrays option is not supported yet on
1409
            # signatures other than "ay".
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1410
            if prop._dbus_signature != "ay":
237.7.197 by Teddy Hogeborn
Minor code fix; raise only exception instances, not classes.
1411
                raise ValueError("Byte arrays not supported for non-"
237.23.5 by Teddy Hogeborn
Use the new auto-numbered "{}" syntax for the .format() string method.
1412
                                 "'ay' signature {!r}"
237.7.197 by Teddy Hogeborn
Minor code fix; raise only exception instances, not classes.
1413
                                 .format(prop._dbus_signature))
237.7.94 by Teddy Hogeborn
* debian/rules (binary-common): Exclude network-hooks.d from
1414
            value = dbus.ByteArray(b''.join(chr(byte)
1415
                                            for byte in value))
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1416
        prop(value)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1417
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1418
    @dbus.service.method(dbus.PROPERTIES_IFACE,
1419
                         in_signature="s",
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1420
                         out_signature="a{sv}")
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1421
    def GetAll(self, interface_name):
1422
        """Standard D-Bus property GetAll() method, see D-Bus
1423
        standard.
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1424
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1425
        Note: Will not include properties with access="write".
1426
        """
237.12.5 by Björn Påhlsson
First run of python-lint. Fixed some *obviously* bad code and turned
1427
        properties = {}
237.18.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
1428
        for name, prop in self._get_all_dbus_things("property"):
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1429
            if (interface_name
1430
                and interface_name != prop._dbus_interface):
1431
                # Interface non-empty but did not match
1432
                continue
1433
            # Ignore write-only properties
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1434
            if prop._dbus_access == "write":
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1435
                continue
1436
            value = prop()
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1437
            if not hasattr(value, "variant_level"):
237.12.5 by Björn Påhlsson
First run of python-lint. Fixed some *obviously* bad code and turned
1438
                properties[name] = value
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1439
                continue
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1440
            properties[name] = type(value)(
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1441
                value, variant_level=value.variant_level + 1)
237.12.5 by Björn Påhlsson
First run of python-lint. Fixed some *obviously* bad code and turned
1442
        return dbus.Dictionary(properties, signature="sv")
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1443
237.7.280 by Teddy Hogeborn
Emit D-Bus "org.freedesktop.DBus.Properties.PropertiesChanged" signal.
1444
    @dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")
1445
    def PropertiesChanged(self, interface_name, changed_properties,
1446
                          invalidated_properties):
1447
        """Standard D-Bus PropertiesChanged() signal, see D-Bus
1448
        standard.
1449
        """
1450
        pass
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1451
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1452
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1453
                         out_signature="s",
1454
                         path_keyword='object_path',
1455
                         connection_keyword='connection')
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1456
    def Introspect(self, object_path, connection):
237.18.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
1457
        """Overloading of standard D-Bus method.
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1458
237.18.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
1459
        Inserts property tags and interface annotation tags.
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1460
        """
237.7.332 by Teddy Hogeborn
Refactor D-Bus annotation class out from D-Bus properties class.
1461
        xmlstring = DBusObjectWithAnnotations.Introspect(self,
1462
                                                         object_path,
1463
                                                         connection)
237.2.150 by Teddy Hogeborn
* mandos (ClientDBus.ReceivedSecret): Renamed to "GotSecret". All
1464
        try:
1465
            document = xml.dom.minidom.parseString(xmlstring)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1466
237.2.150 by Teddy Hogeborn
* mandos (ClientDBus.ReceivedSecret): Renamed to "GotSecret". All
1467
            def make_tag(document, name, prop):
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1468
                e = document.createElement("property")
1469
                e.setAttribute("name", name)
1470
                e.setAttribute("type", prop._dbus_signature)
1471
                e.setAttribute("access", prop._dbus_access)
237.2.150 by Teddy Hogeborn
* mandos (ClientDBus.ReceivedSecret): Renamed to "GotSecret". All
1472
                return e
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1473
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1474
            for if_tag in document.getElementsByTagName("interface"):
237.18.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
1475
                # Add property tags
237.2.150 by Teddy Hogeborn
* mandos (ClientDBus.ReceivedSecret): Renamed to "GotSecret". All
1476
                for tag in (make_tag(document, name, prop)
1477
                            for name, prop
237.18.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
1478
                            in self._get_all_dbus_things("property")
237.2.150 by Teddy Hogeborn
* mandos (ClientDBus.ReceivedSecret): Renamed to "GotSecret". All
1479
                            if prop._dbus_interface
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1480
                            == if_tag.getAttribute("name")):
237.2.150 by Teddy Hogeborn
* mandos (ClientDBus.ReceivedSecret): Renamed to "GotSecret". All
1481
                    if_tag.appendChild(tag)
237.7.332 by Teddy Hogeborn
Refactor D-Bus annotation class out from D-Bus properties class.
1482
                # Add annotation tags for properties
1483
                for tag in if_tag.getElementsByTagName("property"):
1484
                    annots = dict()
1485
                    for name, prop in self._get_all_dbus_things(
1486
                            "property"):
1487
                        if (name == tag.getAttribute("name")
1488
                            and prop._dbus_interface
1489
                            == if_tag.getAttribute("name")):
1490
                            annots.update(getattr(
1491
                                prop, "_dbus_annotations", {}))
1492
                    for name, value in annots.items():
1493
                        ann_tag = document.createElement(
1494
                            "annotation")
1495
                        ann_tag.setAttribute("name", name)
1496
                        ann_tag.setAttribute("value", value)
1497
                        tag.appendChild(ann_tag)
237.2.150 by Teddy Hogeborn
* mandos (ClientDBus.ReceivedSecret): Renamed to "GotSecret". All
1498
                # Add the names to the return values for the
1499
                # "org.freedesktop.DBus.Properties" methods
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1500
                if (if_tag.getAttribute("name")
1501
                    == "org.freedesktop.DBus.Properties"):
1502
                    for cn in if_tag.getElementsByTagName("method"):
1503
                        if cn.getAttribute("name") == "Get":
1504
                            for arg in cn.getElementsByTagName("arg"):
1505
                                if (arg.getAttribute("direction")
1506
                                    == "out"):
1507
                                    arg.setAttribute("name", "value")
1508
                        elif cn.getAttribute("name") == "GetAll":
1509
                            for arg in cn.getElementsByTagName("arg"):
1510
                                if (arg.getAttribute("direction")
1511
                                    == "out"):
1512
                                    arg.setAttribute("name", "props")
1513
            xmlstring = document.toxml("utf-8")
237.2.150 by Teddy Hogeborn
* mandos (ClientDBus.ReceivedSecret): Renamed to "GotSecret". All
1514
            document.unlink()
1515
        except (AttributeError, xml.dom.DOMException,
237.7.30 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
1516
                xml.parsers.expat.ExpatError) as error:
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1517
            logger.error("Failed to override Introspection method",
237.7.113 by Teddy Hogeborn
* mandos (AvahiService.rename, Client.start_checker,
1518
                         exc_info=error)
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1519
        return xmlstring
1520
237.7.436 by Teddy Hogeborn
Add more PEP8 compliance (as per the "pycodestyle" tool).
1521
237.7.333 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
1522
try:
1523
    dbus.OBJECT_MANAGER_IFACE
1524
except AttributeError:
1525
    dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
1526
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1527
237.7.333 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
1528
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
1529
    """A D-Bus object with an ObjectManager.
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1530
237.7.333 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
1531
    Classes inheriting from this exposes the standard
1532
    GetManagedObjects call and the InterfacesAdded and
1533
    InterfacesRemoved signals on the standard
1534
    "org.freedesktop.DBus.ObjectManager" interface.
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1535
237.7.333 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
1536
    Note: No signals are sent automatically; they must be sent
1537
    manually.
1538
    """
1539
    @dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1540
                         out_signature="a{oa{sa{sv}}}")
237.7.333 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
1541
    def GetManagedObjects(self):
1542
        """This function must be overridden"""
1543
        raise NotImplementedError()
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1544
237.7.333 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
1545
    @dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1546
                         signature="oa{sa{sv}}")
237.7.333 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
1547
    def InterfacesAdded(self, object_path, interfaces_and_properties):
1548
        pass
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1549
1550
    @dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature="oas")
237.7.333 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
1551
    def InterfacesRemoved(self, object_path, interfaces):
1552
        pass
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1553
237.7.333 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
1554
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1555
                         out_signature="s",
1556
                         path_keyword='object_path',
1557
                         connection_keyword='connection')
237.7.333 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
1558
    def Introspect(self, object_path, connection):
1559
        """Overloading of standard D-Bus method.
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1560
237.7.333 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
1561
        Override return argument name of GetManagedObjects to be
1562
        "objpath_interfaces_and_properties"
1563
        """
237.7.334 by Teddy Hogeborn
Server Bug fix: Make D-Bus introspection work again.
1564
        xmlstring = DBusObjectWithAnnotations.Introspect(self,
1565
                                                         object_path,
1566
                                                         connection)
237.7.333 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
1567
        try:
1568
            document = xml.dom.minidom.parseString(xmlstring)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1569
237.7.333 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
1570
            for if_tag in document.getElementsByTagName("interface"):
1571
                # Fix argument name for the GetManagedObjects method
1572
                if (if_tag.getAttribute("name")
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1573
                    == dbus.OBJECT_MANAGER_IFACE):
237.7.333 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
1574
                    for cn in if_tag.getElementsByTagName("method"):
1575
                        if (cn.getAttribute("name")
1576
                            == "GetManagedObjects"):
1577
                            for arg in cn.getElementsByTagName("arg"):
1578
                                if (arg.getAttribute("direction")
1579
                                    == "out"):
1580
                                    arg.setAttribute(
1581
                                        "name",
1582
                                        "objpath_interfaces"
1583
                                        "_and_properties")
1584
            xmlstring = document.toxml("utf-8")
1585
            document.unlink()
1586
        except (AttributeError, xml.dom.DOMException,
1587
                xml.parsers.expat.ExpatError) as error:
1588
            logger.error("Failed to override Introspection method",
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1589
                         exc_info=error)
237.7.333 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
1590
        return xmlstring
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1591
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1592
237.7.135 by Teddy Hogeborn
* Makefile (DOCBOOKTOMAN): Only run man --warnings if both "man" and
1593
def datetime_to_dbus(dt, variant_level=0):
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1594
    """Convert a UTC datetime.datetime() to a D-Bus type."""
1595
    if dt is None:
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1596
        return dbus.String("", variant_level=variant_level)
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1597
    return dbus.String(dt.isoformat(), variant_level=variant_level)
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1598
237.12.6 by Teddy Hogeborn
* mandos: Fix whitespace.
1599
237.7.123 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1600
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
1601
    """A class decorator; applied to a subclass of
1602
    dbus.service.Object, it will add alternate D-Bus attributes with
1603
    interface names according to the "alt_interface_names" mapping.
1604
    Usage:
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1605
237.7.135 by Teddy Hogeborn
* Makefile (DOCBOOKTOMAN): Only run man --warnings if both "man" and
1606
    @alternate_dbus_interfaces({"org.example.Interface":
1607
                                    "net.example.AlternateInterface"})
237.7.123 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1608
    class SampleDBusObject(dbus.service.Object):
1609
        @dbus.service.method("org.example.Interface")
1610
        def SampleDBusMethod():
1611
            pass
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1612
237.7.123 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1613
    The above "SampleDBusMethod" on "SampleDBusObject" will be
1614
    reachable via two interfaces: "org.example.Interface" and
1615
    "net.example.AlternateInterface", the latter of which will have
1616
    its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
1617
    "true", unless "deprecate" is passed with a False value.
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1618
237.7.123 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1619
    This works for methods and signals, and also for D-Bus properties
1620
    (from DBusObjectWithProperties) and interfaces (from the
1621
    dbus_interface_annotations decorator).
237.11.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1622
    """
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1623
237.7.123 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1624
    def wrapper(cls):
1625
        for orig_interface_name, alt_interface_name in (
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1626
                alt_interface_names.items()):
237.7.123 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1627
            attr = {}
1628
            interface_names = set()
1629
            # Go though all attributes of the class
1630
            for attrname, attribute in inspect.getmembers(cls):
237.11.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1631
                # Ignore non-D-Bus attributes, and D-Bus attributes
1632
                # with the wrong interface name
1633
                if (not hasattr(attribute, "_dbus_interface")
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1634
                    or not attribute._dbus_interface.startswith(
1635
                        orig_interface_name)):
237.11.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1636
                    continue
1637
                # Create an alternate D-Bus interface name based on
1638
                # the current name
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1639
                alt_interface = attribute._dbus_interface.replace(
1640
                    orig_interface_name, alt_interface_name)
237.7.123 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1641
                interface_names.add(alt_interface)
237.11.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1642
                # Is this a D-Bus signal?
1643
                if getattr(attribute, "_dbus_is_signal", False):
237.7.376 by Teddy Hogeborn
Server: Add Python 3 compatibility
1644
                    # Extract the original non-method undecorated
1645
                    # function by black magic
237.7.304 by Teddy Hogeborn
Merge change to use multiprocessing module to run checkers.
1646
                    if sys.version_info.major == 2:
237.7.302 by Teddy Hogeborn
mandos: More Python 3 fixes.
1647
                        nonmethod_func = (dict(
1648
                            zip(attribute.func_code.co_freevars,
1649
                                attribute.__closure__))
1650
                                          ["func"].cell_contents)
1651
                    else:
237.7.376 by Teddy Hogeborn
Server: Add Python 3 compatibility
1652
                        nonmethod_func = (dict(
1653
                            zip(attribute.__code__.co_freevars,
1654
                                attribute.__closure__))
1655
                                          ["func"].cell_contents)
237.11.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1656
                    # Create a new, but exactly alike, function
1657
                    # object, and decorate it to be a new D-Bus signal
1658
                    # with the alternate D-Bus interface name
237.7.376 by Teddy Hogeborn
Server: Add Python 3 compatibility
1659
                    new_function = copy_function(nonmethod_func)
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1660
                    new_function = (dbus.service.signal(
237.7.302 by Teddy Hogeborn
mandos: More Python 3 fixes.
1661
                        alt_interface,
1662
                        attribute._dbus_signature)(new_function))
237.19.1 by Teddy Hogeborn
Add D-Bus annotations support to methods, signals and properties.
1663
                    # Copy annotations, if any
1664
                    try:
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1665
                        new_function._dbus_annotations = dict(
1666
                            attribute._dbus_annotations)
237.19.1 by Teddy Hogeborn
Add D-Bus annotations support to methods, signals and properties.
1667
                    except AttributeError:
1668
                        pass
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1669
237.11.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1670
                    # Define a creator of a function to call both the
237.7.123 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1671
                    # original and alternate functions, so both the
1672
                    # original and alternate signals gets sent when
1673
                    # the function is called
237.11.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1674
                    def fixscope(func1, func2):
1675
                        """This function is a scope container to pass
1676
                        func1 and func2 to the "call_both" function
1677
                        outside of its arguments"""
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1678
237.7.334 by Teddy Hogeborn
Server Bug fix: Make D-Bus introspection work again.
1679
                        @functools.wraps(func2)
237.11.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1680
                        def call_both(*args, **kwargs):
1681
                            """This function will emit two D-Bus
1682
                            signals by calling func1 and func2"""
1683
                            func1(*args, **kwargs)
1684
                            func2(*args, **kwargs)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1685
                        # Make wrapper function look like a D-Bus
1686
                        # signal
237.7.334 by Teddy Hogeborn
Server Bug fix: Make D-Bus introspection work again.
1687
                        for name, attr in inspect.getmembers(func2):
1688
                            if name.startswith("_dbus_"):
1689
                                setattr(call_both, name, attr)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1690
237.11.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1691
                        return call_both
1692
                    # Create the "call_both" function and add it to
1693
                    # the class
237.7.123 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1694
                    attr[attrname] = fixscope(attribute, new_function)
237.11.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1695
                # Is this a D-Bus method?
1696
                elif getattr(attribute, "_dbus_is_method", False):
1697
                    # Create a new, but exactly alike, function
1698
                    # object.  Decorate it to be a new D-Bus method
1699
                    # with the alternate D-Bus interface name.  Add it
1700
                    # to the class.
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1701
                    attr[attrname] = (
1702
                        dbus.service.method(
1703
                            alt_interface,
1704
                            attribute._dbus_in_signature,
1705
                            attribute._dbus_out_signature)
237.7.376 by Teddy Hogeborn
Server: Add Python 3 compatibility
1706
                        (copy_function(attribute)))
237.19.1 by Teddy Hogeborn
Add D-Bus annotations support to methods, signals and properties.
1707
                    # Copy annotations, if any
1708
                    try:
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1709
                        attr[attrname]._dbus_annotations = dict(
1710
                            attribute._dbus_annotations)
237.19.1 by Teddy Hogeborn
Add D-Bus annotations support to methods, signals and properties.
1711
                    except AttributeError:
1712
                        pass
237.11.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1713
                # Is this a D-Bus property?
1714
                elif getattr(attribute, "_dbus_is_property", False):
1715
                    # Create a new, but exactly alike, function
1716
                    # object, and decorate it to be a new D-Bus
1717
                    # property with the alternate D-Bus interface
1718
                    # name.  Add it to the class.
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1719
                    attr[attrname] = (dbus_service_property(
1720
                        alt_interface, attribute._dbus_signature,
1721
                        attribute._dbus_access,
1722
                        attribute._dbus_get_args_options
1723
                        ["byte_arrays"])
237.7.376 by Teddy Hogeborn
Server: Add Python 3 compatibility
1724
                                      (copy_function(attribute)))
237.19.1 by Teddy Hogeborn
Add D-Bus annotations support to methods, signals and properties.
1725
                    # Copy annotations, if any
1726
                    try:
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1727
                        attr[attrname]._dbus_annotations = dict(
1728
                            attribute._dbus_annotations)
237.19.1 by Teddy Hogeborn
Add D-Bus annotations support to methods, signals and properties.
1729
                    except AttributeError:
1730
                        pass
237.18.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
1731
                # Is this a D-Bus interface?
1732
                elif getattr(attribute, "_dbus_is_interface", False):
1733
                    # Create a new, but exactly alike, function
1734
                    # object.  Decorate it to be a new D-Bus interface
1735
                    # with the alternate D-Bus interface name.  Add it
1736
                    # to the class.
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1737
                    attr[attrname] = (
1738
                        dbus_interface_annotations(alt_interface)
237.7.376 by Teddy Hogeborn
Server: Add Python 3 compatibility
1739
                        (copy_function(attribute)))
237.7.123 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1740
            if deprecate:
1741
                # Deprecate all alternate interfaces
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1742
                iname = "_AlternateDBusNames_interface_annotation{}"
237.7.123 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1743
                for interface_name in interface_names:
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1744
237.7.123 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1745
                    @dbus_interface_annotations(interface_name)
1746
                    def func(self):
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1747
                        return {"org.freedesktop.DBus.Deprecated":
1748
                                "true"}
237.7.123 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1749
                    # Find an unused name
1750
                    for aname in (iname.format(i)
1751
                                  for i in itertools.count()):
1752
                        if aname not in attr:
1753
                            attr[aname] = func
1754
                            break
1755
            if interface_names:
1756
                # Replace the class with a new subclass of it with
1757
                # methods, signals, etc. as created above.
237.7.376 by Teddy Hogeborn
Server: Add Python 3 compatibility
1758
                if sys.version_info.major == 2:
1759
                    cls = type(b"{}Alternate".format(cls.__name__),
1760
                               (cls, ), attr)
1761
                else:
1762
                    cls = type("{}Alternate".format(cls.__name__),
1763
                               (cls, ), attr)
237.7.123 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1764
        return cls
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1765
237.7.123 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1766
    return wrapper
1767
1768
1769
@alternate_dbus_interfaces({"se.recompile.Mandos":
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1770
                            "se.bsnet.fukt.Mandos"})
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1771
class ClientDBus(Client, DBusObjectWithProperties):
237.2.91 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1772
    """A Client class using D-Bus
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1773
237.2.91 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1774
    Attributes:
237.2.101 by Teddy Hogeborn
* mandos: Minor doc string fixes.
1775
    dbus_object_path: dbus.ObjectPath
1776
    bus: dbus.SystemBus()
237.2.91 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1777
    """
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1778
237.2.201 by Teddy Hogeborn
* mandos (Client.runtime_expansions): New attribute containing the
1779
    runtime_expansions = (Client.runtime_expansions
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1780
                          + ("dbus_object_path", ))
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1781
237.7.280 by Teddy Hogeborn
Emit D-Bus "org.freedesktop.DBus.Properties.PropertiesChanged" signal.
1782
    _interface = "se.recompile.Mandos.Client"
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1783
237.2.91 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1784
    # dbus.service.Object doesn't use super(), so we can't either.
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1785
1786
    def __init__(self, bus=None, *args, **kwargs):
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
1787
        self.bus = bus
1788
        Client.__init__(self, *args, **kwargs)
237.2.91 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1789
        # Only now, when this client is initialized, can it show up on
1790
        # the D-Bus
237.7.278 by Teddy Hogeborn
mandos: Replace unicode() with str().
1791
        client_object_name = str(self.name).translate(
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1792
            {ord("."): ord("_"),
1793
             ord("-"): ord("_")})
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1794
        self.dbus_object_path = dbus.ObjectPath(
1795
            "/clients/" + client_object_name)
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1796
        DBusObjectWithProperties.__init__(self, self.bus,
1797
                                          self.dbus_object_path)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1798
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1799
    def notifychangeproperty(transform_func, dbus_name,
1800
                             type_func=lambda x: x,
1801
                             variant_level=1,
1802
                             invalidate_only=False,
237.7.280 by Teddy Hogeborn
Emit D-Bus "org.freedesktop.DBus.Properties.PropertiesChanged" signal.
1803
                             _interface=_interface):
237.11.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1804
        """ Modify a variable so that it's a property which announces
1805
        its changes to DBus.
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1806
237.11.15 by Teddy Hogeborn
Bug fix: Make D-Bus properties settable again.
1807
        transform_fun: Function that takes a value and a variant_level
1808
                       and transforms it to a D-Bus type.
237.11.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1809
        dbus_name: D-Bus name of the variable
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1810
        type_func: Function that transform the value before sending it
237.11.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1811
                   to the D-Bus.  Default: no transform
1812
        variant_level: D-Bus variant level.  Default: 1
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1813
        """
237.23.5 by Teddy Hogeborn
Use the new auto-numbered "{}" syntax for the .format() string method.
1814
        attrname = "_{}".format(dbus_name)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1815
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1816
        def setter(self, value):
1817
            if hasattr(self, "dbus_object_path"):
237.11.6 by Teddy Hogeborn
* mandos (ClientDBus.notifychangeproperty): Bug fix: Use instance
1818
                if (not hasattr(self, attrname) or
1819
                    type_func(getattr(self, attrname, None))
1820
                    != type_func(value)):
237.7.280 by Teddy Hogeborn
Emit D-Bus "org.freedesktop.DBus.Properties.PropertiesChanged" signal.
1821
                    if invalidate_only:
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1822
                        self.PropertiesChanged(
1823
                            _interface, dbus.Dictionary(),
1824
                            dbus.Array((dbus_name, )))
237.7.280 by Teddy Hogeborn
Emit D-Bus "org.freedesktop.DBus.Properties.PropertiesChanged" signal.
1825
                    else:
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1826
                        dbus_value = transform_func(
1827
                            type_func(value),
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1828
                            variant_level=variant_level)
237.7.280 by Teddy Hogeborn
Emit D-Bus "org.freedesktop.DBus.Properties.PropertiesChanged" signal.
1829
                        self.PropertyChanged(dbus.String(dbus_name),
1830
                                             dbus_value)
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1831
                        self.PropertiesChanged(
1832
                            _interface,
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1833
                            dbus.Dictionary({dbus.String(dbus_name):
1834
                                             dbus_value}),
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1835
                            dbus.Array())
237.11.6 by Teddy Hogeborn
* mandos (ClientDBus.notifychangeproperty): Bug fix: Use instance
1836
            setattr(self, attrname, value)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1837
237.11.6 by Teddy Hogeborn
* mandos (ClientDBus.notifychangeproperty): Bug fix: Use instance
1838
        return property(lambda self: getattr(self, attrname), setter)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1839
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1840
    expires = notifychangeproperty(datetime_to_dbus, "Expires")
1841
    approvals_pending = notifychangeproperty(dbus.Boolean,
1842
                                             "ApprovalPending",
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1843
                                             type_func=bool)
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1844
    enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1845
    last_enabled = notifychangeproperty(datetime_to_dbus,
1846
                                        "LastEnabled")
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1847
    checker = notifychangeproperty(
1848
        dbus.Boolean, "CheckerRunning",
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1849
        type_func=lambda checker: checker is not None)
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1850
    last_checked_ok = notifychangeproperty(datetime_to_dbus,
1851
                                           "LastCheckedOK")
237.7.104 by Teddy Hogeborn
* DBUS-API (se.recompile.Mandos.Client.LastCheckerStatus): New
1852
    last_checker_status = notifychangeproperty(dbus.Int16,
1853
                                               "LastCheckerStatus")
237.11.3 by Teddy Hogeborn
* mandos: Break long lines.
1854
    last_approval_request = notifychangeproperty(
1855
        datetime_to_dbus, "LastApprovalRequest")
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1856
    approved_by_default = notifychangeproperty(dbus.Boolean,
1857
                                               "ApprovedByDefault")
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1858
    approval_delay = notifychangeproperty(
1859
        dbus.UInt64, "ApprovalDelay",
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1860
        type_func=lambda td: td.total_seconds() * 1000)
237.11.3 by Teddy Hogeborn
* mandos: Break long lines.
1861
    approval_duration = notifychangeproperty(
237.14.9 by Teddy Hogeborn
* mandos (ClientDBus.approval_delay, ClientDBus.approval_duration,
1862
        dbus.UInt64, "ApprovalDuration",
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1863
        type_func=lambda td: td.total_seconds() * 1000)
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1864
    host = notifychangeproperty(dbus.String, "Host")
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1865
    timeout = notifychangeproperty(
1866
        dbus.UInt64, "Timeout",
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1867
        type_func=lambda td: td.total_seconds() * 1000)
237.11.3 by Teddy Hogeborn
* mandos: Break long lines.
1868
    extended_timeout = notifychangeproperty(
237.14.9 by Teddy Hogeborn
* mandos (ClientDBus.approval_delay, ClientDBus.approval_duration,
1869
        dbus.UInt64, "ExtendedTimeout",
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1870
        type_func=lambda td: td.total_seconds() * 1000)
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1871
    interval = notifychangeproperty(
1872
        dbus.UInt64, "Interval",
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1873
        type_func=lambda td: td.total_seconds() * 1000)
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1874
    checker_command = notifychangeproperty(dbus.String, "Checker")
237.7.280 by Teddy Hogeborn
Emit D-Bus "org.freedesktop.DBus.Properties.PropertiesChanged" signal.
1875
    secret = notifychangeproperty(dbus.ByteArray, "Secret",
1876
                                  invalidate_only=True)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1877
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1878
    del notifychangeproperty
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1879
237.2.91 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1880
    def __del__(self, *args, **kwargs):
1881
        try:
1882
            self.remove_from_connection()
237.2.92 by Teddy Hogeborn
* mandos (ClientDBus.__del__): Bug fix: Correct mispasted code, and do
1883
        except LookupError:
237.2.91 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1884
            pass
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1885
        if hasattr(DBusObjectWithProperties, "__del__"):
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1886
            DBusObjectWithProperties.__del__(self, *args, **kwargs)
237.2.91 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1887
        Client.__del__(self, *args, **kwargs)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1888
237.24.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
1889
    def checker_callback(self, source, condition,
237.7.304 by Teddy Hogeborn
Merge change to use multiprocessing module to run checkers.
1890
                         connection, command, *args, **kwargs):
237.24.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
1891
        ret = Client.checker_callback(self, source, condition,
237.7.304 by Teddy Hogeborn
Merge change to use multiprocessing module to run checkers.
1892
                                      connection, command, *args,
237.24.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
1893
                                      **kwargs)
1894
        exitstatus = self.last_checker_status
1895
        if exitstatus >= 0:
237.2.91 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1896
            # Emit D-Bus signal
1897
            self.CheckerCompleted(dbus.Int16(exitstatus),
237.7.331 by Teddy Hogeborn
Revert change to D-Bus API.
1898
                                  # This is specific to GNU libC
1899
                                  dbus.Int64(exitstatus << 8),
237.2.91 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1900
                                  dbus.String(command))
1901
        else:
1902
            # Emit D-Bus signal
1903
            self.CheckerCompleted(dbus.Int16(-1),
237.24.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
1904
                                  dbus.Int64(
237.7.331 by Teddy Hogeborn
Revert change to D-Bus API.
1905
                                      # This is specific to GNU libC
1906
                                      (exitstatus << 8)
1907
                                      | self.last_checker_signal),
237.2.91 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1908
                                  dbus.String(command))
237.24.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
1909
        return ret
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1910
237.2.91 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1911
    def start_checker(self, *args, **kwargs):
237.7.206 by Teddy Hogeborn
* mandos (ClientDBus.start_checker): Removed unused variable
1912
        old_checker_pid = getattr(self.checker, "pid", None)
237.2.91 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1913
        r = Client.start_checker(self, *args, **kwargs)
237.2.92 by Teddy Hogeborn
* mandos (ClientDBus.__del__): Bug fix: Correct mispasted code, and do
1914
        # Only if new checker process was started
1915
        if (self.checker is not None
1916
            and old_checker_pid != self.checker.pid):
1917
            # Emit D-Bus signal
237.2.91 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1918
            self.CheckerStarted(self.current_checker_command)
1919
        return r
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1920
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1921
    def _reset_approved(self):
237.14.4 by Teddy Hogeborn
* mandos (_timedelta_to_milliseconds): Renamed to
1922
        self.approved = None
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1923
        return False
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1924
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1925
    def approve(self, value=True):
237.14.4 by Teddy Hogeborn
* mandos (_timedelta_to_milliseconds): Renamed to
1926
        self.approved = value
237.7.378 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
1927
        GLib.timeout_add(int(self.approval_duration.total_seconds()
1928
                             * 1000), self._reset_approved)
237.7.129 by Teddy Hogeborn
* mandos (Client.enable, Client.disable, ClientDBus.approve): Call
1929
        self.send_changedstate()
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1930
1931
    #  D-Bus methods, signals & properties
1932
1933
    #  Interfaces
1934
1935
    #  Signals
1936
237.1.2 by Teddy Hogeborn
Further steps towards a D-Bus server interface, plus minor syntax
1937
    # CheckerCompleted - signal
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1938
    @dbus.service.signal(_interface, signature="nxs")
237.2.43 by Teddy Hogeborn
* mandos (Client.CheckerCompleted): Changed signature to "nxs"; return
1939
    def CheckerCompleted(self, exitcode, waitstatus, command):
237.1.2 by Teddy Hogeborn
Further steps towards a D-Bus server interface, plus minor syntax
1940
        "D-Bus signal"
1941
        pass
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1942
237.1.2 by Teddy Hogeborn
Further steps towards a D-Bus server interface, plus minor syntax
1943
    # CheckerStarted - signal
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1944
    @dbus.service.signal(_interface, signature="s")
237.1.2 by Teddy Hogeborn
Further steps towards a D-Bus server interface, plus minor syntax
1945
    def CheckerStarted(self, command):
1946
        "D-Bus signal"
1947
        pass
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1948
237.2.1 by Teddy Hogeborn
First version of a somewhat complete D-Bus server interface. Also
1949
    # PropertyChanged - signal
237.7.280 by Teddy Hogeborn
Emit D-Bus "org.freedesktop.DBus.Properties.PropertiesChanged" signal.
1950
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1951
    @dbus.service.signal(_interface, signature="sv")
237.2.1 by Teddy Hogeborn
First version of a somewhat complete D-Bus server interface. Also
1952
    def PropertyChanged(self, property, value):
1953
        "D-Bus signal"
1954
        pass
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1955
237.2.150 by Teddy Hogeborn
* mandos (ClientDBus.ReceivedSecret): Renamed to "GotSecret". All
1956
    # GotSecret - signal
237.2.90 by Teddy Hogeborn
Merge from pipe IPC branch.
1957
    @dbus.service.signal(_interface)
237.2.150 by Teddy Hogeborn
* mandos (ClientDBus.ReceivedSecret): Renamed to "GotSecret". All
1958
    def GotSecret(self):
24.1.155 by Björn Påhlsson
mandos server: Added debuglevel that adjust at what level information
1959
        """D-Bus signal
1960
        Is sent after a successful transfer of secret from the Mandos
1961
        server to mandos-client
1962
        """
24.2.4 by teddy at bsnet
* mandos (ClientDBus.approvals_pending): Changed to be a property
1963
        pass
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1964
237.2.90 by Teddy Hogeborn
Merge from pipe IPC branch.
1965
    # Rejected - signal
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1966
    @dbus.service.signal(_interface, signature="s")
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1967
    def Rejected(self, reason):
1968
        "D-Bus signal"
24.2.4 by teddy at bsnet
* mandos (ClientDBus.approvals_pending): Changed to be a property
1969
        pass
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1970
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1971
    # NeedApproval - signal
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1972
    @dbus.service.signal(_interface, signature="tb")
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1973
    def NeedApproval(self, timeout, default):
237.2.90 by Teddy Hogeborn
Merge from pipe IPC branch.
1974
        "D-Bus signal"
237.2.205 by Teddy Hogeborn
* DBUS-API: Document new "LastApprovalRequest" client property.
1975
        return self.need_approval()
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1976
1977
    #  Methods
1978
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1979
    # Approve - method
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1980
    @dbus.service.method(_interface, in_signature="b")
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1981
    def Approve(self, value):
1982
        self.approve(value)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1983
24.1.147 by Björn Påhlsson
The IPC pipes are now file objects, not file descriptors:
1984
    # CheckedOK - method
1985
    @dbus.service.method(_interface)
1986
    def CheckedOK(self):
237.7.30 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
1987
        self.checked_ok()
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1988
237.2.144 by Teddy Hogeborn
Restore some poor D-Bus methods who got a bit hastily deleted. Enable
1989
    # Enable - method
237.7.329 by Teddy Hogeborn
Deprecate some D-Bus methods in favor of D-Bus properties.
1990
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
237.2.144 by Teddy Hogeborn
Restore some poor D-Bus methods who got a bit hastily deleted. Enable
1991
    @dbus.service.method(_interface)
1992
    def Enable(self):
1993
        "D-Bus method"
1994
        self.enable()
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
1995
237.2.144 by Teddy Hogeborn
Restore some poor D-Bus methods who got a bit hastily deleted. Enable
1996
    # StartChecker - method
237.7.329 by Teddy Hogeborn
Deprecate some D-Bus methods in favor of D-Bus properties.
1997
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
237.2.144 by Teddy Hogeborn
Restore some poor D-Bus methods who got a bit hastily deleted. Enable
1998
    @dbus.service.method(_interface)
1999
    def StartChecker(self):
2000
        "D-Bus method"
2001
        self.start_checker()
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2002
237.2.144 by Teddy Hogeborn
Restore some poor D-Bus methods who got a bit hastily deleted. Enable
2003
    # Disable - method
237.7.329 by Teddy Hogeborn
Deprecate some D-Bus methods in favor of D-Bus properties.
2004
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
237.2.144 by Teddy Hogeborn
Restore some poor D-Bus methods who got a bit hastily deleted. Enable
2005
    @dbus.service.method(_interface)
2006
    def Disable(self):
2007
        "D-Bus method"
2008
        self.disable()
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2009
237.2.144 by Teddy Hogeborn
Restore some poor D-Bus methods who got a bit hastily deleted. Enable
2010
    # StopChecker - method
237.7.329 by Teddy Hogeborn
Deprecate some D-Bus methods in favor of D-Bus properties.
2011
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
237.2.144 by Teddy Hogeborn
Restore some poor D-Bus methods who got a bit hastily deleted. Enable
2012
    @dbus.service.method(_interface)
2013
    def StopChecker(self):
2014
        self.stop_checker()
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2015
2016
    #  Properties
2017
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2018
    # ApprovalPending - property
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2019
    @dbus_service_property(_interface, signature="b", access="read")
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2020
    def ApprovalPending_dbus_property(self):
24.2.4 by teddy at bsnet
* mandos (ClientDBus.approvals_pending): Changed to be a property
2021
        return dbus.Boolean(bool(self.approvals_pending))
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2022
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2023
    # ApprovedByDefault - property
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2024
    @dbus_service_property(_interface,
2025
                           signature="b",
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2026
                           access="readwrite")
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2027
    def ApprovedByDefault_dbus_property(self, value=None):
2028
        if value is None:       # get
2029
            return dbus.Boolean(self.approved_by_default)
2030
        self.approved_by_default = bool(value)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2031
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2032
    # ApprovalDelay - property
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2033
    @dbus_service_property(_interface,
2034
                           signature="t",
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2035
                           access="readwrite")
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2036
    def ApprovalDelay_dbus_property(self, value=None):
2037
        if value is None:       # get
237.23.6 by Teddy Hogeborn
Use the new .total_seconds() method on datetime.timedelta objects.
2038
            return dbus.UInt64(self.approval_delay.total_seconds()
2039
                               * 1000)
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2040
        self.approval_delay = datetime.timedelta(0, 0, 0, value)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2041
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2042
    # ApprovalDuration - property
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2043
    @dbus_service_property(_interface,
2044
                           signature="t",
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2045
                           access="readwrite")
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2046
    def ApprovalDuration_dbus_property(self, value=None):
2047
        if value is None:       # get
237.23.6 by Teddy Hogeborn
Use the new .total_seconds() method on datetime.timedelta objects.
2048
            return dbus.UInt64(self.approval_duration.total_seconds()
2049
                               * 1000)
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2050
        self.approval_duration = datetime.timedelta(0, 0, 0, value)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2051
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2052
    # Name - property
237.7.328 by Teddy Hogeborn
Add D-Bus annotations on a few properties on the Client object.
2053
    @dbus_annotations(
2054
        {"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2055
    @dbus_service_property(_interface, signature="s", access="read")
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2056
    def Name_dbus_property(self):
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
2057
        return dbus.String(self.name)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2058
237.7.510 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
2059
    # KeyID - property
2060
    @dbus_annotations(
2061
        {"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2062
    @dbus_service_property(_interface, signature="s", access="read")
2063
    def KeyID_dbus_property(self):
2064
        return dbus.String(self.key_id)
2065
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2066
    # Fingerprint - property
237.7.328 by Teddy Hogeborn
Add D-Bus annotations on a few properties on the Client object.
2067
    @dbus_annotations(
2068
        {"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2069
    @dbus_service_property(_interface, signature="s", access="read")
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2070
    def Fingerprint_dbus_property(self):
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
2071
        return dbus.String(self.fingerprint)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2072
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2073
    # Host - property
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2074
    @dbus_service_property(_interface,
2075
                           signature="s",
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2076
                           access="readwrite")
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2077
    def Host_dbus_property(self, value=None):
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
2078
        if value is None:       # get
2079
            return dbus.String(self.host)
237.7.278 by Teddy Hogeborn
mandos: Replace unicode() with str().
2080
        self.host = str(value)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2081
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2082
    # Created - property
237.7.328 by Teddy Hogeborn
Add D-Bus annotations on a few properties on the Client object.
2083
    @dbus_annotations(
2084
        {"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2085
    @dbus_service_property(_interface, signature="s", access="read")
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2086
    def Created_dbus_property(self):
237.14.3 by Teddy Hogeborn
Make "enabled" a client config option.
2087
        return datetime_to_dbus(self.created)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2088
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2089
    # LastEnabled - property
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2090
    @dbus_service_property(_interface, signature="s", access="read")
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2091
    def LastEnabled_dbus_property(self):
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
2092
        return datetime_to_dbus(self.last_enabled)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2093
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2094
    # Enabled - property
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2095
    @dbus_service_property(_interface,
2096
                           signature="b",
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2097
                           access="readwrite")
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2098
    def Enabled_dbus_property(self, value=None):
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
2099
        if value is None:       # get
2100
            return dbus.Boolean(self.enabled)
2101
        if value:
2102
            self.enable()
2103
        else:
2104
            self.disable()
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2105
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2106
    # LastCheckedOK - property
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2107
    @dbus_service_property(_interface,
2108
                           signature="s",
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2109
                           access="readwrite")
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2110
    def LastCheckedOK_dbus_property(self, value=None):
237.2.144 by Teddy Hogeborn
Restore some poor D-Bus methods who got a bit hastily deleted. Enable
2111
        if value is not None:
2112
            self.checked_ok()
2113
            return
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
2114
        return datetime_to_dbus(self.last_checked_ok)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2115
237.7.104 by Teddy Hogeborn
* DBUS-API (se.recompile.Mandos.Client.LastCheckerStatus): New
2116
    # LastCheckerStatus - property
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2117
    @dbus_service_property(_interface, signature="n", access="read")
237.7.104 by Teddy Hogeborn
* DBUS-API (se.recompile.Mandos.Client.LastCheckerStatus): New
2118
    def LastCheckerStatus_dbus_property(self):
2119
        return dbus.Int16(self.last_checker_status)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2120
24.1.179 by Björn Påhlsson
New feature:
2121
    # Expires - property
2122
    @dbus_service_property(_interface, signature="s", access="read")
2123
    def Expires_dbus_property(self):
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
2124
        return datetime_to_dbus(self.expires)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2125
237.2.205 by Teddy Hogeborn
* DBUS-API: Document new "LastApprovalRequest" client property.
2126
    # LastApprovalRequest - property
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2127
    @dbus_service_property(_interface, signature="s", access="read")
237.2.205 by Teddy Hogeborn
* DBUS-API: Document new "LastApprovalRequest" client property.
2128
    def LastApprovalRequest_dbus_property(self):
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
2129
        return datetime_to_dbus(self.last_approval_request)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2130
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2131
    # Timeout - property
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2132
    @dbus_service_property(_interface,
2133
                           signature="t",
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2134
                           access="readwrite")
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2135
    def Timeout_dbus_property(self, value=None):
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
2136
        if value is None:       # get
237.23.6 by Teddy Hogeborn
Use the new .total_seconds() method on datetime.timedelta objects.
2137
            return dbus.UInt64(self.timeout.total_seconds() * 1000)
237.7.129 by Teddy Hogeborn
* mandos (Client.enable, Client.disable, ClientDBus.approve): Call
2138
        old_timeout = self.timeout
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
2139
        self.timeout = datetime.timedelta(0, 0, 0, value)
237.7.129 by Teddy Hogeborn
* mandos (Client.enable, Client.disable, ClientDBus.approve): Call
2140
        # Reschedule disabling
237.7.91 by Teddy Hogeborn
* mandos: Break some long lines.
2141
        if self.enabled:
2142
            now = datetime.datetime.utcnow()
237.7.129 by Teddy Hogeborn
* mandos (Client.enable, Client.disable, ClientDBus.approve): Call
2143
            self.expires += self.timeout - old_timeout
2144
            if self.expires <= now:
237.7.91 by Teddy Hogeborn
* mandos: Break some long lines.
2145
                # The timeout has passed
2146
                self.disable()
2147
            else:
2148
                if (getattr(self, "disable_initiator_tag", None)
2149
                    is None):
2150
                    return
237.7.378 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
2151
                GLib.source_remove(self.disable_initiator_tag)
2152
                self.disable_initiator_tag = GLib.timeout_add(
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2153
                    int((self.expires - now).total_seconds() * 1000),
2154
                    self.disable)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2155
24.1.179 by Björn Påhlsson
New feature:
2156
    # ExtendedTimeout - property
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2157
    @dbus_service_property(_interface,
2158
                           signature="t",
24.1.179 by Björn Påhlsson
New feature:
2159
                           access="readwrite")
2160
    def ExtendedTimeout_dbus_property(self, value=None):
2161
        if value is None:       # get
237.23.6 by Teddy Hogeborn
Use the new .total_seconds() method on datetime.timedelta objects.
2162
            return dbus.UInt64(self.extended_timeout.total_seconds()
2163
                               * 1000)
24.1.179 by Björn Påhlsson
New feature:
2164
        self.extended_timeout = datetime.timedelta(0, 0, 0, value)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2165
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2166
    # Interval - property
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2167
    @dbus_service_property(_interface,
2168
                           signature="t",
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2169
                           access="readwrite")
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2170
    def Interval_dbus_property(self, value=None):
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
2171
        if value is None:       # get
237.23.6 by Teddy Hogeborn
Use the new .total_seconds() method on datetime.timedelta objects.
2172
            return dbus.UInt64(self.interval.total_seconds() * 1000)
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
2173
        self.interval = datetime.timedelta(0, 0, 0, value)
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2174
        if getattr(self, "checker_initiator_tag", None) is None:
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
2175
            return
237.14.3 by Teddy Hogeborn
Make "enabled" a client config option.
2176
        if self.enabled:
2177
            # Reschedule checker run
237.7.378 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
2178
            GLib.source_remove(self.checker_initiator_tag)
2179
            self.checker_initiator_tag = GLib.timeout_add(
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2180
                value, self.start_checker)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2181
            self.start_checker()  # Start one now, too
2182
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2183
    # Checker - property
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2184
    @dbus_service_property(_interface,
2185
                           signature="s",
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2186
                           access="readwrite")
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2187
    def Checker_dbus_property(self, value=None):
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
2188
        if value is None:       # get
2189
            return dbus.String(self.checker_command)
237.7.278 by Teddy Hogeborn
mandos: Replace unicode() with str().
2190
        self.checker_command = str(value)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2191
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2192
    # CheckerRunning - property
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2193
    @dbus_service_property(_interface,
2194
                           signature="b",
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2195
                           access="readwrite")
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2196
    def CheckerRunning_dbus_property(self, value=None):
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
2197
        if value is None:       # get
2198
            return dbus.Boolean(self.checker is not None)
2199
        if value:
2200
            self.start_checker()
2201
        else:
2202
            self.stop_checker()
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2203
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2204
    # ObjectPath - property
237.7.328 by Teddy Hogeborn
Add D-Bus annotations on a few properties on the Client object.
2205
    @dbus_annotations(
237.7.330 by Teddy Hogeborn
Deprecate the D-Bus property "se.recompile.Mandos.Client.ObjectPath".
2206
        {"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",
2207
         "org.freedesktop.DBus.Deprecated": "true"})
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2208
    @dbus_service_property(_interface, signature="o", access="read")
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2209
    def ObjectPath_dbus_property(self):
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2210
        return self.dbus_object_path  # is already a dbus.ObjectPath
2211
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2212
    # Secret = property
237.7.328 by Teddy Hogeborn
Add D-Bus annotations on a few properties on the Client object.
2213
    @dbus_annotations(
2214
        {"org.freedesktop.DBus.Property.EmitsChangedSignal":
2215
         "invalidates"})
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2216
    @dbus_service_property(_interface,
2217
                           signature="ay",
2218
                           access="write",
2219
                           byte_arrays=True)
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2220
    def Secret_dbus_property(self, value):
237.7.277 by Teddy Hogeborn
mandos: Stop using str() and remove unnecessary unicode() calls.
2221
        self.secret = bytes(value)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2222
237.1.2 by Teddy Hogeborn
Further steps towards a D-Bus server interface, plus minor syntax
2223
    del _interface
3 by Björn Påhlsson
Python based server
2224
2225
237.7.702 by Teddy Hogeborn
Simplification of Python 3 compatibility code
2226
class ProxyClient:
237.7.510 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
2227
    def __init__(self, child_pipe, key_id, fpr, address):
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2228
        self._pipe = child_pipe
237.7.510 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
2229
        self._pipe.send(('init', key_id, fpr, address))
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2230
        if not self._pipe.recv():
237.7.510 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
2231
            raise KeyError(key_id or fpr)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2232
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2233
    def __getattribute__(self, name):
237.14.4 by Teddy Hogeborn
* mandos (_timedelta_to_milliseconds): Renamed to
2234
        if name == '_pipe':
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2235
            return super(ProxyClient, self).__getattribute__(name)
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2236
        self._pipe.send(('getattr', name))
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2237
        data = self._pipe.recv()
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2238
        if data[0] == 'data':
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2239
            return data[1]
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2240
        if data[0] == 'function':
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2241
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2242
            def func(*args, **kwargs):
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2243
                self._pipe.send(('funcall', name, args, kwargs))
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2244
                return self._pipe.recv()[1]
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2245
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2246
            return func
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2247
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2248
    def __setattr__(self, name, value):
237.14.4 by Teddy Hogeborn
* mandos (_timedelta_to_milliseconds): Renamed to
2249
        if name == '_pipe':
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2250
            return super(ProxyClient, self).__setattr__(name, value)
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2251
        self._pipe.send(('setattr', name, value))
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2252
237.12.6 by Teddy Hogeborn
* mandos: Fix whitespace.
2253
237.2.98 by Teddy Hogeborn
* mandos: Import "SocketServer" as "socketserver" and "ConfigParser"
2254
class ClientHandler(socketserver.BaseRequestHandler, object):
237.2.94 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
2255
    """A class to handle client connections.
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2256
237.2.94 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
2257
    Instantiated once for each connection to handle it.
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
2258
    Note: This will run in its own forked process."""
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2259
3 by Björn Påhlsson
Python based server
2260
    def handle(self):
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2261
        with contextlib.closing(self.server.child_pipe) as child_pipe:
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2262
            logger.info("TCP connection from: %s",
237.7.278 by Teddy Hogeborn
mandos: Replace unicode() with str().
2263
                        str(self.client_address))
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2264
            logger.debug("Pipe FD: %d",
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2265
                         self.server.child_pipe.fileno())
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2266
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
2267
            session = gnutls.ClientSession(self.request)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2268
2269
            # priority = ':'.join(("NONE", "+VERS-TLS1.1",
2270
            #                       "+AES-256-CBC", "+SHA1",
2271
            #                       "+COMP-NULL", "+CTYPE-OPENPGP",
2272
            #                       "+DHE-DSS"))
237.4.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
2273
            # Use a fallback default, since this MUST be set.
237.2.94 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
2274
            priority = self.server.gnutls_priority
2275
            if priority is None:
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2276
                priority = "NORMAL"
237.7.399 by Teddy Hogeborn
mandos: Minor bug fix for Python 3
2277
            gnutls.priority_set_direct(session._c_object,
2278
                                       priority.encode("utf-8"),
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
2279
                                       None)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2280
237.5.2 by Teddy Hogeborn
* mandos (ClientHandler.handle): Set up the GnuTLS session object
2281
            # Start communication using the Mandos protocol
2282
            # Get protocol number
2283
            line = self.request.makefile().readline()
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2284
            logger.debug("Protocol version: %r", line)
237.5.2 by Teddy Hogeborn
* mandos (ClientHandler.handle): Set up the GnuTLS session object
2285
            try:
2286
                if int(line.strip().split()[0]) > 1:
237.7.190 by Teddy Hogeborn
Syntax fix; use "raise" better in Mandos server.
2287
                    raise RuntimeError(line)
237.7.30 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
2288
            except (ValueError, IndexError, RuntimeError) as error:
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2289
                logger.error("Unknown protocol version: %s", error)
237.5.2 by Teddy Hogeborn
* mandos (ClientHandler.handle): Set up the GnuTLS session object
2290
                return
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2291
237.5.2 by Teddy Hogeborn
* mandos (ClientHandler.handle): Set up the GnuTLS session object
2292
            # Start GnuTLS connection
237.4.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
2293
            try:
2294
                session.handshake()
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
2295
            except gnutls.Error as error:
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2296
                logger.warning("Handshake failed: %s", error)
237.4.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
2297
                # Do not run session.bye() here: the session is not
2298
                # established.  Just abandon the request.
2299
                return
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2300
            logger.debug("Handshake succeeded")
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2301
24.1.150 by Björn Påhlsson
* mandos: Added ClientDBus.approve_pending property. Exposed
2302
            approval_required = False
237.4.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
2303
            try:
237.7.510 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
2304
                if gnutls.has_rawpk:
237.7.678 by Teddy Hogeborn
Update Python 3 compatibility
2305
                    fpr = b""
237.7.510 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
2306
                    try:
2307
                        key_id = self.key_id(
2308
                            self.peer_certificate(session))
2309
                    except (TypeError, gnutls.Error) as error:
2310
                        logger.warning("Bad certificate: %s", error)
2311
                        return
2312
                    logger.debug("Key ID: %s", key_id)
2313
2314
                else:
237.7.678 by Teddy Hogeborn
Update Python 3 compatibility
2315
                    key_id = b""
237.7.510 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
2316
                    try:
2317
                        fpr = self.fingerprint(
2318
                            self.peer_certificate(session))
2319
                    except (TypeError, gnutls.Error) as error:
2320
                        logger.warning("Bad certificate: %s", error)
2321
                        return
2322
                    logger.debug("Fingerprint: %s", fpr)
2323
2324
                try:
2325
                    client = ProxyClient(child_pipe, key_id, fpr,
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2326
                                         self.client_address)
2327
                except KeyError:
237.2.174 by Teddy Hogeborn
More consistent terminology: Clients are no longer "invalid" - they
2328
                    return
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2329
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2330
                if client.approval_delay:
2331
                    delay = client.approval_delay
24.1.150 by Björn Påhlsson
* mandos: Added ClientDBus.approve_pending property. Exposed
2332
                    client.approvals_pending += 1
2333
                    approval_required = True
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2334
24.1.148 by Björn Påhlsson
half working on-demand password and approved code
2335
                while True:
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2336
                    if not client.enabled:
24.1.174 by Björn Påhlsson
* Makefile (CFLAGS): Added "-lrt" to include real time library.
2337
                        logger.info("Client %s is disabled",
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2338
                                    client.name)
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2339
                        if self.server.use_dbus:
2340
                            # Emit D-Bus signal
237.11.3 by Teddy Hogeborn
* mandos: Break long lines.
2341
                            client.Rejected("Disabled")
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2342
                        return
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2343
237.14.4 by Teddy Hogeborn
* mandos (_timedelta_to_milliseconds): Renamed to
2344
                    if client.approved or not client.approval_delay:
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2345
                        # We are approved or approval is disabled
24.1.150 by Björn Påhlsson
* mandos: Added ClientDBus.approve_pending property. Exposed
2346
                        break
237.14.4 by Teddy Hogeborn
* mandos (_timedelta_to_milliseconds): Renamed to
2347
                    elif client.approved is None:
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2348
                        logger.info("Client %s needs approval",
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2349
                                    client.name)
2350
                        if self.server.use_dbus:
2351
                            # Emit D-Bus signal
2352
                            client.NeedApproval(
237.23.6 by Teddy Hogeborn
Use the new .total_seconds() method on datetime.timedelta objects.
2353
                                client.approval_delay.total_seconds()
2354
                                * 1000, client.approved_by_default)
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2355
                    else:
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2356
                        logger.warning("Client %s was not approved",
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2357
                                       client.name)
2358
                        if self.server.use_dbus:
24.1.150 by Björn Påhlsson
* mandos: Added ClientDBus.approve_pending property. Exposed
2359
                            # Emit D-Bus signal
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2360
                            client.Rejected("Denied")
24.1.148 by Björn Påhlsson
half working on-demand password and approved code
2361
                        return
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2362
2363
                    # wait until timeout or approved
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2364
                    time = datetime.datetime.now()
2365
                    client.changedstate.acquire()
237.23.6 by Teddy Hogeborn
Use the new .total_seconds() method on datetime.timedelta objects.
2366
                    client.changedstate.wait(delay.total_seconds())
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2367
                    client.changedstate.release()
2368
                    time2 = datetime.datetime.now()
2369
                    if (time2 - time) >= delay:
2370
                        if not client.approved_by_default:
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2371
                            logger.warning("Client %s timed out while"
2372
                                           " waiting for approval",
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2373
                                           client.name)
2374
                            if self.server.use_dbus:
2375
                                # Emit D-Bus signal
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2376
                                client.Rejected("Approval timed out")
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2377
                            return
2378
                        else:
2379
                            break
2380
                    else:
2381
                        delay -= time2 - time
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2382
237.7.350 by Teddy Hogeborn
Handle GnuTLS errors and partial sends in gnutls "module".
2383
                try:
2384
                    session.send(client.secret)
2385
                except gnutls.Error as error:
2386
                    logger.warning("gnutls send failed",
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2387
                                   exc_info=error)
237.7.350 by Teddy Hogeborn
Handle GnuTLS errors and partial sends in gnutls "module".
2388
                    return
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2389
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2390
                logger.info("Sending secret to %s", client.name)
237.11.13 by Teddy Hogeborn
Miscellaneous fixes prompted by lintian:
2391
                # bump the timeout using extended_timeout
237.7.104 by Teddy Hogeborn
* DBUS-API (se.recompile.Mandos.Client.LastCheckerStatus): New
2392
                client.bump_timeout(client.extended_timeout)
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2393
                if self.server.use_dbus:
2394
                    # Emit D-Bus signal
2395
                    client.GotSecret()
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2396
237.2.174 by Teddy Hogeborn
More consistent terminology: Clients are no longer "invalid" - they
2397
            finally:
24.1.150 by Björn Påhlsson
* mandos: Added ClientDBus.approve_pending property. Exposed
2398
                if approval_required:
2399
                    client.approvals_pending -= 1
24.1.155 by Björn Påhlsson
mandos server: Added debuglevel that adjust at what level information
2400
                try:
2401
                    session.bye()
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
2402
                except gnutls.Error as error:
237.7.122 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
2403
                    logger.warning("GnuTLS bye failed",
2404
                                   exc_info=error)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2405
237.2.93 by Teddy Hogeborn
* mandos (peer_certificate, fingerprint): Moved into "TCP_handler"
2406
    @staticmethod
2407
    def peer_certificate(session):
237.7.510 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
2408
        "Return the peer's certificate as a bytestring"
2409
        try:
2410
            cert_type = gnutls.certificate_type_get2(session._c_object,
2411
                                                     gnutls.CTYPE_PEERS)
2412
        except AttributeError:
2413
            cert_type = gnutls.certificate_type_get(session._c_object)
2414
        if gnutls.has_rawpk:
2415
            valid_cert_types = frozenset((gnutls.CRT_RAWPK,))
2416
        else:
2417
            valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))
2418
        # If not a valid certificate type...
2419
        if cert_type not in valid_cert_types:
2420
            logger.info("Cert type %r not in %r", cert_type,
2421
                        valid_cert_types)
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
2422
            # ...return invalid data
2423
            return b""
237.2.93 by Teddy Hogeborn
* mandos (peer_certificate, fingerprint): Moved into "TCP_handler"
2424
        list_size = ctypes.c_uint(1)
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
2425
        cert_list = (gnutls.certificate_get_peers
237.2.93 by Teddy Hogeborn
* mandos (peer_certificate, fingerprint): Moved into "TCP_handler"
2426
                     (session._c_object, ctypes.byref(list_size)))
2427
        if not bool(cert_list) and list_size.value != 0:
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
2428
            raise gnutls.Error("error getting peer certificate")
237.2.93 by Teddy Hogeborn
* mandos (peer_certificate, fingerprint): Moved into "TCP_handler"
2429
        if list_size.value == 0:
2430
            return None
2431
        cert = cert_list[0]
2432
        return ctypes.string_at(cert.data, cert.size)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2433
237.2.93 by Teddy Hogeborn
* mandos (peer_certificate, fingerprint): Moved into "TCP_handler"
2434
    @staticmethod
237.7.510 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
2435
    def key_id(certificate):
2436
        "Convert a certificate bytestring to a hexdigit key ID"
2437
        # New GnuTLS "datum" with the public key
2438
        datum = gnutls.datum_t(
2439
            ctypes.cast(ctypes.c_char_p(certificate),
2440
                        ctypes.POINTER(ctypes.c_ubyte)),
2441
            ctypes.c_uint(len(certificate)))
2442
        # XXX all these need to be created in the gnutls "module"
2443
        # New empty GnuTLS certificate
2444
        pubkey = gnutls.pubkey_t()
2445
        gnutls.pubkey_init(ctypes.byref(pubkey))
2446
        # Import the raw public key into the certificate
2447
        gnutls.pubkey_import(pubkey,
2448
                             ctypes.byref(datum),
2449
                             gnutls.X509_FMT_DER)
2450
        # New buffer for the key ID
2451
        buf = ctypes.create_string_buffer(32)
2452
        buf_len = ctypes.c_size_t(len(buf))
2453
        # Get the key ID from the raw public key into the buffer
2454
        gnutls.pubkey_get_key_id(pubkey,
2455
                                 gnutls.KEYID_USE_SHA256,
2456
                                 ctypes.cast(ctypes.byref(buf),
2457
                                             ctypes.POINTER(ctypes.c_ubyte)),
2458
                                 ctypes.byref(buf_len))
2459
        # Deinit the certificate
2460
        gnutls.pubkey_deinit(pubkey)
2461
2462
        # Convert the buffer to a Python bytestring
2463
        key_id = ctypes.string_at(buf, buf_len.value)
2464
        # Convert the bytestring to hexadecimal notation
2465
        hex_key_id = binascii.hexlify(key_id).upper()
2466
        return hex_key_id
2467
2468
    @staticmethod
237.2.93 by Teddy Hogeborn
* mandos (peer_certificate, fingerprint): Moved into "TCP_handler"
2469
    def fingerprint(openpgp):
2470
        "Convert an OpenPGP bytestring to a hexdigit fingerprint"
2471
        # New GnuTLS "datum" with the OpenPGP public key
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
2472
        datum = gnutls.datum_t(
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2473
            ctypes.cast(ctypes.c_char_p(openpgp),
2474
                        ctypes.POINTER(ctypes.c_ubyte)),
2475
            ctypes.c_uint(len(openpgp)))
237.2.93 by Teddy Hogeborn
* mandos (peer_certificate, fingerprint): Moved into "TCP_handler"
2476
        # New empty GnuTLS certificate
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
2477
        crt = gnutls.openpgp_crt_t()
2478
        gnutls.openpgp_crt_init(ctypes.byref(crt))
237.2.93 by Teddy Hogeborn
* mandos (peer_certificate, fingerprint): Moved into "TCP_handler"
2479
        # Import the OpenPGP public key into the certificate
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
2480
        gnutls.openpgp_crt_import(crt, ctypes.byref(datum),
2481
                                  gnutls.OPENPGP_FMT_RAW)
237.2.93 by Teddy Hogeborn
* mandos (peer_certificate, fingerprint): Moved into "TCP_handler"
2482
        # Verify the self signature in the key
2483
        crtverify = ctypes.c_uint()
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
2484
        gnutls.openpgp_crt_verify_self(crt, 0,
2485
                                       ctypes.byref(crtverify))
237.2.93 by Teddy Hogeborn
* mandos (peer_certificate, fingerprint): Moved into "TCP_handler"
2486
        if crtverify.value != 0:
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
2487
            gnutls.openpgp_crt_deinit(crt)
237.7.498 by Teddy Hogeborn
mandos: Better error message if self-signature verification fails
2488
            raise gnutls.CertificateSecurityError(code
2489
                                                  =crtverify.value)
237.2.93 by Teddy Hogeborn
* mandos (peer_certificate, fingerprint): Moved into "TCP_handler"
2490
        # New buffer for the fingerprint
2491
        buf = ctypes.create_string_buffer(20)
2492
        buf_len = ctypes.c_size_t()
2493
        # Get the fingerprint from the certificate into the buffer
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
2494
        gnutls.openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
2495
                                           ctypes.byref(buf_len))
237.2.93 by Teddy Hogeborn
* mandos (peer_certificate, fingerprint): Moved into "TCP_handler"
2496
        # Deinit the certificate
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
2497
        gnutls.openpgp_crt_deinit(crt)
237.2.93 by Teddy Hogeborn
* mandos (peer_certificate, fingerprint): Moved into "TCP_handler"
2498
        # Convert the buffer to a Python bytestring
2499
        fpr = ctypes.string_at(buf, buf_len.value)
2500
        # Convert the bytestring to hexadecimal notation
237.14.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
2501
        hex_fpr = binascii.hexlify(fpr).upper()
237.2.93 by Teddy Hogeborn
* mandos (peer_certificate, fingerprint): Moved into "TCP_handler"
2502
        return hex_fpr
237.4.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
2503
2504
237.7.702 by Teddy Hogeborn
Simplification of Python 3 compatibility code
2505
class MultiprocessingMixIn:
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2506
    """Like socketserver.ThreadingMixIn, but with multiprocessing"""
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2507
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2508
    def sub_process_main(self, request, address):
2509
        try:
2510
            self.finish_request(request, address)
237.12.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
2511
        except Exception:
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2512
            self.handle_error(request, address)
2513
        self.close_request(request)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2514
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2515
    def process_request(self, request, address):
2516
        """Start a new process to process the request."""
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2517
        proc = multiprocessing.Process(target=self.sub_process_main,
2518
                                       args=(request, address))
237.11.11 by Teddy Hogeborn
* mandos (Client.checked_ok): Set "expires" after setting timeout.
2519
        proc.start()
2520
        return proc
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2521
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
2522
237.7.702 by Teddy Hogeborn
Simplification of Python 3 compatibility code
2523
class MultiprocessingMixInWithPipe(MultiprocessingMixIn):
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2524
    """ adds a pipe to the MixIn """
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2525
237.4.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
2526
    def process_request(self, request, client_address):
237.2.94 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
2527
        """Overrides and wraps the original process_request().
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2528
237.2.118 by Teddy Hogeborn
* mandos: White-space fixes only.
2529
        This function creates a new pipe in self.pipe
237.4.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
2530
        """
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2531
        parent_pipe, self.child_pipe = multiprocessing.Pipe()
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2532
237.11.11 by Teddy Hogeborn
* mandos (Client.checked_ok): Set "expires" after setting timeout.
2533
        proc = MultiprocessingMixIn.process_request(self, request,
2534
                                                    client_address)
24.1.152 by Björn Påhlsson
bug fixes that prevent problems when runing server as root
2535
        self.child_pipe.close()
237.11.11 by Teddy Hogeborn
* mandos (Client.checked_ok): Set "expires" after setting timeout.
2536
        self.add_pipe(parent_pipe, proc)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2537
237.11.11 by Teddy Hogeborn
* mandos (Client.checked_ok): Set "expires" after setting timeout.
2538
    def add_pipe(self, parent_pipe, proc):
237.4.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
2539
        """Dummy function; override as necessary"""
237.7.190 by Teddy Hogeborn
Syntax fix; use "raise" better in Mandos server.
2540
        raise NotImplementedError()
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2541
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
2542
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2543
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
237.7.702 by Teddy Hogeborn
Simplification of Python 3 compatibility code
2544
                     socketserver.TCPServer):
250 by Teddy Hogeborn
Merge from trunk. Notable changes:
2545
    """IPv6-capable TCP server.  Accepts 'None' as address and/or port
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2546
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
2547
    Attributes:
237.2.94 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
2548
        enabled:        Boolean; whether this server is activated yet
2549
        interface:      None or a network interface name (string)
2550
        use_ipv6:       Boolean; to use IPv6 or not
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
2551
    """
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2552
237.2.94 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
2553
    def __init__(self, server_address, RequestHandlerClass,
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2554
                 interface=None,
2555
                 use_ipv6=True,
2556
                 socketfd=None):
237.21.1 by Teddy Hogeborn
* mandos: Implement "--socket" option.
2557
        """If socketfd is set, use that file descriptor instead of
2558
        creating a new one with socket.socket().
2559
        """
237.2.94 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
2560
        self.interface = interface
2561
        if use_ipv6:
2562
            self.address_family = socket.AF_INET6
237.21.1 by Teddy Hogeborn
* mandos: Implement "--socket" option.
2563
        if socketfd is not None:
2564
            # Save the file descriptor
2565
            self.socketfd = socketfd
2566
            # Save the original socket.socket() function
2567
            self.socket_socket = socket.socket
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2568
237.21.1 by Teddy Hogeborn
* mandos: Implement "--socket" option.
2569
            # To implement --socket, we monkey patch socket.socket.
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2570
            #
237.21.1 by Teddy Hogeborn
* mandos: Implement "--socket" option.
2571
            # (When socketserver.TCPServer is a new-style class, we
2572
            # could make self.socket into a property instead of monkey
2573
            # patching socket.socket.)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2574
            #
237.21.1 by Teddy Hogeborn
* mandos: Implement "--socket" option.
2575
            # Create a one-time-only replacement for socket.socket()
2576
            @functools.wraps(socket.socket)
2577
            def socket_wrapper(*args, **kwargs):
2578
                # Restore original function so subsequent calls are
2579
                # not affected.
2580
                socket.socket = self.socket_socket
2581
                del self.socket_socket
2582
                # This time only, return a new socket object from the
2583
                # saved file descriptor.
2584
                return socket.fromfd(self.socketfd, *args, **kwargs)
2585
            # Replace socket.socket() function with wrapper
2586
            socket.socket = socket_wrapper
2587
        # The socketserver.TCPServer.__init__ will call
2588
        # socket.socket(), which might be our replacement,
2589
        # socket_wrapper(), if socketfd was set.
237.2.98 by Teddy Hogeborn
* mandos: Import "SocketServer" as "socketserver" and "ConfigParser"
2590
        socketserver.TCPServer.__init__(self, server_address,
237.2.94 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
2591
                                        RequestHandlerClass)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2592
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
2593
    def server_bind(self):
2594
        """This overrides the normal server_bind() function
2595
        to bind to an interface if one was specified, and also NOT to
2596
        bind to an address or port if they were not specified."""
237.7.406 by Teddy Hogeborn
Server: Fix bug with --interface flag when "cc" is not installed.
2597
        global SO_BINDTODEVICE
237.2.94 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
2598
        if self.interface is not None:
237.2.101 by Teddy Hogeborn
* mandos: Minor doc string fixes.
2599
            if SO_BINDTODEVICE is None:
237.7.400 by Teddy Hogeborn
mandos: Bug fix for Python 2.7 and the "--interface" option
2600
                # Fall back to a hard-coded value which seems to be
2601
                # common enough.
2602
                logger.warning("SO_BINDTODEVICE not found, trying 25")
2603
                SO_BINDTODEVICE = 25
2604
            try:
2605
                self.socket.setsockopt(
2606
                    socket.SOL_SOCKET, SO_BINDTODEVICE,
2607
                    (self.interface + "\0").encode("utf-8"))
2608
            except socket.error as error:
2609
                if error.errno == errno.EPERM:
2610
                    logger.error("No permission to bind to"
2611
                                 " interface %s", self.interface)
2612
                elif error.errno == errno.ENOPROTOOPT:
2613
                    logger.error("SO_BINDTODEVICE not available;"
2614
                                 " cannot bind to interface %s",
2615
                                 self.interface)
2616
                elif error.errno == errno.ENODEV:
2617
                    logger.error("Interface %s does not exist,"
2618
                                 " cannot bind", self.interface)
2619
                else:
2620
                    raise
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
2621
        # Only bind(2) the socket if we really need to.
2622
        if self.server_address[0] or self.server_address[1]:
237.7.663 by Teddy Hogeborn
Server bug fix: Allow restarts when using port= option
2623
            if self.server_address[1]:
2624
                self.allow_reuse_address = True
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
2625
            if not self.server_address[0]:
237.2.77 by Teddy Hogeborn
Support not using IPv6 in server:
2626
                if self.address_family == socket.AF_INET6:
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2627
                    any_address = "::"  # in6addr_any
237.2.77 by Teddy Hogeborn
Support not using IPv6 in server:
2628
                else:
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2629
                    any_address = "0.0.0.0"  # INADDR_ANY
237.2.77 by Teddy Hogeborn
Support not using IPv6 in server:
2630
                self.server_address = (any_address,
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
2631
                                       self.server_address[1])
49 by Teddy Hogeborn
* mandos (IPv6_TCPServer.server_bind): Bug fix: allow port to be empty
2632
            elif not self.server_address[1]:
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2633
                self.server_address = (self.server_address[0], 0)
237.2.94 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
2634
#                 if self.interface:
49 by Teddy Hogeborn
* mandos (IPv6_TCPServer.server_bind): Bug fix: allow port to be empty
2635
#                     self.server_address = (self.server_address[0],
2636
#                                            0, # port
2637
#                                            0, # flowinfo
2638
#                                            if_nametoindex
237.2.94 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
2639
#                                            (self.interface))
237.2.98 by Teddy Hogeborn
* mandos: Import "SocketServer" as "socketserver" and "ConfigParser"
2640
            return socketserver.TCPServer.server_bind(self)
237.2.102 by Teddy Hogeborn
Code cleanup.
2641
2642
2643
class MandosServer(IPv6_TCPServer):
2644
    """Mandos server.
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2645
237.2.102 by Teddy Hogeborn
Code cleanup.
2646
    Attributes:
2647
        clients:        set of Client objects
2648
        gnutls_priority GnuTLS priority string
2649
        use_dbus:       Boolean; to emit D-Bus signals or not
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2650
237.7.378 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
2651
    Assumes a GLib.MainLoop event loop.
237.2.102 by Teddy Hogeborn
Code cleanup.
2652
    """
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2653
237.2.102 by Teddy Hogeborn
Code cleanup.
2654
    def __init__(self, server_address, RequestHandlerClass,
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2655
                 interface=None,
2656
                 use_ipv6=True,
2657
                 clients=None,
2658
                 gnutls_priority=None,
2659
                 use_dbus=True,
2660
                 socketfd=None):
237.2.102 by Teddy Hogeborn
Code cleanup.
2661
        self.enabled = False
2662
        self.clients = clients
237.2.104 by Teddy Hogeborn
Code cleanup and one bug fix.
2663
        if self.clients is None:
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
2664
            self.clients = {}
237.2.102 by Teddy Hogeborn
Code cleanup.
2665
        self.use_dbus = use_dbus
2666
        self.gnutls_priority = gnutls_priority
2667
        IPv6_TCPServer.__init__(self, server_address,
2668
                                RequestHandlerClass,
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2669
                                interface=interface,
2670
                                use_ipv6=use_ipv6,
2671
                                socketfd=socketfd)
2672
163 by Teddy Hogeborn
* Makefile (PIDDIR, USER, GROUP): Removed.
2673
    def server_activate(self):
2674
        if self.enabled:
237.2.98 by Teddy Hogeborn
* mandos: Import "SocketServer" as "socketserver" and "ConfigParser"
2675
            return socketserver.TCPServer.server_activate(self)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2676
163 by Teddy Hogeborn
* Makefile (PIDDIR, USER, GROUP): Removed.
2677
    def enable(self):
2678
        self.enabled = True
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2679
237.11.11 by Teddy Hogeborn
* mandos (Client.checked_ok): Set "expires" after setting timeout.
2680
    def add_pipe(self, parent_pipe, proc):
237.2.103 by Teddy Hogeborn
Code cleanup.
2681
        # Call "handle_ipc" for both data and EOF events
237.7.378 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
2682
        GLib.io_add_watch(
237.7.715 by Teddy Hogeborn
Server: Use new GLib.io_add_watch() call signature
2683
            parent_pipe.fileno(), GLib.PRIORITY_DEFAULT,
237.7.378 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
2684
            GLib.IO_IN | GLib.IO_HUP,
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2685
            functools.partial(self.handle_ipc,
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2686
                              parent_pipe=parent_pipe,
2687
                              proc=proc))
2688
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2689
    def handle_ipc(self, source, condition,
2690
                   parent_pipe=None,
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2691
                   proc=None,
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2692
                   client_object=None):
237.11.13 by Teddy Hogeborn
Miscellaneous fixes prompted by lintian:
2693
        # error, or the other end of multiprocessing.Pipe has closed
237.7.378 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
2694
        if condition & (GLib.IO_ERR | GLib.IO_HUP):
237.11.13 by Teddy Hogeborn
Miscellaneous fixes prompted by lintian:
2695
            # Wait for other process to exit
237.11.11 by Teddy Hogeborn
* mandos (Client.checked_ok): Set "expires" after setting timeout.
2696
            proc.join()
24.1.152 by Björn Påhlsson
bug fixes that prevent problems when runing server as root
2697
            return False
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2698
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2699
        # Read a request from the child
2700
        request = parent_pipe.recv()
2701
        command = request[0]
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2702
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2703
        if command == 'init':
237.7.510 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
2704
            key_id = request[1].decode("ascii")
2705
            fpr = request[2].decode("ascii")
2706
            address = request[3]
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2707
237.7.376 by Teddy Hogeborn
Server: Add Python 3 compatibility
2708
            for c in self.clients.values():
237.7.519 by Teddy Hogeborn
Bug fix: Only create TLS key with certtool, and read correct key file
2709
                if key_id == "E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855":
2710
                    continue
237.7.510 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
2711
                if key_id and c.key_id == key_id:
2712
                    client = c
2713
                    break
2714
                if fpr and c.fingerprint == fpr:
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2715
                    client = c
2716
                    break
2717
            else:
237.7.510 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
2718
                logger.info("Client not found for key ID: %s, address"
2719
                            ": %s", key_id or fpr, address)
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2720
                if self.use_dbus:
2721
                    # Emit D-Bus signal
237.7.510 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
2722
                    mandos_dbus_service.ClientNotFound(key_id or fpr,
237.11.3 by Teddy Hogeborn
* mandos: Break long lines.
2723
                                                       address[0])
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2724
                parent_pipe.send(False)
2725
                return False
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2726
237.7.378 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
2727
            GLib.io_add_watch(
237.7.715 by Teddy Hogeborn
Server: Use new GLib.io_add_watch() call signature
2728
                parent_pipe.fileno(), GLib.PRIORITY_DEFAULT,
237.7.378 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
2729
                GLib.IO_IN | GLib.IO_HUP,
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2730
                functools.partial(self.handle_ipc,
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2731
                                  parent_pipe=parent_pipe,
2732
                                  proc=proc,
2733
                                  client_object=client))
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2734
            parent_pipe.send(True)
237.11.3 by Teddy Hogeborn
* mandos: Break long lines.
2735
            # remove the old hook in favor of the new above hook on
2736
            # same fileno
237.4.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
2737
            return False
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2738
        if command == 'funcall':
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2739
            funcname = request[1]
2740
            args = request[2]
2741
            kwargs = request[3]
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2742
237.11.3 by Teddy Hogeborn
* mandos: Break long lines.
2743
            parent_pipe.send(('data', getattr(client_object,
2744
                                              funcname)(*args,
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2745
                                                        **kwargs)))
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2746
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2747
        if command == 'getattr':
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2748
            attrname = request[1]
237.7.303 by Teddy Hogeborn
mandos: More Python 3 fixes.
2749
            if isinstance(client_object.__getattribute__(attrname),
2750
                          collections.Callable):
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2751
                parent_pipe.send(('function', ))
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2752
            else:
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2753
                parent_pipe.send((
2754
                    'data', client_object.__getattribute__(attrname)))
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2755
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2756
        if command == 'setattr':
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2757
            attrname = request[1]
2758
            value = request[2]
2759
            setattr(client_object, attrname, value)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2760
237.4.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
2761
        return True
10 by Teddy Hogeborn
* server.py: Bug fix: Do "from __future__ import division".
2762
3 by Björn Påhlsson
Python based server
2763
237.7.157 by Teddy Hogeborn
* clients.conf: Convert all time intervals to new RFC 3339 syntax.
2764
def rfc3339_duration_to_delta(duration):
2765
    """Parse an RFC 3339 "duration" and return a datetime.timedelta
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2766
237.7.157 by Teddy Hogeborn
* clients.conf: Convert all time intervals to new RFC 3339 syntax.
2767
    >>> rfc3339_duration_to_delta("P7D")
2768
    datetime.timedelta(7)
2769
    >>> rfc3339_duration_to_delta("PT60S")
2770
    datetime.timedelta(0, 60)
2771
    >>> rfc3339_duration_to_delta("PT60M")
2772
    datetime.timedelta(0, 3600)
2773
    >>> rfc3339_duration_to_delta("PT24H")
2774
    datetime.timedelta(1)
2775
    >>> rfc3339_duration_to_delta("P1W")
2776
    datetime.timedelta(7)
2777
    >>> rfc3339_duration_to_delta("PT5M30S")
2778
    datetime.timedelta(0, 330)
2779
    >>> rfc3339_duration_to_delta("P1DT3M20S")
2780
    datetime.timedelta(1, 200)
2781
    """
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2782
237.7.157 by Teddy Hogeborn
* clients.conf: Convert all time intervals to new RFC 3339 syntax.
2783
    # Parsing an RFC 3339 duration with regular expressions is not
2784
    # possible - there would have to be multiple places for the same
2785
    # values, like seconds.  The current code, while more esoteric, is
2786
    # cleaner without depending on a parsing library.  If Python had a
2787
    # built-in library for parsing we would use it, but we'd like to
2788
    # avoid excessive use of external libraries.
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2789
237.7.157 by Teddy Hogeborn
* clients.conf: Convert all time intervals to new RFC 3339 syntax.
2790
    # New type for defining tokens, syntax, and semantics all-in-one
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2791
    Token = collections.namedtuple("Token", (
2792
        "regexp",  # To match token; if "value" is not None, must have
2793
                   # a "group" containing digits
2794
        "value",   # datetime.timedelta or None
2795
        "followers"))           # Tokens valid after this token
237.7.157 by Teddy Hogeborn
* clients.conf: Convert all time intervals to new RFC 3339 syntax.
2796
    # RFC 3339 "duration" tokens, syntax, and semantics; taken from
2797
    # the "duration" ABNF definition in RFC 3339, Appendix A.
2798
    token_end = Token(re.compile(r"$"), None, frozenset())
2799
    token_second = Token(re.compile(r"(\d+)S"),
2800
                         datetime.timedelta(seconds=1),
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2801
                         frozenset((token_end, )))
237.7.157 by Teddy Hogeborn
* clients.conf: Convert all time intervals to new RFC 3339 syntax.
2802
    token_minute = Token(re.compile(r"(\d+)M"),
2803
                         datetime.timedelta(minutes=1),
2804
                         frozenset((token_second, token_end)))
2805
    token_hour = Token(re.compile(r"(\d+)H"),
2806
                       datetime.timedelta(hours=1),
2807
                       frozenset((token_minute, token_end)))
2808
    token_time = Token(re.compile(r"T"),
2809
                       None,
2810
                       frozenset((token_hour, token_minute,
2811
                                  token_second)))
2812
    token_day = Token(re.compile(r"(\d+)D"),
2813
                      datetime.timedelta(days=1),
2814
                      frozenset((token_time, token_end)))
2815
    token_month = Token(re.compile(r"(\d+)M"),
2816
                        datetime.timedelta(weeks=4),
2817
                        frozenset((token_day, token_end)))
2818
    token_year = Token(re.compile(r"(\d+)Y"),
2819
                       datetime.timedelta(weeks=52),
2820
                       frozenset((token_month, token_end)))
2821
    token_week = Token(re.compile(r"(\d+)W"),
2822
                       datetime.timedelta(weeks=1),
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2823
                       frozenset((token_end, )))
237.7.157 by Teddy Hogeborn
* clients.conf: Convert all time intervals to new RFC 3339 syntax.
2824
    token_duration = Token(re.compile(r"P"), None,
2825
                           frozenset((token_year, token_month,
2826
                                      token_day, token_time,
237.7.269 by Teddy Hogeborn
Fix two mutually cancelling bugs.
2827
                                      token_week)))
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2828
    # Define starting values:
2829
    # Value so far
2830
    value = datetime.timedelta()
237.7.157 by Teddy Hogeborn
* clients.conf: Convert all time intervals to new RFC 3339 syntax.
2831
    found_token = None
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2832
    # Following valid tokens
2833
    followers = frozenset((token_duration, ))
2834
    # String left to parse
2835
    s = duration
237.7.157 by Teddy Hogeborn
* clients.conf: Convert all time intervals to new RFC 3339 syntax.
2836
    # Loop until end token is found
2837
    while found_token is not token_end:
2838
        # Search for any currently valid tokens
2839
        for token in followers:
2840
            match = token.regexp.match(s)
2841
            if match is not None:
2842
                # Token found
2843
                if token.value is not None:
2844
                    # Value found, parse digits
2845
                    factor = int(match.group(1), 10)
2846
                    # Add to value so far
2847
                    value += factor * token.value
2848
                # Strip token from string
2849
                s = token.regexp.sub("", s, 1)
2850
                # Go to found token
2851
                found_token = token
2852
                # Set valid next tokens
2853
                followers = found_token.followers
2854
                break
2855
        else:
2856
            # No currently valid tokens were found
237.7.300 by Teddy Hogeborn
mandos: Generate better messages in exceptions.
2857
            raise ValueError("Invalid RFC 3339 duration: {!r}"
2858
                             .format(duration))
237.7.157 by Teddy Hogeborn
* clients.conf: Convert all time intervals to new RFC 3339 syntax.
2859
    # End token found
2860
    return value
2861
2862
4 by Teddy Hogeborn
* server.py (Client.created, Client.next_check): New.
2863
def string_to_delta(interval):
2864
    """Parse a string and return a datetime.timedelta
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2865
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2866
    >>> string_to_delta('7d')
4 by Teddy Hogeborn
* server.py (Client.created, Client.next_check): New.
2867
    datetime.timedelta(7)
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2868
    >>> string_to_delta('60s')
4 by Teddy Hogeborn
* server.py (Client.created, Client.next_check): New.
2869
    datetime.timedelta(0, 60)
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2870
    >>> string_to_delta('60m')
4 by Teddy Hogeborn
* server.py (Client.created, Client.next_check): New.
2871
    datetime.timedelta(0, 3600)
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2872
    >>> string_to_delta('24h')
4 by Teddy Hogeborn
* server.py (Client.created, Client.next_check): New.
2873
    datetime.timedelta(1)
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2874
    >>> string_to_delta('1w')
4 by Teddy Hogeborn
* server.py (Client.created, Client.next_check): New.
2875
    datetime.timedelta(7)
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2876
    >>> string_to_delta('5m 30s')
93 by Teddy Hogeborn
* mandos (string_to_delta): Accept a whitespace-separated sequence of
2877
    datetime.timedelta(0, 330)
4 by Teddy Hogeborn
* server.py (Client.created, Client.next_check): New.
2878
    """
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2879
237.7.157 by Teddy Hogeborn
* clients.conf: Convert all time intervals to new RFC 3339 syntax.
2880
    try:
2881
        return rfc3339_duration_to_delta(interval)
2882
    except ValueError:
2883
        pass
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2884
93 by Teddy Hogeborn
* mandos (string_to_delta): Accept a whitespace-separated sequence of
2885
    timevalue = datetime.timedelta(0)
2886
    for s in interval.split():
2887
        try:
237.7.277 by Teddy Hogeborn
mandos: Stop using str() and remove unnecessary unicode() calls.
2888
            suffix = s[-1]
215 by Teddy Hogeborn
* mandos: Remove unused "select" module. Import "ctypes.util".
2889
            value = int(s[:-1])
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2890
            if suffix == "d":
93 by Teddy Hogeborn
* mandos (string_to_delta): Accept a whitespace-separated sequence of
2891
                delta = datetime.timedelta(value)
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2892
            elif suffix == "s":
93 by Teddy Hogeborn
* mandos (string_to_delta): Accept a whitespace-separated sequence of
2893
                delta = datetime.timedelta(0, value)
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2894
            elif suffix == "m":
93 by Teddy Hogeborn
* mandos (string_to_delta): Accept a whitespace-separated sequence of
2895
                delta = datetime.timedelta(0, 0, 0, 0, value)
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2896
            elif suffix == "h":
93 by Teddy Hogeborn
* mandos (string_to_delta): Accept a whitespace-separated sequence of
2897
                delta = datetime.timedelta(0, 0, 0, 0, 0, value)
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2898
            elif suffix == "w":
93 by Teddy Hogeborn
* mandos (string_to_delta): Accept a whitespace-separated sequence of
2899
                delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
2900
            else:
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2901
                raise ValueError("Unknown suffix {!r}".format(suffix))
237.7.190 by Teddy Hogeborn
Syntax fix; use "raise" better in Mandos server.
2902
        except IndexError as e:
237.7.12 by Teddy Hogeborn
* debian/mandos-client.postrm (purge): Bug fix: update initramfs also
2903
            raise ValueError(*(e.args))
93 by Teddy Hogeborn
* mandos (string_to_delta): Accept a whitespace-separated sequence of
2904
        timevalue += delta
2905
    return timevalue
4 by Teddy Hogeborn
* server.py (Client.created, Client.next_check): New.
2906
8 by Teddy Hogeborn
* Makefile (client_debug): Bug fix; add quotes and / to CERT_ROOT.
2907
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2908
def daemon(nochdir=False, noclose=False):
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
2909
    """See daemon(3).  Standard BSD Unix function.
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2910
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
2911
    This should really exist as os.daemon, but it doesn't (yet)."""
2912
    if os.fork():
2913
        sys.exit()
2914
    os.setsid()
2915
    if not nochdir:
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2916
        os.chdir("/")
46 by Teddy Hogeborn
* network-protocol.txt: New.
2917
    if os.fork():
2918
        sys.exit()
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
2919
    if not noclose:
2920
        # Close all standard open file descriptors
237.18.1 by teddy at recompile
* mandos: Use os.devnull instead of os.path.devnull. Fix some white
2921
        null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
2922
        if not stat.S_ISCHR(os.fstat(null).st_mode):
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2923
            raise OSError(errno.ENODEV,
2924
                          "{} not a character device"
237.7.116 by Teddy Hogeborn
* mandos-monitor: Use new string format method.
2925
                          .format(os.devnull))
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
2926
        os.dup2(null, sys.stdin.fileno())
2927
        os.dup2(null, sys.stdout.fileno())
2928
        os.dup2(null, sys.stderr.fileno())
2929
        if null > 2:
2930
            os.close(null)
2931
2932
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
2933
def main():
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2934
237.2.142 by Teddy Hogeborn
* mandos: Fix line lengths.
2935
    ##################################################################
237.2.90 by Teddy Hogeborn
Merge from pipe IPC branch.
2936
    # Parsing of options, both command line and config file
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2937
237.7.22 by teddy at bsnet
* mandos: Use the new argparse library instead of optparse.
2938
    parser = argparse.ArgumentParser()
2939
    parser.add_argument("-v", "--version", action="version",
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2940
                        version="%(prog)s {}".format(version),
237.7.22 by teddy at bsnet
* mandos: Use the new argparse library instead of optparse.
2941
                        help="show version number and exit")
2942
    parser.add_argument("-i", "--interface", metavar="IF",
2943
                        help="Bind to interface IF")
2944
    parser.add_argument("-a", "--address",
2945
                        help="Address to listen for requests on")
2946
    parser.add_argument("-p", "--port", type=int,
2947
                        help="Port number to receive requests on")
2948
    parser.add_argument("--check", action="store_true",
2949
                        help="Run self-test")
2950
    parser.add_argument("--debug", action="store_true",
2951
                        help="Debug mode; run in foreground and log"
237.7.166 by Teddy Hogeborn
* mandos: Bug fix: Make boolean options work from the config file
2952
                        " to terminal", default=None)
237.7.22 by teddy at bsnet
* mandos: Use the new argparse library instead of optparse.
2953
    parser.add_argument("--debuglevel", metavar="LEVEL",
2954
                        help="Debug level for stdout output")
2955
    parser.add_argument("--priority", help="GnuTLS"
2956
                        " priority string (see GnuTLS documentation)")
2957
    parser.add_argument("--servicename",
2958
                        metavar="NAME", help="Zeroconf service name")
2959
    parser.add_argument("--configdir",
2960
                        default="/etc/mandos", metavar="DIR",
2961
                        help="Directory to search for configuration"
2962
                        " files")
2963
    parser.add_argument("--no-dbus", action="store_false",
2964
                        dest="use_dbus", help="Do not provide D-Bus"
237.7.166 by Teddy Hogeborn
* mandos: Bug fix: Make boolean options work from the config file
2965
                        " system bus interface", default=None)
237.7.22 by teddy at bsnet
* mandos: Use the new argparse library instead of optparse.
2966
    parser.add_argument("--no-ipv6", action="store_false",
237.7.166 by Teddy Hogeborn
* mandos: Bug fix: Make boolean options work from the config file
2967
                        dest="use_ipv6", help="Do not use IPv6",
2968
                        default=None)
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
2969
    parser.add_argument("--no-restore", action="store_false",
237.12.7 by Teddy Hogeborn
* mandos: Break long lines and fix some more white space.
2970
                        dest="restore", help="Do not restore stored"
237.7.166 by Teddy Hogeborn
* mandos: Bug fix: Make boolean options work from the config file
2971
                        " state", default=None)
237.21.1 by Teddy Hogeborn
* mandos: Implement "--socket" option.
2972
    parser.add_argument("--socket", type=int,
2973
                        help="Specify a file descriptor to a network"
2974
                        " socket to use instead of creating one")
237.14.2 by Teddy Hogeborn
Directory with persistent state can now be changed with the "statedir"
2975
    parser.add_argument("--statedir", metavar="DIR",
2976
                        help="Directory to save/restore state in")
237.7.154 by Teddy Hogeborn
* mandos: New "--foreground" option.
2977
    parser.add_argument("--foreground", action="store_true",
237.7.166 by Teddy Hogeborn
* mandos: Bug fix: Make boolean options work from the config file
2978
                        help="Run in foreground", default=None)
237.7.255 by Teddy Hogeborn
mandos: New "--no-zeroconf" option. Also make "--socket=0" work.
2979
    parser.add_argument("--no-zeroconf", action="store_false",
2980
                        dest="zeroconf", help="Do not use Zeroconf",
2981
                        default=None)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2982
237.7.22 by teddy at bsnet
* mandos: Use the new argparse library instead of optparse.
2983
    options = parser.parse_args()
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2984
28 by Teddy Hogeborn
* server.conf: New file.
2985
    # Default values for config file for server-global settings
237.7.510 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
2986
    if gnutls.has_rawpk:
2987
        priority = ("SECURE128:!CTYPE-X.509:+CTYPE-RAWPK:!RSA"
2988
                    ":!VERS-ALL:+VERS-TLS1.3:%PROFILE_ULTRA")
2989
    else:
2990
        priority = ("SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2991
                    ":+SIGN-DSA-SHA256")
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2992
    server_defaults = {"interface": "",
2993
                       "address": "",
2994
                       "port": "",
2995
                       "debug": "False",
237.7.510 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
2996
                       "priority": priority,
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
2997
                       "servicename": "Mandos",
2998
                       "use_dbus": "True",
2999
                       "use_ipv6": "True",
3000
                       "debuglevel": "",
3001
                       "restore": "True",
3002
                       "socket": "",
3003
                       "statedir": "/var/lib/mandos",
3004
                       "foreground": "False",
3005
                       "zeroconf": "True",
3006
                       }
237.7.510 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
3007
    del priority
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3008
28 by Teddy Hogeborn
* server.conf: New file.
3009
    # Parse config file for server-global settings
237.7.687 by Teddy Hogeborn
Update Python 3 compatibility
3010
    server_config = configparser.ConfigParser(server_defaults)
28 by Teddy Hogeborn
* server.conf: New file.
3011
    del server_defaults
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3012
    server_config.read(os.path.join(options.configdir, "mandos.conf"))
237.7.687 by Teddy Hogeborn
Update Python 3 compatibility
3013
    # Convert the ConfigParser object to a dict
89 by Teddy Hogeborn
* Makefile: Bug fix: fixed creation of man pages for section 5 pages.
3014
    server_settings = server_config.defaults()
237.2.45 by Teddy Hogeborn
* mandos (main): Bug fix: use "getint" on the "port" config file
3015
    # Use the appropriate methods on the non-string config options
237.7.446 by Teddy Hogeborn
Server bug fix: Use the mandos.conf "zeroconf" and "restore" options
3016
    for option in ("debug", "use_dbus", "use_ipv6", "restore",
3017
                   "foreground", "zeroconf"):
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
3018
        server_settings[option] = server_config.getboolean("DEFAULT",
237.2.96 by Teddy Hogeborn
Minor code cleanup; one minor bug fix.
3019
                                                           option)
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
3020
    if server_settings["port"]:
3021
        server_settings["port"] = server_config.getint("DEFAULT",
3022
                                                       "port")
237.21.1 by Teddy Hogeborn
* mandos: Implement "--socket" option.
3023
    if server_settings["socket"]:
3024
        server_settings["socket"] = server_config.getint("DEFAULT",
3025
                                                         "socket")
237.7.139 by Teddy Hogeborn
Merge "--socket" option for server.
3026
        # Later, stdin will, and stdout and stderr might, be dup'ed
237.21.1 by Teddy Hogeborn
* mandos: Implement "--socket" option.
3027
        # over with an opened os.devnull.  But we don't want this to
3028
        # happen with a supplied network socket.
3029
        if 0 <= server_settings["socket"] <= 2:
3030
            server_settings["socket"] = os.dup(server_settings
3031
                                               ["socket"])
28 by Teddy Hogeborn
* server.conf: New file.
3032
    del server_config
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3033
28 by Teddy Hogeborn
* server.conf: New file.
3034
    # Override the settings from the config file with command line
3035
    # options, if set.
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
3036
    for option in ("interface", "address", "port", "debug",
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3037
                   "priority", "servicename", "configdir", "use_dbus",
3038
                   "use_ipv6", "debuglevel", "restore", "statedir",
3039
                   "socket", "foreground", "zeroconf"):
28 by Teddy Hogeborn
* server.conf: New file.
3040
        value = getattr(options, option)
3041
        if value is not None:
3042
            server_settings[option] = value
3043
    del options
237.2.96 by Teddy Hogeborn
Minor code cleanup; one minor bug fix.
3044
    # Force all strings to be unicode
3045
    for option in server_settings.keys():
237.7.277 by Teddy Hogeborn
mandos: Stop using str() and remove unnecessary unicode() calls.
3046
        if isinstance(server_settings[option], bytes):
3047
            server_settings[option] = (server_settings[option]
3048
                                       .decode("utf-8"))
237.7.166 by Teddy Hogeborn
* mandos: Bug fix: Make boolean options work from the config file
3049
    # Force all boolean options to be boolean
3050
    for option in ("debug", "use_dbus", "use_ipv6", "restore",
237.7.255 by Teddy Hogeborn
mandos: New "--no-zeroconf" option. Also make "--socket=0" work.
3051
                   "foreground", "zeroconf"):
237.7.166 by Teddy Hogeborn
* mandos: Bug fix: Make boolean options work from the config file
3052
        server_settings[option] = bool(server_settings[option])
237.7.154 by Teddy Hogeborn
* mandos: New "--foreground" option.
3053
    # Debug implies foreground
3054
    if server_settings["debug"]:
3055
        server_settings["foreground"] = True
28 by Teddy Hogeborn
* server.conf: New file.
3056
    # Now we have our good server settings in "server_settings"
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3057
237.2.90 by Teddy Hogeborn
Merge from pipe IPC branch.
3058
    ##################################################################
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3059
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3060
    if (not server_settings["zeroconf"]
3061
        and not (server_settings["port"]
3062
                 or server_settings["socket"] != "")):
3063
        parser.error("Needs port or socket to work without Zeroconf")
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3064
237.2.6 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
3065
    # For convenience
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
3066
    debug = server_settings["debug"]
3067
    debuglevel = server_settings["debuglevel"]
3068
    use_dbus = server_settings["use_dbus"]
3069
    use_ipv6 = server_settings["use_ipv6"]
237.14.2 by Teddy Hogeborn
Directory with persistent state can now be changed with the "statedir"
3070
    stored_state_path = os.path.join(server_settings["statedir"],
3071
                                     stored_state_file)
237.7.154 by Teddy Hogeborn
* mandos: New "--foreground" option.
3072
    foreground = server_settings["foreground"]
237.7.255 by Teddy Hogeborn
mandos: New "--no-zeroconf" option. Also make "--socket=0" work.
3073
    zeroconf = server_settings["zeroconf"]
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3074
237.12.4 by Björn Påhlsson
restructured logger
3075
    if debug:
237.7.78 by teddy at bsnet
* mandos (initlogger): Take new "debug" argument; all callers changed.
3076
        initlogger(debug, logging.DEBUG)
237.12.4 by Björn Påhlsson
restructured logger
3077
    else:
3078
        if not debuglevel:
237.7.78 by teddy at bsnet
* mandos (initlogger): Take new "debug" argument; all callers changed.
3079
            initlogger(debug)
237.12.4 by Björn Påhlsson
restructured logger
3080
        else:
3081
            level = getattr(logging, debuglevel.upper())
237.7.78 by teddy at bsnet
* mandos (initlogger): Take new "debug" argument; all callers changed.
3082
            initlogger(debug, level)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3083
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
3084
    if server_settings["servicename"] != "Mandos":
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3085
        syslogger.setFormatter(
3086
            logging.Formatter('Mandos ({}) [%(process)d]:'
3087
                              ' %(levelname)s: %(message)s'.format(
3088
                                  server_settings["servicename"])))
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3089
28 by Teddy Hogeborn
* server.conf: New file.
3090
    # Parse config file with clients
237.7.687 by Teddy Hogeborn
Update Python 3 compatibility
3091
    client_config = configparser.ConfigParser(Client.client_defaults)
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
3092
    client_config.read(os.path.join(server_settings["configdir"],
3093
                                    "clients.conf"))
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3094
237.2.90 by Teddy Hogeborn
Merge from pipe IPC branch.
3095
    global mandos_dbus_service
3096
    mandos_dbus_service = None
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3097
237.7.255 by Teddy Hogeborn
mandos: New "--no-zeroconf" option. Also make "--socket=0" work.
3098
    socketfd = None
3099
    if server_settings["socket"] != "":
3100
        socketfd = server_settings["socket"]
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3101
    tcp_server = MandosServer(
3102
        (server_settings["address"], server_settings["port"]),
3103
        ClientHandler,
3104
        interface=(server_settings["interface"] or None),
3105
        use_ipv6=use_ipv6,
3106
        gnutls_priority=server_settings["priority"],
3107
        use_dbus=use_dbus,
3108
        socketfd=socketfd)
237.7.154 by Teddy Hogeborn
* mandos: New "--foreground" option.
3109
    if not foreground:
237.7.174 by Teddy Hogeborn
* Makefile (CFLAGS, LDFLAGS): Keep default flags from environment.
3110
        pidfilename = "/run/mandos.pid"
237.7.184 by Teddy Hogeborn
Fall back to /var/run for pidfile if /run is not a directory.
3111
        if not os.path.isdir("/run/."):
3112
            pidfilename = "/var/run/mandos.pid"
237.7.154 by Teddy Hogeborn
* mandos: New "--foreground" option.
3113
        pidfile = None
237.2.202 by Teddy Hogeborn
* mandos: Do not write pid file if --debug is passed.
3114
        try:
237.7.299 by Teddy Hogeborn
mandos: Use codecs.open() and print() for PID file.
3115
            pidfile = codecs.open(pidfilename, "w", encoding="utf-8")
237.7.122 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
3116
        except IOError as e:
3117
            logger.error("Could not open file %r", pidfilename,
3118
                         exc_info=e)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3119
237.7.364 by Teddy Hogeborn
Use "nogroup" as a fallback group, not "nobody".
3120
    for name, group in (("_mandos", "_mandos"),
3121
                        ("mandos", "mandos"),
3122
                        ("nobody", "nogroup")):
237.2.1 by Teddy Hogeborn
First version of a somewhat complete D-Bus server interface. Also
3123
        try:
237.7.114 by Teddy Hogeborn
* mandos (main): Simplify and shorten code selecting user and group ID
3124
            uid = pwd.getpwnam(name).pw_uid
237.7.364 by Teddy Hogeborn
Use "nogroup" as a fallback group, not "nobody".
3125
            gid = pwd.getpwnam(group).pw_gid
237.7.114 by Teddy Hogeborn
* mandos (main): Simplify and shorten code selecting user and group ID
3126
            break
237.2.1 by Teddy Hogeborn
First version of a somewhat complete D-Bus server interface. Also
3127
        except KeyError:
237.7.114 by Teddy Hogeborn
* mandos (main): Simplify and shorten code selecting user and group ID
3128
            continue
3129
    else:
3130
        uid = 65534
3131
        gid = 65534
163 by Teddy Hogeborn
* Makefile (PIDDIR, USER, GROUP): Removed.
3132
    try:
237.2.53 by Teddy Hogeborn
* mandos (main): Bug fix: Do setgid before setuid. Add verbose GnuTLS
3133
        os.setgid(gid)
163 by Teddy Hogeborn
* Makefile (PIDDIR, USER, GROUP): Removed.
3134
        os.setuid(uid)
237.7.373 by Teddy Hogeborn
Server bug fix: Include CAP_SETGID so it does not run as root
3135
        if debug:
3136
            logger.debug("Did setuid/setgid to {}:{}".format(uid,
3137
                                                             gid))
237.7.30 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
3138
    except OSError as error:
237.7.373 by Teddy Hogeborn
Server bug fix: Include CAP_SETGID so it does not run as root
3139
        logger.warning("Failed to setuid/setgid to {}:{}: {}"
3140
                       .format(uid, gid, os.strerror(error.errno)))
237.7.131 by Teddy Hogeborn
* mandos (Client.start_checker): Remove undocumented support for "%%s"
3141
        if error.errno != errno.EPERM:
237.7.190 by Teddy Hogeborn
Syntax fix; use "raise" better in Mandos server.
3142
            raise
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3143
237.2.53 by Teddy Hogeborn
* mandos (main): Bug fix: Do setgid before setuid. Add verbose GnuTLS
3144
    if debug:
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
3145
        # Enable all possible GnuTLS debugging
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3146
237.2.53 by Teddy Hogeborn
* mandos (main): Bug fix: Do setgid before setuid. Add verbose GnuTLS
3147
        # "Use a log level over 10 to enable all debugging options."
3148
        # - GnuTLS manual
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
3149
        gnutls.global_set_log_level(11)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3150
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
3151
        @gnutls.log_func
237.2.53 by Teddy Hogeborn
* mandos (main): Bug fix: Do setgid before setuid. Add verbose GnuTLS
3152
        def debug_gnutls(level, string):
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
3153
            logger.debug("GnuTLS: %s", string[:-1])
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3154
237.7.349 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
3155
        gnutls.global_set_log_function(debug_gnutls)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3156
24.1.155 by Björn Påhlsson
mandos server: Added debuglevel that adjust at what level information
3157
        # Redirect stdin so all checkers get /dev/null
237.18.1 by teddy at recompile
* mandos: Use os.devnull instead of os.path.devnull. Fix some white
3158
        null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
24.1.155 by Björn Påhlsson
mandos server: Added debuglevel that adjust at what level information
3159
        os.dup2(null, sys.stdin.fileno())
3160
        if null > 2:
3161
            os.close(null)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3162
237.7.6 by teddy at bsnet
* mandos (main): Bug fix: Fork before connecting to D-Bus.
3163
    # Need to fork before connecting to D-Bus
237.7.154 by Teddy Hogeborn
* mandos: New "--foreground" option.
3164
    if not foreground:
237.7.6 by teddy at bsnet
* mandos (main): Bug fix: Fork before connecting to D-Bus.
3165
        # Close all input and output, do double fork, etc.
3166
        daemon()
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3167
237.7.687 by Teddy Hogeborn
Update Python 3 compatibility
3168
    if gi.version_info < (3, 10, 2):
3169
        # multiprocessing will use threads, so before we use GLib we
3170
        # need to inform GLib that threads will be used.
3171
        GLib.threads_init()
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3172
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
3173
    global main_loop
3174
    # From the Avahi example code
237.18.1 by teddy at recompile
* mandos: Use os.devnull instead of os.path.devnull. Fix some white
3175
    DBusGMainLoop(set_as_default=True)
237.7.378 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
3176
    main_loop = GLib.MainLoop()
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
3177
    bus = dbus.SystemBus()
3178
    # End of Avahi example code
237.2.6 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
3179
    if use_dbus:
237.2.165 by Teddy Hogeborn
* mandos (Client.disable): Rename keyword argument "log" to "quiet",
3180
        try:
237.7.53 by Björn Påhlsson
The domain name has changed, so the D-Bus bus and interface names must
3181
            bus_name = dbus.service.BusName("se.recompile.Mandos",
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3182
                                            bus,
3183
                                            do_not_queue=True)
3184
            old_bus_name = dbus.service.BusName(
3185
                "se.bsnet.fukt.Mandos", bus,
3186
                do_not_queue=True)
237.7.298 by Teddy Hogeborn
mandos: Disable D-Bus if any DBusException is raised when connecting.
3187
        except dbus.exceptions.DBusException as e:
237.7.122 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
3188
            logger.error("Disabling D-Bus:", exc_info=e)
237.2.165 by Teddy Hogeborn
* mandos (Client.disable): Rename keyword argument "log" to "quiet",
3189
            use_dbus = False
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
3190
            server_settings["use_dbus"] = False
237.2.165 by Teddy Hogeborn
* mandos (Client.disable): Rename keyword argument "log" to "quiet",
3191
            tcp_server.use_dbus = False
237.7.255 by Teddy Hogeborn
mandos: New "--no-zeroconf" option. Also make "--socket=0" work.
3192
    if zeroconf:
3193
        protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3194
        service = AvahiServiceToSyslog(
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3195
            name=server_settings["servicename"],
3196
            servicetype="_mandos._tcp",
3197
            protocol=protocol,
3198
            bus=bus)
237.7.255 by Teddy Hogeborn
mandos: New "--no-zeroconf" option. Also make "--socket=0" work.
3199
        if server_settings["interface"]:
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3200
            service.interface = if_nametoindex(
3201
                server_settings["interface"].encode("utf-8"))
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3202
24.1.152 by Björn Påhlsson
bug fixes that prevent problems when runing server as root
3203
    global multiprocessing_manager
3204
    multiprocessing_manager = multiprocessing.Manager()
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3205
237.2.91 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
3206
    client_class = Client
3207
    if use_dbus:
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3208
        client_class = functools.partial(ClientDBus, bus=bus)
3209
237.12.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
3210
    client_settings = Client.config_parser(client_config)
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
3211
    old_client_settings = {}
237.12.15 by Björn Påhlsson
more refactoring in regards to how clients get created
3212
    clients_data = {}
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3213
237.7.165 by Teddy Hogeborn
* mandos: Bug fix: Don't print output from checkers when running in
3214
    # This is used to redirect stdout and stderr for checker processes
3215
    global wnull
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3216
    wnull = open(os.devnull, "w")  # A writable /dev/null
237.7.165 by Teddy Hogeborn
* mandos: Bug fix: Don't print output from checkers when running in
3217
    # Only used if server is running in foreground but not in debug
3218
    # mode
3219
    if debug or not foreground:
3220
        wnull.close()
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3221
237.12.7 by Teddy Hogeborn
* mandos: Break long lines and fix some more white space.
3222
    # Get client data and settings from last running state.
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
3223
    if server_settings["restore"]:
3224
        try:
3225
            with open(stored_state_path, "rb") as stored_state:
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3226
                if sys.version_info.major == 2:
237.7.376 by Teddy Hogeborn
Server: Add Python 3 compatibility
3227
                    clients_data, old_client_settings = pickle.load(
3228
                        stored_state)
3229
                else:
3230
                    bytes_clients_data, bytes_old_client_settings = (
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3231
                        pickle.load(stored_state, encoding="bytes"))
3232
                    #   Fix bytes to strings
3233
                    #  clients_data
237.7.376 by Teddy Hogeborn
Server: Add Python 3 compatibility
3234
                    # .keys()
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3235
                    clients_data = {(key.decode("utf-8")
3236
                                     if isinstance(key, bytes)
3237
                                     else key): value
3238
                                    for key, value in
3239
                                    bytes_clients_data.items()}
237.7.377 by Teddy Hogeborn
Server: Fix minor thing with Python 3 compatibility
3240
                    del bytes_clients_data
237.7.376 by Teddy Hogeborn
Server: Add Python 3 compatibility
3241
                    for key in clients_data:
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3242
                        value = {(k.decode("utf-8")
3243
                                  if isinstance(k, bytes) else k): v
3244
                                 for k, v in
3245
                                 clients_data[key].items()}
237.7.376 by Teddy Hogeborn
Server: Add Python 3 compatibility
3246
                        clients_data[key] = value
3247
                        # .client_structure
3248
                        value["client_structure"] = [
3249
                            (s.decode("utf-8")
3250
                             if isinstance(s, bytes)
3251
                             else s) for s in
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3252
                            value["client_structure"]]
237.7.376 by Teddy Hogeborn
Server: Add Python 3 compatibility
3253
                        # .name & .host
3254
                        for k in ("name", "host"):
3255
                            if isinstance(value[k], bytes):
3256
                                value[k] = value[k].decode("utf-8")
237.7.678 by Teddy Hogeborn
Update Python 3 compatibility
3257
                        if "key_id" not in value:
237.7.510 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
3258
                            value["key_id"] = ""
237.7.678 by Teddy Hogeborn
Update Python 3 compatibility
3259
                        elif "fingerprint" not in value:
237.7.510 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
3260
                            value["fingerprint"] = ""
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3261
                    #  old_client_settings
237.7.377 by Teddy Hogeborn
Server: Fix minor thing with Python 3 compatibility
3262
                    # .keys()
237.7.376 by Teddy Hogeborn
Server: Add Python 3 compatibility
3263
                    old_client_settings = {
3264
                        (key.decode("utf-8")
3265
                         if isinstance(key, bytes)
3266
                         else key): value
3267
                        for key, value in
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3268
                        bytes_old_client_settings.items()}
237.7.377 by Teddy Hogeborn
Server: Fix minor thing with Python 3 compatibility
3269
                    del bytes_old_client_settings
237.7.376 by Teddy Hogeborn
Server: Add Python 3 compatibility
3270
                    # .host
3271
                    for value in old_client_settings.values():
237.7.377 by Teddy Hogeborn
Server: Fix minor thing with Python 3 compatibility
3272
                        if isinstance(value["host"], bytes):
3273
                            value["host"] = (value["host"]
3274
                                             .decode("utf-8"))
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
3275
            os.remove(stored_state_path)
3276
        except IOError as e:
237.7.122 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
3277
            if e.errno == errno.ENOENT:
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3278
                logger.warning("Could not load persistent state:"
3279
                               " {}".format(os.strerror(e.errno)))
237.7.122 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
3280
            else:
3281
                logger.critical("Could not load persistent state:",
3282
                                exc_info=e)
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
3283
                raise
237.11.23 by Teddy Hogeborn
* mandos (main): Handle EOFError when reading state file.
3284
        except EOFError as e:
3285
            logger.warning("Could not load persistent state: "
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3286
                           "EOFError:",
3287
                           exc_info=e)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3288
237.12.9 by Björn Påhlsson
renamed variables
3289
    with PGPEngine() as pgp:
237.23.4 by Teddy Hogeborn
Use the .items() method instead of .iteritems().
3290
        for client_name, client in clients_data.items():
237.7.165 by Teddy Hogeborn
* mandos: Bug fix: Don't print output from checkers when running in
3291
            # Skip removed clients
3292
            if client_name not in client_settings:
3293
                continue
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3294
237.14.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
3295
            # Decide which value to use after restoring saved state.
3296
            # We have three different values: Old config file,
3297
            # new config file, and saved state.
3298
            # New config value takes precedence if it differs from old
3299
            # config value, otherwise use saved state.
3300
            for name, value in client_settings[client_name].items():
3301
                try:
3302
                    # For each value in new config, check if it
3303
                    # differs from the old config value (Except for
3304
                    # the "secret" attribute)
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3305
                    if (name != "secret"
3306
                        and (value !=
3307
                             old_client_settings[client_name][name])):
237.14.10 by Teddy Hogeborn
* mandos (main): Bug fix: Syntax fix when restoring settings.
3308
                        client[name] = value
237.14.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
3309
                except KeyError:
3310
                    pass
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3311
237.14.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
3312
            # Clients who has passed its expire date can still be
237.24.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
3313
            # enabled if its last checker was successful.  A Client
237.7.100 by teddy at recompile
* mandos: Consistent terminology; use the term "secret" for the
3314
            # whose checker succeeded before we stored its state is
3315
            # assumed to have successfully run all checkers during
3316
            # downtime.
237.14.8 by Teddy Hogeborn
* mandos (ClientDBus.Host_dbus_property,
3317
            if client["enabled"]:
237.12.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
3318
                if datetime.datetime.utcnow() >= client["expires"]:
3319
                    if not client["last_checked_ok"]:
3320
                        logger.warning(
237.23.5 by Teddy Hogeborn
Use the new auto-numbered "{}" syntax for the .format() string method.
3321
                            "disabling client {} - Client never "
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3322
                            "performed a successful checker".format(
3323
                                client_name))
237.12.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
3324
                        client["enabled"] = False
3325
                    elif client["last_checker_status"] != 0:
3326
                        logger.warning(
237.23.5 by Teddy Hogeborn
Use the new auto-numbered "{}" syntax for the .format() string method.
3327
                            "disabling client {} - Client last"
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3328
                            " checker failed with error code"
3329
                            " {}".format(
3330
                                client_name,
3331
                                client["last_checker_status"]))
237.14.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
3332
                        client["enabled"] = False
3333
                    else:
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3334
                        client["expires"] = (
3335
                            datetime.datetime.utcnow()
3336
                            + client["timeout"])
237.7.90 by Björn Påhlsson
fixed bug with bad stored config state for expires and last_checked_ok.
3337
                        logger.debug("Last checker succeeded,"
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3338
                                     " keeping {} enabled".format(
3339
                                         client_name))
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
3340
            try:
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3341
                client["secret"] = pgp.decrypt(
3342
                    client["encrypted_secret"],
3343
                    client_settings[client_name]["secret"])
237.12.9 by Björn Påhlsson
renamed variables
3344
            except PGPError:
237.14.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
3345
                # If decryption fails, we use secret from new settings
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3346
                logger.debug("Failed to decrypt {} old secret".format(
3347
                    client_name))
3348
                client["secret"] = (client_settings[client_name]
3349
                                    ["secret"])
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3350
237.12.15 by Björn Påhlsson
more refactoring in regards to how clients get created
3351
    # Add/remove clients based on new changes made to config
237.7.91 by Teddy Hogeborn
* mandos: Break some long lines.
3352
    for client_name in (set(old_client_settings)
3353
                        - set(client_settings)):
237.12.15 by Björn Påhlsson
more refactoring in regards to how clients get created
3354
        del clients_data[client_name]
237.7.91 by Teddy Hogeborn
* mandos: Break some long lines.
3355
    for client_name in (set(client_settings)
3356
                        - set(old_client_settings)):
237.12.15 by Björn Påhlsson
more refactoring in regards to how clients get created
3357
        clients_data[client_name] = client_settings[client_name]
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3358
237.7.100 by teddy at recompile
* mandos: Consistent terminology; use the term "secret" for the
3359
    # Create all client objects
237.23.4 by Teddy Hogeborn
Use the .items() method instead of .iteritems().
3360
    for client_name, client in clients_data.items():
237.12.15 by Björn Påhlsson
more refactoring in regards to how clients get created
3361
        tcp_server.clients[client_name] = client_class(
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3362
            name=client_name,
3363
            settings=client,
3364
            server_settings=server_settings)
3365
237.2.104 by Teddy Hogeborn
Code cleanup and one bug fix.
3366
    if not tcp_server.clients:
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
3367
        logger.warning("No clients defined")
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3368
237.7.154 by Teddy Hogeborn
* mandos: New "--foreground" option.
3369
    if not foreground:
3370
        if pidfile is not None:
237.7.299 by Teddy Hogeborn
mandos: Use codecs.open() and print() for PID file.
3371
            pid = os.getpid()
237.7.154 by Teddy Hogeborn
* mandos: New "--foreground" option.
3372
            try:
3373
                with pidfile:
237.7.299 by Teddy Hogeborn
mandos: Use codecs.open() and print() for PID file.
3374
                    print(pid, file=pidfile)
237.7.154 by Teddy Hogeborn
* mandos: New "--foreground" option.
3375
            except IOError:
3376
                logger.error("Could not write to file %r with PID %d",
3377
                             pidfilename, pid)
3378
        del pidfile
237.2.202 by Teddy Hogeborn
* mandos: Do not write pid file if --debug is passed.
3379
        del pidfilename
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3380
237.7.379 by Teddy Hogeborn
Server: Fix bug where it did not exit timely on signals
3381
    for termsig in (signal.SIGHUP, signal.SIGTERM):
3382
        GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,
3383
                             lambda: main_loop.quit() and False)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3384
237.2.6 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
3385
    if use_dbus:
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3386
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3387
        @alternate_dbus_interfaces(
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3388
            {"se.recompile.Mandos": "se.bsnet.fukt.Mandos"})
237.7.333 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
3389
        class MandosDBusService(DBusObjectWithObjectManager):
237.2.6 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
3390
            """A D-Bus proxy object"""
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3391
237.2.6 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
3392
            def __init__(self):
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
3393
                dbus.service.Object.__init__(self, bus, "/")
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3394
237.11.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
3395
            _interface = "se.recompile.Mandos"
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3396
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
3397
            @dbus.service.signal(_interface, signature="o")
237.2.174 by Teddy Hogeborn
More consistent terminology: Clients are no longer "invalid" - they
3398
            def ClientAdded(self, objpath):
237.2.6 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
3399
                "D-Bus signal"
3400
                pass
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3401
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
3402
            @dbus.service.signal(_interface, signature="ss")
237.7.510 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
3403
            def ClientNotFound(self, key_id, address):
237.2.90 by Teddy Hogeborn
Merge from pipe IPC branch.
3404
                "D-Bus signal"
3405
                pass
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3406
237.7.333 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
3407
            @dbus_annotations({"org.freedesktop.DBus.Deprecated":
3408
                               "true"})
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
3409
            @dbus.service.signal(_interface, signature="os")
237.2.41 by Teddy Hogeborn
* mandos (Client.GetAllProperties): Also send Client.dbus_object_path
3410
            def ClientRemoved(self, objpath, name):
237.2.6 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
3411
                "D-Bus signal"
3412
                pass
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3413
237.7.333 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
3414
            @dbus_annotations({"org.freedesktop.DBus.Deprecated":
3415
                               "true"})
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
3416
            @dbus.service.method(_interface, out_signature="ao")
237.2.6 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
3417
            def GetAllClients(self):
237.2.46 by Teddy Hogeborn
* mandos (peer_certificate): Handle NULL pointer from
3418
                "D-Bus method"
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3419
                return dbus.Array(c.dbus_object_path for c in
237.7.376 by Teddy Hogeborn
Server: Add Python 3 compatibility
3420
                                  tcp_server.clients.values())
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3421
237.7.333 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
3422
            @dbus_annotations({"org.freedesktop.DBus.Deprecated":
3423
                               "true"})
237.2.96 by Teddy Hogeborn
Minor code cleanup; one minor bug fix.
3424
            @dbus.service.method(_interface,
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
3425
                                 out_signature="a{oa{sv}}")
237.2.6 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
3426
            def GetAllClientsWithProperties(self):
237.2.46 by Teddy Hogeborn
* mandos (peer_certificate): Handle NULL pointer from
3427
                "D-Bus method"
237.2.6 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
3428
                return dbus.Dictionary(
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3429
                    {c.dbus_object_path: c.GetAll(
237.7.333 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
3430
                        "se.recompile.Mandos.Client")
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3431
                     for c in tcp_server.clients.values()},
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
3432
                    signature="oa{sv}")
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3433
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
3434
            @dbus.service.method(_interface, in_signature="o")
237.2.6 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
3435
            def RemoveClient(self, object_path):
237.2.46 by Teddy Hogeborn
* mandos (peer_certificate): Handle NULL pointer from
3436
                "D-Bus method"
237.7.376 by Teddy Hogeborn
Server: Add Python 3 compatibility
3437
                for c in tcp_server.clients.values():
237.2.6 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
3438
                    if c.dbus_object_path == object_path:
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
3439
                        del tcp_server.clients[c.name]
237.2.91 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
3440
                        c.remove_from_connection()
237.7.333 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
3441
                        # Don't signal the disabling
237.2.165 by Teddy Hogeborn
* mandos (Client.disable): Rename keyword argument "log" to "quiet",
3442
                        c.disable(quiet=True)
237.7.333 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
3443
                        # Emit D-Bus signal for removal
3444
                        self.client_removed_signal(c)
237.2.41 by Teddy Hogeborn
* mandos (Client.GetAllProperties): Also send Client.dbus_object_path
3445
                        return
237.2.163 by Teddy Hogeborn
* mandos (Client.enable): Bug fix: Start new immediate checker last to
3446
                raise KeyError(object_path)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3447
237.2.6 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
3448
            del _interface
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3449
237.7.333 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
3450
            @dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3451
                                 out_signature="a{oa{sa{sv}}}")
237.7.333 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
3452
            def GetManagedObjects(self):
3453
                """D-Bus method"""
3454
                return dbus.Dictionary(
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3455
                    {client.dbus_object_path:
3456
                     dbus.Dictionary(
3457
                         {interface: client.GetAll(interface)
3458
                          for interface in
3459
                          client._get_all_interface_names()})
3460
                     for client in tcp_server.clients.values()})
3461
237.7.333 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
3462
            def client_added_signal(self, client):
3463
                """Send the new standard signal and the old signal"""
3464
                if use_dbus:
3465
                    # New standard signal
3466
                    self.InterfacesAdded(
3467
                        client.dbus_object_path,
3468
                        dbus.Dictionary(
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3469
                            {interface: client.GetAll(interface)
3470
                             for interface in
3471
                             client._get_all_interface_names()}))
237.7.333 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
3472
                    # Old signal
3473
                    self.ClientAdded(client.dbus_object_path)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3474
237.7.333 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
3475
            def client_removed_signal(self, client):
3476
                """Send the new standard signal and the old signal"""
3477
                if use_dbus:
3478
                    # New standard signal
3479
                    self.InterfacesRemoved(
3480
                        client.dbus_object_path,
3481
                        client._get_all_interface_names())
3482
                    # Old signal
3483
                    self.ClientRemoved(client.dbus_object_path,
3484
                                       client.name)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3485
237.7.123 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
3486
        mandos_dbus_service = MandosDBusService()
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3487
237.7.398 by Teddy Hogeborn
mandos: Bug fix: Do multiprocessing cleanup correctly on exit
3488
    # Save modules to variables to exempt the modules from being
3489
    # unloaded before the function registered with atexit() is run.
3490
    mp = multiprocessing
3491
    wn = wnull
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3492
237.2.163 by Teddy Hogeborn
* mandos (Client.enable): Bug fix: Start new immediate checker last to
3493
    def cleanup():
3494
        "Cleanup function; run on exit"
237.7.255 by Teddy Hogeborn
mandos: New "--no-zeroconf" option. Also make "--socket=0" work.
3495
        if zeroconf:
3496
            service.cleanup()
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3497
237.7.398 by Teddy Hogeborn
mandos: Bug fix: Do multiprocessing cleanup correctly on exit
3498
        mp.active_children()
3499
        wn.close()
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
3500
        if not (tcp_server.clients or client_settings):
3501
            return
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3502
237.7.69 by teddy at bsnet
* debian/control (mandos/Depends): Added "python-crypto".
3503
        # Store client before exiting. Secrets are encrypted with key
3504
        # based on what config file has. If config file is
3505
        # removed/edited, old secret will thus be unrecovable.
237.12.15 by Björn Påhlsson
more refactoring in regards to how clients get created
3506
        clients = {}
237.12.9 by Björn Påhlsson
renamed variables
3507
        with PGPEngine() as pgp:
237.7.376 by Teddy Hogeborn
Server: Add Python 3 compatibility
3508
            for client in tcp_server.clients.values():
237.14.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
3509
                key = client_settings[client.name]["secret"]
237.12.9 by Björn Påhlsson
renamed variables
3510
                client.encrypted_secret = pgp.encrypt(client.secret,
3511
                                                      key)
237.14.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
3512
                client_dict = {}
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3513
237.12.15 by Björn Påhlsson
more refactoring in regards to how clients get created
3514
                # A list of attributes that can not be pickled
3515
                # + secret.
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3516
                exclude = {"bus", "changedstate", "secret",
3517
                           "checker", "server_settings"}
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3518
                for name, typ in inspect.getmembers(dbus.service
3519
                                                    .Object):
237.14.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
3520
                    exclude.add(name)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3521
237.14.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
3522
                client_dict["encrypted_secret"] = (client
3523
                                                   .encrypted_secret)
3524
                for attr in client.client_structure:
3525
                    if attr not in exclude:
3526
                        client_dict[attr] = getattr(client, attr)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3527
237.12.15 by Björn Påhlsson
more refactoring in regards to how clients get created
3528
                clients[client.name] = client_dict
237.14.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
3529
                del client_settings[client.name]["secret"]
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3530
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
3531
        try:
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3532
            with tempfile.NamedTemporaryFile(
3533
                    mode='wb',
3534
                    suffix=".pickle",
3535
                    prefix='clients-',
3536
                    dir=os.path.dirname(stored_state_path),
3537
                    delete=False) as stored_state:
237.7.376 by Teddy Hogeborn
Server: Add Python 3 compatibility
3538
                pickle.dump((clients, client_settings), stored_state,
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3539
                            protocol=2)
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3540
                tempname = stored_state.name
237.11.26 by teddy at bsnet
* mandos (main/cleanup): Write new file, then rename. Use
3541
            os.rename(tempname, stored_state_path)
237.14.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
3542
        except (IOError, OSError) as e:
237.7.78 by teddy at bsnet
* mandos (initlogger): Take new "debug" argument; all callers changed.
3543
            if not debug:
3544
                try:
3545
                    os.remove(tempname)
3546
                except NameError:
3547
                    pass
237.7.122 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
3548
            if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
237.23.5 by Teddy Hogeborn
Use the new auto-numbered "{}" syntax for the .format() string method.
3549
                logger.warning("Could not save persistent state: {}"
237.7.122 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
3550
                               .format(os.strerror(e.errno)))
3551
            else:
3552
                logger.warning("Could not save persistent state:",
3553
                               exc_info=e)
237.7.190 by Teddy Hogeborn
Syntax fix; use "raise" better in Mandos server.
3554
                raise
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3555
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
3556
        # Delete all clients, and settings from config
237.2.163 by Teddy Hogeborn
* mandos (Client.enable): Bug fix: Start new immediate checker last to
3557
        while tcp_server.clients:
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
3558
            name, client = tcp_server.clients.popitem()
237.2.165 by Teddy Hogeborn
* mandos (Client.disable): Rename keyword argument "log" to "quiet",
3559
            if use_dbus:
3560
                client.remove_from_connection()
237.7.333 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
3561
            # Don't signal the disabling
237.2.165 by Teddy Hogeborn
* mandos (Client.disable): Rename keyword argument "log" to "quiet",
3562
            client.disable(quiet=True)
237.7.333 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
3563
            # Emit D-Bus signal for removal
237.7.344 by Teddy Hogeborn
On cleanup, Signal ClientRemoved only if using D-Bus.
3564
            if use_dbus:
3565
                mandos_dbus_service.client_removed_signal(client)
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
3566
        client_settings.clear()
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3567
237.2.163 by Teddy Hogeborn
* mandos (Client.enable): Bug fix: Start new immediate checker last to
3568
    atexit.register(cleanup)
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3569
237.7.376 by Teddy Hogeborn
Server: Add Python 3 compatibility
3570
    for client in tcp_server.clients.values():
237.2.6 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
3571
        if use_dbus:
237.7.333 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
3572
            # Emit D-Bus signal for adding
3573
            mandos_dbus_service.client_added_signal(client)
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
3574
        # Need to initiate checking of clients
3575
        if client.enabled:
3576
            client.init_checker()
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3577
163 by Teddy Hogeborn
* Makefile (PIDDIR, USER, GROUP): Removed.
3578
    tcp_server.enable()
3579
    tcp_server.server_activate()
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3580
28 by Teddy Hogeborn
* server.conf: New file.
3581
    # Find out what port we got
237.7.255 by Teddy Hogeborn
mandos: New "--no-zeroconf" option. Also make "--socket=0" work.
3582
    if zeroconf:
3583
        service.port = tcp_server.socket.getsockname()[1]
237.2.77 by Teddy Hogeborn
Support not using IPv6 in server:
3584
    if use_ipv6:
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
3585
        logger.info("Now listening on address %r, port %d,"
237.7.116 by Teddy Hogeborn
* mandos-monitor: Use new string format method.
3586
                    " flowinfo %d, scope_id %d",
3587
                    *tcp_server.socket.getsockname())
237.2.77 by Teddy Hogeborn
Support not using IPv6 in server:
3588
    else:                       # IPv4
237.7.116 by Teddy Hogeborn
* mandos-monitor: Use new string format method.
3589
        logger.info("Now listening on address %r, port %d",
3590
                    *tcp_server.socket.getsockname())
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3591
3592
    # service.interface = tcp_server.socket.getsockname()[3]
3593
28 by Teddy Hogeborn
* server.conf: New file.
3594
    try:
237.7.255 by Teddy Hogeborn
mandos: New "--no-zeroconf" option. Also make "--socket=0" work.
3595
        if zeroconf:
3596
            # From the Avahi example code
3597
            try:
3598
                service.activate()
3599
            except dbus.exceptions.DBusException as error:
3600
                logger.critical("D-Bus Exception", exc_info=error)
3601
                cleanup()
3602
                sys.exit(1)
3603
            # End of Avahi example code
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3604
237.7.715 by Teddy Hogeborn
Server: Use new GLib.io_add_watch() call signature
3605
        GLib.io_add_watch(tcp_server.fileno(), GLib.PRIORITY_DEFAULT,
3606
                          GLib.IO_IN,
237.7.378 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
3607
                          lambda *args, **kwargs:
3608
                          (tcp_server.handle_request
3609
                           (*args[2:], **kwargs) or True))
237.7.422 by Teddy Hogeborn
PEP8 compliance: mandos
3610
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
3611
        logger.debug("Starting main loop")
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
3612
        main_loop.run()
237.7.30 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
3613
    except AvahiError as error:
237.7.113 by Teddy Hogeborn
* mandos (AvahiService.rename, Client.start_checker,
3614
        logger.critical("Avahi Error", exc_info=error)
237.2.164 by Teddy Hogeborn
* README (FAQ): Fix typo.
3615
        cleanup()
28 by Teddy Hogeborn
* server.conf: New file.
3616
        sys.exit(1)
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
3617
    except KeyboardInterrupt:
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
3618
        if debug:
237.8.5 by teddy at bsnet
* mandos: Use unicode string literals.
3619
            print("", file=sys.stderr)
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
3620
        logger.debug("Server received KeyboardInterrupt")
3621
    logger.debug("Server exiting")
237.2.164 by Teddy Hogeborn
* README (FAQ): Fix typo.
3622
    # Must run before the D-Bus bus name gets deregistered
3623
    cleanup()
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
3624
237.7.713 by Teddy Hogeborn
Server: Add scaffolding for tests
3625

3626
def should_only_run_tests():
3627
    parser = argparse.ArgumentParser(add_help=False)
3628
    parser.add_argument("--check", action='store_true')
3629
    args, unknown_args = parser.parse_known_args()
3630
    run_tests = args.check
3631
    if run_tests:
3632
        # Remove --check argument from sys.argv
3633
        sys.argv[1:] = unknown_args
3634
    return run_tests
3635
3636
# Add all tests from doctest strings
3637
def load_tests(loader, tests, none):
3638
    import doctest
3639
    tests.addTests(doctest.DocTestSuite())
3640
    return tests
237.7.294 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3641
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
3642
if __name__ == '__main__':
237.7.713 by Teddy Hogeborn
Server: Add scaffolding for tests
3643
    try:
3644
        if should_only_run_tests():
3645
            # Call using ./mandos --check [--verbose]
3646
            unittest.main()
3647
        else:
3648
            main()
3649
    finally:
3650
        logging.shutdown()