/mandos/release

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/release
3 by Björn Påhlsson
Python based server
1
#!/usr/bin/python
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
2
# -*- mode: python; coding: utf-8 -*-
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
3
# 
4
# Mandos server - give out binary blobs to connecting clients.
5
# 
6
# This program is partly derived from an example program for an Avahi
7
# service publisher, downloaded from
8
# <http://avahi.org/wiki/PythonPublishExample>.  This includes the
237.2.99 by Teddy Hogeborn
Code cleanup.
9
# methods "add", "remove", "server_state_changed",
10
# "entry_group_state_changed", "cleanup", and "activate" in the
11
# "AvahiService" class, and some lines in "main".
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
12
# 
28 by Teddy Hogeborn
* server.conf: New file.
13
# Everything else is
237.7.197 by Teddy Hogeborn
Minor code fix; raise only exception instances, not classes.
14
# Copyright © 2008-2014 Teddy Hogeborn
15
# Copyright © 2008-2014 Björn Påhlsson
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
16
# 
17
# This program is free software: you can redistribute it and/or modify
18
# it under the terms of the GNU General Public License as published by
19
# the Free Software Foundation, either version 3 of the License, or
20
# (at your option) any later version.
21
#
22
#     This program is distributed in the hope that it will be useful,
23
#     but WITHOUT ANY WARRANTY; without even the implied warranty of
24
#     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
25
#     GNU General Public License for more details.
26
# 
27
# You should have received a copy of the GNU General Public License
109 by Teddy Hogeborn
* .bzrignore: New.
28
# along with this program.  If not, see
29
# <http://www.gnu.org/licenses/>.
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
30
# 
237.11.2 by Teddy Hogeborn
Change "fukt.bsnet.se" to "recompile.se" throughout.
31
# Contact the authors at <mandos@recompile.se>.
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
32
# 
3 by Björn Påhlsson
Python based server
33
237.8.5 by teddy at bsnet
* mandos: Use unicode string literals.
34
from __future__ import (division, absolute_import, print_function,
35
                        unicode_literals)
10 by Teddy Hogeborn
* server.py: Bug fix: Do "from __future__ import division".
36
237.7.127 by Teddy Hogeborn
* mandos: Use all new builtins.
37
from future_builtins import *
38
237.2.98 by Teddy Hogeborn
* mandos: Import "SocketServer" as "socketserver" and "ConfigParser"
39
import SocketServer as socketserver
3 by Björn Påhlsson
Python based server
40
import socket
237.7.22 by teddy at bsnet
* mandos: Use the new argparse library instead of optparse.
41
import argparse
3 by Björn Påhlsson
Python based server
42
import datetime
43
import errno
44
import gnutls.crypto
45
import gnutls.connection
46
import gnutls.errors
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
47
import gnutls.library.functions
48
import gnutls.library.constants
49
import gnutls.library.types
237.2.98 by Teddy Hogeborn
* mandos: Import "SocketServer" as "socketserver" and "ConfigParser"
50
import ConfigParser as configparser
4 by Teddy Hogeborn
* server.py (Client.created, Client.next_check): New.
51
import sys
9 by Teddy Hogeborn
* client.cpp (main): Get t_old early since it is used on error exits.
52
import re
53
import os
54
import signal
10 by Teddy Hogeborn
* server.py: Bug fix: Do "from __future__ import division".
55
import subprocess
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
56
import atexit
57
import stat
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
58
import logging
59
import logging.handlers
163 by Teddy Hogeborn
* Makefile (PIDDIR, USER, GROUP): Removed.
60
import pwd
237.2.174 by Teddy Hogeborn
More consistent terminology: Clients are no longer "invalid" - they
61
import contextlib
237.2.96 by Teddy Hogeborn
Minor code cleanup; one minor bug fix.
62
import struct
63
import fcntl
237.2.100 by Teddy Hogeborn
Code cleanup. Move some global stuff into main.
64
import functools
237.2.174 by Teddy Hogeborn
More consistent terminology: Clients are no longer "invalid" - they
65
import cPickle as pickle
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
66
import multiprocessing
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
67
import types
237.14.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
68
import binascii
69
import tempfile
237.18.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
70
import itertools
237.7.157 by Teddy Hogeborn
* clients.conf: Convert all time intervals to new RFC 3339 syntax.
71
import collections
5 by Teddy Hogeborn
* server.py (server_metaclass): New.
72
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
73
import dbus
237.1.1 by Teddy Hogeborn
First steps of a D-Bus interface to the server.
74
import dbus.service
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
75
import gobject
76
import avahi
77
from dbus.mainloop.glib import DBusGMainLoop
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
78
import ctypes
215 by Teddy Hogeborn
* mandos: Remove unused "select" module. Import "ctypes.util".
79
import ctypes.util
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
80
import xml.dom.minidom
81
import inspect
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
82
237.2.94 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
83
try:
84
    SO_BINDTODEVICE = socket.SO_BINDTODEVICE
85
except AttributeError:
86
    try:
87
        from IN import SO_BINDTODEVICE
88
    except ImportError:
237.2.101 by Teddy Hogeborn
* mandos: Minor doc string fixes.
89
        SO_BINDTODEVICE = None
237.2.94 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
90
310 by Teddy Hogeborn
* Makefile (version): Changed to "1.6.4".
91
version = "1.6.4"
237.14.2 by Teddy Hogeborn
Directory with persistent state can now be changed with the "statedir"
92
stored_state_file = "clients.pickle"
13 by Björn Påhlsson
Added following support:
93
237.11.20 by Teddy Hogeborn
* Makefile (run-server): Remove obsolete warning.
94
logger = logging.getLogger()
237.7.203 by Teddy Hogeborn
Allow self-tests to run without needing /dev/log.
95
syslogger = None
13 by Björn Påhlsson
Added following support:
96
237.12.5 by Björn Påhlsson
First run of python-lint. Fixed some *obviously* bad code and turned
97
try:
98
    if_nametoindex = (ctypes.cdll.LoadLibrary
99
                      (ctypes.util.find_library("c"))
100
                      .if_nametoindex)
101
except (OSError, AttributeError):
102
    def if_nametoindex(interface):
103
        "Get an interface index the hard way, i.e. using fcntl()"
104
        SIOCGIFINDEX = 0x8933  # From /usr/include/linux/sockios.h
105
        with contextlib.closing(socket.socket()) as s:
106
            ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
107
                                struct.pack(str("16s16x"),
108
                                            interface))
109
        interface_index = struct.unpack(str("I"),
110
                                        ifreq[16:20])[0]
111
        return interface_index
112
113
237.7.78 by teddy at bsnet
* mandos (initlogger): Take new "debug" argument; all callers changed.
114
def initlogger(debug, level=logging.WARNING):
237.12.4 by Björn Påhlsson
restructured logger
115
    """init logger and add loglevel"""
116
    
237.7.203 by Teddy Hogeborn
Allow self-tests to run without needing /dev/log.
117
    syslogger = (logging.handlers.SysLogHandler
118
                 (facility =
119
                  logging.handlers.SysLogHandler.LOG_DAEMON,
120
                  address = str("/dev/log")))
237.12.4 by Björn Påhlsson
restructured logger
121
    syslogger.setFormatter(logging.Formatter
122
                           ('Mandos [%(process)d]: %(levelname)s:'
123
                            ' %(message)s'))
124
    logger.addHandler(syslogger)
125
    
237.7.78 by teddy at bsnet
* mandos (initlogger): Take new "debug" argument; all callers changed.
126
    if debug:
127
        console = logging.StreamHandler()
128
        console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
129
                                               ' [%(process)d]:'
130
                                               ' %(levelname)s:'
131
                                               ' %(message)s'))
132
        logger.addHandler(console)
237.12.4 by Björn Påhlsson
restructured logger
133
    logger.setLevel(level)
28 by Teddy Hogeborn
* server.conf: New file.
134
237.11.20 by Teddy Hogeborn
* Makefile (run-server): Remove obsolete warning.
135
237.12.9 by Björn Påhlsson
renamed variables
136
class PGPError(Exception):
137
    """Exception if encryption/decryption fails"""
237.14.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
138
    pass
139
140
237.12.9 by Björn Påhlsson
renamed variables
141
class PGPEngine(object):
237.14.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
142
    """A simple class for OpenPGP symmetric encryption & decryption"""
143
    def __init__(self):
144
        self.tempdir = tempfile.mkdtemp(prefix="mandos-")
237.7.163 by Teddy Hogeborn
* mandos: Don't use the GnuPGInterface module.
145
        self.gnupgargs = ['--batch',
146
                          '--home', self.tempdir,
147
                          '--force-mdc',
148
                          '--quiet',
149
                          '--no-use-agent']
237.14.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
150
    
151
    def __enter__(self):
152
        return self
153
    
237.7.135 by Teddy Hogeborn
* Makefile (DOCBOOKTOMAN): Only run man --warnings if both "man" and
154
    def __exit__(self, exc_type, exc_value, traceback):
237.14.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
155
        self._cleanup()
156
        return False
157
    
158
    def __del__(self):
159
        self._cleanup()
160
    
161
    def _cleanup(self):
162
        if self.tempdir is not None:
163
            # Delete contents of tempdir
164
            for root, dirs, files in os.walk(self.tempdir,
165
                                             topdown = False):
166
                for filename in files:
167
                    os.remove(os.path.join(root, filename))
168
                for dirname in dirs:
169
                    os.rmdir(os.path.join(root, dirname))
170
            # Remove tempdir
171
            os.rmdir(self.tempdir)
172
            self.tempdir = None
173
    
174
    def password_encode(self, password):
175
        # Passphrase can not be empty and can not contain newlines or
176
        # NUL bytes.  So we prefix it and hex encode it.
237.7.178 by Teddy Hogeborn
* mandos (PGPEngine.password_encode): Bug fix: GnuPG can't handle
177
        encoded = b"mandos" + binascii.hexlify(password)
178
        if len(encoded) > 2048:
179
            # GnuPG can't handle long passwords, so encode differently
180
            encoded = (b"mandos" + password.replace(b"\\", b"\\\\")
181
                       .replace(b"\n", b"\\n")
182
                       .replace(b"\0", b"\\x00"))
183
        return encoded
237.14.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
184
    
185
    def encrypt(self, data, password):
237.7.163 by Teddy Hogeborn
* mandos: Don't use the GnuPGInterface module.
186
        passphrase = self.password_encode(password)
187
        with tempfile.NamedTemporaryFile(dir=self.tempdir
188
                                         ) as passfile:
189
            passfile.write(passphrase)
190
            passfile.flush()
191
            proc = subprocess.Popen(['gpg', '--symmetric',
192
                                     '--passphrase-file',
193
                                     passfile.name]
194
                                    + self.gnupgargs,
195
                                    stdin = subprocess.PIPE,
196
                                    stdout = subprocess.PIPE,
197
                                    stderr = subprocess.PIPE)
198
            ciphertext, err = proc.communicate(input = data)
199
        if proc.returncode != 0:
200
            raise PGPError(err)
237.14.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
201
        return ciphertext
202
    
203
    def decrypt(self, data, password):
237.7.163 by Teddy Hogeborn
* mandos: Don't use the GnuPGInterface module.
204
        passphrase = self.password_encode(password)
205
        with tempfile.NamedTemporaryFile(dir = self.tempdir
206
                                         ) as passfile:
207
            passfile.write(passphrase)
208
            passfile.flush()
209
            proc = subprocess.Popen(['gpg', '--decrypt',
210
                                     '--passphrase-file',
211
                                     passfile.name]
212
                                    + self.gnupgargs,
213
                                    stdin = subprocess.PIPE,
214
                                    stdout = subprocess.PIPE,
215
                                    stderr = subprocess.PIPE)
216
            decrypted_plaintext, err = proc.communicate(input
217
                                                        = data)
218
        if proc.returncode != 0:
219
            raise PGPError(err)
237.14.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
220
        return decrypted_plaintext
221
222
28 by Teddy Hogeborn
* server.conf: New file.
223
class AvahiError(Exception):
237.2.5 by Teddy Hogeborn
* mandos (AvahiError): Converted to use unicode. All users changed.
224
    def __init__(self, value, *args, **kwargs):
28 by Teddy Hogeborn
* server.conf: New file.
225
        self.value = value
237.2.5 by Teddy Hogeborn
* mandos (AvahiError): Converted to use unicode. All users changed.
226
        super(AvahiError, self).__init__(value, *args, **kwargs)
227
    def __unicode__(self):
228
        return unicode(repr(self.value))
28 by Teddy Hogeborn
* server.conf: New file.
229
230
class AvahiServiceError(AvahiError):
231
    pass
232
233
class AvahiGroupError(AvahiError):
234
    pass
235
236
237
class AvahiService(object):
45 by Teddy Hogeborn
* server.py: Cosmetic changes.
238
    """An Avahi (Zeroconf) service.
237.2.94 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
239
    
45 by Teddy Hogeborn
* server.py: Cosmetic changes.
240
    Attributes:
28 by Teddy Hogeborn
* server.conf: New file.
241
    interface: integer; avahi.IF_UNSPEC or an interface index.
242
               Used to optionally bind to the specified interface.
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
243
    name: string; Example: 'Mandos'
244
    type: string; Example: '_mandos._tcp'.
237.7.162 by Teddy Hogeborn
* mandos: Comment changes.
245
     See <https://www.iana.org/assignments/service-names-port-numbers>
45 by Teddy Hogeborn
* server.py: Cosmetic changes.
246
    port: integer; what port to announce
247
    TXT: list of strings; TXT record for the service
248
    domain: string; Domain to publish on, default to .local if empty.
249
    host: string; Host to publish records for, default is localhost
250
    max_renames: integer; maximum number of renames
251
    rename_count: integer; counter so we only rename after collisions
252
                  a sensible number of times
237.2.99 by Teddy Hogeborn
Code cleanup.
253
    group: D-Bus Entry Group
254
    server: D-Bus Server
237.2.101 by Teddy Hogeborn
* mandos: Minor doc string fixes.
255
    bus: dbus.SystemBus()
28 by Teddy Hogeborn
* server.conf: New file.
256
    """
237.7.121 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
257
    
28 by Teddy Hogeborn
* server.conf: New file.
258
    def __init__(self, interface = avahi.IF_UNSPEC, name = None,
237.1.2 by Teddy Hogeborn
Further steps towards a D-Bus server interface, plus minor syntax
259
                 servicetype = None, port = None, TXT = None,
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
260
                 domain = "", host = "", max_renames = 32768,
237.2.100 by Teddy Hogeborn
Code cleanup. Move some global stuff into main.
261
                 protocol = avahi.PROTO_UNSPEC, bus = None):
28 by Teddy Hogeborn
* server.conf: New file.
262
        self.interface = interface
263
        self.name = name
215 by Teddy Hogeborn
* mandos: Remove unused "select" module. Import "ctypes.util".
264
        self.type = servicetype
28 by Teddy Hogeborn
* server.conf: New file.
265
        self.port = port
237.1.2 by Teddy Hogeborn
Further steps towards a D-Bus server interface, plus minor syntax
266
        self.TXT = TXT if TXT is not None else []
28 by Teddy Hogeborn
* server.conf: New file.
267
        self.domain = domain
268
        self.host = host
269
        self.rename_count = 0
76 by Teddy Hogeborn
* plugins.d/password-request.c (init_gnutls_global): Renamed
270
        self.max_renames = max_renames
237.2.77 by Teddy Hogeborn
Support not using IPv6 in server:
271
        self.protocol = protocol
237.2.99 by Teddy Hogeborn
Code cleanup.
272
        self.group = None       # our entry group
273
        self.server = None
237.2.100 by Teddy Hogeborn
Code cleanup. Move some global stuff into main.
274
        self.bus = bus
237.7.30 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
275
        self.entry_group_state_changed_match = None
237.7.121 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
276
    
28 by Teddy Hogeborn
* server.conf: New file.
277
    def rename(self):
278
        """Derived from the Avahi example code"""
279
        if self.rename_count >= self.max_renames:
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
280
            logger.critical("No suitable Zeroconf service name found"
281
                            " after %i retries, exiting.",
215 by Teddy Hogeborn
* mandos: Remove unused "select" module. Import "ctypes.util".
282
                            self.rename_count)
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
283
            raise AvahiServiceError("Too many renames")
237.11.3 by Teddy Hogeborn
* mandos: Break long lines.
284
        self.name = unicode(self.server
285
                            .GetAlternativeServiceName(self.name))
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
286
        logger.info("Changing Zeroconf service name to %r ...",
24.1.155 by Björn Påhlsson
mandos server: Added debuglevel that adjust at what level information
287
                    self.name)
28 by Teddy Hogeborn
* server.conf: New file.
288
        self.remove()
24.1.160 by Björn Påhlsson
fixed bug with local name collisions after a non-local name collision
289
        try:
290
            self.add()
237.7.30 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
291
        except dbus.exceptions.DBusException as error:
237.7.113 by Teddy Hogeborn
* mandos (AvahiService.rename, Client.start_checker,
292
            logger.critical("D-Bus Exception", exc_info=error)
24.1.160 by Björn Påhlsson
fixed bug with local name collisions after a non-local name collision
293
            self.cleanup()
294
            os._exit(1)
28 by Teddy Hogeborn
* server.conf: New file.
295
        self.rename_count += 1
237.7.121 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
296
    
28 by Teddy Hogeborn
* server.conf: New file.
297
    def remove(self):
298
        """Derived from the Avahi example code"""
237.7.30 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
299
        if self.entry_group_state_changed_match is not None:
300
            self.entry_group_state_changed_match.remove()
301
            self.entry_group_state_changed_match = None
237.7.31 by Teddy Hogeborn
* mandos: Never call .Reset() on a defunct Avahi entry group.
302
        if self.group is not None:
303
            self.group.Reset()
237.7.121 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
304
    
28 by Teddy Hogeborn
* server.conf: New file.
305
    def add(self):
306
        """Derived from the Avahi example code"""
237.7.30 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
307
        self.remove()
237.7.31 by Teddy Hogeborn
* mandos: Never call .Reset() on a defunct Avahi entry group.
308
        if self.group is None:
309
            self.group = dbus.Interface(
310
                self.bus.get_object(avahi.DBUS_NAME,
311
                                    self.server.EntryGroupNew()),
312
                avahi.DBUS_INTERFACE_ENTRY_GROUP)
237.7.30 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
313
        self.entry_group_state_changed_match = (
314
            self.group.connect_to_signal(
237.11.20 by Teddy Hogeborn
* Makefile (run-server): Remove obsolete warning.
315
                'StateChanged', self.entry_group_state_changed))
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
316
        logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
237.2.99 by Teddy Hogeborn
Code cleanup.
317
                     self.name, self.type)
318
        self.group.AddService(
319
            self.interface,
320
            self.protocol,
321
            dbus.UInt32(0),     # flags
322
            self.name, self.type,
323
            self.domain, self.host,
324
            dbus.UInt16(self.port),
325
            avahi.string_array_to_txt_array(self.TXT))
326
        self.group.Commit()
237.7.121 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
327
    
237.2.99 by Teddy Hogeborn
Code cleanup.
328
    def entry_group_state_changed(self, state, error):
329
        """Derived from the Avahi example code"""
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
330
        logger.debug("Avahi entry group state change: %i", state)
237.2.99 by Teddy Hogeborn
Code cleanup.
331
        
332
        if state == avahi.ENTRY_GROUP_ESTABLISHED:
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
333
            logger.debug("Zeroconf service established.")
237.2.99 by Teddy Hogeborn
Code cleanup.
334
        elif state == avahi.ENTRY_GROUP_COLLISION:
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
335
            logger.info("Zeroconf service name collision.")
237.2.99 by Teddy Hogeborn
Code cleanup.
336
            self.rename()
337
        elif state == avahi.ENTRY_GROUP_FAILURE:
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
338
            logger.critical("Avahi: Error in group state changed %s",
237.2.99 by Teddy Hogeborn
Code cleanup.
339
                            unicode(error))
237.7.116 by Teddy Hogeborn
* mandos-monitor: Use new string format method.
340
            raise AvahiGroupError("State changed: {0!s}"
341
                                  .format(error))
237.7.121 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
342
    
237.2.99 by Teddy Hogeborn
Code cleanup.
343
    def cleanup(self):
344
        """Derived from the Avahi example code"""
237.7.31 by Teddy Hogeborn
* mandos: Never call .Reset() on a defunct Avahi entry group.
345
        if self.group is not None:
346
            try:
347
                self.group.Free()
348
            except (dbus.exceptions.UnknownMethodException,
237.12.5 by Björn Påhlsson
First run of python-lint. Fixed some *obviously* bad code and turned
349
                    dbus.exceptions.DBusException):
237.7.31 by Teddy Hogeborn
* mandos: Never call .Reset() on a defunct Avahi entry group.
350
                pass
351
            self.group = None
237.7.30 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
352
        self.remove()
237.7.121 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
353
    
237.7.30 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
354
    def server_state_changed(self, state, error=None):
237.2.99 by Teddy Hogeborn
Code cleanup.
355
        """Derived from the Avahi example code"""
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
356
        logger.debug("Avahi server state change: %i", state)
237.7.30 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
357
        bad_states = { avahi.SERVER_INVALID:
358
                           "Zeroconf server invalid",
359
                       avahi.SERVER_REGISTERING: None,
360
                       avahi.SERVER_COLLISION:
361
                           "Zeroconf server name collision",
362
                       avahi.SERVER_FAILURE:
363
                           "Zeroconf server failure" }
364
        if state in bad_states:
237.7.31 by Teddy Hogeborn
* mandos: Never call .Reset() on a defunct Avahi entry group.
365
            if bad_states[state] is not None:
366
                if error is None:
367
                    logger.error(bad_states[state])
368
                else:
369
                    logger.error(bad_states[state] + ": %r", error)
370
            self.cleanup()
237.2.99 by Teddy Hogeborn
Code cleanup.
371
        elif state == avahi.SERVER_RUNNING:
372
            self.add()
237.7.30 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
373
        else:
237.7.31 by Teddy Hogeborn
* mandos: Never call .Reset() on a defunct Avahi entry group.
374
            if error is None:
375
                logger.debug("Unknown state: %r", state)
376
            else:
377
                logger.debug("Unknown state: %r: %r", state, error)
237.7.121 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
378
    
237.2.99 by Teddy Hogeborn
Code cleanup.
379
    def activate(self):
380
        """Derived from the Avahi example code"""
381
        if self.server is None:
382
            self.server = dbus.Interface(
237.2.100 by Teddy Hogeborn
Code cleanup. Move some global stuff into main.
383
                self.bus.get_object(avahi.DBUS_NAME,
237.7.30 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
384
                                    avahi.DBUS_PATH_SERVER,
385
                                    follow_name_owner_changes=True),
237.2.99 by Teddy Hogeborn
Code cleanup.
386
                avahi.DBUS_INTERFACE_SERVER)
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
387
        self.server.connect_to_signal("StateChanged",
237.2.99 by Teddy Hogeborn
Code cleanup.
388
                                 self.server_state_changed)
389
        self.server_state_changed(self.server.GetState())
237.2.1 by Teddy Hogeborn
First version of a somewhat complete D-Bus server interface. Also
390
237.7.130 by Teddy Hogeborn
* mandos (IPv6_TCPServer.server_bind): Bug fix: handle non-existing
391
237.11.20 by Teddy Hogeborn
* Makefile (run-server): Remove obsolete warning.
392
class AvahiServiceToSyslog(AvahiService):
393
    def rename(self):
394
        """Add the new name to the syslog messages"""
395
        ret = AvahiService.rename(self)
396
        syslogger.setFormatter(logging.Formatter
237.7.116 by Teddy Hogeborn
* mandos-monitor: Use new string format method.
397
                               ('Mandos ({0}) [%(process)d]:'
398
                                ' %(levelname)s: %(message)s'
399
                                .format(self.name)))
237.11.20 by Teddy Hogeborn
* Makefile (run-server): Remove obsolete warning.
400
        return ret
237.2.1 by Teddy Hogeborn
First version of a somewhat complete D-Bus server interface. Also
401
237.7.130 by Teddy Hogeborn
* mandos (IPv6_TCPServer.server_bind): Bug fix: handle non-existing
402
237.14.4 by Teddy Hogeborn
* mandos (_timedelta_to_milliseconds): Renamed to
403
def timedelta_to_milliseconds(td):
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
404
    "Convert a datetime.timedelta() to milliseconds"
405
    return ((td.days * 24 * 60 * 60 * 1000)
406
            + (td.seconds * 1000)
407
            + (td.microseconds // 1000))
237.7.121 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
408
237.7.130 by Teddy Hogeborn
* mandos (IPv6_TCPServer.server_bind): Bug fix: handle non-existing
409
237.2.91 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
410
class Client(object):
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
411
    """A representation of a client host served by this server.
237.2.94 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
412
    
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
413
    Attributes:
237.14.4 by Teddy Hogeborn
* mandos (_timedelta_to_milliseconds): Renamed to
414
    approved:   bool(); 'None' if not yet approved/disapproved
237.2.201 by Teddy Hogeborn
* mandos (Client.runtime_expansions): New attribute containing the
415
    approval_delay: datetime.timedelta(); Time to wait for approval
416
    approval_duration: datetime.timedelta(); Duration of one approval
237.2.1 by Teddy Hogeborn
First version of a somewhat complete D-Bus server interface. Also
417
    checker:    subprocess.Popen(); a running checker process used
418
                                    to see if the client lives.
419
                                    'None' if no process is running.
237.2.205 by Teddy Hogeborn
* DBUS-API: Document new "LastApprovalRequest" client property.
420
    checker_callback_tag: a gobject event source tag, or None
237.2.201 by Teddy Hogeborn
* mandos (Client.runtime_expansions): New attribute containing the
421
    checker_command: string; External command which is run to check
422
                     if client lives.  %() expansions are done at
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
423
                     runtime with vars(self) as dict, so that for
424
                     instance %(name)s can be used in the command.
237.2.201 by Teddy Hogeborn
* mandos (Client.runtime_expansions): New attribute containing the
425
    checker_initiator_tag: a gobject event source tag, or None
426
    created:    datetime.datetime(); (UTC) object creation
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
427
    client_structure: Object describing what attributes a client has
428
                      and is used for storing the client at exit
237.2.78 by Teddy Hogeborn
* mandos (Client.current_checker_command): New attribute.
429
    current_checker_command: string; current running checker_command
237.2.205 by Teddy Hogeborn
* DBUS-API: Document new "LastApprovalRequest" client property.
430
    disable_initiator_tag: a gobject event source tag, or None
237.2.201 by Teddy Hogeborn
* mandos (Client.runtime_expansions): New attribute containing the
431
    enabled:    bool()
432
    fingerprint: string (40 or 32 hexadecimal digits); used to
433
                 uniquely identify the client
434
    host:       string; available for use by the checker command
435
    interval:   datetime.timedelta(); How often to start a new checker
237.2.205 by Teddy Hogeborn
* DBUS-API: Document new "LastApprovalRequest" client property.
436
    last_approval_request: datetime.datetime(); (UTC) or None
237.2.201 by Teddy Hogeborn
* mandos (Client.runtime_expansions): New attribute containing the
437
    last_checked_ok: datetime.datetime(); (UTC) or None
237.7.69 by teddy at bsnet
* debian/control (mandos/Depends): Added "python-crypto".
438
    last_checker_status: integer between 0 and 255 reflecting exit
237.12.7 by Teddy Hogeborn
* mandos: Break long lines and fix some more white space.
439
                         status of last checker. -1 reflects crashed
237.7.104 by Teddy Hogeborn
* DBUS-API (se.recompile.Mandos.Client.LastCheckerStatus): New
440
                         checker, -2 means no checker completed yet.
237.14.3 by Teddy Hogeborn
Make "enabled" a client config option.
441
    last_enabled: datetime.datetime(); (UTC) or None
237.2.201 by Teddy Hogeborn
* mandos (Client.runtime_expansions): New attribute containing the
442
    name:       string; from the config file, used in log messages and
443
                        D-Bus identifiers
444
    secret:     bytestring; sent verbatim (over TLS) to client
445
    timeout:    datetime.timedelta(); How long from last_checked_ok
446
                                      until this client is disabled
237.7.100 by teddy at recompile
* mandos: Consistent terminology; use the term "secret" for the
447
    extended_timeout:   extra long timeout when secret has been sent
237.2.201 by Teddy Hogeborn
* mandos (Client.runtime_expansions): New attribute containing the
448
    runtime_expansions: Allowed attributes for runtime expansion.
237.7.45 by Teddy Hogeborn
* DBUS-API: Document new "Expires" and "ExtendedTimeout" properties.
449
    expires:    datetime.datetime(); time (UTC) when a client will be
24.1.179 by Björn Påhlsson
New feature:
450
                disabled, or None
237.7.165 by Teddy Hogeborn
* mandos: Bug fix: Don't print output from checkers when running in
451
    server_settings: The server_settings dict from main()
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
452
    """
237.2.96 by Teddy Hogeborn
Minor code cleanup; one minor bug fix.
453
    
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
454
    runtime_expansions = ("approval_delay", "approval_duration",
237.7.132 by Teddy Hogeborn
* mandos (Client.runtime_expansions): Add "expires" and (bug fix)
455
                          "created", "enabled", "expires",
456
                          "fingerprint", "host", "interval",
457
                          "last_approval_request", "last_checked_ok",
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
458
                          "last_enabled", "name", "timeout")
237.7.157 by Teddy Hogeborn
* clients.conf: Convert all time intervals to new RFC 3339 syntax.
459
    client_defaults = { "timeout": "PT5M",
460
                        "extended_timeout": "PT15M",
461
                        "interval": "PT2M",
237.12.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
462
                        "checker": "fping -q -- %%(host)s",
463
                        "host": "",
237.7.157 by Teddy Hogeborn
* clients.conf: Convert all time intervals to new RFC 3339 syntax.
464
                        "approval_delay": "PT0S",
465
                        "approval_duration": "PT1S",
237.12.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
466
                        "approved_by_default": "True",
467
                        "enabled": "True",
468
                        }
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
469
    
237.2.6 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
470
    def timeout_milliseconds(self):
471
        "Return the 'timeout' attribute in milliseconds"
237.14.4 by Teddy Hogeborn
* mandos (_timedelta_to_milliseconds): Renamed to
472
        return timedelta_to_milliseconds(self.timeout)
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
473
    
24.1.179 by Björn Påhlsson
New feature:
474
    def extended_timeout_milliseconds(self):
475
        "Return the 'extended_timeout' attribute in milliseconds"
237.14.4 by Teddy Hogeborn
* mandos (_timedelta_to_milliseconds): Renamed to
476
        return timedelta_to_milliseconds(self.extended_timeout)
237.2.6 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
477
    
478
    def interval_milliseconds(self):
479
        "Return the 'interval' attribute in milliseconds"
237.14.4 by Teddy Hogeborn
* mandos (_timedelta_to_milliseconds): Renamed to
480
        return timedelta_to_milliseconds(self.interval)
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
481
    
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
482
    def approval_delay_milliseconds(self):
237.14.4 by Teddy Hogeborn
* mandos (_timedelta_to_milliseconds): Renamed to
483
        return timedelta_to_milliseconds(self.approval_delay)
237.7.121 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
484
    
237.12.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
485
    @staticmethod
486
    def config_parser(config):
237.7.90 by Björn Påhlsson
fixed bug with bad stored config state for expires and last_checked_ok.
487
        """Construct a new dict of client settings of this form:
237.12.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
488
        { client_name: {setting_name: value, ...}, ...}
237.7.90 by Björn Påhlsson
fixed bug with bad stored config state for expires and last_checked_ok.
489
        with exceptions for any special settings as defined above.
490
        NOTE: Must be a pure function. Must return the same result
491
        value given the same arguments.
492
        """
237.12.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
493
        settings = {}
494
        for client_name in config.sections():
495
            section = dict(config.items(client_name))
496
            client = settings[client_name] = {}
497
            
237.12.15 by Björn Påhlsson
more refactoring in regards to how clients get created
498
            client["host"] = section["host"]
237.12.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
499
            # Reformat values from string types to Python types
500
            client["approved_by_default"] = config.getboolean(
501
                client_name, "approved_by_default")
237.7.91 by Teddy Hogeborn
* mandos: Break some long lines.
502
            client["enabled"] = config.getboolean(client_name,
503
                                                  "enabled")
237.12.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
504
            
505
            client["fingerprint"] = (section["fingerprint"].upper()
506
                                     .replace(" ", ""))
507
            if "secret" in section:
508
                client["secret"] = section["secret"].decode("base64")
509
            elif "secfile" in section:
510
                with open(os.path.expanduser(os.path.expandvars
511
                                             (section["secfile"])),
512
                          "rb") as secfile:
513
                    client["secret"] = secfile.read()
514
            else:
237.7.116 by Teddy Hogeborn
* mandos-monitor: Use new string format method.
515
                raise TypeError("No secret or secfile for section {0}"
516
                                .format(section))
237.12.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
517
            client["timeout"] = string_to_delta(section["timeout"])
518
            client["extended_timeout"] = string_to_delta(
519
                section["extended_timeout"])
520
            client["interval"] = string_to_delta(section["interval"])
521
            client["approval_delay"] = string_to_delta(
522
                section["approval_delay"])
523
            client["approval_duration"] = string_to_delta(
524
                section["approval_duration"])
237.12.15 by Björn Påhlsson
more refactoring in regards to how clients get created
525
            client["checker_command"] = section["checker"]
526
            client["last_approval_request"] = None
527
            client["last_checked_ok"] = None
237.7.104 by Teddy Hogeborn
* DBUS-API (se.recompile.Mandos.Client.LastCheckerStatus): New
528
            client["last_checker_status"] = -2
237.7.90 by Björn Påhlsson
fixed bug with bad stored config state for expires and last_checked_ok.
529
        
237.12.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
530
        return settings
237.7.121 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
531
    
237.7.165 by Teddy Hogeborn
* mandos: Bug fix: Don't print output from checkers when running in
532
    def __init__(self, settings, name = None, server_settings=None):
237.2.6 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
533
        self.name = name
237.7.165 by Teddy Hogeborn
* mandos: Bug fix: Don't print output from checkers when running in
534
        if server_settings is None:
535
            server_settings = {}
536
        self.server_settings = server_settings
237.12.15 by Björn Påhlsson
more refactoring in regards to how clients get created
537
        # adding all client settings
538
        for setting, value in settings.iteritems():
539
            setattr(self, setting, value)
540
        
237.7.90 by Björn Påhlsson
fixed bug with bad stored config state for expires and last_checked_ok.
541
        if self.enabled:
542
            if not hasattr(self, "last_enabled"):
543
                self.last_enabled = datetime.datetime.utcnow()
544
            if not hasattr(self, "expires"):
545
                self.expires = (datetime.datetime.utcnow()
546
                                + self.timeout)
547
        else:
548
            self.last_enabled = None
549
            self.expires = None
237.7.121 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
550
        
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
551
        logger.debug("Creating client %r", self.name)
45 by Teddy Hogeborn
* server.py: Cosmetic changes.
552
        # Uppercase and remove spaces from fingerprint for later
553
        # comparison purposes with return value from the fingerprint()
554
        # function
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
555
        logger.debug("  Fingerprint: %s", self.fingerprint)
237.7.91 by Teddy Hogeborn
* mandos: Break some long lines.
556
        self.created = settings.get("created",
557
                                    datetime.datetime.utcnow())
237.7.121 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
558
        
237.12.15 by Björn Påhlsson
more refactoring in regards to how clients get created
559
        # attributes specific for this server instance
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
560
        self.checker = None
561
        self.checker_initiator_tag = None
237.2.2 by Teddy Hogeborn
* mandos (_datetime_to_dbus_struct): Renamed to "_datetime_to_dbus";
562
        self.disable_initiator_tag = None
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
563
        self.checker_callback_tag = None
237.2.78 by Teddy Hogeborn
* mandos (Client.current_checker_command): New attribute.
564
        self.current_checker_command = None
237.14.4 by Teddy Hogeborn
* mandos (_timedelta_to_milliseconds): Renamed to
565
        self.approved = None
24.1.150 by Björn Påhlsson
* mandos: Added ClientDBus.approve_pending property. Exposed
566
        self.approvals_pending = 0
237.11.3 by Teddy Hogeborn
* mandos: Break long lines.
567
        self.changedstate = (multiprocessing_manager
568
                             .Condition(multiprocessing_manager
569
                                        .Lock()))
237.12.7 by Teddy Hogeborn
* mandos: Break long lines and fix some more white space.
570
        self.client_structure = [attr for attr in
571
                                 self.__dict__.iterkeys()
237.7.69 by teddy at bsnet
* debian/control (mandos/Depends): Added "python-crypto".
572
                                 if not attr.startswith("_")]
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
573
        self.client_structure.append("client_structure")
237.12.6 by Teddy Hogeborn
* mandos: Fix whitespace.
574
        
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
575
        for name, t in inspect.getmembers(type(self),
237.7.69 by teddy at bsnet
* debian/control (mandos/Depends): Added "python-crypto".
576
                                          lambda obj:
577
                                              isinstance(obj,
578
                                                         property)):
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
579
            if not name.startswith("_"):
580
                self.client_structure.append(name)
581
    
237.7.68 by Björn Påhlsson
merge persistent state
582
    # Send notice to process children that client state has changed
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
583
    def send_changedstate(self):
237.7.68 by Björn Påhlsson
merge persistent state
584
        with self.changedstate:
585
            self.changedstate.notify_all()
237.11.3 by Teddy Hogeborn
* mandos: Break long lines.
586
    
237.2.2 by Teddy Hogeborn
* mandos (_datetime_to_dbus_struct): Renamed to "_datetime_to_dbus";
587
    def enable(self):
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
588
        """Start this client's checker and timeout hooks"""
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
589
        if getattr(self, "enabled", False):
237.2.104 by Teddy Hogeborn
Code cleanup and one bug fix.
590
            # Already enabled
591
            return
24.1.179 by Björn Påhlsson
New feature:
592
        self.expires = datetime.datetime.utcnow() + self.timeout
237.2.2 by Teddy Hogeborn
* mandos (_datetime_to_dbus_struct): Renamed to "_datetime_to_dbus";
593
        self.enabled = True
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
594
        self.last_enabled = datetime.datetime.utcnow()
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
595
        self.init_checker()
237.7.129 by Teddy Hogeborn
* mandos (Client.enable, Client.disable, ClientDBus.approve): Call
596
        self.send_changedstate()
237.1.1 by Teddy Hogeborn
First steps of a D-Bus interface to the server.
597
    
237.2.165 by Teddy Hogeborn
* mandos (Client.disable): Rename keyword argument "log" to "quiet",
598
    def disable(self, quiet=True):
237.2.2 by Teddy Hogeborn
* mandos (_datetime_to_dbus_struct): Renamed to "_datetime_to_dbus";
599
        """Disable this client."""
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
600
        if not getattr(self, "enabled", False):
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
601
            return False
237.2.165 by Teddy Hogeborn
* mandos (Client.disable): Rename keyword argument "log" to "quiet",
602
        if not quiet:
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
603
            logger.info("Disabling client %s", self.name)
237.7.129 by Teddy Hogeborn
* mandos (Client.enable, Client.disable, ClientDBus.approve): Call
604
        if getattr(self, "disable_initiator_tag", None) is not None:
237.2.2 by Teddy Hogeborn
* mandos (_datetime_to_dbus_struct): Renamed to "_datetime_to_dbus";
605
            gobject.source_remove(self.disable_initiator_tag)
606
            self.disable_initiator_tag = None
24.1.179 by Björn Påhlsson
New feature:
607
        self.expires = None
237.7.129 by Teddy Hogeborn
* mandos (Client.enable, Client.disable, ClientDBus.approve): Call
608
        if getattr(self, "checker_initiator_tag", None) is not None:
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
609
            gobject.source_remove(self.checker_initiator_tag)
610
            self.checker_initiator_tag = None
611
        self.stop_checker()
237.2.2 by Teddy Hogeborn
* mandos (_datetime_to_dbus_struct): Renamed to "_datetime_to_dbus";
612
        self.enabled = False
237.7.129 by Teddy Hogeborn
* mandos (Client.enable, Client.disable, ClientDBus.approve): Call
613
        if not quiet:
614
            self.send_changedstate()
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
615
        # Do not run this again if called by a gobject.timeout_add
616
        return False
237.1.1 by Teddy Hogeborn
First steps of a D-Bus interface to the server.
617
    
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
618
    def __del__(self):
237.2.2 by Teddy Hogeborn
* mandos (_datetime_to_dbus_struct): Renamed to "_datetime_to_dbus";
619
        self.disable()
237.12.6 by Teddy Hogeborn
* mandos: Fix whitespace.
620
    
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
621
    def init_checker(self):
622
        # Schedule a new checker to be started an 'interval' from now,
623
        # and every interval from then on.
237.7.129 by Teddy Hogeborn
* mandos (Client.enable, Client.disable, ClientDBus.approve): Call
624
        if self.checker_initiator_tag is not None:
625
            gobject.source_remove(self.checker_initiator_tag)
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
626
        self.checker_initiator_tag = (gobject.timeout_add
627
                                      (self.interval_milliseconds(),
628
                                       self.start_checker))
629
        # Schedule a disable() when 'timeout' has passed
237.7.129 by Teddy Hogeborn
* mandos (Client.enable, Client.disable, ClientDBus.approve): Call
630
        if self.disable_initiator_tag is not None:
631
            gobject.source_remove(self.disable_initiator_tag)
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
632
        self.disable_initiator_tag = (gobject.timeout_add
633
                                   (self.timeout_milliseconds(),
634
                                    self.disable))
635
        # Also start a new checker *right now*.
636
        self.start_checker()
237.12.6 by Teddy Hogeborn
* mandos: Fix whitespace.
637
    
237.2.1 by Teddy Hogeborn
First version of a somewhat complete D-Bus server interface. Also
638
    def checker_callback(self, pid, condition, command):
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
639
        """The checker has completed, so take appropriate actions."""
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
640
        self.checker_callback_tag = None
641
        self.checker = None
237.2.43 by Teddy Hogeborn
* mandos (Client.CheckerCompleted): Changed signature to "nxs"; return
642
        if os.WIFEXITED(condition):
237.14.8 by Teddy Hogeborn
* mandos (ClientDBus.Host_dbus_property,
643
            self.last_checker_status = os.WEXITSTATUS(condition)
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
644
            if self.last_checker_status == 0:
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
645
                logger.info("Checker for %(name)s succeeded",
237.2.43 by Teddy Hogeborn
* mandos (Client.CheckerCompleted): Changed signature to "nxs"; return
646
                            vars(self))
237.2.44 by Teddy Hogeborn
* mandos (Client.bump_timeout): Renamed to "checked_ok". All callers
647
                self.checked_ok()
237.2.43 by Teddy Hogeborn
* mandos (Client.CheckerCompleted): Changed signature to "nxs"; return
648
            else:
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
649
                logger.info("Checker for %(name)s failed",
237.2.43 by Teddy Hogeborn
* mandos (Client.CheckerCompleted): Changed signature to "nxs"; return
650
                            vars(self))
651
        else:
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
652
            self.last_checker_status = -1
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
653
            logger.warning("Checker for %(name)s crashed?",
13 by Björn Påhlsson
Added following support:
654
                           vars(self))
237.1.1 by Teddy Hogeborn
First steps of a D-Bus interface to the server.
655
    
237.7.104 by Teddy Hogeborn
* DBUS-API (se.recompile.Mandos.Client.LastCheckerStatus): New
656
    def checked_ok(self):
657
        """Assert that the client has been seen, alive and well."""
658
        self.last_checked_ok = datetime.datetime.utcnow()
659
        self.last_checker_status = 0
660
        self.bump_timeout()
661
    
662
    def bump_timeout(self, timeout=None):
663
        """Bump up the timeout for this client."""
24.1.179 by Björn Påhlsson
New feature:
664
        if timeout is None:
665
            timeout = self.timeout
237.11.17 by Teddy Hogeborn
* mandos (Client.checked_ok): Bug fix: Handle disabled client.
666
        if self.disable_initiator_tag is not None:
667
            gobject.source_remove(self.disable_initiator_tag)
237.7.129 by Teddy Hogeborn
* mandos (Client.enable, Client.disable, ClientDBus.approve): Call
668
            self.disable_initiator_tag = None
237.11.17 by Teddy Hogeborn
* mandos (Client.checked_ok): Bug fix: Handle disabled client.
669
        if getattr(self, "enabled", False):
670
            self.disable_initiator_tag = (gobject.timeout_add
237.14.4 by Teddy Hogeborn
* mandos (_timedelta_to_milliseconds): Renamed to
671
                                          (timedelta_to_milliseconds
237.11.17 by Teddy Hogeborn
* mandos (Client.checked_ok): Bug fix: Handle disabled client.
672
                                           (timeout), self.disable))
673
            self.expires = datetime.datetime.utcnow() + timeout
237.1.1 by Teddy Hogeborn
First steps of a D-Bus interface to the server.
674
    
237.2.205 by Teddy Hogeborn
* DBUS-API: Document new "LastApprovalRequest" client property.
675
    def need_approval(self):
676
        self.last_approval_request = datetime.datetime.utcnow()
677
    
9 by Teddy Hogeborn
* client.cpp (main): Get t_old early since it is used on error exits.
678
    def start_checker(self):
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
679
        """Start a new checker subprocess if one is not running.
237.2.94 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
680
        
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
681
        If a checker already exists, leave it running and do
682
        nothing."""
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
683
        # The reason for not killing a running checker is that if we
237.7.125 by Teddy Hogeborn
* mandos (Client.start_checker): Reworded comment.
684
        # did that, and if a checker (for some reason) started running
685
        # slowly and taking more than 'interval' time, then the client
686
        # would inevitably timeout, since no checker would get a
687
        # chance to run to completion.  If we instead leave running
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
688
        # checkers alone, the checker would have to take more time
237.2.174 by Teddy Hogeborn
More consistent terminology: Clients are no longer "invalid" - they
689
        # than 'timeout' for the client to be disabled, which is as it
690
        # should be.
237.2.78 by Teddy Hogeborn
* mandos (Client.current_checker_command): New attribute.
691
        
692
        # If a checker exists, make sure it is not a zombie
237.2.146 by Teddy Hogeborn
* mandos (Client.start_checker): Bug fix: Fix race condition with
693
        try:
237.2.78 by Teddy Hogeborn
* mandos (Client.current_checker_command): New attribute.
694
            pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
237.7.190 by Teddy Hogeborn
Syntax fix; use "raise" better in Mandos server.
695
        except AttributeError:
696
            pass
697
        except OSError as error:
698
            if error.errno != errno.ECHILD:
699
                raise
237.2.146 by Teddy Hogeborn
* mandos (Client.start_checker): Bug fix: Fix race condition with
700
        else:
237.2.78 by Teddy Hogeborn
* mandos (Client.current_checker_command): New attribute.
701
            if pid:
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
702
                logger.warning("Checker was a zombie")
237.2.78 by Teddy Hogeborn
* mandos (Client.current_checker_command): New attribute.
703
                gobject.source_remove(self.checker_callback_tag)
704
                self.checker_callback(pid, status,
705
                                      self.current_checker_command)
706
        # Start a new checker if needed
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
707
        if self.checker is None:
237.7.131 by Teddy Hogeborn
* mandos (Client.start_checker): Remove undocumented support for "%%s"
708
            # Escape attributes for the shell
709
            escaped_attrs = dict(
710
                (attr, re.escape(unicode(getattr(self, attr))))
711
                for attr in
712
                self.runtime_expansions)
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
713
            try:
237.7.131 by Teddy Hogeborn
* mandos (Client.start_checker): Remove undocumented support for "%%s"
714
                command = self.checker_command % escaped_attrs
715
            except TypeError as error:
716
                logger.error('Could not format string "%s"',
717
                             self.checker_command, exc_info=error)
718
                return True # Try again later
237.2.91 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
719
            self.current_checker_command = command
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
720
            try:
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
721
                logger.info("Starting checker %r for %s",
44 by Teddy Hogeborn
* ca.pem: Removed.
722
                            command, self.name)
94 by Teddy Hogeborn
* clients.conf ([DEFAULT]/checker): Update to new default value.
723
                # We don't need to redirect stdout and stderr, since
724
                # in normal mode, that is already done by daemon(),
725
                # and in debug mode we don't want to.  (Stdin is
726
                # always replaced by /dev/null.)
237.7.165 by Teddy Hogeborn
* mandos: Bug fix: Don't print output from checkers when running in
727
                # The exception is when not debugging but nevertheless
728
                # running in the foreground; use the previously
729
                # created wnull.
730
                popen_args = {}
731
                if (not self.server_settings["debug"]
732
                    and self.server_settings["foreground"]):
733
                    popen_args.update({"stdout": wnull,
734
                                       "stderr": wnull })
28 by Teddy Hogeborn
* server.conf: New file.
735
                self.checker = subprocess.Popen(command,
736
                                                close_fds=True,
237.7.165 by Teddy Hogeborn
* mandos: Bug fix: Don't print output from checkers when running in
737
                                                shell=True, cwd="/",
738
                                                **popen_args)
237.7.30 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
739
            except OSError as error:
237.7.113 by Teddy Hogeborn
* mandos (AvahiService.rename, Client.start_checker,
740
                logger.error("Failed to start subprocess",
741
                             exc_info=error)
237.7.158 by Teddy Hogeborn
* mandos (Client.start_checker): Return True (retry later) if starting
742
                return True
237.7.131 by Teddy Hogeborn
* mandos (Client.start_checker): Remove undocumented support for "%%s"
743
            self.checker_callback_tag = (gobject.child_watch_add
744
                                         (self.checker.pid,
745
                                          self.checker_callback,
746
                                          data=command))
747
            # The checker may have completed before the gobject
748
            # watch was added.  Check for this.
237.7.158 by Teddy Hogeborn
* mandos (Client.start_checker): Return True (retry later) if starting
749
            try:
750
                pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
751
            except OSError as error:
752
                if error.errno == errno.ECHILD:
237.7.159 by Teddy Hogeborn
* mandos (Client.start_checker): Add comment. Break long line.
753
                    # This should never happen
754
                    logger.error("Child process vanished",
755
                                 exc_info=error)
237.7.158 by Teddy Hogeborn
* mandos (Client.start_checker): Return True (retry later) if starting
756
                    return True
757
                raise
237.7.131 by Teddy Hogeborn
* mandos (Client.start_checker): Remove undocumented support for "%%s"
758
            if pid:
759
                gobject.source_remove(self.checker_callback_tag)
760
                self.checker_callback(pid, status, command)
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
761
        # Re-run this periodically if run by gobject.timeout_add
762
        return True
237.1.1 by Teddy Hogeborn
First steps of a D-Bus interface to the server.
763
    
9 by Teddy Hogeborn
* client.cpp (main): Get t_old early since it is used on error exits.
764
    def stop_checker(self):
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
765
        """Force the checker process, if any, to stop."""
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
766
        if self.checker_callback_tag:
767
            gobject.source_remove(self.checker_callback_tag)
768
            self.checker_callback_tag = None
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
769
        if getattr(self, "checker", None) is None:
9 by Teddy Hogeborn
* client.cpp (main): Get t_old early since it is used on error exits.
770
            return
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
771
        logger.debug("Stopping checker for %(name)s", vars(self))
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
772
        try:
237.7.112 by Teddy Hogeborn
* mandos (Client.stop_checker): Use new Popen.terminate() method.
773
            self.checker.terminate()
237.2.163 by Teddy Hogeborn
* mandos (Client.enable): Bug fix: Start new immediate checker last to
774
            #time.sleep(0.5)
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
775
            #if self.checker.poll() is None:
237.7.112 by Teddy Hogeborn
* mandos (Client.stop_checker): Use new Popen.terminate() method.
776
            #    self.checker.kill()
237.7.30 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
777
        except OSError as error:
28 by Teddy Hogeborn
* server.conf: New file.
778
            if error.errno != errno.ESRCH: # No such process
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
779
                raise
9 by Teddy Hogeborn
* client.cpp (main): Get t_old early since it is used on error exits.
780
        self.checker = None
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
781
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
782
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
783
def dbus_service_property(dbus_interface, signature="v",
784
                          access="readwrite", byte_arrays=False):
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
785
    """Decorators for marking methods of a DBusObjectWithProperties to
786
    become properties on the D-Bus.
787
    
788
    The decorated method will be called with no arguments by "Get"
789
    and with one argument by "Set".
790
    
791
    The parameters, where they are supported, are the same as
792
    dbus.service.method, except there is only "signature", since the
793
    type from Get() and the type sent to Set() is the same.
794
    """
237.2.174 by Teddy Hogeborn
More consistent terminology: Clients are no longer "invalid" - they
795
    # Encoding deeply encoded byte arrays is not supported yet by the
796
    # "Set" method, so we fail early here:
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
797
    if byte_arrays and signature != "ay":
798
        raise ValueError("Byte arrays not supported for non-'ay'"
237.7.116 by Teddy Hogeborn
* mandos-monitor: Use new string format method.
799
                         " signature {0!r}".format(signature))
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
800
    def decorator(func):
801
        func._dbus_is_property = True
802
        func._dbus_interface = dbus_interface
803
        func._dbus_signature = signature
804
        func._dbus_access = access
805
        func._dbus_name = func.__name__
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
806
        if func._dbus_name.endswith("_dbus_property"):
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
807
            func._dbus_name = func._dbus_name[:-14]
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
808
        func._dbus_get_args_options = {'byte_arrays': byte_arrays }
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
809
        return func
810
    return decorator
811
812
237.18.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
813
def dbus_interface_annotations(dbus_interface):
237.7.121 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
814
    """Decorator for marking functions returning interface annotations
237.18.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
815
    
816
    Usage:
817
    
818
    @dbus_interface_annotations("org.example.Interface")
819
    def _foo(self):  # Function name does not matter
820
        return {"org.freedesktop.DBus.Deprecated": "true",
821
                "org.freedesktop.DBus.Property.EmitsChangedSignal":
822
                    "false"}
823
    """
824
    def decorator(func):
825
        func._dbus_is_interface = True
826
        func._dbus_interface = dbus_interface
827
        func._dbus_name = dbus_interface
828
        return func
829
    return decorator
830
831
237.19.1 by Teddy Hogeborn
Add D-Bus annotations support to methods, signals and properties.
832
def dbus_annotations(annotations):
833
    """Decorator to annotate D-Bus methods, signals or properties
834
    Usage:
835
    
836
    @dbus_service_property("org.example.Interface", signature="b",
837
                           access="r")
838
    @dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",
839
                        "org.freedesktop.DBus.Property."
840
                        "EmitsChangedSignal": "false"})
841
    def Property_dbus_property(self):
842
        return dbus.Boolean(False)
843
    """
844
    def decorator(func):
845
        func._dbus_annotations = annotations
846
        return func
847
    return decorator
848
849
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
850
class DBusPropertyException(dbus.exceptions.DBusException):
851
    """A base class for D-Bus property-related exceptions
852
    """
853
    def __unicode__(self):
854
        return unicode(str(self))
855
856
857
class DBusPropertyAccessException(DBusPropertyException):
858
    """A property's access permissions disallows an operation.
859
    """
860
    pass
861
862
863
class DBusPropertyNotFound(DBusPropertyException):
864
    """An attempt was made to access a non-existing property.
865
    """
866
    pass
867
868
869
class DBusObjectWithProperties(dbus.service.Object):
870
    """A D-Bus object with properties.
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
871
    
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
872
    Classes inheriting from this can use the dbus_service_property
873
    decorator to expose methods as D-Bus properties.  It exposes the
874
    standard Get(), Set(), and GetAll() methods on the D-Bus.
875
    """
876
    
877
    @staticmethod
237.18.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
878
    def _is_dbus_thing(thing):
879
        """Returns a function testing if an attribute is a D-Bus thing
880
        
881
        If called like _is_dbus_thing("method") it returns a function
882
        suitable for use as predicate to inspect.getmembers().
883
        """
884
        return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),
885
                                   False)
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
886
    
237.18.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
887
    def _get_all_dbus_things(self, thing):
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
888
        """Returns a generator of (name, attribute) pairs
889
        """
237.19.1 by Teddy Hogeborn
Add D-Bus annotations support to methods, signals and properties.
890
        return ((getattr(athing.__get__(self), "_dbus_name",
891
                         name),
237.18.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
892
                 athing.__get__(self))
24.1.186 by Björn Påhlsson
transitional stuff actually working
893
                for cls in self.__class__.__mro__
237.18.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
894
                for name, athing in
895
                inspect.getmembers(cls,
896
                                   self._is_dbus_thing(thing)))
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
897
    
898
    def _get_dbus_property(self, interface_name, property_name):
899
        """Returns a bound method if one exists which is a D-Bus
900
        property with the specified name and interface.
901
        """
24.1.186 by Björn Påhlsson
transitional stuff actually working
902
        for cls in  self.__class__.__mro__:
237.11.3 by Teddy Hogeborn
* mandos: Break long lines.
903
            for name, value in (inspect.getmembers
237.18.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
904
                                (cls,
905
                                 self._is_dbus_thing("property"))):
237.11.3 by Teddy Hogeborn
* mandos: Break long lines.
906
                if (value._dbus_name == property_name
907
                    and value._dbus_interface == interface_name):
24.1.186 by Björn Påhlsson
transitional stuff actually working
908
                    return value.__get__(self)
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
909
        
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
910
        # No such property
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
911
        raise DBusPropertyNotFound(self.dbus_object_path + ":"
912
                                   + interface_name + "."
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
913
                                   + property_name)
914
    
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
915
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
916
                         out_signature="v")
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
917
    def Get(self, interface_name, property_name):
918
        """Standard D-Bus property Get() method, see D-Bus standard.
919
        """
920
        prop = self._get_dbus_property(interface_name, property_name)
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
921
        if prop._dbus_access == "write":
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
922
            raise DBusPropertyAccessException(property_name)
923
        value = prop()
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
924
        if not hasattr(value, "variant_level"):
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
925
            return value
926
        return type(value)(value, variant_level=value.variant_level+1)
927
    
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
928
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
929
    def Set(self, interface_name, property_name, value):
930
        """Standard D-Bus property Set() method, see D-Bus standard.
931
        """
932
        prop = self._get_dbus_property(interface_name, property_name)
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
933
        if prop._dbus_access == "read":
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
934
            raise DBusPropertyAccessException(property_name)
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
935
        if prop._dbus_get_args_options["byte_arrays"]:
237.2.174 by Teddy Hogeborn
More consistent terminology: Clients are no longer "invalid" - they
936
            # The byte_arrays option is not supported yet on
937
            # signatures other than "ay".
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
938
            if prop._dbus_signature != "ay":
237.7.197 by Teddy Hogeborn
Minor code fix; raise only exception instances, not classes.
939
                raise ValueError("Byte arrays not supported for non-"
940
                                 "'ay' signature {0!r}"
941
                                 .format(prop._dbus_signature))
237.7.94 by Teddy Hogeborn
* debian/rules (binary-common): Exclude network-hooks.d from
942
            value = dbus.ByteArray(b''.join(chr(byte)
943
                                            for byte in value))
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
944
        prop(value)
945
    
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
946
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
947
                         out_signature="a{sv}")
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
948
    def GetAll(self, interface_name):
949
        """Standard D-Bus property GetAll() method, see D-Bus
950
        standard.
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
951
        
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
952
        Note: Will not include properties with access="write".
953
        """
237.12.5 by Björn Påhlsson
First run of python-lint. Fixed some *obviously* bad code and turned
954
        properties = {}
237.18.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
955
        for name, prop in self._get_all_dbus_things("property"):
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
956
            if (interface_name
957
                and interface_name != prop._dbus_interface):
958
                # Interface non-empty but did not match
959
                continue
960
            # Ignore write-only properties
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
961
            if prop._dbus_access == "write":
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
962
                continue
963
            value = prop()
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
964
            if not hasattr(value, "variant_level"):
237.12.5 by Björn Påhlsson
First run of python-lint. Fixed some *obviously* bad code and turned
965
                properties[name] = value
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
966
                continue
237.12.5 by Björn Påhlsson
First run of python-lint. Fixed some *obviously* bad code and turned
967
            properties[name] = type(value)(value, variant_level=
968
                                           value.variant_level+1)
969
        return dbus.Dictionary(properties, signature="sv")
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
970
    
971
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
972
                         out_signature="s",
973
                         path_keyword='object_path',
974
                         connection_keyword='connection')
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
975
    def Introspect(self, object_path, connection):
237.18.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
976
        """Overloading of standard D-Bus method.
977
        
978
        Inserts property tags and interface annotation tags.
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
979
        """
980
        xmlstring = dbus.service.Object.Introspect(self, object_path,
237.2.149 by Teddy Hogeborn
* mandos (DBusObjectWithProperties.Introspect): Add the name
981
                                                   connection)
237.2.150 by Teddy Hogeborn
* mandos (ClientDBus.ReceivedSecret): Renamed to "GotSecret". All
982
        try:
983
            document = xml.dom.minidom.parseString(xmlstring)
984
            def make_tag(document, name, prop):
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
985
                e = document.createElement("property")
986
                e.setAttribute("name", name)
987
                e.setAttribute("type", prop._dbus_signature)
988
                e.setAttribute("access", prop._dbus_access)
237.2.150 by Teddy Hogeborn
* mandos (ClientDBus.ReceivedSecret): Renamed to "GotSecret". All
989
                return e
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
990
            for if_tag in document.getElementsByTagName("interface"):
237.18.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
991
                # Add property tags
237.2.150 by Teddy Hogeborn
* mandos (ClientDBus.ReceivedSecret): Renamed to "GotSecret". All
992
                for tag in (make_tag(document, name, prop)
993
                            for name, prop
237.18.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
994
                            in self._get_all_dbus_things("property")
237.2.150 by Teddy Hogeborn
* mandos (ClientDBus.ReceivedSecret): Renamed to "GotSecret". All
995
                            if prop._dbus_interface
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
996
                            == if_tag.getAttribute("name")):
237.2.150 by Teddy Hogeborn
* mandos (ClientDBus.ReceivedSecret): Renamed to "GotSecret". All
997
                    if_tag.appendChild(tag)
237.19.1 by Teddy Hogeborn
Add D-Bus annotations support to methods, signals and properties.
998
                # Add annotation tags
999
                for typ in ("method", "signal", "property"):
1000
                    for tag in if_tag.getElementsByTagName(typ):
1001
                        annots = dict()
1002
                        for name, prop in (self.
1003
                                           _get_all_dbus_things(typ)):
1004
                            if (name == tag.getAttribute("name")
1005
                                and prop._dbus_interface
1006
                                == if_tag.getAttribute("name")):
1007
                                annots.update(getattr
1008
                                              (prop,
1009
                                               "_dbus_annotations",
1010
                                               {}))
1011
                        for name, value in annots.iteritems():
1012
                            ann_tag = document.createElement(
1013
                                "annotation")
1014
                            ann_tag.setAttribute("name", name)
1015
                            ann_tag.setAttribute("value", value)
1016
                            tag.appendChild(ann_tag)
237.18.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
1017
                # Add interface annotation tags
1018
                for annotation, value in dict(
237.7.124 by Teddy Hogeborn
* mandos (DBusObjectWithProperties.Introspect): Use
1019
                    itertools.chain.from_iterable(
1020
                        annotations().iteritems()
1021
                        for name, annotations in
1022
                        self._get_all_dbus_things("interface")
1023
                        if name == if_tag.getAttribute("name")
1024
                        )).iteritems():
237.19.1 by Teddy Hogeborn
Add D-Bus annotations support to methods, signals and properties.
1025
                    ann_tag = document.createElement("annotation")
1026
                    ann_tag.setAttribute("name", annotation)
1027
                    ann_tag.setAttribute("value", value)
1028
                    if_tag.appendChild(ann_tag)
237.2.150 by Teddy Hogeborn
* mandos (ClientDBus.ReceivedSecret): Renamed to "GotSecret". All
1029
                # Add the names to the return values for the
1030
                # "org.freedesktop.DBus.Properties" methods
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1031
                if (if_tag.getAttribute("name")
1032
                    == "org.freedesktop.DBus.Properties"):
1033
                    for cn in if_tag.getElementsByTagName("method"):
1034
                        if cn.getAttribute("name") == "Get":
1035
                            for arg in cn.getElementsByTagName("arg"):
1036
                                if (arg.getAttribute("direction")
1037
                                    == "out"):
1038
                                    arg.setAttribute("name", "value")
1039
                        elif cn.getAttribute("name") == "GetAll":
1040
                            for arg in cn.getElementsByTagName("arg"):
1041
                                if (arg.getAttribute("direction")
1042
                                    == "out"):
1043
                                    arg.setAttribute("name", "props")
1044
            xmlstring = document.toxml("utf-8")
237.2.150 by Teddy Hogeborn
* mandos (ClientDBus.ReceivedSecret): Renamed to "GotSecret". All
1045
            document.unlink()
1046
        except (AttributeError, xml.dom.DOMException,
237.7.30 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
1047
                xml.parsers.expat.ExpatError) as error:
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1048
            logger.error("Failed to override Introspection method",
237.7.113 by Teddy Hogeborn
* mandos (AvahiService.rename, Client.start_checker,
1049
                         exc_info=error)
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1050
        return xmlstring
1051
1052
237.7.135 by Teddy Hogeborn
* Makefile (DOCBOOKTOMAN): Only run man --warnings if both "man" and
1053
def datetime_to_dbus(dt, variant_level=0):
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1054
    """Convert a UTC datetime.datetime() to a D-Bus type."""
1055
    if dt is None:
1056
        return dbus.String("", variant_level = variant_level)
1057
    return dbus.String(dt.isoformat(),
1058
                       variant_level=variant_level)
1059
237.12.6 by Teddy Hogeborn
* mandos: Fix whitespace.
1060
237.7.123 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1061
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
1062
    """A class decorator; applied to a subclass of
1063
    dbus.service.Object, it will add alternate D-Bus attributes with
1064
    interface names according to the "alt_interface_names" mapping.
1065
    Usage:
1066
    
237.7.135 by Teddy Hogeborn
* Makefile (DOCBOOKTOMAN): Only run man --warnings if both "man" and
1067
    @alternate_dbus_interfaces({"org.example.Interface":
1068
                                    "net.example.AlternateInterface"})
237.7.123 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1069
    class SampleDBusObject(dbus.service.Object):
1070
        @dbus.service.method("org.example.Interface")
1071
        def SampleDBusMethod():
1072
            pass
1073
    
1074
    The above "SampleDBusMethod" on "SampleDBusObject" will be
1075
    reachable via two interfaces: "org.example.Interface" and
1076
    "net.example.AlternateInterface", the latter of which will have
1077
    its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
1078
    "true", unless "deprecate" is passed with a False value.
1079
    
1080
    This works for methods and signals, and also for D-Bus properties
1081
    (from DBusObjectWithProperties) and interfaces (from the
1082
    dbus_interface_annotations decorator).
237.11.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1083
    """
237.7.123 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1084
    def wrapper(cls):
1085
        for orig_interface_name, alt_interface_name in (
1086
            alt_interface_names.iteritems()):
1087
            attr = {}
1088
            interface_names = set()
1089
            # Go though all attributes of the class
1090
            for attrname, attribute in inspect.getmembers(cls):
237.11.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1091
                # Ignore non-D-Bus attributes, and D-Bus attributes
1092
                # with the wrong interface name
1093
                if (not hasattr(attribute, "_dbus_interface")
1094
                    or not attribute._dbus_interface
237.7.123 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1095
                    .startswith(orig_interface_name)):
237.11.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1096
                    continue
1097
                # Create an alternate D-Bus interface name based on
1098
                # the current name
1099
                alt_interface = (attribute._dbus_interface
237.7.123 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1100
                                 .replace(orig_interface_name,
1101
                                          alt_interface_name))
1102
                interface_names.add(alt_interface)
237.11.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1103
                # Is this a D-Bus signal?
1104
                if getattr(attribute, "_dbus_is_signal", False):
237.7.162 by Teddy Hogeborn
* mandos: Comment changes.
1105
                    # Extract the original non-method undecorated
1106
                    # function by black magic
237.11.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1107
                    nonmethod_func = (dict(
1108
                            zip(attribute.func_code.co_freevars,
1109
                                attribute.__closure__))["func"]
1110
                                      .cell_contents)
1111
                    # Create a new, but exactly alike, function
1112
                    # object, and decorate it to be a new D-Bus signal
1113
                    # with the alternate D-Bus interface name
1114
                    new_function = (dbus.service.signal
1115
                                    (alt_interface,
1116
                                     attribute._dbus_signature)
1117
                                    (types.FunctionType(
1118
                                nonmethod_func.func_code,
1119
                                nonmethod_func.func_globals,
1120
                                nonmethod_func.func_name,
1121
                                nonmethod_func.func_defaults,
1122
                                nonmethod_func.func_closure)))
237.19.1 by Teddy Hogeborn
Add D-Bus annotations support to methods, signals and properties.
1123
                    # Copy annotations, if any
1124
                    try:
1125
                        new_function._dbus_annotations = (
1126
                            dict(attribute._dbus_annotations))
1127
                    except AttributeError:
1128
                        pass
237.11.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1129
                    # Define a creator of a function to call both the
237.7.123 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1130
                    # original and alternate functions, so both the
1131
                    # original and alternate signals gets sent when
1132
                    # the function is called
237.11.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1133
                    def fixscope(func1, func2):
1134
                        """This function is a scope container to pass
1135
                        func1 and func2 to the "call_both" function
1136
                        outside of its arguments"""
1137
                        def call_both(*args, **kwargs):
1138
                            """This function will emit two D-Bus
1139
                            signals by calling func1 and func2"""
1140
                            func1(*args, **kwargs)
1141
                            func2(*args, **kwargs)
1142
                        return call_both
1143
                    # Create the "call_both" function and add it to
1144
                    # the class
237.7.123 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1145
                    attr[attrname] = fixscope(attribute, new_function)
237.11.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1146
                # Is this a D-Bus method?
1147
                elif getattr(attribute, "_dbus_is_method", False):
1148
                    # Create a new, but exactly alike, function
1149
                    # object.  Decorate it to be a new D-Bus method
1150
                    # with the alternate D-Bus interface name.  Add it
1151
                    # to the class.
1152
                    attr[attrname] = (dbus.service.method
1153
                                      (alt_interface,
1154
                                       attribute._dbus_in_signature,
1155
                                       attribute._dbus_out_signature)
1156
                                      (types.FunctionType
1157
                                       (attribute.func_code,
1158
                                        attribute.func_globals,
1159
                                        attribute.func_name,
1160
                                        attribute.func_defaults,
1161
                                        attribute.func_closure)))
237.19.1 by Teddy Hogeborn
Add D-Bus annotations support to methods, signals and properties.
1162
                    # Copy annotations, if any
1163
                    try:
1164
                        attr[attrname]._dbus_annotations = (
1165
                            dict(attribute._dbus_annotations))
1166
                    except AttributeError:
1167
                        pass
237.11.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1168
                # Is this a D-Bus property?
1169
                elif getattr(attribute, "_dbus_is_property", False):
1170
                    # Create a new, but exactly alike, function
1171
                    # object, and decorate it to be a new D-Bus
1172
                    # property with the alternate D-Bus interface
1173
                    # name.  Add it to the class.
1174
                    attr[attrname] = (dbus_service_property
1175
                                      (alt_interface,
1176
                                       attribute._dbus_signature,
1177
                                       attribute._dbus_access,
1178
                                       attribute
1179
                                       ._dbus_get_args_options
1180
                                       ["byte_arrays"])
1181
                                      (types.FunctionType
1182
                                       (attribute.func_code,
1183
                                        attribute.func_globals,
1184
                                        attribute.func_name,
1185
                                        attribute.func_defaults,
1186
                                        attribute.func_closure)))
237.19.1 by Teddy Hogeborn
Add D-Bus annotations support to methods, signals and properties.
1187
                    # Copy annotations, if any
1188
                    try:
1189
                        attr[attrname]._dbus_annotations = (
1190
                            dict(attribute._dbus_annotations))
1191
                    except AttributeError:
1192
                        pass
237.18.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
1193
                # Is this a D-Bus interface?
1194
                elif getattr(attribute, "_dbus_is_interface", False):
1195
                    # Create a new, but exactly alike, function
1196
                    # object.  Decorate it to be a new D-Bus interface
1197
                    # with the alternate D-Bus interface name.  Add it
1198
                    # to the class.
1199
                    attr[attrname] = (dbus_interface_annotations
1200
                                      (alt_interface)
1201
                                      (types.FunctionType
1202
                                       (attribute.func_code,
1203
                                        attribute.func_globals,
1204
                                        attribute.func_name,
1205
                                        attribute.func_defaults,
1206
                                        attribute.func_closure)))
237.7.123 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1207
            if deprecate:
1208
                # Deprecate all alternate interfaces
1209
                iname="_AlternateDBusNames_interface_annotation{0}"
1210
                for interface_name in interface_names:
1211
                    @dbus_interface_annotations(interface_name)
1212
                    def func(self):
1213
                        return { "org.freedesktop.DBus.Deprecated":
1214
                                     "true" }
1215
                    # Find an unused name
1216
                    for aname in (iname.format(i)
1217
                                  for i in itertools.count()):
1218
                        if aname not in attr:
1219
                            attr[aname] = func
1220
                            break
1221
            if interface_names:
1222
                # Replace the class with a new subclass of it with
1223
                # methods, signals, etc. as created above.
1224
                cls = type(b"{0}Alternate".format(cls.__name__),
1225
                           (cls,), attr)
1226
        return cls
1227
    return wrapper
1228
1229
1230
@alternate_dbus_interfaces({"se.recompile.Mandos":
1231
                                "se.bsnet.fukt.Mandos"})
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1232
class ClientDBus(Client, DBusObjectWithProperties):
237.2.91 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1233
    """A Client class using D-Bus
237.2.94 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
1234
    
237.2.91 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1235
    Attributes:
237.2.101 by Teddy Hogeborn
* mandos: Minor doc string fixes.
1236
    dbus_object_path: dbus.ObjectPath
1237
    bus: dbus.SystemBus()
237.2.91 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1238
    """
237.2.201 by Teddy Hogeborn
* mandos (Client.runtime_expansions): New attribute containing the
1239
    
1240
    runtime_expansions = (Client.runtime_expansions
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1241
                          + ("dbus_object_path",))
237.2.201 by Teddy Hogeborn
* mandos (Client.runtime_expansions): New attribute containing the
1242
    
237.2.91 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1243
    # dbus.service.Object doesn't use super(), so we can't either.
1244
    
237.2.100 by Teddy Hogeborn
Code cleanup. Move some global stuff into main.
1245
    def __init__(self, bus = None, *args, **kwargs):
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
1246
        self.bus = bus
1247
        Client.__init__(self, *args, **kwargs)
237.2.91 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1248
        # Only now, when this client is initialized, can it show up on
1249
        # the D-Bus
237.2.204 by Teddy Hogeborn
* mandos (ClientDBus.__init__): Bug fix: Translate "-" in client names
1250
        client_object_name = unicode(self.name).translate(
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1251
            {ord("."): ord("_"),
1252
             ord("-"): ord("_")})
237.2.91 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1253
        self.dbus_object_path = (dbus.ObjectPath
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1254
                                 ("/clients/" + client_object_name))
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1255
        DBusObjectWithProperties.__init__(self, self.bus,
1256
                                          self.dbus_object_path)
237.7.121 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
1257
    
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1258
    def notifychangeproperty(transform_func,
1259
                             dbus_name, type_func=lambda x: x,
1260
                             variant_level=1):
237.11.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1261
        """ Modify a variable so that it's a property which announces
1262
        its changes to DBus.
237.12.6 by Teddy Hogeborn
* mandos: Fix whitespace.
1263
        
237.11.15 by Teddy Hogeborn
Bug fix: Make D-Bus properties settable again.
1264
        transform_fun: Function that takes a value and a variant_level
1265
                       and transforms it to a D-Bus type.
237.11.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1266
        dbus_name: D-Bus name of the variable
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1267
        type_func: Function that transform the value before sending it
237.11.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1268
                   to the D-Bus.  Default: no transform
1269
        variant_level: D-Bus variant level.  Default: 1
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1270
        """
237.11.6 by Teddy Hogeborn
* mandos (ClientDBus.notifychangeproperty): Bug fix: Use instance
1271
        attrname = "_{0}".format(dbus_name)
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1272
        def setter(self, value):
1273
            if hasattr(self, "dbus_object_path"):
237.11.6 by Teddy Hogeborn
* mandos (ClientDBus.notifychangeproperty): Bug fix: Use instance
1274
                if (not hasattr(self, attrname) or
1275
                    type_func(getattr(self, attrname, None))
1276
                    != type_func(value)):
1277
                    dbus_value = transform_func(type_func(value),
237.11.15 by Teddy Hogeborn
Bug fix: Make D-Bus properties settable again.
1278
                                                variant_level
1279
                                                =variant_level)
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1280
                    self.PropertyChanged(dbus.String(dbus_name),
1281
                                         dbus_value)
237.11.6 by Teddy Hogeborn
* mandos (ClientDBus.notifychangeproperty): Bug fix: Use instance
1282
            setattr(self, attrname, value)
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
1283
        
237.11.6 by Teddy Hogeborn
* mandos (ClientDBus.notifychangeproperty): Bug fix: Use instance
1284
        return property(lambda self: getattr(self, attrname), setter)
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
1285
    
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1286
    expires = notifychangeproperty(datetime_to_dbus, "Expires")
1287
    approvals_pending = notifychangeproperty(dbus.Boolean,
1288
                                             "ApprovalPending",
1289
                                             type_func = bool)
1290
    enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1291
    last_enabled = notifychangeproperty(datetime_to_dbus,
1292
                                        "LastEnabled")
1293
    checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",
237.11.3 by Teddy Hogeborn
* mandos: Break long lines.
1294
                                   type_func = lambda checker:
1295
                                       checker is not None)
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1296
    last_checked_ok = notifychangeproperty(datetime_to_dbus,
1297
                                           "LastCheckedOK")
237.7.104 by Teddy Hogeborn
* DBUS-API (se.recompile.Mandos.Client.LastCheckerStatus): New
1298
    last_checker_status = notifychangeproperty(dbus.Int16,
1299
                                               "LastCheckerStatus")
237.11.3 by Teddy Hogeborn
* mandos: Break long lines.
1300
    last_approval_request = notifychangeproperty(
1301
        datetime_to_dbus, "LastApprovalRequest")
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1302
    approved_by_default = notifychangeproperty(dbus.Boolean,
1303
                                               "ApprovedByDefault")
237.14.9 by Teddy Hogeborn
* mandos (ClientDBus.approval_delay, ClientDBus.approval_duration,
1304
    approval_delay = notifychangeproperty(dbus.UInt64,
237.11.3 by Teddy Hogeborn
* mandos: Break long lines.
1305
                                          "ApprovalDelay",
1306
                                          type_func =
237.14.4 by Teddy Hogeborn
* mandos (_timedelta_to_milliseconds): Renamed to
1307
                                          timedelta_to_milliseconds)
237.11.3 by Teddy Hogeborn
* mandos: Break long lines.
1308
    approval_duration = notifychangeproperty(
237.14.9 by Teddy Hogeborn
* mandos (ClientDBus.approval_delay, ClientDBus.approval_duration,
1309
        dbus.UInt64, "ApprovalDuration",
237.14.4 by Teddy Hogeborn
* mandos (_timedelta_to_milliseconds): Renamed to
1310
        type_func = timedelta_to_milliseconds)
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1311
    host = notifychangeproperty(dbus.String, "Host")
237.14.9 by Teddy Hogeborn
* mandos (ClientDBus.approval_delay, ClientDBus.approval_duration,
1312
    timeout = notifychangeproperty(dbus.UInt64, "Timeout",
237.11.3 by Teddy Hogeborn
* mandos: Break long lines.
1313
                                   type_func =
237.14.4 by Teddy Hogeborn
* mandos (_timedelta_to_milliseconds): Renamed to
1314
                                   timedelta_to_milliseconds)
237.11.3 by Teddy Hogeborn
* mandos: Break long lines.
1315
    extended_timeout = notifychangeproperty(
237.14.9 by Teddy Hogeborn
* mandos (ClientDBus.approval_delay, ClientDBus.approval_duration,
1316
        dbus.UInt64, "ExtendedTimeout",
237.14.4 by Teddy Hogeborn
* mandos (_timedelta_to_milliseconds): Renamed to
1317
        type_func = timedelta_to_milliseconds)
237.14.9 by Teddy Hogeborn
* mandos (ClientDBus.approval_delay, ClientDBus.approval_duration,
1318
    interval = notifychangeproperty(dbus.UInt64,
237.11.3 by Teddy Hogeborn
* mandos: Break long lines.
1319
                                    "Interval",
1320
                                    type_func =
237.14.4 by Teddy Hogeborn
* mandos (_timedelta_to_milliseconds): Renamed to
1321
                                    timedelta_to_milliseconds)
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1322
    checker_command = notifychangeproperty(dbus.String, "Checker")
1323
    
1324
    del notifychangeproperty
237.2.91 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1325
    
1326
    def __del__(self, *args, **kwargs):
1327
        try:
1328
            self.remove_from_connection()
237.2.92 by Teddy Hogeborn
* mandos (ClientDBus.__del__): Bug fix: Correct mispasted code, and do
1329
        except LookupError:
237.2.91 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1330
            pass
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1331
        if hasattr(DBusObjectWithProperties, "__del__"):
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1332
            DBusObjectWithProperties.__del__(self, *args, **kwargs)
237.2.91 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1333
        Client.__del__(self, *args, **kwargs)
1334
    
1335
    def checker_callback(self, pid, condition, command,
1336
                         *args, **kwargs):
1337
        self.checker_callback_tag = None
1338
        self.checker = None
1339
        if os.WIFEXITED(condition):
1340
            exitstatus = os.WEXITSTATUS(condition)
1341
            # Emit D-Bus signal
1342
            self.CheckerCompleted(dbus.Int16(exitstatus),
1343
                                  dbus.Int64(condition),
1344
                                  dbus.String(command))
1345
        else:
1346
            # Emit D-Bus signal
1347
            self.CheckerCompleted(dbus.Int16(-1),
1348
                                  dbus.Int64(condition),
1349
                                  dbus.String(command))
1350
        
1351
        return Client.checker_callback(self, pid, condition, command,
1352
                                       *args, **kwargs)
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
1353
    
237.2.91 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1354
    def start_checker(self, *args, **kwargs):
1355
        old_checker = self.checker
1356
        if self.checker is not None:
1357
            old_checker_pid = self.checker.pid
1358
        else:
1359
            old_checker_pid = None
1360
        r = Client.start_checker(self, *args, **kwargs)
237.2.92 by Teddy Hogeborn
* mandos (ClientDBus.__del__): Bug fix: Correct mispasted code, and do
1361
        # Only if new checker process was started
1362
        if (self.checker is not None
1363
            and old_checker_pid != self.checker.pid):
1364
            # Emit D-Bus signal
237.2.91 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1365
            self.CheckerStarted(self.current_checker_command)
1366
        return r
1367
    
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1368
    def _reset_approved(self):
237.14.4 by Teddy Hogeborn
* mandos (_timedelta_to_milliseconds): Renamed to
1369
        self.approved = None
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1370
        return False
1371
    
1372
    def approve(self, value=True):
237.14.4 by Teddy Hogeborn
* mandos (_timedelta_to_milliseconds): Renamed to
1373
        self.approved = value
1374
        gobject.timeout_add(timedelta_to_milliseconds
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1375
                            (self.approval_duration),
24.1.154 by Björn Påhlsson
merge
1376
                            self._reset_approved)
237.7.129 by Teddy Hogeborn
* mandos (Client.enable, Client.disable, ClientDBus.approve): Call
1377
        self.send_changedstate()
24.2.1 by teddy at bsnet
* debian/control (mandos/Depends): Added "python-urwid".
1378
    
24.1.147 by Björn Påhlsson
The IPC pipes are now file objects, not file descriptors:
1379
    ## D-Bus methods, signals & properties
237.11.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1380
    _interface = "se.recompile.Mandos.Client"
237.1.2 by Teddy Hogeborn
Further steps towards a D-Bus server interface, plus minor syntax
1381
    
237.18.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
1382
    ## Interfaces
1383
    
1384
    @dbus_interface_annotations(_interface)
1385
    def _foo(self):
1386
        return { "org.freedesktop.DBus.Property.EmitsChangedSignal":
1387
                     "false"}
1388
    
24.1.147 by Björn Påhlsson
The IPC pipes are now file objects, not file descriptors:
1389
    ## Signals
237.2.144 by Teddy Hogeborn
Restore some poor D-Bus methods who got a bit hastily deleted. Enable
1390
    
237.1.2 by Teddy Hogeborn
Further steps towards a D-Bus server interface, plus minor syntax
1391
    # CheckerCompleted - signal
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1392
    @dbus.service.signal(_interface, signature="nxs")
237.2.43 by Teddy Hogeborn
* mandos (Client.CheckerCompleted): Changed signature to "nxs"; return
1393
    def CheckerCompleted(self, exitcode, waitstatus, command):
237.1.2 by Teddy Hogeborn
Further steps towards a D-Bus server interface, plus minor syntax
1394
        "D-Bus signal"
1395
        pass
1396
    
1397
    # CheckerStarted - signal
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1398
    @dbus.service.signal(_interface, signature="s")
237.1.2 by Teddy Hogeborn
Further steps towards a D-Bus server interface, plus minor syntax
1399
    def CheckerStarted(self, command):
1400
        "D-Bus signal"
1401
        pass
1402
    
237.2.1 by Teddy Hogeborn
First version of a somewhat complete D-Bus server interface. Also
1403
    # PropertyChanged - signal
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1404
    @dbus.service.signal(_interface, signature="sv")
237.2.1 by Teddy Hogeborn
First version of a somewhat complete D-Bus server interface. Also
1405
    def PropertyChanged(self, property, value):
1406
        "D-Bus signal"
1407
        pass
237.1.2 by Teddy Hogeborn
Further steps towards a D-Bus server interface, plus minor syntax
1408
    
237.2.150 by Teddy Hogeborn
* mandos (ClientDBus.ReceivedSecret): Renamed to "GotSecret". All
1409
    # GotSecret - signal
237.2.90 by Teddy Hogeborn
Merge from pipe IPC branch.
1410
    @dbus.service.signal(_interface)
237.2.150 by Teddy Hogeborn
* mandos (ClientDBus.ReceivedSecret): Renamed to "GotSecret". All
1411
    def GotSecret(self):
24.1.155 by Björn Påhlsson
mandos server: Added debuglevel that adjust at what level information
1412
        """D-Bus signal
1413
        Is sent after a successful transfer of secret from the Mandos
1414
        server to mandos-client
1415
        """
24.2.4 by teddy at bsnet
* mandos (ClientDBus.approvals_pending): Changed to be a property
1416
        pass
237.2.90 by Teddy Hogeborn
Merge from pipe IPC branch.
1417
    
1418
    # Rejected - signal
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1419
    @dbus.service.signal(_interface, signature="s")
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1420
    def Rejected(self, reason):
1421
        "D-Bus signal"
24.2.4 by teddy at bsnet
* mandos (ClientDBus.approvals_pending): Changed to be a property
1422
        pass
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1423
    
1424
    # NeedApproval - signal
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1425
    @dbus.service.signal(_interface, signature="tb")
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1426
    def NeedApproval(self, timeout, default):
237.2.90 by Teddy Hogeborn
Merge from pipe IPC branch.
1427
        "D-Bus signal"
237.2.205 by Teddy Hogeborn
* DBUS-API: Document new "LastApprovalRequest" client property.
1428
        return self.need_approval()
237.2.90 by Teddy Hogeborn
Merge from pipe IPC branch.
1429
    
24.1.147 by Björn Påhlsson
The IPC pipes are now file objects, not file descriptors:
1430
    ## Methods
237.2.205 by Teddy Hogeborn
* DBUS-API: Document new "LastApprovalRequest" client property.
1431
    
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1432
    # Approve - method
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1433
    @dbus.service.method(_interface, in_signature="b")
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1434
    def Approve(self, value):
1435
        self.approve(value)
237.2.205 by Teddy Hogeborn
* DBUS-API: Document new "LastApprovalRequest" client property.
1436
    
24.1.147 by Björn Påhlsson
The IPC pipes are now file objects, not file descriptors:
1437
    # CheckedOK - method
1438
    @dbus.service.method(_interface)
1439
    def CheckedOK(self):
237.7.30 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
1440
        self.checked_ok()
24.1.147 by Björn Påhlsson
The IPC pipes are now file objects, not file descriptors:
1441
    
237.2.144 by Teddy Hogeborn
Restore some poor D-Bus methods who got a bit hastily deleted. Enable
1442
    # Enable - method
1443
    @dbus.service.method(_interface)
1444
    def Enable(self):
1445
        "D-Bus method"
1446
        self.enable()
1447
    
1448
    # StartChecker - method
1449
    @dbus.service.method(_interface)
1450
    def StartChecker(self):
1451
        "D-Bus method"
1452
        self.start_checker()
1453
    
1454
    # Disable - method
1455
    @dbus.service.method(_interface)
1456
    def Disable(self):
1457
        "D-Bus method"
1458
        self.disable()
1459
    
1460
    # StopChecker - method
1461
    @dbus.service.method(_interface)
1462
    def StopChecker(self):
1463
        self.stop_checker()
1464
    
24.1.147 by Björn Påhlsson
The IPC pipes are now file objects, not file descriptors:
1465
    ## Properties
1466
    
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1467
    # ApprovalPending - property
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1468
    @dbus_service_property(_interface, signature="b", access="read")
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1469
    def ApprovalPending_dbus_property(self):
24.2.4 by teddy at bsnet
* mandos (ClientDBus.approvals_pending): Changed to be a property
1470
        return dbus.Boolean(bool(self.approvals_pending))
24.1.150 by Björn Påhlsson
* mandos: Added ClientDBus.approve_pending property. Exposed
1471
    
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1472
    # ApprovedByDefault - property
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1473
    @dbus_service_property(_interface, signature="b",
1474
                           access="readwrite")
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1475
    def ApprovedByDefault_dbus_property(self, value=None):
1476
        if value is None:       # get
1477
            return dbus.Boolean(self.approved_by_default)
1478
        self.approved_by_default = bool(value)
1479
    
1480
    # ApprovalDelay - property
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1481
    @dbus_service_property(_interface, signature="t",
1482
                           access="readwrite")
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1483
    def ApprovalDelay_dbus_property(self, value=None):
1484
        if value is None:       # get
1485
            return dbus.UInt64(self.approval_delay_milliseconds())
1486
        self.approval_delay = datetime.timedelta(0, 0, 0, value)
1487
    
1488
    # ApprovalDuration - property
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1489
    @dbus_service_property(_interface, signature="t",
1490
                           access="readwrite")
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1491
    def ApprovalDuration_dbus_property(self, value=None):
1492
        if value is None:       # get
237.14.4 by Teddy Hogeborn
* mandos (_timedelta_to_milliseconds): Renamed to
1493
            return dbus.UInt64(timedelta_to_milliseconds(
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1494
                    self.approval_duration))
1495
        self.approval_duration = datetime.timedelta(0, 0, 0, value)
1496
    
1497
    # Name - property
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1498
    @dbus_service_property(_interface, signature="s", access="read")
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1499
    def Name_dbus_property(self):
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1500
        return dbus.String(self.name)
1501
    
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1502
    # Fingerprint - property
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1503
    @dbus_service_property(_interface, signature="s", access="read")
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1504
    def Fingerprint_dbus_property(self):
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1505
        return dbus.String(self.fingerprint)
1506
    
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1507
    # Host - property
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1508
    @dbus_service_property(_interface, signature="s",
1509
                           access="readwrite")
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1510
    def Host_dbus_property(self, value=None):
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1511
        if value is None:       # get
1512
            return dbus.String(self.host)
237.14.8 by Teddy Hogeborn
* mandos (ClientDBus.Host_dbus_property,
1513
        self.host = unicode(value)
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1514
    
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1515
    # Created - property
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1516
    @dbus_service_property(_interface, signature="s", access="read")
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1517
    def Created_dbus_property(self):
237.14.3 by Teddy Hogeborn
Make "enabled" a client config option.
1518
        return datetime_to_dbus(self.created)
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1519
    
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1520
    # LastEnabled - property
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1521
    @dbus_service_property(_interface, signature="s", access="read")
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1522
    def LastEnabled_dbus_property(self):
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1523
        return datetime_to_dbus(self.last_enabled)
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1524
    
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1525
    # Enabled - property
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1526
    @dbus_service_property(_interface, signature="b",
1527
                           access="readwrite")
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1528
    def Enabled_dbus_property(self, value=None):
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1529
        if value is None:       # get
1530
            return dbus.Boolean(self.enabled)
1531
        if value:
1532
            self.enable()
1533
        else:
1534
            self.disable()
1535
    
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1536
    # LastCheckedOK - property
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1537
    @dbus_service_property(_interface, signature="s",
1538
                           access="readwrite")
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1539
    def LastCheckedOK_dbus_property(self, value=None):
237.2.144 by Teddy Hogeborn
Restore some poor D-Bus methods who got a bit hastily deleted. Enable
1540
        if value is not None:
1541
            self.checked_ok()
1542
            return
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1543
        return datetime_to_dbus(self.last_checked_ok)
24.1.179 by Björn Påhlsson
New feature:
1544
    
237.7.104 by Teddy Hogeborn
* DBUS-API (se.recompile.Mandos.Client.LastCheckerStatus): New
1545
    # LastCheckerStatus - property
1546
    @dbus_service_property(_interface, signature="n",
1547
                           access="read")
1548
    def LastCheckerStatus_dbus_property(self):
1549
        return dbus.Int16(self.last_checker_status)
1550
    
24.1.179 by Björn Påhlsson
New feature:
1551
    # Expires - property
1552
    @dbus_service_property(_interface, signature="s", access="read")
1553
    def Expires_dbus_property(self):
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1554
        return datetime_to_dbus(self.expires)
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1555
    
237.2.205 by Teddy Hogeborn
* DBUS-API: Document new "LastApprovalRequest" client property.
1556
    # LastApprovalRequest - property
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1557
    @dbus_service_property(_interface, signature="s", access="read")
237.2.205 by Teddy Hogeborn
* DBUS-API: Document new "LastApprovalRequest" client property.
1558
    def LastApprovalRequest_dbus_property(self):
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1559
        return datetime_to_dbus(self.last_approval_request)
237.2.205 by Teddy Hogeborn
* DBUS-API: Document new "LastApprovalRequest" client property.
1560
    
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1561
    # Timeout - property
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1562
    @dbus_service_property(_interface, signature="t",
1563
                           access="readwrite")
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1564
    def Timeout_dbus_property(self, value=None):
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1565
        if value is None:       # get
1566
            return dbus.UInt64(self.timeout_milliseconds())
237.7.129 by Teddy Hogeborn
* mandos (Client.enable, Client.disable, ClientDBus.approve): Call
1567
        old_timeout = self.timeout
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1568
        self.timeout = datetime.timedelta(0, 0, 0, value)
237.7.129 by Teddy Hogeborn
* mandos (Client.enable, Client.disable, ClientDBus.approve): Call
1569
        # Reschedule disabling
237.7.91 by Teddy Hogeborn
* mandos: Break some long lines.
1570
        if self.enabled:
1571
            now = datetime.datetime.utcnow()
237.7.129 by Teddy Hogeborn
* mandos (Client.enable, Client.disable, ClientDBus.approve): Call
1572
            self.expires += self.timeout - old_timeout
1573
            if self.expires <= now:
237.7.91 by Teddy Hogeborn
* mandos: Break some long lines.
1574
                # The timeout has passed
1575
                self.disable()
1576
            else:
1577
                if (getattr(self, "disable_initiator_tag", None)
1578
                    is None):
1579
                    return
1580
                gobject.source_remove(self.disable_initiator_tag)
237.7.129 by Teddy Hogeborn
* mandos (Client.enable, Client.disable, ClientDBus.approve): Call
1581
                self.disable_initiator_tag = (
1582
                    gobject.timeout_add(
1583
                        timedelta_to_milliseconds(self.expires - now),
1584
                        self.disable))
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
1585
    
24.1.179 by Björn Påhlsson
New feature:
1586
    # ExtendedTimeout - property
1587
    @dbus_service_property(_interface, signature="t",
1588
                           access="readwrite")
1589
    def ExtendedTimeout_dbus_property(self, value=None):
1590
        if value is None:       # get
1591
            return dbus.UInt64(self.extended_timeout_milliseconds())
1592
        self.extended_timeout = datetime.timedelta(0, 0, 0, value)
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
1593
    
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1594
    # Interval - property
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1595
    @dbus_service_property(_interface, signature="t",
1596
                           access="readwrite")
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1597
    def Interval_dbus_property(self, value=None):
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1598
        if value is None:       # get
1599
            return dbus.UInt64(self.interval_milliseconds())
1600
        self.interval = datetime.timedelta(0, 0, 0, value)
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1601
        if getattr(self, "checker_initiator_tag", None) is None:
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1602
            return
237.14.3 by Teddy Hogeborn
Make "enabled" a client config option.
1603
        if self.enabled:
1604
            # Reschedule checker run
1605
            gobject.source_remove(self.checker_initiator_tag)
1606
            self.checker_initiator_tag = (gobject.timeout_add
1607
                                          (value, self.start_checker))
1608
            self.start_checker()    # Start one now, too
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
1609
    
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1610
    # Checker - property
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1611
    @dbus_service_property(_interface, signature="s",
1612
                           access="readwrite")
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1613
    def Checker_dbus_property(self, value=None):
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1614
        if value is None:       # get
1615
            return dbus.String(self.checker_command)
237.14.8 by Teddy Hogeborn
* mandos (ClientDBus.Host_dbus_property,
1616
        self.checker_command = unicode(value)
237.1.2 by Teddy Hogeborn
Further steps towards a D-Bus server interface, plus minor syntax
1617
    
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1618
    # CheckerRunning - property
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1619
    @dbus_service_property(_interface, signature="b",
1620
                           access="readwrite")
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1621
    def CheckerRunning_dbus_property(self, value=None):
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1622
        if value is None:       # get
1623
            return dbus.Boolean(self.checker is not None)
1624
        if value:
1625
            self.start_checker()
1626
        else:
1627
            self.stop_checker()
1628
    
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1629
    # ObjectPath - property
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1630
    @dbus_service_property(_interface, signature="o", access="read")
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1631
    def ObjectPath_dbus_property(self):
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1632
        return self.dbus_object_path # is already a dbus.ObjectPath
1633
    
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1634
    # Secret = property
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1635
    @dbus_service_property(_interface, signature="ay",
1636
                           access="write", byte_arrays=True)
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1637
    def Secret_dbus_property(self, value):
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1638
        self.secret = str(value)
237.1.2 by Teddy Hogeborn
Further steps towards a D-Bus server interface, plus minor syntax
1639
    
1640
    del _interface
3 by Björn Påhlsson
Python based server
1641
1642
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1643
class ProxyClient(object):
1644
    def __init__(self, child_pipe, fpr, address):
1645
        self._pipe = child_pipe
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1646
        self._pipe.send(('init', fpr, address))
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1647
        if not self._pipe.recv():
1648
            raise KeyError()
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
1649
    
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1650
    def __getattribute__(self, name):
237.14.4 by Teddy Hogeborn
* mandos (_timedelta_to_milliseconds): Renamed to
1651
        if name == '_pipe':
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1652
            return super(ProxyClient, self).__getattribute__(name)
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1653
        self._pipe.send(('getattr', name))
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1654
        data = self._pipe.recv()
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1655
        if data[0] == 'data':
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1656
            return data[1]
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1657
        if data[0] == 'function':
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1658
            def func(*args, **kwargs):
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1659
                self._pipe.send(('funcall', name, args, kwargs))
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1660
                return self._pipe.recv()[1]
1661
            return func
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
1662
    
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1663
    def __setattr__(self, name, value):
237.14.4 by Teddy Hogeborn
* mandos (_timedelta_to_milliseconds): Renamed to
1664
        if name == '_pipe':
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1665
            return super(ProxyClient, self).__setattr__(name, value)
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1666
        self._pipe.send(('setattr', name, value))
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1667
237.12.6 by Teddy Hogeborn
* mandos: Fix whitespace.
1668
237.2.98 by Teddy Hogeborn
* mandos: Import "SocketServer" as "socketserver" and "ConfigParser"
1669
class ClientHandler(socketserver.BaseRequestHandler, object):
237.2.94 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
1670
    """A class to handle client connections.
1671
    
1672
    Instantiated once for each connection to handle it.
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
1673
    Note: This will run in its own forked process."""
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
1674
    
3 by Björn Påhlsson
Python based server
1675
    def handle(self):
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1676
        with contextlib.closing(self.server.child_pipe) as child_pipe:
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1677
            logger.info("TCP connection from: %s",
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1678
                        unicode(self.client_address))
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1679
            logger.debug("Pipe FD: %d",
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1680
                         self.server.child_pipe.fileno())
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
1681
            
237.4.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
1682
            session = (gnutls.connection
1683
                       .ClientSession(self.request,
1684
                                      gnutls.connection
1685
                                      .X509Credentials()))
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
1686
            
237.4.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
1687
            # Note: gnutls.connection.X509Credentials is really a
1688
            # generic GnuTLS certificate credentials object so long as
1689
            # no X.509 keys are added to it.  Therefore, we can use it
1690
            # here despite using OpenPGP certificates.
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
1691
            
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1692
            #priority = ':'.join(("NONE", "+VERS-TLS1.1",
1693
            #                      "+AES-256-CBC", "+SHA1",
1694
            #                      "+COMP-NULL", "+CTYPE-OPENPGP",
1695
            #                      "+DHE-DSS"))
237.4.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
1696
            # Use a fallback default, since this MUST be set.
237.2.94 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
1697
            priority = self.server.gnutls_priority
1698
            if priority is None:
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1699
                priority = "NORMAL"
237.4.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
1700
            (gnutls.library.functions
1701
             .gnutls_priority_set_direct(session._c_object,
1702
                                         priority, None))
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
1703
            
237.5.2 by Teddy Hogeborn
* mandos (ClientHandler.handle): Set up the GnuTLS session object
1704
            # Start communication using the Mandos protocol
1705
            # Get protocol number
1706
            line = self.request.makefile().readline()
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1707
            logger.debug("Protocol version: %r", line)
237.5.2 by Teddy Hogeborn
* mandos (ClientHandler.handle): Set up the GnuTLS session object
1708
            try:
1709
                if int(line.strip().split()[0]) > 1:
237.7.190 by Teddy Hogeborn
Syntax fix; use "raise" better in Mandos server.
1710
                    raise RuntimeError(line)
237.7.30 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
1711
            except (ValueError, IndexError, RuntimeError) as error:
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1712
                logger.error("Unknown protocol version: %s", error)
237.5.2 by Teddy Hogeborn
* mandos (ClientHandler.handle): Set up the GnuTLS session object
1713
                return
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
1714
            
237.5.2 by Teddy Hogeborn
* mandos (ClientHandler.handle): Set up the GnuTLS session object
1715
            # Start GnuTLS connection
237.4.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
1716
            try:
1717
                session.handshake()
237.7.30 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
1718
            except gnutls.errors.GNUTLSError as error:
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1719
                logger.warning("Handshake failed: %s", error)
237.4.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
1720
                # Do not run session.bye() here: the session is not
1721
                # established.  Just abandon the request.
1722
                return
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1723
            logger.debug("Handshake succeeded")
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
1724
            
24.1.150 by Björn Påhlsson
* mandos: Added ClientDBus.approve_pending property. Exposed
1725
            approval_required = False
237.4.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
1726
            try:
237.2.174 by Teddy Hogeborn
More consistent terminology: Clients are no longer "invalid" - they
1727
                try:
1728
                    fpr = self.fingerprint(self.peer_certificate
1729
                                           (session))
237.7.30 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
1730
                except (TypeError,
1731
                        gnutls.errors.GNUTLSError) as error:
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1732
                    logger.warning("Bad certificate: %s", error)
237.2.174 by Teddy Hogeborn
More consistent terminology: Clients are no longer "invalid" - they
1733
                    return
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1734
                logger.debug("Fingerprint: %s", fpr)
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
1735
                
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1736
                try:
1737
                    client = ProxyClient(child_pipe, fpr,
1738
                                         self.client_address)
1739
                except KeyError:
237.2.174 by Teddy Hogeborn
More consistent terminology: Clients are no longer "invalid" - they
1740
                    return
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1741
                
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1742
                if client.approval_delay:
1743
                    delay = client.approval_delay
24.1.150 by Björn Påhlsson
* mandos: Added ClientDBus.approve_pending property. Exposed
1744
                    client.approvals_pending += 1
1745
                    approval_required = True
1746
                
24.1.148 by Björn Påhlsson
half working on-demand password and approved code
1747
                while True:
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1748
                    if not client.enabled:
24.1.174 by Björn Påhlsson
* Makefile (CFLAGS): Added "-lrt" to include real time library.
1749
                        logger.info("Client %s is disabled",
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1750
                                       client.name)
1751
                        if self.server.use_dbus:
1752
                            # Emit D-Bus signal
237.11.3 by Teddy Hogeborn
* mandos: Break long lines.
1753
                            client.Rejected("Disabled")
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1754
                        return
24.1.150 by Björn Påhlsson
* mandos: Added ClientDBus.approve_pending property. Exposed
1755
                    
237.14.4 by Teddy Hogeborn
* mandos (_timedelta_to_milliseconds): Renamed to
1756
                    if client.approved or not client.approval_delay:
24.1.150 by Björn Påhlsson
* mandos: Added ClientDBus.approve_pending property. Exposed
1757
                        #We are approved or approval is disabled
1758
                        break
237.14.4 by Teddy Hogeborn
* mandos (_timedelta_to_milliseconds): Renamed to
1759
                    elif client.approved is None:
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1760
                        logger.info("Client %s needs approval",
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1761
                                    client.name)
1762
                        if self.server.use_dbus:
1763
                            # Emit D-Bus signal
1764
                            client.NeedApproval(
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1765
                                client.approval_delay_milliseconds(),
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1766
                                client.approved_by_default)
1767
                    else:
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1768
                        logger.warning("Client %s was not approved",
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1769
                                       client.name)
1770
                        if self.server.use_dbus:
24.1.150 by Björn Påhlsson
* mandos: Added ClientDBus.approve_pending property. Exposed
1771
                            # Emit D-Bus signal
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1772
                            client.Rejected("Denied")
24.1.148 by Björn Påhlsson
half working on-demand password and approved code
1773
                        return
1774
                    
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1775
                    #wait until timeout or approved
1776
                    time = datetime.datetime.now()
1777
                    client.changedstate.acquire()
237.7.129 by Teddy Hogeborn
* mandos (Client.enable, Client.disable, ClientDBus.approve): Call
1778
                    client.changedstate.wait(
1779
                        float(timedelta_to_milliseconds(delay)
1780
                              / 1000))
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1781
                    client.changedstate.release()
1782
                    time2 = datetime.datetime.now()
1783
                    if (time2 - time) >= delay:
1784
                        if not client.approved_by_default:
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1785
                            logger.warning("Client %s timed out while"
1786
                                           " waiting for approval",
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1787
                                           client.name)
1788
                            if self.server.use_dbus:
1789
                                # Emit D-Bus signal
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1790
                                client.Rejected("Approval timed out")
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1791
                            return
1792
                        else:
1793
                            break
1794
                    else:
1795
                        delay -= time2 - time
1796
                
237.2.174 by Teddy Hogeborn
More consistent terminology: Clients are no longer "invalid" - they
1797
                sent_size = 0
1798
                while sent_size < len(client.secret):
24.1.155 by Björn Påhlsson
mandos server: Added debuglevel that adjust at what level information
1799
                    try:
1800
                        sent = session.send(client.secret[sent_size:])
237.7.30 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
1801
                    except gnutls.errors.GNUTLSError as error:
237.7.122 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
1802
                        logger.warning("gnutls send failed",
1803
                                       exc_info=error)
24.1.155 by Björn Påhlsson
mandos server: Added debuglevel that adjust at what level information
1804
                        return
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1805
                    logger.debug("Sent: %d, remaining: %d",
237.2.174 by Teddy Hogeborn
More consistent terminology: Clients are no longer "invalid" - they
1806
                                 sent, len(client.secret)
1807
                                 - (sent_size + sent))
1808
                    sent_size += sent
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
1809
                
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1810
                logger.info("Sending secret to %s", client.name)
237.11.13 by Teddy Hogeborn
Miscellaneous fixes prompted by lintian:
1811
                # bump the timeout using extended_timeout
237.7.104 by Teddy Hogeborn
* DBUS-API (se.recompile.Mandos.Client.LastCheckerStatus): New
1812
                client.bump_timeout(client.extended_timeout)
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1813
                if self.server.use_dbus:
1814
                    # Emit D-Bus signal
1815
                    client.GotSecret()
24.1.150 by Björn Påhlsson
* mandos: Added ClientDBus.approve_pending property. Exposed
1816
            
237.2.174 by Teddy Hogeborn
More consistent terminology: Clients are no longer "invalid" - they
1817
            finally:
24.1.150 by Björn Påhlsson
* mandos: Added ClientDBus.approve_pending property. Exposed
1818
                if approval_required:
1819
                    client.approvals_pending -= 1
24.1.155 by Björn Påhlsson
mandos server: Added debuglevel that adjust at what level information
1820
                try:
1821
                    session.bye()
237.7.30 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
1822
                except gnutls.errors.GNUTLSError as error:
237.7.122 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
1823
                    logger.warning("GnuTLS bye failed",
1824
                                   exc_info=error)
237.2.93 by Teddy Hogeborn
* mandos (peer_certificate, fingerprint): Moved into "TCP_handler"
1825
    
1826
    @staticmethod
1827
    def peer_certificate(session):
1828
        "Return the peer's OpenPGP certificate as a bytestring"
1829
        # If not an OpenPGP certificate...
1830
        if (gnutls.library.functions
1831
            .gnutls_certificate_type_get(session._c_object)
1832
            != gnutls.library.constants.GNUTLS_CRT_OPENPGP):
1833
            # ...do the normal thing
1834
            return session.peer_certificate
1835
        list_size = ctypes.c_uint(1)
1836
        cert_list = (gnutls.library.functions
1837
                     .gnutls_certificate_get_peers
1838
                     (session._c_object, ctypes.byref(list_size)))
1839
        if not bool(cert_list) and list_size.value != 0:
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1840
            raise gnutls.errors.GNUTLSError("error getting peer"
1841
                                            " certificate")
237.2.93 by Teddy Hogeborn
* mandos (peer_certificate, fingerprint): Moved into "TCP_handler"
1842
        if list_size.value == 0:
1843
            return None
1844
        cert = cert_list[0]
1845
        return ctypes.string_at(cert.data, cert.size)
1846
    
1847
    @staticmethod
1848
    def fingerprint(openpgp):
1849
        "Convert an OpenPGP bytestring to a hexdigit fingerprint"
1850
        # New GnuTLS "datum" with the OpenPGP public key
1851
        datum = (gnutls.library.types
1852
                 .gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
1853
                                             ctypes.POINTER
1854
                                             (ctypes.c_ubyte)),
1855
                                 ctypes.c_uint(len(openpgp))))
1856
        # New empty GnuTLS certificate
1857
        crt = gnutls.library.types.gnutls_openpgp_crt_t()
1858
        (gnutls.library.functions
1859
         .gnutls_openpgp_crt_init(ctypes.byref(crt)))
1860
        # Import the OpenPGP public key into the certificate
1861
        (gnutls.library.functions
1862
         .gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
1863
                                    gnutls.library.constants
1864
                                    .GNUTLS_OPENPGP_FMT_RAW))
1865
        # Verify the self signature in the key
1866
        crtverify = ctypes.c_uint()
1867
        (gnutls.library.functions
1868
         .gnutls_openpgp_crt_verify_self(crt, 0,
1869
                                         ctypes.byref(crtverify)))
1870
        if crtverify.value != 0:
1871
            gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1872
            raise (gnutls.errors.CertificateSecurityError
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1873
                   ("Verify failed"))
237.2.93 by Teddy Hogeborn
* mandos (peer_certificate, fingerprint): Moved into "TCP_handler"
1874
        # New buffer for the fingerprint
1875
        buf = ctypes.create_string_buffer(20)
1876
        buf_len = ctypes.c_size_t()
1877
        # Get the fingerprint from the certificate into the buffer
1878
        (gnutls.library.functions
1879
         .gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
1880
                                             ctypes.byref(buf_len)))
1881
        # Deinit the certificate
1882
        gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1883
        # Convert the buffer to a Python bytestring
1884
        fpr = ctypes.string_at(buf, buf_len.value)
1885
        # Convert the bytestring to hexadecimal notation
237.14.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
1886
        hex_fpr = binascii.hexlify(fpr).upper()
237.2.93 by Teddy Hogeborn
* mandos (peer_certificate, fingerprint): Moved into "TCP_handler"
1887
        return hex_fpr
237.4.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
1888
1889
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1890
class MultiprocessingMixIn(object):
1891
    """Like socketserver.ThreadingMixIn, but with multiprocessing"""
1892
    def sub_process_main(self, request, address):
1893
        try:
1894
            self.finish_request(request, address)
237.12.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
1895
        except Exception:
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1896
            self.handle_error(request, address)
1897
        self.close_request(request)
237.11.11 by Teddy Hogeborn
* mandos (Client.checked_ok): Set "expires" after setting timeout.
1898
    
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1899
    def process_request(self, request, address):
1900
        """Start a new process to process the request."""
237.11.11 by Teddy Hogeborn
* mandos (Client.checked_ok): Set "expires" after setting timeout.
1901
        proc = multiprocessing.Process(target = self.sub_process_main,
237.7.127 by Teddy Hogeborn
* mandos: Use all new builtins.
1902
                                       args = (request, address))
237.11.11 by Teddy Hogeborn
* mandos (Client.checked_ok): Set "expires" after setting timeout.
1903
        proc.start()
1904
        return proc
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1905
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
1906
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1907
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
1908
    """ adds a pipe to the MixIn """
237.4.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
1909
    def process_request(self, request, client_address):
237.2.94 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
1910
        """Overrides and wraps the original process_request().
1911
        
237.2.118 by Teddy Hogeborn
* mandos: White-space fixes only.
1912
        This function creates a new pipe in self.pipe
237.4.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
1913
        """
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1914
        parent_pipe, self.child_pipe = multiprocessing.Pipe()
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
1915
        
237.11.11 by Teddy Hogeborn
* mandos (Client.checked_ok): Set "expires" after setting timeout.
1916
        proc = MultiprocessingMixIn.process_request(self, request,
1917
                                                    client_address)
24.1.152 by Björn Påhlsson
bug fixes that prevent problems when runing server as root
1918
        self.child_pipe.close()
237.11.11 by Teddy Hogeborn
* mandos (Client.checked_ok): Set "expires" after setting timeout.
1919
        self.add_pipe(parent_pipe, proc)
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
1920
    
237.11.11 by Teddy Hogeborn
* mandos (Client.checked_ok): Set "expires" after setting timeout.
1921
    def add_pipe(self, parent_pipe, proc):
237.4.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
1922
        """Dummy function; override as necessary"""
237.7.190 by Teddy Hogeborn
Syntax fix; use "raise" better in Mandos server.
1923
        raise NotImplementedError()
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1924
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
1925
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1926
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
237.2.98 by Teddy Hogeborn
* mandos: Import "SocketServer" as "socketserver" and "ConfigParser"
1927
                     socketserver.TCPServer, object):
250 by Teddy Hogeborn
Merge from trunk. Notable changes:
1928
    """IPv6-capable TCP server.  Accepts 'None' as address and/or port
237.2.94 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
1929
    
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
1930
    Attributes:
237.2.94 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
1931
        enabled:        Boolean; whether this server is activated yet
1932
        interface:      None or a network interface name (string)
1933
        use_ipv6:       Boolean; to use IPv6 or not
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
1934
    """
237.2.94 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
1935
    def __init__(self, server_address, RequestHandlerClass,
237.21.1 by Teddy Hogeborn
* mandos: Implement "--socket" option.
1936
                 interface=None, use_ipv6=True, socketfd=None):
1937
        """If socketfd is set, use that file descriptor instead of
1938
        creating a new one with socket.socket().
1939
        """
237.2.94 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
1940
        self.interface = interface
1941
        if use_ipv6:
1942
            self.address_family = socket.AF_INET6
237.21.1 by Teddy Hogeborn
* mandos: Implement "--socket" option.
1943
        if socketfd is not None:
1944
            # Save the file descriptor
1945
            self.socketfd = socketfd
1946
            # Save the original socket.socket() function
1947
            self.socket_socket = socket.socket
1948
            # To implement --socket, we monkey patch socket.socket.
1949
            # 
1950
            # (When socketserver.TCPServer is a new-style class, we
1951
            # could make self.socket into a property instead of monkey
1952
            # patching socket.socket.)
1953
            # 
1954
            # Create a one-time-only replacement for socket.socket()
1955
            @functools.wraps(socket.socket)
1956
            def socket_wrapper(*args, **kwargs):
1957
                # Restore original function so subsequent calls are
1958
                # not affected.
1959
                socket.socket = self.socket_socket
1960
                del self.socket_socket
1961
                # This time only, return a new socket object from the
1962
                # saved file descriptor.
1963
                return socket.fromfd(self.socketfd, *args, **kwargs)
1964
            # Replace socket.socket() function with wrapper
1965
            socket.socket = socket_wrapper
1966
        # The socketserver.TCPServer.__init__ will call
1967
        # socket.socket(), which might be our replacement,
1968
        # socket_wrapper(), if socketfd was set.
237.2.98 by Teddy Hogeborn
* mandos: Import "SocketServer" as "socketserver" and "ConfigParser"
1969
        socketserver.TCPServer.__init__(self, server_address,
237.2.94 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
1970
                                        RequestHandlerClass)
237.21.1 by Teddy Hogeborn
* mandos: Implement "--socket" option.
1971
    
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
1972
    def server_bind(self):
1973
        """This overrides the normal server_bind() function
1974
        to bind to an interface if one was specified, and also NOT to
1975
        bind to an address or port if they were not specified."""
237.2.94 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
1976
        if self.interface is not None:
237.2.101 by Teddy Hogeborn
* mandos: Minor doc string fixes.
1977
            if SO_BINDTODEVICE is None:
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1978
                logger.error("SO_BINDTODEVICE does not exist;"
1979
                             " cannot bind to interface %s",
237.2.101 by Teddy Hogeborn
* mandos: Minor doc string fixes.
1980
                             self.interface)
1981
            else:
1982
                try:
1983
                    self.socket.setsockopt(socket.SOL_SOCKET,
1984
                                           SO_BINDTODEVICE,
237.7.154 by Teddy Hogeborn
* mandos: New "--foreground" option.
1985
                                           str(self.interface + '\0'))
237.7.30 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
1986
                except socket.error as error:
237.7.130 by Teddy Hogeborn
* mandos (IPv6_TCPServer.server_bind): Bug fix: handle non-existing
1987
                    if error.errno == errno.EPERM:
237.7.154 by Teddy Hogeborn
* mandos: New "--foreground" option.
1988
                        logger.error("No permission to bind to"
1989
                                     " interface %s", self.interface)
237.7.130 by Teddy Hogeborn
* mandos (IPv6_TCPServer.server_bind): Bug fix: handle non-existing
1990
                    elif error.errno == errno.ENOPROTOOPT:
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1991
                        logger.error("SO_BINDTODEVICE not available;"
1992
                                     " cannot bind to interface %s",
237.2.101 by Teddy Hogeborn
* mandos: Minor doc string fixes.
1993
                                     self.interface)
237.7.130 by Teddy Hogeborn
* mandos (IPv6_TCPServer.server_bind): Bug fix: handle non-existing
1994
                    elif error.errno == errno.ENODEV:
237.7.154 by Teddy Hogeborn
* mandos: New "--foreground" option.
1995
                        logger.error("Interface %s does not exist,"
1996
                                     " cannot bind", self.interface)
237.2.101 by Teddy Hogeborn
* mandos: Minor doc string fixes.
1997
                    else:
1998
                        raise
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
1999
        # Only bind(2) the socket if we really need to.
2000
        if self.server_address[0] or self.server_address[1]:
2001
            if not self.server_address[0]:
237.2.77 by Teddy Hogeborn
Support not using IPv6 in server:
2002
                if self.address_family == socket.AF_INET6:
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2003
                    any_address = "::" # in6addr_any
237.2.77 by Teddy Hogeborn
Support not using IPv6 in server:
2004
                else:
237.7.166 by Teddy Hogeborn
* mandos: Bug fix: Make boolean options work from the config file
2005
                    any_address = "0.0.0.0" # INADDR_ANY
237.2.77 by Teddy Hogeborn
Support not using IPv6 in server:
2006
                self.server_address = (any_address,
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
2007
                                       self.server_address[1])
49 by Teddy Hogeborn
* mandos (IPv6_TCPServer.server_bind): Bug fix: allow port to be empty
2008
            elif not self.server_address[1]:
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
2009
                self.server_address = (self.server_address[0],
2010
                                       0)
237.2.94 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
2011
#                 if self.interface:
49 by Teddy Hogeborn
* mandos (IPv6_TCPServer.server_bind): Bug fix: allow port to be empty
2012
#                     self.server_address = (self.server_address[0],
2013
#                                            0, # port
2014
#                                            0, # flowinfo
2015
#                                            if_nametoindex
237.2.94 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
2016
#                                            (self.interface))
237.2.98 by Teddy Hogeborn
* mandos: Import "SocketServer" as "socketserver" and "ConfigParser"
2017
            return socketserver.TCPServer.server_bind(self)
237.2.102 by Teddy Hogeborn
Code cleanup.
2018
2019
2020
class MandosServer(IPv6_TCPServer):
2021
    """Mandos server.
2022
    
2023
    Attributes:
2024
        clients:        set of Client objects
2025
        gnutls_priority GnuTLS priority string
2026
        use_dbus:       Boolean; to emit D-Bus signals or not
237.2.103 by Teddy Hogeborn
Code cleanup.
2027
    
2028
    Assumes a gobject.MainLoop event loop.
237.2.102 by Teddy Hogeborn
Code cleanup.
2029
    """
2030
    def __init__(self, server_address, RequestHandlerClass,
2031
                 interface=None, use_ipv6=True, clients=None,
237.21.1 by Teddy Hogeborn
* mandos: Implement "--socket" option.
2032
                 gnutls_priority=None, use_dbus=True, socketfd=None):
237.2.102 by Teddy Hogeborn
Code cleanup.
2033
        self.enabled = False
2034
        self.clients = clients
237.2.104 by Teddy Hogeborn
Code cleanup and one bug fix.
2035
        if self.clients is None:
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
2036
            self.clients = {}
237.2.102 by Teddy Hogeborn
Code cleanup.
2037
        self.use_dbus = use_dbus
2038
        self.gnutls_priority = gnutls_priority
2039
        IPv6_TCPServer.__init__(self, server_address,
2040
                                RequestHandlerClass,
2041
                                interface = interface,
237.21.1 by Teddy Hogeborn
* mandos: Implement "--socket" option.
2042
                                use_ipv6 = use_ipv6,
2043
                                socketfd = socketfd)
163 by Teddy Hogeborn
* Makefile (PIDDIR, USER, GROUP): Removed.
2044
    def server_activate(self):
2045
        if self.enabled:
237.2.98 by Teddy Hogeborn
* mandos: Import "SocketServer" as "socketserver" and "ConfigParser"
2046
            return socketserver.TCPServer.server_activate(self)
237.11.11 by Teddy Hogeborn
* mandos (Client.checked_ok): Set "expires" after setting timeout.
2047
    
163 by Teddy Hogeborn
* Makefile (PIDDIR, USER, GROUP): Removed.
2048
    def enable(self):
2049
        self.enabled = True
237.11.11 by Teddy Hogeborn
* mandos (Client.checked_ok): Set "expires" after setting timeout.
2050
    
2051
    def add_pipe(self, parent_pipe, proc):
237.2.103 by Teddy Hogeborn
Code cleanup.
2052
        # Call "handle_ipc" for both data and EOF events
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2053
        gobject.io_add_watch(parent_pipe.fileno(),
237.2.174 by Teddy Hogeborn
More consistent terminology: Clients are no longer "invalid" - they
2054
                             gobject.IO_IN | gobject.IO_HUP,
2055
                             functools.partial(self.handle_ipc,
237.11.3 by Teddy Hogeborn
* mandos: Break long lines.
2056
                                               parent_pipe =
237.11.11 by Teddy Hogeborn
* mandos (Client.checked_ok): Set "expires" after setting timeout.
2057
                                               parent_pipe,
2058
                                               proc = proc))
237.11.9 by Teddy Hogeborn
Whitespace
2059
    
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2060
    def handle_ipc(self, source, condition, parent_pipe=None,
237.11.11 by Teddy Hogeborn
* mandos (Client.checked_ok): Set "expires" after setting timeout.
2061
                   proc = None, client_object=None):
237.11.13 by Teddy Hogeborn
Miscellaneous fixes prompted by lintian:
2062
        # error, or the other end of multiprocessing.Pipe has closed
237.7.125 by Teddy Hogeborn
* mandos (Client.start_checker): Reworded comment.
2063
        if condition & (gobject.IO_ERR | gobject.IO_HUP):
237.11.13 by Teddy Hogeborn
Miscellaneous fixes prompted by lintian:
2064
            # Wait for other process to exit
237.11.11 by Teddy Hogeborn
* mandos (Client.checked_ok): Set "expires" after setting timeout.
2065
            proc.join()
24.1.152 by Björn Påhlsson
bug fixes that prevent problems when runing server as root
2066
            return False
237.4.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
2067
        
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2068
        # Read a request from the child
2069
        request = parent_pipe.recv()
2070
        command = request[0]
2071
        
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2072
        if command == 'init':
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2073
            fpr = request[1]
2074
            address = request[2]
2075
            
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
2076
            for c in self.clients.itervalues():
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2077
                if c.fingerprint == fpr:
2078
                    client = c
2079
                    break
2080
            else:
24.1.174 by Björn Påhlsson
* Makefile (CFLAGS): Added "-lrt" to include real time library.
2081
                logger.info("Client not found for fingerprint: %s, ad"
2082
                            "dress: %s", fpr, address)
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2083
                if self.use_dbus:
2084
                    # Emit D-Bus signal
237.11.3 by Teddy Hogeborn
* mandos: Break long lines.
2085
                    mandos_dbus_service.ClientNotFound(fpr,
2086
                                                       address[0])
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2087
                parent_pipe.send(False)
2088
                return False
2089
            
2090
            gobject.io_add_watch(parent_pipe.fileno(),
2091
                                 gobject.IO_IN | gobject.IO_HUP,
2092
                                 functools.partial(self.handle_ipc,
237.11.3 by Teddy Hogeborn
* mandos: Break long lines.
2093
                                                   parent_pipe =
2094
                                                   parent_pipe,
237.11.11 by Teddy Hogeborn
* mandos (Client.checked_ok): Set "expires" after setting timeout.
2095
                                                   proc = proc,
237.11.3 by Teddy Hogeborn
* mandos: Break long lines.
2096
                                                   client_object =
2097
                                                   client))
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2098
            parent_pipe.send(True)
237.11.3 by Teddy Hogeborn
* mandos: Break long lines.
2099
            # remove the old hook in favor of the new above hook on
2100
            # same fileno
237.4.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
2101
            return False
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2102
        if command == 'funcall':
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2103
            funcname = request[1]
2104
            args = request[2]
2105
            kwargs = request[3]
2106
            
237.11.3 by Teddy Hogeborn
* mandos: Break long lines.
2107
            parent_pipe.send(('data', getattr(client_object,
2108
                                              funcname)(*args,
2109
                                                         **kwargs)))
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
2110
        
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2111
        if command == 'getattr':
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2112
            attrname = request[1]
2113
            if callable(client_object.__getattribute__(attrname)):
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2114
                parent_pipe.send(('function',))
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2115
            else:
237.11.3 by Teddy Hogeborn
* mandos: Break long lines.
2116
                parent_pipe.send(('data', client_object
2117
                                  .__getattribute__(attrname)))
24.2.4 by teddy at bsnet
* mandos (ClientDBus.approvals_pending): Changed to be a property
2118
        
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2119
        if command == 'setattr':
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2120
            attrname = request[1]
2121
            value = request[2]
2122
            setattr(client_object, attrname, value)
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
2123
        
237.4.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
2124
        return True
10 by Teddy Hogeborn
* server.py: Bug fix: Do "from __future__ import division".
2125
3 by Björn Påhlsson
Python based server
2126
237.7.157 by Teddy Hogeborn
* clients.conf: Convert all time intervals to new RFC 3339 syntax.
2127
def rfc3339_duration_to_delta(duration):
2128
    """Parse an RFC 3339 "duration" and return a datetime.timedelta
2129
    
2130
    >>> rfc3339_duration_to_delta("P7D")
2131
    datetime.timedelta(7)
2132
    >>> rfc3339_duration_to_delta("PT60S")
2133
    datetime.timedelta(0, 60)
2134
    >>> rfc3339_duration_to_delta("PT60M")
2135
    datetime.timedelta(0, 3600)
2136
    >>> rfc3339_duration_to_delta("PT24H")
2137
    datetime.timedelta(1)
2138
    >>> rfc3339_duration_to_delta("P1W")
2139
    datetime.timedelta(7)
2140
    >>> rfc3339_duration_to_delta("PT5M30S")
2141
    datetime.timedelta(0, 330)
2142
    >>> rfc3339_duration_to_delta("P1DT3M20S")
2143
    datetime.timedelta(1, 200)
2144
    """
2145
    
2146
    # Parsing an RFC 3339 duration with regular expressions is not
2147
    # possible - there would have to be multiple places for the same
2148
    # values, like seconds.  The current code, while more esoteric, is
2149
    # cleaner without depending on a parsing library.  If Python had a
2150
    # built-in library for parsing we would use it, but we'd like to
2151
    # avoid excessive use of external libraries.
2152
    
2153
    # New type for defining tokens, syntax, and semantics all-in-one
2154
    Token = collections.namedtuple("Token",
2155
                                   ("regexp", # To match token; if
2156
                                              # "value" is not None,
2157
                                              # must have a "group"
2158
                                              # containing digits
2159
                                    "value",  # datetime.timedelta or
2160
                                              # None
2161
                                    "followers")) # Tokens valid after
2162
                                                  # this token
2163
    # RFC 3339 "duration" tokens, syntax, and semantics; taken from
2164
    # the "duration" ABNF definition in RFC 3339, Appendix A.
2165
    token_end = Token(re.compile(r"$"), None, frozenset())
2166
    token_second = Token(re.compile(r"(\d+)S"),
2167
                         datetime.timedelta(seconds=1),
2168
                         frozenset((token_end,)))
2169
    token_minute = Token(re.compile(r"(\d+)M"),
2170
                         datetime.timedelta(minutes=1),
2171
                         frozenset((token_second, token_end)))
2172
    token_hour = Token(re.compile(r"(\d+)H"),
2173
                       datetime.timedelta(hours=1),
2174
                       frozenset((token_minute, token_end)))
2175
    token_time = Token(re.compile(r"T"),
2176
                       None,
2177
                       frozenset((token_hour, token_minute,
2178
                                  token_second)))
2179
    token_day = Token(re.compile(r"(\d+)D"),
2180
                      datetime.timedelta(days=1),
2181
                      frozenset((token_time, token_end)))
2182
    token_month = Token(re.compile(r"(\d+)M"),
2183
                        datetime.timedelta(weeks=4),
2184
                        frozenset((token_day, token_end)))
2185
    token_year = Token(re.compile(r"(\d+)Y"),
2186
                       datetime.timedelta(weeks=52),
2187
                       frozenset((token_month, token_end)))
2188
    token_week = Token(re.compile(r"(\d+)W"),
2189
                       datetime.timedelta(weeks=1),
2190
                       frozenset((token_end,)))
2191
    token_duration = Token(re.compile(r"P"), None,
2192
                           frozenset((token_year, token_month,
2193
                                      token_day, token_time,
2194
                                      token_week))),
2195
    # Define starting values
2196
    value = datetime.timedelta() # Value so far
2197
    found_token = None
2198
    followers = frozenset(token_duration,) # Following valid tokens
2199
    s = duration                # String left to parse
2200
    # Loop until end token is found
2201
    while found_token is not token_end:
2202
        # Search for any currently valid tokens
2203
        for token in followers:
2204
            match = token.regexp.match(s)
2205
            if match is not None:
2206
                # Token found
2207
                if token.value is not None:
2208
                    # Value found, parse digits
2209
                    factor = int(match.group(1), 10)
2210
                    # Add to value so far
2211
                    value += factor * token.value
2212
                # Strip token from string
2213
                s = token.regexp.sub("", s, 1)
2214
                # Go to found token
2215
                found_token = token
2216
                # Set valid next tokens
2217
                followers = found_token.followers
2218
                break
2219
        else:
2220
            # No currently valid tokens were found
2221
            raise ValueError("Invalid RFC 3339 duration")
2222
    # End token found
2223
    return value
2224
2225
4 by Teddy Hogeborn
* server.py (Client.created, Client.next_check): New.
2226
def string_to_delta(interval):
2227
    """Parse a string and return a datetime.timedelta
237.2.53 by Teddy Hogeborn
* mandos (main): Bug fix: Do setgid before setuid. Add verbose GnuTLS
2228
    
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2229
    >>> string_to_delta('7d')
4 by Teddy Hogeborn
* server.py (Client.created, Client.next_check): New.
2230
    datetime.timedelta(7)
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2231
    >>> string_to_delta('60s')
4 by Teddy Hogeborn
* server.py (Client.created, Client.next_check): New.
2232
    datetime.timedelta(0, 60)
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2233
    >>> string_to_delta('60m')
4 by Teddy Hogeborn
* server.py (Client.created, Client.next_check): New.
2234
    datetime.timedelta(0, 3600)
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2235
    >>> string_to_delta('24h')
4 by Teddy Hogeborn
* server.py (Client.created, Client.next_check): New.
2236
    datetime.timedelta(1)
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2237
    >>> string_to_delta('1w')
4 by Teddy Hogeborn
* server.py (Client.created, Client.next_check): New.
2238
    datetime.timedelta(7)
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2239
    >>> string_to_delta('5m 30s')
93 by Teddy Hogeborn
* mandos (string_to_delta): Accept a whitespace-separated sequence of
2240
    datetime.timedelta(0, 330)
4 by Teddy Hogeborn
* server.py (Client.created, Client.next_check): New.
2241
    """
237.7.157 by Teddy Hogeborn
* clients.conf: Convert all time intervals to new RFC 3339 syntax.
2242
    
2243
    try:
2244
        return rfc3339_duration_to_delta(interval)
2245
    except ValueError:
2246
        pass
2247
    
93 by Teddy Hogeborn
* mandos (string_to_delta): Accept a whitespace-separated sequence of
2248
    timevalue = datetime.timedelta(0)
2249
    for s in interval.split():
2250
        try:
215 by Teddy Hogeborn
* mandos: Remove unused "select" module. Import "ctypes.util".
2251
            suffix = unicode(s[-1])
2252
            value = int(s[:-1])
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2253
            if suffix == "d":
93 by Teddy Hogeborn
* mandos (string_to_delta): Accept a whitespace-separated sequence of
2254
                delta = datetime.timedelta(value)
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2255
            elif suffix == "s":
93 by Teddy Hogeborn
* mandos (string_to_delta): Accept a whitespace-separated sequence of
2256
                delta = datetime.timedelta(0, value)
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2257
            elif suffix == "m":
93 by Teddy Hogeborn
* mandos (string_to_delta): Accept a whitespace-separated sequence of
2258
                delta = datetime.timedelta(0, 0, 0, 0, value)
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2259
            elif suffix == "h":
93 by Teddy Hogeborn
* mandos (string_to_delta): Accept a whitespace-separated sequence of
2260
                delta = datetime.timedelta(0, 0, 0, 0, 0, value)
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2261
            elif suffix == "w":
93 by Teddy Hogeborn
* mandos (string_to_delta): Accept a whitespace-separated sequence of
2262
                delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
2263
            else:
237.7.116 by Teddy Hogeborn
* mandos-monitor: Use new string format method.
2264
                raise ValueError("Unknown suffix {0!r}"
2265
                                 .format(suffix))
237.7.190 by Teddy Hogeborn
Syntax fix; use "raise" better in Mandos server.
2266
        except IndexError as e:
237.7.12 by Teddy Hogeborn
* debian/mandos-client.postrm (purge): Bug fix: update initramfs also
2267
            raise ValueError(*(e.args))
93 by Teddy Hogeborn
* mandos (string_to_delta): Accept a whitespace-separated sequence of
2268
        timevalue += delta
2269
    return timevalue
4 by Teddy Hogeborn
* server.py (Client.created, Client.next_check): New.
2270
8 by Teddy Hogeborn
* Makefile (client_debug): Bug fix; add quotes and / to CERT_ROOT.
2271
47 by Teddy Hogeborn
* plugbasedclient.c: Renamed to "mandos-client.c". All users changed.
2272
def daemon(nochdir = False, noclose = False):
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
2273
    """See daemon(3).  Standard BSD Unix function.
237.2.94 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
2274
    
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
2275
    This should really exist as os.daemon, but it doesn't (yet)."""
2276
    if os.fork():
2277
        sys.exit()
2278
    os.setsid()
2279
    if not nochdir:
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2280
        os.chdir("/")
46 by Teddy Hogeborn
* network-protocol.txt: New.
2281
    if os.fork():
2282
        sys.exit()
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
2283
    if not noclose:
2284
        # Close all standard open file descriptors
237.18.1 by teddy at recompile
* mandos: Use os.devnull instead of os.path.devnull. Fix some white
2285
        null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
2286
        if not stat.S_ISCHR(os.fstat(null).st_mode):
2287
            raise OSError(errno.ENODEV,
237.7.116 by Teddy Hogeborn
* mandos-monitor: Use new string format method.
2288
                          "{0} not a character device"
2289
                          .format(os.devnull))
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
2290
        os.dup2(null, sys.stdin.fileno())
2291
        os.dup2(null, sys.stdout.fileno())
2292
        os.dup2(null, sys.stderr.fileno())
2293
        if null > 2:
2294
            os.close(null)
2295
2296
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
2297
def main():
237.2.90 by Teddy Hogeborn
Merge from pipe IPC branch.
2298
    
237.2.142 by Teddy Hogeborn
* mandos: Fix line lengths.
2299
    ##################################################################
237.2.90 by Teddy Hogeborn
Merge from pipe IPC branch.
2300
    # Parsing of options, both command line and config file
2301
    
237.7.22 by teddy at bsnet
* mandos: Use the new argparse library instead of optparse.
2302
    parser = argparse.ArgumentParser()
2303
    parser.add_argument("-v", "--version", action="version",
237.7.116 by Teddy Hogeborn
* mandos-monitor: Use new string format method.
2304
                        version = "%(prog)s {0}".format(version),
237.7.22 by teddy at bsnet
* mandos: Use the new argparse library instead of optparse.
2305
                        help="show version number and exit")
2306
    parser.add_argument("-i", "--interface", metavar="IF",
2307
                        help="Bind to interface IF")
2308
    parser.add_argument("-a", "--address",
2309
                        help="Address to listen for requests on")
2310
    parser.add_argument("-p", "--port", type=int,
2311
                        help="Port number to receive requests on")
2312
    parser.add_argument("--check", action="store_true",
2313
                        help="Run self-test")
2314
    parser.add_argument("--debug", action="store_true",
2315
                        help="Debug mode; run in foreground and log"
237.7.166 by Teddy Hogeborn
* mandos: Bug fix: Make boolean options work from the config file
2316
                        " to terminal", default=None)
237.7.22 by teddy at bsnet
* mandos: Use the new argparse library instead of optparse.
2317
    parser.add_argument("--debuglevel", metavar="LEVEL",
2318
                        help="Debug level for stdout output")
2319
    parser.add_argument("--priority", help="GnuTLS"
2320
                        " priority string (see GnuTLS documentation)")
2321
    parser.add_argument("--servicename",
2322
                        metavar="NAME", help="Zeroconf service name")
2323
    parser.add_argument("--configdir",
2324
                        default="/etc/mandos", metavar="DIR",
2325
                        help="Directory to search for configuration"
2326
                        " files")
2327
    parser.add_argument("--no-dbus", action="store_false",
2328
                        dest="use_dbus", help="Do not provide D-Bus"
237.7.166 by Teddy Hogeborn
* mandos: Bug fix: Make boolean options work from the config file
2329
                        " system bus interface", default=None)
237.7.22 by teddy at bsnet
* mandos: Use the new argparse library instead of optparse.
2330
    parser.add_argument("--no-ipv6", action="store_false",
237.7.166 by Teddy Hogeborn
* mandos: Bug fix: Make boolean options work from the config file
2331
                        dest="use_ipv6", help="Do not use IPv6",
2332
                        default=None)
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
2333
    parser.add_argument("--no-restore", action="store_false",
237.12.7 by Teddy Hogeborn
* mandos: Break long lines and fix some more white space.
2334
                        dest="restore", help="Do not restore stored"
237.7.166 by Teddy Hogeborn
* mandos: Bug fix: Make boolean options work from the config file
2335
                        " state", default=None)
237.21.1 by Teddy Hogeborn
* mandos: Implement "--socket" option.
2336
    parser.add_argument("--socket", type=int,
2337
                        help="Specify a file descriptor to a network"
2338
                        " socket to use instead of creating one")
237.14.2 by Teddy Hogeborn
Directory with persistent state can now be changed with the "statedir"
2339
    parser.add_argument("--statedir", metavar="DIR",
2340
                        help="Directory to save/restore state in")
237.7.154 by Teddy Hogeborn
* mandos: New "--foreground" option.
2341
    parser.add_argument("--foreground", action="store_true",
237.7.166 by Teddy Hogeborn
* mandos: Bug fix: Make boolean options work from the config file
2342
                        help="Run in foreground", default=None)
237.12.6 by Teddy Hogeborn
* mandos: Fix whitespace.
2343
    
237.7.22 by teddy at bsnet
* mandos: Use the new argparse library instead of optparse.
2344
    options = parser.parse_args()
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
2345
    
4 by Teddy Hogeborn
* server.py (Client.created, Client.next_check): New.
2346
    if options.check:
2347
        import doctest
237.7.202 by Teddy Hogeborn
Fix running of self-tests.
2348
        fail_count, test_count = doctest.testmod()
2349
        sys.exit(os.EX_OK if fail_count == 0 else 1)
3 by Björn Påhlsson
Python based server
2350
    
28 by Teddy Hogeborn
* server.conf: New file.
2351
    # Default values for config file for server-global settings
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2352
    server_defaults = { "interface": "",
2353
                        "address": "",
2354
                        "port": "",
2355
                        "debug": "False",
2356
                        "priority":
237.7.179 by Teddy Hogeborn
* mandos (priority): Bug fix: Add even more magic to make the old
2357
                        "SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2358
                        "servicename": "Mandos",
2359
                        "use_dbus": "True",
2360
                        "use_ipv6": "True",
2361
                        "debuglevel": "",
237.14.2 by Teddy Hogeborn
Directory with persistent state can now be changed with the "statedir"
2362
                        "restore": "True",
237.21.1 by Teddy Hogeborn
* mandos: Implement "--socket" option.
2363
                        "socket": "",
237.7.154 by Teddy Hogeborn
* mandos: New "--foreground" option.
2364
                        "statedir": "/var/lib/mandos",
2365
                        "foreground": "False",
28 by Teddy Hogeborn
* server.conf: New file.
2366
                        }
2367
    
2368
    # Parse config file for server-global settings
237.2.98 by Teddy Hogeborn
* mandos: Import "SocketServer" as "socketserver" and "ConfigParser"
2369
    server_config = configparser.SafeConfigParser(server_defaults)
28 by Teddy Hogeborn
* server.conf: New file.
2370
    del server_defaults
237.2.96 by Teddy Hogeborn
Minor code cleanup; one minor bug fix.
2371
    server_config.read(os.path.join(options.configdir,
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2372
                                    "mandos.conf"))
28 by Teddy Hogeborn
* server.conf: New file.
2373
    # Convert the SafeConfigParser object to a dict
89 by Teddy Hogeborn
* Makefile: Bug fix: fixed creation of man pages for section 5 pages.
2374
    server_settings = server_config.defaults()
237.2.45 by Teddy Hogeborn
* mandos (main): Bug fix: use "getint" on the "port" config file
2375
    # Use the appropriate methods on the non-string config options
237.7.154 by Teddy Hogeborn
* mandos: New "--foreground" option.
2376
    for option in ("debug", "use_dbus", "use_ipv6", "foreground"):
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2377
        server_settings[option] = server_config.getboolean("DEFAULT",
237.2.96 by Teddy Hogeborn
Minor code cleanup; one minor bug fix.
2378
                                                           option)
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2379
    if server_settings["port"]:
2380
        server_settings["port"] = server_config.getint("DEFAULT",
2381
                                                       "port")
237.21.1 by Teddy Hogeborn
* mandos: Implement "--socket" option.
2382
    if server_settings["socket"]:
2383
        server_settings["socket"] = server_config.getint("DEFAULT",
2384
                                                         "socket")
237.7.139 by Teddy Hogeborn
Merge "--socket" option for server.
2385
        # Later, stdin will, and stdout and stderr might, be dup'ed
237.21.1 by Teddy Hogeborn
* mandos: Implement "--socket" option.
2386
        # over with an opened os.devnull.  But we don't want this to
2387
        # happen with a supplied network socket.
2388
        if 0 <= server_settings["socket"] <= 2:
2389
            server_settings["socket"] = os.dup(server_settings
2390
                                               ["socket"])
28 by Teddy Hogeborn
* server.conf: New file.
2391
    del server_config
2392
    
2393
    # Override the settings from the config file with command line
2394
    # options, if set.
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2395
    for option in ("interface", "address", "port", "debug",
2396
                   "priority", "servicename", "configdir",
237.14.2 by Teddy Hogeborn
Directory with persistent state can now be changed with the "statedir"
2397
                   "use_dbus", "use_ipv6", "debuglevel", "restore",
237.7.154 by Teddy Hogeborn
* mandos: New "--foreground" option.
2398
                   "statedir", "socket", "foreground"):
28 by Teddy Hogeborn
* server.conf: New file.
2399
        value = getattr(options, option)
2400
        if value is not None:
2401
            server_settings[option] = value
2402
    del options
237.2.96 by Teddy Hogeborn
Minor code cleanup; one minor bug fix.
2403
    # Force all strings to be unicode
2404
    for option in server_settings.keys():
2405
        if type(server_settings[option]) is str:
2406
            server_settings[option] = unicode(server_settings[option])
237.7.166 by Teddy Hogeborn
* mandos: Bug fix: Make boolean options work from the config file
2407
    # Force all boolean options to be boolean
2408
    for option in ("debug", "use_dbus", "use_ipv6", "restore",
2409
                   "foreground"):
2410
        server_settings[option] = bool(server_settings[option])
237.7.154 by Teddy Hogeborn
* mandos: New "--foreground" option.
2411
    # Debug implies foreground
2412
    if server_settings["debug"]:
2413
        server_settings["foreground"] = True
28 by Teddy Hogeborn
* server.conf: New file.
2414
    # Now we have our good server settings in "server_settings"
2415
    
237.2.90 by Teddy Hogeborn
Merge from pipe IPC branch.
2416
    ##################################################################
2417
    
237.2.6 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
2418
    # For convenience
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2419
    debug = server_settings["debug"]
2420
    debuglevel = server_settings["debuglevel"]
2421
    use_dbus = server_settings["use_dbus"]
2422
    use_ipv6 = server_settings["use_ipv6"]
237.14.2 by Teddy Hogeborn
Directory with persistent state can now be changed with the "statedir"
2423
    stored_state_path = os.path.join(server_settings["statedir"],
2424
                                     stored_state_file)
237.7.154 by Teddy Hogeborn
* mandos: New "--foreground" option.
2425
    foreground = server_settings["foreground"]
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
2426
    
237.12.4 by Björn Påhlsson
restructured logger
2427
    if debug:
237.7.78 by teddy at bsnet
* mandos (initlogger): Take new "debug" argument; all callers changed.
2428
        initlogger(debug, logging.DEBUG)
237.12.4 by Björn Påhlsson
restructured logger
2429
    else:
2430
        if not debuglevel:
237.7.78 by teddy at bsnet
* mandos (initlogger): Take new "debug" argument; all callers changed.
2431
            initlogger(debug)
237.12.4 by Björn Påhlsson
restructured logger
2432
        else:
2433
            level = getattr(logging, debuglevel.upper())
237.7.78 by teddy at bsnet
* mandos (initlogger): Take new "debug" argument; all callers changed.
2434
            initlogger(debug, level)
237.12.4 by Björn Påhlsson
restructured logger
2435
    
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2436
    if server_settings["servicename"] != "Mandos":
237.1.2 by Teddy Hogeborn
Further steps towards a D-Bus server interface, plus minor syntax
2437
        syslogger.setFormatter(logging.Formatter
237.7.116 by Teddy Hogeborn
* mandos-monitor: Use new string format method.
2438
                               ('Mandos ({0}) [%(process)d]:'
2439
                                ' %(levelname)s: %(message)s'
2440
                                .format(server_settings
2441
                                        ["servicename"])))
52 by Teddy Hogeborn
* mandos: Make syslog use "/dev/log" instead of UDP to localhost.
2442
    
28 by Teddy Hogeborn
* server.conf: New file.
2443
    # Parse config file with clients
237.7.91 by Teddy Hogeborn
* mandos: Break some long lines.
2444
    client_config = configparser.SafeConfigParser(Client
2445
                                                  .client_defaults)
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2446
    client_config.read(os.path.join(server_settings["configdir"],
2447
                                    "clients.conf"))
237.2.96 by Teddy Hogeborn
Minor code cleanup; one minor bug fix.
2448
    
237.2.90 by Teddy Hogeborn
Merge from pipe IPC branch.
2449
    global mandos_dbus_service
2450
    mandos_dbus_service = None
28 by Teddy Hogeborn
* server.conf: New file.
2451
    
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2452
    tcp_server = MandosServer((server_settings["address"],
2453
                               server_settings["port"]),
237.2.102 by Teddy Hogeborn
Code cleanup.
2454
                              ClientHandler,
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2455
                              interface=(server_settings["interface"]
269.1.3 by teddy at bsnet
* mandos (main): Bug fix: Don't try to bind to an empty string
2456
                                         or None),
237.2.102 by Teddy Hogeborn
Code cleanup.
2457
                              use_ipv6=use_ipv6,
2458
                              gnutls_priority=
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2459
                              server_settings["priority"],
237.21.1 by Teddy Hogeborn
* mandos: Implement "--socket" option.
2460
                              use_dbus=use_dbus,
2461
                              socketfd=(server_settings["socket"]
2462
                                        or None))
237.7.154 by Teddy Hogeborn
* mandos: New "--foreground" option.
2463
    if not foreground:
237.7.174 by Teddy Hogeborn
* Makefile (CFLAGS, LDFLAGS): Keep default flags from environment.
2464
        pidfilename = "/run/mandos.pid"
237.7.184 by Teddy Hogeborn
Fall back to /var/run for pidfile if /run is not a directory.
2465
        if not os.path.isdir("/run/."):
2466
            pidfilename = "/var/run/mandos.pid"
237.7.154 by Teddy Hogeborn
* mandos: New "--foreground" option.
2467
        pidfile = None
237.2.202 by Teddy Hogeborn
* mandos: Do not write pid file if --debug is passed.
2468
        try:
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2469
            pidfile = open(pidfilename, "w")
237.7.122 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
2470
        except IOError as e:
2471
            logger.error("Could not open file %r", pidfilename,
2472
                         exc_info=e)
164 by Teddy Hogeborn
* mandos: Open the PID file before daemonizing, but write to it
2473
    
237.7.114 by Teddy Hogeborn
* mandos (main): Simplify and shorten code selecting user and group ID
2474
    for name in ("_mandos", "mandos", "nobody"):
237.2.1 by Teddy Hogeborn
First version of a somewhat complete D-Bus server interface. Also
2475
        try:
237.7.114 by Teddy Hogeborn
* mandos (main): Simplify and shorten code selecting user and group ID
2476
            uid = pwd.getpwnam(name).pw_uid
2477
            gid = pwd.getpwnam(name).pw_gid
2478
            break
237.2.1 by Teddy Hogeborn
First version of a somewhat complete D-Bus server interface. Also
2479
        except KeyError:
237.7.114 by Teddy Hogeborn
* mandos (main): Simplify and shorten code selecting user and group ID
2480
            continue
2481
    else:
2482
        uid = 65534
2483
        gid = 65534
163 by Teddy Hogeborn
* Makefile (PIDDIR, USER, GROUP): Removed.
2484
    try:
237.2.53 by Teddy Hogeborn
* mandos (main): Bug fix: Do setgid before setuid. Add verbose GnuTLS
2485
        os.setgid(gid)
163 by Teddy Hogeborn
* Makefile (PIDDIR, USER, GROUP): Removed.
2486
        os.setuid(uid)
237.7.30 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
2487
    except OSError as error:
237.7.131 by Teddy Hogeborn
* mandos (Client.start_checker): Remove undocumented support for "%%s"
2488
        if error.errno != errno.EPERM:
237.7.190 by Teddy Hogeborn
Syntax fix; use "raise" better in Mandos server.
2489
            raise
164 by Teddy Hogeborn
* mandos: Open the PID file before daemonizing, but write to it
2490
    
237.2.53 by Teddy Hogeborn
* mandos (main): Bug fix: Do setgid before setuid. Add verbose GnuTLS
2491
    if debug:
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2492
        # Enable all possible GnuTLS debugging
2493
        
237.2.53 by Teddy Hogeborn
* mandos (main): Bug fix: Do setgid before setuid. Add verbose GnuTLS
2494
        # "Use a log level over 10 to enable all debugging options."
2495
        # - GnuTLS manual
2496
        gnutls.library.functions.gnutls_global_set_log_level(11)
2497
        
2498
        @gnutls.library.types.gnutls_log_func
2499
        def debug_gnutls(level, string):
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2500
            logger.debug("GnuTLS: %s", string[:-1])
237.2.53 by Teddy Hogeborn
* mandos (main): Bug fix: Do setgid before setuid. Add verbose GnuTLS
2501
        
2502
        (gnutls.library.functions
2503
         .gnutls_global_set_log_function(debug_gnutls))
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2504
        
24.1.155 by Björn Påhlsson
mandos server: Added debuglevel that adjust at what level information
2505
        # Redirect stdin so all checkers get /dev/null
237.18.1 by teddy at recompile
* mandos: Use os.devnull instead of os.path.devnull. Fix some white
2506
        null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
24.1.155 by Björn Påhlsson
mandos server: Added debuglevel that adjust at what level information
2507
        os.dup2(null, sys.stdin.fileno())
2508
        if null > 2:
2509
            os.close(null)
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2510
    
237.7.6 by teddy at bsnet
* mandos (main): Bug fix: Fork before connecting to D-Bus.
2511
    # Need to fork before connecting to D-Bus
237.7.154 by Teddy Hogeborn
* mandos: New "--foreground" option.
2512
    if not foreground:
237.7.6 by teddy at bsnet
* mandos (main): Bug fix: Fork before connecting to D-Bus.
2513
        # Close all input and output, do double fork, etc.
2514
        daemon()
237.2.53 by Teddy Hogeborn
* mandos (main): Bug fix: Do setgid before setuid. Add verbose GnuTLS
2515
    
237.7.138 by Teddy Hogeborn
* mandos: Change comment.
2516
    # multiprocessing will use threads, so before we use gobject we
2517
    # need to inform gobject that threads will be used.
237.14.11 by Teddy Hogeborn
* mandos (main): Tell gobject we're (or, rather, multiprocessing is)
2518
    gobject.threads_init()
2519
    
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
2520
    global main_loop
2521
    # From the Avahi example code
237.18.1 by teddy at recompile
* mandos: Use os.devnull instead of os.path.devnull. Fix some white
2522
    DBusGMainLoop(set_as_default=True)
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
2523
    main_loop = gobject.MainLoop()
2524
    bus = dbus.SystemBus()
2525
    # End of Avahi example code
237.2.6 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
2526
    if use_dbus:
237.2.165 by Teddy Hogeborn
* mandos (Client.disable): Rename keyword argument "log" to "quiet",
2527
        try:
237.7.53 by Björn Påhlsson
The domain name has changed, so the D-Bus bus and interface names must
2528
            bus_name = dbus.service.BusName("se.recompile.Mandos",
237.2.165 by Teddy Hogeborn
* mandos (Client.disable): Rename keyword argument "log" to "quiet",
2529
                                            bus, do_not_queue=True)
237.11.3 by Teddy Hogeborn
* mandos: Break long lines.
2530
            old_bus_name = (dbus.service.BusName
2531
                            ("se.bsnet.fukt.Mandos", bus,
2532
                             do_not_queue=True))
237.7.30 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
2533
        except dbus.exceptions.NameExistsException as e:
237.7.122 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
2534
            logger.error("Disabling D-Bus:", exc_info=e)
237.2.165 by Teddy Hogeborn
* mandos (Client.disable): Rename keyword argument "log" to "quiet",
2535
            use_dbus = False
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2536
            server_settings["use_dbus"] = False
237.2.165 by Teddy Hogeborn
* mandos (Client.disable): Rename keyword argument "log" to "quiet",
2537
            tcp_server.use_dbus = False
237.2.100 by Teddy Hogeborn
Code cleanup. Move some global stuff into main.
2538
    protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
237.11.20 by Teddy Hogeborn
* Makefile (run-server): Remove obsolete warning.
2539
    service = AvahiServiceToSyslog(name =
2540
                                   server_settings["servicename"],
2541
                                   servicetype = "_mandos._tcp",
2542
                                   protocol = protocol, bus = bus)
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2543
    if server_settings["interface"]:
237.2.100 by Teddy Hogeborn
Code cleanup. Move some global stuff into main.
2544
        service.interface = (if_nametoindex
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2545
                             (str(server_settings["interface"])))
237.7.6 by teddy at bsnet
* mandos (main): Bug fix: Fork before connecting to D-Bus.
2546
    
24.1.152 by Björn Påhlsson
bug fixes that prevent problems when runing server as root
2547
    global multiprocessing_manager
2548
    multiprocessing_manager = multiprocessing.Manager()
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
2549
    
237.2.91 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
2550
    client_class = Client
2551
    if use_dbus:
237.7.123 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
2552
        client_class = functools.partial(ClientDBus, bus = bus)
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
2553
    
237.12.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
2554
    client_settings = Client.config_parser(client_config)
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
2555
    old_client_settings = {}
237.12.15 by Björn Påhlsson
more refactoring in regards to how clients get created
2556
    clients_data = {}
237.12.6 by Teddy Hogeborn
* mandos: Fix whitespace.
2557
    
237.7.165 by Teddy Hogeborn
* mandos: Bug fix: Don't print output from checkers when running in
2558
    # This is used to redirect stdout and stderr for checker processes
2559
    global wnull
2560
    wnull = open(os.devnull, "w") # A writable /dev/null
2561
    # Only used if server is running in foreground but not in debug
2562
    # mode
2563
    if debug or not foreground:
2564
        wnull.close()
2565
    
237.12.7 by Teddy Hogeborn
* mandos: Break long lines and fix some more white space.
2566
    # Get client data and settings from last running state.
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
2567
    if server_settings["restore"]:
2568
        try:
2569
            with open(stored_state_path, "rb") as stored_state:
237.12.7 by Teddy Hogeborn
* mandos: Break long lines and fix some more white space.
2570
                clients_data, old_client_settings = (pickle.load
2571
                                                     (stored_state))
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
2572
            os.remove(stored_state_path)
2573
        except IOError as e:
237.7.122 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
2574
            if e.errno == errno.ENOENT:
2575
                logger.warning("Could not load persistent state: {0}"
2576
                                .format(os.strerror(e.errno)))
2577
            else:
2578
                logger.critical("Could not load persistent state:",
2579
                                exc_info=e)
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
2580
                raise
237.11.23 by Teddy Hogeborn
* mandos (main): Handle EOFError when reading state file.
2581
        except EOFError as e:
2582
            logger.warning("Could not load persistent state: "
237.7.122 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
2583
                           "EOFError:", exc_info=e)
237.12.6 by Teddy Hogeborn
* mandos: Fix whitespace.
2584
    
237.12.9 by Björn Påhlsson
renamed variables
2585
    with PGPEngine() as pgp:
237.12.15 by Björn Påhlsson
more refactoring in regards to how clients get created
2586
        for client_name, client in clients_data.iteritems():
237.7.165 by Teddy Hogeborn
* mandos: Bug fix: Don't print output from checkers when running in
2587
            # Skip removed clients
2588
            if client_name not in client_settings:
2589
                continue
2590
            
237.14.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
2591
            # Decide which value to use after restoring saved state.
2592
            # We have three different values: Old config file,
2593
            # new config file, and saved state.
2594
            # New config value takes precedence if it differs from old
2595
            # config value, otherwise use saved state.
2596
            for name, value in client_settings[client_name].items():
2597
                try:
2598
                    # For each value in new config, check if it
2599
                    # differs from the old config value (Except for
2600
                    # the "secret" attribute)
2601
                    if (name != "secret" and
2602
                        value != old_client_settings[client_name]
2603
                        [name]):
237.14.10 by Teddy Hogeborn
* mandos (main): Bug fix: Syntax fix when restoring settings.
2604
                        client[name] = value
237.14.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
2605
                except KeyError:
2606
                    pass
2607
            
2608
            # Clients who has passed its expire date can still be
237.12.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
2609
            # enabled if its last checker was successful.  Clients
237.7.100 by teddy at recompile
* mandos: Consistent terminology; use the term "secret" for the
2610
            # whose checker succeeded before we stored its state is
2611
            # assumed to have successfully run all checkers during
2612
            # downtime.
237.14.8 by Teddy Hogeborn
* mandos (ClientDBus.Host_dbus_property,
2613
            if client["enabled"]:
237.12.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
2614
                if datetime.datetime.utcnow() >= client["expires"]:
2615
                    if not client["last_checked_ok"]:
2616
                        logger.warning(
2617
                            "disabling client {0} - Client never "
237.7.100 by teddy at recompile
* mandos: Consistent terminology; use the term "secret" for the
2618
                            "performed a successful checker"
2619
                            .format(client_name))
237.12.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
2620
                        client["enabled"] = False
2621
                    elif client["last_checker_status"] != 0:
2622
                        logger.warning(
2623
                            "disabling client {0} - Client "
2624
                            "last checker failed with error code {1}"
237.7.100 by teddy at recompile
* mandos: Consistent terminology; use the term "secret" for the
2625
                            .format(client_name,
237.12.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
2626
                                    client["last_checker_status"]))
237.14.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
2627
                        client["enabled"] = False
2628
                    else:
2629
                        client["expires"] = (datetime.datetime
2630
                                             .utcnow()
2631
                                             + client["timeout"])
237.7.90 by Björn Påhlsson
fixed bug with bad stored config state for expires and last_checked_ok.
2632
                        logger.debug("Last checker succeeded,"
2633
                                     " keeping {0} enabled"
237.7.100 by teddy at recompile
* mandos: Consistent terminology; use the term "secret" for the
2634
                                     .format(client_name))
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2635
            try:
237.12.15 by Björn Påhlsson
more refactoring in regards to how clients get created
2636
                client["secret"] = (
2637
                    pgp.decrypt(client["encrypted_secret"],
237.12.9 by Björn Påhlsson
renamed variables
2638
                                client_settings[client_name]
2639
                                ["secret"]))
2640
            except PGPError:
237.14.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
2641
                # If decryption fails, we use secret from new settings
237.12.10 by Björn Påhlsson
added warning text when failing to decrypt old state
2642
                logger.debug("Failed to decrypt {0} old secret"
2643
                             .format(client_name))
237.12.15 by Björn Påhlsson
more refactoring in regards to how clients get created
2644
                client["secret"] = (
237.14.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
2645
                    client_settings[client_name]["secret"])
2646
    
237.12.15 by Björn Påhlsson
more refactoring in regards to how clients get created
2647
    # Add/remove clients based on new changes made to config
237.7.91 by Teddy Hogeborn
* mandos: Break some long lines.
2648
    for client_name in (set(old_client_settings)
2649
                        - set(client_settings)):
237.12.15 by Björn Påhlsson
more refactoring in regards to how clients get created
2650
        del clients_data[client_name]
237.7.91 by Teddy Hogeborn
* mandos: Break some long lines.
2651
    for client_name in (set(client_settings)
2652
                        - set(old_client_settings)):
237.12.15 by Björn Påhlsson
more refactoring in regards to how clients get created
2653
        clients_data[client_name] = client_settings[client_name]
237.7.121 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
2654
    
237.7.100 by teddy at recompile
* mandos: Consistent terminology; use the term "secret" for the
2655
    # Create all client objects
237.12.15 by Björn Påhlsson
more refactoring in regards to how clients get created
2656
    for client_name, client in clients_data.iteritems():
2657
        tcp_server.clients[client_name] = client_class(
237.7.165 by Teddy Hogeborn
* mandos: Bug fix: Don't print output from checkers when running in
2658
            name = client_name, settings = client,
2659
            server_settings = server_settings)
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2660
    
237.2.104 by Teddy Hogeborn
Code cleanup and one bug fix.
2661
    if not tcp_server.clients:
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2662
        logger.warning("No clients defined")
237.7.121 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
2663
    
237.7.154 by Teddy Hogeborn
* mandos: New "--foreground" option.
2664
    if not foreground:
2665
        if pidfile is not None:
2666
            try:
2667
                with pidfile:
2668
                    pid = os.getpid()
2669
                    pidfile.write(str(pid) + "\n".encode("utf-8"))
2670
            except IOError:
2671
                logger.error("Could not write to file %r with PID %d",
2672
                             pidfilename, pid)
2673
        del pidfile
237.2.202 by Teddy Hogeborn
* mandos: Do not write pid file if --debug is passed.
2674
        del pidfilename
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
2675
    
28 by Teddy Hogeborn
* server.conf: New file.
2676
    signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2677
    signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
2678
    
237.2.6 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
2679
    if use_dbus:
237.7.123 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
2680
        @alternate_dbus_interfaces({"se.recompile.Mandos":
2681
                                        "se.bsnet.fukt.Mandos"})
237.18.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
2682
        class MandosDBusService(DBusObjectWithProperties):
237.2.6 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
2683
            """A D-Bus proxy object"""
2684
            def __init__(self):
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2685
                dbus.service.Object.__init__(self, bus, "/")
237.11.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
2686
            _interface = "se.recompile.Mandos"
237.2.41 by Teddy Hogeborn
* mandos (Client.GetAllProperties): Also send Client.dbus_object_path
2687
            
237.18.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
2688
            @dbus_interface_annotations(_interface)
2689
            def _foo(self):
2690
                return { "org.freedesktop.DBus.Property"
2691
                         ".EmitsChangedSignal":
2692
                             "false"}
2693
            
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2694
            @dbus.service.signal(_interface, signature="o")
237.2.174 by Teddy Hogeborn
More consistent terminology: Clients are no longer "invalid" - they
2695
            def ClientAdded(self, objpath):
237.2.6 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
2696
                "D-Bus signal"
2697
                pass
237.2.41 by Teddy Hogeborn
* mandos (Client.GetAllProperties): Also send Client.dbus_object_path
2698
            
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2699
            @dbus.service.signal(_interface, signature="ss")
237.2.172 by Teddy Hogeborn
* mandos (MandosServer.handle_ipc): Better log message.
2700
            def ClientNotFound(self, fingerprint, address):
237.2.90 by Teddy Hogeborn
Merge from pipe IPC branch.
2701
                "D-Bus signal"
2702
                pass
2703
            
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2704
            @dbus.service.signal(_interface, signature="os")
237.2.41 by Teddy Hogeborn
* mandos (Client.GetAllProperties): Also send Client.dbus_object_path
2705
            def ClientRemoved(self, objpath, name):
237.2.6 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
2706
                "D-Bus signal"
2707
                pass
237.2.41 by Teddy Hogeborn
* mandos (Client.GetAllProperties): Also send Client.dbus_object_path
2708
            
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2709
            @dbus.service.method(_interface, out_signature="ao")
237.2.6 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
2710
            def GetAllClients(self):
237.2.46 by Teddy Hogeborn
* mandos (peer_certificate): Handle NULL pointer from
2711
                "D-Bus method"
237.2.104 by Teddy Hogeborn
Code cleanup and one bug fix.
2712
                return dbus.Array(c.dbus_object_path
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
2713
                                  for c in
2714
                                  tcp_server.clients.itervalues())
237.2.41 by Teddy Hogeborn
* mandos (Client.GetAllProperties): Also send Client.dbus_object_path
2715
            
237.2.96 by Teddy Hogeborn
Minor code cleanup; one minor bug fix.
2716
            @dbus.service.method(_interface,
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2717
                                 out_signature="a{oa{sv}}")
237.2.6 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
2718
            def GetAllClientsWithProperties(self):
237.2.46 by Teddy Hogeborn
* mandos (peer_certificate): Handle NULL pointer from
2719
                "D-Bus method"
237.2.6 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
2720
                return dbus.Dictionary(
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2721
                    ((c.dbus_object_path, c.GetAll(""))
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
2722
                     for c in tcp_server.clients.itervalues()),
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2723
                    signature="oa{sv}")
237.2.41 by Teddy Hogeborn
* mandos (Client.GetAllProperties): Also send Client.dbus_object_path
2724
            
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2725
            @dbus.service.method(_interface, in_signature="o")
237.2.6 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
2726
            def RemoveClient(self, object_path):
237.2.46 by Teddy Hogeborn
* mandos (peer_certificate): Handle NULL pointer from
2727
                "D-Bus method"
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
2728
                for c in tcp_server.clients.itervalues():
237.2.6 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
2729
                    if c.dbus_object_path == object_path:
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
2730
                        del tcp_server.clients[c.name]
237.2.91 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
2731
                        c.remove_from_connection()
237.2.6 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
2732
                        # Don't signal anything except ClientRemoved
237.2.165 by Teddy Hogeborn
* mandos (Client.disable): Rename keyword argument "log" to "quiet",
2733
                        c.disable(quiet=True)
237.2.6 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
2734
                        # Emit D-Bus signal
237.2.41 by Teddy Hogeborn
* mandos (Client.GetAllProperties): Also send Client.dbus_object_path
2735
                        self.ClientRemoved(object_path, c.name)
2736
                        return
237.2.163 by Teddy Hogeborn
* mandos (Client.enable): Bug fix: Start new immediate checker last to
2737
                raise KeyError(object_path)
237.2.41 by Teddy Hogeborn
* mandos (Client.GetAllProperties): Also send Client.dbus_object_path
2738
            
237.2.6 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
2739
            del _interface
237.2.41 by Teddy Hogeborn
* mandos (Client.GetAllProperties): Also send Client.dbus_object_path
2740
        
237.7.123 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
2741
        mandos_dbus_service = MandosDBusService()
237.2.1 by Teddy Hogeborn
First version of a somewhat complete D-Bus server interface. Also
2742
    
237.2.163 by Teddy Hogeborn
* mandos (Client.enable): Bug fix: Start new immediate checker last to
2743
    def cleanup():
2744
        "Cleanup function; run on exit"
2745
        service.cleanup()
2746
        
237.11.11 by Teddy Hogeborn
* mandos (Client.checked_ok): Set "expires" after setting timeout.
2747
        multiprocessing.active_children()
237.7.165 by Teddy Hogeborn
* mandos: Bug fix: Don't print output from checkers when running in
2748
        wnull.close()
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
2749
        if not (tcp_server.clients or client_settings):
2750
            return
237.12.6 by Teddy Hogeborn
* mandos: Fix whitespace.
2751
        
237.7.69 by teddy at bsnet
* debian/control (mandos/Depends): Added "python-crypto".
2752
        # Store client before exiting. Secrets are encrypted with key
2753
        # based on what config file has. If config file is
2754
        # removed/edited, old secret will thus be unrecovable.
237.12.15 by Björn Påhlsson
more refactoring in regards to how clients get created
2755
        clients = {}
237.12.9 by Björn Påhlsson
renamed variables
2756
        with PGPEngine() as pgp:
237.14.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
2757
            for client in tcp_server.clients.itervalues():
2758
                key = client_settings[client.name]["secret"]
237.12.9 by Björn Påhlsson
renamed variables
2759
                client.encrypted_secret = pgp.encrypt(client.secret,
2760
                                                      key)
237.14.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
2761
                client_dict = {}
2762
                
237.12.15 by Björn Påhlsson
more refactoring in regards to how clients get created
2763
                # A list of attributes that can not be pickled
2764
                # + secret.
237.12.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
2765
                exclude = set(("bus", "changedstate", "secret",
237.7.165 by Teddy Hogeborn
* mandos: Bug fix: Don't print output from checkers when running in
2766
                               "checker", "server_settings"))
237.14.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
2767
                for name, typ in (inspect.getmembers
2768
                                  (dbus.service.Object)):
2769
                    exclude.add(name)
2770
                
2771
                client_dict["encrypted_secret"] = (client
2772
                                                   .encrypted_secret)
2773
                for attr in client.client_structure:
2774
                    if attr not in exclude:
2775
                        client_dict[attr] = getattr(client, attr)
2776
                
237.12.15 by Björn Påhlsson
more refactoring in regards to how clients get created
2777
                clients[client.name] = client_dict
237.14.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
2778
                del client_settings[client.name]["secret"]
2779
        
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
2780
        try:
237.7.126 by Teddy Hogeborn
* mandos (main.cleanup): Use tempfile.NamedTemporaryFile() instead of
2781
            with (tempfile.NamedTemporaryFile
2782
                  (mode='wb', suffix=".pickle", prefix='clients-',
2783
                   dir=os.path.dirname(stored_state_path),
2784
                   delete=False)) as stored_state:
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
2785
                pickle.dump((clients, client_settings), stored_state)
237.7.126 by Teddy Hogeborn
* mandos (main.cleanup): Use tempfile.NamedTemporaryFile() instead of
2786
                tempname=stored_state.name
237.11.26 by teddy at bsnet
* mandos (main/cleanup): Write new file, then rename. Use
2787
            os.rename(tempname, stored_state_path)
237.14.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
2788
        except (IOError, OSError) as e:
237.7.78 by teddy at bsnet
* mandos (initlogger): Take new "debug" argument; all callers changed.
2789
            if not debug:
2790
                try:
2791
                    os.remove(tempname)
2792
                except NameError:
2793
                    pass
237.7.122 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
2794
            if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
2795
                logger.warning("Could not save persistent state: {0}"
2796
                               .format(os.strerror(e.errno)))
2797
            else:
2798
                logger.warning("Could not save persistent state:",
2799
                               exc_info=e)
237.7.190 by Teddy Hogeborn
Syntax fix; use "raise" better in Mandos server.
2800
                raise
237.12.6 by Teddy Hogeborn
* mandos: Fix whitespace.
2801
        
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
2802
        # Delete all clients, and settings from config
237.2.163 by Teddy Hogeborn
* mandos (Client.enable): Bug fix: Start new immediate checker last to
2803
        while tcp_server.clients:
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
2804
            name, client = tcp_server.clients.popitem()
237.2.165 by Teddy Hogeborn
* mandos (Client.disable): Rename keyword argument "log" to "quiet",
2805
            if use_dbus:
2806
                client.remove_from_connection()
237.2.163 by Teddy Hogeborn
* mandos (Client.enable): Bug fix: Start new immediate checker last to
2807
            # Don't signal anything except ClientRemoved
237.2.165 by Teddy Hogeborn
* mandos (Client.disable): Rename keyword argument "log" to "quiet",
2808
            client.disable(quiet=True)
237.2.163 by Teddy Hogeborn
* mandos (Client.enable): Bug fix: Start new immediate checker last to
2809
            if use_dbus:
2810
                # Emit D-Bus signal
237.11.3 by Teddy Hogeborn
* mandos: Break long lines.
2811
                mandos_dbus_service.ClientRemoved(client
2812
                                                  .dbus_object_path,
237.2.163 by Teddy Hogeborn
* mandos (Client.enable): Bug fix: Start new immediate checker last to
2813
                                                  client.name)
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
2814
        client_settings.clear()
237.2.163 by Teddy Hogeborn
* mandos (Client.enable): Bug fix: Start new immediate checker last to
2815
    
2816
    atexit.register(cleanup)
2817
    
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
2818
    for client in tcp_server.clients.itervalues():
237.2.6 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
2819
        if use_dbus:
2820
            # Emit D-Bus signal
237.2.174 by Teddy Hogeborn
More consistent terminology: Clients are no longer "invalid" - they
2821
            mandos_dbus_service.ClientAdded(client.dbus_object_path)
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
2822
        # Need to initiate checking of clients
2823
        if client.enabled:
2824
            client.init_checker()
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
2825
    
163 by Teddy Hogeborn
* Makefile (PIDDIR, USER, GROUP): Removed.
2826
    tcp_server.enable()
2827
    tcp_server.server_activate()
2828
    
28 by Teddy Hogeborn
* server.conf: New file.
2829
    # Find out what port we got
2830
    service.port = tcp_server.socket.getsockname()[1]
237.2.77 by Teddy Hogeborn
Support not using IPv6 in server:
2831
    if use_ipv6:
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2832
        logger.info("Now listening on address %r, port %d,"
237.7.116 by Teddy Hogeborn
* mandos-monitor: Use new string format method.
2833
                    " flowinfo %d, scope_id %d",
2834
                    *tcp_server.socket.getsockname())
237.2.77 by Teddy Hogeborn
Support not using IPv6 in server:
2835
    else:                       # IPv4
237.7.116 by Teddy Hogeborn
* mandos-monitor: Use new string format method.
2836
        logger.info("Now listening on address %r, port %d",
2837
                    *tcp_server.socket.getsockname())
28 by Teddy Hogeborn
* server.conf: New file.
2838
    
29 by Teddy Hogeborn
* plugins.d/mandosclient.c (start_mandos_communication): Changed
2839
    #service.interface = tcp_server.socket.getsockname()[3]
28 by Teddy Hogeborn
* server.conf: New file.
2840
    
2841
    try:
2842
        # From the Avahi example code
2843
        try:
237.2.99 by Teddy Hogeborn
Code cleanup.
2844
            service.activate()
237.7.30 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
2845
        except dbus.exceptions.DBusException as error:
237.7.113 by Teddy Hogeborn
* mandos (AvahiService.rename, Client.start_checker,
2846
            logger.critical("D-Bus Exception", exc_info=error)
237.2.164 by Teddy Hogeborn
* README (FAQ): Fix typo.
2847
            cleanup()
28 by Teddy Hogeborn
* server.conf: New file.
2848
            sys.exit(1)
2849
        # End of Avahi example code
2850
        
2851
        gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
2852
                             lambda *args, **kwargs:
237.1.2 by Teddy Hogeborn
Further steps towards a D-Bus server interface, plus minor syntax
2853
                             (tcp_server.handle_request
2854
                              (*args[2:], **kwargs) or True))
28 by Teddy Hogeborn
* server.conf: New file.
2855
        
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2856
        logger.debug("Starting main loop")
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
2857
        main_loop.run()
237.7.30 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
2858
    except AvahiError as error:
237.7.113 by Teddy Hogeborn
* mandos (AvahiService.rename, Client.start_checker,
2859
        logger.critical("Avahi Error", exc_info=error)
237.2.164 by Teddy Hogeborn
* README (FAQ): Fix typo.
2860
        cleanup()
28 by Teddy Hogeborn
* server.conf: New file.
2861
        sys.exit(1)
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
2862
    except KeyboardInterrupt:
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
2863
        if debug:
237.8.5 by teddy at bsnet
* mandos: Use unicode string literals.
2864
            print("", file=sys.stderr)
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2865
        logger.debug("Server received KeyboardInterrupt")
2866
    logger.debug("Server exiting")
237.2.164 by Teddy Hogeborn
* README (FAQ): Fix typo.
2867
    # Must run before the D-Bus bus name gets deregistered
2868
    cleanup()
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
2869
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2870
if __name__ == '__main__':
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
2871
    main()