/mandos/release

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/release
3 by Björn Påhlsson
Python based server
1
#!/usr/bin/python
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
2
# -*- mode: python; coding: utf-8 -*-
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
3
# 
4
# Mandos server - give out binary blobs to connecting clients.
5
# 
6
# This program is partly derived from an example program for an Avahi
7
# service publisher, downloaded from
8
# <http://avahi.org/wiki/PythonPublishExample>.  This includes the
237.2.99 by Teddy Hogeborn
Code cleanup.
9
# methods "add", "remove", "server_state_changed",
10
# "entry_group_state_changed", "cleanup", and "activate" in the
11
# "AvahiService" class, and some lines in "main".
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
12
# 
28 by Teddy Hogeborn
* server.conf: New file.
13
# Everything else is
237.7.197 by Teddy Hogeborn
Minor code fix; raise only exception instances, not classes.
14
# Copyright © 2008-2014 Teddy Hogeborn
15
# Copyright © 2008-2014 Björn Påhlsson
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
16
# 
17
# This program is free software: you can redistribute it and/or modify
18
# it under the terms of the GNU General Public License as published by
19
# the Free Software Foundation, either version 3 of the License, or
20
# (at your option) any later version.
21
#
22
#     This program is distributed in the hope that it will be useful,
23
#     but WITHOUT ANY WARRANTY; without even the implied warranty of
24
#     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
25
#     GNU General Public License for more details.
26
# 
27
# You should have received a copy of the GNU General Public License
109 by Teddy Hogeborn
* .bzrignore: New.
28
# along with this program.  If not, see
29
# <http://www.gnu.org/licenses/>.
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
30
# 
237.11.2 by Teddy Hogeborn
Change "fukt.bsnet.se" to "recompile.se" throughout.
31
# Contact the authors at <mandos@recompile.se>.
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
32
# 
3 by Björn Påhlsson
Python based server
33
237.8.5 by teddy at bsnet
* mandos: Use unicode string literals.
34
from __future__ import (division, absolute_import, print_function,
35
                        unicode_literals)
10 by Teddy Hogeborn
* server.py: Bug fix: Do "from __future__ import division".
36
237.7.127 by Teddy Hogeborn
* mandos: Use all new builtins.
37
from future_builtins import *
38
237.2.98 by Teddy Hogeborn
* mandos: Import "SocketServer" as "socketserver" and "ConfigParser"
39
import SocketServer as socketserver
3 by Björn Påhlsson
Python based server
40
import socket
237.7.22 by teddy at bsnet
* mandos: Use the new argparse library instead of optparse.
41
import argparse
3 by Björn Påhlsson
Python based server
42
import datetime
43
import errno
44
import gnutls.crypto
45
import gnutls.connection
46
import gnutls.errors
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
47
import gnutls.library.functions
48
import gnutls.library.constants
49
import gnutls.library.types
237.2.98 by Teddy Hogeborn
* mandos: Import "SocketServer" as "socketserver" and "ConfigParser"
50
import ConfigParser as configparser
4 by Teddy Hogeborn
* server.py (Client.created, Client.next_check): New.
51
import sys
9 by Teddy Hogeborn
* client.cpp (main): Get t_old early since it is used on error exits.
52
import re
53
import os
54
import signal
10 by Teddy Hogeborn
* server.py: Bug fix: Do "from __future__ import division".
55
import subprocess
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
56
import atexit
57
import stat
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
58
import logging
59
import logging.handlers
163 by Teddy Hogeborn
* Makefile (PIDDIR, USER, GROUP): Removed.
60
import pwd
237.2.174 by Teddy Hogeborn
More consistent terminology: Clients are no longer "invalid" - they
61
import contextlib
237.2.96 by Teddy Hogeborn
Minor code cleanup; one minor bug fix.
62
import struct
63
import fcntl
237.2.100 by Teddy Hogeborn
Code cleanup. Move some global stuff into main.
64
import functools
237.2.174 by Teddy Hogeborn
More consistent terminology: Clients are no longer "invalid" - they
65
import cPickle as pickle
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
66
import multiprocessing
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
67
import types
237.14.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
68
import binascii
69
import tempfile
237.18.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
70
import itertools
237.7.157 by Teddy Hogeborn
* clients.conf: Convert all time intervals to new RFC 3339 syntax.
71
import collections
5 by Teddy Hogeborn
* server.py (server_metaclass): New.
72
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
73
import dbus
237.1.1 by Teddy Hogeborn
First steps of a D-Bus interface to the server.
74
import dbus.service
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
75
import gobject
76
import avahi
77
from dbus.mainloop.glib import DBusGMainLoop
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
78
import ctypes
215 by Teddy Hogeborn
* mandos: Remove unused "select" module. Import "ctypes.util".
79
import ctypes.util
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
80
import xml.dom.minidom
81
import inspect
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
82
237.2.94 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
83
try:
84
    SO_BINDTODEVICE = socket.SO_BINDTODEVICE
85
except AttributeError:
86
    try:
87
        from IN import SO_BINDTODEVICE
88
    except ImportError:
237.2.101 by Teddy Hogeborn
* mandos: Minor doc string fixes.
89
        SO_BINDTODEVICE = None
237.2.94 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
90
312 by Teddy Hogeborn
* Makefile (version): Changed to "1.6.5".
91
version = "1.6.5"
237.14.2 by Teddy Hogeborn
Directory with persistent state can now be changed with the "statedir"
92
stored_state_file = "clients.pickle"
13 by Björn Påhlsson
Added following support:
93
237.11.20 by Teddy Hogeborn
* Makefile (run-server): Remove obsolete warning.
94
logger = logging.getLogger()
237.7.203 by Teddy Hogeborn
Allow self-tests to run without needing /dev/log.
95
syslogger = None
13 by Björn Påhlsson
Added following support:
96
237.12.5 by Björn Påhlsson
First run of python-lint. Fixed some *obviously* bad code and turned
97
try:
98
    if_nametoindex = (ctypes.cdll.LoadLibrary
99
                      (ctypes.util.find_library("c"))
100
                      .if_nametoindex)
101
except (OSError, AttributeError):
102
    def if_nametoindex(interface):
103
        "Get an interface index the hard way, i.e. using fcntl()"
104
        SIOCGIFINDEX = 0x8933  # From /usr/include/linux/sockios.h
105
        with contextlib.closing(socket.socket()) as s:
106
            ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
107
                                struct.pack(str("16s16x"),
108
                                            interface))
109
        interface_index = struct.unpack(str("I"),
110
                                        ifreq[16:20])[0]
111
        return interface_index
112
113
237.7.78 by teddy at bsnet
* mandos (initlogger): Take new "debug" argument; all callers changed.
114
def initlogger(debug, level=logging.WARNING):
237.12.4 by Björn Påhlsson
restructured logger
115
    """init logger and add loglevel"""
116
    
237.7.203 by Teddy Hogeborn
Allow self-tests to run without needing /dev/log.
117
    syslogger = (logging.handlers.SysLogHandler
118
                 (facility =
119
                  logging.handlers.SysLogHandler.LOG_DAEMON,
120
                  address = str("/dev/log")))
237.12.4 by Björn Påhlsson
restructured logger
121
    syslogger.setFormatter(logging.Formatter
122
                           ('Mandos [%(process)d]: %(levelname)s:'
123
                            ' %(message)s'))
124
    logger.addHandler(syslogger)
125
    
237.7.78 by teddy at bsnet
* mandos (initlogger): Take new "debug" argument; all callers changed.
126
    if debug:
127
        console = logging.StreamHandler()
128
        console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
129
                                               ' [%(process)d]:'
130
                                               ' %(levelname)s:'
131
                                               ' %(message)s'))
132
        logger.addHandler(console)
237.12.4 by Björn Påhlsson
restructured logger
133
    logger.setLevel(level)
28 by Teddy Hogeborn
* server.conf: New file.
134
237.11.20 by Teddy Hogeborn
* Makefile (run-server): Remove obsolete warning.
135
237.12.9 by Björn Påhlsson
renamed variables
136
class PGPError(Exception):
137
    """Exception if encryption/decryption fails"""
237.14.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
138
    pass
139
140
237.12.9 by Björn Påhlsson
renamed variables
141
class PGPEngine(object):
237.14.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
142
    """A simple class for OpenPGP symmetric encryption & decryption"""
143
    def __init__(self):
144
        self.tempdir = tempfile.mkdtemp(prefix="mandos-")
237.7.163 by Teddy Hogeborn
* mandos: Don't use the GnuPGInterface module.
145
        self.gnupgargs = ['--batch',
146
                          '--home', self.tempdir,
147
                          '--force-mdc',
148
                          '--quiet',
149
                          '--no-use-agent']
237.14.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
150
    
151
    def __enter__(self):
152
        return self
153
    
237.7.135 by Teddy Hogeborn
* Makefile (DOCBOOKTOMAN): Only run man --warnings if both "man" and
154
    def __exit__(self, exc_type, exc_value, traceback):
237.14.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
155
        self._cleanup()
156
        return False
157
    
158
    def __del__(self):
159
        self._cleanup()
160
    
161
    def _cleanup(self):
162
        if self.tempdir is not None:
163
            # Delete contents of tempdir
164
            for root, dirs, files in os.walk(self.tempdir,
165
                                             topdown = False):
166
                for filename in files:
167
                    os.remove(os.path.join(root, filename))
168
                for dirname in dirs:
169
                    os.rmdir(os.path.join(root, dirname))
170
            # Remove tempdir
171
            os.rmdir(self.tempdir)
172
            self.tempdir = None
173
    
174
    def password_encode(self, password):
175
        # Passphrase can not be empty and can not contain newlines or
176
        # NUL bytes.  So we prefix it and hex encode it.
237.7.178 by Teddy Hogeborn
* mandos (PGPEngine.password_encode): Bug fix: GnuPG can't handle
177
        encoded = b"mandos" + binascii.hexlify(password)
178
        if len(encoded) > 2048:
179
            # GnuPG can't handle long passwords, so encode differently
180
            encoded = (b"mandos" + password.replace(b"\\", b"\\\\")
181
                       .replace(b"\n", b"\\n")
182
                       .replace(b"\0", b"\\x00"))
183
        return encoded
237.14.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
184
    
185
    def encrypt(self, data, password):
237.7.163 by Teddy Hogeborn
* mandos: Don't use the GnuPGInterface module.
186
        passphrase = self.password_encode(password)
187
        with tempfile.NamedTemporaryFile(dir=self.tempdir
188
                                         ) as passfile:
189
            passfile.write(passphrase)
190
            passfile.flush()
191
            proc = subprocess.Popen(['gpg', '--symmetric',
192
                                     '--passphrase-file',
193
                                     passfile.name]
194
                                    + self.gnupgargs,
195
                                    stdin = subprocess.PIPE,
196
                                    stdout = subprocess.PIPE,
197
                                    stderr = subprocess.PIPE)
198
            ciphertext, err = proc.communicate(input = data)
199
        if proc.returncode != 0:
200
            raise PGPError(err)
237.14.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
201
        return ciphertext
202
    
203
    def decrypt(self, data, password):
237.7.163 by Teddy Hogeborn
* mandos: Don't use the GnuPGInterface module.
204
        passphrase = self.password_encode(password)
205
        with tempfile.NamedTemporaryFile(dir = self.tempdir
206
                                         ) as passfile:
207
            passfile.write(passphrase)
208
            passfile.flush()
209
            proc = subprocess.Popen(['gpg', '--decrypt',
210
                                     '--passphrase-file',
211
                                     passfile.name]
212
                                    + self.gnupgargs,
213
                                    stdin = subprocess.PIPE,
214
                                    stdout = subprocess.PIPE,
215
                                    stderr = subprocess.PIPE)
216
            decrypted_plaintext, err = proc.communicate(input
217
                                                        = data)
218
        if proc.returncode != 0:
219
            raise PGPError(err)
237.14.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
220
        return decrypted_plaintext
221
222
28 by Teddy Hogeborn
* server.conf: New file.
223
class AvahiError(Exception):
237.2.5 by Teddy Hogeborn
* mandos (AvahiError): Converted to use unicode. All users changed.
224
    def __init__(self, value, *args, **kwargs):
28 by Teddy Hogeborn
* server.conf: New file.
225
        self.value = value
237.2.5 by Teddy Hogeborn
* mandos (AvahiError): Converted to use unicode. All users changed.
226
        super(AvahiError, self).__init__(value, *args, **kwargs)
227
    def __unicode__(self):
228
        return unicode(repr(self.value))
28 by Teddy Hogeborn
* server.conf: New file.
229
230
class AvahiServiceError(AvahiError):
231
    pass
232
233
class AvahiGroupError(AvahiError):
234
    pass
235
236
237
class AvahiService(object):
45 by Teddy Hogeborn
* server.py: Cosmetic changes.
238
    """An Avahi (Zeroconf) service.
237.2.94 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
239
    
45 by Teddy Hogeborn
* server.py: Cosmetic changes.
240
    Attributes:
28 by Teddy Hogeborn
* server.conf: New file.
241
    interface: integer; avahi.IF_UNSPEC or an interface index.
242
               Used to optionally bind to the specified interface.
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
243
    name: string; Example: 'Mandos'
244
    type: string; Example: '_mandos._tcp'.
237.7.162 by Teddy Hogeborn
* mandos: Comment changes.
245
     See <https://www.iana.org/assignments/service-names-port-numbers>
45 by Teddy Hogeborn
* server.py: Cosmetic changes.
246
    port: integer; what port to announce
247
    TXT: list of strings; TXT record for the service
248
    domain: string; Domain to publish on, default to .local if empty.
249
    host: string; Host to publish records for, default is localhost
250
    max_renames: integer; maximum number of renames
251
    rename_count: integer; counter so we only rename after collisions
252
                  a sensible number of times
237.2.99 by Teddy Hogeborn
Code cleanup.
253
    group: D-Bus Entry Group
254
    server: D-Bus Server
237.2.101 by Teddy Hogeborn
* mandos: Minor doc string fixes.
255
    bus: dbus.SystemBus()
28 by Teddy Hogeborn
* server.conf: New file.
256
    """
237.7.121 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
257
    
28 by Teddy Hogeborn
* server.conf: New file.
258
    def __init__(self, interface = avahi.IF_UNSPEC, name = None,
237.1.2 by Teddy Hogeborn
Further steps towards a D-Bus server interface, plus minor syntax
259
                 servicetype = None, port = None, TXT = None,
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
260
                 domain = "", host = "", max_renames = 32768,
237.2.100 by Teddy Hogeborn
Code cleanup. Move some global stuff into main.
261
                 protocol = avahi.PROTO_UNSPEC, bus = None):
28 by Teddy Hogeborn
* server.conf: New file.
262
        self.interface = interface
263
        self.name = name
215 by Teddy Hogeborn
* mandos: Remove unused "select" module. Import "ctypes.util".
264
        self.type = servicetype
28 by Teddy Hogeborn
* server.conf: New file.
265
        self.port = port
237.1.2 by Teddy Hogeborn
Further steps towards a D-Bus server interface, plus minor syntax
266
        self.TXT = TXT if TXT is not None else []
28 by Teddy Hogeborn
* server.conf: New file.
267
        self.domain = domain
268
        self.host = host
269
        self.rename_count = 0
76 by Teddy Hogeborn
* plugins.d/password-request.c (init_gnutls_global): Renamed
270
        self.max_renames = max_renames
237.2.77 by Teddy Hogeborn
Support not using IPv6 in server:
271
        self.protocol = protocol
237.2.99 by Teddy Hogeborn
Code cleanup.
272
        self.group = None       # our entry group
273
        self.server = None
237.2.100 by Teddy Hogeborn
Code cleanup. Move some global stuff into main.
274
        self.bus = bus
237.7.30 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
275
        self.entry_group_state_changed_match = None
237.7.121 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
276
    
28 by Teddy Hogeborn
* server.conf: New file.
277
    def rename(self):
278
        """Derived from the Avahi example code"""
279
        if self.rename_count >= self.max_renames:
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
280
            logger.critical("No suitable Zeroconf service name found"
281
                            " after %i retries, exiting.",
215 by Teddy Hogeborn
* mandos: Remove unused "select" module. Import "ctypes.util".
282
                            self.rename_count)
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
283
            raise AvahiServiceError("Too many renames")
237.11.3 by Teddy Hogeborn
* mandos: Break long lines.
284
        self.name = unicode(self.server
285
                            .GetAlternativeServiceName(self.name))
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
286
        logger.info("Changing Zeroconf service name to %r ...",
24.1.155 by Björn Påhlsson
mandos server: Added debuglevel that adjust at what level information
287
                    self.name)
28 by Teddy Hogeborn
* server.conf: New file.
288
        self.remove()
24.1.160 by Björn Påhlsson
fixed bug with local name collisions after a non-local name collision
289
        try:
290
            self.add()
237.7.30 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
291
        except dbus.exceptions.DBusException as error:
237.7.113 by Teddy Hogeborn
* mandos (AvahiService.rename, Client.start_checker,
292
            logger.critical("D-Bus Exception", exc_info=error)
24.1.160 by Björn Påhlsson
fixed bug with local name collisions after a non-local name collision
293
            self.cleanup()
294
            os._exit(1)
28 by Teddy Hogeborn
* server.conf: New file.
295
        self.rename_count += 1
237.7.121 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
296
    
28 by Teddy Hogeborn
* server.conf: New file.
297
    def remove(self):
298
        """Derived from the Avahi example code"""
237.7.30 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
299
        if self.entry_group_state_changed_match is not None:
300
            self.entry_group_state_changed_match.remove()
301
            self.entry_group_state_changed_match = None
237.7.31 by Teddy Hogeborn
* mandos: Never call .Reset() on a defunct Avahi entry group.
302
        if self.group is not None:
303
            self.group.Reset()
237.7.121 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
304
    
28 by Teddy Hogeborn
* server.conf: New file.
305
    def add(self):
306
        """Derived from the Avahi example code"""
237.7.30 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
307
        self.remove()
237.7.31 by Teddy Hogeborn
* mandos: Never call .Reset() on a defunct Avahi entry group.
308
        if self.group is None:
309
            self.group = dbus.Interface(
310
                self.bus.get_object(avahi.DBUS_NAME,
311
                                    self.server.EntryGroupNew()),
312
                avahi.DBUS_INTERFACE_ENTRY_GROUP)
237.7.30 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
313
        self.entry_group_state_changed_match = (
314
            self.group.connect_to_signal(
237.11.20 by Teddy Hogeborn
* Makefile (run-server): Remove obsolete warning.
315
                'StateChanged', self.entry_group_state_changed))
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
316
        logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
237.2.99 by Teddy Hogeborn
Code cleanup.
317
                     self.name, self.type)
318
        self.group.AddService(
319
            self.interface,
320
            self.protocol,
321
            dbus.UInt32(0),     # flags
322
            self.name, self.type,
323
            self.domain, self.host,
324
            dbus.UInt16(self.port),
325
            avahi.string_array_to_txt_array(self.TXT))
326
        self.group.Commit()
237.7.121 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
327
    
237.2.99 by Teddy Hogeborn
Code cleanup.
328
    def entry_group_state_changed(self, state, error):
329
        """Derived from the Avahi example code"""
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
330
        logger.debug("Avahi entry group state change: %i", state)
237.2.99 by Teddy Hogeborn
Code cleanup.
331
        
332
        if state == avahi.ENTRY_GROUP_ESTABLISHED:
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
333
            logger.debug("Zeroconf service established.")
237.2.99 by Teddy Hogeborn
Code cleanup.
334
        elif state == avahi.ENTRY_GROUP_COLLISION:
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
335
            logger.info("Zeroconf service name collision.")
237.2.99 by Teddy Hogeborn
Code cleanup.
336
            self.rename()
337
        elif state == avahi.ENTRY_GROUP_FAILURE:
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
338
            logger.critical("Avahi: Error in group state changed %s",
237.2.99 by Teddy Hogeborn
Code cleanup.
339
                            unicode(error))
237.7.116 by Teddy Hogeborn
* mandos-monitor: Use new string format method.
340
            raise AvahiGroupError("State changed: {0!s}"
341
                                  .format(error))
237.7.121 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
342
    
237.2.99 by Teddy Hogeborn
Code cleanup.
343
    def cleanup(self):
344
        """Derived from the Avahi example code"""
237.7.31 by Teddy Hogeborn
* mandos: Never call .Reset() on a defunct Avahi entry group.
345
        if self.group is not None:
346
            try:
347
                self.group.Free()
348
            except (dbus.exceptions.UnknownMethodException,
237.12.5 by Björn Påhlsson
First run of python-lint. Fixed some *obviously* bad code and turned
349
                    dbus.exceptions.DBusException):
237.7.31 by Teddy Hogeborn
* mandos: Never call .Reset() on a defunct Avahi entry group.
350
                pass
351
            self.group = None
237.7.30 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
352
        self.remove()
237.7.121 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
353
    
237.7.30 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
354
    def server_state_changed(self, state, error=None):
237.2.99 by Teddy Hogeborn
Code cleanup.
355
        """Derived from the Avahi example code"""
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
356
        logger.debug("Avahi server state change: %i", state)
237.7.30 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
357
        bad_states = { avahi.SERVER_INVALID:
358
                           "Zeroconf server invalid",
359
                       avahi.SERVER_REGISTERING: None,
360
                       avahi.SERVER_COLLISION:
361
                           "Zeroconf server name collision",
362
                       avahi.SERVER_FAILURE:
363
                           "Zeroconf server failure" }
364
        if state in bad_states:
237.7.31 by Teddy Hogeborn
* mandos: Never call .Reset() on a defunct Avahi entry group.
365
            if bad_states[state] is not None:
366
                if error is None:
367
                    logger.error(bad_states[state])
368
                else:
369
                    logger.error(bad_states[state] + ": %r", error)
370
            self.cleanup()
237.2.99 by Teddy Hogeborn
Code cleanup.
371
        elif state == avahi.SERVER_RUNNING:
372
            self.add()
237.7.30 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
373
        else:
237.7.31 by Teddy Hogeborn
* mandos: Never call .Reset() on a defunct Avahi entry group.
374
            if error is None:
375
                logger.debug("Unknown state: %r", state)
376
            else:
377
                logger.debug("Unknown state: %r: %r", state, error)
237.7.121 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
378
    
237.2.99 by Teddy Hogeborn
Code cleanup.
379
    def activate(self):
380
        """Derived from the Avahi example code"""
381
        if self.server is None:
382
            self.server = dbus.Interface(
237.2.100 by Teddy Hogeborn
Code cleanup. Move some global stuff into main.
383
                self.bus.get_object(avahi.DBUS_NAME,
237.7.30 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
384
                                    avahi.DBUS_PATH_SERVER,
385
                                    follow_name_owner_changes=True),
237.2.99 by Teddy Hogeborn
Code cleanup.
386
                avahi.DBUS_INTERFACE_SERVER)
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
387
        self.server.connect_to_signal("StateChanged",
237.2.99 by Teddy Hogeborn
Code cleanup.
388
                                 self.server_state_changed)
389
        self.server_state_changed(self.server.GetState())
237.2.1 by Teddy Hogeborn
First version of a somewhat complete D-Bus server interface. Also
390
237.7.130 by Teddy Hogeborn
* mandos (IPv6_TCPServer.server_bind): Bug fix: handle non-existing
391
237.11.20 by Teddy Hogeborn
* Makefile (run-server): Remove obsolete warning.
392
class AvahiServiceToSyslog(AvahiService):
393
    def rename(self):
394
        """Add the new name to the syslog messages"""
395
        ret = AvahiService.rename(self)
396
        syslogger.setFormatter(logging.Formatter
237.7.116 by Teddy Hogeborn
* mandos-monitor: Use new string format method.
397
                               ('Mandos ({0}) [%(process)d]:'
398
                                ' %(levelname)s: %(message)s'
399
                                .format(self.name)))
237.11.20 by Teddy Hogeborn
* Makefile (run-server): Remove obsolete warning.
400
        return ret
237.2.1 by Teddy Hogeborn
First version of a somewhat complete D-Bus server interface. Also
401
237.7.130 by Teddy Hogeborn
* mandos (IPv6_TCPServer.server_bind): Bug fix: handle non-existing
402
237.14.4 by Teddy Hogeborn
* mandos (_timedelta_to_milliseconds): Renamed to
403
def timedelta_to_milliseconds(td):
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
404
    "Convert a datetime.timedelta() to milliseconds"
405
    return ((td.days * 24 * 60 * 60 * 1000)
406
            + (td.seconds * 1000)
407
            + (td.microseconds // 1000))
237.7.121 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
408
237.7.130 by Teddy Hogeborn
* mandos (IPv6_TCPServer.server_bind): Bug fix: handle non-existing
409
237.2.91 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
410
class Client(object):
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
411
    """A representation of a client host served by this server.
237.2.94 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
412
    
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
413
    Attributes:
237.14.4 by Teddy Hogeborn
* mandos (_timedelta_to_milliseconds): Renamed to
414
    approved:   bool(); 'None' if not yet approved/disapproved
237.2.201 by Teddy Hogeborn
* mandos (Client.runtime_expansions): New attribute containing the
415
    approval_delay: datetime.timedelta(); Time to wait for approval
416
    approval_duration: datetime.timedelta(); Duration of one approval
237.2.1 by Teddy Hogeborn
First version of a somewhat complete D-Bus server interface. Also
417
    checker:    subprocess.Popen(); a running checker process used
418
                                    to see if the client lives.
419
                                    'None' if no process is running.
237.2.205 by Teddy Hogeborn
* DBUS-API: Document new "LastApprovalRequest" client property.
420
    checker_callback_tag: a gobject event source tag, or None
237.2.201 by Teddy Hogeborn
* mandos (Client.runtime_expansions): New attribute containing the
421
    checker_command: string; External command which is run to check
422
                     if client lives.  %() expansions are done at
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
423
                     runtime with vars(self) as dict, so that for
424
                     instance %(name)s can be used in the command.
237.2.201 by Teddy Hogeborn
* mandos (Client.runtime_expansions): New attribute containing the
425
    checker_initiator_tag: a gobject event source tag, or None
426
    created:    datetime.datetime(); (UTC) object creation
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
427
    client_structure: Object describing what attributes a client has
428
                      and is used for storing the client at exit
237.2.78 by Teddy Hogeborn
* mandos (Client.current_checker_command): New attribute.
429
    current_checker_command: string; current running checker_command
237.2.205 by Teddy Hogeborn
* DBUS-API: Document new "LastApprovalRequest" client property.
430
    disable_initiator_tag: a gobject event source tag, or None
237.2.201 by Teddy Hogeborn
* mandos (Client.runtime_expansions): New attribute containing the
431
    enabled:    bool()
432
    fingerprint: string (40 or 32 hexadecimal digits); used to
433
                 uniquely identify the client
434
    host:       string; available for use by the checker command
435
    interval:   datetime.timedelta(); How often to start a new checker
237.2.205 by Teddy Hogeborn
* DBUS-API: Document new "LastApprovalRequest" client property.
436
    last_approval_request: datetime.datetime(); (UTC) or None
237.2.201 by Teddy Hogeborn
* mandos (Client.runtime_expansions): New attribute containing the
437
    last_checked_ok: datetime.datetime(); (UTC) or None
237.7.69 by teddy at bsnet
* debian/control (mandos/Depends): Added "python-crypto".
438
    last_checker_status: integer between 0 and 255 reflecting exit
237.12.7 by Teddy Hogeborn
* mandos: Break long lines and fix some more white space.
439
                         status of last checker. -1 reflects crashed
237.7.104 by Teddy Hogeborn
* DBUS-API (se.recompile.Mandos.Client.LastCheckerStatus): New
440
                         checker, -2 means no checker completed yet.
237.14.3 by Teddy Hogeborn
Make "enabled" a client config option.
441
    last_enabled: datetime.datetime(); (UTC) or None
237.2.201 by Teddy Hogeborn
* mandos (Client.runtime_expansions): New attribute containing the
442
    name:       string; from the config file, used in log messages and
443
                        D-Bus identifiers
444
    secret:     bytestring; sent verbatim (over TLS) to client
445
    timeout:    datetime.timedelta(); How long from last_checked_ok
446
                                      until this client is disabled
237.7.100 by teddy at recompile
* mandos: Consistent terminology; use the term "secret" for the
447
    extended_timeout:   extra long timeout when secret has been sent
237.2.201 by Teddy Hogeborn
* mandos (Client.runtime_expansions): New attribute containing the
448
    runtime_expansions: Allowed attributes for runtime expansion.
237.7.45 by Teddy Hogeborn
* DBUS-API: Document new "Expires" and "ExtendedTimeout" properties.
449
    expires:    datetime.datetime(); time (UTC) when a client will be
24.1.179 by Björn Påhlsson
New feature:
450
                disabled, or None
237.7.165 by Teddy Hogeborn
* mandos: Bug fix: Don't print output from checkers when running in
451
    server_settings: The server_settings dict from main()
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
452
    """
237.2.96 by Teddy Hogeborn
Minor code cleanup; one minor bug fix.
453
    
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
454
    runtime_expansions = ("approval_delay", "approval_duration",
237.7.132 by Teddy Hogeborn
* mandos (Client.runtime_expansions): Add "expires" and (bug fix)
455
                          "created", "enabled", "expires",
456
                          "fingerprint", "host", "interval",
457
                          "last_approval_request", "last_checked_ok",
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
458
                          "last_enabled", "name", "timeout")
237.7.157 by Teddy Hogeborn
* clients.conf: Convert all time intervals to new RFC 3339 syntax.
459
    client_defaults = { "timeout": "PT5M",
460
                        "extended_timeout": "PT15M",
461
                        "interval": "PT2M",
237.12.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
462
                        "checker": "fping -q -- %%(host)s",
463
                        "host": "",
237.7.157 by Teddy Hogeborn
* clients.conf: Convert all time intervals to new RFC 3339 syntax.
464
                        "approval_delay": "PT0S",
465
                        "approval_duration": "PT1S",
237.12.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
466
                        "approved_by_default": "True",
467
                        "enabled": "True",
468
                        }
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
469
    
237.2.6 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
470
    def timeout_milliseconds(self):
471
        "Return the 'timeout' attribute in milliseconds"
237.14.4 by Teddy Hogeborn
* mandos (_timedelta_to_milliseconds): Renamed to
472
        return timedelta_to_milliseconds(self.timeout)
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
473
    
24.1.179 by Björn Påhlsson
New feature:
474
    def extended_timeout_milliseconds(self):
475
        "Return the 'extended_timeout' attribute in milliseconds"
237.14.4 by Teddy Hogeborn
* mandos (_timedelta_to_milliseconds): Renamed to
476
        return timedelta_to_milliseconds(self.extended_timeout)
237.2.6 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
477
    
478
    def interval_milliseconds(self):
479
        "Return the 'interval' attribute in milliseconds"
237.14.4 by Teddy Hogeborn
* mandos (_timedelta_to_milliseconds): Renamed to
480
        return timedelta_to_milliseconds(self.interval)
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
481
    
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
482
    def approval_delay_milliseconds(self):
237.14.4 by Teddy Hogeborn
* mandos (_timedelta_to_milliseconds): Renamed to
483
        return timedelta_to_milliseconds(self.approval_delay)
237.7.121 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
484
    
237.12.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
485
    @staticmethod
486
    def config_parser(config):
237.7.90 by Björn Påhlsson
fixed bug with bad stored config state for expires and last_checked_ok.
487
        """Construct a new dict of client settings of this form:
237.12.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
488
        { client_name: {setting_name: value, ...}, ...}
237.7.90 by Björn Påhlsson
fixed bug with bad stored config state for expires and last_checked_ok.
489
        with exceptions for any special settings as defined above.
490
        NOTE: Must be a pure function. Must return the same result
491
        value given the same arguments.
492
        """
237.12.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
493
        settings = {}
494
        for client_name in config.sections():
495
            section = dict(config.items(client_name))
496
            client = settings[client_name] = {}
497
            
237.12.15 by Björn Påhlsson
more refactoring in regards to how clients get created
498
            client["host"] = section["host"]
237.12.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
499
            # Reformat values from string types to Python types
500
            client["approved_by_default"] = config.getboolean(
501
                client_name, "approved_by_default")
237.7.91 by Teddy Hogeborn
* mandos: Break some long lines.
502
            client["enabled"] = config.getboolean(client_name,
503
                                                  "enabled")
237.12.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
504
            
505
            client["fingerprint"] = (section["fingerprint"].upper()
506
                                     .replace(" ", ""))
507
            if "secret" in section:
508
                client["secret"] = section["secret"].decode("base64")
509
            elif "secfile" in section:
510
                with open(os.path.expanduser(os.path.expandvars
511
                                             (section["secfile"])),
512
                          "rb") as secfile:
513
                    client["secret"] = secfile.read()
514
            else:
237.7.116 by Teddy Hogeborn
* mandos-monitor: Use new string format method.
515
                raise TypeError("No secret or secfile for section {0}"
516
                                .format(section))
237.12.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
517
            client["timeout"] = string_to_delta(section["timeout"])
518
            client["extended_timeout"] = string_to_delta(
519
                section["extended_timeout"])
520
            client["interval"] = string_to_delta(section["interval"])
521
            client["approval_delay"] = string_to_delta(
522
                section["approval_delay"])
523
            client["approval_duration"] = string_to_delta(
524
                section["approval_duration"])
237.12.15 by Björn Påhlsson
more refactoring in regards to how clients get created
525
            client["checker_command"] = section["checker"]
526
            client["last_approval_request"] = None
527
            client["last_checked_ok"] = None
237.7.104 by Teddy Hogeborn
* DBUS-API (se.recompile.Mandos.Client.LastCheckerStatus): New
528
            client["last_checker_status"] = -2
237.7.90 by Björn Påhlsson
fixed bug with bad stored config state for expires and last_checked_ok.
529
        
237.12.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
530
        return settings
237.7.121 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
531
    
237.7.165 by Teddy Hogeborn
* mandos: Bug fix: Don't print output from checkers when running in
532
    def __init__(self, settings, name = None, server_settings=None):
237.2.6 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
533
        self.name = name
237.7.165 by Teddy Hogeborn
* mandos: Bug fix: Don't print output from checkers when running in
534
        if server_settings is None:
535
            server_settings = {}
536
        self.server_settings = server_settings
237.12.15 by Björn Påhlsson
more refactoring in regards to how clients get created
537
        # adding all client settings
538
        for setting, value in settings.iteritems():
539
            setattr(self, setting, value)
540
        
237.7.90 by Björn Påhlsson
fixed bug with bad stored config state for expires and last_checked_ok.
541
        if self.enabled:
542
            if not hasattr(self, "last_enabled"):
543
                self.last_enabled = datetime.datetime.utcnow()
544
            if not hasattr(self, "expires"):
545
                self.expires = (datetime.datetime.utcnow()
546
                                + self.timeout)
547
        else:
548
            self.last_enabled = None
549
            self.expires = None
237.7.121 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
550
        
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
551
        logger.debug("Creating client %r", self.name)
45 by Teddy Hogeborn
* server.py: Cosmetic changes.
552
        # Uppercase and remove spaces from fingerprint for later
553
        # comparison purposes with return value from the fingerprint()
554
        # function
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
555
        logger.debug("  Fingerprint: %s", self.fingerprint)
237.7.91 by Teddy Hogeborn
* mandos: Break some long lines.
556
        self.created = settings.get("created",
557
                                    datetime.datetime.utcnow())
237.7.121 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
558
        
237.12.15 by Björn Påhlsson
more refactoring in regards to how clients get created
559
        # attributes specific for this server instance
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
560
        self.checker = None
561
        self.checker_initiator_tag = None
237.2.2 by Teddy Hogeborn
* mandos (_datetime_to_dbus_struct): Renamed to "_datetime_to_dbus";
562
        self.disable_initiator_tag = None
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
563
        self.checker_callback_tag = None
237.2.78 by Teddy Hogeborn
* mandos (Client.current_checker_command): New attribute.
564
        self.current_checker_command = None
237.14.4 by Teddy Hogeborn
* mandos (_timedelta_to_milliseconds): Renamed to
565
        self.approved = None
24.1.150 by Björn Påhlsson
* mandos: Added ClientDBus.approve_pending property. Exposed
566
        self.approvals_pending = 0
237.11.3 by Teddy Hogeborn
* mandos: Break long lines.
567
        self.changedstate = (multiprocessing_manager
568
                             .Condition(multiprocessing_manager
569
                                        .Lock()))
237.12.7 by Teddy Hogeborn
* mandos: Break long lines and fix some more white space.
570
        self.client_structure = [attr for attr in
571
                                 self.__dict__.iterkeys()
237.7.69 by teddy at bsnet
* debian/control (mandos/Depends): Added "python-crypto".
572
                                 if not attr.startswith("_")]
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
573
        self.client_structure.append("client_structure")
237.12.6 by Teddy Hogeborn
* mandos: Fix whitespace.
574
        
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
575
        for name, t in inspect.getmembers(type(self),
237.7.69 by teddy at bsnet
* debian/control (mandos/Depends): Added "python-crypto".
576
                                          lambda obj:
577
                                              isinstance(obj,
578
                                                         property)):
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
579
            if not name.startswith("_"):
580
                self.client_structure.append(name)
581
    
237.7.68 by Björn Påhlsson
merge persistent state
582
    # Send notice to process children that client state has changed
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
583
    def send_changedstate(self):
237.7.68 by Björn Påhlsson
merge persistent state
584
        with self.changedstate:
585
            self.changedstate.notify_all()
237.11.3 by Teddy Hogeborn
* mandos: Break long lines.
586
    
237.2.2 by Teddy Hogeborn
* mandos (_datetime_to_dbus_struct): Renamed to "_datetime_to_dbus";
587
    def enable(self):
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
588
        """Start this client's checker and timeout hooks"""
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
589
        if getattr(self, "enabled", False):
237.2.104 by Teddy Hogeborn
Code cleanup and one bug fix.
590
            # Already enabled
591
            return
24.1.179 by Björn Påhlsson
New feature:
592
        self.expires = datetime.datetime.utcnow() + self.timeout
237.2.2 by Teddy Hogeborn
* mandos (_datetime_to_dbus_struct): Renamed to "_datetime_to_dbus";
593
        self.enabled = True
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
594
        self.last_enabled = datetime.datetime.utcnow()
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
595
        self.init_checker()
237.7.129 by Teddy Hogeborn
* mandos (Client.enable, Client.disable, ClientDBus.approve): Call
596
        self.send_changedstate()
237.1.1 by Teddy Hogeborn
First steps of a D-Bus interface to the server.
597
    
237.2.165 by Teddy Hogeborn
* mandos (Client.disable): Rename keyword argument "log" to "quiet",
598
    def disable(self, quiet=True):
237.2.2 by Teddy Hogeborn
* mandos (_datetime_to_dbus_struct): Renamed to "_datetime_to_dbus";
599
        """Disable this client."""
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
600
        if not getattr(self, "enabled", False):
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
601
            return False
237.2.165 by Teddy Hogeborn
* mandos (Client.disable): Rename keyword argument "log" to "quiet",
602
        if not quiet:
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
603
            logger.info("Disabling client %s", self.name)
237.7.129 by Teddy Hogeborn
* mandos (Client.enable, Client.disable, ClientDBus.approve): Call
604
        if getattr(self, "disable_initiator_tag", None) is not None:
237.2.2 by Teddy Hogeborn
* mandos (_datetime_to_dbus_struct): Renamed to "_datetime_to_dbus";
605
            gobject.source_remove(self.disable_initiator_tag)
606
            self.disable_initiator_tag = None
24.1.179 by Björn Påhlsson
New feature:
607
        self.expires = None
237.7.129 by Teddy Hogeborn
* mandos (Client.enable, Client.disable, ClientDBus.approve): Call
608
        if getattr(self, "checker_initiator_tag", None) is not None:
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
609
            gobject.source_remove(self.checker_initiator_tag)
610
            self.checker_initiator_tag = None
611
        self.stop_checker()
237.2.2 by Teddy Hogeborn
* mandos (_datetime_to_dbus_struct): Renamed to "_datetime_to_dbus";
612
        self.enabled = False
237.7.129 by Teddy Hogeborn
* mandos (Client.enable, Client.disable, ClientDBus.approve): Call
613
        if not quiet:
614
            self.send_changedstate()
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
615
        # Do not run this again if called by a gobject.timeout_add
616
        return False
237.1.1 by Teddy Hogeborn
First steps of a D-Bus interface to the server.
617
    
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
618
    def __del__(self):
237.2.2 by Teddy Hogeborn
* mandos (_datetime_to_dbus_struct): Renamed to "_datetime_to_dbus";
619
        self.disable()
237.12.6 by Teddy Hogeborn
* mandos: Fix whitespace.
620
    
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
621
    def init_checker(self):
622
        # Schedule a new checker to be started an 'interval' from now,
623
        # and every interval from then on.
237.7.129 by Teddy Hogeborn
* mandos (Client.enable, Client.disable, ClientDBus.approve): Call
624
        if self.checker_initiator_tag is not None:
625
            gobject.source_remove(self.checker_initiator_tag)
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
626
        self.checker_initiator_tag = (gobject.timeout_add
627
                                      (self.interval_milliseconds(),
628
                                       self.start_checker))
629
        # Schedule a disable() when 'timeout' has passed
237.7.129 by Teddy Hogeborn
* mandos (Client.enable, Client.disable, ClientDBus.approve): Call
630
        if self.disable_initiator_tag is not None:
631
            gobject.source_remove(self.disable_initiator_tag)
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
632
        self.disable_initiator_tag = (gobject.timeout_add
633
                                   (self.timeout_milliseconds(),
634
                                    self.disable))
635
        # Also start a new checker *right now*.
636
        self.start_checker()
237.12.6 by Teddy Hogeborn
* mandos: Fix whitespace.
637
    
237.2.1 by Teddy Hogeborn
First version of a somewhat complete D-Bus server interface. Also
638
    def checker_callback(self, pid, condition, command):
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
639
        """The checker has completed, so take appropriate actions."""
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
640
        self.checker_callback_tag = None
641
        self.checker = None
237.2.43 by Teddy Hogeborn
* mandos (Client.CheckerCompleted): Changed signature to "nxs"; return
642
        if os.WIFEXITED(condition):
237.14.8 by Teddy Hogeborn
* mandos (ClientDBus.Host_dbus_property,
643
            self.last_checker_status = os.WEXITSTATUS(condition)
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
644
            if self.last_checker_status == 0:
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
645
                logger.info("Checker for %(name)s succeeded",
237.2.43 by Teddy Hogeborn
* mandos (Client.CheckerCompleted): Changed signature to "nxs"; return
646
                            vars(self))
237.2.44 by Teddy Hogeborn
* mandos (Client.bump_timeout): Renamed to "checked_ok". All callers
647
                self.checked_ok()
237.2.43 by Teddy Hogeborn
* mandos (Client.CheckerCompleted): Changed signature to "nxs"; return
648
            else:
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
649
                logger.info("Checker for %(name)s failed",
237.2.43 by Teddy Hogeborn
* mandos (Client.CheckerCompleted): Changed signature to "nxs"; return
650
                            vars(self))
651
        else:
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
652
            self.last_checker_status = -1
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
653
            logger.warning("Checker for %(name)s crashed?",
13 by Björn Påhlsson
Added following support:
654
                           vars(self))
237.1.1 by Teddy Hogeborn
First steps of a D-Bus interface to the server.
655
    
237.7.104 by Teddy Hogeborn
* DBUS-API (se.recompile.Mandos.Client.LastCheckerStatus): New
656
    def checked_ok(self):
657
        """Assert that the client has been seen, alive and well."""
658
        self.last_checked_ok = datetime.datetime.utcnow()
659
        self.last_checker_status = 0
660
        self.bump_timeout()
661
    
662
    def bump_timeout(self, timeout=None):
663
        """Bump up the timeout for this client."""
24.1.179 by Björn Påhlsson
New feature:
664
        if timeout is None:
665
            timeout = self.timeout
237.11.17 by Teddy Hogeborn
* mandos (Client.checked_ok): Bug fix: Handle disabled client.
666
        if self.disable_initiator_tag is not None:
667
            gobject.source_remove(self.disable_initiator_tag)
237.7.129 by Teddy Hogeborn
* mandos (Client.enable, Client.disable, ClientDBus.approve): Call
668
            self.disable_initiator_tag = None
237.11.17 by Teddy Hogeborn
* mandos (Client.checked_ok): Bug fix: Handle disabled client.
669
        if getattr(self, "enabled", False):
670
            self.disable_initiator_tag = (gobject.timeout_add
237.14.4 by Teddy Hogeborn
* mandos (_timedelta_to_milliseconds): Renamed to
671
                                          (timedelta_to_milliseconds
237.11.17 by Teddy Hogeborn
* mandos (Client.checked_ok): Bug fix: Handle disabled client.
672
                                           (timeout), self.disable))
673
            self.expires = datetime.datetime.utcnow() + timeout
237.1.1 by Teddy Hogeborn
First steps of a D-Bus interface to the server.
674
    
237.2.205 by Teddy Hogeborn
* DBUS-API: Document new "LastApprovalRequest" client property.
675
    def need_approval(self):
676
        self.last_approval_request = datetime.datetime.utcnow()
677
    
9 by Teddy Hogeborn
* client.cpp (main): Get t_old early since it is used on error exits.
678
    def start_checker(self):
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
679
        """Start a new checker subprocess if one is not running.
237.2.94 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
680
        
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
681
        If a checker already exists, leave it running and do
682
        nothing."""
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
683
        # The reason for not killing a running checker is that if we
237.7.125 by Teddy Hogeborn
* mandos (Client.start_checker): Reworded comment.
684
        # did that, and if a checker (for some reason) started running
685
        # slowly and taking more than 'interval' time, then the client
686
        # would inevitably timeout, since no checker would get a
687
        # chance to run to completion.  If we instead leave running
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
688
        # checkers alone, the checker would have to take more time
237.2.174 by Teddy Hogeborn
More consistent terminology: Clients are no longer "invalid" - they
689
        # than 'timeout' for the client to be disabled, which is as it
690
        # should be.
237.2.78 by Teddy Hogeborn
* mandos (Client.current_checker_command): New attribute.
691
        
692
        # If a checker exists, make sure it is not a zombie
237.2.146 by Teddy Hogeborn
* mandos (Client.start_checker): Bug fix: Fix race condition with
693
        try:
237.2.78 by Teddy Hogeborn
* mandos (Client.current_checker_command): New attribute.
694
            pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
237.7.190 by Teddy Hogeborn
Syntax fix; use "raise" better in Mandos server.
695
        except AttributeError:
696
            pass
697
        except OSError as error:
698
            if error.errno != errno.ECHILD:
699
                raise
237.2.146 by Teddy Hogeborn
* mandos (Client.start_checker): Bug fix: Fix race condition with
700
        else:
237.2.78 by Teddy Hogeborn
* mandos (Client.current_checker_command): New attribute.
701
            if pid:
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
702
                logger.warning("Checker was a zombie")
237.2.78 by Teddy Hogeborn
* mandos (Client.current_checker_command): New attribute.
703
                gobject.source_remove(self.checker_callback_tag)
704
                self.checker_callback(pid, status,
705
                                      self.current_checker_command)
706
        # Start a new checker if needed
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
707
        if self.checker is None:
237.7.131 by Teddy Hogeborn
* mandos (Client.start_checker): Remove undocumented support for "%%s"
708
            # Escape attributes for the shell
709
            escaped_attrs = dict(
710
                (attr, re.escape(unicode(getattr(self, attr))))
711
                for attr in
712
                self.runtime_expansions)
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
713
            try:
237.7.131 by Teddy Hogeborn
* mandos (Client.start_checker): Remove undocumented support for "%%s"
714
                command = self.checker_command % escaped_attrs
715
            except TypeError as error:
716
                logger.error('Could not format string "%s"',
717
                             self.checker_command, exc_info=error)
718
                return True # Try again later
237.2.91 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
719
            self.current_checker_command = command
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
720
            try:
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
721
                logger.info("Starting checker %r for %s",
44 by Teddy Hogeborn
* ca.pem: Removed.
722
                            command, self.name)
94 by Teddy Hogeborn
* clients.conf ([DEFAULT]/checker): Update to new default value.
723
                # We don't need to redirect stdout and stderr, since
724
                # in normal mode, that is already done by daemon(),
725
                # and in debug mode we don't want to.  (Stdin is
726
                # always replaced by /dev/null.)
237.7.165 by Teddy Hogeborn
* mandos: Bug fix: Don't print output from checkers when running in
727
                # The exception is when not debugging but nevertheless
728
                # running in the foreground; use the previously
729
                # created wnull.
730
                popen_args = {}
731
                if (not self.server_settings["debug"]
732
                    and self.server_settings["foreground"]):
733
                    popen_args.update({"stdout": wnull,
734
                                       "stderr": wnull })
28 by Teddy Hogeborn
* server.conf: New file.
735
                self.checker = subprocess.Popen(command,
736
                                                close_fds=True,
237.7.165 by Teddy Hogeborn
* mandos: Bug fix: Don't print output from checkers when running in
737
                                                shell=True, cwd="/",
738
                                                **popen_args)
237.7.30 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
739
            except OSError as error:
237.7.113 by Teddy Hogeborn
* mandos (AvahiService.rename, Client.start_checker,
740
                logger.error("Failed to start subprocess",
741
                             exc_info=error)
237.7.158 by Teddy Hogeborn
* mandos (Client.start_checker): Return True (retry later) if starting
742
                return True
237.7.131 by Teddy Hogeborn
* mandos (Client.start_checker): Remove undocumented support for "%%s"
743
            self.checker_callback_tag = (gobject.child_watch_add
744
                                         (self.checker.pid,
745
                                          self.checker_callback,
746
                                          data=command))
747
            # The checker may have completed before the gobject
748
            # watch was added.  Check for this.
237.7.158 by Teddy Hogeborn
* mandos (Client.start_checker): Return True (retry later) if starting
749
            try:
750
                pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
751
            except OSError as error:
752
                if error.errno == errno.ECHILD:
237.7.159 by Teddy Hogeborn
* mandos (Client.start_checker): Add comment. Break long line.
753
                    # This should never happen
754
                    logger.error("Child process vanished",
755
                                 exc_info=error)
237.7.158 by Teddy Hogeborn
* mandos (Client.start_checker): Return True (retry later) if starting
756
                    return True
757
                raise
237.7.131 by Teddy Hogeborn
* mandos (Client.start_checker): Remove undocumented support for "%%s"
758
            if pid:
759
                gobject.source_remove(self.checker_callback_tag)
760
                self.checker_callback(pid, status, command)
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
761
        # Re-run this periodically if run by gobject.timeout_add
762
        return True
237.1.1 by Teddy Hogeborn
First steps of a D-Bus interface to the server.
763
    
9 by Teddy Hogeborn
* client.cpp (main): Get t_old early since it is used on error exits.
764
    def stop_checker(self):
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
765
        """Force the checker process, if any, to stop."""
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
766
        if self.checker_callback_tag:
767
            gobject.source_remove(self.checker_callback_tag)
768
            self.checker_callback_tag = None
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
769
        if getattr(self, "checker", None) is None:
9 by Teddy Hogeborn
* client.cpp (main): Get t_old early since it is used on error exits.
770
            return
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
771
        logger.debug("Stopping checker for %(name)s", vars(self))
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
772
        try:
237.7.112 by Teddy Hogeborn
* mandos (Client.stop_checker): Use new Popen.terminate() method.
773
            self.checker.terminate()
237.2.163 by Teddy Hogeborn
* mandos (Client.enable): Bug fix: Start new immediate checker last to
774
            #time.sleep(0.5)
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
775
            #if self.checker.poll() is None:
237.7.112 by Teddy Hogeborn
* mandos (Client.stop_checker): Use new Popen.terminate() method.
776
            #    self.checker.kill()
237.7.30 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
777
        except OSError as error:
28 by Teddy Hogeborn
* server.conf: New file.
778
            if error.errno != errno.ESRCH: # No such process
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
779
                raise
9 by Teddy Hogeborn
* client.cpp (main): Get t_old early since it is used on error exits.
780
        self.checker = None
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
781
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
782
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
783
def dbus_service_property(dbus_interface, signature="v",
784
                          access="readwrite", byte_arrays=False):
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
785
    """Decorators for marking methods of a DBusObjectWithProperties to
786
    become properties on the D-Bus.
787
    
788
    The decorated method will be called with no arguments by "Get"
789
    and with one argument by "Set".
790
    
791
    The parameters, where they are supported, are the same as
792
    dbus.service.method, except there is only "signature", since the
793
    type from Get() and the type sent to Set() is the same.
794
    """
237.2.174 by Teddy Hogeborn
More consistent terminology: Clients are no longer "invalid" - they
795
    # Encoding deeply encoded byte arrays is not supported yet by the
796
    # "Set" method, so we fail early here:
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
797
    if byte_arrays and signature != "ay":
798
        raise ValueError("Byte arrays not supported for non-'ay'"
237.7.116 by Teddy Hogeborn
* mandos-monitor: Use new string format method.
799
                         " signature {0!r}".format(signature))
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
800
    def decorator(func):
801
        func._dbus_is_property = True
802
        func._dbus_interface = dbus_interface
803
        func._dbus_signature = signature
804
        func._dbus_access = access
805
        func._dbus_name = func.__name__
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
806
        if func._dbus_name.endswith("_dbus_property"):
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
807
            func._dbus_name = func._dbus_name[:-14]
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
808
        func._dbus_get_args_options = {'byte_arrays': byte_arrays }
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
809
        return func
810
    return decorator
811
812
237.18.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
813
def dbus_interface_annotations(dbus_interface):
237.7.121 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
814
    """Decorator for marking functions returning interface annotations
237.18.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
815
    
816
    Usage:
817
    
818
    @dbus_interface_annotations("org.example.Interface")
819
    def _foo(self):  # Function name does not matter
820
        return {"org.freedesktop.DBus.Deprecated": "true",
821
                "org.freedesktop.DBus.Property.EmitsChangedSignal":
822
                    "false"}
823
    """
824
    def decorator(func):
825
        func._dbus_is_interface = True
826
        func._dbus_interface = dbus_interface
827
        func._dbus_name = dbus_interface
828
        return func
829
    return decorator
830
831
237.19.1 by Teddy Hogeborn
Add D-Bus annotations support to methods, signals and properties.
832
def dbus_annotations(annotations):
833
    """Decorator to annotate D-Bus methods, signals or properties
834
    Usage:
835
    
836
    @dbus_service_property("org.example.Interface", signature="b",
837
                           access="r")
838
    @dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",
839
                        "org.freedesktop.DBus.Property."
840
                        "EmitsChangedSignal": "false"})
841
    def Property_dbus_property(self):
842
        return dbus.Boolean(False)
843
    """
844
    def decorator(func):
845
        func._dbus_annotations = annotations
846
        return func
847
    return decorator
848
849
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
850
class DBusPropertyException(dbus.exceptions.DBusException):
851
    """A base class for D-Bus property-related exceptions
852
    """
853
    def __unicode__(self):
854
        return unicode(str(self))
855
856
857
class DBusPropertyAccessException(DBusPropertyException):
858
    """A property's access permissions disallows an operation.
859
    """
860
    pass
861
862
863
class DBusPropertyNotFound(DBusPropertyException):
864
    """An attempt was made to access a non-existing property.
865
    """
866
    pass
867
868
869
class DBusObjectWithProperties(dbus.service.Object):
870
    """A D-Bus object with properties.
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
871
    
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
872
    Classes inheriting from this can use the dbus_service_property
873
    decorator to expose methods as D-Bus properties.  It exposes the
874
    standard Get(), Set(), and GetAll() methods on the D-Bus.
875
    """
876
    
877
    @staticmethod
237.18.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
878
    def _is_dbus_thing(thing):
879
        """Returns a function testing if an attribute is a D-Bus thing
880
        
881
        If called like _is_dbus_thing("method") it returns a function
882
        suitable for use as predicate to inspect.getmembers().
883
        """
884
        return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),
885
                                   False)
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
886
    
237.18.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
887
    def _get_all_dbus_things(self, thing):
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
888
        """Returns a generator of (name, attribute) pairs
889
        """
237.19.1 by Teddy Hogeborn
Add D-Bus annotations support to methods, signals and properties.
890
        return ((getattr(athing.__get__(self), "_dbus_name",
891
                         name),
237.18.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
892
                 athing.__get__(self))
24.1.186 by Björn Påhlsson
transitional stuff actually working
893
                for cls in self.__class__.__mro__
237.18.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
894
                for name, athing in
895
                inspect.getmembers(cls,
896
                                   self._is_dbus_thing(thing)))
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
897
    
898
    def _get_dbus_property(self, interface_name, property_name):
899
        """Returns a bound method if one exists which is a D-Bus
900
        property with the specified name and interface.
901
        """
24.1.186 by Björn Påhlsson
transitional stuff actually working
902
        for cls in  self.__class__.__mro__:
237.11.3 by Teddy Hogeborn
* mandos: Break long lines.
903
            for name, value in (inspect.getmembers
237.18.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
904
                                (cls,
905
                                 self._is_dbus_thing("property"))):
237.11.3 by Teddy Hogeborn
* mandos: Break long lines.
906
                if (value._dbus_name == property_name
907
                    and value._dbus_interface == interface_name):
24.1.186 by Björn Påhlsson
transitional stuff actually working
908
                    return value.__get__(self)
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
909
        
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
910
        # No such property
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
911
        raise DBusPropertyNotFound(self.dbus_object_path + ":"
912
                                   + interface_name + "."
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
913
                                   + property_name)
914
    
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
915
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
916
                         out_signature="v")
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
917
    def Get(self, interface_name, property_name):
918
        """Standard D-Bus property Get() method, see D-Bus standard.
919
        """
920
        prop = self._get_dbus_property(interface_name, property_name)
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
921
        if prop._dbus_access == "write":
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
922
            raise DBusPropertyAccessException(property_name)
923
        value = prop()
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
924
        if not hasattr(value, "variant_level"):
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
925
            return value
926
        return type(value)(value, variant_level=value.variant_level+1)
927
    
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
928
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
929
    def Set(self, interface_name, property_name, value):
930
        """Standard D-Bus property Set() method, see D-Bus standard.
931
        """
932
        prop = self._get_dbus_property(interface_name, property_name)
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
933
        if prop._dbus_access == "read":
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
934
            raise DBusPropertyAccessException(property_name)
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
935
        if prop._dbus_get_args_options["byte_arrays"]:
237.2.174 by Teddy Hogeborn
More consistent terminology: Clients are no longer "invalid" - they
936
            # The byte_arrays option is not supported yet on
937
            # signatures other than "ay".
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
938
            if prop._dbus_signature != "ay":
237.7.197 by Teddy Hogeborn
Minor code fix; raise only exception instances, not classes.
939
                raise ValueError("Byte arrays not supported for non-"
940
                                 "'ay' signature {0!r}"
941
                                 .format(prop._dbus_signature))
237.7.94 by Teddy Hogeborn
* debian/rules (binary-common): Exclude network-hooks.d from
942
            value = dbus.ByteArray(b''.join(chr(byte)
943
                                            for byte in value))
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
944
        prop(value)
945
    
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
946
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
947
                         out_signature="a{sv}")
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
948
    def GetAll(self, interface_name):
949
        """Standard D-Bus property GetAll() method, see D-Bus
950
        standard.
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
951
        
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
952
        Note: Will not include properties with access="write".
953
        """
237.12.5 by Björn Påhlsson
First run of python-lint. Fixed some *obviously* bad code and turned
954
        properties = {}
237.18.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
955
        for name, prop in self._get_all_dbus_things("property"):
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
956
            if (interface_name
957
                and interface_name != prop._dbus_interface):
958
                # Interface non-empty but did not match
959
                continue
960
            # Ignore write-only properties
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
961
            if prop._dbus_access == "write":
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
962
                continue
963
            value = prop()
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
964
            if not hasattr(value, "variant_level"):
237.12.5 by Björn Påhlsson
First run of python-lint. Fixed some *obviously* bad code and turned
965
                properties[name] = value
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
966
                continue
237.12.5 by Björn Påhlsson
First run of python-lint. Fixed some *obviously* bad code and turned
967
            properties[name] = type(value)(value, variant_level=
968
                                           value.variant_level+1)
969
        return dbus.Dictionary(properties, signature="sv")
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
970
    
971
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
972
                         out_signature="s",
973
                         path_keyword='object_path',
974
                         connection_keyword='connection')
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
975
    def Introspect(self, object_path, connection):
237.18.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
976
        """Overloading of standard D-Bus method.
977
        
978
        Inserts property tags and interface annotation tags.
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
979
        """
980
        xmlstring = dbus.service.Object.Introspect(self, object_path,
237.2.149 by Teddy Hogeborn
* mandos (DBusObjectWithProperties.Introspect): Add the name
981
                                                   connection)
237.2.150 by Teddy Hogeborn
* mandos (ClientDBus.ReceivedSecret): Renamed to "GotSecret". All
982
        try:
983
            document = xml.dom.minidom.parseString(xmlstring)
984
            def make_tag(document, name, prop):
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
985
                e = document.createElement("property")
986
                e.setAttribute("name", name)
987
                e.setAttribute("type", prop._dbus_signature)
988
                e.setAttribute("access", prop._dbus_access)
237.2.150 by Teddy Hogeborn
* mandos (ClientDBus.ReceivedSecret): Renamed to "GotSecret". All
989
                return e
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
990
            for if_tag in document.getElementsByTagName("interface"):
237.18.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
991
                # Add property tags
237.2.150 by Teddy Hogeborn
* mandos (ClientDBus.ReceivedSecret): Renamed to "GotSecret". All
992
                for tag in (make_tag(document, name, prop)
993
                            for name, prop
237.18.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
994
                            in self._get_all_dbus_things("property")
237.2.150 by Teddy Hogeborn
* mandos (ClientDBus.ReceivedSecret): Renamed to "GotSecret". All
995
                            if prop._dbus_interface
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
996
                            == if_tag.getAttribute("name")):
237.2.150 by Teddy Hogeborn
* mandos (ClientDBus.ReceivedSecret): Renamed to "GotSecret". All
997
                    if_tag.appendChild(tag)
237.19.1 by Teddy Hogeborn
Add D-Bus annotations support to methods, signals and properties.
998
                # Add annotation tags
999
                for typ in ("method", "signal", "property"):
1000
                    for tag in if_tag.getElementsByTagName(typ):
1001
                        annots = dict()
1002
                        for name, prop in (self.
1003
                                           _get_all_dbus_things(typ)):
1004
                            if (name == tag.getAttribute("name")
1005
                                and prop._dbus_interface
1006
                                == if_tag.getAttribute("name")):
1007
                                annots.update(getattr
1008
                                              (prop,
1009
                                               "_dbus_annotations",
1010
                                               {}))
1011
                        for name, value in annots.iteritems():
1012
                            ann_tag = document.createElement(
1013
                                "annotation")
1014
                            ann_tag.setAttribute("name", name)
1015
                            ann_tag.setAttribute("value", value)
1016
                            tag.appendChild(ann_tag)
237.18.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
1017
                # Add interface annotation tags
1018
                for annotation, value in dict(
237.7.124 by Teddy Hogeborn
* mandos (DBusObjectWithProperties.Introspect): Use
1019
                    itertools.chain.from_iterable(
1020
                        annotations().iteritems()
1021
                        for name, annotations in
1022
                        self._get_all_dbus_things("interface")
1023
                        if name == if_tag.getAttribute("name")
1024
                        )).iteritems():
237.19.1 by Teddy Hogeborn
Add D-Bus annotations support to methods, signals and properties.
1025
                    ann_tag = document.createElement("annotation")
1026
                    ann_tag.setAttribute("name", annotation)
1027
                    ann_tag.setAttribute("value", value)
1028
                    if_tag.appendChild(ann_tag)
237.2.150 by Teddy Hogeborn
* mandos (ClientDBus.ReceivedSecret): Renamed to "GotSecret". All
1029
                # Add the names to the return values for the
1030
                # "org.freedesktop.DBus.Properties" methods
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1031
                if (if_tag.getAttribute("name")
1032
                    == "org.freedesktop.DBus.Properties"):
1033
                    for cn in if_tag.getElementsByTagName("method"):
1034
                        if cn.getAttribute("name") == "Get":
1035
                            for arg in cn.getElementsByTagName("arg"):
1036
                                if (arg.getAttribute("direction")
1037
                                    == "out"):
1038
                                    arg.setAttribute("name", "value")
1039
                        elif cn.getAttribute("name") == "GetAll":
1040
                            for arg in cn.getElementsByTagName("arg"):
1041
                                if (arg.getAttribute("direction")
1042
                                    == "out"):
1043
                                    arg.setAttribute("name", "props")
1044
            xmlstring = document.toxml("utf-8")
237.2.150 by Teddy Hogeborn
* mandos (ClientDBus.ReceivedSecret): Renamed to "GotSecret". All
1045
            document.unlink()
1046
        except (AttributeError, xml.dom.DOMException,
237.7.30 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
1047
                xml.parsers.expat.ExpatError) as error:
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1048
            logger.error("Failed to override Introspection method",
237.7.113 by Teddy Hogeborn
* mandos (AvahiService.rename, Client.start_checker,
1049
                         exc_info=error)
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1050
        return xmlstring
1051
1052
237.7.135 by Teddy Hogeborn
* Makefile (DOCBOOKTOMAN): Only run man --warnings if both "man" and
1053
def datetime_to_dbus(dt, variant_level=0):
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1054
    """Convert a UTC datetime.datetime() to a D-Bus type."""
1055
    if dt is None:
1056
        return dbus.String("", variant_level = variant_level)
1057
    return dbus.String(dt.isoformat(),
1058
                       variant_level=variant_level)
1059
237.12.6 by Teddy Hogeborn
* mandos: Fix whitespace.
1060
237.7.123 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1061
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
1062
    """A class decorator; applied to a subclass of
1063
    dbus.service.Object, it will add alternate D-Bus attributes with
1064
    interface names according to the "alt_interface_names" mapping.
1065
    Usage:
1066
    
237.7.135 by Teddy Hogeborn
* Makefile (DOCBOOKTOMAN): Only run man --warnings if both "man" and
1067
    @alternate_dbus_interfaces({"org.example.Interface":
1068
                                    "net.example.AlternateInterface"})
237.7.123 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1069
    class SampleDBusObject(dbus.service.Object):
1070
        @dbus.service.method("org.example.Interface")
1071
        def SampleDBusMethod():
1072
            pass
1073
    
1074
    The above "SampleDBusMethod" on "SampleDBusObject" will be
1075
    reachable via two interfaces: "org.example.Interface" and
1076
    "net.example.AlternateInterface", the latter of which will have
1077
    its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
1078
    "true", unless "deprecate" is passed with a False value.
1079
    
1080
    This works for methods and signals, and also for D-Bus properties
1081
    (from DBusObjectWithProperties) and interfaces (from the
1082
    dbus_interface_annotations decorator).
237.11.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1083
    """
237.7.123 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1084
    def wrapper(cls):
1085
        for orig_interface_name, alt_interface_name in (
1086
            alt_interface_names.iteritems()):
1087
            attr = {}
1088
            interface_names = set()
1089
            # Go though all attributes of the class
1090
            for attrname, attribute in inspect.getmembers(cls):
237.11.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1091
                # Ignore non-D-Bus attributes, and D-Bus attributes
1092
                # with the wrong interface name
1093
                if (not hasattr(attribute, "_dbus_interface")
1094
                    or not attribute._dbus_interface
237.7.123 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1095
                    .startswith(orig_interface_name)):
237.11.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1096
                    continue
1097
                # Create an alternate D-Bus interface name based on
1098
                # the current name
1099
                alt_interface = (attribute._dbus_interface
237.7.123 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1100
                                 .replace(orig_interface_name,
1101
                                          alt_interface_name))
1102
                interface_names.add(alt_interface)
237.11.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1103
                # Is this a D-Bus signal?
1104
                if getattr(attribute, "_dbus_is_signal", False):
237.7.162 by Teddy Hogeborn
* mandos: Comment changes.
1105
                    # Extract the original non-method undecorated
1106
                    # function by black magic
237.11.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1107
                    nonmethod_func = (dict(
1108
                            zip(attribute.func_code.co_freevars,
1109
                                attribute.__closure__))["func"]
1110
                                      .cell_contents)
1111
                    # Create a new, but exactly alike, function
1112
                    # object, and decorate it to be a new D-Bus signal
1113
                    # with the alternate D-Bus interface name
1114
                    new_function = (dbus.service.signal
1115
                                    (alt_interface,
1116
                                     attribute._dbus_signature)
1117
                                    (types.FunctionType(
1118
                                nonmethod_func.func_code,
1119
                                nonmethod_func.func_globals,
1120
                                nonmethod_func.func_name,
1121
                                nonmethod_func.func_defaults,
1122
                                nonmethod_func.func_closure)))
237.19.1 by Teddy Hogeborn
Add D-Bus annotations support to methods, signals and properties.
1123
                    # Copy annotations, if any
1124
                    try:
1125
                        new_function._dbus_annotations = (
1126
                            dict(attribute._dbus_annotations))
1127
                    except AttributeError:
1128
                        pass
237.11.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1129
                    # Define a creator of a function to call both the
237.7.123 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1130
                    # original and alternate functions, so both the
1131
                    # original and alternate signals gets sent when
1132
                    # the function is called
237.11.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1133
                    def fixscope(func1, func2):
1134
                        """This function is a scope container to pass
1135
                        func1 and func2 to the "call_both" function
1136
                        outside of its arguments"""
1137
                        def call_both(*args, **kwargs):
1138
                            """This function will emit two D-Bus
1139
                            signals by calling func1 and func2"""
1140
                            func1(*args, **kwargs)
1141
                            func2(*args, **kwargs)
1142
                        return call_both
1143
                    # Create the "call_both" function and add it to
1144
                    # the class
237.7.123 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1145
                    attr[attrname] = fixscope(attribute, new_function)
237.11.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1146
                # Is this a D-Bus method?
1147
                elif getattr(attribute, "_dbus_is_method", False):
1148
                    # Create a new, but exactly alike, function
1149
                    # object.  Decorate it to be a new D-Bus method
1150
                    # with the alternate D-Bus interface name.  Add it
1151
                    # to the class.
1152
                    attr[attrname] = (dbus.service.method
1153
                                      (alt_interface,
1154
                                       attribute._dbus_in_signature,
1155
                                       attribute._dbus_out_signature)
1156
                                      (types.FunctionType
1157
                                       (attribute.func_code,
1158
                                        attribute.func_globals,
1159
                                        attribute.func_name,
1160
                                        attribute.func_defaults,
1161
                                        attribute.func_closure)))
237.19.1 by Teddy Hogeborn
Add D-Bus annotations support to methods, signals and properties.
1162
                    # Copy annotations, if any
1163
                    try:
1164
                        attr[attrname]._dbus_annotations = (
1165
                            dict(attribute._dbus_annotations))
1166
                    except AttributeError:
1167
                        pass
237.11.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1168
                # Is this a D-Bus property?
1169
                elif getattr(attribute, "_dbus_is_property", False):
1170
                    # Create a new, but exactly alike, function
1171
                    # object, and decorate it to be a new D-Bus
1172
                    # property with the alternate D-Bus interface
1173
                    # name.  Add it to the class.
1174
                    attr[attrname] = (dbus_service_property
1175
                                      (alt_interface,
1176
                                       attribute._dbus_signature,
1177
                                       attribute._dbus_access,
1178
                                       attribute
1179
                                       ._dbus_get_args_options
1180
                                       ["byte_arrays"])
1181
                                      (types.FunctionType
1182
                                       (attribute.func_code,
1183
                                        attribute.func_globals,
1184
                                        attribute.func_name,
1185
                                        attribute.func_defaults,
1186
                                        attribute.func_closure)))
237.19.1 by Teddy Hogeborn
Add D-Bus annotations support to methods, signals and properties.
1187
                    # Copy annotations, if any
1188
                    try:
1189
                        attr[attrname]._dbus_annotations = (
1190
                            dict(attribute._dbus_annotations))
1191
                    except AttributeError:
1192
                        pass
237.18.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
1193
                # Is this a D-Bus interface?
1194
                elif getattr(attribute, "_dbus_is_interface", False):
1195
                    # Create a new, but exactly alike, function
1196
                    # object.  Decorate it to be a new D-Bus interface
1197
                    # with the alternate D-Bus interface name.  Add it
1198
                    # to the class.
1199
                    attr[attrname] = (dbus_interface_annotations
1200
                                      (alt_interface)
1201
                                      (types.FunctionType
1202
                                       (attribute.func_code,
1203
                                        attribute.func_globals,
1204
                                        attribute.func_name,
1205
                                        attribute.func_defaults,
1206
                                        attribute.func_closure)))
237.7.123 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1207
            if deprecate:
1208
                # Deprecate all alternate interfaces
1209
                iname="_AlternateDBusNames_interface_annotation{0}"
1210
                for interface_name in interface_names:
1211
                    @dbus_interface_annotations(interface_name)
1212
                    def func(self):
1213
                        return { "org.freedesktop.DBus.Deprecated":
1214
                                     "true" }
1215
                    # Find an unused name
1216
                    for aname in (iname.format(i)
1217
                                  for i in itertools.count()):
1218
                        if aname not in attr:
1219
                            attr[aname] = func
1220
                            break
1221
            if interface_names:
1222
                # Replace the class with a new subclass of it with
1223
                # methods, signals, etc. as created above.
1224
                cls = type(b"{0}Alternate".format(cls.__name__),
1225
                           (cls,), attr)
1226
        return cls
1227
    return wrapper
1228
1229
1230
@alternate_dbus_interfaces({"se.recompile.Mandos":
1231
                                "se.bsnet.fukt.Mandos"})
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1232
class ClientDBus(Client, DBusObjectWithProperties):
237.2.91 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1233
    """A Client class using D-Bus
237.2.94 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
1234
    
237.2.91 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1235
    Attributes:
237.2.101 by Teddy Hogeborn
* mandos: Minor doc string fixes.
1236
    dbus_object_path: dbus.ObjectPath
1237
    bus: dbus.SystemBus()
237.2.91 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1238
    """
237.2.201 by Teddy Hogeborn
* mandos (Client.runtime_expansions): New attribute containing the
1239
    
1240
    runtime_expansions = (Client.runtime_expansions
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1241
                          + ("dbus_object_path",))
237.2.201 by Teddy Hogeborn
* mandos (Client.runtime_expansions): New attribute containing the
1242
    
237.2.91 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1243
    # dbus.service.Object doesn't use super(), so we can't either.
1244
    
237.2.100 by Teddy Hogeborn
Code cleanup. Move some global stuff into main.
1245
    def __init__(self, bus = None, *args, **kwargs):
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
1246
        self.bus = bus
1247
        Client.__init__(self, *args, **kwargs)
237.2.91 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1248
        # Only now, when this client is initialized, can it show up on
1249
        # the D-Bus
237.2.204 by Teddy Hogeborn
* mandos (ClientDBus.__init__): Bug fix: Translate "-" in client names
1250
        client_object_name = unicode(self.name).translate(
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1251
            {ord("."): ord("_"),
1252
             ord("-"): ord("_")})
237.2.91 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1253
        self.dbus_object_path = (dbus.ObjectPath
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1254
                                 ("/clients/" + client_object_name))
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1255
        DBusObjectWithProperties.__init__(self, self.bus,
1256
                                          self.dbus_object_path)
237.7.121 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
1257
    
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1258
    def notifychangeproperty(transform_func,
1259
                             dbus_name, type_func=lambda x: x,
1260
                             variant_level=1):
237.11.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1261
        """ Modify a variable so that it's a property which announces
1262
        its changes to DBus.
237.12.6 by Teddy Hogeborn
* mandos: Fix whitespace.
1263
        
237.11.15 by Teddy Hogeborn
Bug fix: Make D-Bus properties settable again.
1264
        transform_fun: Function that takes a value and a variant_level
1265
                       and transforms it to a D-Bus type.
237.11.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1266
        dbus_name: D-Bus name of the variable
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1267
        type_func: Function that transform the value before sending it
237.11.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1268
                   to the D-Bus.  Default: no transform
1269
        variant_level: D-Bus variant level.  Default: 1
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1270
        """
237.11.6 by Teddy Hogeborn
* mandos (ClientDBus.notifychangeproperty): Bug fix: Use instance
1271
        attrname = "_{0}".format(dbus_name)
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1272
        def setter(self, value):
1273
            if hasattr(self, "dbus_object_path"):
237.11.6 by Teddy Hogeborn
* mandos (ClientDBus.notifychangeproperty): Bug fix: Use instance
1274
                if (not hasattr(self, attrname) or
1275
                    type_func(getattr(self, attrname, None))
1276
                    != type_func(value)):
1277
                    dbus_value = transform_func(type_func(value),
237.11.15 by Teddy Hogeborn
Bug fix: Make D-Bus properties settable again.
1278
                                                variant_level
1279
                                                =variant_level)
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1280
                    self.PropertyChanged(dbus.String(dbus_name),
1281
                                         dbus_value)
237.11.6 by Teddy Hogeborn
* mandos (ClientDBus.notifychangeproperty): Bug fix: Use instance
1282
            setattr(self, attrname, value)
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
1283
        
237.11.6 by Teddy Hogeborn
* mandos (ClientDBus.notifychangeproperty): Bug fix: Use instance
1284
        return property(lambda self: getattr(self, attrname), setter)
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
1285
    
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1286
    expires = notifychangeproperty(datetime_to_dbus, "Expires")
1287
    approvals_pending = notifychangeproperty(dbus.Boolean,
1288
                                             "ApprovalPending",
1289
                                             type_func = bool)
1290
    enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1291
    last_enabled = notifychangeproperty(datetime_to_dbus,
1292
                                        "LastEnabled")
1293
    checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",
237.11.3 by Teddy Hogeborn
* mandos: Break long lines.
1294
                                   type_func = lambda checker:
1295
                                       checker is not None)
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1296
    last_checked_ok = notifychangeproperty(datetime_to_dbus,
1297
                                           "LastCheckedOK")
237.7.104 by Teddy Hogeborn
* DBUS-API (se.recompile.Mandos.Client.LastCheckerStatus): New
1298
    last_checker_status = notifychangeproperty(dbus.Int16,
1299
                                               "LastCheckerStatus")
237.11.3 by Teddy Hogeborn
* mandos: Break long lines.
1300
    last_approval_request = notifychangeproperty(
1301
        datetime_to_dbus, "LastApprovalRequest")
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1302
    approved_by_default = notifychangeproperty(dbus.Boolean,
1303
                                               "ApprovedByDefault")
237.14.9 by Teddy Hogeborn
* mandos (ClientDBus.approval_delay, ClientDBus.approval_duration,
1304
    approval_delay = notifychangeproperty(dbus.UInt64,
237.11.3 by Teddy Hogeborn
* mandos: Break long lines.
1305
                                          "ApprovalDelay",
1306
                                          type_func =
237.14.4 by Teddy Hogeborn
* mandos (_timedelta_to_milliseconds): Renamed to
1307
                                          timedelta_to_milliseconds)
237.11.3 by Teddy Hogeborn
* mandos: Break long lines.
1308
    approval_duration = notifychangeproperty(
237.14.9 by Teddy Hogeborn
* mandos (ClientDBus.approval_delay, ClientDBus.approval_duration,
1309
        dbus.UInt64, "ApprovalDuration",
237.14.4 by Teddy Hogeborn
* mandos (_timedelta_to_milliseconds): Renamed to
1310
        type_func = timedelta_to_milliseconds)
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1311
    host = notifychangeproperty(dbus.String, "Host")
237.14.9 by Teddy Hogeborn
* mandos (ClientDBus.approval_delay, ClientDBus.approval_duration,
1312
    timeout = notifychangeproperty(dbus.UInt64, "Timeout",
237.11.3 by Teddy Hogeborn
* mandos: Break long lines.
1313
                                   type_func =
237.14.4 by Teddy Hogeborn
* mandos (_timedelta_to_milliseconds): Renamed to
1314
                                   timedelta_to_milliseconds)
237.11.3 by Teddy Hogeborn
* mandos: Break long lines.
1315
    extended_timeout = notifychangeproperty(
237.14.9 by Teddy Hogeborn
* mandos (ClientDBus.approval_delay, ClientDBus.approval_duration,
1316
        dbus.UInt64, "ExtendedTimeout",
237.14.4 by Teddy Hogeborn
* mandos (_timedelta_to_milliseconds): Renamed to
1317
        type_func = timedelta_to_milliseconds)
237.14.9 by Teddy Hogeborn
* mandos (ClientDBus.approval_delay, ClientDBus.approval_duration,
1318
    interval = notifychangeproperty(dbus.UInt64,
237.11.3 by Teddy Hogeborn
* mandos: Break long lines.
1319
                                    "Interval",
1320
                                    type_func =
237.14.4 by Teddy Hogeborn
* mandos (_timedelta_to_milliseconds): Renamed to
1321
                                    timedelta_to_milliseconds)
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1322
    checker_command = notifychangeproperty(dbus.String, "Checker")
1323
    
1324
    del notifychangeproperty
237.2.91 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1325
    
1326
    def __del__(self, *args, **kwargs):
1327
        try:
1328
            self.remove_from_connection()
237.2.92 by Teddy Hogeborn
* mandos (ClientDBus.__del__): Bug fix: Correct mispasted code, and do
1329
        except LookupError:
237.2.91 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1330
            pass
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1331
        if hasattr(DBusObjectWithProperties, "__del__"):
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1332
            DBusObjectWithProperties.__del__(self, *args, **kwargs)
237.2.91 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1333
        Client.__del__(self, *args, **kwargs)
1334
    
1335
    def checker_callback(self, pid, condition, command,
1336
                         *args, **kwargs):
1337
        self.checker_callback_tag = None
1338
        self.checker = None
1339
        if os.WIFEXITED(condition):
1340
            exitstatus = os.WEXITSTATUS(condition)
1341
            # Emit D-Bus signal
1342
            self.CheckerCompleted(dbus.Int16(exitstatus),
1343
                                  dbus.Int64(condition),
1344
                                  dbus.String(command))
1345
        else:
1346
            # Emit D-Bus signal
1347
            self.CheckerCompleted(dbus.Int16(-1),
1348
                                  dbus.Int64(condition),
1349
                                  dbus.String(command))
1350
        
1351
        return Client.checker_callback(self, pid, condition, command,
1352
                                       *args, **kwargs)
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
1353
    
237.2.91 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1354
    def start_checker(self, *args, **kwargs):
237.7.206 by Teddy Hogeborn
* mandos (ClientDBus.start_checker): Removed unused variable
1355
        old_checker_pid = getattr(self.checker, "pid", None)
237.2.91 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1356
        r = Client.start_checker(self, *args, **kwargs)
237.2.92 by Teddy Hogeborn
* mandos (ClientDBus.__del__): Bug fix: Correct mispasted code, and do
1357
        # Only if new checker process was started
1358
        if (self.checker is not None
1359
            and old_checker_pid != self.checker.pid):
1360
            # Emit D-Bus signal
237.2.91 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1361
            self.CheckerStarted(self.current_checker_command)
1362
        return r
1363
    
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1364
    def _reset_approved(self):
237.14.4 by Teddy Hogeborn
* mandos (_timedelta_to_milliseconds): Renamed to
1365
        self.approved = None
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1366
        return False
1367
    
1368
    def approve(self, value=True):
237.14.4 by Teddy Hogeborn
* mandos (_timedelta_to_milliseconds): Renamed to
1369
        self.approved = value
1370
        gobject.timeout_add(timedelta_to_milliseconds
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1371
                            (self.approval_duration),
24.1.154 by Björn Påhlsson
merge
1372
                            self._reset_approved)
237.7.129 by Teddy Hogeborn
* mandos (Client.enable, Client.disable, ClientDBus.approve): Call
1373
        self.send_changedstate()
24.2.1 by teddy at bsnet
* debian/control (mandos/Depends): Added "python-urwid".
1374
    
24.1.147 by Björn Påhlsson
The IPC pipes are now file objects, not file descriptors:
1375
    ## D-Bus methods, signals & properties
237.11.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1376
    _interface = "se.recompile.Mandos.Client"
237.1.2 by Teddy Hogeborn
Further steps towards a D-Bus server interface, plus minor syntax
1377
    
237.18.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
1378
    ## Interfaces
1379
    
1380
    @dbus_interface_annotations(_interface)
1381
    def _foo(self):
1382
        return { "org.freedesktop.DBus.Property.EmitsChangedSignal":
1383
                     "false"}
1384
    
24.1.147 by Björn Påhlsson
The IPC pipes are now file objects, not file descriptors:
1385
    ## Signals
237.2.144 by Teddy Hogeborn
Restore some poor D-Bus methods who got a bit hastily deleted. Enable
1386
    
237.1.2 by Teddy Hogeborn
Further steps towards a D-Bus server interface, plus minor syntax
1387
    # CheckerCompleted - signal
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1388
    @dbus.service.signal(_interface, signature="nxs")
237.2.43 by Teddy Hogeborn
* mandos (Client.CheckerCompleted): Changed signature to "nxs"; return
1389
    def CheckerCompleted(self, exitcode, waitstatus, command):
237.1.2 by Teddy Hogeborn
Further steps towards a D-Bus server interface, plus minor syntax
1390
        "D-Bus signal"
1391
        pass
1392
    
1393
    # CheckerStarted - signal
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1394
    @dbus.service.signal(_interface, signature="s")
237.1.2 by Teddy Hogeborn
Further steps towards a D-Bus server interface, plus minor syntax
1395
    def CheckerStarted(self, command):
1396
        "D-Bus signal"
1397
        pass
1398
    
237.2.1 by Teddy Hogeborn
First version of a somewhat complete D-Bus server interface. Also
1399
    # PropertyChanged - signal
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1400
    @dbus.service.signal(_interface, signature="sv")
237.2.1 by Teddy Hogeborn
First version of a somewhat complete D-Bus server interface. Also
1401
    def PropertyChanged(self, property, value):
1402
        "D-Bus signal"
1403
        pass
237.1.2 by Teddy Hogeborn
Further steps towards a D-Bus server interface, plus minor syntax
1404
    
237.2.150 by Teddy Hogeborn
* mandos (ClientDBus.ReceivedSecret): Renamed to "GotSecret". All
1405
    # GotSecret - signal
237.2.90 by Teddy Hogeborn
Merge from pipe IPC branch.
1406
    @dbus.service.signal(_interface)
237.2.150 by Teddy Hogeborn
* mandos (ClientDBus.ReceivedSecret): Renamed to "GotSecret". All
1407
    def GotSecret(self):
24.1.155 by Björn Påhlsson
mandos server: Added debuglevel that adjust at what level information
1408
        """D-Bus signal
1409
        Is sent after a successful transfer of secret from the Mandos
1410
        server to mandos-client
1411
        """
24.2.4 by teddy at bsnet
* mandos (ClientDBus.approvals_pending): Changed to be a property
1412
        pass
237.2.90 by Teddy Hogeborn
Merge from pipe IPC branch.
1413
    
1414
    # Rejected - signal
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1415
    @dbus.service.signal(_interface, signature="s")
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1416
    def Rejected(self, reason):
1417
        "D-Bus signal"
24.2.4 by teddy at bsnet
* mandos (ClientDBus.approvals_pending): Changed to be a property
1418
        pass
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1419
    
1420
    # NeedApproval - signal
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1421
    @dbus.service.signal(_interface, signature="tb")
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1422
    def NeedApproval(self, timeout, default):
237.2.90 by Teddy Hogeborn
Merge from pipe IPC branch.
1423
        "D-Bus signal"
237.2.205 by Teddy Hogeborn
* DBUS-API: Document new "LastApprovalRequest" client property.
1424
        return self.need_approval()
237.2.90 by Teddy Hogeborn
Merge from pipe IPC branch.
1425
    
24.1.147 by Björn Påhlsson
The IPC pipes are now file objects, not file descriptors:
1426
    ## Methods
237.2.205 by Teddy Hogeborn
* DBUS-API: Document new "LastApprovalRequest" client property.
1427
    
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1428
    # Approve - method
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1429
    @dbus.service.method(_interface, in_signature="b")
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1430
    def Approve(self, value):
1431
        self.approve(value)
237.2.205 by Teddy Hogeborn
* DBUS-API: Document new "LastApprovalRequest" client property.
1432
    
24.1.147 by Björn Påhlsson
The IPC pipes are now file objects, not file descriptors:
1433
    # CheckedOK - method
1434
    @dbus.service.method(_interface)
1435
    def CheckedOK(self):
237.7.30 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
1436
        self.checked_ok()
24.1.147 by Björn Påhlsson
The IPC pipes are now file objects, not file descriptors:
1437
    
237.2.144 by Teddy Hogeborn
Restore some poor D-Bus methods who got a bit hastily deleted. Enable
1438
    # Enable - method
1439
    @dbus.service.method(_interface)
1440
    def Enable(self):
1441
        "D-Bus method"
1442
        self.enable()
1443
    
1444
    # StartChecker - method
1445
    @dbus.service.method(_interface)
1446
    def StartChecker(self):
1447
        "D-Bus method"
1448
        self.start_checker()
1449
    
1450
    # Disable - method
1451
    @dbus.service.method(_interface)
1452
    def Disable(self):
1453
        "D-Bus method"
1454
        self.disable()
1455
    
1456
    # StopChecker - method
1457
    @dbus.service.method(_interface)
1458
    def StopChecker(self):
1459
        self.stop_checker()
1460
    
24.1.147 by Björn Påhlsson
The IPC pipes are now file objects, not file descriptors:
1461
    ## Properties
1462
    
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1463
    # ApprovalPending - property
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1464
    @dbus_service_property(_interface, signature="b", access="read")
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1465
    def ApprovalPending_dbus_property(self):
24.2.4 by teddy at bsnet
* mandos (ClientDBus.approvals_pending): Changed to be a property
1466
        return dbus.Boolean(bool(self.approvals_pending))
24.1.150 by Björn Påhlsson
* mandos: Added ClientDBus.approve_pending property. Exposed
1467
    
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1468
    # ApprovedByDefault - property
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1469
    @dbus_service_property(_interface, signature="b",
1470
                           access="readwrite")
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1471
    def ApprovedByDefault_dbus_property(self, value=None):
1472
        if value is None:       # get
1473
            return dbus.Boolean(self.approved_by_default)
1474
        self.approved_by_default = bool(value)
1475
    
1476
    # ApprovalDelay - property
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1477
    @dbus_service_property(_interface, signature="t",
1478
                           access="readwrite")
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1479
    def ApprovalDelay_dbus_property(self, value=None):
1480
        if value is None:       # get
1481
            return dbus.UInt64(self.approval_delay_milliseconds())
1482
        self.approval_delay = datetime.timedelta(0, 0, 0, value)
1483
    
1484
    # ApprovalDuration - property
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1485
    @dbus_service_property(_interface, signature="t",
1486
                           access="readwrite")
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1487
    def ApprovalDuration_dbus_property(self, value=None):
1488
        if value is None:       # get
237.14.4 by Teddy Hogeborn
* mandos (_timedelta_to_milliseconds): Renamed to
1489
            return dbus.UInt64(timedelta_to_milliseconds(
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1490
                    self.approval_duration))
1491
        self.approval_duration = datetime.timedelta(0, 0, 0, value)
1492
    
1493
    # Name - property
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1494
    @dbus_service_property(_interface, signature="s", access="read")
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1495
    def Name_dbus_property(self):
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1496
        return dbus.String(self.name)
1497
    
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1498
    # Fingerprint - property
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1499
    @dbus_service_property(_interface, signature="s", access="read")
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1500
    def Fingerprint_dbus_property(self):
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1501
        return dbus.String(self.fingerprint)
1502
    
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1503
    # Host - property
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1504
    @dbus_service_property(_interface, signature="s",
1505
                           access="readwrite")
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1506
    def Host_dbus_property(self, value=None):
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1507
        if value is None:       # get
1508
            return dbus.String(self.host)
237.14.8 by Teddy Hogeborn
* mandos (ClientDBus.Host_dbus_property,
1509
        self.host = unicode(value)
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1510
    
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1511
    # Created - property
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1512
    @dbus_service_property(_interface, signature="s", access="read")
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1513
    def Created_dbus_property(self):
237.14.3 by Teddy Hogeborn
Make "enabled" a client config option.
1514
        return datetime_to_dbus(self.created)
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1515
    
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1516
    # LastEnabled - property
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1517
    @dbus_service_property(_interface, signature="s", access="read")
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1518
    def LastEnabled_dbus_property(self):
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1519
        return datetime_to_dbus(self.last_enabled)
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1520
    
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1521
    # Enabled - property
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1522
    @dbus_service_property(_interface, signature="b",
1523
                           access="readwrite")
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1524
    def Enabled_dbus_property(self, value=None):
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1525
        if value is None:       # get
1526
            return dbus.Boolean(self.enabled)
1527
        if value:
1528
            self.enable()
1529
        else:
1530
            self.disable()
1531
    
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1532
    # LastCheckedOK - property
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1533
    @dbus_service_property(_interface, signature="s",
1534
                           access="readwrite")
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1535
    def LastCheckedOK_dbus_property(self, value=None):
237.2.144 by Teddy Hogeborn
Restore some poor D-Bus methods who got a bit hastily deleted. Enable
1536
        if value is not None:
1537
            self.checked_ok()
1538
            return
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1539
        return datetime_to_dbus(self.last_checked_ok)
24.1.179 by Björn Påhlsson
New feature:
1540
    
237.7.104 by Teddy Hogeborn
* DBUS-API (se.recompile.Mandos.Client.LastCheckerStatus): New
1541
    # LastCheckerStatus - property
1542
    @dbus_service_property(_interface, signature="n",
1543
                           access="read")
1544
    def LastCheckerStatus_dbus_property(self):
1545
        return dbus.Int16(self.last_checker_status)
1546
    
24.1.179 by Björn Påhlsson
New feature:
1547
    # Expires - property
1548
    @dbus_service_property(_interface, signature="s", access="read")
1549
    def Expires_dbus_property(self):
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1550
        return datetime_to_dbus(self.expires)
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1551
    
237.2.205 by Teddy Hogeborn
* DBUS-API: Document new "LastApprovalRequest" client property.
1552
    # LastApprovalRequest - property
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1553
    @dbus_service_property(_interface, signature="s", access="read")
237.2.205 by Teddy Hogeborn
* DBUS-API: Document new "LastApprovalRequest" client property.
1554
    def LastApprovalRequest_dbus_property(self):
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1555
        return datetime_to_dbus(self.last_approval_request)
237.2.205 by Teddy Hogeborn
* DBUS-API: Document new "LastApprovalRequest" client property.
1556
    
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1557
    # Timeout - property
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1558
    @dbus_service_property(_interface, signature="t",
1559
                           access="readwrite")
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1560
    def Timeout_dbus_property(self, value=None):
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1561
        if value is None:       # get
1562
            return dbus.UInt64(self.timeout_milliseconds())
237.7.129 by Teddy Hogeborn
* mandos (Client.enable, Client.disable, ClientDBus.approve): Call
1563
        old_timeout = self.timeout
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1564
        self.timeout = datetime.timedelta(0, 0, 0, value)
237.7.129 by Teddy Hogeborn
* mandos (Client.enable, Client.disable, ClientDBus.approve): Call
1565
        # Reschedule disabling
237.7.91 by Teddy Hogeborn
* mandos: Break some long lines.
1566
        if self.enabled:
1567
            now = datetime.datetime.utcnow()
237.7.129 by Teddy Hogeborn
* mandos (Client.enable, Client.disable, ClientDBus.approve): Call
1568
            self.expires += self.timeout - old_timeout
1569
            if self.expires <= now:
237.7.91 by Teddy Hogeborn
* mandos: Break some long lines.
1570
                # The timeout has passed
1571
                self.disable()
1572
            else:
1573
                if (getattr(self, "disable_initiator_tag", None)
1574
                    is None):
1575
                    return
1576
                gobject.source_remove(self.disable_initiator_tag)
237.7.129 by Teddy Hogeborn
* mandos (Client.enable, Client.disable, ClientDBus.approve): Call
1577
                self.disable_initiator_tag = (
1578
                    gobject.timeout_add(
1579
                        timedelta_to_milliseconds(self.expires - now),
1580
                        self.disable))
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
1581
    
24.1.179 by Björn Påhlsson
New feature:
1582
    # ExtendedTimeout - property
1583
    @dbus_service_property(_interface, signature="t",
1584
                           access="readwrite")
1585
    def ExtendedTimeout_dbus_property(self, value=None):
1586
        if value is None:       # get
1587
            return dbus.UInt64(self.extended_timeout_milliseconds())
1588
        self.extended_timeout = datetime.timedelta(0, 0, 0, value)
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
1589
    
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1590
    # Interval - property
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1591
    @dbus_service_property(_interface, signature="t",
1592
                           access="readwrite")
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1593
    def Interval_dbus_property(self, value=None):
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1594
        if value is None:       # get
1595
            return dbus.UInt64(self.interval_milliseconds())
1596
        self.interval = datetime.timedelta(0, 0, 0, value)
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1597
        if getattr(self, "checker_initiator_tag", None) is None:
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1598
            return
237.14.3 by Teddy Hogeborn
Make "enabled" a client config option.
1599
        if self.enabled:
1600
            # Reschedule checker run
1601
            gobject.source_remove(self.checker_initiator_tag)
1602
            self.checker_initiator_tag = (gobject.timeout_add
1603
                                          (value, self.start_checker))
1604
            self.start_checker()    # Start one now, too
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
1605
    
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1606
    # Checker - property
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1607
    @dbus_service_property(_interface, signature="s",
1608
                           access="readwrite")
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1609
    def Checker_dbus_property(self, value=None):
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1610
        if value is None:       # get
1611
            return dbus.String(self.checker_command)
237.14.8 by Teddy Hogeborn
* mandos (ClientDBus.Host_dbus_property,
1612
        self.checker_command = unicode(value)
237.1.2 by Teddy Hogeborn
Further steps towards a D-Bus server interface, plus minor syntax
1613
    
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1614
    # CheckerRunning - property
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1615
    @dbus_service_property(_interface, signature="b",
1616
                           access="readwrite")
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1617
    def CheckerRunning_dbus_property(self, value=None):
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1618
        if value is None:       # get
1619
            return dbus.Boolean(self.checker is not None)
1620
        if value:
1621
            self.start_checker()
1622
        else:
1623
            self.stop_checker()
1624
    
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1625
    # ObjectPath - property
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1626
    @dbus_service_property(_interface, signature="o", access="read")
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1627
    def ObjectPath_dbus_property(self):
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1628
        return self.dbus_object_path # is already a dbus.ObjectPath
1629
    
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1630
    # Secret = property
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1631
    @dbus_service_property(_interface, signature="ay",
1632
                           access="write", byte_arrays=True)
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1633
    def Secret_dbus_property(self, value):
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1634
        self.secret = str(value)
237.1.2 by Teddy Hogeborn
Further steps towards a D-Bus server interface, plus minor syntax
1635
    
1636
    del _interface
3 by Björn Påhlsson
Python based server
1637
1638
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1639
class ProxyClient(object):
1640
    def __init__(self, child_pipe, fpr, address):
1641
        self._pipe = child_pipe
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1642
        self._pipe.send(('init', fpr, address))
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1643
        if not self._pipe.recv():
1644
            raise KeyError()
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
1645
    
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1646
    def __getattribute__(self, name):
237.14.4 by Teddy Hogeborn
* mandos (_timedelta_to_milliseconds): Renamed to
1647
        if name == '_pipe':
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1648
            return super(ProxyClient, self).__getattribute__(name)
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1649
        self._pipe.send(('getattr', name))
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1650
        data = self._pipe.recv()
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1651
        if data[0] == 'data':
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1652
            return data[1]
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1653
        if data[0] == 'function':
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1654
            def func(*args, **kwargs):
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1655
                self._pipe.send(('funcall', name, args, kwargs))
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1656
                return self._pipe.recv()[1]
1657
            return func
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
1658
    
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1659
    def __setattr__(self, name, value):
237.14.4 by Teddy Hogeborn
* mandos (_timedelta_to_milliseconds): Renamed to
1660
        if name == '_pipe':
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1661
            return super(ProxyClient, self).__setattr__(name, value)
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1662
        self._pipe.send(('setattr', name, value))
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1663
237.12.6 by Teddy Hogeborn
* mandos: Fix whitespace.
1664
237.2.98 by Teddy Hogeborn
* mandos: Import "SocketServer" as "socketserver" and "ConfigParser"
1665
class ClientHandler(socketserver.BaseRequestHandler, object):
237.2.94 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
1666
    """A class to handle client connections.
1667
    
1668
    Instantiated once for each connection to handle it.
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
1669
    Note: This will run in its own forked process."""
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
1670
    
3 by Björn Påhlsson
Python based server
1671
    def handle(self):
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1672
        with contextlib.closing(self.server.child_pipe) as child_pipe:
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1673
            logger.info("TCP connection from: %s",
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1674
                        unicode(self.client_address))
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1675
            logger.debug("Pipe FD: %d",
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1676
                         self.server.child_pipe.fileno())
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
1677
            
237.4.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
1678
            session = (gnutls.connection
1679
                       .ClientSession(self.request,
1680
                                      gnutls.connection
1681
                                      .X509Credentials()))
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
1682
            
237.4.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
1683
            # Note: gnutls.connection.X509Credentials is really a
1684
            # generic GnuTLS certificate credentials object so long as
1685
            # no X.509 keys are added to it.  Therefore, we can use it
1686
            # here despite using OpenPGP certificates.
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
1687
            
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1688
            #priority = ':'.join(("NONE", "+VERS-TLS1.1",
1689
            #                      "+AES-256-CBC", "+SHA1",
1690
            #                      "+COMP-NULL", "+CTYPE-OPENPGP",
1691
            #                      "+DHE-DSS"))
237.4.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
1692
            # Use a fallback default, since this MUST be set.
237.2.94 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
1693
            priority = self.server.gnutls_priority
1694
            if priority is None:
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1695
                priority = "NORMAL"
237.4.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
1696
            (gnutls.library.functions
1697
             .gnutls_priority_set_direct(session._c_object,
1698
                                         priority, None))
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
1699
            
237.5.2 by Teddy Hogeborn
* mandos (ClientHandler.handle): Set up the GnuTLS session object
1700
            # Start communication using the Mandos protocol
1701
            # Get protocol number
1702
            line = self.request.makefile().readline()
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1703
            logger.debug("Protocol version: %r", line)
237.5.2 by Teddy Hogeborn
* mandos (ClientHandler.handle): Set up the GnuTLS session object
1704
            try:
1705
                if int(line.strip().split()[0]) > 1:
237.7.190 by Teddy Hogeborn
Syntax fix; use "raise" better in Mandos server.
1706
                    raise RuntimeError(line)
237.7.30 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
1707
            except (ValueError, IndexError, RuntimeError) as error:
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1708
                logger.error("Unknown protocol version: %s", error)
237.5.2 by Teddy Hogeborn
* mandos (ClientHandler.handle): Set up the GnuTLS session object
1709
                return
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
1710
            
237.5.2 by Teddy Hogeborn
* mandos (ClientHandler.handle): Set up the GnuTLS session object
1711
            # Start GnuTLS connection
237.4.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
1712
            try:
1713
                session.handshake()
237.7.30 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
1714
            except gnutls.errors.GNUTLSError as error:
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1715
                logger.warning("Handshake failed: %s", error)
237.4.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
1716
                # Do not run session.bye() here: the session is not
1717
                # established.  Just abandon the request.
1718
                return
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1719
            logger.debug("Handshake succeeded")
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
1720
            
24.1.150 by Björn Påhlsson
* mandos: Added ClientDBus.approve_pending property. Exposed
1721
            approval_required = False
237.4.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
1722
            try:
237.2.174 by Teddy Hogeborn
More consistent terminology: Clients are no longer "invalid" - they
1723
                try:
1724
                    fpr = self.fingerprint(self.peer_certificate
1725
                                           (session))
237.7.30 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
1726
                except (TypeError,
1727
                        gnutls.errors.GNUTLSError) as error:
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1728
                    logger.warning("Bad certificate: %s", error)
237.2.174 by Teddy Hogeborn
More consistent terminology: Clients are no longer "invalid" - they
1729
                    return
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1730
                logger.debug("Fingerprint: %s", fpr)
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
1731
                
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1732
                try:
1733
                    client = ProxyClient(child_pipe, fpr,
1734
                                         self.client_address)
1735
                except KeyError:
237.2.174 by Teddy Hogeborn
More consistent terminology: Clients are no longer "invalid" - they
1736
                    return
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1737
                
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1738
                if client.approval_delay:
1739
                    delay = client.approval_delay
24.1.150 by Björn Påhlsson
* mandos: Added ClientDBus.approve_pending property. Exposed
1740
                    client.approvals_pending += 1
1741
                    approval_required = True
1742
                
24.1.148 by Björn Påhlsson
half working on-demand password and approved code
1743
                while True:
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1744
                    if not client.enabled:
24.1.174 by Björn Påhlsson
* Makefile (CFLAGS): Added "-lrt" to include real time library.
1745
                        logger.info("Client %s is disabled",
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1746
                                       client.name)
1747
                        if self.server.use_dbus:
1748
                            # Emit D-Bus signal
237.11.3 by Teddy Hogeborn
* mandos: Break long lines.
1749
                            client.Rejected("Disabled")
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1750
                        return
24.1.150 by Björn Påhlsson
* mandos: Added ClientDBus.approve_pending property. Exposed
1751
                    
237.14.4 by Teddy Hogeborn
* mandos (_timedelta_to_milliseconds): Renamed to
1752
                    if client.approved or not client.approval_delay:
24.1.150 by Björn Påhlsson
* mandos: Added ClientDBus.approve_pending property. Exposed
1753
                        #We are approved or approval is disabled
1754
                        break
237.14.4 by Teddy Hogeborn
* mandos (_timedelta_to_milliseconds): Renamed to
1755
                    elif client.approved is None:
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1756
                        logger.info("Client %s needs approval",
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1757
                                    client.name)
1758
                        if self.server.use_dbus:
1759
                            # Emit D-Bus signal
1760
                            client.NeedApproval(
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1761
                                client.approval_delay_milliseconds(),
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1762
                                client.approved_by_default)
1763
                    else:
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1764
                        logger.warning("Client %s was not approved",
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1765
                                       client.name)
1766
                        if self.server.use_dbus:
24.1.150 by Björn Påhlsson
* mandos: Added ClientDBus.approve_pending property. Exposed
1767
                            # Emit D-Bus signal
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1768
                            client.Rejected("Denied")
24.1.148 by Björn Påhlsson
half working on-demand password and approved code
1769
                        return
1770
                    
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1771
                    #wait until timeout or approved
1772
                    time = datetime.datetime.now()
1773
                    client.changedstate.acquire()
237.7.129 by Teddy Hogeborn
* mandos (Client.enable, Client.disable, ClientDBus.approve): Call
1774
                    client.changedstate.wait(
1775
                        float(timedelta_to_milliseconds(delay)
1776
                              / 1000))
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1777
                    client.changedstate.release()
1778
                    time2 = datetime.datetime.now()
1779
                    if (time2 - time) >= delay:
1780
                        if not client.approved_by_default:
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1781
                            logger.warning("Client %s timed out while"
1782
                                           " waiting for approval",
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1783
                                           client.name)
1784
                            if self.server.use_dbus:
1785
                                # Emit D-Bus signal
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1786
                                client.Rejected("Approval timed out")
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1787
                            return
1788
                        else:
1789
                            break
1790
                    else:
1791
                        delay -= time2 - time
1792
                
237.2.174 by Teddy Hogeborn
More consistent terminology: Clients are no longer "invalid" - they
1793
                sent_size = 0
1794
                while sent_size < len(client.secret):
24.1.155 by Björn Påhlsson
mandos server: Added debuglevel that adjust at what level information
1795
                    try:
1796
                        sent = session.send(client.secret[sent_size:])
237.7.30 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
1797
                    except gnutls.errors.GNUTLSError as error:
237.7.122 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
1798
                        logger.warning("gnutls send failed",
1799
                                       exc_info=error)
24.1.155 by Björn Påhlsson
mandos server: Added debuglevel that adjust at what level information
1800
                        return
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1801
                    logger.debug("Sent: %d, remaining: %d",
237.2.174 by Teddy Hogeborn
More consistent terminology: Clients are no longer "invalid" - they
1802
                                 sent, len(client.secret)
1803
                                 - (sent_size + sent))
1804
                    sent_size += sent
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
1805
                
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1806
                logger.info("Sending secret to %s", client.name)
237.11.13 by Teddy Hogeborn
Miscellaneous fixes prompted by lintian:
1807
                # bump the timeout using extended_timeout
237.7.104 by Teddy Hogeborn
* DBUS-API (se.recompile.Mandos.Client.LastCheckerStatus): New
1808
                client.bump_timeout(client.extended_timeout)
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1809
                if self.server.use_dbus:
1810
                    # Emit D-Bus signal
1811
                    client.GotSecret()
24.1.150 by Björn Påhlsson
* mandos: Added ClientDBus.approve_pending property. Exposed
1812
            
237.2.174 by Teddy Hogeborn
More consistent terminology: Clients are no longer "invalid" - they
1813
            finally:
24.1.150 by Björn Påhlsson
* mandos: Added ClientDBus.approve_pending property. Exposed
1814
                if approval_required:
1815
                    client.approvals_pending -= 1
24.1.155 by Björn Påhlsson
mandos server: Added debuglevel that adjust at what level information
1816
                try:
1817
                    session.bye()
237.7.30 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
1818
                except gnutls.errors.GNUTLSError as error:
237.7.122 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
1819
                    logger.warning("GnuTLS bye failed",
1820
                                   exc_info=error)
237.2.93 by Teddy Hogeborn
* mandos (peer_certificate, fingerprint): Moved into "TCP_handler"
1821
    
1822
    @staticmethod
1823
    def peer_certificate(session):
1824
        "Return the peer's OpenPGP certificate as a bytestring"
1825
        # If not an OpenPGP certificate...
1826
        if (gnutls.library.functions
1827
            .gnutls_certificate_type_get(session._c_object)
1828
            != gnutls.library.constants.GNUTLS_CRT_OPENPGP):
1829
            # ...do the normal thing
1830
            return session.peer_certificate
1831
        list_size = ctypes.c_uint(1)
1832
        cert_list = (gnutls.library.functions
1833
                     .gnutls_certificate_get_peers
1834
                     (session._c_object, ctypes.byref(list_size)))
1835
        if not bool(cert_list) and list_size.value != 0:
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1836
            raise gnutls.errors.GNUTLSError("error getting peer"
1837
                                            " certificate")
237.2.93 by Teddy Hogeborn
* mandos (peer_certificate, fingerprint): Moved into "TCP_handler"
1838
        if list_size.value == 0:
1839
            return None
1840
        cert = cert_list[0]
1841
        return ctypes.string_at(cert.data, cert.size)
1842
    
1843
    @staticmethod
1844
    def fingerprint(openpgp):
1845
        "Convert an OpenPGP bytestring to a hexdigit fingerprint"
1846
        # New GnuTLS "datum" with the OpenPGP public key
1847
        datum = (gnutls.library.types
1848
                 .gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
1849
                                             ctypes.POINTER
1850
                                             (ctypes.c_ubyte)),
1851
                                 ctypes.c_uint(len(openpgp))))
1852
        # New empty GnuTLS certificate
1853
        crt = gnutls.library.types.gnutls_openpgp_crt_t()
1854
        (gnutls.library.functions
1855
         .gnutls_openpgp_crt_init(ctypes.byref(crt)))
1856
        # Import the OpenPGP public key into the certificate
1857
        (gnutls.library.functions
1858
         .gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
1859
                                    gnutls.library.constants
1860
                                    .GNUTLS_OPENPGP_FMT_RAW))
1861
        # Verify the self signature in the key
1862
        crtverify = ctypes.c_uint()
1863
        (gnutls.library.functions
1864
         .gnutls_openpgp_crt_verify_self(crt, 0,
1865
                                         ctypes.byref(crtverify)))
1866
        if crtverify.value != 0:
1867
            gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1868
            raise (gnutls.errors.CertificateSecurityError
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1869
                   ("Verify failed"))
237.2.93 by Teddy Hogeborn
* mandos (peer_certificate, fingerprint): Moved into "TCP_handler"
1870
        # New buffer for the fingerprint
1871
        buf = ctypes.create_string_buffer(20)
1872
        buf_len = ctypes.c_size_t()
1873
        # Get the fingerprint from the certificate into the buffer
1874
        (gnutls.library.functions
1875
         .gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
1876
                                             ctypes.byref(buf_len)))
1877
        # Deinit the certificate
1878
        gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1879
        # Convert the buffer to a Python bytestring
1880
        fpr = ctypes.string_at(buf, buf_len.value)
1881
        # Convert the bytestring to hexadecimal notation
237.14.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
1882
        hex_fpr = binascii.hexlify(fpr).upper()
237.2.93 by Teddy Hogeborn
* mandos (peer_certificate, fingerprint): Moved into "TCP_handler"
1883
        return hex_fpr
237.4.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
1884
1885
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1886
class MultiprocessingMixIn(object):
1887
    """Like socketserver.ThreadingMixIn, but with multiprocessing"""
1888
    def sub_process_main(self, request, address):
1889
        try:
1890
            self.finish_request(request, address)
237.12.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
1891
        except Exception:
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1892
            self.handle_error(request, address)
1893
        self.close_request(request)
237.11.11 by Teddy Hogeborn
* mandos (Client.checked_ok): Set "expires" after setting timeout.
1894
    
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1895
    def process_request(self, request, address):
1896
        """Start a new process to process the request."""
237.11.11 by Teddy Hogeborn
* mandos (Client.checked_ok): Set "expires" after setting timeout.
1897
        proc = multiprocessing.Process(target = self.sub_process_main,
237.7.127 by Teddy Hogeborn
* mandos: Use all new builtins.
1898
                                       args = (request, address))
237.11.11 by Teddy Hogeborn
* mandos (Client.checked_ok): Set "expires" after setting timeout.
1899
        proc.start()
1900
        return proc
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1901
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
1902
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1903
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
1904
    """ adds a pipe to the MixIn """
237.4.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
1905
    def process_request(self, request, client_address):
237.2.94 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
1906
        """Overrides and wraps the original process_request().
1907
        
237.2.118 by Teddy Hogeborn
* mandos: White-space fixes only.
1908
        This function creates a new pipe in self.pipe
237.4.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
1909
        """
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1910
        parent_pipe, self.child_pipe = multiprocessing.Pipe()
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
1911
        
237.11.11 by Teddy Hogeborn
* mandos (Client.checked_ok): Set "expires" after setting timeout.
1912
        proc = MultiprocessingMixIn.process_request(self, request,
1913
                                                    client_address)
24.1.152 by Björn Påhlsson
bug fixes that prevent problems when runing server as root
1914
        self.child_pipe.close()
237.11.11 by Teddy Hogeborn
* mandos (Client.checked_ok): Set "expires" after setting timeout.
1915
        self.add_pipe(parent_pipe, proc)
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
1916
    
237.11.11 by Teddy Hogeborn
* mandos (Client.checked_ok): Set "expires" after setting timeout.
1917
    def add_pipe(self, parent_pipe, proc):
237.4.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
1918
        """Dummy function; override as necessary"""
237.7.190 by Teddy Hogeborn
Syntax fix; use "raise" better in Mandos server.
1919
        raise NotImplementedError()
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1920
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
1921
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1922
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
237.2.98 by Teddy Hogeborn
* mandos: Import "SocketServer" as "socketserver" and "ConfigParser"
1923
                     socketserver.TCPServer, object):
250 by Teddy Hogeborn
Merge from trunk. Notable changes:
1924
    """IPv6-capable TCP server.  Accepts 'None' as address and/or port
237.2.94 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
1925
    
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
1926
    Attributes:
237.2.94 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
1927
        enabled:        Boolean; whether this server is activated yet
1928
        interface:      None or a network interface name (string)
1929
        use_ipv6:       Boolean; to use IPv6 or not
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
1930
    """
237.2.94 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
1931
    def __init__(self, server_address, RequestHandlerClass,
237.21.1 by Teddy Hogeborn
* mandos: Implement "--socket" option.
1932
                 interface=None, use_ipv6=True, socketfd=None):
1933
        """If socketfd is set, use that file descriptor instead of
1934
        creating a new one with socket.socket().
1935
        """
237.2.94 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
1936
        self.interface = interface
1937
        if use_ipv6:
1938
            self.address_family = socket.AF_INET6
237.21.1 by Teddy Hogeborn
* mandos: Implement "--socket" option.
1939
        if socketfd is not None:
1940
            # Save the file descriptor
1941
            self.socketfd = socketfd
1942
            # Save the original socket.socket() function
1943
            self.socket_socket = socket.socket
1944
            # To implement --socket, we monkey patch socket.socket.
1945
            # 
1946
            # (When socketserver.TCPServer is a new-style class, we
1947
            # could make self.socket into a property instead of monkey
1948
            # patching socket.socket.)
1949
            # 
1950
            # Create a one-time-only replacement for socket.socket()
1951
            @functools.wraps(socket.socket)
1952
            def socket_wrapper(*args, **kwargs):
1953
                # Restore original function so subsequent calls are
1954
                # not affected.
1955
                socket.socket = self.socket_socket
1956
                del self.socket_socket
1957
                # This time only, return a new socket object from the
1958
                # saved file descriptor.
1959
                return socket.fromfd(self.socketfd, *args, **kwargs)
1960
            # Replace socket.socket() function with wrapper
1961
            socket.socket = socket_wrapper
1962
        # The socketserver.TCPServer.__init__ will call
1963
        # socket.socket(), which might be our replacement,
1964
        # socket_wrapper(), if socketfd was set.
237.2.98 by Teddy Hogeborn
* mandos: Import "SocketServer" as "socketserver" and "ConfigParser"
1965
        socketserver.TCPServer.__init__(self, server_address,
237.2.94 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
1966
                                        RequestHandlerClass)
237.21.1 by Teddy Hogeborn
* mandos: Implement "--socket" option.
1967
    
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
1968
    def server_bind(self):
1969
        """This overrides the normal server_bind() function
1970
        to bind to an interface if one was specified, and also NOT to
1971
        bind to an address or port if they were not specified."""
237.2.94 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
1972
        if self.interface is not None:
237.2.101 by Teddy Hogeborn
* mandos: Minor doc string fixes.
1973
            if SO_BINDTODEVICE is None:
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1974
                logger.error("SO_BINDTODEVICE does not exist;"
1975
                             " cannot bind to interface %s",
237.2.101 by Teddy Hogeborn
* mandos: Minor doc string fixes.
1976
                             self.interface)
1977
            else:
1978
                try:
1979
                    self.socket.setsockopt(socket.SOL_SOCKET,
1980
                                           SO_BINDTODEVICE,
237.7.154 by Teddy Hogeborn
* mandos: New "--foreground" option.
1981
                                           str(self.interface + '\0'))
237.7.30 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
1982
                except socket.error as error:
237.7.130 by Teddy Hogeborn
* mandos (IPv6_TCPServer.server_bind): Bug fix: handle non-existing
1983
                    if error.errno == errno.EPERM:
237.7.154 by Teddy Hogeborn
* mandos: New "--foreground" option.
1984
                        logger.error("No permission to bind to"
1985
                                     " interface %s", self.interface)
237.7.130 by Teddy Hogeborn
* mandos (IPv6_TCPServer.server_bind): Bug fix: handle non-existing
1986
                    elif error.errno == errno.ENOPROTOOPT:
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1987
                        logger.error("SO_BINDTODEVICE not available;"
1988
                                     " cannot bind to interface %s",
237.2.101 by Teddy Hogeborn
* mandos: Minor doc string fixes.
1989
                                     self.interface)
237.7.130 by Teddy Hogeborn
* mandos (IPv6_TCPServer.server_bind): Bug fix: handle non-existing
1990
                    elif error.errno == errno.ENODEV:
237.7.154 by Teddy Hogeborn
* mandos: New "--foreground" option.
1991
                        logger.error("Interface %s does not exist,"
1992
                                     " cannot bind", self.interface)
237.2.101 by Teddy Hogeborn
* mandos: Minor doc string fixes.
1993
                    else:
1994
                        raise
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
1995
        # Only bind(2) the socket if we really need to.
1996
        if self.server_address[0] or self.server_address[1]:
1997
            if not self.server_address[0]:
237.2.77 by Teddy Hogeborn
Support not using IPv6 in server:
1998
                if self.address_family == socket.AF_INET6:
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1999
                    any_address = "::" # in6addr_any
237.2.77 by Teddy Hogeborn
Support not using IPv6 in server:
2000
                else:
237.7.166 by Teddy Hogeborn
* mandos: Bug fix: Make boolean options work from the config file
2001
                    any_address = "0.0.0.0" # INADDR_ANY
237.2.77 by Teddy Hogeborn
Support not using IPv6 in server:
2002
                self.server_address = (any_address,
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
2003
                                       self.server_address[1])
49 by Teddy Hogeborn
* mandos (IPv6_TCPServer.server_bind): Bug fix: allow port to be empty
2004
            elif not self.server_address[1]:
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
2005
                self.server_address = (self.server_address[0],
2006
                                       0)
237.2.94 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
2007
#                 if self.interface:
49 by Teddy Hogeborn
* mandos (IPv6_TCPServer.server_bind): Bug fix: allow port to be empty
2008
#                     self.server_address = (self.server_address[0],
2009
#                                            0, # port
2010
#                                            0, # flowinfo
2011
#                                            if_nametoindex
237.2.94 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
2012
#                                            (self.interface))
237.2.98 by Teddy Hogeborn
* mandos: Import "SocketServer" as "socketserver" and "ConfigParser"
2013
            return socketserver.TCPServer.server_bind(self)
237.2.102 by Teddy Hogeborn
Code cleanup.
2014
2015
2016
class MandosServer(IPv6_TCPServer):
2017
    """Mandos server.
2018
    
2019
    Attributes:
2020
        clients:        set of Client objects
2021
        gnutls_priority GnuTLS priority string
2022
        use_dbus:       Boolean; to emit D-Bus signals or not
237.2.103 by Teddy Hogeborn
Code cleanup.
2023
    
2024
    Assumes a gobject.MainLoop event loop.
237.2.102 by Teddy Hogeborn
Code cleanup.
2025
    """
2026
    def __init__(self, server_address, RequestHandlerClass,
2027
                 interface=None, use_ipv6=True, clients=None,
237.21.1 by Teddy Hogeborn
* mandos: Implement "--socket" option.
2028
                 gnutls_priority=None, use_dbus=True, socketfd=None):
237.2.102 by Teddy Hogeborn
Code cleanup.
2029
        self.enabled = False
2030
        self.clients = clients
237.2.104 by Teddy Hogeborn
Code cleanup and one bug fix.
2031
        if self.clients is None:
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
2032
            self.clients = {}
237.2.102 by Teddy Hogeborn
Code cleanup.
2033
        self.use_dbus = use_dbus
2034
        self.gnutls_priority = gnutls_priority
2035
        IPv6_TCPServer.__init__(self, server_address,
2036
                                RequestHandlerClass,
2037
                                interface = interface,
237.21.1 by Teddy Hogeborn
* mandos: Implement "--socket" option.
2038
                                use_ipv6 = use_ipv6,
2039
                                socketfd = socketfd)
163 by Teddy Hogeborn
* Makefile (PIDDIR, USER, GROUP): Removed.
2040
    def server_activate(self):
2041
        if self.enabled:
237.2.98 by Teddy Hogeborn
* mandos: Import "SocketServer" as "socketserver" and "ConfigParser"
2042
            return socketserver.TCPServer.server_activate(self)
237.11.11 by Teddy Hogeborn
* mandos (Client.checked_ok): Set "expires" after setting timeout.
2043
    
163 by Teddy Hogeborn
* Makefile (PIDDIR, USER, GROUP): Removed.
2044
    def enable(self):
2045
        self.enabled = True
237.11.11 by Teddy Hogeborn
* mandos (Client.checked_ok): Set "expires" after setting timeout.
2046
    
2047
    def add_pipe(self, parent_pipe, proc):
237.2.103 by Teddy Hogeborn
Code cleanup.
2048
        # Call "handle_ipc" for both data and EOF events
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2049
        gobject.io_add_watch(parent_pipe.fileno(),
237.2.174 by Teddy Hogeborn
More consistent terminology: Clients are no longer "invalid" - they
2050
                             gobject.IO_IN | gobject.IO_HUP,
2051
                             functools.partial(self.handle_ipc,
237.11.3 by Teddy Hogeborn
* mandos: Break long lines.
2052
                                               parent_pipe =
237.11.11 by Teddy Hogeborn
* mandos (Client.checked_ok): Set "expires" after setting timeout.
2053
                                               parent_pipe,
2054
                                               proc = proc))
237.11.9 by Teddy Hogeborn
Whitespace
2055
    
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2056
    def handle_ipc(self, source, condition, parent_pipe=None,
237.11.11 by Teddy Hogeborn
* mandos (Client.checked_ok): Set "expires" after setting timeout.
2057
                   proc = None, client_object=None):
237.11.13 by Teddy Hogeborn
Miscellaneous fixes prompted by lintian:
2058
        # error, or the other end of multiprocessing.Pipe has closed
237.7.125 by Teddy Hogeborn
* mandos (Client.start_checker): Reworded comment.
2059
        if condition & (gobject.IO_ERR | gobject.IO_HUP):
237.11.13 by Teddy Hogeborn
Miscellaneous fixes prompted by lintian:
2060
            # Wait for other process to exit
237.11.11 by Teddy Hogeborn
* mandos (Client.checked_ok): Set "expires" after setting timeout.
2061
            proc.join()
24.1.152 by Björn Påhlsson
bug fixes that prevent problems when runing server as root
2062
            return False
237.4.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
2063
        
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2064
        # Read a request from the child
2065
        request = parent_pipe.recv()
2066
        command = request[0]
2067
        
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2068
        if command == 'init':
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2069
            fpr = request[1]
2070
            address = request[2]
2071
            
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
2072
            for c in self.clients.itervalues():
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2073
                if c.fingerprint == fpr:
2074
                    client = c
2075
                    break
2076
            else:
24.1.174 by Björn Påhlsson
* Makefile (CFLAGS): Added "-lrt" to include real time library.
2077
                logger.info("Client not found for fingerprint: %s, ad"
2078
                            "dress: %s", fpr, address)
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2079
                if self.use_dbus:
2080
                    # Emit D-Bus signal
237.11.3 by Teddy Hogeborn
* mandos: Break long lines.
2081
                    mandos_dbus_service.ClientNotFound(fpr,
2082
                                                       address[0])
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2083
                parent_pipe.send(False)
2084
                return False
2085
            
2086
            gobject.io_add_watch(parent_pipe.fileno(),
2087
                                 gobject.IO_IN | gobject.IO_HUP,
2088
                                 functools.partial(self.handle_ipc,
237.11.3 by Teddy Hogeborn
* mandos: Break long lines.
2089
                                                   parent_pipe =
2090
                                                   parent_pipe,
237.11.11 by Teddy Hogeborn
* mandos (Client.checked_ok): Set "expires" after setting timeout.
2091
                                                   proc = proc,
237.11.3 by Teddy Hogeborn
* mandos: Break long lines.
2092
                                                   client_object =
2093
                                                   client))
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2094
            parent_pipe.send(True)
237.11.3 by Teddy Hogeborn
* mandos: Break long lines.
2095
            # remove the old hook in favor of the new above hook on
2096
            # same fileno
237.4.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
2097
            return False
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2098
        if command == 'funcall':
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2099
            funcname = request[1]
2100
            args = request[2]
2101
            kwargs = request[3]
2102
            
237.11.3 by Teddy Hogeborn
* mandos: Break long lines.
2103
            parent_pipe.send(('data', getattr(client_object,
2104
                                              funcname)(*args,
2105
                                                         **kwargs)))
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
2106
        
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2107
        if command == 'getattr':
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2108
            attrname = request[1]
2109
            if callable(client_object.__getattribute__(attrname)):
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2110
                parent_pipe.send(('function',))
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2111
            else:
237.11.3 by Teddy Hogeborn
* mandos: Break long lines.
2112
                parent_pipe.send(('data', client_object
2113
                                  .__getattribute__(attrname)))
24.2.4 by teddy at bsnet
* mandos (ClientDBus.approvals_pending): Changed to be a property
2114
        
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2115
        if command == 'setattr':
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2116
            attrname = request[1]
2117
            value = request[2]
2118
            setattr(client_object, attrname, value)
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
2119
        
237.4.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
2120
        return True
10 by Teddy Hogeborn
* server.py: Bug fix: Do "from __future__ import division".
2121
3 by Björn Påhlsson
Python based server
2122
237.7.157 by Teddy Hogeborn
* clients.conf: Convert all time intervals to new RFC 3339 syntax.
2123
def rfc3339_duration_to_delta(duration):
2124
    """Parse an RFC 3339 "duration" and return a datetime.timedelta
2125
    
2126
    >>> rfc3339_duration_to_delta("P7D")
2127
    datetime.timedelta(7)
2128
    >>> rfc3339_duration_to_delta("PT60S")
2129
    datetime.timedelta(0, 60)
2130
    >>> rfc3339_duration_to_delta("PT60M")
2131
    datetime.timedelta(0, 3600)
2132
    >>> rfc3339_duration_to_delta("PT24H")
2133
    datetime.timedelta(1)
2134
    >>> rfc3339_duration_to_delta("P1W")
2135
    datetime.timedelta(7)
2136
    >>> rfc3339_duration_to_delta("PT5M30S")
2137
    datetime.timedelta(0, 330)
2138
    >>> rfc3339_duration_to_delta("P1DT3M20S")
2139
    datetime.timedelta(1, 200)
2140
    """
2141
    
2142
    # Parsing an RFC 3339 duration with regular expressions is not
2143
    # possible - there would have to be multiple places for the same
2144
    # values, like seconds.  The current code, while more esoteric, is
2145
    # cleaner without depending on a parsing library.  If Python had a
2146
    # built-in library for parsing we would use it, but we'd like to
2147
    # avoid excessive use of external libraries.
2148
    
2149
    # New type for defining tokens, syntax, and semantics all-in-one
2150
    Token = collections.namedtuple("Token",
2151
                                   ("regexp", # To match token; if
2152
                                              # "value" is not None,
2153
                                              # must have a "group"
2154
                                              # containing digits
2155
                                    "value",  # datetime.timedelta or
2156
                                              # None
2157
                                    "followers")) # Tokens valid after
2158
                                                  # this token
2159
    # RFC 3339 "duration" tokens, syntax, and semantics; taken from
2160
    # the "duration" ABNF definition in RFC 3339, Appendix A.
2161
    token_end = Token(re.compile(r"$"), None, frozenset())
2162
    token_second = Token(re.compile(r"(\d+)S"),
2163
                         datetime.timedelta(seconds=1),
2164
                         frozenset((token_end,)))
2165
    token_minute = Token(re.compile(r"(\d+)M"),
2166
                         datetime.timedelta(minutes=1),
2167
                         frozenset((token_second, token_end)))
2168
    token_hour = Token(re.compile(r"(\d+)H"),
2169
                       datetime.timedelta(hours=1),
2170
                       frozenset((token_minute, token_end)))
2171
    token_time = Token(re.compile(r"T"),
2172
                       None,
2173
                       frozenset((token_hour, token_minute,
2174
                                  token_second)))
2175
    token_day = Token(re.compile(r"(\d+)D"),
2176
                      datetime.timedelta(days=1),
2177
                      frozenset((token_time, token_end)))
2178
    token_month = Token(re.compile(r"(\d+)M"),
2179
                        datetime.timedelta(weeks=4),
2180
                        frozenset((token_day, token_end)))
2181
    token_year = Token(re.compile(r"(\d+)Y"),
2182
                       datetime.timedelta(weeks=52),
2183
                       frozenset((token_month, token_end)))
2184
    token_week = Token(re.compile(r"(\d+)W"),
2185
                       datetime.timedelta(weeks=1),
2186
                       frozenset((token_end,)))
2187
    token_duration = Token(re.compile(r"P"), None,
2188
                           frozenset((token_year, token_month,
2189
                                      token_day, token_time,
2190
                                      token_week))),
2191
    # Define starting values
2192
    value = datetime.timedelta() # Value so far
2193
    found_token = None
2194
    followers = frozenset(token_duration,) # Following valid tokens
2195
    s = duration                # String left to parse
2196
    # Loop until end token is found
2197
    while found_token is not token_end:
2198
        # Search for any currently valid tokens
2199
        for token in followers:
2200
            match = token.regexp.match(s)
2201
            if match is not None:
2202
                # Token found
2203
                if token.value is not None:
2204
                    # Value found, parse digits
2205
                    factor = int(match.group(1), 10)
2206
                    # Add to value so far
2207
                    value += factor * token.value
2208
                # Strip token from string
2209
                s = token.regexp.sub("", s, 1)
2210
                # Go to found token
2211
                found_token = token
2212
                # Set valid next tokens
2213
                followers = found_token.followers
2214
                break
2215
        else:
2216
            # No currently valid tokens were found
2217
            raise ValueError("Invalid RFC 3339 duration")
2218
    # End token found
2219
    return value
2220
2221
4 by Teddy Hogeborn
* server.py (Client.created, Client.next_check): New.
2222
def string_to_delta(interval):
2223
    """Parse a string and return a datetime.timedelta
237.2.53 by Teddy Hogeborn
* mandos (main): Bug fix: Do setgid before setuid. Add verbose GnuTLS
2224
    
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2225
    >>> string_to_delta('7d')
4 by Teddy Hogeborn
* server.py (Client.created, Client.next_check): New.
2226
    datetime.timedelta(7)
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2227
    >>> string_to_delta('60s')
4 by Teddy Hogeborn
* server.py (Client.created, Client.next_check): New.
2228
    datetime.timedelta(0, 60)
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2229
    >>> string_to_delta('60m')
4 by Teddy Hogeborn
* server.py (Client.created, Client.next_check): New.
2230
    datetime.timedelta(0, 3600)
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2231
    >>> string_to_delta('24h')
4 by Teddy Hogeborn
* server.py (Client.created, Client.next_check): New.
2232
    datetime.timedelta(1)
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2233
    >>> string_to_delta('1w')
4 by Teddy Hogeborn
* server.py (Client.created, Client.next_check): New.
2234
    datetime.timedelta(7)
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2235
    >>> string_to_delta('5m 30s')
93 by Teddy Hogeborn
* mandos (string_to_delta): Accept a whitespace-separated sequence of
2236
    datetime.timedelta(0, 330)
4 by Teddy Hogeborn
* server.py (Client.created, Client.next_check): New.
2237
    """
237.7.157 by Teddy Hogeborn
* clients.conf: Convert all time intervals to new RFC 3339 syntax.
2238
    
2239
    try:
2240
        return rfc3339_duration_to_delta(interval)
2241
    except ValueError:
2242
        pass
2243
    
93 by Teddy Hogeborn
* mandos (string_to_delta): Accept a whitespace-separated sequence of
2244
    timevalue = datetime.timedelta(0)
2245
    for s in interval.split():
2246
        try:
215 by Teddy Hogeborn
* mandos: Remove unused "select" module. Import "ctypes.util".
2247
            suffix = unicode(s[-1])
2248
            value = int(s[:-1])
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2249
            if suffix == "d":
93 by Teddy Hogeborn
* mandos (string_to_delta): Accept a whitespace-separated sequence of
2250
                delta = datetime.timedelta(value)
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2251
            elif suffix == "s":
93 by Teddy Hogeborn
* mandos (string_to_delta): Accept a whitespace-separated sequence of
2252
                delta = datetime.timedelta(0, value)
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2253
            elif suffix == "m":
93 by Teddy Hogeborn
* mandos (string_to_delta): Accept a whitespace-separated sequence of
2254
                delta = datetime.timedelta(0, 0, 0, 0, value)
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2255
            elif suffix == "h":
93 by Teddy Hogeborn
* mandos (string_to_delta): Accept a whitespace-separated sequence of
2256
                delta = datetime.timedelta(0, 0, 0, 0, 0, value)
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2257
            elif suffix == "w":
93 by Teddy Hogeborn
* mandos (string_to_delta): Accept a whitespace-separated sequence of
2258
                delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
2259
            else:
237.7.116 by Teddy Hogeborn
* mandos-monitor: Use new string format method.
2260
                raise ValueError("Unknown suffix {0!r}"
2261
                                 .format(suffix))
237.7.190 by Teddy Hogeborn
Syntax fix; use "raise" better in Mandos server.
2262
        except IndexError as e:
237.7.12 by Teddy Hogeborn
* debian/mandos-client.postrm (purge): Bug fix: update initramfs also
2263
            raise ValueError(*(e.args))
93 by Teddy Hogeborn
* mandos (string_to_delta): Accept a whitespace-separated sequence of
2264
        timevalue += delta
2265
    return timevalue
4 by Teddy Hogeborn
* server.py (Client.created, Client.next_check): New.
2266
8 by Teddy Hogeborn
* Makefile (client_debug): Bug fix; add quotes and / to CERT_ROOT.
2267
47 by Teddy Hogeborn
* plugbasedclient.c: Renamed to "mandos-client.c". All users changed.
2268
def daemon(nochdir = False, noclose = False):
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
2269
    """See daemon(3).  Standard BSD Unix function.
237.2.94 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
2270
    
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
2271
    This should really exist as os.daemon, but it doesn't (yet)."""
2272
    if os.fork():
2273
        sys.exit()
2274
    os.setsid()
2275
    if not nochdir:
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2276
        os.chdir("/")
46 by Teddy Hogeborn
* network-protocol.txt: New.
2277
    if os.fork():
2278
        sys.exit()
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
2279
    if not noclose:
2280
        # Close all standard open file descriptors
237.18.1 by teddy at recompile
* mandos: Use os.devnull instead of os.path.devnull. Fix some white
2281
        null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
2282
        if not stat.S_ISCHR(os.fstat(null).st_mode):
2283
            raise OSError(errno.ENODEV,
237.7.116 by Teddy Hogeborn
* mandos-monitor: Use new string format method.
2284
                          "{0} not a character device"
2285
                          .format(os.devnull))
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
2286
        os.dup2(null, sys.stdin.fileno())
2287
        os.dup2(null, sys.stdout.fileno())
2288
        os.dup2(null, sys.stderr.fileno())
2289
        if null > 2:
2290
            os.close(null)
2291
2292
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
2293
def main():
237.2.90 by Teddy Hogeborn
Merge from pipe IPC branch.
2294
    
237.2.142 by Teddy Hogeborn
* mandos: Fix line lengths.
2295
    ##################################################################
237.2.90 by Teddy Hogeborn
Merge from pipe IPC branch.
2296
    # Parsing of options, both command line and config file
2297
    
237.7.22 by teddy at bsnet
* mandos: Use the new argparse library instead of optparse.
2298
    parser = argparse.ArgumentParser()
2299
    parser.add_argument("-v", "--version", action="version",
237.7.116 by Teddy Hogeborn
* mandos-monitor: Use new string format method.
2300
                        version = "%(prog)s {0}".format(version),
237.7.22 by teddy at bsnet
* mandos: Use the new argparse library instead of optparse.
2301
                        help="show version number and exit")
2302
    parser.add_argument("-i", "--interface", metavar="IF",
2303
                        help="Bind to interface IF")
2304
    parser.add_argument("-a", "--address",
2305
                        help="Address to listen for requests on")
2306
    parser.add_argument("-p", "--port", type=int,
2307
                        help="Port number to receive requests on")
2308
    parser.add_argument("--check", action="store_true",
2309
                        help="Run self-test")
2310
    parser.add_argument("--debug", action="store_true",
2311
                        help="Debug mode; run in foreground and log"
237.7.166 by Teddy Hogeborn
* mandos: Bug fix: Make boolean options work from the config file
2312
                        " to terminal", default=None)
237.7.22 by teddy at bsnet
* mandos: Use the new argparse library instead of optparse.
2313
    parser.add_argument("--debuglevel", metavar="LEVEL",
2314
                        help="Debug level for stdout output")
2315
    parser.add_argument("--priority", help="GnuTLS"
2316
                        " priority string (see GnuTLS documentation)")
2317
    parser.add_argument("--servicename",
2318
                        metavar="NAME", help="Zeroconf service name")
2319
    parser.add_argument("--configdir",
2320
                        default="/etc/mandos", metavar="DIR",
2321
                        help="Directory to search for configuration"
2322
                        " files")
2323
    parser.add_argument("--no-dbus", action="store_false",
2324
                        dest="use_dbus", help="Do not provide D-Bus"
237.7.166 by Teddy Hogeborn
* mandos: Bug fix: Make boolean options work from the config file
2325
                        " system bus interface", default=None)
237.7.22 by teddy at bsnet
* mandos: Use the new argparse library instead of optparse.
2326
    parser.add_argument("--no-ipv6", action="store_false",
237.7.166 by Teddy Hogeborn
* mandos: Bug fix: Make boolean options work from the config file
2327
                        dest="use_ipv6", help="Do not use IPv6",
2328
                        default=None)
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
2329
    parser.add_argument("--no-restore", action="store_false",
237.12.7 by Teddy Hogeborn
* mandos: Break long lines and fix some more white space.
2330
                        dest="restore", help="Do not restore stored"
237.7.166 by Teddy Hogeborn
* mandos: Bug fix: Make boolean options work from the config file
2331
                        " state", default=None)
237.21.1 by Teddy Hogeborn
* mandos: Implement "--socket" option.
2332
    parser.add_argument("--socket", type=int,
2333
                        help="Specify a file descriptor to a network"
2334
                        " socket to use instead of creating one")
237.14.2 by Teddy Hogeborn
Directory with persistent state can now be changed with the "statedir"
2335
    parser.add_argument("--statedir", metavar="DIR",
2336
                        help="Directory to save/restore state in")
237.7.154 by Teddy Hogeborn
* mandos: New "--foreground" option.
2337
    parser.add_argument("--foreground", action="store_true",
237.7.166 by Teddy Hogeborn
* mandos: Bug fix: Make boolean options work from the config file
2338
                        help="Run in foreground", default=None)
237.12.6 by Teddy Hogeborn
* mandos: Fix whitespace.
2339
    
237.7.22 by teddy at bsnet
* mandos: Use the new argparse library instead of optparse.
2340
    options = parser.parse_args()
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
2341
    
4 by Teddy Hogeborn
* server.py (Client.created, Client.next_check): New.
2342
    if options.check:
2343
        import doctest
237.7.202 by Teddy Hogeborn
Fix running of self-tests.
2344
        fail_count, test_count = doctest.testmod()
2345
        sys.exit(os.EX_OK if fail_count == 0 else 1)
3 by Björn Påhlsson
Python based server
2346
    
28 by Teddy Hogeborn
* server.conf: New file.
2347
    # Default values for config file for server-global settings
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2348
    server_defaults = { "interface": "",
2349
                        "address": "",
2350
                        "port": "",
2351
                        "debug": "False",
2352
                        "priority":
237.7.179 by Teddy Hogeborn
* mandos (priority): Bug fix: Add even more magic to make the old
2353
                        "SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2354
                        "servicename": "Mandos",
2355
                        "use_dbus": "True",
2356
                        "use_ipv6": "True",
2357
                        "debuglevel": "",
237.14.2 by Teddy Hogeborn
Directory with persistent state can now be changed with the "statedir"
2358
                        "restore": "True",
237.21.1 by Teddy Hogeborn
* mandos: Implement "--socket" option.
2359
                        "socket": "",
237.7.154 by Teddy Hogeborn
* mandos: New "--foreground" option.
2360
                        "statedir": "/var/lib/mandos",
2361
                        "foreground": "False",
28 by Teddy Hogeborn
* server.conf: New file.
2362
                        }
2363
    
2364
    # Parse config file for server-global settings
237.2.98 by Teddy Hogeborn
* mandos: Import "SocketServer" as "socketserver" and "ConfigParser"
2365
    server_config = configparser.SafeConfigParser(server_defaults)
28 by Teddy Hogeborn
* server.conf: New file.
2366
    del server_defaults
237.2.96 by Teddy Hogeborn
Minor code cleanup; one minor bug fix.
2367
    server_config.read(os.path.join(options.configdir,
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2368
                                    "mandos.conf"))
28 by Teddy Hogeborn
* server.conf: New file.
2369
    # Convert the SafeConfigParser object to a dict
89 by Teddy Hogeborn
* Makefile: Bug fix: fixed creation of man pages for section 5 pages.
2370
    server_settings = server_config.defaults()
237.2.45 by Teddy Hogeborn
* mandos (main): Bug fix: use "getint" on the "port" config file
2371
    # Use the appropriate methods on the non-string config options
237.7.154 by Teddy Hogeborn
* mandos: New "--foreground" option.
2372
    for option in ("debug", "use_dbus", "use_ipv6", "foreground"):
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2373
        server_settings[option] = server_config.getboolean("DEFAULT",
237.2.96 by Teddy Hogeborn
Minor code cleanup; one minor bug fix.
2374
                                                           option)
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2375
    if server_settings["port"]:
2376
        server_settings["port"] = server_config.getint("DEFAULT",
2377
                                                       "port")
237.21.1 by Teddy Hogeborn
* mandos: Implement "--socket" option.
2378
    if server_settings["socket"]:
2379
        server_settings["socket"] = server_config.getint("DEFAULT",
2380
                                                         "socket")
237.7.139 by Teddy Hogeborn
Merge "--socket" option for server.
2381
        # Later, stdin will, and stdout and stderr might, be dup'ed
237.21.1 by Teddy Hogeborn
* mandos: Implement "--socket" option.
2382
        # over with an opened os.devnull.  But we don't want this to
2383
        # happen with a supplied network socket.
2384
        if 0 <= server_settings["socket"] <= 2:
2385
            server_settings["socket"] = os.dup(server_settings
2386
                                               ["socket"])
28 by Teddy Hogeborn
* server.conf: New file.
2387
    del server_config
2388
    
2389
    # Override the settings from the config file with command line
2390
    # options, if set.
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2391
    for option in ("interface", "address", "port", "debug",
2392
                   "priority", "servicename", "configdir",
237.14.2 by Teddy Hogeborn
Directory with persistent state can now be changed with the "statedir"
2393
                   "use_dbus", "use_ipv6", "debuglevel", "restore",
237.7.154 by Teddy Hogeborn
* mandos: New "--foreground" option.
2394
                   "statedir", "socket", "foreground"):
28 by Teddy Hogeborn
* server.conf: New file.
2395
        value = getattr(options, option)
2396
        if value is not None:
2397
            server_settings[option] = value
2398
    del options
237.2.96 by Teddy Hogeborn
Minor code cleanup; one minor bug fix.
2399
    # Force all strings to be unicode
2400
    for option in server_settings.keys():
2401
        if type(server_settings[option]) is str:
2402
            server_settings[option] = unicode(server_settings[option])
237.7.166 by Teddy Hogeborn
* mandos: Bug fix: Make boolean options work from the config file
2403
    # Force all boolean options to be boolean
2404
    for option in ("debug", "use_dbus", "use_ipv6", "restore",
2405
                   "foreground"):
2406
        server_settings[option] = bool(server_settings[option])
237.7.154 by Teddy Hogeborn
* mandos: New "--foreground" option.
2407
    # Debug implies foreground
2408
    if server_settings["debug"]:
2409
        server_settings["foreground"] = True
28 by Teddy Hogeborn
* server.conf: New file.
2410
    # Now we have our good server settings in "server_settings"
2411
    
237.2.90 by Teddy Hogeborn
Merge from pipe IPC branch.
2412
    ##################################################################
2413
    
237.2.6 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
2414
    # For convenience
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2415
    debug = server_settings["debug"]
2416
    debuglevel = server_settings["debuglevel"]
2417
    use_dbus = server_settings["use_dbus"]
2418
    use_ipv6 = server_settings["use_ipv6"]
237.14.2 by Teddy Hogeborn
Directory with persistent state can now be changed with the "statedir"
2419
    stored_state_path = os.path.join(server_settings["statedir"],
2420
                                     stored_state_file)
237.7.154 by Teddy Hogeborn
* mandos: New "--foreground" option.
2421
    foreground = server_settings["foreground"]
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
2422
    
237.12.4 by Björn Påhlsson
restructured logger
2423
    if debug:
237.7.78 by teddy at bsnet
* mandos (initlogger): Take new "debug" argument; all callers changed.
2424
        initlogger(debug, logging.DEBUG)
237.12.4 by Björn Påhlsson
restructured logger
2425
    else:
2426
        if not debuglevel:
237.7.78 by teddy at bsnet
* mandos (initlogger): Take new "debug" argument; all callers changed.
2427
            initlogger(debug)
237.12.4 by Björn Påhlsson
restructured logger
2428
        else:
2429
            level = getattr(logging, debuglevel.upper())
237.7.78 by teddy at bsnet
* mandos (initlogger): Take new "debug" argument; all callers changed.
2430
            initlogger(debug, level)
237.12.4 by Björn Påhlsson
restructured logger
2431
    
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2432
    if server_settings["servicename"] != "Mandos":
237.1.2 by Teddy Hogeborn
Further steps towards a D-Bus server interface, plus minor syntax
2433
        syslogger.setFormatter(logging.Formatter
237.7.116 by Teddy Hogeborn
* mandos-monitor: Use new string format method.
2434
                               ('Mandos ({0}) [%(process)d]:'
2435
                                ' %(levelname)s: %(message)s'
2436
                                .format(server_settings
2437
                                        ["servicename"])))
52 by Teddy Hogeborn
* mandos: Make syslog use "/dev/log" instead of UDP to localhost.
2438
    
28 by Teddy Hogeborn
* server.conf: New file.
2439
    # Parse config file with clients
237.7.91 by Teddy Hogeborn
* mandos: Break some long lines.
2440
    client_config = configparser.SafeConfigParser(Client
2441
                                                  .client_defaults)
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2442
    client_config.read(os.path.join(server_settings["configdir"],
2443
                                    "clients.conf"))
237.2.96 by Teddy Hogeborn
Minor code cleanup; one minor bug fix.
2444
    
237.2.90 by Teddy Hogeborn
Merge from pipe IPC branch.
2445
    global mandos_dbus_service
2446
    mandos_dbus_service = None
28 by Teddy Hogeborn
* server.conf: New file.
2447
    
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2448
    tcp_server = MandosServer((server_settings["address"],
2449
                               server_settings["port"]),
237.2.102 by Teddy Hogeborn
Code cleanup.
2450
                              ClientHandler,
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2451
                              interface=(server_settings["interface"]
269.1.3 by teddy at bsnet
* mandos (main): Bug fix: Don't try to bind to an empty string
2452
                                         or None),
237.2.102 by Teddy Hogeborn
Code cleanup.
2453
                              use_ipv6=use_ipv6,
2454
                              gnutls_priority=
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2455
                              server_settings["priority"],
237.21.1 by Teddy Hogeborn
* mandos: Implement "--socket" option.
2456
                              use_dbus=use_dbus,
2457
                              socketfd=(server_settings["socket"]
2458
                                        or None))
237.7.154 by Teddy Hogeborn
* mandos: New "--foreground" option.
2459
    if not foreground:
237.7.174 by Teddy Hogeborn
* Makefile (CFLAGS, LDFLAGS): Keep default flags from environment.
2460
        pidfilename = "/run/mandos.pid"
237.7.184 by Teddy Hogeborn
Fall back to /var/run for pidfile if /run is not a directory.
2461
        if not os.path.isdir("/run/."):
2462
            pidfilename = "/var/run/mandos.pid"
237.7.154 by Teddy Hogeborn
* mandos: New "--foreground" option.
2463
        pidfile = None
237.2.202 by Teddy Hogeborn
* mandos: Do not write pid file if --debug is passed.
2464
        try:
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2465
            pidfile = open(pidfilename, "w")
237.7.122 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
2466
        except IOError as e:
2467
            logger.error("Could not open file %r", pidfilename,
2468
                         exc_info=e)
164 by Teddy Hogeborn
* mandos: Open the PID file before daemonizing, but write to it
2469
    
237.7.114 by Teddy Hogeborn
* mandos (main): Simplify and shorten code selecting user and group ID
2470
    for name in ("_mandos", "mandos", "nobody"):
237.2.1 by Teddy Hogeborn
First version of a somewhat complete D-Bus server interface. Also
2471
        try:
237.7.114 by Teddy Hogeborn
* mandos (main): Simplify and shorten code selecting user and group ID
2472
            uid = pwd.getpwnam(name).pw_uid
2473
            gid = pwd.getpwnam(name).pw_gid
2474
            break
237.2.1 by Teddy Hogeborn
First version of a somewhat complete D-Bus server interface. Also
2475
        except KeyError:
237.7.114 by Teddy Hogeborn
* mandos (main): Simplify and shorten code selecting user and group ID
2476
            continue
2477
    else:
2478
        uid = 65534
2479
        gid = 65534
163 by Teddy Hogeborn
* Makefile (PIDDIR, USER, GROUP): Removed.
2480
    try:
237.2.53 by Teddy Hogeborn
* mandos (main): Bug fix: Do setgid before setuid. Add verbose GnuTLS
2481
        os.setgid(gid)
163 by Teddy Hogeborn
* Makefile (PIDDIR, USER, GROUP): Removed.
2482
        os.setuid(uid)
237.7.30 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
2483
    except OSError as error:
237.7.131 by Teddy Hogeborn
* mandos (Client.start_checker): Remove undocumented support for "%%s"
2484
        if error.errno != errno.EPERM:
237.7.190 by Teddy Hogeborn
Syntax fix; use "raise" better in Mandos server.
2485
            raise
164 by Teddy Hogeborn
* mandos: Open the PID file before daemonizing, but write to it
2486
    
237.2.53 by Teddy Hogeborn
* mandos (main): Bug fix: Do setgid before setuid. Add verbose GnuTLS
2487
    if debug:
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2488
        # Enable all possible GnuTLS debugging
2489
        
237.2.53 by Teddy Hogeborn
* mandos (main): Bug fix: Do setgid before setuid. Add verbose GnuTLS
2490
        # "Use a log level over 10 to enable all debugging options."
2491
        # - GnuTLS manual
2492
        gnutls.library.functions.gnutls_global_set_log_level(11)
2493
        
2494
        @gnutls.library.types.gnutls_log_func
2495
        def debug_gnutls(level, string):
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2496
            logger.debug("GnuTLS: %s", string[:-1])
237.2.53 by Teddy Hogeborn
* mandos (main): Bug fix: Do setgid before setuid. Add verbose GnuTLS
2497
        
2498
        (gnutls.library.functions
2499
         .gnutls_global_set_log_function(debug_gnutls))
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2500
        
24.1.155 by Björn Påhlsson
mandos server: Added debuglevel that adjust at what level information
2501
        # Redirect stdin so all checkers get /dev/null
237.18.1 by teddy at recompile
* mandos: Use os.devnull instead of os.path.devnull. Fix some white
2502
        null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
24.1.155 by Björn Påhlsson
mandos server: Added debuglevel that adjust at what level information
2503
        os.dup2(null, sys.stdin.fileno())
2504
        if null > 2:
2505
            os.close(null)
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2506
    
237.7.6 by teddy at bsnet
* mandos (main): Bug fix: Fork before connecting to D-Bus.
2507
    # Need to fork before connecting to D-Bus
237.7.154 by Teddy Hogeborn
* mandos: New "--foreground" option.
2508
    if not foreground:
237.7.6 by teddy at bsnet
* mandos (main): Bug fix: Fork before connecting to D-Bus.
2509
        # Close all input and output, do double fork, etc.
2510
        daemon()
237.2.53 by Teddy Hogeborn
* mandos (main): Bug fix: Do setgid before setuid. Add verbose GnuTLS
2511
    
237.7.138 by Teddy Hogeborn
* mandos: Change comment.
2512
    # multiprocessing will use threads, so before we use gobject we
2513
    # need to inform gobject that threads will be used.
237.14.11 by Teddy Hogeborn
* mandos (main): Tell gobject we're (or, rather, multiprocessing is)
2514
    gobject.threads_init()
2515
    
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
2516
    global main_loop
2517
    # From the Avahi example code
237.18.1 by teddy at recompile
* mandos: Use os.devnull instead of os.path.devnull. Fix some white
2518
    DBusGMainLoop(set_as_default=True)
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
2519
    main_loop = gobject.MainLoop()
2520
    bus = dbus.SystemBus()
2521
    # End of Avahi example code
237.2.6 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
2522
    if use_dbus:
237.2.165 by Teddy Hogeborn
* mandos (Client.disable): Rename keyword argument "log" to "quiet",
2523
        try:
237.7.53 by Björn Påhlsson
The domain name has changed, so the D-Bus bus and interface names must
2524
            bus_name = dbus.service.BusName("se.recompile.Mandos",
237.2.165 by Teddy Hogeborn
* mandos (Client.disable): Rename keyword argument "log" to "quiet",
2525
                                            bus, do_not_queue=True)
237.11.3 by Teddy Hogeborn
* mandos: Break long lines.
2526
            old_bus_name = (dbus.service.BusName
2527
                            ("se.bsnet.fukt.Mandos", bus,
2528
                             do_not_queue=True))
237.7.30 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
2529
        except dbus.exceptions.NameExistsException as e:
237.7.122 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
2530
            logger.error("Disabling D-Bus:", exc_info=e)
237.2.165 by Teddy Hogeborn
* mandos (Client.disable): Rename keyword argument "log" to "quiet",
2531
            use_dbus = False
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2532
            server_settings["use_dbus"] = False
237.2.165 by Teddy Hogeborn
* mandos (Client.disable): Rename keyword argument "log" to "quiet",
2533
            tcp_server.use_dbus = False
237.2.100 by Teddy Hogeborn
Code cleanup. Move some global stuff into main.
2534
    protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
237.11.20 by Teddy Hogeborn
* Makefile (run-server): Remove obsolete warning.
2535
    service = AvahiServiceToSyslog(name =
2536
                                   server_settings["servicename"],
2537
                                   servicetype = "_mandos._tcp",
2538
                                   protocol = protocol, bus = bus)
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2539
    if server_settings["interface"]:
237.2.100 by Teddy Hogeborn
Code cleanup. Move some global stuff into main.
2540
        service.interface = (if_nametoindex
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2541
                             (str(server_settings["interface"])))
237.7.6 by teddy at bsnet
* mandos (main): Bug fix: Fork before connecting to D-Bus.
2542
    
24.1.152 by Björn Påhlsson
bug fixes that prevent problems when runing server as root
2543
    global multiprocessing_manager
2544
    multiprocessing_manager = multiprocessing.Manager()
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
2545
    
237.2.91 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
2546
    client_class = Client
2547
    if use_dbus:
237.7.123 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
2548
        client_class = functools.partial(ClientDBus, bus = bus)
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
2549
    
237.12.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
2550
    client_settings = Client.config_parser(client_config)
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
2551
    old_client_settings = {}
237.12.15 by Björn Påhlsson
more refactoring in regards to how clients get created
2552
    clients_data = {}
237.12.6 by Teddy Hogeborn
* mandos: Fix whitespace.
2553
    
237.7.165 by Teddy Hogeborn
* mandos: Bug fix: Don't print output from checkers when running in
2554
    # This is used to redirect stdout and stderr for checker processes
2555
    global wnull
2556
    wnull = open(os.devnull, "w") # A writable /dev/null
2557
    # Only used if server is running in foreground but not in debug
2558
    # mode
2559
    if debug or not foreground:
2560
        wnull.close()
2561
    
237.12.7 by Teddy Hogeborn
* mandos: Break long lines and fix some more white space.
2562
    # Get client data and settings from last running state.
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
2563
    if server_settings["restore"]:
2564
        try:
2565
            with open(stored_state_path, "rb") as stored_state:
237.12.7 by Teddy Hogeborn
* mandos: Break long lines and fix some more white space.
2566
                clients_data, old_client_settings = (pickle.load
2567
                                                     (stored_state))
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
2568
            os.remove(stored_state_path)
2569
        except IOError as e:
237.7.122 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
2570
            if e.errno == errno.ENOENT:
2571
                logger.warning("Could not load persistent state: {0}"
2572
                                .format(os.strerror(e.errno)))
2573
            else:
2574
                logger.critical("Could not load persistent state:",
2575
                                exc_info=e)
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
2576
                raise
237.11.23 by Teddy Hogeborn
* mandos (main): Handle EOFError when reading state file.
2577
        except EOFError as e:
2578
            logger.warning("Could not load persistent state: "
237.7.122 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
2579
                           "EOFError:", exc_info=e)
237.12.6 by Teddy Hogeborn
* mandos: Fix whitespace.
2580
    
237.12.9 by Björn Påhlsson
renamed variables
2581
    with PGPEngine() as pgp:
237.12.15 by Björn Påhlsson
more refactoring in regards to how clients get created
2582
        for client_name, client in clients_data.iteritems():
237.7.165 by Teddy Hogeborn
* mandos: Bug fix: Don't print output from checkers when running in
2583
            # Skip removed clients
2584
            if client_name not in client_settings:
2585
                continue
2586
            
237.14.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
2587
            # Decide which value to use after restoring saved state.
2588
            # We have three different values: Old config file,
2589
            # new config file, and saved state.
2590
            # New config value takes precedence if it differs from old
2591
            # config value, otherwise use saved state.
2592
            for name, value in client_settings[client_name].items():
2593
                try:
2594
                    # For each value in new config, check if it
2595
                    # differs from the old config value (Except for
2596
                    # the "secret" attribute)
2597
                    if (name != "secret" and
2598
                        value != old_client_settings[client_name]
2599
                        [name]):
237.14.10 by Teddy Hogeborn
* mandos (main): Bug fix: Syntax fix when restoring settings.
2600
                        client[name] = value
237.14.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
2601
                except KeyError:
2602
                    pass
2603
            
2604
            # Clients who has passed its expire date can still be
237.12.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
2605
            # enabled if its last checker was successful.  Clients
237.7.100 by teddy at recompile
* mandos: Consistent terminology; use the term "secret" for the
2606
            # whose checker succeeded before we stored its state is
2607
            # assumed to have successfully run all checkers during
2608
            # downtime.
237.14.8 by Teddy Hogeborn
* mandos (ClientDBus.Host_dbus_property,
2609
            if client["enabled"]:
237.12.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
2610
                if datetime.datetime.utcnow() >= client["expires"]:
2611
                    if not client["last_checked_ok"]:
2612
                        logger.warning(
2613
                            "disabling client {0} - Client never "
237.7.100 by teddy at recompile
* mandos: Consistent terminology; use the term "secret" for the
2614
                            "performed a successful checker"
2615
                            .format(client_name))
237.12.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
2616
                        client["enabled"] = False
2617
                    elif client["last_checker_status"] != 0:
2618
                        logger.warning(
2619
                            "disabling client {0} - Client "
2620
                            "last checker failed with error code {1}"
237.7.100 by teddy at recompile
* mandos: Consistent terminology; use the term "secret" for the
2621
                            .format(client_name,
237.12.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
2622
                                    client["last_checker_status"]))
237.14.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
2623
                        client["enabled"] = False
2624
                    else:
2625
                        client["expires"] = (datetime.datetime
2626
                                             .utcnow()
2627
                                             + client["timeout"])
237.7.90 by Björn Påhlsson
fixed bug with bad stored config state for expires and last_checked_ok.
2628
                        logger.debug("Last checker succeeded,"
2629
                                     " keeping {0} enabled"
237.7.100 by teddy at recompile
* mandos: Consistent terminology; use the term "secret" for the
2630
                                     .format(client_name))
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2631
            try:
237.12.15 by Björn Påhlsson
more refactoring in regards to how clients get created
2632
                client["secret"] = (
2633
                    pgp.decrypt(client["encrypted_secret"],
237.12.9 by Björn Påhlsson
renamed variables
2634
                                client_settings[client_name]
2635
                                ["secret"]))
2636
            except PGPError:
237.14.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
2637
                # If decryption fails, we use secret from new settings
237.12.10 by Björn Påhlsson
added warning text when failing to decrypt old state
2638
                logger.debug("Failed to decrypt {0} old secret"
2639
                             .format(client_name))
237.12.15 by Björn Påhlsson
more refactoring in regards to how clients get created
2640
                client["secret"] = (
237.14.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
2641
                    client_settings[client_name]["secret"])
2642
    
237.12.15 by Björn Påhlsson
more refactoring in regards to how clients get created
2643
    # Add/remove clients based on new changes made to config
237.7.91 by Teddy Hogeborn
* mandos: Break some long lines.
2644
    for client_name in (set(old_client_settings)
2645
                        - set(client_settings)):
237.12.15 by Björn Påhlsson
more refactoring in regards to how clients get created
2646
        del clients_data[client_name]
237.7.91 by Teddy Hogeborn
* mandos: Break some long lines.
2647
    for client_name in (set(client_settings)
2648
                        - set(old_client_settings)):
237.12.15 by Björn Påhlsson
more refactoring in regards to how clients get created
2649
        clients_data[client_name] = client_settings[client_name]
237.7.121 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
2650
    
237.7.100 by teddy at recompile
* mandos: Consistent terminology; use the term "secret" for the
2651
    # Create all client objects
237.12.15 by Björn Påhlsson
more refactoring in regards to how clients get created
2652
    for client_name, client in clients_data.iteritems():
2653
        tcp_server.clients[client_name] = client_class(
237.7.165 by Teddy Hogeborn
* mandos: Bug fix: Don't print output from checkers when running in
2654
            name = client_name, settings = client,
2655
            server_settings = server_settings)
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2656
    
237.2.104 by Teddy Hogeborn
Code cleanup and one bug fix.
2657
    if not tcp_server.clients:
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2658
        logger.warning("No clients defined")
237.7.121 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
2659
    
237.7.154 by Teddy Hogeborn
* mandos: New "--foreground" option.
2660
    if not foreground:
2661
        if pidfile is not None:
2662
            try:
2663
                with pidfile:
2664
                    pid = os.getpid()
2665
                    pidfile.write(str(pid) + "\n".encode("utf-8"))
2666
            except IOError:
2667
                logger.error("Could not write to file %r with PID %d",
2668
                             pidfilename, pid)
2669
        del pidfile
237.2.202 by Teddy Hogeborn
* mandos: Do not write pid file if --debug is passed.
2670
        del pidfilename
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
2671
    
28 by Teddy Hogeborn
* server.conf: New file.
2672
    signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2673
    signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
2674
    
237.2.6 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
2675
    if use_dbus:
237.7.123 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
2676
        @alternate_dbus_interfaces({"se.recompile.Mandos":
2677
                                        "se.bsnet.fukt.Mandos"})
237.18.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
2678
        class MandosDBusService(DBusObjectWithProperties):
237.2.6 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
2679
            """A D-Bus proxy object"""
2680
            def __init__(self):
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2681
                dbus.service.Object.__init__(self, bus, "/")
237.11.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
2682
            _interface = "se.recompile.Mandos"
237.2.41 by Teddy Hogeborn
* mandos (Client.GetAllProperties): Also send Client.dbus_object_path
2683
            
237.18.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
2684
            @dbus_interface_annotations(_interface)
2685
            def _foo(self):
2686
                return { "org.freedesktop.DBus.Property"
2687
                         ".EmitsChangedSignal":
2688
                             "false"}
2689
            
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2690
            @dbus.service.signal(_interface, signature="o")
237.2.174 by Teddy Hogeborn
More consistent terminology: Clients are no longer "invalid" - they
2691
            def ClientAdded(self, objpath):
237.2.6 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
2692
                "D-Bus signal"
2693
                pass
237.2.41 by Teddy Hogeborn
* mandos (Client.GetAllProperties): Also send Client.dbus_object_path
2694
            
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2695
            @dbus.service.signal(_interface, signature="ss")
237.2.172 by Teddy Hogeborn
* mandos (MandosServer.handle_ipc): Better log message.
2696
            def ClientNotFound(self, fingerprint, address):
237.2.90 by Teddy Hogeborn
Merge from pipe IPC branch.
2697
                "D-Bus signal"
2698
                pass
2699
            
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2700
            @dbus.service.signal(_interface, signature="os")
237.2.41 by Teddy Hogeborn
* mandos (Client.GetAllProperties): Also send Client.dbus_object_path
2701
            def ClientRemoved(self, objpath, name):
237.2.6 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
2702
                "D-Bus signal"
2703
                pass
237.2.41 by Teddy Hogeborn
* mandos (Client.GetAllProperties): Also send Client.dbus_object_path
2704
            
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2705
            @dbus.service.method(_interface, out_signature="ao")
237.2.6 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
2706
            def GetAllClients(self):
237.2.46 by Teddy Hogeborn
* mandos (peer_certificate): Handle NULL pointer from
2707
                "D-Bus method"
237.2.104 by Teddy Hogeborn
Code cleanup and one bug fix.
2708
                return dbus.Array(c.dbus_object_path
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
2709
                                  for c in
2710
                                  tcp_server.clients.itervalues())
237.2.41 by Teddy Hogeborn
* mandos (Client.GetAllProperties): Also send Client.dbus_object_path
2711
            
237.2.96 by Teddy Hogeborn
Minor code cleanup; one minor bug fix.
2712
            @dbus.service.method(_interface,
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2713
                                 out_signature="a{oa{sv}}")
237.2.6 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
2714
            def GetAllClientsWithProperties(self):
237.2.46 by Teddy Hogeborn
* mandos (peer_certificate): Handle NULL pointer from
2715
                "D-Bus method"
237.2.6 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
2716
                return dbus.Dictionary(
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2717
                    ((c.dbus_object_path, c.GetAll(""))
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
2718
                     for c in tcp_server.clients.itervalues()),
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2719
                    signature="oa{sv}")
237.2.41 by Teddy Hogeborn
* mandos (Client.GetAllProperties): Also send Client.dbus_object_path
2720
            
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2721
            @dbus.service.method(_interface, in_signature="o")
237.2.6 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
2722
            def RemoveClient(self, object_path):
237.2.46 by Teddy Hogeborn
* mandos (peer_certificate): Handle NULL pointer from
2723
                "D-Bus method"
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
2724
                for c in tcp_server.clients.itervalues():
237.2.6 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
2725
                    if c.dbus_object_path == object_path:
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
2726
                        del tcp_server.clients[c.name]
237.2.91 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
2727
                        c.remove_from_connection()
237.2.6 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
2728
                        # Don't signal anything except ClientRemoved
237.2.165 by Teddy Hogeborn
* mandos (Client.disable): Rename keyword argument "log" to "quiet",
2729
                        c.disable(quiet=True)
237.2.6 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
2730
                        # Emit D-Bus signal
237.2.41 by Teddy Hogeborn
* mandos (Client.GetAllProperties): Also send Client.dbus_object_path
2731
                        self.ClientRemoved(object_path, c.name)
2732
                        return
237.2.163 by Teddy Hogeborn
* mandos (Client.enable): Bug fix: Start new immediate checker last to
2733
                raise KeyError(object_path)
237.2.41 by Teddy Hogeborn
* mandos (Client.GetAllProperties): Also send Client.dbus_object_path
2734
            
237.2.6 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
2735
            del _interface
237.2.41 by Teddy Hogeborn
* mandos (Client.GetAllProperties): Also send Client.dbus_object_path
2736
        
237.7.123 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
2737
        mandos_dbus_service = MandosDBusService()
237.2.1 by Teddy Hogeborn
First version of a somewhat complete D-Bus server interface. Also
2738
    
237.2.163 by Teddy Hogeborn
* mandos (Client.enable): Bug fix: Start new immediate checker last to
2739
    def cleanup():
2740
        "Cleanup function; run on exit"
2741
        service.cleanup()
2742
        
237.11.11 by Teddy Hogeborn
* mandos (Client.checked_ok): Set "expires" after setting timeout.
2743
        multiprocessing.active_children()
237.7.165 by Teddy Hogeborn
* mandos: Bug fix: Don't print output from checkers when running in
2744
        wnull.close()
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
2745
        if not (tcp_server.clients or client_settings):
2746
            return
237.12.6 by Teddy Hogeborn
* mandos: Fix whitespace.
2747
        
237.7.69 by teddy at bsnet
* debian/control (mandos/Depends): Added "python-crypto".
2748
        # Store client before exiting. Secrets are encrypted with key
2749
        # based on what config file has. If config file is
2750
        # removed/edited, old secret will thus be unrecovable.
237.12.15 by Björn Påhlsson
more refactoring in regards to how clients get created
2751
        clients = {}
237.12.9 by Björn Påhlsson
renamed variables
2752
        with PGPEngine() as pgp:
237.14.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
2753
            for client in tcp_server.clients.itervalues():
2754
                key = client_settings[client.name]["secret"]
237.12.9 by Björn Påhlsson
renamed variables
2755
                client.encrypted_secret = pgp.encrypt(client.secret,
2756
                                                      key)
237.14.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
2757
                client_dict = {}
2758
                
237.12.15 by Björn Påhlsson
more refactoring in regards to how clients get created
2759
                # A list of attributes that can not be pickled
2760
                # + secret.
237.12.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
2761
                exclude = set(("bus", "changedstate", "secret",
237.7.165 by Teddy Hogeborn
* mandos: Bug fix: Don't print output from checkers when running in
2762
                               "checker", "server_settings"))
237.14.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
2763
                for name, typ in (inspect.getmembers
2764
                                  (dbus.service.Object)):
2765
                    exclude.add(name)
2766
                
2767
                client_dict["encrypted_secret"] = (client
2768
                                                   .encrypted_secret)
2769
                for attr in client.client_structure:
2770
                    if attr not in exclude:
2771
                        client_dict[attr] = getattr(client, attr)
2772
                
237.12.15 by Björn Påhlsson
more refactoring in regards to how clients get created
2773
                clients[client.name] = client_dict
237.14.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
2774
                del client_settings[client.name]["secret"]
2775
        
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
2776
        try:
237.7.126 by Teddy Hogeborn
* mandos (main.cleanup): Use tempfile.NamedTemporaryFile() instead of
2777
            with (tempfile.NamedTemporaryFile
2778
                  (mode='wb', suffix=".pickle", prefix='clients-',
2779
                   dir=os.path.dirname(stored_state_path),
2780
                   delete=False)) as stored_state:
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
2781
                pickle.dump((clients, client_settings), stored_state)
237.7.126 by Teddy Hogeborn
* mandos (main.cleanup): Use tempfile.NamedTemporaryFile() instead of
2782
                tempname=stored_state.name
237.11.26 by teddy at bsnet
* mandos (main/cleanup): Write new file, then rename. Use
2783
            os.rename(tempname, stored_state_path)
237.14.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
2784
        except (IOError, OSError) as e:
237.7.78 by teddy at bsnet
* mandos (initlogger): Take new "debug" argument; all callers changed.
2785
            if not debug:
2786
                try:
2787
                    os.remove(tempname)
2788
                except NameError:
2789
                    pass
237.7.122 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
2790
            if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
2791
                logger.warning("Could not save persistent state: {0}"
2792
                               .format(os.strerror(e.errno)))
2793
            else:
2794
                logger.warning("Could not save persistent state:",
2795
                               exc_info=e)
237.7.190 by Teddy Hogeborn
Syntax fix; use "raise" better in Mandos server.
2796
                raise
237.12.6 by Teddy Hogeborn
* mandos: Fix whitespace.
2797
        
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
2798
        # Delete all clients, and settings from config
237.2.163 by Teddy Hogeborn
* mandos (Client.enable): Bug fix: Start new immediate checker last to
2799
        while tcp_server.clients:
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
2800
            name, client = tcp_server.clients.popitem()
237.2.165 by Teddy Hogeborn
* mandos (Client.disable): Rename keyword argument "log" to "quiet",
2801
            if use_dbus:
2802
                client.remove_from_connection()
237.2.163 by Teddy Hogeborn
* mandos (Client.enable): Bug fix: Start new immediate checker last to
2803
            # Don't signal anything except ClientRemoved
237.2.165 by Teddy Hogeborn
* mandos (Client.disable): Rename keyword argument "log" to "quiet",
2804
            client.disable(quiet=True)
237.2.163 by Teddy Hogeborn
* mandos (Client.enable): Bug fix: Start new immediate checker last to
2805
            if use_dbus:
2806
                # Emit D-Bus signal
237.11.3 by Teddy Hogeborn
* mandos: Break long lines.
2807
                mandos_dbus_service.ClientRemoved(client
2808
                                                  .dbus_object_path,
237.2.163 by Teddy Hogeborn
* mandos (Client.enable): Bug fix: Start new immediate checker last to
2809
                                                  client.name)
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
2810
        client_settings.clear()
237.2.163 by Teddy Hogeborn
* mandos (Client.enable): Bug fix: Start new immediate checker last to
2811
    
2812
    atexit.register(cleanup)
2813
    
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
2814
    for client in tcp_server.clients.itervalues():
237.2.6 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
2815
        if use_dbus:
2816
            # Emit D-Bus signal
237.2.174 by Teddy Hogeborn
More consistent terminology: Clients are no longer "invalid" - they
2817
            mandos_dbus_service.ClientAdded(client.dbus_object_path)
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
2818
        # Need to initiate checking of clients
2819
        if client.enabled:
2820
            client.init_checker()
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
2821
    
163 by Teddy Hogeborn
* Makefile (PIDDIR, USER, GROUP): Removed.
2822
    tcp_server.enable()
2823
    tcp_server.server_activate()
2824
    
28 by Teddy Hogeborn
* server.conf: New file.
2825
    # Find out what port we got
2826
    service.port = tcp_server.socket.getsockname()[1]
237.2.77 by Teddy Hogeborn
Support not using IPv6 in server:
2827
    if use_ipv6:
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2828
        logger.info("Now listening on address %r, port %d,"
237.7.116 by Teddy Hogeborn
* mandos-monitor: Use new string format method.
2829
                    " flowinfo %d, scope_id %d",
2830
                    *tcp_server.socket.getsockname())
237.2.77 by Teddy Hogeborn
Support not using IPv6 in server:
2831
    else:                       # IPv4
237.7.116 by Teddy Hogeborn
* mandos-monitor: Use new string format method.
2832
        logger.info("Now listening on address %r, port %d",
2833
                    *tcp_server.socket.getsockname())
28 by Teddy Hogeborn
* server.conf: New file.
2834
    
29 by Teddy Hogeborn
* plugins.d/mandosclient.c (start_mandos_communication): Changed
2835
    #service.interface = tcp_server.socket.getsockname()[3]
28 by Teddy Hogeborn
* server.conf: New file.
2836
    
2837
    try:
2838
        # From the Avahi example code
2839
        try:
237.2.99 by Teddy Hogeborn
Code cleanup.
2840
            service.activate()
237.7.30 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
2841
        except dbus.exceptions.DBusException as error:
237.7.113 by Teddy Hogeborn
* mandos (AvahiService.rename, Client.start_checker,
2842
            logger.critical("D-Bus Exception", exc_info=error)
237.2.164 by Teddy Hogeborn
* README (FAQ): Fix typo.
2843
            cleanup()
28 by Teddy Hogeborn
* server.conf: New file.
2844
            sys.exit(1)
2845
        # End of Avahi example code
2846
        
2847
        gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
2848
                             lambda *args, **kwargs:
237.1.2 by Teddy Hogeborn
Further steps towards a D-Bus server interface, plus minor syntax
2849
                             (tcp_server.handle_request
2850
                              (*args[2:], **kwargs) or True))
28 by Teddy Hogeborn
* server.conf: New file.
2851
        
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2852
        logger.debug("Starting main loop")
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
2853
        main_loop.run()
237.7.30 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
2854
    except AvahiError as error:
237.7.113 by Teddy Hogeborn
* mandos (AvahiService.rename, Client.start_checker,
2855
        logger.critical("Avahi Error", exc_info=error)
237.2.164 by Teddy Hogeborn
* README (FAQ): Fix typo.
2856
        cleanup()
28 by Teddy Hogeborn
* server.conf: New file.
2857
        sys.exit(1)
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
2858
    except KeyboardInterrupt:
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
2859
        if debug:
237.8.5 by teddy at bsnet
* mandos: Use unicode string literals.
2860
            print("", file=sys.stderr)
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2861
        logger.debug("Server received KeyboardInterrupt")
2862
    logger.debug("Server exiting")
237.2.164 by Teddy Hogeborn
* README (FAQ): Fix typo.
2863
    # Must run before the D-Bus bus name gets deregistered
2864
    cleanup()
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
2865
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2866
if __name__ == '__main__':
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
2867
    main()