/mandos/release

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/release

« back to all changes in this revision

Viewing changes to mandos

* initramfs-tools-hook: Set DEVICE for network hooks.

Show diffs side-by-side

added added

removed removed

Lines of Context:
11
11
# "AvahiService" class, and some lines in "main".
12
12
13
13
# Everything else is
14
 
# Copyright © 2008-2012 Teddy Hogeborn
15
 
# Copyright © 2008-2012 Björn Påhlsson
 
14
# Copyright © 2008-2011 Teddy Hogeborn
 
15
# Copyright © 2008-2011 Björn Påhlsson
16
16
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
34
34
from __future__ import (division, absolute_import, print_function,
35
35
                        unicode_literals)
36
36
 
37
 
from future_builtins import *
38
 
 
39
37
import SocketServer as socketserver
40
38
import socket
41
39
import argparse
65
63
import cPickle as pickle
66
64
import multiprocessing
67
65
import types
68
 
import binascii
69
 
import tempfile
70
 
import itertools
71
 
import collections
72
66
 
73
67
import dbus
74
68
import dbus.service
88
82
    except ImportError:
89
83
        SO_BINDTODEVICE = None
90
84
 
91
 
version = "1.6.0"
92
 
stored_state_file = "clients.pickle"
93
 
 
94
 
logger = logging.getLogger()
 
85
 
 
86
version = "1.4.1"
 
87
 
 
88
#logger = logging.getLogger('mandos')
 
89
logger = logging.Logger('mandos')
95
90
syslogger = (logging.handlers.SysLogHandler
96
91
             (facility = logging.handlers.SysLogHandler.LOG_DAEMON,
97
92
              address = str("/dev/log")))
98
 
 
99
 
try:
100
 
    if_nametoindex = (ctypes.cdll.LoadLibrary
101
 
                      (ctypes.util.find_library("c"))
102
 
                      .if_nametoindex)
103
 
except (OSError, AttributeError):
104
 
    def if_nametoindex(interface):
105
 
        "Get an interface index the hard way, i.e. using fcntl()"
106
 
        SIOCGIFINDEX = 0x8933  # From /usr/include/linux/sockios.h
107
 
        with contextlib.closing(socket.socket()) as s:
108
 
            ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
109
 
                                struct.pack(str("16s16x"),
110
 
                                            interface))
111
 
        interface_index = struct.unpack(str("I"),
112
 
                                        ifreq[16:20])[0]
113
 
        return interface_index
114
 
 
115
 
 
116
 
def initlogger(debug, level=logging.WARNING):
117
 
    """init logger and add loglevel"""
118
 
    
119
 
    syslogger.setFormatter(logging.Formatter
120
 
                           ('Mandos [%(process)d]: %(levelname)s:'
121
 
                            ' %(message)s'))
122
 
    logger.addHandler(syslogger)
123
 
    
124
 
    if debug:
125
 
        console = logging.StreamHandler()
126
 
        console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
127
 
                                               ' [%(process)d]:'
128
 
                                               ' %(levelname)s:'
129
 
                                               ' %(message)s'))
130
 
        logger.addHandler(console)
131
 
    logger.setLevel(level)
132
 
 
133
 
 
134
 
class PGPError(Exception):
135
 
    """Exception if encryption/decryption fails"""
136
 
    pass
137
 
 
138
 
 
139
 
class PGPEngine(object):
140
 
    """A simple class for OpenPGP symmetric encryption & decryption"""
141
 
    def __init__(self):
142
 
        self.tempdir = tempfile.mkdtemp(prefix="mandos-")
143
 
        self.gnupgargs = ['--batch',
144
 
                          '--home', self.tempdir,
145
 
                          '--force-mdc',
146
 
                          '--quiet',
147
 
                          '--no-use-agent']
148
 
    
149
 
    def __enter__(self):
150
 
        return self
151
 
    
152
 
    def __exit__(self, exc_type, exc_value, traceback):
153
 
        self._cleanup()
154
 
        return False
155
 
    
156
 
    def __del__(self):
157
 
        self._cleanup()
158
 
    
159
 
    def _cleanup(self):
160
 
        if self.tempdir is not None:
161
 
            # Delete contents of tempdir
162
 
            for root, dirs, files in os.walk(self.tempdir,
163
 
                                             topdown = False):
164
 
                for filename in files:
165
 
                    os.remove(os.path.join(root, filename))
166
 
                for dirname in dirs:
167
 
                    os.rmdir(os.path.join(root, dirname))
168
 
            # Remove tempdir
169
 
            os.rmdir(self.tempdir)
170
 
            self.tempdir = None
171
 
    
172
 
    def password_encode(self, password):
173
 
        # Passphrase can not be empty and can not contain newlines or
174
 
        # NUL bytes.  So we prefix it and hex encode it.
175
 
        return b"mandos" + binascii.hexlify(password)
176
 
    
177
 
    def encrypt(self, data, password):
178
 
        passphrase = self.password_encode(password)
179
 
        with tempfile.NamedTemporaryFile(dir=self.tempdir
180
 
                                         ) as passfile:
181
 
            passfile.write(passphrase)
182
 
            passfile.flush()
183
 
            proc = subprocess.Popen(['gpg', '--symmetric',
184
 
                                     '--passphrase-file',
185
 
                                     passfile.name]
186
 
                                    + self.gnupgargs,
187
 
                                    stdin = subprocess.PIPE,
188
 
                                    stdout = subprocess.PIPE,
189
 
                                    stderr = subprocess.PIPE)
190
 
            ciphertext, err = proc.communicate(input = data)
191
 
        if proc.returncode != 0:
192
 
            raise PGPError(err)
193
 
        return ciphertext
194
 
    
195
 
    def decrypt(self, data, password):
196
 
        passphrase = self.password_encode(password)
197
 
        with tempfile.NamedTemporaryFile(dir = self.tempdir
198
 
                                         ) as passfile:
199
 
            passfile.write(passphrase)
200
 
            passfile.flush()
201
 
            proc = subprocess.Popen(['gpg', '--decrypt',
202
 
                                     '--passphrase-file',
203
 
                                     passfile.name]
204
 
                                    + self.gnupgargs,
205
 
                                    stdin = subprocess.PIPE,
206
 
                                    stdout = subprocess.PIPE,
207
 
                                    stderr = subprocess.PIPE)
208
 
            decrypted_plaintext, err = proc.communicate(input
209
 
                                                        = data)
210
 
        if proc.returncode != 0:
211
 
            raise PGPError(err)
212
 
        return decrypted_plaintext
213
 
 
 
93
syslogger.setFormatter(logging.Formatter
 
94
                       ('Mandos [%(process)d]: %(levelname)s:'
 
95
                        ' %(message)s'))
 
96
logger.addHandler(syslogger)
 
97
 
 
98
console = logging.StreamHandler()
 
99
console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'
 
100
                                       ' %(levelname)s:'
 
101
                                       ' %(message)s'))
 
102
logger.addHandler(console)
214
103
 
215
104
class AvahiError(Exception):
216
105
    def __init__(self, value, *args, **kwargs):
234
123
               Used to optionally bind to the specified interface.
235
124
    name: string; Example: 'Mandos'
236
125
    type: string; Example: '_mandos._tcp'.
237
 
     See <https://www.iana.org/assignments/service-names-port-numbers>
 
126
                  See <http://www.dns-sd.org/ServiceTypes.html>
238
127
    port: integer; what port to announce
239
128
    TXT: list of strings; TXT record for the service
240
129
    domain: string; Domain to publish on, default to .local if empty.
246
135
    server: D-Bus Server
247
136
    bus: dbus.SystemBus()
248
137
    """
249
 
    
250
138
    def __init__(self, interface = avahi.IF_UNSPEC, name = None,
251
139
                 servicetype = None, port = None, TXT = None,
252
140
                 domain = "", host = "", max_renames = 32768,
265
153
        self.server = None
266
154
        self.bus = bus
267
155
        self.entry_group_state_changed_match = None
268
 
    
269
156
    def rename(self):
270
157
        """Derived from the Avahi example code"""
271
158
        if self.rename_count >= self.max_renames:
277
164
                            .GetAlternativeServiceName(self.name))
278
165
        logger.info("Changing Zeroconf service name to %r ...",
279
166
                    self.name)
 
167
        syslogger.setFormatter(logging.Formatter
 
168
                               ('Mandos (%s) [%%(process)d]:'
 
169
                                ' %%(levelname)s: %%(message)s'
 
170
                                % self.name))
280
171
        self.remove()
281
172
        try:
282
173
            self.add()
283
174
        except dbus.exceptions.DBusException as error:
284
 
            logger.critical("D-Bus Exception", exc_info=error)
 
175
            logger.critical("DBusException: %s", error)
285
176
            self.cleanup()
286
177
            os._exit(1)
287
178
        self.rename_count += 1
288
 
    
289
179
    def remove(self):
290
180
        """Derived from the Avahi example code"""
291
181
        if self.entry_group_state_changed_match is not None:
293
183
            self.entry_group_state_changed_match = None
294
184
        if self.group is not None:
295
185
            self.group.Reset()
296
 
    
297
186
    def add(self):
298
187
        """Derived from the Avahi example code"""
299
188
        self.remove()
304
193
                avahi.DBUS_INTERFACE_ENTRY_GROUP)
305
194
        self.entry_group_state_changed_match = (
306
195
            self.group.connect_to_signal(
307
 
                'StateChanged', self.entry_group_state_changed))
 
196
                'StateChanged', self .entry_group_state_changed))
308
197
        logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
309
198
                     self.name, self.type)
310
199
        self.group.AddService(
316
205
            dbus.UInt16(self.port),
317
206
            avahi.string_array_to_txt_array(self.TXT))
318
207
        self.group.Commit()
319
 
    
320
208
    def entry_group_state_changed(self, state, error):
321
209
        """Derived from the Avahi example code"""
322
210
        logger.debug("Avahi entry group state change: %i", state)
329
217
        elif state == avahi.ENTRY_GROUP_FAILURE:
330
218
            logger.critical("Avahi: Error in group state changed %s",
331
219
                            unicode(error))
332
 
            raise AvahiGroupError("State changed: {0!s}"
333
 
                                  .format(error))
334
 
    
 
220
            raise AvahiGroupError("State changed: %s"
 
221
                                  % unicode(error))
335
222
    def cleanup(self):
336
223
        """Derived from the Avahi example code"""
337
224
        if self.group is not None:
338
225
            try:
339
226
                self.group.Free()
340
227
            except (dbus.exceptions.UnknownMethodException,
341
 
                    dbus.exceptions.DBusException):
 
228
                    dbus.exceptions.DBusException) as e:
342
229
                pass
343
230
            self.group = None
344
231
        self.remove()
345
 
    
346
232
    def server_state_changed(self, state, error=None):
347
233
        """Derived from the Avahi example code"""
348
234
        logger.debug("Avahi server state change: %i", state)
367
253
                logger.debug("Unknown state: %r", state)
368
254
            else:
369
255
                logger.debug("Unknown state: %r: %r", state, error)
370
 
    
371
256
    def activate(self):
372
257
        """Derived from the Avahi example code"""
373
258
        if self.server is None:
381
266
        self.server_state_changed(self.server.GetState())
382
267
 
383
268
 
384
 
class AvahiServiceToSyslog(AvahiService):
385
 
    def rename(self):
386
 
        """Add the new name to the syslog messages"""
387
 
        ret = AvahiService.rename(self)
388
 
        syslogger.setFormatter(logging.Formatter
389
 
                               ('Mandos ({0}) [%(process)d]:'
390
 
                                ' %(levelname)s: %(message)s'
391
 
                                .format(self.name)))
392
 
        return ret
393
 
 
394
 
 
395
 
def timedelta_to_milliseconds(td):
 
269
def _timedelta_to_milliseconds(td):
396
270
    "Convert a datetime.timedelta() to milliseconds"
397
271
    return ((td.days * 24 * 60 * 60 * 1000)
398
272
            + (td.seconds * 1000)
399
273
            + (td.microseconds // 1000))
400
 
 
401
 
 
 
274
        
402
275
class Client(object):
403
276
    """A representation of a client host served by this server.
404
277
    
405
278
    Attributes:
406
 
    approved:   bool(); 'None' if not yet approved/disapproved
 
279
    _approved:   bool(); 'None' if not yet approved/disapproved
407
280
    approval_delay: datetime.timedelta(); Time to wait for approval
408
281
    approval_duration: datetime.timedelta(); Duration of one approval
409
282
    checker:    subprocess.Popen(); a running checker process used
416
289
                     instance %(name)s can be used in the command.
417
290
    checker_initiator_tag: a gobject event source tag, or None
418
291
    created:    datetime.datetime(); (UTC) object creation
419
 
    client_structure: Object describing what attributes a client has
420
 
                      and is used for storing the client at exit
421
292
    current_checker_command: string; current running checker_command
 
293
    disable_hook:  If set, called by disable() as disable_hook(self)
422
294
    disable_initiator_tag: a gobject event source tag, or None
423
295
    enabled:    bool()
424
296
    fingerprint: string (40 or 32 hexadecimal digits); used to
427
299
    interval:   datetime.timedelta(); How often to start a new checker
428
300
    last_approval_request: datetime.datetime(); (UTC) or None
429
301
    last_checked_ok: datetime.datetime(); (UTC) or None
430
 
    last_checker_status: integer between 0 and 255 reflecting exit
431
 
                         status of last checker. -1 reflects crashed
432
 
                         checker, -2 means no checker completed yet.
433
 
    last_enabled: datetime.datetime(); (UTC) or None
 
302
    last_enabled: datetime.datetime(); (UTC)
434
303
    name:       string; from the config file, used in log messages and
435
304
                        D-Bus identifiers
436
305
    secret:     bytestring; sent verbatim (over TLS) to client
437
306
    timeout:    datetime.timedelta(); How long from last_checked_ok
438
307
                                      until this client is disabled
439
 
    extended_timeout:   extra long timeout when secret has been sent
 
308
    extended_timeout:   extra long timeout when password has been sent
440
309
    runtime_expansions: Allowed attributes for runtime expansion.
441
310
    expires:    datetime.datetime(); time (UTC) when a client will be
442
311
                disabled, or None
443
312
    """
444
313
    
445
314
    runtime_expansions = ("approval_delay", "approval_duration",
446
 
                          "created", "enabled", "expires",
447
 
                          "fingerprint", "host", "interval",
448
 
                          "last_approval_request", "last_checked_ok",
 
315
                          "created", "enabled", "fingerprint",
 
316
                          "host", "interval", "last_checked_ok",
449
317
                          "last_enabled", "name", "timeout")
450
 
    client_defaults = { "timeout": "PT5M",
451
 
                        "extended_timeout": "PT15M",
452
 
                        "interval": "PT2M",
453
 
                        "checker": "fping -q -- %%(host)s",
454
 
                        "host": "",
455
 
                        "approval_delay": "PT0S",
456
 
                        "approval_duration": "PT1S",
457
 
                        "approved_by_default": "True",
458
 
                        "enabled": "True",
459
 
                        }
460
318
    
461
319
    def timeout_milliseconds(self):
462
320
        "Return the 'timeout' attribute in milliseconds"
463
 
        return timedelta_to_milliseconds(self.timeout)
 
321
        return _timedelta_to_milliseconds(self.timeout)
464
322
    
465
323
    def extended_timeout_milliseconds(self):
466
324
        "Return the 'extended_timeout' attribute in milliseconds"
467
 
        return timedelta_to_milliseconds(self.extended_timeout)
 
325
        return _timedelta_to_milliseconds(self.extended_timeout)
468
326
    
469
327
    def interval_milliseconds(self):
470
328
        "Return the 'interval' attribute in milliseconds"
471
 
        return timedelta_to_milliseconds(self.interval)
 
329
        return _timedelta_to_milliseconds(self.interval)
472
330
    
473
331
    def approval_delay_milliseconds(self):
474
 
        return timedelta_to_milliseconds(self.approval_delay)
475
 
    
476
 
    @staticmethod
477
 
    def config_parser(config):
478
 
        """Construct a new dict of client settings of this form:
479
 
        { client_name: {setting_name: value, ...}, ...}
480
 
        with exceptions for any special settings as defined above.
481
 
        NOTE: Must be a pure function. Must return the same result
482
 
        value given the same arguments.
483
 
        """
484
 
        settings = {}
485
 
        for client_name in config.sections():
486
 
            section = dict(config.items(client_name))
487
 
            client = settings[client_name] = {}
488
 
            
489
 
            client["host"] = section["host"]
490
 
            # Reformat values from string types to Python types
491
 
            client["approved_by_default"] = config.getboolean(
492
 
                client_name, "approved_by_default")
493
 
            client["enabled"] = config.getboolean(client_name,
494
 
                                                  "enabled")
495
 
            
496
 
            client["fingerprint"] = (section["fingerprint"].upper()
497
 
                                     .replace(" ", ""))
498
 
            if "secret" in section:
499
 
                client["secret"] = section["secret"].decode("base64")
500
 
            elif "secfile" in section:
501
 
                with open(os.path.expanduser(os.path.expandvars
502
 
                                             (section["secfile"])),
503
 
                          "rb") as secfile:
504
 
                    client["secret"] = secfile.read()
505
 
            else:
506
 
                raise TypeError("No secret or secfile for section {0}"
507
 
                                .format(section))
508
 
            client["timeout"] = string_to_delta(section["timeout"])
509
 
            client["extended_timeout"] = string_to_delta(
510
 
                section["extended_timeout"])
511
 
            client["interval"] = string_to_delta(section["interval"])
512
 
            client["approval_delay"] = string_to_delta(
513
 
                section["approval_delay"])
514
 
            client["approval_duration"] = string_to_delta(
515
 
                section["approval_duration"])
516
 
            client["checker_command"] = section["checker"]
517
 
            client["last_approval_request"] = None
518
 
            client["last_checked_ok"] = None
519
 
            client["last_checker_status"] = -2
520
 
        
521
 
        return settings
522
 
    
523
 
    def __init__(self, settings, name = None):
 
332
        return _timedelta_to_milliseconds(self.approval_delay)
 
333
    
 
334
    def __init__(self, name = None, disable_hook=None, config=None):
 
335
        """Note: the 'checker' key in 'config' sets the
 
336
        'checker_command' attribute and *not* the 'checker'
 
337
        attribute."""
524
338
        self.name = name
525
 
        # adding all client settings
526
 
        for setting, value in settings.iteritems():
527
 
            setattr(self, setting, value)
528
 
        
529
 
        if self.enabled:
530
 
            if not hasattr(self, "last_enabled"):
531
 
                self.last_enabled = datetime.datetime.utcnow()
532
 
            if not hasattr(self, "expires"):
533
 
                self.expires = (datetime.datetime.utcnow()
534
 
                                + self.timeout)
535
 
        else:
536
 
            self.last_enabled = None
537
 
            self.expires = None
538
 
        
 
339
        if config is None:
 
340
            config = {}
539
341
        logger.debug("Creating client %r", self.name)
540
342
        # Uppercase and remove spaces from fingerprint for later
541
343
        # comparison purposes with return value from the fingerprint()
542
344
        # function
 
345
        self.fingerprint = (config["fingerprint"].upper()
 
346
                            .replace(" ", ""))
543
347
        logger.debug("  Fingerprint: %s", self.fingerprint)
544
 
        self.created = settings.get("created",
545
 
                                    datetime.datetime.utcnow())
546
 
        
547
 
        # attributes specific for this server instance
 
348
        if "secret" in config:
 
349
            self.secret = config["secret"].decode("base64")
 
350
        elif "secfile" in config:
 
351
            with open(os.path.expanduser(os.path.expandvars
 
352
                                         (config["secfile"])),
 
353
                      "rb") as secfile:
 
354
                self.secret = secfile.read()
 
355
        else:
 
356
            raise TypeError("No secret or secfile for client %s"
 
357
                            % self.name)
 
358
        self.host = config.get("host", "")
 
359
        self.created = datetime.datetime.utcnow()
 
360
        self.enabled = False
 
361
        self.last_approval_request = None
 
362
        self.last_enabled = None
 
363
        self.last_checked_ok = None
 
364
        self.timeout = string_to_delta(config["timeout"])
 
365
        self.extended_timeout = string_to_delta(config
 
366
                                                ["extended_timeout"])
 
367
        self.interval = string_to_delta(config["interval"])
 
368
        self.disable_hook = disable_hook
548
369
        self.checker = None
549
370
        self.checker_initiator_tag = None
550
371
        self.disable_initiator_tag = None
 
372
        self.expires = None
551
373
        self.checker_callback_tag = None
 
374
        self.checker_command = config["checker"]
552
375
        self.current_checker_command = None
553
 
        self.approved = None
 
376
        self.last_connect = None
 
377
        self._approved = None
 
378
        self.approved_by_default = config.get("approved_by_default",
 
379
                                              True)
554
380
        self.approvals_pending = 0
 
381
        self.approval_delay = string_to_delta(
 
382
            config["approval_delay"])
 
383
        self.approval_duration = string_to_delta(
 
384
            config["approval_duration"])
555
385
        self.changedstate = (multiprocessing_manager
556
386
                             .Condition(multiprocessing_manager
557
387
                                        .Lock()))
558
 
        self.client_structure = [attr for attr in
559
 
                                 self.__dict__.iterkeys()
560
 
                                 if not attr.startswith("_")]
561
 
        self.client_structure.append("client_structure")
562
 
        
563
 
        for name, t in inspect.getmembers(type(self),
564
 
                                          lambda obj:
565
 
                                              isinstance(obj,
566
 
                                                         property)):
567
 
            if not name.startswith("_"):
568
 
                self.client_structure.append(name)
569
388
    
570
 
    # Send notice to process children that client state has changed
571
389
    def send_changedstate(self):
572
 
        with self.changedstate:
573
 
            self.changedstate.notify_all()
 
390
        self.changedstate.acquire()
 
391
        self.changedstate.notify_all()
 
392
        self.changedstate.release()
574
393
    
575
394
    def enable(self):
576
395
        """Start this client's checker and timeout hooks"""
577
396
        if getattr(self, "enabled", False):
578
397
            # Already enabled
579
398
            return
580
 
        self.expires = datetime.datetime.utcnow() + self.timeout
581
 
        self.enabled = True
582
 
        self.last_enabled = datetime.datetime.utcnow()
583
 
        self.init_checker()
584
399
        self.send_changedstate()
585
 
    
586
 
    def disable(self, quiet=True):
587
 
        """Disable this client."""
588
 
        if not getattr(self, "enabled", False):
589
 
            return False
590
 
        if not quiet:
591
 
            logger.info("Disabling client %s", self.name)
592
 
        if getattr(self, "disable_initiator_tag", None) is not None:
593
 
            gobject.source_remove(self.disable_initiator_tag)
594
 
            self.disable_initiator_tag = None
595
 
        self.expires = None
596
 
        if getattr(self, "checker_initiator_tag", None) is not None:
597
 
            gobject.source_remove(self.checker_initiator_tag)
598
 
            self.checker_initiator_tag = None
599
 
        self.stop_checker()
600
 
        self.enabled = False
601
 
        if not quiet:
602
 
            self.send_changedstate()
603
 
        # Do not run this again if called by a gobject.timeout_add
604
 
        return False
605
 
    
606
 
    def __del__(self):
607
 
        self.disable()
608
 
    
609
 
    def init_checker(self):
610
400
        # Schedule a new checker to be started an 'interval' from now,
611
401
        # and every interval from then on.
612
 
        if self.checker_initiator_tag is not None:
613
 
            gobject.source_remove(self.checker_initiator_tag)
614
402
        self.checker_initiator_tag = (gobject.timeout_add
615
403
                                      (self.interval_milliseconds(),
616
404
                                       self.start_checker))
617
405
        # Schedule a disable() when 'timeout' has passed
618
 
        if self.disable_initiator_tag is not None:
619
 
            gobject.source_remove(self.disable_initiator_tag)
 
406
        self.expires = datetime.datetime.utcnow() + self.timeout
620
407
        self.disable_initiator_tag = (gobject.timeout_add
621
408
                                   (self.timeout_milliseconds(),
622
409
                                    self.disable))
 
410
        self.enabled = True
 
411
        self.last_enabled = datetime.datetime.utcnow()
623
412
        # Also start a new checker *right now*.
624
413
        self.start_checker()
625
414
    
 
415
    def disable(self, quiet=True):
 
416
        """Disable this client."""
 
417
        if not getattr(self, "enabled", False):
 
418
            return False
 
419
        if not quiet:
 
420
            self.send_changedstate()
 
421
        if not quiet:
 
422
            logger.info("Disabling client %s", self.name)
 
423
        if getattr(self, "disable_initiator_tag", False):
 
424
            gobject.source_remove(self.disable_initiator_tag)
 
425
            self.disable_initiator_tag = None
 
426
        self.expires = None
 
427
        if getattr(self, "checker_initiator_tag", False):
 
428
            gobject.source_remove(self.checker_initiator_tag)
 
429
            self.checker_initiator_tag = None
 
430
        self.stop_checker()
 
431
        if self.disable_hook:
 
432
            self.disable_hook(self)
 
433
        self.enabled = False
 
434
        # Do not run this again if called by a gobject.timeout_add
 
435
        return False
 
436
    
 
437
    def __del__(self):
 
438
        self.disable_hook = None
 
439
        self.disable()
 
440
    
626
441
    def checker_callback(self, pid, condition, command):
627
442
        """The checker has completed, so take appropriate actions."""
628
443
        self.checker_callback_tag = None
629
444
        self.checker = None
630
445
        if os.WIFEXITED(condition):
631
 
            self.last_checker_status = os.WEXITSTATUS(condition)
632
 
            if self.last_checker_status == 0:
 
446
            exitstatus = os.WEXITSTATUS(condition)
 
447
            if exitstatus == 0:
633
448
                logger.info("Checker for %(name)s succeeded",
634
449
                            vars(self))
635
450
                self.checked_ok()
637
452
                logger.info("Checker for %(name)s failed",
638
453
                            vars(self))
639
454
        else:
640
 
            self.last_checker_status = -1
641
455
            logger.warning("Checker for %(name)s crashed?",
642
456
                           vars(self))
643
457
    
644
 
    def checked_ok(self):
645
 
        """Assert that the client has been seen, alive and well."""
646
 
        self.last_checked_ok = datetime.datetime.utcnow()
647
 
        self.last_checker_status = 0
648
 
        self.bump_timeout()
649
 
    
650
 
    def bump_timeout(self, timeout=None):
651
 
        """Bump up the timeout for this client."""
 
458
    def checked_ok(self, timeout=None):
 
459
        """Bump up the timeout for this client.
 
460
        
 
461
        This should only be called when the client has been seen,
 
462
        alive and well.
 
463
        """
652
464
        if timeout is None:
653
465
            timeout = self.timeout
 
466
        self.last_checked_ok = datetime.datetime.utcnow()
654
467
        if self.disable_initiator_tag is not None:
655
468
            gobject.source_remove(self.disable_initiator_tag)
656
 
            self.disable_initiator_tag = None
657
469
        if getattr(self, "enabled", False):
658
470
            self.disable_initiator_tag = (gobject.timeout_add
659
 
                                          (timedelta_to_milliseconds
 
471
                                          (_timedelta_to_milliseconds
660
472
                                           (timeout), self.disable))
661
473
            self.expires = datetime.datetime.utcnow() + timeout
662
474
    
669
481
        If a checker already exists, leave it running and do
670
482
        nothing."""
671
483
        # The reason for not killing a running checker is that if we
672
 
        # did that, and if a checker (for some reason) started running
673
 
        # slowly and taking more than 'interval' time, then the client
674
 
        # would inevitably timeout, since no checker would get a
675
 
        # chance to run to completion.  If we instead leave running
 
484
        # did that, then if a checker (for some reason) started
 
485
        # running slowly and taking more than 'interval' time, the
 
486
        # client would inevitably timeout, since no checker would get
 
487
        # a chance to run to completion.  If we instead leave running
676
488
        # checkers alone, the checker would have to take more time
677
489
        # than 'timeout' for the client to be disabled, which is as it
678
490
        # should be.
692
504
                                      self.current_checker_command)
693
505
        # Start a new checker if needed
694
506
        if self.checker is None:
695
 
            # Escape attributes for the shell
696
 
            escaped_attrs = dict(
697
 
                (attr, re.escape(unicode(getattr(self, attr))))
698
 
                for attr in
699
 
                self.runtime_expansions)
700
507
            try:
701
 
                command = self.checker_command % escaped_attrs
702
 
            except TypeError as error:
703
 
                logger.error('Could not format string "%s"',
704
 
                             self.checker_command, exc_info=error)
705
 
                return True # Try again later
 
508
                # In case checker_command has exactly one % operator
 
509
                command = self.checker_command % self.host
 
510
            except TypeError:
 
511
                # Escape attributes for the shell
 
512
                escaped_attrs = dict(
 
513
                    (attr,
 
514
                     re.escape(unicode(str(getattr(self, attr, "")),
 
515
                                       errors=
 
516
                                       'replace')))
 
517
                    for attr in
 
518
                    self.runtime_expansions)
 
519
                
 
520
                try:
 
521
                    command = self.checker_command % escaped_attrs
 
522
                except TypeError as error:
 
523
                    logger.error('Could not format string "%s":'
 
524
                                 ' %s', self.checker_command, error)
 
525
                    return True # Try again later
706
526
            self.current_checker_command = command
707
527
            try:
708
528
                logger.info("Starting checker %r for %s",
714
534
                self.checker = subprocess.Popen(command,
715
535
                                                close_fds=True,
716
536
                                                shell=True, cwd="/")
717
 
            except OSError as error:
718
 
                logger.error("Failed to start subprocess",
719
 
                             exc_info=error)
720
 
                return True
721
 
            self.checker_callback_tag = (gobject.child_watch_add
722
 
                                         (self.checker.pid,
723
 
                                          self.checker_callback,
724
 
                                          data=command))
725
 
            # The checker may have completed before the gobject
726
 
            # watch was added.  Check for this.
727
 
            try:
 
537
                self.checker_callback_tag = (gobject.child_watch_add
 
538
                                             (self.checker.pid,
 
539
                                              self.checker_callback,
 
540
                                              data=command))
 
541
                # The checker may have completed before the gobject
 
542
                # watch was added.  Check for this.
728
543
                pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
 
544
                if pid:
 
545
                    gobject.source_remove(self.checker_callback_tag)
 
546
                    self.checker_callback(pid, status, command)
729
547
            except OSError as error:
730
 
                if error.errno == errno.ECHILD:
731
 
                    # This should never happen
732
 
                    logger.error("Child process vanished",
733
 
                                 exc_info=error)
734
 
                    return True
735
 
                raise
736
 
            if pid:
737
 
                gobject.source_remove(self.checker_callback_tag)
738
 
                self.checker_callback(pid, status, command)
 
548
                logger.error("Failed to start subprocess: %s",
 
549
                             error)
739
550
        # Re-run this periodically if run by gobject.timeout_add
740
551
        return True
741
552
    
748
559
            return
749
560
        logger.debug("Stopping checker for %(name)s", vars(self))
750
561
        try:
751
 
            self.checker.terminate()
 
562
            os.kill(self.checker.pid, signal.SIGTERM)
752
563
            #time.sleep(0.5)
753
564
            #if self.checker.poll() is None:
754
 
            #    self.checker.kill()
 
565
            #    os.kill(self.checker.pid, signal.SIGKILL)
755
566
        except OSError as error:
756
567
            if error.errno != errno.ESRCH: # No such process
757
568
                raise
774
585
    # "Set" method, so we fail early here:
775
586
    if byte_arrays and signature != "ay":
776
587
        raise ValueError("Byte arrays not supported for non-'ay'"
777
 
                         " signature {0!r}".format(signature))
 
588
                         " signature %r" % signature)
778
589
    def decorator(func):
779
590
        func._dbus_is_property = True
780
591
        func._dbus_interface = dbus_interface
788
599
    return decorator
789
600
 
790
601
 
791
 
def dbus_interface_annotations(dbus_interface):
792
 
    """Decorator for marking functions returning interface annotations
793
 
    
794
 
    Usage:
795
 
    
796
 
    @dbus_interface_annotations("org.example.Interface")
797
 
    def _foo(self):  # Function name does not matter
798
 
        return {"org.freedesktop.DBus.Deprecated": "true",
799
 
                "org.freedesktop.DBus.Property.EmitsChangedSignal":
800
 
                    "false"}
801
 
    """
802
 
    def decorator(func):
803
 
        func._dbus_is_interface = True
804
 
        func._dbus_interface = dbus_interface
805
 
        func._dbus_name = dbus_interface
806
 
        return func
807
 
    return decorator
808
 
 
809
 
 
810
 
def dbus_annotations(annotations):
811
 
    """Decorator to annotate D-Bus methods, signals or properties
812
 
    Usage:
813
 
    
814
 
    @dbus_service_property("org.example.Interface", signature="b",
815
 
                           access="r")
816
 
    @dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",
817
 
                        "org.freedesktop.DBus.Property."
818
 
                        "EmitsChangedSignal": "false"})
819
 
    def Property_dbus_property(self):
820
 
        return dbus.Boolean(False)
821
 
    """
822
 
    def decorator(func):
823
 
        func._dbus_annotations = annotations
824
 
        return func
825
 
    return decorator
826
 
 
827
 
 
828
602
class DBusPropertyException(dbus.exceptions.DBusException):
829
603
    """A base class for D-Bus property-related exceptions
830
604
    """
853
627
    """
854
628
    
855
629
    @staticmethod
856
 
    def _is_dbus_thing(thing):
857
 
        """Returns a function testing if an attribute is a D-Bus thing
858
 
        
859
 
        If called like _is_dbus_thing("method") it returns a function
860
 
        suitable for use as predicate to inspect.getmembers().
861
 
        """
862
 
        return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),
863
 
                                   False)
 
630
    def _is_dbus_property(obj):
 
631
        return getattr(obj, "_dbus_is_property", False)
864
632
    
865
 
    def _get_all_dbus_things(self, thing):
 
633
    def _get_all_dbus_properties(self):
866
634
        """Returns a generator of (name, attribute) pairs
867
635
        """
868
 
        return ((getattr(athing.__get__(self), "_dbus_name",
869
 
                         name),
870
 
                 athing.__get__(self))
 
636
        return ((prop.__get__(self)._dbus_name, prop.__get__(self))
871
637
                for cls in self.__class__.__mro__
872
 
                for name, athing in
873
 
                inspect.getmembers(cls,
874
 
                                   self._is_dbus_thing(thing)))
 
638
                for name, prop in
 
639
                inspect.getmembers(cls, self._is_dbus_property))
875
640
    
876
641
    def _get_dbus_property(self, interface_name, property_name):
877
642
        """Returns a bound method if one exists which is a D-Bus
879
644
        """
880
645
        for cls in  self.__class__.__mro__:
881
646
            for name, value in (inspect.getmembers
882
 
                                (cls,
883
 
                                 self._is_dbus_thing("property"))):
 
647
                                (cls, self._is_dbus_property)):
884
648
                if (value._dbus_name == property_name
885
649
                    and value._dbus_interface == interface_name):
886
650
                    return value.__get__(self)
915
679
            # signatures other than "ay".
916
680
            if prop._dbus_signature != "ay":
917
681
                raise ValueError
918
 
            value = dbus.ByteArray(b''.join(chr(byte)
919
 
                                            for byte in value))
 
682
            value = dbus.ByteArray(''.join(unichr(byte)
 
683
                                           for byte in value))
920
684
        prop(value)
921
685
    
922
686
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
927
691
        
928
692
        Note: Will not include properties with access="write".
929
693
        """
930
 
        properties = {}
931
 
        for name, prop in self._get_all_dbus_things("property"):
 
694
        all = {}
 
695
        for name, prop in self._get_all_dbus_properties():
932
696
            if (interface_name
933
697
                and interface_name != prop._dbus_interface):
934
698
                # Interface non-empty but did not match
938
702
                continue
939
703
            value = prop()
940
704
            if not hasattr(value, "variant_level"):
941
 
                properties[name] = value
 
705
                all[name] = value
942
706
                continue
943
 
            properties[name] = type(value)(value, variant_level=
944
 
                                           value.variant_level+1)
945
 
        return dbus.Dictionary(properties, signature="sv")
 
707
            all[name] = type(value)(value, variant_level=
 
708
                                    value.variant_level+1)
 
709
        return dbus.Dictionary(all, signature="sv")
946
710
    
947
711
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
948
712
                         out_signature="s",
949
713
                         path_keyword='object_path',
950
714
                         connection_keyword='connection')
951
715
    def Introspect(self, object_path, connection):
952
 
        """Overloading of standard D-Bus method.
953
 
        
954
 
        Inserts property tags and interface annotation tags.
 
716
        """Standard D-Bus method, overloaded to insert property tags.
955
717
        """
956
718
        xmlstring = dbus.service.Object.Introspect(self, object_path,
957
719
                                                   connection)
964
726
                e.setAttribute("access", prop._dbus_access)
965
727
                return e
966
728
            for if_tag in document.getElementsByTagName("interface"):
967
 
                # Add property tags
968
729
                for tag in (make_tag(document, name, prop)
969
730
                            for name, prop
970
 
                            in self._get_all_dbus_things("property")
 
731
                            in self._get_all_dbus_properties()
971
732
                            if prop._dbus_interface
972
733
                            == if_tag.getAttribute("name")):
973
734
                    if_tag.appendChild(tag)
974
 
                # Add annotation tags
975
 
                for typ in ("method", "signal", "property"):
976
 
                    for tag in if_tag.getElementsByTagName(typ):
977
 
                        annots = dict()
978
 
                        for name, prop in (self.
979
 
                                           _get_all_dbus_things(typ)):
980
 
                            if (name == tag.getAttribute("name")
981
 
                                and prop._dbus_interface
982
 
                                == if_tag.getAttribute("name")):
983
 
                                annots.update(getattr
984
 
                                              (prop,
985
 
                                               "_dbus_annotations",
986
 
                                               {}))
987
 
                        for name, value in annots.iteritems():
988
 
                            ann_tag = document.createElement(
989
 
                                "annotation")
990
 
                            ann_tag.setAttribute("name", name)
991
 
                            ann_tag.setAttribute("value", value)
992
 
                            tag.appendChild(ann_tag)
993
 
                # Add interface annotation tags
994
 
                for annotation, value in dict(
995
 
                    itertools.chain.from_iterable(
996
 
                        annotations().iteritems()
997
 
                        for name, annotations in
998
 
                        self._get_all_dbus_things("interface")
999
 
                        if name == if_tag.getAttribute("name")
1000
 
                        )).iteritems():
1001
 
                    ann_tag = document.createElement("annotation")
1002
 
                    ann_tag.setAttribute("name", annotation)
1003
 
                    ann_tag.setAttribute("value", value)
1004
 
                    if_tag.appendChild(ann_tag)
1005
735
                # Add the names to the return values for the
1006
736
                # "org.freedesktop.DBus.Properties" methods
1007
737
                if (if_tag.getAttribute("name")
1022
752
        except (AttributeError, xml.dom.DOMException,
1023
753
                xml.parsers.expat.ExpatError) as error:
1024
754
            logger.error("Failed to override Introspection method",
1025
 
                         exc_info=error)
 
755
                         error)
1026
756
        return xmlstring
1027
757
 
1028
758
 
1029
 
def datetime_to_dbus(dt, variant_level=0):
 
759
def datetime_to_dbus (dt, variant_level=0):
1030
760
    """Convert a UTC datetime.datetime() to a D-Bus type."""
1031
761
    if dt is None:
1032
762
        return dbus.String("", variant_level = variant_level)
1033
763
    return dbus.String(dt.isoformat(),
1034
764
                       variant_level=variant_level)
1035
765
 
1036
 
 
1037
 
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
1038
 
    """A class decorator; applied to a subclass of
1039
 
    dbus.service.Object, it will add alternate D-Bus attributes with
1040
 
    interface names according to the "alt_interface_names" mapping.
1041
 
    Usage:
1042
 
    
1043
 
    @alternate_dbus_interfaces({"org.example.Interface":
1044
 
                                    "net.example.AlternateInterface"})
1045
 
    class SampleDBusObject(dbus.service.Object):
1046
 
        @dbus.service.method("org.example.Interface")
1047
 
        def SampleDBusMethod():
1048
 
            pass
1049
 
    
1050
 
    The above "SampleDBusMethod" on "SampleDBusObject" will be
1051
 
    reachable via two interfaces: "org.example.Interface" and
1052
 
    "net.example.AlternateInterface", the latter of which will have
1053
 
    its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
1054
 
    "true", unless "deprecate" is passed with a False value.
1055
 
    
1056
 
    This works for methods and signals, and also for D-Bus properties
1057
 
    (from DBusObjectWithProperties) and interfaces (from the
1058
 
    dbus_interface_annotations decorator).
 
766
class AlternateDBusNamesMetaclass(DBusObjectWithProperties
 
767
                                  .__metaclass__):
 
768
    """Applied to an empty subclass of a D-Bus object, this metaclass
 
769
    will add additional D-Bus attributes matching a certain pattern.
1059
770
    """
1060
 
    def wrapper(cls):
1061
 
        for orig_interface_name, alt_interface_name in (
1062
 
            alt_interface_names.iteritems()):
1063
 
            attr = {}
1064
 
            interface_names = set()
1065
 
            # Go though all attributes of the class
1066
 
            for attrname, attribute in inspect.getmembers(cls):
 
771
    def __new__(mcs, name, bases, attr):
 
772
        # Go through all the base classes which could have D-Bus
 
773
        # methods, signals, or properties in them
 
774
        for base in (b for b in bases
 
775
                     if issubclass(b, dbus.service.Object)):
 
776
            # Go though all attributes of the base class
 
777
            for attrname, attribute in inspect.getmembers(base):
1067
778
                # Ignore non-D-Bus attributes, and D-Bus attributes
1068
779
                # with the wrong interface name
1069
780
                if (not hasattr(attribute, "_dbus_interface")
1070
781
                    or not attribute._dbus_interface
1071
 
                    .startswith(orig_interface_name)):
 
782
                    .startswith("se.recompile.Mandos")):
1072
783
                    continue
1073
784
                # Create an alternate D-Bus interface name based on
1074
785
                # the current name
1075
786
                alt_interface = (attribute._dbus_interface
1076
 
                                 .replace(orig_interface_name,
1077
 
                                          alt_interface_name))
1078
 
                interface_names.add(alt_interface)
 
787
                                 .replace("se.recompile.Mandos",
 
788
                                          "se.bsnet.fukt.Mandos"))
1079
789
                # Is this a D-Bus signal?
1080
790
                if getattr(attribute, "_dbus_is_signal", False):
1081
 
                    # Extract the original non-method undecorated
1082
 
                    # function by black magic
 
791
                    # Extract the original non-method function by
 
792
                    # black magic
1083
793
                    nonmethod_func = (dict(
1084
794
                            zip(attribute.func_code.co_freevars,
1085
795
                                attribute.__closure__))["func"]
1096
806
                                nonmethod_func.func_name,
1097
807
                                nonmethod_func.func_defaults,
1098
808
                                nonmethod_func.func_closure)))
1099
 
                    # Copy annotations, if any
1100
 
                    try:
1101
 
                        new_function._dbus_annotations = (
1102
 
                            dict(attribute._dbus_annotations))
1103
 
                    except AttributeError:
1104
 
                        pass
1105
809
                    # Define a creator of a function to call both the
1106
 
                    # original and alternate functions, so both the
1107
 
                    # original and alternate signals gets sent when
1108
 
                    # the function is called
 
810
                    # old and new functions, so both the old and new
 
811
                    # signals gets sent when the function is called
1109
812
                    def fixscope(func1, func2):
1110
813
                        """This function is a scope container to pass
1111
814
                        func1 and func2 to the "call_both" function
1118
821
                        return call_both
1119
822
                    # Create the "call_both" function and add it to
1120
823
                    # the class
1121
 
                    attr[attrname] = fixscope(attribute, new_function)
 
824
                    attr[attrname] = fixscope(attribute,
 
825
                                              new_function)
1122
826
                # Is this a D-Bus method?
1123
827
                elif getattr(attribute, "_dbus_is_method", False):
1124
828
                    # Create a new, but exactly alike, function
1135
839
                                        attribute.func_name,
1136
840
                                        attribute.func_defaults,
1137
841
                                        attribute.func_closure)))
1138
 
                    # Copy annotations, if any
1139
 
                    try:
1140
 
                        attr[attrname]._dbus_annotations = (
1141
 
                            dict(attribute._dbus_annotations))
1142
 
                    except AttributeError:
1143
 
                        pass
1144
842
                # Is this a D-Bus property?
1145
843
                elif getattr(attribute, "_dbus_is_property", False):
1146
844
                    # Create a new, but exactly alike, function
1160
858
                                        attribute.func_name,
1161
859
                                        attribute.func_defaults,
1162
860
                                        attribute.func_closure)))
1163
 
                    # Copy annotations, if any
1164
 
                    try:
1165
 
                        attr[attrname]._dbus_annotations = (
1166
 
                            dict(attribute._dbus_annotations))
1167
 
                    except AttributeError:
1168
 
                        pass
1169
 
                # Is this a D-Bus interface?
1170
 
                elif getattr(attribute, "_dbus_is_interface", False):
1171
 
                    # Create a new, but exactly alike, function
1172
 
                    # object.  Decorate it to be a new D-Bus interface
1173
 
                    # with the alternate D-Bus interface name.  Add it
1174
 
                    # to the class.
1175
 
                    attr[attrname] = (dbus_interface_annotations
1176
 
                                      (alt_interface)
1177
 
                                      (types.FunctionType
1178
 
                                       (attribute.func_code,
1179
 
                                        attribute.func_globals,
1180
 
                                        attribute.func_name,
1181
 
                                        attribute.func_defaults,
1182
 
                                        attribute.func_closure)))
1183
 
            if deprecate:
1184
 
                # Deprecate all alternate interfaces
1185
 
                iname="_AlternateDBusNames_interface_annotation{0}"
1186
 
                for interface_name in interface_names:
1187
 
                    @dbus_interface_annotations(interface_name)
1188
 
                    def func(self):
1189
 
                        return { "org.freedesktop.DBus.Deprecated":
1190
 
                                     "true" }
1191
 
                    # Find an unused name
1192
 
                    for aname in (iname.format(i)
1193
 
                                  for i in itertools.count()):
1194
 
                        if aname not in attr:
1195
 
                            attr[aname] = func
1196
 
                            break
1197
 
            if interface_names:
1198
 
                # Replace the class with a new subclass of it with
1199
 
                # methods, signals, etc. as created above.
1200
 
                cls = type(b"{0}Alternate".format(cls.__name__),
1201
 
                           (cls,), attr)
1202
 
        return cls
1203
 
    return wrapper
1204
 
 
1205
 
 
1206
 
@alternate_dbus_interfaces({"se.recompile.Mandos":
1207
 
                                "se.bsnet.fukt.Mandos"})
 
861
        return type.__new__(mcs, name, bases, attr)
 
862
 
1208
863
class ClientDBus(Client, DBusObjectWithProperties):
1209
864
    """A Client class using D-Bus
1210
865
    
1219
874
    # dbus.service.Object doesn't use super(), so we can't either.
1220
875
    
1221
876
    def __init__(self, bus = None, *args, **kwargs):
 
877
        self._approvals_pending = 0
1222
878
        self.bus = bus
1223
879
        Client.__init__(self, *args, **kwargs)
1224
880
        # Only now, when this client is initialized, can it show up on
1230
886
                                 ("/clients/" + client_object_name))
1231
887
        DBusObjectWithProperties.__init__(self, self.bus,
1232
888
                                          self.dbus_object_path)
1233
 
    
 
889
        
1234
890
    def notifychangeproperty(transform_func,
1235
891
                             dbus_name, type_func=lambda x: x,
1236
892
                             variant_level=1):
1237
893
        """ Modify a variable so that it's a property which announces
1238
894
        its changes to DBus.
1239
 
        
 
895
 
1240
896
        transform_fun: Function that takes a value and a variant_level
1241
897
                       and transforms it to a D-Bus type.
1242
898
        dbus_name: D-Bus name of the variable
1259
915
        
1260
916
        return property(lambda self: getattr(self, attrname), setter)
1261
917
    
 
918
    
1262
919
    expires = notifychangeproperty(datetime_to_dbus, "Expires")
1263
920
    approvals_pending = notifychangeproperty(dbus.Boolean,
1264
921
                                             "ApprovalPending",
1271
928
                                       checker is not None)
1272
929
    last_checked_ok = notifychangeproperty(datetime_to_dbus,
1273
930
                                           "LastCheckedOK")
1274
 
    last_checker_status = notifychangeproperty(dbus.Int16,
1275
 
                                               "LastCheckerStatus")
1276
931
    last_approval_request = notifychangeproperty(
1277
932
        datetime_to_dbus, "LastApprovalRequest")
1278
933
    approved_by_default = notifychangeproperty(dbus.Boolean,
1279
934
                                               "ApprovedByDefault")
1280
 
    approval_delay = notifychangeproperty(dbus.UInt64,
 
935
    approval_delay = notifychangeproperty(dbus.UInt16,
1281
936
                                          "ApprovalDelay",
1282
937
                                          type_func =
1283
 
                                          timedelta_to_milliseconds)
 
938
                                          _timedelta_to_milliseconds)
1284
939
    approval_duration = notifychangeproperty(
1285
 
        dbus.UInt64, "ApprovalDuration",
1286
 
        type_func = timedelta_to_milliseconds)
 
940
        dbus.UInt16, "ApprovalDuration",
 
941
        type_func = _timedelta_to_milliseconds)
1287
942
    host = notifychangeproperty(dbus.String, "Host")
1288
 
    timeout = notifychangeproperty(dbus.UInt64, "Timeout",
 
943
    timeout = notifychangeproperty(dbus.UInt16, "Timeout",
1289
944
                                   type_func =
1290
 
                                   timedelta_to_milliseconds)
 
945
                                   _timedelta_to_milliseconds)
1291
946
    extended_timeout = notifychangeproperty(
1292
 
        dbus.UInt64, "ExtendedTimeout",
1293
 
        type_func = timedelta_to_milliseconds)
1294
 
    interval = notifychangeproperty(dbus.UInt64,
 
947
        dbus.UInt16, "ExtendedTimeout",
 
948
        type_func = _timedelta_to_milliseconds)
 
949
    interval = notifychangeproperty(dbus.UInt16,
1295
950
                                    "Interval",
1296
951
                                    type_func =
1297
 
                                    timedelta_to_milliseconds)
 
952
                                    _timedelta_to_milliseconds)
1298
953
    checker_command = notifychangeproperty(dbus.String, "Checker")
1299
954
    
1300
955
    del notifychangeproperty
1342
997
        return r
1343
998
    
1344
999
    def _reset_approved(self):
1345
 
        self.approved = None
 
1000
        self._approved = None
1346
1001
        return False
1347
1002
    
1348
1003
    def approve(self, value=True):
1349
 
        self.approved = value
1350
 
        gobject.timeout_add(timedelta_to_milliseconds
 
1004
        self.send_changedstate()
 
1005
        self._approved = value
 
1006
        gobject.timeout_add(_timedelta_to_milliseconds
1351
1007
                            (self.approval_duration),
1352
1008
                            self._reset_approved)
1353
 
        self.send_changedstate()
 
1009
    
1354
1010
    
1355
1011
    ## D-Bus methods, signals & properties
1356
1012
    _interface = "se.recompile.Mandos.Client"
1357
1013
    
1358
 
    ## Interfaces
1359
 
    
1360
 
    @dbus_interface_annotations(_interface)
1361
 
    def _foo(self):
1362
 
        return { "org.freedesktop.DBus.Property.EmitsChangedSignal":
1363
 
                     "false"}
1364
 
    
1365
1014
    ## Signals
1366
1015
    
1367
1016
    # CheckerCompleted - signal
1466
1115
                           access="readwrite")
1467
1116
    def ApprovalDuration_dbus_property(self, value=None):
1468
1117
        if value is None:       # get
1469
 
            return dbus.UInt64(timedelta_to_milliseconds(
 
1118
            return dbus.UInt64(_timedelta_to_milliseconds(
1470
1119
                    self.approval_duration))
1471
1120
        self.approval_duration = datetime.timedelta(0, 0, 0, value)
1472
1121
    
1486
1135
    def Host_dbus_property(self, value=None):
1487
1136
        if value is None:       # get
1488
1137
            return dbus.String(self.host)
1489
 
        self.host = unicode(value)
 
1138
        self.host = value
1490
1139
    
1491
1140
    # Created - property
1492
1141
    @dbus_service_property(_interface, signature="s", access="read")
1493
1142
    def Created_dbus_property(self):
1494
 
        return datetime_to_dbus(self.created)
 
1143
        return dbus.String(datetime_to_dbus(self.created))
1495
1144
    
1496
1145
    # LastEnabled - property
1497
1146
    @dbus_service_property(_interface, signature="s", access="read")
1518
1167
            return
1519
1168
        return datetime_to_dbus(self.last_checked_ok)
1520
1169
    
1521
 
    # LastCheckerStatus - property
1522
 
    @dbus_service_property(_interface, signature="n",
1523
 
                           access="read")
1524
 
    def LastCheckerStatus_dbus_property(self):
1525
 
        return dbus.Int16(self.last_checker_status)
1526
 
    
1527
1170
    # Expires - property
1528
1171
    @dbus_service_property(_interface, signature="s", access="read")
1529
1172
    def Expires_dbus_property(self):
1540
1183
    def Timeout_dbus_property(self, value=None):
1541
1184
        if value is None:       # get
1542
1185
            return dbus.UInt64(self.timeout_milliseconds())
1543
 
        old_timeout = self.timeout
1544
1186
        self.timeout = datetime.timedelta(0, 0, 0, value)
1545
 
        # Reschedule disabling
1546
 
        if self.enabled:
1547
 
            now = datetime.datetime.utcnow()
1548
 
            self.expires += self.timeout - old_timeout
1549
 
            if self.expires <= now:
1550
 
                # The timeout has passed
1551
 
                self.disable()
1552
 
            else:
1553
 
                if (getattr(self, "disable_initiator_tag", None)
1554
 
                    is None):
1555
 
                    return
1556
 
                gobject.source_remove(self.disable_initiator_tag)
1557
 
                self.disable_initiator_tag = (
1558
 
                    gobject.timeout_add(
1559
 
                        timedelta_to_milliseconds(self.expires - now),
1560
 
                        self.disable))
 
1187
        if getattr(self, "disable_initiator_tag", None) is None:
 
1188
            return
 
1189
        # Reschedule timeout
 
1190
        gobject.source_remove(self.disable_initiator_tag)
 
1191
        self.disable_initiator_tag = None
 
1192
        self.expires = None
 
1193
        time_to_die = _timedelta_to_milliseconds((self
 
1194
                                                  .last_checked_ok
 
1195
                                                  + self.timeout)
 
1196
                                                 - datetime.datetime
 
1197
                                                 .utcnow())
 
1198
        if time_to_die <= 0:
 
1199
            # The timeout has passed
 
1200
            self.disable()
 
1201
        else:
 
1202
            self.expires = (datetime.datetime.utcnow()
 
1203
                            + datetime.timedelta(milliseconds =
 
1204
                                                 time_to_die))
 
1205
            self.disable_initiator_tag = (gobject.timeout_add
 
1206
                                          (time_to_die, self.disable))
1561
1207
    
1562
1208
    # ExtendedTimeout - property
1563
1209
    @dbus_service_property(_interface, signature="t",
1576
1222
        self.interval = datetime.timedelta(0, 0, 0, value)
1577
1223
        if getattr(self, "checker_initiator_tag", None) is None:
1578
1224
            return
1579
 
        if self.enabled:
1580
 
            # Reschedule checker run
1581
 
            gobject.source_remove(self.checker_initiator_tag)
1582
 
            self.checker_initiator_tag = (gobject.timeout_add
1583
 
                                          (value, self.start_checker))
1584
 
            self.start_checker()    # Start one now, too
 
1225
        # Reschedule checker run
 
1226
        gobject.source_remove(self.checker_initiator_tag)
 
1227
        self.checker_initiator_tag = (gobject.timeout_add
 
1228
                                      (value, self.start_checker))
 
1229
        self.start_checker()    # Start one now, too
1585
1230
    
1586
1231
    # Checker - property
1587
1232
    @dbus_service_property(_interface, signature="s",
1589
1234
    def Checker_dbus_property(self, value=None):
1590
1235
        if value is None:       # get
1591
1236
            return dbus.String(self.checker_command)
1592
 
        self.checker_command = unicode(value)
 
1237
        self.checker_command = value
1593
1238
    
1594
1239
    # CheckerRunning - property
1595
1240
    @dbus_service_property(_interface, signature="b",
1624
1269
            raise KeyError()
1625
1270
    
1626
1271
    def __getattribute__(self, name):
1627
 
        if name == '_pipe':
 
1272
        if(name == '_pipe'):
1628
1273
            return super(ProxyClient, self).__getattribute__(name)
1629
1274
        self._pipe.send(('getattr', name))
1630
1275
        data = self._pipe.recv()
1637
1282
            return func
1638
1283
    
1639
1284
    def __setattr__(self, name, value):
1640
 
        if name == '_pipe':
 
1285
        if(name == '_pipe'):
1641
1286
            return super(ProxyClient, self).__setattr__(name, value)
1642
1287
        self._pipe.send(('setattr', name, value))
1643
1288
 
 
1289
class ClientDBusTransitional(ClientDBus):
 
1290
    __metaclass__ = AlternateDBusNamesMetaclass
1644
1291
 
1645
1292
class ClientHandler(socketserver.BaseRequestHandler, object):
1646
1293
    """A class to handle client connections.
1729
1376
                            client.Rejected("Disabled")
1730
1377
                        return
1731
1378
                    
1732
 
                    if client.approved or not client.approval_delay:
 
1379
                    if client._approved or not client.approval_delay:
1733
1380
                        #We are approved or approval is disabled
1734
1381
                        break
1735
 
                    elif client.approved is None:
 
1382
                    elif client._approved is None:
1736
1383
                        logger.info("Client %s needs approval",
1737
1384
                                    client.name)
1738
1385
                        if self.server.use_dbus:
1751
1398
                    #wait until timeout or approved
1752
1399
                    time = datetime.datetime.now()
1753
1400
                    client.changedstate.acquire()
1754
 
                    client.changedstate.wait(
1755
 
                        float(timedelta_to_milliseconds(delay)
1756
 
                              / 1000))
 
1401
                    (client.changedstate.wait
 
1402
                     (float(client._timedelta_to_milliseconds(delay)
 
1403
                            / 1000)))
1757
1404
                    client.changedstate.release()
1758
1405
                    time2 = datetime.datetime.now()
1759
1406
                    if (time2 - time) >= delay:
1775
1422
                    try:
1776
1423
                        sent = session.send(client.secret[sent_size:])
1777
1424
                    except gnutls.errors.GNUTLSError as error:
1778
 
                        logger.warning("gnutls send failed",
1779
 
                                       exc_info=error)
 
1425
                        logger.warning("gnutls send failed")
1780
1426
                        return
1781
1427
                    logger.debug("Sent: %d, remaining: %d",
1782
1428
                                 sent, len(client.secret)
1785
1431
                
1786
1432
                logger.info("Sending secret to %s", client.name)
1787
1433
                # bump the timeout using extended_timeout
1788
 
                client.bump_timeout(client.extended_timeout)
 
1434
                client.checked_ok(client.extended_timeout)
1789
1435
                if self.server.use_dbus:
1790
1436
                    # Emit D-Bus signal
1791
1437
                    client.GotSecret()
1796
1442
                try:
1797
1443
                    session.bye()
1798
1444
                except gnutls.errors.GNUTLSError as error:
1799
 
                    logger.warning("GnuTLS bye failed",
1800
 
                                   exc_info=error)
 
1445
                    logger.warning("GnuTLS bye failed")
1801
1446
    
1802
1447
    @staticmethod
1803
1448
    def peer_certificate(session):
1859
1504
        # Convert the buffer to a Python bytestring
1860
1505
        fpr = ctypes.string_at(buf, buf_len.value)
1861
1506
        # Convert the bytestring to hexadecimal notation
1862
 
        hex_fpr = binascii.hexlify(fpr).upper()
 
1507
        hex_fpr = ''.join("%02X" % ord(char) for char in fpr)
1863
1508
        return hex_fpr
1864
1509
 
1865
1510
 
1868
1513
    def sub_process_main(self, request, address):
1869
1514
        try:
1870
1515
            self.finish_request(request, address)
1871
 
        except Exception:
 
1516
        except:
1872
1517
            self.handle_error(request, address)
1873
1518
        self.close_request(request)
1874
1519
    
1875
1520
    def process_request(self, request, address):
1876
1521
        """Start a new process to process the request."""
1877
1522
        proc = multiprocessing.Process(target = self.sub_process_main,
1878
 
                                       args = (request, address))
 
1523
                                       args = (request,
 
1524
                                               address))
1879
1525
        proc.start()
1880
1526
        return proc
1881
1527
 
1909
1555
        use_ipv6:       Boolean; to use IPv6 or not
1910
1556
    """
1911
1557
    def __init__(self, server_address, RequestHandlerClass,
1912
 
                 interface=None, use_ipv6=True, socketfd=None):
1913
 
        """If socketfd is set, use that file descriptor instead of
1914
 
        creating a new one with socket.socket().
1915
 
        """
 
1558
                 interface=None, use_ipv6=True):
1916
1559
        self.interface = interface
1917
1560
        if use_ipv6:
1918
1561
            self.address_family = socket.AF_INET6
1919
 
        if socketfd is not None:
1920
 
            # Save the file descriptor
1921
 
            self.socketfd = socketfd
1922
 
            # Save the original socket.socket() function
1923
 
            self.socket_socket = socket.socket
1924
 
            # To implement --socket, we monkey patch socket.socket.
1925
 
            # 
1926
 
            # (When socketserver.TCPServer is a new-style class, we
1927
 
            # could make self.socket into a property instead of monkey
1928
 
            # patching socket.socket.)
1929
 
            # 
1930
 
            # Create a one-time-only replacement for socket.socket()
1931
 
            @functools.wraps(socket.socket)
1932
 
            def socket_wrapper(*args, **kwargs):
1933
 
                # Restore original function so subsequent calls are
1934
 
                # not affected.
1935
 
                socket.socket = self.socket_socket
1936
 
                del self.socket_socket
1937
 
                # This time only, return a new socket object from the
1938
 
                # saved file descriptor.
1939
 
                return socket.fromfd(self.socketfd, *args, **kwargs)
1940
 
            # Replace socket.socket() function with wrapper
1941
 
            socket.socket = socket_wrapper
1942
 
        # The socketserver.TCPServer.__init__ will call
1943
 
        # socket.socket(), which might be our replacement,
1944
 
        # socket_wrapper(), if socketfd was set.
1945
1562
        socketserver.TCPServer.__init__(self, server_address,
1946
1563
                                        RequestHandlerClass)
1947
 
    
1948
1564
    def server_bind(self):
1949
1565
        """This overrides the normal server_bind() function
1950
1566
        to bind to an interface if one was specified, and also NOT to
1958
1574
                try:
1959
1575
                    self.socket.setsockopt(socket.SOL_SOCKET,
1960
1576
                                           SO_BINDTODEVICE,
1961
 
                                           str(self.interface + '\0'))
 
1577
                                           str(self.interface
 
1578
                                               + '\0'))
1962
1579
                except socket.error as error:
1963
 
                    if error.errno == errno.EPERM:
1964
 
                        logger.error("No permission to bind to"
1965
 
                                     " interface %s", self.interface)
1966
 
                    elif error.errno == errno.ENOPROTOOPT:
 
1580
                    if error[0] == errno.EPERM:
 
1581
                        logger.error("No permission to"
 
1582
                                     " bind to interface %s",
 
1583
                                     self.interface)
 
1584
                    elif error[0] == errno.ENOPROTOOPT:
1967
1585
                        logger.error("SO_BINDTODEVICE not available;"
1968
1586
                                     " cannot bind to interface %s",
1969
1587
                                     self.interface)
1970
 
                    elif error.errno == errno.ENODEV:
1971
 
                        logger.error("Interface %s does not exist,"
1972
 
                                     " cannot bind", self.interface)
1973
1588
                    else:
1974
1589
                        raise
1975
1590
        # Only bind(2) the socket if we really need to.
2005
1620
    """
2006
1621
    def __init__(self, server_address, RequestHandlerClass,
2007
1622
                 interface=None, use_ipv6=True, clients=None,
2008
 
                 gnutls_priority=None, use_dbus=True, socketfd=None):
 
1623
                 gnutls_priority=None, use_dbus=True):
2009
1624
        self.enabled = False
2010
1625
        self.clients = clients
2011
1626
        if self.clients is None:
2012
 
            self.clients = {}
 
1627
            self.clients = set()
2013
1628
        self.use_dbus = use_dbus
2014
1629
        self.gnutls_priority = gnutls_priority
2015
1630
        IPv6_TCPServer.__init__(self, server_address,
2016
1631
                                RequestHandlerClass,
2017
1632
                                interface = interface,
2018
 
                                use_ipv6 = use_ipv6,
2019
 
                                socketfd = socketfd)
 
1633
                                use_ipv6 = use_ipv6)
2020
1634
    def server_activate(self):
2021
1635
        if self.enabled:
2022
1636
            return socketserver.TCPServer.server_activate(self)
2035
1649
    
2036
1650
    def handle_ipc(self, source, condition, parent_pipe=None,
2037
1651
                   proc = None, client_object=None):
 
1652
        condition_names = {
 
1653
            gobject.IO_IN: "IN",   # There is data to read.
 
1654
            gobject.IO_OUT: "OUT", # Data can be written (without
 
1655
                                    # blocking).
 
1656
            gobject.IO_PRI: "PRI", # There is urgent data to read.
 
1657
            gobject.IO_ERR: "ERR", # Error condition.
 
1658
            gobject.IO_HUP: "HUP"  # Hung up (the connection has been
 
1659
                                    # broken, usually for pipes and
 
1660
                                    # sockets).
 
1661
            }
 
1662
        conditions_string = ' | '.join(name
 
1663
                                       for cond, name in
 
1664
                                       condition_names.iteritems()
 
1665
                                       if cond & condition)
2038
1666
        # error, or the other end of multiprocessing.Pipe has closed
2039
 
        if condition & (gobject.IO_ERR | gobject.IO_HUP):
 
1667
        if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):
2040
1668
            # Wait for other process to exit
2041
1669
            proc.join()
2042
1670
            return False
2049
1677
            fpr = request[1]
2050
1678
            address = request[2]
2051
1679
            
2052
 
            for c in self.clients.itervalues():
 
1680
            for c in self.clients:
2053
1681
                if c.fingerprint == fpr:
2054
1682
                    client = c
2055
1683
                    break
2100
1728
        return True
2101
1729
 
2102
1730
 
2103
 
def rfc3339_duration_to_delta(duration):
2104
 
    """Parse an RFC 3339 "duration" and return a datetime.timedelta
2105
 
    
2106
 
    >>> rfc3339_duration_to_delta("P7D")
2107
 
    datetime.timedelta(7)
2108
 
    >>> rfc3339_duration_to_delta("PT60S")
2109
 
    datetime.timedelta(0, 60)
2110
 
    >>> rfc3339_duration_to_delta("PT60M")
2111
 
    datetime.timedelta(0, 3600)
2112
 
    >>> rfc3339_duration_to_delta("PT24H")
2113
 
    datetime.timedelta(1)
2114
 
    >>> rfc3339_duration_to_delta("P1W")
2115
 
    datetime.timedelta(7)
2116
 
    >>> rfc3339_duration_to_delta("PT5M30S")
2117
 
    datetime.timedelta(0, 330)
2118
 
    >>> rfc3339_duration_to_delta("P1DT3M20S")
2119
 
    datetime.timedelta(1, 200)
2120
 
    """
2121
 
    
2122
 
    # Parsing an RFC 3339 duration with regular expressions is not
2123
 
    # possible - there would have to be multiple places for the same
2124
 
    # values, like seconds.  The current code, while more esoteric, is
2125
 
    # cleaner without depending on a parsing library.  If Python had a
2126
 
    # built-in library for parsing we would use it, but we'd like to
2127
 
    # avoid excessive use of external libraries.
2128
 
    
2129
 
    # New type for defining tokens, syntax, and semantics all-in-one
2130
 
    Token = collections.namedtuple("Token",
2131
 
                                   ("regexp", # To match token; if
2132
 
                                              # "value" is not None,
2133
 
                                              # must have a "group"
2134
 
                                              # containing digits
2135
 
                                    "value",  # datetime.timedelta or
2136
 
                                              # None
2137
 
                                    "followers")) # Tokens valid after
2138
 
                                                  # this token
2139
 
    # RFC 3339 "duration" tokens, syntax, and semantics; taken from
2140
 
    # the "duration" ABNF definition in RFC 3339, Appendix A.
2141
 
    token_end = Token(re.compile(r"$"), None, frozenset())
2142
 
    token_second = Token(re.compile(r"(\d+)S"),
2143
 
                         datetime.timedelta(seconds=1),
2144
 
                         frozenset((token_end,)))
2145
 
    token_minute = Token(re.compile(r"(\d+)M"),
2146
 
                         datetime.timedelta(minutes=1),
2147
 
                         frozenset((token_second, token_end)))
2148
 
    token_hour = Token(re.compile(r"(\d+)H"),
2149
 
                       datetime.timedelta(hours=1),
2150
 
                       frozenset((token_minute, token_end)))
2151
 
    token_time = Token(re.compile(r"T"),
2152
 
                       None,
2153
 
                       frozenset((token_hour, token_minute,
2154
 
                                  token_second)))
2155
 
    token_day = Token(re.compile(r"(\d+)D"),
2156
 
                      datetime.timedelta(days=1),
2157
 
                      frozenset((token_time, token_end)))
2158
 
    token_month = Token(re.compile(r"(\d+)M"),
2159
 
                        datetime.timedelta(weeks=4),
2160
 
                        frozenset((token_day, token_end)))
2161
 
    token_year = Token(re.compile(r"(\d+)Y"),
2162
 
                       datetime.timedelta(weeks=52),
2163
 
                       frozenset((token_month, token_end)))
2164
 
    token_week = Token(re.compile(r"(\d+)W"),
2165
 
                       datetime.timedelta(weeks=1),
2166
 
                       frozenset((token_end,)))
2167
 
    token_duration = Token(re.compile(r"P"), None,
2168
 
                           frozenset((token_year, token_month,
2169
 
                                      token_day, token_time,
2170
 
                                      token_week))),
2171
 
    # Define starting values
2172
 
    value = datetime.timedelta() # Value so far
2173
 
    found_token = None
2174
 
    followers = frozenset(token_duration,) # Following valid tokens
2175
 
    s = duration                # String left to parse
2176
 
    # Loop until end token is found
2177
 
    while found_token is not token_end:
2178
 
        # Search for any currently valid tokens
2179
 
        for token in followers:
2180
 
            match = token.regexp.match(s)
2181
 
            if match is not None:
2182
 
                # Token found
2183
 
                if token.value is not None:
2184
 
                    # Value found, parse digits
2185
 
                    factor = int(match.group(1), 10)
2186
 
                    # Add to value so far
2187
 
                    value += factor * token.value
2188
 
                # Strip token from string
2189
 
                s = token.regexp.sub("", s, 1)
2190
 
                # Go to found token
2191
 
                found_token = token
2192
 
                # Set valid next tokens
2193
 
                followers = found_token.followers
2194
 
                break
2195
 
        else:
2196
 
            # No currently valid tokens were found
2197
 
            raise ValueError("Invalid RFC 3339 duration")
2198
 
    # End token found
2199
 
    return value
2200
 
 
2201
 
 
2202
1731
def string_to_delta(interval):
2203
1732
    """Parse a string and return a datetime.timedelta
2204
1733
    
2215
1744
    >>> string_to_delta('5m 30s')
2216
1745
    datetime.timedelta(0, 330)
2217
1746
    """
2218
 
    
2219
 
    try:
2220
 
        return rfc3339_duration_to_delta(interval)
2221
 
    except ValueError:
2222
 
        pass
2223
 
    
2224
1747
    timevalue = datetime.timedelta(0)
2225
1748
    for s in interval.split():
2226
1749
        try:
2237
1760
            elif suffix == "w":
2238
1761
                delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
2239
1762
            else:
2240
 
                raise ValueError("Unknown suffix {0!r}"
2241
 
                                 .format(suffix))
 
1763
                raise ValueError("Unknown suffix %r" % suffix)
2242
1764
        except (ValueError, IndexError) as e:
2243
1765
            raise ValueError(*(e.args))
2244
1766
        timevalue += delta
2245
1767
    return timevalue
2246
1768
 
2247
1769
 
 
1770
def if_nametoindex(interface):
 
1771
    """Call the C function if_nametoindex(), or equivalent
 
1772
    
 
1773
    Note: This function cannot accept a unicode string."""
 
1774
    global if_nametoindex
 
1775
    try:
 
1776
        if_nametoindex = (ctypes.cdll.LoadLibrary
 
1777
                          (ctypes.util.find_library("c"))
 
1778
                          .if_nametoindex)
 
1779
    except (OSError, AttributeError):
 
1780
        logger.warning("Doing if_nametoindex the hard way")
 
1781
        def if_nametoindex(interface):
 
1782
            "Get an interface index the hard way, i.e. using fcntl()"
 
1783
            SIOCGIFINDEX = 0x8933  # From /usr/include/linux/sockios.h
 
1784
            with contextlib.closing(socket.socket()) as s:
 
1785
                ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
 
1786
                                    struct.pack(str("16s16x"),
 
1787
                                                interface))
 
1788
            interface_index = struct.unpack(str("I"),
 
1789
                                            ifreq[16:20])[0]
 
1790
            return interface_index
 
1791
    return if_nametoindex(interface)
 
1792
 
 
1793
 
2248
1794
def daemon(nochdir = False, noclose = False):
2249
1795
    """See daemon(3).  Standard BSD Unix function.
2250
1796
    
2258
1804
        sys.exit()
2259
1805
    if not noclose:
2260
1806
        # Close all standard open file descriptors
2261
 
        null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
 
1807
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
2262
1808
        if not stat.S_ISCHR(os.fstat(null).st_mode):
2263
1809
            raise OSError(errno.ENODEV,
2264
 
                          "{0} not a character device"
2265
 
                          .format(os.devnull))
 
1810
                          "%s not a character device"
 
1811
                          % os.path.devnull)
2266
1812
        os.dup2(null, sys.stdin.fileno())
2267
1813
        os.dup2(null, sys.stdout.fileno())
2268
1814
        os.dup2(null, sys.stderr.fileno())
2277
1823
    
2278
1824
    parser = argparse.ArgumentParser()
2279
1825
    parser.add_argument("-v", "--version", action="version",
2280
 
                        version = "%(prog)s {0}".format(version),
 
1826
                        version = "%%(prog)s %s" % version,
2281
1827
                        help="show version number and exit")
2282
1828
    parser.add_argument("-i", "--interface", metavar="IF",
2283
1829
                        help="Bind to interface IF")
2305
1851
                        " system bus interface")
2306
1852
    parser.add_argument("--no-ipv6", action="store_false",
2307
1853
                        dest="use_ipv6", help="Do not use IPv6")
2308
 
    parser.add_argument("--no-restore", action="store_false",
2309
 
                        dest="restore", help="Do not restore stored"
2310
 
                        " state")
2311
 
    parser.add_argument("--socket", type=int,
2312
 
                        help="Specify a file descriptor to a network"
2313
 
                        " socket to use instead of creating one")
2314
 
    parser.add_argument("--statedir", metavar="DIR",
2315
 
                        help="Directory to save/restore state in")
2316
 
    parser.add_argument("--foreground", action="store_true",
2317
 
                        help="Run in foreground")
2318
 
    
2319
1854
    options = parser.parse_args()
2320
1855
    
2321
1856
    if options.check:
2334
1869
                        "use_dbus": "True",
2335
1870
                        "use_ipv6": "True",
2336
1871
                        "debuglevel": "",
2337
 
                        "restore": "True",
2338
 
                        "socket": "",
2339
 
                        "statedir": "/var/lib/mandos",
2340
 
                        "foreground": "False",
2341
1872
                        }
2342
1873
    
2343
1874
    # Parse config file for server-global settings
2348
1879
    # Convert the SafeConfigParser object to a dict
2349
1880
    server_settings = server_config.defaults()
2350
1881
    # Use the appropriate methods on the non-string config options
2351
 
    for option in ("debug", "use_dbus", "use_ipv6", "foreground"):
 
1882
    for option in ("debug", "use_dbus", "use_ipv6"):
2352
1883
        server_settings[option] = server_config.getboolean("DEFAULT",
2353
1884
                                                           option)
2354
1885
    if server_settings["port"]:
2355
1886
        server_settings["port"] = server_config.getint("DEFAULT",
2356
1887
                                                       "port")
2357
 
    if server_settings["socket"]:
2358
 
        server_settings["socket"] = server_config.getint("DEFAULT",
2359
 
                                                         "socket")
2360
 
        # Later, stdin will, and stdout and stderr might, be dup'ed
2361
 
        # over with an opened os.devnull.  But we don't want this to
2362
 
        # happen with a supplied network socket.
2363
 
        if 0 <= server_settings["socket"] <= 2:
2364
 
            server_settings["socket"] = os.dup(server_settings
2365
 
                                               ["socket"])
2366
1888
    del server_config
2367
1889
    
2368
1890
    # Override the settings from the config file with command line
2369
1891
    # options, if set.
2370
1892
    for option in ("interface", "address", "port", "debug",
2371
1893
                   "priority", "servicename", "configdir",
2372
 
                   "use_dbus", "use_ipv6", "debuglevel", "restore",
2373
 
                   "statedir", "socket", "foreground"):
 
1894
                   "use_dbus", "use_ipv6", "debuglevel"):
2374
1895
        value = getattr(options, option)
2375
1896
        if value is not None:
2376
1897
            server_settings[option] = value
2379
1900
    for option in server_settings.keys():
2380
1901
        if type(server_settings[option]) is str:
2381
1902
            server_settings[option] = unicode(server_settings[option])
2382
 
    # Debug implies foreground
2383
 
    if server_settings["debug"]:
2384
 
        server_settings["foreground"] = True
2385
1903
    # Now we have our good server settings in "server_settings"
2386
1904
    
2387
1905
    ##################################################################
2391
1909
    debuglevel = server_settings["debuglevel"]
2392
1910
    use_dbus = server_settings["use_dbus"]
2393
1911
    use_ipv6 = server_settings["use_ipv6"]
2394
 
    stored_state_path = os.path.join(server_settings["statedir"],
2395
 
                                     stored_state_file)
2396
 
    foreground = server_settings["foreground"]
2397
 
    
2398
 
    if debug:
2399
 
        initlogger(debug, logging.DEBUG)
2400
 
    else:
2401
 
        if not debuglevel:
2402
 
            initlogger(debug)
2403
 
        else:
2404
 
            level = getattr(logging, debuglevel.upper())
2405
 
            initlogger(debug, level)
2406
1912
    
2407
1913
    if server_settings["servicename"] != "Mandos":
2408
1914
        syslogger.setFormatter(logging.Formatter
2409
 
                               ('Mandos ({0}) [%(process)d]:'
2410
 
                                ' %(levelname)s: %(message)s'
2411
 
                                .format(server_settings
2412
 
                                        ["servicename"])))
 
1915
                               ('Mandos (%s) [%%(process)d]:'
 
1916
                                ' %%(levelname)s: %%(message)s'
 
1917
                                % server_settings["servicename"]))
2413
1918
    
2414
1919
    # Parse config file with clients
2415
 
    client_config = configparser.SafeConfigParser(Client
2416
 
                                                  .client_defaults)
 
1920
    client_defaults = { "timeout": "5m",
 
1921
                        "extended_timeout": "15m",
 
1922
                        "interval": "2m",
 
1923
                        "checker": "fping -q -- %%(host)s",
 
1924
                        "host": "",
 
1925
                        "approval_delay": "0s",
 
1926
                        "approval_duration": "1s",
 
1927
                        }
 
1928
    client_config = configparser.SafeConfigParser(client_defaults)
2417
1929
    client_config.read(os.path.join(server_settings["configdir"],
2418
1930
                                    "clients.conf"))
2419
1931
    
2428
1940
                              use_ipv6=use_ipv6,
2429
1941
                              gnutls_priority=
2430
1942
                              server_settings["priority"],
2431
 
                              use_dbus=use_dbus,
2432
 
                              socketfd=(server_settings["socket"]
2433
 
                                        or None))
2434
 
    if not foreground:
 
1943
                              use_dbus=use_dbus)
 
1944
    if not debug:
2435
1945
        pidfilename = "/var/run/mandos.pid"
2436
 
        pidfile = None
2437
1946
        try:
2438
1947
            pidfile = open(pidfilename, "w")
2439
 
        except IOError as e:
2440
 
            logger.error("Could not open file %r", pidfilename,
2441
 
                         exc_info=e)
 
1948
        except IOError:
 
1949
            logger.error("Could not open file %r", pidfilename)
2442
1950
    
2443
 
    for name in ("_mandos", "mandos", "nobody"):
 
1951
    try:
 
1952
        uid = pwd.getpwnam("_mandos").pw_uid
 
1953
        gid = pwd.getpwnam("_mandos").pw_gid
 
1954
    except KeyError:
2444
1955
        try:
2445
 
            uid = pwd.getpwnam(name).pw_uid
2446
 
            gid = pwd.getpwnam(name).pw_gid
2447
 
            break
 
1956
            uid = pwd.getpwnam("mandos").pw_uid
 
1957
            gid = pwd.getpwnam("mandos").pw_gid
2448
1958
        except KeyError:
2449
 
            continue
2450
 
    else:
2451
 
        uid = 65534
2452
 
        gid = 65534
 
1959
            try:
 
1960
                uid = pwd.getpwnam("nobody").pw_uid
 
1961
                gid = pwd.getpwnam("nobody").pw_gid
 
1962
            except KeyError:
 
1963
                uid = 65534
 
1964
                gid = 65534
2453
1965
    try:
2454
1966
        os.setgid(gid)
2455
1967
        os.setuid(uid)
2456
1968
    except OSError as error:
2457
 
        if error.errno != errno.EPERM:
 
1969
        if error[0] != errno.EPERM:
2458
1970
            raise error
2459
1971
    
 
1972
    if not debug and not debuglevel:
 
1973
        syslogger.setLevel(logging.WARNING)
 
1974
        console.setLevel(logging.WARNING)
 
1975
    if debuglevel:
 
1976
        level = getattr(logging, debuglevel.upper())
 
1977
        syslogger.setLevel(level)
 
1978
        console.setLevel(level)
 
1979
    
2460
1980
    if debug:
2461
1981
        # Enable all possible GnuTLS debugging
2462
1982
        
2472
1992
         .gnutls_global_set_log_function(debug_gnutls))
2473
1993
        
2474
1994
        # Redirect stdin so all checkers get /dev/null
2475
 
        null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
 
1995
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
2476
1996
        os.dup2(null, sys.stdin.fileno())
2477
1997
        if null > 2:
2478
1998
            os.close(null)
 
1999
    else:
 
2000
        # No console logging
 
2001
        logger.removeHandler(console)
2479
2002
    
2480
2003
    # Need to fork before connecting to D-Bus
2481
 
    if not foreground:
 
2004
    if not debug:
2482
2005
        # Close all input and output, do double fork, etc.
2483
2006
        daemon()
2484
2007
    
2485
 
    # multiprocessing will use threads, so before we use gobject we
2486
 
    # need to inform gobject that threads will be used.
2487
 
    gobject.threads_init()
2488
 
    
2489
2008
    global main_loop
2490
2009
    # From the Avahi example code
2491
 
    DBusGMainLoop(set_as_default=True)
 
2010
    DBusGMainLoop(set_as_default=True )
2492
2011
    main_loop = gobject.MainLoop()
2493
2012
    bus = dbus.SystemBus()
2494
2013
    # End of Avahi example code
2500
2019
                            ("se.bsnet.fukt.Mandos", bus,
2501
2020
                             do_not_queue=True))
2502
2021
        except dbus.exceptions.NameExistsException as e:
2503
 
            logger.error("Disabling D-Bus:", exc_info=e)
 
2022
            logger.error(unicode(e) + ", disabling D-Bus")
2504
2023
            use_dbus = False
2505
2024
            server_settings["use_dbus"] = False
2506
2025
            tcp_server.use_dbus = False
2507
2026
    protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2508
 
    service = AvahiServiceToSyslog(name =
2509
 
                                   server_settings["servicename"],
2510
 
                                   servicetype = "_mandos._tcp",
2511
 
                                   protocol = protocol, bus = bus)
 
2027
    service = AvahiService(name = server_settings["servicename"],
 
2028
                           servicetype = "_mandos._tcp",
 
2029
                           protocol = protocol, bus = bus)
2512
2030
    if server_settings["interface"]:
2513
2031
        service.interface = (if_nametoindex
2514
2032
                             (str(server_settings["interface"])))
2518
2036
    
2519
2037
    client_class = Client
2520
2038
    if use_dbus:
2521
 
        client_class = functools.partial(ClientDBus, bus = bus)
2522
 
    
2523
 
    client_settings = Client.config_parser(client_config)
2524
 
    old_client_settings = {}
2525
 
    clients_data = {}
2526
 
    
2527
 
    # Get client data and settings from last running state.
2528
 
    if server_settings["restore"]:
2529
 
        try:
2530
 
            with open(stored_state_path, "rb") as stored_state:
2531
 
                clients_data, old_client_settings = (pickle.load
2532
 
                                                     (stored_state))
2533
 
            os.remove(stored_state_path)
2534
 
        except IOError as e:
2535
 
            if e.errno == errno.ENOENT:
2536
 
                logger.warning("Could not load persistent state: {0}"
2537
 
                                .format(os.strerror(e.errno)))
2538
 
            else:
2539
 
                logger.critical("Could not load persistent state:",
2540
 
                                exc_info=e)
2541
 
                raise
2542
 
        except EOFError as e:
2543
 
            logger.warning("Could not load persistent state: "
2544
 
                           "EOFError:", exc_info=e)
2545
 
    
2546
 
    with PGPEngine() as pgp:
2547
 
        for client_name, client in clients_data.iteritems():
2548
 
            # Decide which value to use after restoring saved state.
2549
 
            # We have three different values: Old config file,
2550
 
            # new config file, and saved state.
2551
 
            # New config value takes precedence if it differs from old
2552
 
            # config value, otherwise use saved state.
2553
 
            for name, value in client_settings[client_name].items():
2554
 
                try:
2555
 
                    # For each value in new config, check if it
2556
 
                    # differs from the old config value (Except for
2557
 
                    # the "secret" attribute)
2558
 
                    if (name != "secret" and
2559
 
                        value != old_client_settings[client_name]
2560
 
                        [name]):
2561
 
                        client[name] = value
2562
 
                except KeyError:
2563
 
                    pass
2564
 
            
2565
 
            # Clients who has passed its expire date can still be
2566
 
            # enabled if its last checker was successful.  Clients
2567
 
            # whose checker succeeded before we stored its state is
2568
 
            # assumed to have successfully run all checkers during
2569
 
            # downtime.
2570
 
            if client["enabled"]:
2571
 
                if datetime.datetime.utcnow() >= client["expires"]:
2572
 
                    if not client["last_checked_ok"]:
2573
 
                        logger.warning(
2574
 
                            "disabling client {0} - Client never "
2575
 
                            "performed a successful checker"
2576
 
                            .format(client_name))
2577
 
                        client["enabled"] = False
2578
 
                    elif client["last_checker_status"] != 0:
2579
 
                        logger.warning(
2580
 
                            "disabling client {0} - Client "
2581
 
                            "last checker failed with error code {1}"
2582
 
                            .format(client_name,
2583
 
                                    client["last_checker_status"]))
2584
 
                        client["enabled"] = False
2585
 
                    else:
2586
 
                        client["expires"] = (datetime.datetime
2587
 
                                             .utcnow()
2588
 
                                             + client["timeout"])
2589
 
                        logger.debug("Last checker succeeded,"
2590
 
                                     " keeping {0} enabled"
2591
 
                                     .format(client_name))
 
2039
        client_class = functools.partial(ClientDBusTransitional,
 
2040
                                         bus = bus)
 
2041
    def client_config_items(config, section):
 
2042
        special_settings = {
 
2043
            "approved_by_default":
 
2044
                lambda: config.getboolean(section,
 
2045
                                          "approved_by_default"),
 
2046
            }
 
2047
        for name, value in config.items(section):
2592
2048
            try:
2593
 
                client["secret"] = (
2594
 
                    pgp.decrypt(client["encrypted_secret"],
2595
 
                                client_settings[client_name]
2596
 
                                ["secret"]))
2597
 
            except PGPError:
2598
 
                # If decryption fails, we use secret from new settings
2599
 
                logger.debug("Failed to decrypt {0} old secret"
2600
 
                             .format(client_name))
2601
 
                client["secret"] = (
2602
 
                    client_settings[client_name]["secret"])
2603
 
    
2604
 
    # Add/remove clients based on new changes made to config
2605
 
    for client_name in (set(old_client_settings)
2606
 
                        - set(client_settings)):
2607
 
        del clients_data[client_name]
2608
 
    for client_name in (set(client_settings)
2609
 
                        - set(old_client_settings)):
2610
 
        clients_data[client_name] = client_settings[client_name]
2611
 
    
2612
 
    # Create all client objects
2613
 
    for client_name, client in clients_data.iteritems():
2614
 
        tcp_server.clients[client_name] = client_class(
2615
 
            name = client_name, settings = client)
2616
 
    
 
2049
                yield (name, special_settings[name]())
 
2050
            except KeyError:
 
2051
                yield (name, value)
 
2052
    
 
2053
    tcp_server.clients.update(set(
 
2054
            client_class(name = section,
 
2055
                         config= dict(client_config_items(
 
2056
                        client_config, section)))
 
2057
            for section in client_config.sections()))
2617
2058
    if not tcp_server.clients:
2618
2059
        logger.warning("No clients defined")
2619
 
    
2620
 
    if not foreground:
2621
 
        if pidfile is not None:
2622
 
            try:
2623
 
                with pidfile:
2624
 
                    pid = os.getpid()
2625
 
                    pidfile.write(str(pid) + "\n".encode("utf-8"))
2626
 
            except IOError:
2627
 
                logger.error("Could not write to file %r with PID %d",
2628
 
                             pidfilename, pid)
2629
 
        del pidfile
 
2060
        
 
2061
    if not debug:
 
2062
        try:
 
2063
            with pidfile:
 
2064
                pid = os.getpid()
 
2065
                pidfile.write(str(pid) + "\n".encode("utf-8"))
 
2066
            del pidfile
 
2067
        except IOError:
 
2068
            logger.error("Could not write to file %r with PID %d",
 
2069
                         pidfilename, pid)
 
2070
        except NameError:
 
2071
            # "pidfile" was never created
 
2072
            pass
2630
2073
        del pidfilename
 
2074
        
 
2075
        signal.signal(signal.SIGINT, signal.SIG_IGN)
2631
2076
    
2632
2077
    signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2633
2078
    signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
2634
2079
    
2635
2080
    if use_dbus:
2636
 
        @alternate_dbus_interfaces({"se.recompile.Mandos":
2637
 
                                        "se.bsnet.fukt.Mandos"})
2638
 
        class MandosDBusService(DBusObjectWithProperties):
 
2081
        class MandosDBusService(dbus.service.Object):
2639
2082
            """A D-Bus proxy object"""
2640
2083
            def __init__(self):
2641
2084
                dbus.service.Object.__init__(self, bus, "/")
2642
2085
            _interface = "se.recompile.Mandos"
2643
2086
            
2644
 
            @dbus_interface_annotations(_interface)
2645
 
            def _foo(self):
2646
 
                return { "org.freedesktop.DBus.Property"
2647
 
                         ".EmitsChangedSignal":
2648
 
                             "false"}
2649
 
            
2650
2087
            @dbus.service.signal(_interface, signature="o")
2651
2088
            def ClientAdded(self, objpath):
2652
2089
                "D-Bus signal"
2666
2103
            def GetAllClients(self):
2667
2104
                "D-Bus method"
2668
2105
                return dbus.Array(c.dbus_object_path
2669
 
                                  for c in
2670
 
                                  tcp_server.clients.itervalues())
 
2106
                                  for c in tcp_server.clients)
2671
2107
            
2672
2108
            @dbus.service.method(_interface,
2673
2109
                                 out_signature="a{oa{sv}}")
2675
2111
                "D-Bus method"
2676
2112
                return dbus.Dictionary(
2677
2113
                    ((c.dbus_object_path, c.GetAll(""))
2678
 
                     for c in tcp_server.clients.itervalues()),
 
2114
                     for c in tcp_server.clients),
2679
2115
                    signature="oa{sv}")
2680
2116
            
2681
2117
            @dbus.service.method(_interface, in_signature="o")
2682
2118
            def RemoveClient(self, object_path):
2683
2119
                "D-Bus method"
2684
 
                for c in tcp_server.clients.itervalues():
 
2120
                for c in tcp_server.clients:
2685
2121
                    if c.dbus_object_path == object_path:
2686
 
                        del tcp_server.clients[c.name]
 
2122
                        tcp_server.clients.remove(c)
2687
2123
                        c.remove_from_connection()
2688
2124
                        # Don't signal anything except ClientRemoved
2689
2125
                        c.disable(quiet=True)
2694
2130
            
2695
2131
            del _interface
2696
2132
        
2697
 
        mandos_dbus_service = MandosDBusService()
 
2133
        class MandosDBusServiceTransitional(MandosDBusService):
 
2134
            __metaclass__ = AlternateDBusNamesMetaclass
 
2135
        mandos_dbus_service = MandosDBusServiceTransitional()
2698
2136
    
2699
2137
    def cleanup():
2700
2138
        "Cleanup function; run on exit"
2701
2139
        service.cleanup()
2702
2140
        
2703
2141
        multiprocessing.active_children()
2704
 
        if not (tcp_server.clients or client_settings):
2705
 
            return
2706
 
        
2707
 
        # Store client before exiting. Secrets are encrypted with key
2708
 
        # based on what config file has. If config file is
2709
 
        # removed/edited, old secret will thus be unrecovable.
2710
 
        clients = {}
2711
 
        with PGPEngine() as pgp:
2712
 
            for client in tcp_server.clients.itervalues():
2713
 
                key = client_settings[client.name]["secret"]
2714
 
                client.encrypted_secret = pgp.encrypt(client.secret,
2715
 
                                                      key)
2716
 
                client_dict = {}
2717
 
                
2718
 
                # A list of attributes that can not be pickled
2719
 
                # + secret.
2720
 
                exclude = set(("bus", "changedstate", "secret",
2721
 
                               "checker"))
2722
 
                for name, typ in (inspect.getmembers
2723
 
                                  (dbus.service.Object)):
2724
 
                    exclude.add(name)
2725
 
                
2726
 
                client_dict["encrypted_secret"] = (client
2727
 
                                                   .encrypted_secret)
2728
 
                for attr in client.client_structure:
2729
 
                    if attr not in exclude:
2730
 
                        client_dict[attr] = getattr(client, attr)
2731
 
                
2732
 
                clients[client.name] = client_dict
2733
 
                del client_settings[client.name]["secret"]
2734
 
        
2735
 
        try:
2736
 
            with (tempfile.NamedTemporaryFile
2737
 
                  (mode='wb', suffix=".pickle", prefix='clients-',
2738
 
                   dir=os.path.dirname(stored_state_path),
2739
 
                   delete=False)) as stored_state:
2740
 
                pickle.dump((clients, client_settings), stored_state)
2741
 
                tempname=stored_state.name
2742
 
            os.rename(tempname, stored_state_path)
2743
 
        except (IOError, OSError) as e:
2744
 
            if not debug:
2745
 
                try:
2746
 
                    os.remove(tempname)
2747
 
                except NameError:
2748
 
                    pass
2749
 
            if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
2750
 
                logger.warning("Could not save persistent state: {0}"
2751
 
                               .format(os.strerror(e.errno)))
2752
 
            else:
2753
 
                logger.warning("Could not save persistent state:",
2754
 
                               exc_info=e)
2755
 
                raise e
2756
 
        
2757
 
        # Delete all clients, and settings from config
2758
2142
        while tcp_server.clients:
2759
 
            name, client = tcp_server.clients.popitem()
 
2143
            client = tcp_server.clients.pop()
2760
2144
            if use_dbus:
2761
2145
                client.remove_from_connection()
 
2146
            client.disable_hook = None
2762
2147
            # Don't signal anything except ClientRemoved
2763
2148
            client.disable(quiet=True)
2764
2149
            if use_dbus:
2766
2151
                mandos_dbus_service.ClientRemoved(client
2767
2152
                                                  .dbus_object_path,
2768
2153
                                                  client.name)
2769
 
        client_settings.clear()
2770
2154
    
2771
2155
    atexit.register(cleanup)
2772
2156
    
2773
 
    for client in tcp_server.clients.itervalues():
 
2157
    for client in tcp_server.clients:
2774
2158
        if use_dbus:
2775
2159
            # Emit D-Bus signal
2776
2160
            mandos_dbus_service.ClientAdded(client.dbus_object_path)
2777
 
        # Need to initiate checking of clients
2778
 
        if client.enabled:
2779
 
            client.init_checker()
 
2161
        client.enable()
2780
2162
    
2781
2163
    tcp_server.enable()
2782
2164
    tcp_server.server_activate()
2785
2167
    service.port = tcp_server.socket.getsockname()[1]
2786
2168
    if use_ipv6:
2787
2169
        logger.info("Now listening on address %r, port %d,"
2788
 
                    " flowinfo %d, scope_id %d",
2789
 
                    *tcp_server.socket.getsockname())
 
2170
                    " flowinfo %d, scope_id %d"
 
2171
                    % tcp_server.socket.getsockname())
2790
2172
    else:                       # IPv4
2791
 
        logger.info("Now listening on address %r, port %d",
2792
 
                    *tcp_server.socket.getsockname())
 
2173
        logger.info("Now listening on address %r, port %d"
 
2174
                    % tcp_server.socket.getsockname())
2793
2175
    
2794
2176
    #service.interface = tcp_server.socket.getsockname()[3]
2795
2177
    
2798
2180
        try:
2799
2181
            service.activate()
2800
2182
        except dbus.exceptions.DBusException as error:
2801
 
            logger.critical("D-Bus Exception", exc_info=error)
 
2183
            logger.critical("DBusException: %s", error)
2802
2184
            cleanup()
2803
2185
            sys.exit(1)
2804
2186
        # End of Avahi example code
2811
2193
        logger.debug("Starting main loop")
2812
2194
        main_loop.run()
2813
2195
    except AvahiError as error:
2814
 
        logger.critical("Avahi Error", exc_info=error)
 
2196
        logger.critical("AvahiError: %s", error)
2815
2197
        cleanup()
2816
2198
        sys.exit(1)
2817
2199
    except KeyboardInterrupt:
2822
2204
    # Must run before the D-Bus bus name gets deregistered
2823
2205
    cleanup()
2824
2206
 
 
2207
 
2825
2208
if __name__ == '__main__':
2826
2209
    main()