/mandos/release

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/release

« back to all changes in this revision

Viewing changes to mandos

  • Committer: Teddy Hogeborn
  • Date: 2015-07-05 21:38:01 UTC
  • mto: (237.7.307 trunk)
  • mto: This revision was merged to the branch mainline in revision 325.
  • Revision ID: teddy@recompile.se-20150705213801-pi8vk0ovlumuj826
plugin-helpers/mandos-client-iprouteadddel.c: Fix #include lines.
(main): Fix minor typo in error message.

Show diffs side-by-side

added added

removed removed

Lines of Context:
1
 
#!/usr/bin/python
 
1
#!/usr/bin/python2.7
2
2
# -*- mode: python; coding: utf-8 -*-
3
3
4
4
# Mandos server - give out binary blobs to connecting clients.
11
11
# "AvahiService" class, and some lines in "main".
12
12
13
13
# Everything else is
14
 
# Copyright © 2008-2012 Teddy Hogeborn
15
 
# Copyright © 2008-2012 Björn Påhlsson
 
14
# Copyright © 2008-2014 Teddy Hogeborn
 
15
# Copyright © 2008-2014 Björn Påhlsson
16
16
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
68
68
import binascii
69
69
import tempfile
70
70
import itertools
 
71
import collections
71
72
 
72
73
import dbus
73
74
import dbus.service
78
79
import ctypes.util
79
80
import xml.dom.minidom
80
81
import inspect
81
 
import GnuPGInterface
82
82
 
83
83
try:
84
84
    SO_BINDTODEVICE = socket.SO_BINDTODEVICE
88
88
    except ImportError:
89
89
        SO_BINDTODEVICE = None
90
90
 
91
 
version = "1.6.0"
 
91
if sys.version_info.major == 2:
 
92
    str = unicode
 
93
 
 
94
version = "1.6.9"
92
95
stored_state_file = "clients.pickle"
93
96
 
94
97
logger = logging.getLogger()
95
 
syslogger = (logging.handlers.SysLogHandler
96
 
             (facility = logging.handlers.SysLogHandler.LOG_DAEMON,
97
 
              address = str("/dev/log")))
 
98
syslogger = None
98
99
 
99
100
try:
100
101
    if_nametoindex = (ctypes.cdll.LoadLibrary
106
107
        SIOCGIFINDEX = 0x8933  # From /usr/include/linux/sockios.h
107
108
        with contextlib.closing(socket.socket()) as s:
108
109
            ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
109
 
                                struct.pack(str("16s16x"),
110
 
                                            interface))
111
 
        interface_index = struct.unpack(str("I"),
112
 
                                        ifreq[16:20])[0]
 
110
                                struct.pack(b"16s16x", interface))
 
111
        interface_index = struct.unpack("I", ifreq[16:20])[0]
113
112
        return interface_index
114
113
 
115
114
 
116
115
def initlogger(debug, level=logging.WARNING):
117
116
    """init logger and add loglevel"""
118
117
    
 
118
    global syslogger
 
119
    syslogger = (logging.handlers.SysLogHandler
 
120
                 (facility =
 
121
                  logging.handlers.SysLogHandler.LOG_DAEMON,
 
122
                  address = "/dev/log"))
119
123
    syslogger.setFormatter(logging.Formatter
120
124
                           ('Mandos [%(process)d]: %(levelname)s:'
121
125
                            ' %(message)s'))
139
143
class PGPEngine(object):
140
144
    """A simple class for OpenPGP symmetric encryption & decryption"""
141
145
    def __init__(self):
142
 
        self.gnupg = GnuPGInterface.GnuPG()
143
146
        self.tempdir = tempfile.mkdtemp(prefix="mandos-")
144
 
        self.gnupg = GnuPGInterface.GnuPG()
145
 
        self.gnupg.options.meta_interactive = False
146
 
        self.gnupg.options.homedir = self.tempdir
147
 
        self.gnupg.options.extra_args.extend(['--force-mdc',
148
 
                                              '--quiet',
149
 
                                              '--no-use-agent'])
 
147
        self.gnupgargs = ['--batch',
 
148
                          '--home', self.tempdir,
 
149
                          '--force-mdc',
 
150
                          '--quiet',
 
151
                          '--no-use-agent']
150
152
    
151
153
    def __enter__(self):
152
154
        return self
174
176
    def password_encode(self, password):
175
177
        # Passphrase can not be empty and can not contain newlines or
176
178
        # NUL bytes.  So we prefix it and hex encode it.
177
 
        return b"mandos" + binascii.hexlify(password)
 
179
        encoded = b"mandos" + binascii.hexlify(password)
 
180
        if len(encoded) > 2048:
 
181
            # GnuPG can't handle long passwords, so encode differently
 
182
            encoded = (b"mandos" + password.replace(b"\\", b"\\\\")
 
183
                       .replace(b"\n", b"\\n")
 
184
                       .replace(b"\0", b"\\x00"))
 
185
        return encoded
178
186
    
179
187
    def encrypt(self, data, password):
180
 
        self.gnupg.passphrase = self.password_encode(password)
181
 
        with open(os.devnull, "w") as devnull:
182
 
            try:
183
 
                proc = self.gnupg.run(['--symmetric'],
184
 
                                      create_fhs=['stdin', 'stdout'],
185
 
                                      attach_fhs={'stderr': devnull})
186
 
                with contextlib.closing(proc.handles['stdin']) as f:
187
 
                    f.write(data)
188
 
                with contextlib.closing(proc.handles['stdout']) as f:
189
 
                    ciphertext = f.read()
190
 
                proc.wait()
191
 
            except IOError as e:
192
 
                raise PGPError(e)
193
 
        self.gnupg.passphrase = None
 
188
        passphrase = self.password_encode(password)
 
189
        with tempfile.NamedTemporaryFile(dir=self.tempdir
 
190
                                         ) as passfile:
 
191
            passfile.write(passphrase)
 
192
            passfile.flush()
 
193
            proc = subprocess.Popen(['gpg', '--symmetric',
 
194
                                     '--passphrase-file',
 
195
                                     passfile.name]
 
196
                                    + self.gnupgargs,
 
197
                                    stdin = subprocess.PIPE,
 
198
                                    stdout = subprocess.PIPE,
 
199
                                    stderr = subprocess.PIPE)
 
200
            ciphertext, err = proc.communicate(input = data)
 
201
        if proc.returncode != 0:
 
202
            raise PGPError(err)
194
203
        return ciphertext
195
204
    
196
205
    def decrypt(self, data, password):
197
 
        self.gnupg.passphrase = self.password_encode(password)
198
 
        with open(os.devnull, "w") as devnull:
199
 
            try:
200
 
                proc = self.gnupg.run(['--decrypt'],
201
 
                                      create_fhs=['stdin', 'stdout'],
202
 
                                      attach_fhs={'stderr': devnull})
203
 
                with contextlib.closing(proc.handles['stdin']) as f:
204
 
                    f.write(data)
205
 
                with contextlib.closing(proc.handles['stdout']) as f:
206
 
                    decrypted_plaintext = f.read()
207
 
                proc.wait()
208
 
            except IOError as e:
209
 
                raise PGPError(e)
210
 
        self.gnupg.passphrase = None
 
206
        passphrase = self.password_encode(password)
 
207
        with tempfile.NamedTemporaryFile(dir = self.tempdir
 
208
                                         ) as passfile:
 
209
            passfile.write(passphrase)
 
210
            passfile.flush()
 
211
            proc = subprocess.Popen(['gpg', '--decrypt',
 
212
                                     '--passphrase-file',
 
213
                                     passfile.name]
 
214
                                    + self.gnupgargs,
 
215
                                    stdin = subprocess.PIPE,
 
216
                                    stdout = subprocess.PIPE,
 
217
                                    stderr = subprocess.PIPE)
 
218
            decrypted_plaintext, err = proc.communicate(input
 
219
                                                        = data)
 
220
        if proc.returncode != 0:
 
221
            raise PGPError(err)
211
222
        return decrypted_plaintext
212
223
 
213
224
 
214
225
class AvahiError(Exception):
215
226
    def __init__(self, value, *args, **kwargs):
216
227
        self.value = value
217
 
        super(AvahiError, self).__init__(value, *args, **kwargs)
218
 
    def __unicode__(self):
219
 
        return unicode(repr(self.value))
 
228
        return super(AvahiError, self).__init__(value, *args,
 
229
                                                **kwargs)
220
230
 
221
231
class AvahiServiceError(AvahiError):
222
232
    pass
233
243
               Used to optionally bind to the specified interface.
234
244
    name: string; Example: 'Mandos'
235
245
    type: string; Example: '_mandos._tcp'.
236
 
                  See <http://www.dns-sd.org/ServiceTypes.html>
 
246
     See <https://www.iana.org/assignments/service-names-port-numbers>
237
247
    port: integer; what port to announce
238
248
    TXT: list of strings; TXT record for the service
239
249
    domain: string; Domain to publish on, default to .local if empty.
265
275
        self.bus = bus
266
276
        self.entry_group_state_changed_match = None
267
277
    
268
 
    def rename(self):
 
278
    def rename(self, remove=True):
269
279
        """Derived from the Avahi example code"""
270
280
        if self.rename_count >= self.max_renames:
271
281
            logger.critical("No suitable Zeroconf service name found"
272
282
                            " after %i retries, exiting.",
273
283
                            self.rename_count)
274
284
            raise AvahiServiceError("Too many renames")
275
 
        self.name = unicode(self.server
276
 
                            .GetAlternativeServiceName(self.name))
 
285
        self.name = str(self.server
 
286
                        .GetAlternativeServiceName(self.name))
 
287
        self.rename_count += 1
277
288
        logger.info("Changing Zeroconf service name to %r ...",
278
289
                    self.name)
279
 
        self.remove()
 
290
        if remove:
 
291
            self.remove()
280
292
        try:
281
293
            self.add()
282
294
        except dbus.exceptions.DBusException as error:
283
 
            logger.critical("D-Bus Exception", exc_info=error)
284
 
            self.cleanup()
285
 
            os._exit(1)
286
 
        self.rename_count += 1
 
295
            if (error.get_dbus_name()
 
296
                == "org.freedesktop.Avahi.CollisionError"):
 
297
                logger.info("Local Zeroconf service name collision.")
 
298
                return self.rename(remove=False)
 
299
            else:
 
300
                logger.critical("D-Bus Exception", exc_info=error)
 
301
                self.cleanup()
 
302
                os._exit(1)
287
303
    
288
304
    def remove(self):
289
305
        """Derived from the Avahi example code"""
327
343
            self.rename()
328
344
        elif state == avahi.ENTRY_GROUP_FAILURE:
329
345
            logger.critical("Avahi: Error in group state changed %s",
330
 
                            unicode(error))
331
 
            raise AvahiGroupError("State changed: {0!s}"
 
346
                            str(error))
 
347
            raise AvahiGroupError("State changed: {!s}"
332
348
                                  .format(error))
333
349
    
334
350
    def cleanup(self):
381
397
 
382
398
 
383
399
class AvahiServiceToSyslog(AvahiService):
384
 
    def rename(self):
 
400
    def rename(self, *args, **kwargs):
385
401
        """Add the new name to the syslog messages"""
386
 
        ret = AvahiService.rename(self)
 
402
        ret = AvahiService.rename(self, *args, **kwargs)
387
403
        syslogger.setFormatter(logging.Formatter
388
 
                               ('Mandos ({0}) [%(process)d]:'
 
404
                               ('Mandos ({}) [%(process)d]:'
389
405
                                ' %(levelname)s: %(message)s'
390
406
                                .format(self.name)))
391
407
        return ret
392
408
 
393
409
 
394
 
def timedelta_to_milliseconds(td):
395
 
    "Convert a datetime.timedelta() to milliseconds"
396
 
    return ((td.days * 24 * 60 * 60 * 1000)
397
 
            + (td.seconds * 1000)
398
 
            + (td.microseconds // 1000))
399
 
 
400
 
 
401
410
class Client(object):
402
411
    """A representation of a client host served by this server.
403
412
    
439
448
    runtime_expansions: Allowed attributes for runtime expansion.
440
449
    expires:    datetime.datetime(); time (UTC) when a client will be
441
450
                disabled, or None
 
451
    server_settings: The server_settings dict from main()
442
452
    """
443
453
    
444
454
    runtime_expansions = ("approval_delay", "approval_duration",
446
456
                          "fingerprint", "host", "interval",
447
457
                          "last_approval_request", "last_checked_ok",
448
458
                          "last_enabled", "name", "timeout")
449
 
    client_defaults = { "timeout": "5m",
450
 
                        "extended_timeout": "15m",
451
 
                        "interval": "2m",
 
459
    client_defaults = { "timeout": "PT5M",
 
460
                        "extended_timeout": "PT15M",
 
461
                        "interval": "PT2M",
452
462
                        "checker": "fping -q -- %%(host)s",
453
463
                        "host": "",
454
 
                        "approval_delay": "0s",
455
 
                        "approval_duration": "1s",
 
464
                        "approval_delay": "PT0S",
 
465
                        "approval_duration": "PT1S",
456
466
                        "approved_by_default": "True",
457
467
                        "enabled": "True",
458
468
                        }
459
469
    
460
 
    def timeout_milliseconds(self):
461
 
        "Return the 'timeout' attribute in milliseconds"
462
 
        return timedelta_to_milliseconds(self.timeout)
463
 
    
464
 
    def extended_timeout_milliseconds(self):
465
 
        "Return the 'extended_timeout' attribute in milliseconds"
466
 
        return timedelta_to_milliseconds(self.extended_timeout)
467
 
    
468
 
    def interval_milliseconds(self):
469
 
        "Return the 'interval' attribute in milliseconds"
470
 
        return timedelta_to_milliseconds(self.interval)
471
 
    
472
 
    def approval_delay_milliseconds(self):
473
 
        return timedelta_to_milliseconds(self.approval_delay)
474
 
    
475
470
    @staticmethod
476
471
    def config_parser(config):
477
472
        """Construct a new dict of client settings of this form:
502
497
                          "rb") as secfile:
503
498
                    client["secret"] = secfile.read()
504
499
            else:
505
 
                raise TypeError("No secret or secfile for section {0}"
 
500
                raise TypeError("No secret or secfile for section {}"
506
501
                                .format(section))
507
502
            client["timeout"] = string_to_delta(section["timeout"])
508
503
            client["extended_timeout"] = string_to_delta(
519
514
        
520
515
        return settings
521
516
    
522
 
    def __init__(self, settings, name = None):
 
517
    def __init__(self, settings, name = None, server_settings=None):
523
518
        self.name = name
 
519
        if server_settings is None:
 
520
            server_settings = {}
 
521
        self.server_settings = server_settings
524
522
        # adding all client settings
525
 
        for setting, value in settings.iteritems():
 
523
        for setting, value in settings.items():
526
524
            setattr(self, setting, value)
527
525
        
528
526
        if self.enabled:
611
609
        if self.checker_initiator_tag is not None:
612
610
            gobject.source_remove(self.checker_initiator_tag)
613
611
        self.checker_initiator_tag = (gobject.timeout_add
614
 
                                      (self.interval_milliseconds(),
 
612
                                      (int(self.interval
 
613
                                           .total_seconds() * 1000),
615
614
                                       self.start_checker))
616
615
        # Schedule a disable() when 'timeout' has passed
617
616
        if self.disable_initiator_tag is not None:
618
617
            gobject.source_remove(self.disable_initiator_tag)
619
618
        self.disable_initiator_tag = (gobject.timeout_add
620
 
                                   (self.timeout_milliseconds(),
621
 
                                    self.disable))
 
619
                                      (int(self.timeout
 
620
                                           .total_seconds() * 1000),
 
621
                                       self.disable))
622
622
        # Also start a new checker *right now*.
623
623
        self.start_checker()
624
624
    
655
655
            self.disable_initiator_tag = None
656
656
        if getattr(self, "enabled", False):
657
657
            self.disable_initiator_tag = (gobject.timeout_add
658
 
                                          (timedelta_to_milliseconds
659
 
                                           (timeout), self.disable))
 
658
                                          (int(timeout.total_seconds()
 
659
                                               * 1000), self.disable))
660
660
            self.expires = datetime.datetime.utcnow() + timeout
661
661
    
662
662
    def need_approval(self):
679
679
        # If a checker exists, make sure it is not a zombie
680
680
        try:
681
681
            pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
682
 
        except (AttributeError, OSError) as error:
683
 
            if (isinstance(error, OSError)
684
 
                and error.errno != errno.ECHILD):
685
 
                raise error
 
682
        except AttributeError:
 
683
            pass
 
684
        except OSError as error:
 
685
            if error.errno != errno.ECHILD:
 
686
                raise
686
687
        else:
687
688
            if pid:
688
689
                logger.warning("Checker was a zombie")
692
693
        # Start a new checker if needed
693
694
        if self.checker is None:
694
695
            # Escape attributes for the shell
695
 
            escaped_attrs = dict(
696
 
                (attr, re.escape(unicode(getattr(self, attr))))
697
 
                for attr in
698
 
                self.runtime_expansions)
 
696
            escaped_attrs = { attr:
 
697
                                  re.escape(str(getattr(self, attr)))
 
698
                              for attr in self.runtime_expansions }
699
699
            try:
700
700
                command = self.checker_command % escaped_attrs
701
701
            except TypeError as error:
710
710
                # in normal mode, that is already done by daemon(),
711
711
                # and in debug mode we don't want to.  (Stdin is
712
712
                # always replaced by /dev/null.)
 
713
                # The exception is when not debugging but nevertheless
 
714
                # running in the foreground; use the previously
 
715
                # created wnull.
 
716
                popen_args = {}
 
717
                if (not self.server_settings["debug"]
 
718
                    and self.server_settings["foreground"]):
 
719
                    popen_args.update({"stdout": wnull,
 
720
                                       "stderr": wnull })
713
721
                self.checker = subprocess.Popen(command,
714
722
                                                close_fds=True,
715
 
                                                shell=True, cwd="/")
 
723
                                                shell=True, cwd="/",
 
724
                                                **popen_args)
716
725
            except OSError as error:
717
726
                logger.error("Failed to start subprocess",
718
727
                             exc_info=error)
 
728
                return True
719
729
            self.checker_callback_tag = (gobject.child_watch_add
720
730
                                         (self.checker.pid,
721
731
                                          self.checker_callback,
722
732
                                          data=command))
723
733
            # The checker may have completed before the gobject
724
734
            # watch was added.  Check for this.
725
 
            pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
 
735
            try:
 
736
                pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
 
737
            except OSError as error:
 
738
                if error.errno == errno.ECHILD:
 
739
                    # This should never happen
 
740
                    logger.error("Child process vanished",
 
741
                                 exc_info=error)
 
742
                    return True
 
743
                raise
726
744
            if pid:
727
745
                gobject.source_remove(self.checker_callback_tag)
728
746
                self.checker_callback(pid, status, command)
764
782
    # "Set" method, so we fail early here:
765
783
    if byte_arrays and signature != "ay":
766
784
        raise ValueError("Byte arrays not supported for non-'ay'"
767
 
                         " signature {0!r}".format(signature))
 
785
                         " signature {!r}".format(signature))
768
786
    def decorator(func):
769
787
        func._dbus_is_property = True
770
788
        func._dbus_interface = dbus_interface
801
819
    """Decorator to annotate D-Bus methods, signals or properties
802
820
    Usage:
803
821
    
 
822
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",
 
823
                       "org.freedesktop.DBus.Property."
 
824
                       "EmitsChangedSignal": "false"})
804
825
    @dbus_service_property("org.example.Interface", signature="b",
805
826
                           access="r")
806
 
    @dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",
807
 
                        "org.freedesktop.DBus.Property."
808
 
                        "EmitsChangedSignal": "false"})
809
827
    def Property_dbus_property(self):
810
828
        return dbus.Boolean(False)
811
829
    """
818
836
class DBusPropertyException(dbus.exceptions.DBusException):
819
837
    """A base class for D-Bus property-related exceptions
820
838
    """
821
 
    def __unicode__(self):
822
 
        return unicode(str(self))
823
 
 
 
839
    pass
824
840
 
825
841
class DBusPropertyAccessException(DBusPropertyException):
826
842
    """A property's access permissions disallows an operation.
849
865
        If called like _is_dbus_thing("method") it returns a function
850
866
        suitable for use as predicate to inspect.getmembers().
851
867
        """
852
 
        return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),
 
868
        return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
853
869
                                   False)
854
870
    
855
871
    def _get_all_dbus_things(self, thing):
904
920
            # The byte_arrays option is not supported yet on
905
921
            # signatures other than "ay".
906
922
            if prop._dbus_signature != "ay":
907
 
                raise ValueError
 
923
                raise ValueError("Byte arrays not supported for non-"
 
924
                                 "'ay' signature {!r}"
 
925
                                 .format(prop._dbus_signature))
908
926
            value = dbus.ByteArray(b''.join(chr(byte)
909
927
                                            for byte in value))
910
928
        prop(value)
934
952
                                           value.variant_level+1)
935
953
        return dbus.Dictionary(properties, signature="sv")
936
954
    
 
955
    @dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")
 
956
    def PropertiesChanged(self, interface_name, changed_properties,
 
957
                          invalidated_properties):
 
958
        """Standard D-Bus PropertiesChanged() signal, see D-Bus
 
959
        standard.
 
960
        """
 
961
        pass
 
962
    
937
963
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
938
964
                         out_signature="s",
939
965
                         path_keyword='object_path',
974
1000
                                              (prop,
975
1001
                                               "_dbus_annotations",
976
1002
                                               {}))
977
 
                        for name, value in annots.iteritems():
 
1003
                        for name, value in annots.items():
978
1004
                            ann_tag = document.createElement(
979
1005
                                "annotation")
980
1006
                            ann_tag.setAttribute("name", name)
983
1009
                # Add interface annotation tags
984
1010
                for annotation, value in dict(
985
1011
                    itertools.chain.from_iterable(
986
 
                        annotations().iteritems()
 
1012
                        annotations().items()
987
1013
                        for name, annotations in
988
1014
                        self._get_all_dbus_things("interface")
989
1015
                        if name == if_tag.getAttribute("name")
990
 
                        )).iteritems():
 
1016
                        )).items():
991
1017
                    ann_tag = document.createElement("annotation")
992
1018
                    ann_tag.setAttribute("name", annotation)
993
1019
                    ann_tag.setAttribute("value", value)
1049
1075
    """
1050
1076
    def wrapper(cls):
1051
1077
        for orig_interface_name, alt_interface_name in (
1052
 
            alt_interface_names.iteritems()):
 
1078
            alt_interface_names.items()):
1053
1079
            attr = {}
1054
1080
            interface_names = set()
1055
1081
            # Go though all attributes of the class
1068
1094
                interface_names.add(alt_interface)
1069
1095
                # Is this a D-Bus signal?
1070
1096
                if getattr(attribute, "_dbus_is_signal", False):
1071
 
                    # Extract the original non-method function by
1072
 
                    # black magic
 
1097
                    # Extract the original non-method undecorated
 
1098
                    # function by black magic
1073
1099
                    nonmethod_func = (dict(
1074
1100
                            zip(attribute.func_code.co_freevars,
1075
1101
                                attribute.__closure__))["func"]
1172
1198
                                        attribute.func_closure)))
1173
1199
            if deprecate:
1174
1200
                # Deprecate all alternate interfaces
1175
 
                iname="_AlternateDBusNames_interface_annotation{0}"
 
1201
                iname="_AlternateDBusNames_interface_annotation{}"
1176
1202
                for interface_name in interface_names:
1177
1203
                    @dbus_interface_annotations(interface_name)
1178
1204
                    def func(self):
1187
1213
            if interface_names:
1188
1214
                # Replace the class with a new subclass of it with
1189
1215
                # methods, signals, etc. as created above.
1190
 
                cls = type(b"{0}Alternate".format(cls.__name__),
 
1216
                cls = type(b"{}Alternate".format(cls.__name__),
1191
1217
                           (cls,), attr)
1192
1218
        return cls
1193
1219
    return wrapper
1206
1232
    runtime_expansions = (Client.runtime_expansions
1207
1233
                          + ("dbus_object_path",))
1208
1234
    
 
1235
    _interface = "se.recompile.Mandos.Client"
 
1236
    
1209
1237
    # dbus.service.Object doesn't use super(), so we can't either.
1210
1238
    
1211
1239
    def __init__(self, bus = None, *args, **kwargs):
1213
1241
        Client.__init__(self, *args, **kwargs)
1214
1242
        # Only now, when this client is initialized, can it show up on
1215
1243
        # the D-Bus
1216
 
        client_object_name = unicode(self.name).translate(
 
1244
        client_object_name = str(self.name).translate(
1217
1245
            {ord("."): ord("_"),
1218
1246
             ord("-"): ord("_")})
1219
1247
        self.dbus_object_path = (dbus.ObjectPath
1223
1251
    
1224
1252
    def notifychangeproperty(transform_func,
1225
1253
                             dbus_name, type_func=lambda x: x,
1226
 
                             variant_level=1):
 
1254
                             variant_level=1, invalidate_only=False,
 
1255
                             _interface=_interface):
1227
1256
        """ Modify a variable so that it's a property which announces
1228
1257
        its changes to DBus.
1229
1258
        
1234
1263
                   to the D-Bus.  Default: no transform
1235
1264
        variant_level: D-Bus variant level.  Default: 1
1236
1265
        """
1237
 
        attrname = "_{0}".format(dbus_name)
 
1266
        attrname = "_{}".format(dbus_name)
1238
1267
        def setter(self, value):
1239
1268
            if hasattr(self, "dbus_object_path"):
1240
1269
                if (not hasattr(self, attrname) or
1241
1270
                    type_func(getattr(self, attrname, None))
1242
1271
                    != type_func(value)):
1243
 
                    dbus_value = transform_func(type_func(value),
1244
 
                                                variant_level
1245
 
                                                =variant_level)
1246
 
                    self.PropertyChanged(dbus.String(dbus_name),
1247
 
                                         dbus_value)
 
1272
                    if invalidate_only:
 
1273
                        self.PropertiesChanged(_interface,
 
1274
                                               dbus.Dictionary(),
 
1275
                                               dbus.Array
 
1276
                                               ((dbus_name,)))
 
1277
                    else:
 
1278
                        dbus_value = transform_func(type_func(value),
 
1279
                                                    variant_level
 
1280
                                                    =variant_level)
 
1281
                        self.PropertyChanged(dbus.String(dbus_name),
 
1282
                                             dbus_value)
 
1283
                        self.PropertiesChanged(_interface,
 
1284
                                               dbus.Dictionary({
 
1285
                                    dbus.String(dbus_name):
 
1286
                                        dbus_value }), dbus.Array())
1248
1287
            setattr(self, attrname, value)
1249
1288
        
1250
1289
        return property(lambda self: getattr(self, attrname), setter)
1270
1309
    approval_delay = notifychangeproperty(dbus.UInt64,
1271
1310
                                          "ApprovalDelay",
1272
1311
                                          type_func =
1273
 
                                          timedelta_to_milliseconds)
 
1312
                                          lambda td: td.total_seconds()
 
1313
                                          * 1000)
1274
1314
    approval_duration = notifychangeproperty(
1275
1315
        dbus.UInt64, "ApprovalDuration",
1276
 
        type_func = timedelta_to_milliseconds)
 
1316
        type_func = lambda td: td.total_seconds() * 1000)
1277
1317
    host = notifychangeproperty(dbus.String, "Host")
1278
1318
    timeout = notifychangeproperty(dbus.UInt64, "Timeout",
1279
 
                                   type_func =
1280
 
                                   timedelta_to_milliseconds)
 
1319
                                   type_func = lambda td:
 
1320
                                       td.total_seconds() * 1000)
1281
1321
    extended_timeout = notifychangeproperty(
1282
1322
        dbus.UInt64, "ExtendedTimeout",
1283
 
        type_func = timedelta_to_milliseconds)
 
1323
        type_func = lambda td: td.total_seconds() * 1000)
1284
1324
    interval = notifychangeproperty(dbus.UInt64,
1285
1325
                                    "Interval",
1286
1326
                                    type_func =
1287
 
                                    timedelta_to_milliseconds)
 
1327
                                    lambda td: td.total_seconds()
 
1328
                                    * 1000)
1288
1329
    checker_command = notifychangeproperty(dbus.String, "Checker")
 
1330
    secret = notifychangeproperty(dbus.ByteArray, "Secret",
 
1331
                                  invalidate_only=True)
1289
1332
    
1290
1333
    del notifychangeproperty
1291
1334
    
1318
1361
                                       *args, **kwargs)
1319
1362
    
1320
1363
    def start_checker(self, *args, **kwargs):
1321
 
        old_checker = self.checker
1322
 
        if self.checker is not None:
1323
 
            old_checker_pid = self.checker.pid
1324
 
        else:
1325
 
            old_checker_pid = None
 
1364
        old_checker_pid = getattr(self.checker, "pid", None)
1326
1365
        r = Client.start_checker(self, *args, **kwargs)
1327
1366
        # Only if new checker process was started
1328
1367
        if (self.checker is not None
1337
1376
    
1338
1377
    def approve(self, value=True):
1339
1378
        self.approved = value
1340
 
        gobject.timeout_add(timedelta_to_milliseconds
1341
 
                            (self.approval_duration),
1342
 
                            self._reset_approved)
 
1379
        gobject.timeout_add(int(self.approval_duration.total_seconds()
 
1380
                                * 1000), self._reset_approved)
1343
1381
        self.send_changedstate()
1344
1382
    
1345
1383
    ## D-Bus methods, signals & properties
1346
 
    _interface = "se.recompile.Mandos.Client"
1347
1384
    
1348
1385
    ## Interfaces
1349
1386
    
1350
 
    @dbus_interface_annotations(_interface)
1351
 
    def _foo(self):
1352
 
        return { "org.freedesktop.DBus.Property.EmitsChangedSignal":
1353
 
                     "false"}
1354
 
    
1355
1387
    ## Signals
1356
1388
    
1357
1389
    # CheckerCompleted - signal
1367
1399
        pass
1368
1400
    
1369
1401
    # PropertyChanged - signal
 
1402
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1370
1403
    @dbus.service.signal(_interface, signature="sv")
1371
1404
    def PropertyChanged(self, property, value):
1372
1405
        "D-Bus signal"
1448
1481
                           access="readwrite")
1449
1482
    def ApprovalDelay_dbus_property(self, value=None):
1450
1483
        if value is None:       # get
1451
 
            return dbus.UInt64(self.approval_delay_milliseconds())
 
1484
            return dbus.UInt64(self.approval_delay.total_seconds()
 
1485
                               * 1000)
1452
1486
        self.approval_delay = datetime.timedelta(0, 0, 0, value)
1453
1487
    
1454
1488
    # ApprovalDuration - property
1456
1490
                           access="readwrite")
1457
1491
    def ApprovalDuration_dbus_property(self, value=None):
1458
1492
        if value is None:       # get
1459
 
            return dbus.UInt64(timedelta_to_milliseconds(
1460
 
                    self.approval_duration))
 
1493
            return dbus.UInt64(self.approval_duration.total_seconds()
 
1494
                               * 1000)
1461
1495
        self.approval_duration = datetime.timedelta(0, 0, 0, value)
1462
1496
    
1463
1497
    # Name - property
1476
1510
    def Host_dbus_property(self, value=None):
1477
1511
        if value is None:       # get
1478
1512
            return dbus.String(self.host)
1479
 
        self.host = unicode(value)
 
1513
        self.host = str(value)
1480
1514
    
1481
1515
    # Created - property
1482
1516
    @dbus_service_property(_interface, signature="s", access="read")
1529
1563
                           access="readwrite")
1530
1564
    def Timeout_dbus_property(self, value=None):
1531
1565
        if value is None:       # get
1532
 
            return dbus.UInt64(self.timeout_milliseconds())
 
1566
            return dbus.UInt64(self.timeout.total_seconds() * 1000)
1533
1567
        old_timeout = self.timeout
1534
1568
        self.timeout = datetime.timedelta(0, 0, 0, value)
1535
1569
        # Reschedule disabling
1546
1580
                gobject.source_remove(self.disable_initiator_tag)
1547
1581
                self.disable_initiator_tag = (
1548
1582
                    gobject.timeout_add(
1549
 
                        timedelta_to_milliseconds(self.expires - now),
1550
 
                        self.disable))
 
1583
                        int((self.expires - now).total_seconds()
 
1584
                            * 1000), self.disable))
1551
1585
    
1552
1586
    # ExtendedTimeout - property
1553
1587
    @dbus_service_property(_interface, signature="t",
1554
1588
                           access="readwrite")
1555
1589
    def ExtendedTimeout_dbus_property(self, value=None):
1556
1590
        if value is None:       # get
1557
 
            return dbus.UInt64(self.extended_timeout_milliseconds())
 
1591
            return dbus.UInt64(self.extended_timeout.total_seconds()
 
1592
                               * 1000)
1558
1593
        self.extended_timeout = datetime.timedelta(0, 0, 0, value)
1559
1594
    
1560
1595
    # Interval - property
1562
1597
                           access="readwrite")
1563
1598
    def Interval_dbus_property(self, value=None):
1564
1599
        if value is None:       # get
1565
 
            return dbus.UInt64(self.interval_milliseconds())
 
1600
            return dbus.UInt64(self.interval.total_seconds() * 1000)
1566
1601
        self.interval = datetime.timedelta(0, 0, 0, value)
1567
1602
        if getattr(self, "checker_initiator_tag", None) is None:
1568
1603
            return
1579
1614
    def Checker_dbus_property(self, value=None):
1580
1615
        if value is None:       # get
1581
1616
            return dbus.String(self.checker_command)
1582
 
        self.checker_command = unicode(value)
 
1617
        self.checker_command = str(value)
1583
1618
    
1584
1619
    # CheckerRunning - property
1585
1620
    @dbus_service_property(_interface, signature="b",
1601
1636
    @dbus_service_property(_interface, signature="ay",
1602
1637
                           access="write", byte_arrays=True)
1603
1638
    def Secret_dbus_property(self, value):
1604
 
        self.secret = str(value)
 
1639
        self.secret = bytes(value)
1605
1640
    
1606
1641
    del _interface
1607
1642
 
1641
1676
    def handle(self):
1642
1677
        with contextlib.closing(self.server.child_pipe) as child_pipe:
1643
1678
            logger.info("TCP connection from: %s",
1644
 
                        unicode(self.client_address))
 
1679
                        str(self.client_address))
1645
1680
            logger.debug("Pipe FD: %d",
1646
1681
                         self.server.child_pipe.fileno())
1647
1682
            
1673
1708
            logger.debug("Protocol version: %r", line)
1674
1709
            try:
1675
1710
                if int(line.strip().split()[0]) > 1:
1676
 
                    raise RuntimeError
 
1711
                    raise RuntimeError(line)
1677
1712
            except (ValueError, IndexError, RuntimeError) as error:
1678
1713
                logger.error("Unknown protocol version: %s", error)
1679
1714
                return
1728
1763
                        if self.server.use_dbus:
1729
1764
                            # Emit D-Bus signal
1730
1765
                            client.NeedApproval(
1731
 
                                client.approval_delay_milliseconds(),
1732
 
                                client.approved_by_default)
 
1766
                                client.approval_delay.total_seconds()
 
1767
                                * 1000, client.approved_by_default)
1733
1768
                    else:
1734
1769
                        logger.warning("Client %s was not approved",
1735
1770
                                       client.name)
1741
1776
                    #wait until timeout or approved
1742
1777
                    time = datetime.datetime.now()
1743
1778
                    client.changedstate.acquire()
1744
 
                    client.changedstate.wait(
1745
 
                        float(timedelta_to_milliseconds(delay)
1746
 
                              / 1000))
 
1779
                    client.changedstate.wait(delay.total_seconds())
1747
1780
                    client.changedstate.release()
1748
1781
                    time2 = datetime.datetime.now()
1749
1782
                    if (time2 - time) >= delay:
1886
1919
    
1887
1920
    def add_pipe(self, parent_pipe, proc):
1888
1921
        """Dummy function; override as necessary"""
1889
 
        raise NotImplementedError
 
1922
        raise NotImplementedError()
1890
1923
 
1891
1924
 
1892
1925
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
1948
1981
                try:
1949
1982
                    self.socket.setsockopt(socket.SOL_SOCKET,
1950
1983
                                           SO_BINDTODEVICE,
1951
 
                                           str(self.interface + '\0'))
 
1984
                                           (self.interface + "\0")
 
1985
                                           .encode("utf-8"))
1952
1986
                except socket.error as error:
1953
1987
                    if error.errno == errno.EPERM:
1954
1988
                        logger.error("No permission to bind to"
1968
2002
                if self.address_family == socket.AF_INET6:
1969
2003
                    any_address = "::" # in6addr_any
1970
2004
                else:
1971
 
                    any_address = socket.INADDR_ANY
 
2005
                    any_address = "0.0.0.0" # INADDR_ANY
1972
2006
                self.server_address = (any_address,
1973
2007
                                       self.server_address[1])
1974
2008
            elif not self.server_address[1]:
2090
2124
        return True
2091
2125
 
2092
2126
 
 
2127
def rfc3339_duration_to_delta(duration):
 
2128
    """Parse an RFC 3339 "duration" and return a datetime.timedelta
 
2129
    
 
2130
    >>> rfc3339_duration_to_delta("P7D")
 
2131
    datetime.timedelta(7)
 
2132
    >>> rfc3339_duration_to_delta("PT60S")
 
2133
    datetime.timedelta(0, 60)
 
2134
    >>> rfc3339_duration_to_delta("PT60M")
 
2135
    datetime.timedelta(0, 3600)
 
2136
    >>> rfc3339_duration_to_delta("PT24H")
 
2137
    datetime.timedelta(1)
 
2138
    >>> rfc3339_duration_to_delta("P1W")
 
2139
    datetime.timedelta(7)
 
2140
    >>> rfc3339_duration_to_delta("PT5M30S")
 
2141
    datetime.timedelta(0, 330)
 
2142
    >>> rfc3339_duration_to_delta("P1DT3M20S")
 
2143
    datetime.timedelta(1, 200)
 
2144
    """
 
2145
    
 
2146
    # Parsing an RFC 3339 duration with regular expressions is not
 
2147
    # possible - there would have to be multiple places for the same
 
2148
    # values, like seconds.  The current code, while more esoteric, is
 
2149
    # cleaner without depending on a parsing library.  If Python had a
 
2150
    # built-in library for parsing we would use it, but we'd like to
 
2151
    # avoid excessive use of external libraries.
 
2152
    
 
2153
    # New type for defining tokens, syntax, and semantics all-in-one
 
2154
    Token = collections.namedtuple("Token",
 
2155
                                   ("regexp", # To match token; if
 
2156
                                              # "value" is not None,
 
2157
                                              # must have a "group"
 
2158
                                              # containing digits
 
2159
                                    "value",  # datetime.timedelta or
 
2160
                                              # None
 
2161
                                    "followers")) # Tokens valid after
 
2162
                                                  # this token
 
2163
    # RFC 3339 "duration" tokens, syntax, and semantics; taken from
 
2164
    # the "duration" ABNF definition in RFC 3339, Appendix A.
 
2165
    token_end = Token(re.compile(r"$"), None, frozenset())
 
2166
    token_second = Token(re.compile(r"(\d+)S"),
 
2167
                         datetime.timedelta(seconds=1),
 
2168
                         frozenset((token_end,)))
 
2169
    token_minute = Token(re.compile(r"(\d+)M"),
 
2170
                         datetime.timedelta(minutes=1),
 
2171
                         frozenset((token_second, token_end)))
 
2172
    token_hour = Token(re.compile(r"(\d+)H"),
 
2173
                       datetime.timedelta(hours=1),
 
2174
                       frozenset((token_minute, token_end)))
 
2175
    token_time = Token(re.compile(r"T"),
 
2176
                       None,
 
2177
                       frozenset((token_hour, token_minute,
 
2178
                                  token_second)))
 
2179
    token_day = Token(re.compile(r"(\d+)D"),
 
2180
                      datetime.timedelta(days=1),
 
2181
                      frozenset((token_time, token_end)))
 
2182
    token_month = Token(re.compile(r"(\d+)M"),
 
2183
                        datetime.timedelta(weeks=4),
 
2184
                        frozenset((token_day, token_end)))
 
2185
    token_year = Token(re.compile(r"(\d+)Y"),
 
2186
                       datetime.timedelta(weeks=52),
 
2187
                       frozenset((token_month, token_end)))
 
2188
    token_week = Token(re.compile(r"(\d+)W"),
 
2189
                       datetime.timedelta(weeks=1),
 
2190
                       frozenset((token_end,)))
 
2191
    token_duration = Token(re.compile(r"P"), None,
 
2192
                           frozenset((token_year, token_month,
 
2193
                                      token_day, token_time,
 
2194
                                      token_week)))
 
2195
    # Define starting values
 
2196
    value = datetime.timedelta() # Value so far
 
2197
    found_token = None
 
2198
    followers = frozenset((token_duration,)) # Following valid tokens
 
2199
    s = duration                # String left to parse
 
2200
    # Loop until end token is found
 
2201
    while found_token is not token_end:
 
2202
        # Search for any currently valid tokens
 
2203
        for token in followers:
 
2204
            match = token.regexp.match(s)
 
2205
            if match is not None:
 
2206
                # Token found
 
2207
                if token.value is not None:
 
2208
                    # Value found, parse digits
 
2209
                    factor = int(match.group(1), 10)
 
2210
                    # Add to value so far
 
2211
                    value += factor * token.value
 
2212
                # Strip token from string
 
2213
                s = token.regexp.sub("", s, 1)
 
2214
                # Go to found token
 
2215
                found_token = token
 
2216
                # Set valid next tokens
 
2217
                followers = found_token.followers
 
2218
                break
 
2219
        else:
 
2220
            # No currently valid tokens were found
 
2221
            raise ValueError("Invalid RFC 3339 duration")
 
2222
    # End token found
 
2223
    return value
 
2224
 
 
2225
 
2093
2226
def string_to_delta(interval):
2094
2227
    """Parse a string and return a datetime.timedelta
2095
2228
    
2106
2239
    >>> string_to_delta('5m 30s')
2107
2240
    datetime.timedelta(0, 330)
2108
2241
    """
 
2242
    
 
2243
    try:
 
2244
        return rfc3339_duration_to_delta(interval)
 
2245
    except ValueError:
 
2246
        pass
 
2247
    
2109
2248
    timevalue = datetime.timedelta(0)
2110
2249
    for s in interval.split():
2111
2250
        try:
2112
 
            suffix = unicode(s[-1])
 
2251
            suffix = s[-1]
2113
2252
            value = int(s[:-1])
2114
2253
            if suffix == "d":
2115
2254
                delta = datetime.timedelta(value)
2122
2261
            elif suffix == "w":
2123
2262
                delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
2124
2263
            else:
2125
 
                raise ValueError("Unknown suffix {0!r}"
 
2264
                raise ValueError("Unknown suffix {!r}"
2126
2265
                                 .format(suffix))
2127
 
        except (ValueError, IndexError) as e:
 
2266
        except IndexError as e:
2128
2267
            raise ValueError(*(e.args))
2129
2268
        timevalue += delta
2130
2269
    return timevalue
2145
2284
        # Close all standard open file descriptors
2146
2285
        null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2147
2286
        if not stat.S_ISCHR(os.fstat(null).st_mode):
2148
 
            raise OSError(errno.ENODEV,
2149
 
                          "{0} not a character device"
 
2287
            raise OSError(errno.ENODEV, "{} not a character device"
2150
2288
                          .format(os.devnull))
2151
2289
        os.dup2(null, sys.stdin.fileno())
2152
2290
        os.dup2(null, sys.stdout.fileno())
2162
2300
    
2163
2301
    parser = argparse.ArgumentParser()
2164
2302
    parser.add_argument("-v", "--version", action="version",
2165
 
                        version = "%(prog)s {0}".format(version),
 
2303
                        version = "%(prog)s {}".format(version),
2166
2304
                        help="show version number and exit")
2167
2305
    parser.add_argument("-i", "--interface", metavar="IF",
2168
2306
                        help="Bind to interface IF")
2174
2312
                        help="Run self-test")
2175
2313
    parser.add_argument("--debug", action="store_true",
2176
2314
                        help="Debug mode; run in foreground and log"
2177
 
                        " to terminal")
 
2315
                        " to terminal", default=None)
2178
2316
    parser.add_argument("--debuglevel", metavar="LEVEL",
2179
2317
                        help="Debug level for stdout output")
2180
2318
    parser.add_argument("--priority", help="GnuTLS"
2187
2325
                        " files")
2188
2326
    parser.add_argument("--no-dbus", action="store_false",
2189
2327
                        dest="use_dbus", help="Do not provide D-Bus"
2190
 
                        " system bus interface")
 
2328
                        " system bus interface", default=None)
2191
2329
    parser.add_argument("--no-ipv6", action="store_false",
2192
 
                        dest="use_ipv6", help="Do not use IPv6")
 
2330
                        dest="use_ipv6", help="Do not use IPv6",
 
2331
                        default=None)
2193
2332
    parser.add_argument("--no-restore", action="store_false",
2194
2333
                        dest="restore", help="Do not restore stored"
2195
 
                        " state")
 
2334
                        " state", default=None)
2196
2335
    parser.add_argument("--socket", type=int,
2197
2336
                        help="Specify a file descriptor to a network"
2198
2337
                        " socket to use instead of creating one")
2199
2338
    parser.add_argument("--statedir", metavar="DIR",
2200
2339
                        help="Directory to save/restore state in")
2201
2340
    parser.add_argument("--foreground", action="store_true",
2202
 
                        help="Run in foreground")
 
2341
                        help="Run in foreground", default=None)
 
2342
    parser.add_argument("--no-zeroconf", action="store_false",
 
2343
                        dest="zeroconf", help="Do not use Zeroconf",
 
2344
                        default=None)
2203
2345
    
2204
2346
    options = parser.parse_args()
2205
2347
    
2206
2348
    if options.check:
2207
2349
        import doctest
2208
 
        doctest.testmod()
2209
 
        sys.exit()
 
2350
        fail_count, test_count = doctest.testmod()
 
2351
        sys.exit(os.EX_OK if fail_count == 0 else 1)
2210
2352
    
2211
2353
    # Default values for config file for server-global settings
2212
2354
    server_defaults = { "interface": "",
2214
2356
                        "port": "",
2215
2357
                        "debug": "False",
2216
2358
                        "priority":
2217
 
                        "SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
 
2359
                        "SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",
2218
2360
                        "servicename": "Mandos",
2219
2361
                        "use_dbus": "True",
2220
2362
                        "use_ipv6": "True",
2223
2365
                        "socket": "",
2224
2366
                        "statedir": "/var/lib/mandos",
2225
2367
                        "foreground": "False",
 
2368
                        "zeroconf": "True",
2226
2369
                        }
2227
2370
    
2228
2371
    # Parse config file for server-global settings
2255
2398
    for option in ("interface", "address", "port", "debug",
2256
2399
                   "priority", "servicename", "configdir",
2257
2400
                   "use_dbus", "use_ipv6", "debuglevel", "restore",
2258
 
                   "statedir", "socket", "foreground"):
 
2401
                   "statedir", "socket", "foreground", "zeroconf"):
2259
2402
        value = getattr(options, option)
2260
2403
        if value is not None:
2261
2404
            server_settings[option] = value
2262
2405
    del options
2263
2406
    # Force all strings to be unicode
2264
2407
    for option in server_settings.keys():
2265
 
        if type(server_settings[option]) is str:
2266
 
            server_settings[option] = unicode(server_settings[option])
 
2408
        if isinstance(server_settings[option], bytes):
 
2409
            server_settings[option] = (server_settings[option]
 
2410
                                       .decode("utf-8"))
 
2411
    # Force all boolean options to be boolean
 
2412
    for option in ("debug", "use_dbus", "use_ipv6", "restore",
 
2413
                   "foreground", "zeroconf"):
 
2414
        server_settings[option] = bool(server_settings[option])
2267
2415
    # Debug implies foreground
2268
2416
    if server_settings["debug"]:
2269
2417
        server_settings["foreground"] = True
2271
2419
    
2272
2420
    ##################################################################
2273
2421
    
 
2422
    if (not server_settings["zeroconf"] and
 
2423
        not (server_settings["port"]
 
2424
             or server_settings["socket"] != "")):
 
2425
            parser.error("Needs port or socket to work without"
 
2426
                         " Zeroconf")
 
2427
    
2274
2428
    # For convenience
2275
2429
    debug = server_settings["debug"]
2276
2430
    debuglevel = server_settings["debuglevel"]
2279
2433
    stored_state_path = os.path.join(server_settings["statedir"],
2280
2434
                                     stored_state_file)
2281
2435
    foreground = server_settings["foreground"]
 
2436
    zeroconf = server_settings["zeroconf"]
2282
2437
    
2283
2438
    if debug:
2284
2439
        initlogger(debug, logging.DEBUG)
2291
2446
    
2292
2447
    if server_settings["servicename"] != "Mandos":
2293
2448
        syslogger.setFormatter(logging.Formatter
2294
 
                               ('Mandos ({0}) [%(process)d]:'
 
2449
                               ('Mandos ({}) [%(process)d]:'
2295
2450
                                ' %(levelname)s: %(message)s'
2296
2451
                                .format(server_settings
2297
2452
                                        ["servicename"])))
2305
2460
    global mandos_dbus_service
2306
2461
    mandos_dbus_service = None
2307
2462
    
 
2463
    socketfd = None
 
2464
    if server_settings["socket"] != "":
 
2465
        socketfd = server_settings["socket"]
2308
2466
    tcp_server = MandosServer((server_settings["address"],
2309
2467
                               server_settings["port"]),
2310
2468
                              ClientHandler,
2314
2472
                              gnutls_priority=
2315
2473
                              server_settings["priority"],
2316
2474
                              use_dbus=use_dbus,
2317
 
                              socketfd=(server_settings["socket"]
2318
 
                                        or None))
 
2475
                              socketfd=socketfd)
2319
2476
    if not foreground:
2320
 
        pidfilename = "/var/run/mandos.pid"
 
2477
        pidfilename = "/run/mandos.pid"
 
2478
        if not os.path.isdir("/run/."):
 
2479
            pidfilename = "/var/run/mandos.pid"
2321
2480
        pidfile = None
2322
2481
        try:
2323
2482
            pidfile = open(pidfilename, "w")
2340
2499
        os.setuid(uid)
2341
2500
    except OSError as error:
2342
2501
        if error.errno != errno.EPERM:
2343
 
            raise error
 
2502
            raise
2344
2503
    
2345
2504
    if debug:
2346
2505
        # Enable all possible GnuTLS debugging
2389
2548
            use_dbus = False
2390
2549
            server_settings["use_dbus"] = False
2391
2550
            tcp_server.use_dbus = False
2392
 
    protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2393
 
    service = AvahiServiceToSyslog(name =
2394
 
                                   server_settings["servicename"],
2395
 
                                   servicetype = "_mandos._tcp",
2396
 
                                   protocol = protocol, bus = bus)
2397
 
    if server_settings["interface"]:
2398
 
        service.interface = (if_nametoindex
2399
 
                             (str(server_settings["interface"])))
 
2551
    if zeroconf:
 
2552
        protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
 
2553
        service = AvahiServiceToSyslog(name =
 
2554
                                       server_settings["servicename"],
 
2555
                                       servicetype = "_mandos._tcp",
 
2556
                                       protocol = protocol, bus = bus)
 
2557
        if server_settings["interface"]:
 
2558
            service.interface = (if_nametoindex
 
2559
                                 (server_settings["interface"]
 
2560
                                  .encode("utf-8")))
2400
2561
    
2401
2562
    global multiprocessing_manager
2402
2563
    multiprocessing_manager = multiprocessing.Manager()
2409
2570
    old_client_settings = {}
2410
2571
    clients_data = {}
2411
2572
    
 
2573
    # This is used to redirect stdout and stderr for checker processes
 
2574
    global wnull
 
2575
    wnull = open(os.devnull, "w") # A writable /dev/null
 
2576
    # Only used if server is running in foreground but not in debug
 
2577
    # mode
 
2578
    if debug or not foreground:
 
2579
        wnull.close()
 
2580
    
2412
2581
    # Get client data and settings from last running state.
2413
2582
    if server_settings["restore"]:
2414
2583
        try:
2418
2587
            os.remove(stored_state_path)
2419
2588
        except IOError as e:
2420
2589
            if e.errno == errno.ENOENT:
2421
 
                logger.warning("Could not load persistent state: {0}"
 
2590
                logger.warning("Could not load persistent state: {}"
2422
2591
                                .format(os.strerror(e.errno)))
2423
2592
            else:
2424
2593
                logger.critical("Could not load persistent state:",
2429
2598
                           "EOFError:", exc_info=e)
2430
2599
    
2431
2600
    with PGPEngine() as pgp:
2432
 
        for client_name, client in clients_data.iteritems():
 
2601
        for client_name, client in clients_data.items():
 
2602
            # Skip removed clients
 
2603
            if client_name not in client_settings:
 
2604
                continue
 
2605
            
2433
2606
            # Decide which value to use after restoring saved state.
2434
2607
            # We have three different values: Old config file,
2435
2608
            # new config file, and saved state.
2456
2629
                if datetime.datetime.utcnow() >= client["expires"]:
2457
2630
                    if not client["last_checked_ok"]:
2458
2631
                        logger.warning(
2459
 
                            "disabling client {0} - Client never "
 
2632
                            "disabling client {} - Client never "
2460
2633
                            "performed a successful checker"
2461
2634
                            .format(client_name))
2462
2635
                        client["enabled"] = False
2463
2636
                    elif client["last_checker_status"] != 0:
2464
2637
                        logger.warning(
2465
 
                            "disabling client {0} - Client "
2466
 
                            "last checker failed with error code {1}"
 
2638
                            "disabling client {} - Client last"
 
2639
                            " checker failed with error code {}"
2467
2640
                            .format(client_name,
2468
2641
                                    client["last_checker_status"]))
2469
2642
                        client["enabled"] = False
2472
2645
                                             .utcnow()
2473
2646
                                             + client["timeout"])
2474
2647
                        logger.debug("Last checker succeeded,"
2475
 
                                     " keeping {0} enabled"
 
2648
                                     " keeping {} enabled"
2476
2649
                                     .format(client_name))
2477
2650
            try:
2478
2651
                client["secret"] = (
2481
2654
                                ["secret"]))
2482
2655
            except PGPError:
2483
2656
                # If decryption fails, we use secret from new settings
2484
 
                logger.debug("Failed to decrypt {0} old secret"
 
2657
                logger.debug("Failed to decrypt {} old secret"
2485
2658
                             .format(client_name))
2486
2659
                client["secret"] = (
2487
2660
                    client_settings[client_name]["secret"])
2495
2668
        clients_data[client_name] = client_settings[client_name]
2496
2669
    
2497
2670
    # Create all client objects
2498
 
    for client_name, client in clients_data.iteritems():
 
2671
    for client_name, client in clients_data.items():
2499
2672
        tcp_server.clients[client_name] = client_class(
2500
 
            name = client_name, settings = client)
 
2673
            name = client_name, settings = client,
 
2674
            server_settings = server_settings)
2501
2675
    
2502
2676
    if not tcp_server.clients:
2503
2677
        logger.warning("No clients defined")
2507
2681
            try:
2508
2682
                with pidfile:
2509
2683
                    pid = os.getpid()
2510
 
                    pidfile.write(str(pid) + "\n".encode("utf-8"))
 
2684
                    pidfile.write("{}\n".format(pid).encode("utf-8"))
2511
2685
            except IOError:
2512
2686
                logger.error("Could not write to file %r with PID %d",
2513
2687
                             pidfilename, pid)
2559
2733
            def GetAllClientsWithProperties(self):
2560
2734
                "D-Bus method"
2561
2735
                return dbus.Dictionary(
2562
 
                    ((c.dbus_object_path, c.GetAll(""))
2563
 
                     for c in tcp_server.clients.itervalues()),
 
2736
                    { c.dbus_object_path: c.GetAll("")
 
2737
                      for c in tcp_server.clients.itervalues() },
2564
2738
                    signature="oa{sv}")
2565
2739
            
2566
2740
            @dbus.service.method(_interface, in_signature="o")
2583
2757
    
2584
2758
    def cleanup():
2585
2759
        "Cleanup function; run on exit"
2586
 
        service.cleanup()
 
2760
        if zeroconf:
 
2761
            service.cleanup()
2587
2762
        
2588
2763
        multiprocessing.active_children()
 
2764
        wnull.close()
2589
2765
        if not (tcp_server.clients or client_settings):
2590
2766
            return
2591
2767
        
2602
2778
                
2603
2779
                # A list of attributes that can not be pickled
2604
2780
                # + secret.
2605
 
                exclude = set(("bus", "changedstate", "secret",
2606
 
                               "checker"))
 
2781
                exclude = { "bus", "changedstate", "secret",
 
2782
                            "checker", "server_settings" }
2607
2783
                for name, typ in (inspect.getmembers
2608
2784
                                  (dbus.service.Object)):
2609
2785
                    exclude.add(name)
2632
2808
                except NameError:
2633
2809
                    pass
2634
2810
            if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
2635
 
                logger.warning("Could not save persistent state: {0}"
 
2811
                logger.warning("Could not save persistent state: {}"
2636
2812
                               .format(os.strerror(e.errno)))
2637
2813
            else:
2638
2814
                logger.warning("Could not save persistent state:",
2639
2815
                               exc_info=e)
2640
 
                raise e
 
2816
                raise
2641
2817
        
2642
2818
        # Delete all clients, and settings from config
2643
2819
        while tcp_server.clients:
2667
2843
    tcp_server.server_activate()
2668
2844
    
2669
2845
    # Find out what port we got
2670
 
    service.port = tcp_server.socket.getsockname()[1]
 
2846
    if zeroconf:
 
2847
        service.port = tcp_server.socket.getsockname()[1]
2671
2848
    if use_ipv6:
2672
2849
        logger.info("Now listening on address %r, port %d,"
2673
2850
                    " flowinfo %d, scope_id %d",
2679
2856
    #service.interface = tcp_server.socket.getsockname()[3]
2680
2857
    
2681
2858
    try:
2682
 
        # From the Avahi example code
2683
 
        try:
2684
 
            service.activate()
2685
 
        except dbus.exceptions.DBusException as error:
2686
 
            logger.critical("D-Bus Exception", exc_info=error)
2687
 
            cleanup()
2688
 
            sys.exit(1)
2689
 
        # End of Avahi example code
 
2859
        if zeroconf:
 
2860
            # From the Avahi example code
 
2861
            try:
 
2862
                service.activate()
 
2863
            except dbus.exceptions.DBusException as error:
 
2864
                logger.critical("D-Bus Exception", exc_info=error)
 
2865
                cleanup()
 
2866
                sys.exit(1)
 
2867
            # End of Avahi example code
2690
2868
        
2691
2869
        gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
2692
2870
                             lambda *args, **kwargs: