/mandos/release

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/release

« back to all changes in this revision

Viewing changes to mandos

  • Committer: Teddy Hogeborn
  • Date: 2015-07-05 21:38:01 UTC
  • mto: (237.7.307 trunk)
  • mto: This revision was merged to the branch mainline in revision 325.
  • Revision ID: teddy@recompile.se-20150705213801-pi8vk0ovlumuj826
plugin-helpers/mandos-client-iprouteadddel.c: Fix #include lines.
(main): Fix minor typo in error message.

Show diffs side-by-side

added added

removed removed

Lines of Context:
1
 
#!/usr/bin/python
 
1
#!/usr/bin/python2.7
2
2
# -*- mode: python; coding: utf-8 -*-
3
3
4
4
# Mandos server - give out binary blobs to connecting clients.
11
11
# "AvahiService" class, and some lines in "main".
12
12
13
13
# Everything else is
14
 
# Copyright © 2008-2011 Teddy Hogeborn
15
 
# Copyright © 2008-2011 Björn Påhlsson
 
14
# Copyright © 2008-2014 Teddy Hogeborn
 
15
# Copyright © 2008-2014 Björn Påhlsson
16
16
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
34
34
from __future__ import (division, absolute_import, print_function,
35
35
                        unicode_literals)
36
36
 
 
37
from future_builtins import *
 
38
 
37
39
import SocketServer as socketserver
38
40
import socket
39
41
import argparse
65
67
import types
66
68
import binascii
67
69
import tempfile
 
70
import itertools
 
71
import collections
68
72
 
69
73
import dbus
70
74
import dbus.service
75
79
import ctypes.util
76
80
import xml.dom.minidom
77
81
import inspect
78
 
import GnuPGInterface
79
82
 
80
83
try:
81
84
    SO_BINDTODEVICE = socket.SO_BINDTODEVICE
85
88
    except ImportError:
86
89
        SO_BINDTODEVICE = None
87
90
 
88
 
version = "1.4.1"
 
91
if sys.version_info.major == 2:
 
92
    str = unicode
 
93
 
 
94
version = "1.6.9"
89
95
stored_state_file = "clients.pickle"
90
96
 
91
97
logger = logging.getLogger()
92
 
syslogger = (logging.handlers.SysLogHandler
93
 
             (facility = logging.handlers.SysLogHandler.LOG_DAEMON,
94
 
              address = str("/dev/log")))
 
98
syslogger = None
95
99
 
96
100
try:
97
101
    if_nametoindex = (ctypes.cdll.LoadLibrary
103
107
        SIOCGIFINDEX = 0x8933  # From /usr/include/linux/sockios.h
104
108
        with contextlib.closing(socket.socket()) as s:
105
109
            ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
106
 
                                struct.pack(str("16s16x"),
107
 
                                            interface))
108
 
        interface_index = struct.unpack(str("I"),
109
 
                                        ifreq[16:20])[0]
 
110
                                struct.pack(b"16s16x", interface))
 
111
        interface_index = struct.unpack("I", ifreq[16:20])[0]
110
112
        return interface_index
111
113
 
112
114
 
113
115
def initlogger(debug, level=logging.WARNING):
114
116
    """init logger and add loglevel"""
115
117
    
 
118
    global syslogger
 
119
    syslogger = (logging.handlers.SysLogHandler
 
120
                 (facility =
 
121
                  logging.handlers.SysLogHandler.LOG_DAEMON,
 
122
                  address = "/dev/log"))
116
123
    syslogger.setFormatter(logging.Formatter
117
124
                           ('Mandos [%(process)d]: %(levelname)s:'
118
125
                            ' %(message)s'))
136
143
class PGPEngine(object):
137
144
    """A simple class for OpenPGP symmetric encryption & decryption"""
138
145
    def __init__(self):
139
 
        self.gnupg = GnuPGInterface.GnuPG()
140
146
        self.tempdir = tempfile.mkdtemp(prefix="mandos-")
141
 
        self.gnupg = GnuPGInterface.GnuPG()
142
 
        self.gnupg.options.meta_interactive = False
143
 
        self.gnupg.options.homedir = self.tempdir
144
 
        self.gnupg.options.extra_args.extend(['--force-mdc',
145
 
                                              '--quiet'])
 
147
        self.gnupgargs = ['--batch',
 
148
                          '--home', self.tempdir,
 
149
                          '--force-mdc',
 
150
                          '--quiet',
 
151
                          '--no-use-agent']
146
152
    
147
153
    def __enter__(self):
148
154
        return self
149
155
    
150
 
    def __exit__ (self, exc_type, exc_value, traceback):
 
156
    def __exit__(self, exc_type, exc_value, traceback):
151
157
        self._cleanup()
152
158
        return False
153
159
    
170
176
    def password_encode(self, password):
171
177
        # Passphrase can not be empty and can not contain newlines or
172
178
        # NUL bytes.  So we prefix it and hex encode it.
173
 
        return b"mandos" + binascii.hexlify(password)
 
179
        encoded = b"mandos" + binascii.hexlify(password)
 
180
        if len(encoded) > 2048:
 
181
            # GnuPG can't handle long passwords, so encode differently
 
182
            encoded = (b"mandos" + password.replace(b"\\", b"\\\\")
 
183
                       .replace(b"\n", b"\\n")
 
184
                       .replace(b"\0", b"\\x00"))
 
185
        return encoded
174
186
    
175
187
    def encrypt(self, data, password):
176
 
        self.gnupg.passphrase = self.password_encode(password)
177
 
        with open(os.devnull) as devnull:
178
 
            try:
179
 
                proc = self.gnupg.run(['--symmetric'],
180
 
                                      create_fhs=['stdin', 'stdout'],
181
 
                                      attach_fhs={'stderr': devnull})
182
 
                with contextlib.closing(proc.handles['stdin']) as f:
183
 
                    f.write(data)
184
 
                with contextlib.closing(proc.handles['stdout']) as f:
185
 
                    ciphertext = f.read()
186
 
                proc.wait()
187
 
            except IOError as e:
188
 
                raise PGPError(e)
189
 
        self.gnupg.passphrase = None
 
188
        passphrase = self.password_encode(password)
 
189
        with tempfile.NamedTemporaryFile(dir=self.tempdir
 
190
                                         ) as passfile:
 
191
            passfile.write(passphrase)
 
192
            passfile.flush()
 
193
            proc = subprocess.Popen(['gpg', '--symmetric',
 
194
                                     '--passphrase-file',
 
195
                                     passfile.name]
 
196
                                    + self.gnupgargs,
 
197
                                    stdin = subprocess.PIPE,
 
198
                                    stdout = subprocess.PIPE,
 
199
                                    stderr = subprocess.PIPE)
 
200
            ciphertext, err = proc.communicate(input = data)
 
201
        if proc.returncode != 0:
 
202
            raise PGPError(err)
190
203
        return ciphertext
191
204
    
192
205
    def decrypt(self, data, password):
193
 
        self.gnupg.passphrase = self.password_encode(password)
194
 
        with open(os.devnull) as devnull:
195
 
            try:
196
 
                proc = self.gnupg.run(['--decrypt'],
197
 
                                      create_fhs=['stdin', 'stdout'],
198
 
                                      attach_fhs={'stderr': devnull})
199
 
                with contextlib.closing(proc.handles['stdin'] ) as f:
200
 
                    f.write(data)
201
 
                with contextlib.closing(proc.handles['stdout']) as f:
202
 
                    decrypted_plaintext = f.read()
203
 
                proc.wait()
204
 
            except IOError as e:
205
 
                raise PGPError(e)
206
 
        self.gnupg.passphrase = None
 
206
        passphrase = self.password_encode(password)
 
207
        with tempfile.NamedTemporaryFile(dir = self.tempdir
 
208
                                         ) as passfile:
 
209
            passfile.write(passphrase)
 
210
            passfile.flush()
 
211
            proc = subprocess.Popen(['gpg', '--decrypt',
 
212
                                     '--passphrase-file',
 
213
                                     passfile.name]
 
214
                                    + self.gnupgargs,
 
215
                                    stdin = subprocess.PIPE,
 
216
                                    stdout = subprocess.PIPE,
 
217
                                    stderr = subprocess.PIPE)
 
218
            decrypted_plaintext, err = proc.communicate(input
 
219
                                                        = data)
 
220
        if proc.returncode != 0:
 
221
            raise PGPError(err)
207
222
        return decrypted_plaintext
208
223
 
209
224
 
210
 
 
211
225
class AvahiError(Exception):
212
226
    def __init__(self, value, *args, **kwargs):
213
227
        self.value = value
214
 
        super(AvahiError, self).__init__(value, *args, **kwargs)
215
 
    def __unicode__(self):
216
 
        return unicode(repr(self.value))
 
228
        return super(AvahiError, self).__init__(value, *args,
 
229
                                                **kwargs)
217
230
 
218
231
class AvahiServiceError(AvahiError):
219
232
    pass
230
243
               Used to optionally bind to the specified interface.
231
244
    name: string; Example: 'Mandos'
232
245
    type: string; Example: '_mandos._tcp'.
233
 
                  See <http://www.dns-sd.org/ServiceTypes.html>
 
246
     See <https://www.iana.org/assignments/service-names-port-numbers>
234
247
    port: integer; what port to announce
235
248
    TXT: list of strings; TXT record for the service
236
249
    domain: string; Domain to publish on, default to .local if empty.
242
255
    server: D-Bus Server
243
256
    bus: dbus.SystemBus()
244
257
    """
 
258
    
245
259
    def __init__(self, interface = avahi.IF_UNSPEC, name = None,
246
260
                 servicetype = None, port = None, TXT = None,
247
261
                 domain = "", host = "", max_renames = 32768,
260
274
        self.server = None
261
275
        self.bus = bus
262
276
        self.entry_group_state_changed_match = None
263
 
    def rename(self):
 
277
    
 
278
    def rename(self, remove=True):
264
279
        """Derived from the Avahi example code"""
265
280
        if self.rename_count >= self.max_renames:
266
281
            logger.critical("No suitable Zeroconf service name found"
267
282
                            " after %i retries, exiting.",
268
283
                            self.rename_count)
269
284
            raise AvahiServiceError("Too many renames")
270
 
        self.name = unicode(self.server
271
 
                            .GetAlternativeServiceName(self.name))
 
285
        self.name = str(self.server
 
286
                        .GetAlternativeServiceName(self.name))
 
287
        self.rename_count += 1
272
288
        logger.info("Changing Zeroconf service name to %r ...",
273
289
                    self.name)
274
 
        self.remove()
 
290
        if remove:
 
291
            self.remove()
275
292
        try:
276
293
            self.add()
277
294
        except dbus.exceptions.DBusException as error:
278
 
            logger.critical("DBusException: %s", error)
279
 
            self.cleanup()
280
 
            os._exit(1)
281
 
        self.rename_count += 1
 
295
            if (error.get_dbus_name()
 
296
                == "org.freedesktop.Avahi.CollisionError"):
 
297
                logger.info("Local Zeroconf service name collision.")
 
298
                return self.rename(remove=False)
 
299
            else:
 
300
                logger.critical("D-Bus Exception", exc_info=error)
 
301
                self.cleanup()
 
302
                os._exit(1)
 
303
    
282
304
    def remove(self):
283
305
        """Derived from the Avahi example code"""
284
306
        if self.entry_group_state_changed_match is not None:
286
308
            self.entry_group_state_changed_match = None
287
309
        if self.group is not None:
288
310
            self.group.Reset()
 
311
    
289
312
    def add(self):
290
313
        """Derived from the Avahi example code"""
291
314
        self.remove()
308
331
            dbus.UInt16(self.port),
309
332
            avahi.string_array_to_txt_array(self.TXT))
310
333
        self.group.Commit()
 
334
    
311
335
    def entry_group_state_changed(self, state, error):
312
336
        """Derived from the Avahi example code"""
313
337
        logger.debug("Avahi entry group state change: %i", state)
319
343
            self.rename()
320
344
        elif state == avahi.ENTRY_GROUP_FAILURE:
321
345
            logger.critical("Avahi: Error in group state changed %s",
322
 
                            unicode(error))
323
 
            raise AvahiGroupError("State changed: %s"
324
 
                                  % unicode(error))
 
346
                            str(error))
 
347
            raise AvahiGroupError("State changed: {!s}"
 
348
                                  .format(error))
 
349
    
325
350
    def cleanup(self):
326
351
        """Derived from the Avahi example code"""
327
352
        if self.group is not None:
332
357
                pass
333
358
            self.group = None
334
359
        self.remove()
 
360
    
335
361
    def server_state_changed(self, state, error=None):
336
362
        """Derived from the Avahi example code"""
337
363
        logger.debug("Avahi server state change: %i", state)
356
382
                logger.debug("Unknown state: %r", state)
357
383
            else:
358
384
                logger.debug("Unknown state: %r: %r", state, error)
 
385
    
359
386
    def activate(self):
360
387
        """Derived from the Avahi example code"""
361
388
        if self.server is None:
368
395
                                 self.server_state_changed)
369
396
        self.server_state_changed(self.server.GetState())
370
397
 
 
398
 
371
399
class AvahiServiceToSyslog(AvahiService):
372
 
    def rename(self):
 
400
    def rename(self, *args, **kwargs):
373
401
        """Add the new name to the syslog messages"""
374
 
        ret = AvahiService.rename(self)
 
402
        ret = AvahiService.rename(self, *args, **kwargs)
375
403
        syslogger.setFormatter(logging.Formatter
376
 
                               ('Mandos (%s) [%%(process)d]:'
377
 
                                ' %%(levelname)s: %%(message)s'
378
 
                                % self.name))
 
404
                               ('Mandos ({}) [%(process)d]:'
 
405
                                ' %(levelname)s: %(message)s'
 
406
                                .format(self.name)))
379
407
        return ret
380
408
 
381
 
def timedelta_to_milliseconds(td):
382
 
    "Convert a datetime.timedelta() to milliseconds"
383
 
    return ((td.days * 24 * 60 * 60 * 1000)
384
 
            + (td.seconds * 1000)
385
 
            + (td.microseconds // 1000))
386
 
        
 
409
 
387
410
class Client(object):
388
411
    """A representation of a client host served by this server.
389
412
    
414
437
    last_checked_ok: datetime.datetime(); (UTC) or None
415
438
    last_checker_status: integer between 0 and 255 reflecting exit
416
439
                         status of last checker. -1 reflects crashed
417
 
                         checker, or None.
 
440
                         checker, -2 means no checker completed yet.
418
441
    last_enabled: datetime.datetime(); (UTC) or None
419
442
    name:       string; from the config file, used in log messages and
420
443
                        D-Bus identifiers
421
444
    secret:     bytestring; sent verbatim (over TLS) to client
422
445
    timeout:    datetime.timedelta(); How long from last_checked_ok
423
446
                                      until this client is disabled
424
 
    extended_timeout:   extra long timeout when password has been sent
 
447
    extended_timeout:   extra long timeout when secret has been sent
425
448
    runtime_expansions: Allowed attributes for runtime expansion.
426
449
    expires:    datetime.datetime(); time (UTC) when a client will be
427
450
                disabled, or None
 
451
    server_settings: The server_settings dict from main()
428
452
    """
429
453
    
430
454
    runtime_expansions = ("approval_delay", "approval_duration",
431
 
                          "created", "enabled", "fingerprint",
432
 
                          "host", "interval", "last_checked_ok",
 
455
                          "created", "enabled", "expires",
 
456
                          "fingerprint", "host", "interval",
 
457
                          "last_approval_request", "last_checked_ok",
433
458
                          "last_enabled", "name", "timeout")
434
 
    client_defaults = { "timeout": "5m",
435
 
                        "extended_timeout": "15m",
436
 
                        "interval": "2m",
 
459
    client_defaults = { "timeout": "PT5M",
 
460
                        "extended_timeout": "PT15M",
 
461
                        "interval": "PT2M",
437
462
                        "checker": "fping -q -- %%(host)s",
438
463
                        "host": "",
439
 
                        "approval_delay": "0s",
440
 
                        "approval_duration": "1s",
 
464
                        "approval_delay": "PT0S",
 
465
                        "approval_duration": "PT1S",
441
466
                        "approved_by_default": "True",
442
467
                        "enabled": "True",
443
468
                        }
444
469
    
445
 
    def timeout_milliseconds(self):
446
 
        "Return the 'timeout' attribute in milliseconds"
447
 
        return timedelta_to_milliseconds(self.timeout)
448
 
    
449
 
    def extended_timeout_milliseconds(self):
450
 
        "Return the 'extended_timeout' attribute in milliseconds"
451
 
        return timedelta_to_milliseconds(self.extended_timeout)
452
 
    
453
 
    def interval_milliseconds(self):
454
 
        "Return the 'interval' attribute in milliseconds"
455
 
        return timedelta_to_milliseconds(self.interval)
456
 
    
457
 
    def approval_delay_milliseconds(self):
458
 
        return timedelta_to_milliseconds(self.approval_delay)
459
 
 
460
470
    @staticmethod
461
471
    def config_parser(config):
462
 
        """ Construct a new dict of client settings of this form:
 
472
        """Construct a new dict of client settings of this form:
463
473
        { client_name: {setting_name: value, ...}, ...}
464
 
        with exceptions for any special settings as defined above"""
 
474
        with exceptions for any special settings as defined above.
 
475
        NOTE: Must be a pure function. Must return the same result
 
476
        value given the same arguments.
 
477
        """
465
478
        settings = {}
466
479
        for client_name in config.sections():
467
480
            section = dict(config.items(client_name))
471
484
            # Reformat values from string types to Python types
472
485
            client["approved_by_default"] = config.getboolean(
473
486
                client_name, "approved_by_default")
474
 
            client["enabled"] = config.getboolean(client_name, "enabled")
 
487
            client["enabled"] = config.getboolean(client_name,
 
488
                                                  "enabled")
475
489
            
476
490
            client["fingerprint"] = (section["fingerprint"].upper()
477
491
                                     .replace(" ", ""))
483
497
                          "rb") as secfile:
484
498
                    client["secret"] = secfile.read()
485
499
            else:
486
 
                raise TypeError("No secret or secfile for section %s"
487
 
                                % section)
 
500
                raise TypeError("No secret or secfile for section {}"
 
501
                                .format(section))
488
502
            client["timeout"] = string_to_delta(section["timeout"])
489
503
            client["extended_timeout"] = string_to_delta(
490
504
                section["extended_timeout"])
496
510
            client["checker_command"] = section["checker"]
497
511
            client["last_approval_request"] = None
498
512
            client["last_checked_ok"] = None
499
 
            client["last_checker_status"] = None
500
 
            if client["enabled"]:
501
 
                client["last_enabled"] = datetime.datetime.utcnow()
502
 
                client["expires"] = (datetime.datetime.utcnow()
503
 
                                     + client["timeout"])
504
 
            else:
505
 
                client["last_enabled"] = None
506
 
                client["expires"] = None
507
 
 
 
513
            client["last_checker_status"] = -2
 
514
        
508
515
        return settings
509
 
        
510
 
        
511
 
    def __init__(self, settings, name = None):
512
 
        """Note: the 'checker' key in 'config' sets the
513
 
        'checker_command' attribute and *not* the 'checker'
514
 
        attribute."""
 
516
    
 
517
    def __init__(self, settings, name = None, server_settings=None):
515
518
        self.name = name
 
519
        if server_settings is None:
 
520
            server_settings = {}
 
521
        self.server_settings = server_settings
516
522
        # adding all client settings
517
 
        for setting, value in settings.iteritems():
 
523
        for setting, value in settings.items():
518
524
            setattr(self, setting, value)
519
525
        
 
526
        if self.enabled:
 
527
            if not hasattr(self, "last_enabled"):
 
528
                self.last_enabled = datetime.datetime.utcnow()
 
529
            if not hasattr(self, "expires"):
 
530
                self.expires = (datetime.datetime.utcnow()
 
531
                                + self.timeout)
 
532
        else:
 
533
            self.last_enabled = None
 
534
            self.expires = None
 
535
        
520
536
        logger.debug("Creating client %r", self.name)
521
537
        # Uppercase and remove spaces from fingerprint for later
522
538
        # comparison purposes with return value from the fingerprint()
523
539
        # function
524
540
        logger.debug("  Fingerprint: %s", self.fingerprint)
525
 
        self.created = settings.get("created", datetime.datetime.utcnow())
526
 
 
 
541
        self.created = settings.get("created",
 
542
                                    datetime.datetime.utcnow())
 
543
        
527
544
        # attributes specific for this server instance
528
545
        self.checker = None
529
546
        self.checker_initiator_tag = None
557
574
        if getattr(self, "enabled", False):
558
575
            # Already enabled
559
576
            return
560
 
        self.send_changedstate()
561
577
        self.expires = datetime.datetime.utcnow() + self.timeout
562
578
        self.enabled = True
563
579
        self.last_enabled = datetime.datetime.utcnow()
564
580
        self.init_checker()
 
581
        self.send_changedstate()
565
582
    
566
583
    def disable(self, quiet=True):
567
584
        """Disable this client."""
568
585
        if not getattr(self, "enabled", False):
569
586
            return False
570
587
        if not quiet:
571
 
            self.send_changedstate()
572
 
        if not quiet:
573
588
            logger.info("Disabling client %s", self.name)
574
 
        if getattr(self, "disable_initiator_tag", False):
 
589
        if getattr(self, "disable_initiator_tag", None) is not None:
575
590
            gobject.source_remove(self.disable_initiator_tag)
576
591
            self.disable_initiator_tag = None
577
592
        self.expires = None
578
 
        if getattr(self, "checker_initiator_tag", False):
 
593
        if getattr(self, "checker_initiator_tag", None) is not None:
579
594
            gobject.source_remove(self.checker_initiator_tag)
580
595
            self.checker_initiator_tag = None
581
596
        self.stop_checker()
582
597
        self.enabled = False
 
598
        if not quiet:
 
599
            self.send_changedstate()
583
600
        # Do not run this again if called by a gobject.timeout_add
584
601
        return False
585
602
    
589
606
    def init_checker(self):
590
607
        # Schedule a new checker to be started an 'interval' from now,
591
608
        # and every interval from then on.
 
609
        if self.checker_initiator_tag is not None:
 
610
            gobject.source_remove(self.checker_initiator_tag)
592
611
        self.checker_initiator_tag = (gobject.timeout_add
593
 
                                      (self.interval_milliseconds(),
 
612
                                      (int(self.interval
 
613
                                           .total_seconds() * 1000),
594
614
                                       self.start_checker))
595
615
        # Schedule a disable() when 'timeout' has passed
 
616
        if self.disable_initiator_tag is not None:
 
617
            gobject.source_remove(self.disable_initiator_tag)
596
618
        self.disable_initiator_tag = (gobject.timeout_add
597
 
                                   (self.timeout_milliseconds(),
598
 
                                    self.disable))
 
619
                                      (int(self.timeout
 
620
                                           .total_seconds() * 1000),
 
621
                                       self.disable))
599
622
        # Also start a new checker *right now*.
600
623
        self.start_checker()
601
624
    
617
640
            logger.warning("Checker for %(name)s crashed?",
618
641
                           vars(self))
619
642
    
620
 
    def checked_ok(self, timeout=None):
621
 
        """Bump up the timeout for this client.
622
 
        
623
 
        This should only be called when the client has been seen,
624
 
        alive and well.
625
 
        """
 
643
    def checked_ok(self):
 
644
        """Assert that the client has been seen, alive and well."""
 
645
        self.last_checked_ok = datetime.datetime.utcnow()
 
646
        self.last_checker_status = 0
 
647
        self.bump_timeout()
 
648
    
 
649
    def bump_timeout(self, timeout=None):
 
650
        """Bump up the timeout for this client."""
626
651
        if timeout is None:
627
652
            timeout = self.timeout
628
 
        self.last_checked_ok = datetime.datetime.utcnow()
629
653
        if self.disable_initiator_tag is not None:
630
654
            gobject.source_remove(self.disable_initiator_tag)
 
655
            self.disable_initiator_tag = None
631
656
        if getattr(self, "enabled", False):
632
657
            self.disable_initiator_tag = (gobject.timeout_add
633
 
                                          (timedelta_to_milliseconds
634
 
                                           (timeout), self.disable))
 
658
                                          (int(timeout.total_seconds()
 
659
                                               * 1000), self.disable))
635
660
            self.expires = datetime.datetime.utcnow() + timeout
636
661
    
637
662
    def need_approval(self):
643
668
        If a checker already exists, leave it running and do
644
669
        nothing."""
645
670
        # The reason for not killing a running checker is that if we
646
 
        # did that, then if a checker (for some reason) started
647
 
        # running slowly and taking more than 'interval' time, the
648
 
        # client would inevitably timeout, since no checker would get
649
 
        # a chance to run to completion.  If we instead leave running
 
671
        # did that, and if a checker (for some reason) started running
 
672
        # slowly and taking more than 'interval' time, then the client
 
673
        # would inevitably timeout, since no checker would get a
 
674
        # chance to run to completion.  If we instead leave running
650
675
        # checkers alone, the checker would have to take more time
651
676
        # than 'timeout' for the client to be disabled, which is as it
652
677
        # should be.
654
679
        # If a checker exists, make sure it is not a zombie
655
680
        try:
656
681
            pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
657
 
        except (AttributeError, OSError) as error:
658
 
            if (isinstance(error, OSError)
659
 
                and error.errno != errno.ECHILD):
660
 
                raise error
 
682
        except AttributeError:
 
683
            pass
 
684
        except OSError as error:
 
685
            if error.errno != errno.ECHILD:
 
686
                raise
661
687
        else:
662
688
            if pid:
663
689
                logger.warning("Checker was a zombie")
666
692
                                      self.current_checker_command)
667
693
        # Start a new checker if needed
668
694
        if self.checker is None:
 
695
            # Escape attributes for the shell
 
696
            escaped_attrs = { attr:
 
697
                                  re.escape(str(getattr(self, attr)))
 
698
                              for attr in self.runtime_expansions }
669
699
            try:
670
 
                # In case checker_command has exactly one % operator
671
 
                command = self.checker_command % self.host
672
 
            except TypeError:
673
 
                # Escape attributes for the shell
674
 
                escaped_attrs = dict(
675
 
                    (attr,
676
 
                     re.escape(unicode(str(getattr(self, attr, "")),
677
 
                                       errors=
678
 
                                       'replace')))
679
 
                    for attr in
680
 
                    self.runtime_expansions)
681
 
                
682
 
                try:
683
 
                    command = self.checker_command % escaped_attrs
684
 
                except TypeError as error:
685
 
                    logger.error('Could not format string "%s":'
686
 
                                 ' %s', self.checker_command, error)
687
 
                    return True # Try again later
 
700
                command = self.checker_command % escaped_attrs
 
701
            except TypeError as error:
 
702
                logger.error('Could not format string "%s"',
 
703
                             self.checker_command, exc_info=error)
 
704
                return True # Try again later
688
705
            self.current_checker_command = command
689
706
            try:
690
707
                logger.info("Starting checker %r for %s",
693
710
                # in normal mode, that is already done by daemon(),
694
711
                # and in debug mode we don't want to.  (Stdin is
695
712
                # always replaced by /dev/null.)
 
713
                # The exception is when not debugging but nevertheless
 
714
                # running in the foreground; use the previously
 
715
                # created wnull.
 
716
                popen_args = {}
 
717
                if (not self.server_settings["debug"]
 
718
                    and self.server_settings["foreground"]):
 
719
                    popen_args.update({"stdout": wnull,
 
720
                                       "stderr": wnull })
696
721
                self.checker = subprocess.Popen(command,
697
722
                                                close_fds=True,
698
 
                                                shell=True, cwd="/")
699
 
                self.checker_callback_tag = (gobject.child_watch_add
700
 
                                             (self.checker.pid,
701
 
                                              self.checker_callback,
702
 
                                              data=command))
703
 
                # The checker may have completed before the gobject
704
 
                # watch was added.  Check for this.
 
723
                                                shell=True, cwd="/",
 
724
                                                **popen_args)
 
725
            except OSError as error:
 
726
                logger.error("Failed to start subprocess",
 
727
                             exc_info=error)
 
728
                return True
 
729
            self.checker_callback_tag = (gobject.child_watch_add
 
730
                                         (self.checker.pid,
 
731
                                          self.checker_callback,
 
732
                                          data=command))
 
733
            # The checker may have completed before the gobject
 
734
            # watch was added.  Check for this.
 
735
            try:
705
736
                pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
706
 
                if pid:
707
 
                    gobject.source_remove(self.checker_callback_tag)
708
 
                    self.checker_callback(pid, status, command)
709
737
            except OSError as error:
710
 
                logger.error("Failed to start subprocess: %s",
711
 
                             error)
 
738
                if error.errno == errno.ECHILD:
 
739
                    # This should never happen
 
740
                    logger.error("Child process vanished",
 
741
                                 exc_info=error)
 
742
                    return True
 
743
                raise
 
744
            if pid:
 
745
                gobject.source_remove(self.checker_callback_tag)
 
746
                self.checker_callback(pid, status, command)
712
747
        # Re-run this periodically if run by gobject.timeout_add
713
748
        return True
714
749
    
721
756
            return
722
757
        logger.debug("Stopping checker for %(name)s", vars(self))
723
758
        try:
724
 
            os.kill(self.checker.pid, signal.SIGTERM)
 
759
            self.checker.terminate()
725
760
            #time.sleep(0.5)
726
761
            #if self.checker.poll() is None:
727
 
            #    os.kill(self.checker.pid, signal.SIGKILL)
 
762
            #    self.checker.kill()
728
763
        except OSError as error:
729
764
            if error.errno != errno.ESRCH: # No such process
730
765
                raise
747
782
    # "Set" method, so we fail early here:
748
783
    if byte_arrays and signature != "ay":
749
784
        raise ValueError("Byte arrays not supported for non-'ay'"
750
 
                         " signature %r" % signature)
 
785
                         " signature {!r}".format(signature))
751
786
    def decorator(func):
752
787
        func._dbus_is_property = True
753
788
        func._dbus_interface = dbus_interface
761
796
    return decorator
762
797
 
763
798
 
 
799
def dbus_interface_annotations(dbus_interface):
 
800
    """Decorator for marking functions returning interface annotations
 
801
    
 
802
    Usage:
 
803
    
 
804
    @dbus_interface_annotations("org.example.Interface")
 
805
    def _foo(self):  # Function name does not matter
 
806
        return {"org.freedesktop.DBus.Deprecated": "true",
 
807
                "org.freedesktop.DBus.Property.EmitsChangedSignal":
 
808
                    "false"}
 
809
    """
 
810
    def decorator(func):
 
811
        func._dbus_is_interface = True
 
812
        func._dbus_interface = dbus_interface
 
813
        func._dbus_name = dbus_interface
 
814
        return func
 
815
    return decorator
 
816
 
 
817
 
 
818
def dbus_annotations(annotations):
 
819
    """Decorator to annotate D-Bus methods, signals or properties
 
820
    Usage:
 
821
    
 
822
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",
 
823
                       "org.freedesktop.DBus.Property."
 
824
                       "EmitsChangedSignal": "false"})
 
825
    @dbus_service_property("org.example.Interface", signature="b",
 
826
                           access="r")
 
827
    def Property_dbus_property(self):
 
828
        return dbus.Boolean(False)
 
829
    """
 
830
    def decorator(func):
 
831
        func._dbus_annotations = annotations
 
832
        return func
 
833
    return decorator
 
834
 
 
835
 
764
836
class DBusPropertyException(dbus.exceptions.DBusException):
765
837
    """A base class for D-Bus property-related exceptions
766
838
    """
767
 
    def __unicode__(self):
768
 
        return unicode(str(self))
769
 
 
 
839
    pass
770
840
 
771
841
class DBusPropertyAccessException(DBusPropertyException):
772
842
    """A property's access permissions disallows an operation.
789
859
    """
790
860
    
791
861
    @staticmethod
792
 
    def _is_dbus_property(obj):
793
 
        return getattr(obj, "_dbus_is_property", False)
 
862
    def _is_dbus_thing(thing):
 
863
        """Returns a function testing if an attribute is a D-Bus thing
 
864
        
 
865
        If called like _is_dbus_thing("method") it returns a function
 
866
        suitable for use as predicate to inspect.getmembers().
 
867
        """
 
868
        return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
 
869
                                   False)
794
870
    
795
 
    def _get_all_dbus_properties(self):
 
871
    def _get_all_dbus_things(self, thing):
796
872
        """Returns a generator of (name, attribute) pairs
797
873
        """
798
 
        return ((prop.__get__(self)._dbus_name, prop.__get__(self))
 
874
        return ((getattr(athing.__get__(self), "_dbus_name",
 
875
                         name),
 
876
                 athing.__get__(self))
799
877
                for cls in self.__class__.__mro__
800
 
                for name, prop in
801
 
                inspect.getmembers(cls, self._is_dbus_property))
 
878
                for name, athing in
 
879
                inspect.getmembers(cls,
 
880
                                   self._is_dbus_thing(thing)))
802
881
    
803
882
    def _get_dbus_property(self, interface_name, property_name):
804
883
        """Returns a bound method if one exists which is a D-Bus
806
885
        """
807
886
        for cls in  self.__class__.__mro__:
808
887
            for name, value in (inspect.getmembers
809
 
                                (cls, self._is_dbus_property)):
 
888
                                (cls,
 
889
                                 self._is_dbus_thing("property"))):
810
890
                if (value._dbus_name == property_name
811
891
                    and value._dbus_interface == interface_name):
812
892
                    return value.__get__(self)
840
920
            # The byte_arrays option is not supported yet on
841
921
            # signatures other than "ay".
842
922
            if prop._dbus_signature != "ay":
843
 
                raise ValueError
844
 
            value = dbus.ByteArray(''.join(unichr(byte)
845
 
                                           for byte in value))
 
923
                raise ValueError("Byte arrays not supported for non-"
 
924
                                 "'ay' signature {!r}"
 
925
                                 .format(prop._dbus_signature))
 
926
            value = dbus.ByteArray(b''.join(chr(byte)
 
927
                                            for byte in value))
846
928
        prop(value)
847
929
    
848
930
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
854
936
        Note: Will not include properties with access="write".
855
937
        """
856
938
        properties = {}
857
 
        for name, prop in self._get_all_dbus_properties():
 
939
        for name, prop in self._get_all_dbus_things("property"):
858
940
            if (interface_name
859
941
                and interface_name != prop._dbus_interface):
860
942
                # Interface non-empty but did not match
870
952
                                           value.variant_level+1)
871
953
        return dbus.Dictionary(properties, signature="sv")
872
954
    
 
955
    @dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")
 
956
    def PropertiesChanged(self, interface_name, changed_properties,
 
957
                          invalidated_properties):
 
958
        """Standard D-Bus PropertiesChanged() signal, see D-Bus
 
959
        standard.
 
960
        """
 
961
        pass
 
962
    
873
963
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
874
964
                         out_signature="s",
875
965
                         path_keyword='object_path',
876
966
                         connection_keyword='connection')
877
967
    def Introspect(self, object_path, connection):
878
 
        """Standard D-Bus method, overloaded to insert property tags.
 
968
        """Overloading of standard D-Bus method.
 
969
        
 
970
        Inserts property tags and interface annotation tags.
879
971
        """
880
972
        xmlstring = dbus.service.Object.Introspect(self, object_path,
881
973
                                                   connection)
888
980
                e.setAttribute("access", prop._dbus_access)
889
981
                return e
890
982
            for if_tag in document.getElementsByTagName("interface"):
 
983
                # Add property tags
891
984
                for tag in (make_tag(document, name, prop)
892
985
                            for name, prop
893
 
                            in self._get_all_dbus_properties()
 
986
                            in self._get_all_dbus_things("property")
894
987
                            if prop._dbus_interface
895
988
                            == if_tag.getAttribute("name")):
896
989
                    if_tag.appendChild(tag)
 
990
                # Add annotation tags
 
991
                for typ in ("method", "signal", "property"):
 
992
                    for tag in if_tag.getElementsByTagName(typ):
 
993
                        annots = dict()
 
994
                        for name, prop in (self.
 
995
                                           _get_all_dbus_things(typ)):
 
996
                            if (name == tag.getAttribute("name")
 
997
                                and prop._dbus_interface
 
998
                                == if_tag.getAttribute("name")):
 
999
                                annots.update(getattr
 
1000
                                              (prop,
 
1001
                                               "_dbus_annotations",
 
1002
                                               {}))
 
1003
                        for name, value in annots.items():
 
1004
                            ann_tag = document.createElement(
 
1005
                                "annotation")
 
1006
                            ann_tag.setAttribute("name", name)
 
1007
                            ann_tag.setAttribute("value", value)
 
1008
                            tag.appendChild(ann_tag)
 
1009
                # Add interface annotation tags
 
1010
                for annotation, value in dict(
 
1011
                    itertools.chain.from_iterable(
 
1012
                        annotations().items()
 
1013
                        for name, annotations in
 
1014
                        self._get_all_dbus_things("interface")
 
1015
                        if name == if_tag.getAttribute("name")
 
1016
                        )).items():
 
1017
                    ann_tag = document.createElement("annotation")
 
1018
                    ann_tag.setAttribute("name", annotation)
 
1019
                    ann_tag.setAttribute("value", value)
 
1020
                    if_tag.appendChild(ann_tag)
897
1021
                # Add the names to the return values for the
898
1022
                # "org.freedesktop.DBus.Properties" methods
899
1023
                if (if_tag.getAttribute("name")
914
1038
        except (AttributeError, xml.dom.DOMException,
915
1039
                xml.parsers.expat.ExpatError) as error:
916
1040
            logger.error("Failed to override Introspection method",
917
 
                         error)
 
1041
                         exc_info=error)
918
1042
        return xmlstring
919
1043
 
920
1044
 
921
 
def datetime_to_dbus (dt, variant_level=0):
 
1045
def datetime_to_dbus(dt, variant_level=0):
922
1046
    """Convert a UTC datetime.datetime() to a D-Bus type."""
923
1047
    if dt is None:
924
1048
        return dbus.String("", variant_level = variant_level)
926
1050
                       variant_level=variant_level)
927
1051
 
928
1052
 
929
 
class AlternateDBusNamesMetaclass(DBusObjectWithProperties
930
 
                                  .__metaclass__):
931
 
    """Applied to an empty subclass of a D-Bus object, this metaclass
932
 
    will add additional D-Bus attributes matching a certain pattern.
 
1053
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
 
1054
    """A class decorator; applied to a subclass of
 
1055
    dbus.service.Object, it will add alternate D-Bus attributes with
 
1056
    interface names according to the "alt_interface_names" mapping.
 
1057
    Usage:
 
1058
    
 
1059
    @alternate_dbus_interfaces({"org.example.Interface":
 
1060
                                    "net.example.AlternateInterface"})
 
1061
    class SampleDBusObject(dbus.service.Object):
 
1062
        @dbus.service.method("org.example.Interface")
 
1063
        def SampleDBusMethod():
 
1064
            pass
 
1065
    
 
1066
    The above "SampleDBusMethod" on "SampleDBusObject" will be
 
1067
    reachable via two interfaces: "org.example.Interface" and
 
1068
    "net.example.AlternateInterface", the latter of which will have
 
1069
    its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
 
1070
    "true", unless "deprecate" is passed with a False value.
 
1071
    
 
1072
    This works for methods and signals, and also for D-Bus properties
 
1073
    (from DBusObjectWithProperties) and interfaces (from the
 
1074
    dbus_interface_annotations decorator).
933
1075
    """
934
 
    def __new__(mcs, name, bases, attr):
935
 
        # Go through all the base classes which could have D-Bus
936
 
        # methods, signals, or properties in them
937
 
        for base in (b for b in bases
938
 
                     if issubclass(b, dbus.service.Object)):
939
 
            # Go though all attributes of the base class
940
 
            for attrname, attribute in inspect.getmembers(base):
 
1076
    def wrapper(cls):
 
1077
        for orig_interface_name, alt_interface_name in (
 
1078
            alt_interface_names.items()):
 
1079
            attr = {}
 
1080
            interface_names = set()
 
1081
            # Go though all attributes of the class
 
1082
            for attrname, attribute in inspect.getmembers(cls):
941
1083
                # Ignore non-D-Bus attributes, and D-Bus attributes
942
1084
                # with the wrong interface name
943
1085
                if (not hasattr(attribute, "_dbus_interface")
944
1086
                    or not attribute._dbus_interface
945
 
                    .startswith("se.recompile.Mandos")):
 
1087
                    .startswith(orig_interface_name)):
946
1088
                    continue
947
1089
                # Create an alternate D-Bus interface name based on
948
1090
                # the current name
949
1091
                alt_interface = (attribute._dbus_interface
950
 
                                 .replace("se.recompile.Mandos",
951
 
                                          "se.bsnet.fukt.Mandos"))
 
1092
                                 .replace(orig_interface_name,
 
1093
                                          alt_interface_name))
 
1094
                interface_names.add(alt_interface)
952
1095
                # Is this a D-Bus signal?
953
1096
                if getattr(attribute, "_dbus_is_signal", False):
954
 
                    # Extract the original non-method function by
955
 
                    # black magic
 
1097
                    # Extract the original non-method undecorated
 
1098
                    # function by black magic
956
1099
                    nonmethod_func = (dict(
957
1100
                            zip(attribute.func_code.co_freevars,
958
1101
                                attribute.__closure__))["func"]
969
1112
                                nonmethod_func.func_name,
970
1113
                                nonmethod_func.func_defaults,
971
1114
                                nonmethod_func.func_closure)))
 
1115
                    # Copy annotations, if any
 
1116
                    try:
 
1117
                        new_function._dbus_annotations = (
 
1118
                            dict(attribute._dbus_annotations))
 
1119
                    except AttributeError:
 
1120
                        pass
972
1121
                    # Define a creator of a function to call both the
973
 
                    # old and new functions, so both the old and new
974
 
                    # signals gets sent when the function is called
 
1122
                    # original and alternate functions, so both the
 
1123
                    # original and alternate signals gets sent when
 
1124
                    # the function is called
975
1125
                    def fixscope(func1, func2):
976
1126
                        """This function is a scope container to pass
977
1127
                        func1 and func2 to the "call_both" function
984
1134
                        return call_both
985
1135
                    # Create the "call_both" function and add it to
986
1136
                    # the class
987
 
                    attr[attrname] = fixscope(attribute,
988
 
                                              new_function)
 
1137
                    attr[attrname] = fixscope(attribute, new_function)
989
1138
                # Is this a D-Bus method?
990
1139
                elif getattr(attribute, "_dbus_is_method", False):
991
1140
                    # Create a new, but exactly alike, function
1002
1151
                                        attribute.func_name,
1003
1152
                                        attribute.func_defaults,
1004
1153
                                        attribute.func_closure)))
 
1154
                    # Copy annotations, if any
 
1155
                    try:
 
1156
                        attr[attrname]._dbus_annotations = (
 
1157
                            dict(attribute._dbus_annotations))
 
1158
                    except AttributeError:
 
1159
                        pass
1005
1160
                # Is this a D-Bus property?
1006
1161
                elif getattr(attribute, "_dbus_is_property", False):
1007
1162
                    # Create a new, but exactly alike, function
1021
1176
                                        attribute.func_name,
1022
1177
                                        attribute.func_defaults,
1023
1178
                                        attribute.func_closure)))
1024
 
        return type.__new__(mcs, name, bases, attr)
1025
 
 
1026
 
 
 
1179
                    # Copy annotations, if any
 
1180
                    try:
 
1181
                        attr[attrname]._dbus_annotations = (
 
1182
                            dict(attribute._dbus_annotations))
 
1183
                    except AttributeError:
 
1184
                        pass
 
1185
                # Is this a D-Bus interface?
 
1186
                elif getattr(attribute, "_dbus_is_interface", False):
 
1187
                    # Create a new, but exactly alike, function
 
1188
                    # object.  Decorate it to be a new D-Bus interface
 
1189
                    # with the alternate D-Bus interface name.  Add it
 
1190
                    # to the class.
 
1191
                    attr[attrname] = (dbus_interface_annotations
 
1192
                                      (alt_interface)
 
1193
                                      (types.FunctionType
 
1194
                                       (attribute.func_code,
 
1195
                                        attribute.func_globals,
 
1196
                                        attribute.func_name,
 
1197
                                        attribute.func_defaults,
 
1198
                                        attribute.func_closure)))
 
1199
            if deprecate:
 
1200
                # Deprecate all alternate interfaces
 
1201
                iname="_AlternateDBusNames_interface_annotation{}"
 
1202
                for interface_name in interface_names:
 
1203
                    @dbus_interface_annotations(interface_name)
 
1204
                    def func(self):
 
1205
                        return { "org.freedesktop.DBus.Deprecated":
 
1206
                                     "true" }
 
1207
                    # Find an unused name
 
1208
                    for aname in (iname.format(i)
 
1209
                                  for i in itertools.count()):
 
1210
                        if aname not in attr:
 
1211
                            attr[aname] = func
 
1212
                            break
 
1213
            if interface_names:
 
1214
                # Replace the class with a new subclass of it with
 
1215
                # methods, signals, etc. as created above.
 
1216
                cls = type(b"{}Alternate".format(cls.__name__),
 
1217
                           (cls,), attr)
 
1218
        return cls
 
1219
    return wrapper
 
1220
 
 
1221
 
 
1222
@alternate_dbus_interfaces({"se.recompile.Mandos":
 
1223
                                "se.bsnet.fukt.Mandos"})
1027
1224
class ClientDBus(Client, DBusObjectWithProperties):
1028
1225
    """A Client class using D-Bus
1029
1226
    
1035
1232
    runtime_expansions = (Client.runtime_expansions
1036
1233
                          + ("dbus_object_path",))
1037
1234
    
 
1235
    _interface = "se.recompile.Mandos.Client"
 
1236
    
1038
1237
    # dbus.service.Object doesn't use super(), so we can't either.
1039
1238
    
1040
1239
    def __init__(self, bus = None, *args, **kwargs):
1041
1240
        self.bus = bus
1042
1241
        Client.__init__(self, *args, **kwargs)
1043
 
        self._approvals_pending = 0
1044
 
        
1045
 
        self._approvals_pending = 0
1046
1242
        # Only now, when this client is initialized, can it show up on
1047
1243
        # the D-Bus
1048
 
        client_object_name = unicode(self.name).translate(
 
1244
        client_object_name = str(self.name).translate(
1049
1245
            {ord("."): ord("_"),
1050
1246
             ord("-"): ord("_")})
1051
1247
        self.dbus_object_path = (dbus.ObjectPath
1052
1248
                                 ("/clients/" + client_object_name))
1053
1249
        DBusObjectWithProperties.__init__(self, self.bus,
1054
1250
                                          self.dbus_object_path)
1055
 
        
 
1251
    
1056
1252
    def notifychangeproperty(transform_func,
1057
1253
                             dbus_name, type_func=lambda x: x,
1058
 
                             variant_level=1):
 
1254
                             variant_level=1, invalidate_only=False,
 
1255
                             _interface=_interface):
1059
1256
        """ Modify a variable so that it's a property which announces
1060
1257
        its changes to DBus.
1061
1258
        
1066
1263
                   to the D-Bus.  Default: no transform
1067
1264
        variant_level: D-Bus variant level.  Default: 1
1068
1265
        """
1069
 
        attrname = "_{0}".format(dbus_name)
 
1266
        attrname = "_{}".format(dbus_name)
1070
1267
        def setter(self, value):
1071
1268
            if hasattr(self, "dbus_object_path"):
1072
1269
                if (not hasattr(self, attrname) or
1073
1270
                    type_func(getattr(self, attrname, None))
1074
1271
                    != type_func(value)):
1075
 
                    dbus_value = transform_func(type_func(value),
1076
 
                                                variant_level
1077
 
                                                =variant_level)
1078
 
                    self.PropertyChanged(dbus.String(dbus_name),
1079
 
                                         dbus_value)
 
1272
                    if invalidate_only:
 
1273
                        self.PropertiesChanged(_interface,
 
1274
                                               dbus.Dictionary(),
 
1275
                                               dbus.Array
 
1276
                                               ((dbus_name,)))
 
1277
                    else:
 
1278
                        dbus_value = transform_func(type_func(value),
 
1279
                                                    variant_level
 
1280
                                                    =variant_level)
 
1281
                        self.PropertyChanged(dbus.String(dbus_name),
 
1282
                                             dbus_value)
 
1283
                        self.PropertiesChanged(_interface,
 
1284
                                               dbus.Dictionary({
 
1285
                                    dbus.String(dbus_name):
 
1286
                                        dbus_value }), dbus.Array())
1080
1287
            setattr(self, attrname, value)
1081
1288
        
1082
1289
        return property(lambda self: getattr(self, attrname), setter)
1083
1290
    
1084
 
    
1085
1291
    expires = notifychangeproperty(datetime_to_dbus, "Expires")
1086
1292
    approvals_pending = notifychangeproperty(dbus.Boolean,
1087
1293
                                             "ApprovalPending",
1094
1300
                                       checker is not None)
1095
1301
    last_checked_ok = notifychangeproperty(datetime_to_dbus,
1096
1302
                                           "LastCheckedOK")
 
1303
    last_checker_status = notifychangeproperty(dbus.Int16,
 
1304
                                               "LastCheckerStatus")
1097
1305
    last_approval_request = notifychangeproperty(
1098
1306
        datetime_to_dbus, "LastApprovalRequest")
1099
1307
    approved_by_default = notifychangeproperty(dbus.Boolean,
1101
1309
    approval_delay = notifychangeproperty(dbus.UInt64,
1102
1310
                                          "ApprovalDelay",
1103
1311
                                          type_func =
1104
 
                                          timedelta_to_milliseconds)
 
1312
                                          lambda td: td.total_seconds()
 
1313
                                          * 1000)
1105
1314
    approval_duration = notifychangeproperty(
1106
1315
        dbus.UInt64, "ApprovalDuration",
1107
 
        type_func = timedelta_to_milliseconds)
 
1316
        type_func = lambda td: td.total_seconds() * 1000)
1108
1317
    host = notifychangeproperty(dbus.String, "Host")
1109
1318
    timeout = notifychangeproperty(dbus.UInt64, "Timeout",
1110
 
                                   type_func =
1111
 
                                   timedelta_to_milliseconds)
 
1319
                                   type_func = lambda td:
 
1320
                                       td.total_seconds() * 1000)
1112
1321
    extended_timeout = notifychangeproperty(
1113
1322
        dbus.UInt64, "ExtendedTimeout",
1114
 
        type_func = timedelta_to_milliseconds)
 
1323
        type_func = lambda td: td.total_seconds() * 1000)
1115
1324
    interval = notifychangeproperty(dbus.UInt64,
1116
1325
                                    "Interval",
1117
1326
                                    type_func =
1118
 
                                    timedelta_to_milliseconds)
 
1327
                                    lambda td: td.total_seconds()
 
1328
                                    * 1000)
1119
1329
    checker_command = notifychangeproperty(dbus.String, "Checker")
 
1330
    secret = notifychangeproperty(dbus.ByteArray, "Secret",
 
1331
                                  invalidate_only=True)
1120
1332
    
1121
1333
    del notifychangeproperty
1122
1334
    
1149
1361
                                       *args, **kwargs)
1150
1362
    
1151
1363
    def start_checker(self, *args, **kwargs):
1152
 
        old_checker = self.checker
1153
 
        if self.checker is not None:
1154
 
            old_checker_pid = self.checker.pid
1155
 
        else:
1156
 
            old_checker_pid = None
 
1364
        old_checker_pid = getattr(self.checker, "pid", None)
1157
1365
        r = Client.start_checker(self, *args, **kwargs)
1158
1366
        # Only if new checker process was started
1159
1367
        if (self.checker is not None
1167
1375
        return False
1168
1376
    
1169
1377
    def approve(self, value=True):
1170
 
        self.send_changedstate()
1171
1378
        self.approved = value
1172
 
        gobject.timeout_add(timedelta_to_milliseconds
1173
 
                            (self.approval_duration),
1174
 
                            self._reset_approved)
1175
 
    
 
1379
        gobject.timeout_add(int(self.approval_duration.total_seconds()
 
1380
                                * 1000), self._reset_approved)
 
1381
        self.send_changedstate()
1176
1382
    
1177
1383
    ## D-Bus methods, signals & properties
1178
 
    _interface = "se.recompile.Mandos.Client"
 
1384
    
 
1385
    ## Interfaces
1179
1386
    
1180
1387
    ## Signals
1181
1388
    
1192
1399
        pass
1193
1400
    
1194
1401
    # PropertyChanged - signal
 
1402
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1195
1403
    @dbus.service.signal(_interface, signature="sv")
1196
1404
    def PropertyChanged(self, property, value):
1197
1405
        "D-Bus signal"
1218
1426
        "D-Bus signal"
1219
1427
        return self.need_approval()
1220
1428
    
1221
 
    # NeRwequest - signal
1222
 
    @dbus.service.signal(_interface, signature="s")
1223
 
    def NewRequest(self, ip):
1224
 
        """D-Bus signal
1225
 
        Is sent after a client request a password.
1226
 
        """
1227
 
        pass
1228
 
    
1229
1429
    ## Methods
1230
1430
    
1231
1431
    # Approve - method
1281
1481
                           access="readwrite")
1282
1482
    def ApprovalDelay_dbus_property(self, value=None):
1283
1483
        if value is None:       # get
1284
 
            return dbus.UInt64(self.approval_delay_milliseconds())
 
1484
            return dbus.UInt64(self.approval_delay.total_seconds()
 
1485
                               * 1000)
1285
1486
        self.approval_delay = datetime.timedelta(0, 0, 0, value)
1286
1487
    
1287
1488
    # ApprovalDuration - property
1289
1490
                           access="readwrite")
1290
1491
    def ApprovalDuration_dbus_property(self, value=None):
1291
1492
        if value is None:       # get
1292
 
            return dbus.UInt64(timedelta_to_milliseconds(
1293
 
                    self.approval_duration))
 
1493
            return dbus.UInt64(self.approval_duration.total_seconds()
 
1494
                               * 1000)
1294
1495
        self.approval_duration = datetime.timedelta(0, 0, 0, value)
1295
1496
    
1296
1497
    # Name - property
1309
1510
    def Host_dbus_property(self, value=None):
1310
1511
        if value is None:       # get
1311
1512
            return dbus.String(self.host)
1312
 
        self.host = unicode(value)
 
1513
        self.host = str(value)
1313
1514
    
1314
1515
    # Created - property
1315
1516
    @dbus_service_property(_interface, signature="s", access="read")
1341
1542
            return
1342
1543
        return datetime_to_dbus(self.last_checked_ok)
1343
1544
    
 
1545
    # LastCheckerStatus - property
 
1546
    @dbus_service_property(_interface, signature="n",
 
1547
                           access="read")
 
1548
    def LastCheckerStatus_dbus_property(self):
 
1549
        return dbus.Int16(self.last_checker_status)
 
1550
    
1344
1551
    # Expires - property
1345
1552
    @dbus_service_property(_interface, signature="s", access="read")
1346
1553
    def Expires_dbus_property(self):
1356
1563
                           access="readwrite")
1357
1564
    def Timeout_dbus_property(self, value=None):
1358
1565
        if value is None:       # get
1359
 
            return dbus.UInt64(self.timeout_milliseconds())
 
1566
            return dbus.UInt64(self.timeout.total_seconds() * 1000)
 
1567
        old_timeout = self.timeout
1360
1568
        self.timeout = datetime.timedelta(0, 0, 0, value)
1361
 
        if getattr(self, "disable_initiator_tag", None) is None:
1362
 
            return
1363
 
        # Reschedule timeout
1364
 
        gobject.source_remove(self.disable_initiator_tag)
1365
 
        self.disable_initiator_tag = None
1366
 
        self.expires = None
1367
 
        time_to_die = timedelta_to_milliseconds((self
1368
 
                                                 .last_checked_ok
1369
 
                                                 + self.timeout)
1370
 
                                                - datetime.datetime
1371
 
                                                .utcnow())
1372
 
        if time_to_die <= 0:
1373
 
            # The timeout has passed
1374
 
            self.disable()
1375
 
        else:
1376
 
            self.expires = (datetime.datetime.utcnow()
1377
 
                            + datetime.timedelta(milliseconds =
1378
 
                                                 time_to_die))
1379
 
            self.disable_initiator_tag = (gobject.timeout_add
1380
 
                                          (time_to_die, self.disable))
 
1569
        # Reschedule disabling
 
1570
        if self.enabled:
 
1571
            now = datetime.datetime.utcnow()
 
1572
            self.expires += self.timeout - old_timeout
 
1573
            if self.expires <= now:
 
1574
                # The timeout has passed
 
1575
                self.disable()
 
1576
            else:
 
1577
                if (getattr(self, "disable_initiator_tag", None)
 
1578
                    is None):
 
1579
                    return
 
1580
                gobject.source_remove(self.disable_initiator_tag)
 
1581
                self.disable_initiator_tag = (
 
1582
                    gobject.timeout_add(
 
1583
                        int((self.expires - now).total_seconds()
 
1584
                            * 1000), self.disable))
1381
1585
    
1382
1586
    # ExtendedTimeout - property
1383
1587
    @dbus_service_property(_interface, signature="t",
1384
1588
                           access="readwrite")
1385
1589
    def ExtendedTimeout_dbus_property(self, value=None):
1386
1590
        if value is None:       # get
1387
 
            return dbus.UInt64(self.extended_timeout_milliseconds())
 
1591
            return dbus.UInt64(self.extended_timeout.total_seconds()
 
1592
                               * 1000)
1388
1593
        self.extended_timeout = datetime.timedelta(0, 0, 0, value)
1389
1594
    
1390
1595
    # Interval - property
1392
1597
                           access="readwrite")
1393
1598
    def Interval_dbus_property(self, value=None):
1394
1599
        if value is None:       # get
1395
 
            return dbus.UInt64(self.interval_milliseconds())
 
1600
            return dbus.UInt64(self.interval.total_seconds() * 1000)
1396
1601
        self.interval = datetime.timedelta(0, 0, 0, value)
1397
1602
        if getattr(self, "checker_initiator_tag", None) is None:
1398
1603
            return
1409
1614
    def Checker_dbus_property(self, value=None):
1410
1615
        if value is None:       # get
1411
1616
            return dbus.String(self.checker_command)
1412
 
        self.checker_command = unicode(value)
 
1617
        self.checker_command = str(value)
1413
1618
    
1414
1619
    # CheckerRunning - property
1415
1620
    @dbus_service_property(_interface, signature="b",
1431
1636
    @dbus_service_property(_interface, signature="ay",
1432
1637
                           access="write", byte_arrays=True)
1433
1638
    def Secret_dbus_property(self, value):
1434
 
        self.secret = str(value)
 
1639
        self.secret = bytes(value)
1435
1640
    
1436
1641
    del _interface
1437
1642
 
1462
1667
        self._pipe.send(('setattr', name, value))
1463
1668
 
1464
1669
 
1465
 
class ClientDBusTransitional(ClientDBus):
1466
 
    __metaclass__ = AlternateDBusNamesMetaclass
1467
 
 
1468
 
 
1469
1670
class ClientHandler(socketserver.BaseRequestHandler, object):
1470
1671
    """A class to handle client connections.
1471
1672
    
1475
1676
    def handle(self):
1476
1677
        with contextlib.closing(self.server.child_pipe) as child_pipe:
1477
1678
            logger.info("TCP connection from: %s",
1478
 
                        unicode(self.client_address))
 
1679
                        str(self.client_address))
1479
1680
            logger.debug("Pipe FD: %d",
1480
1681
                         self.server.child_pipe.fileno())
1481
1682
            
1507
1708
            logger.debug("Protocol version: %r", line)
1508
1709
            try:
1509
1710
                if int(line.strip().split()[0]) > 1:
1510
 
                    raise RuntimeError
 
1711
                    raise RuntimeError(line)
1511
1712
            except (ValueError, IndexError, RuntimeError) as error:
1512
1713
                logger.error("Unknown protocol version: %s", error)
1513
1714
                return
1539
1740
                except KeyError:
1540
1741
                    return
1541
1742
                
1542
 
                if self.server.use_dbus:
1543
 
                    # Emit D-Bus signal
1544
 
                    client.NewRequest(str(self.client_address))
1545
 
                
1546
1743
                if client.approval_delay:
1547
1744
                    delay = client.approval_delay
1548
1745
                    client.approvals_pending += 1
1566
1763
                        if self.server.use_dbus:
1567
1764
                            # Emit D-Bus signal
1568
1765
                            client.NeedApproval(
1569
 
                                client.approval_delay_milliseconds(),
1570
 
                                client.approved_by_default)
 
1766
                                client.approval_delay.total_seconds()
 
1767
                                * 1000, client.approved_by_default)
1571
1768
                    else:
1572
1769
                        logger.warning("Client %s was not approved",
1573
1770
                                       client.name)
1579
1776
                    #wait until timeout or approved
1580
1777
                    time = datetime.datetime.now()
1581
1778
                    client.changedstate.acquire()
1582
 
                    (client.changedstate.wait
1583
 
                     (float(client.timedelta_to_milliseconds(delay)
1584
 
                            / 1000)))
 
1779
                    client.changedstate.wait(delay.total_seconds())
1585
1780
                    client.changedstate.release()
1586
1781
                    time2 = datetime.datetime.now()
1587
1782
                    if (time2 - time) >= delay:
1603
1798
                    try:
1604
1799
                        sent = session.send(client.secret[sent_size:])
1605
1800
                    except gnutls.errors.GNUTLSError as error:
1606
 
                        logger.warning("gnutls send failed")
 
1801
                        logger.warning("gnutls send failed",
 
1802
                                       exc_info=error)
1607
1803
                        return
1608
1804
                    logger.debug("Sent: %d, remaining: %d",
1609
1805
                                 sent, len(client.secret)
1612
1808
                
1613
1809
                logger.info("Sending secret to %s", client.name)
1614
1810
                # bump the timeout using extended_timeout
1615
 
                client.checked_ok(client.extended_timeout)
 
1811
                client.bump_timeout(client.extended_timeout)
1616
1812
                if self.server.use_dbus:
1617
1813
                    # Emit D-Bus signal
1618
1814
                    client.GotSecret()
1623
1819
                try:
1624
1820
                    session.bye()
1625
1821
                except gnutls.errors.GNUTLSError as error:
1626
 
                    logger.warning("GnuTLS bye failed")
 
1822
                    logger.warning("GnuTLS bye failed",
 
1823
                                   exc_info=error)
1627
1824
    
1628
1825
    @staticmethod
1629
1826
    def peer_certificate(session):
1701
1898
    def process_request(self, request, address):
1702
1899
        """Start a new process to process the request."""
1703
1900
        proc = multiprocessing.Process(target = self.sub_process_main,
1704
 
                                       args = (request,
1705
 
                                               address))
 
1901
                                       args = (request, address))
1706
1902
        proc.start()
1707
1903
        return proc
1708
1904
 
1723
1919
    
1724
1920
    def add_pipe(self, parent_pipe, proc):
1725
1921
        """Dummy function; override as necessary"""
1726
 
        raise NotImplementedError
 
1922
        raise NotImplementedError()
1727
1923
 
1728
1924
 
1729
1925
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
1736
1932
        use_ipv6:       Boolean; to use IPv6 or not
1737
1933
    """
1738
1934
    def __init__(self, server_address, RequestHandlerClass,
1739
 
                 interface=None, use_ipv6=True):
 
1935
                 interface=None, use_ipv6=True, socketfd=None):
 
1936
        """If socketfd is set, use that file descriptor instead of
 
1937
        creating a new one with socket.socket().
 
1938
        """
1740
1939
        self.interface = interface
1741
1940
        if use_ipv6:
1742
1941
            self.address_family = socket.AF_INET6
 
1942
        if socketfd is not None:
 
1943
            # Save the file descriptor
 
1944
            self.socketfd = socketfd
 
1945
            # Save the original socket.socket() function
 
1946
            self.socket_socket = socket.socket
 
1947
            # To implement --socket, we monkey patch socket.socket.
 
1948
            # 
 
1949
            # (When socketserver.TCPServer is a new-style class, we
 
1950
            # could make self.socket into a property instead of monkey
 
1951
            # patching socket.socket.)
 
1952
            # 
 
1953
            # Create a one-time-only replacement for socket.socket()
 
1954
            @functools.wraps(socket.socket)
 
1955
            def socket_wrapper(*args, **kwargs):
 
1956
                # Restore original function so subsequent calls are
 
1957
                # not affected.
 
1958
                socket.socket = self.socket_socket
 
1959
                del self.socket_socket
 
1960
                # This time only, return a new socket object from the
 
1961
                # saved file descriptor.
 
1962
                return socket.fromfd(self.socketfd, *args, **kwargs)
 
1963
            # Replace socket.socket() function with wrapper
 
1964
            socket.socket = socket_wrapper
 
1965
        # The socketserver.TCPServer.__init__ will call
 
1966
        # socket.socket(), which might be our replacement,
 
1967
        # socket_wrapper(), if socketfd was set.
1743
1968
        socketserver.TCPServer.__init__(self, server_address,
1744
1969
                                        RequestHandlerClass)
 
1970
    
1745
1971
    def server_bind(self):
1746
1972
        """This overrides the normal server_bind() function
1747
1973
        to bind to an interface if one was specified, and also NOT to
1755
1981
                try:
1756
1982
                    self.socket.setsockopt(socket.SOL_SOCKET,
1757
1983
                                           SO_BINDTODEVICE,
1758
 
                                           str(self.interface
1759
 
                                               + '\0'))
 
1984
                                           (self.interface + "\0")
 
1985
                                           .encode("utf-8"))
1760
1986
                except socket.error as error:
1761
 
                    if error[0] == errno.EPERM:
1762
 
                        logger.error("No permission to"
1763
 
                                     " bind to interface %s",
1764
 
                                     self.interface)
1765
 
                    elif error[0] == errno.ENOPROTOOPT:
 
1987
                    if error.errno == errno.EPERM:
 
1988
                        logger.error("No permission to bind to"
 
1989
                                     " interface %s", self.interface)
 
1990
                    elif error.errno == errno.ENOPROTOOPT:
1766
1991
                        logger.error("SO_BINDTODEVICE not available;"
1767
1992
                                     " cannot bind to interface %s",
1768
1993
                                     self.interface)
 
1994
                    elif error.errno == errno.ENODEV:
 
1995
                        logger.error("Interface %s does not exist,"
 
1996
                                     " cannot bind", self.interface)
1769
1997
                    else:
1770
1998
                        raise
1771
1999
        # Only bind(2) the socket if we really need to.
1774
2002
                if self.address_family == socket.AF_INET6:
1775
2003
                    any_address = "::" # in6addr_any
1776
2004
                else:
1777
 
                    any_address = socket.INADDR_ANY
 
2005
                    any_address = "0.0.0.0" # INADDR_ANY
1778
2006
                self.server_address = (any_address,
1779
2007
                                       self.server_address[1])
1780
2008
            elif not self.server_address[1]:
1801
2029
    """
1802
2030
    def __init__(self, server_address, RequestHandlerClass,
1803
2031
                 interface=None, use_ipv6=True, clients=None,
1804
 
                 gnutls_priority=None, use_dbus=True):
 
2032
                 gnutls_priority=None, use_dbus=True, socketfd=None):
1805
2033
        self.enabled = False
1806
2034
        self.clients = clients
1807
2035
        if self.clients is None:
1811
2039
        IPv6_TCPServer.__init__(self, server_address,
1812
2040
                                RequestHandlerClass,
1813
2041
                                interface = interface,
1814
 
                                use_ipv6 = use_ipv6)
 
2042
                                use_ipv6 = use_ipv6,
 
2043
                                socketfd = socketfd)
1815
2044
    def server_activate(self):
1816
2045
        if self.enabled:
1817
2046
            return socketserver.TCPServer.server_activate(self)
1830
2059
    
1831
2060
    def handle_ipc(self, source, condition, parent_pipe=None,
1832
2061
                   proc = None, client_object=None):
1833
 
        condition_names = {
1834
 
            gobject.IO_IN: "IN",   # There is data to read.
1835
 
            gobject.IO_OUT: "OUT", # Data can be written (without
1836
 
                                    # blocking).
1837
 
            gobject.IO_PRI: "PRI", # There is urgent data to read.
1838
 
            gobject.IO_ERR: "ERR", # Error condition.
1839
 
            gobject.IO_HUP: "HUP"  # Hung up (the connection has been
1840
 
                                    # broken, usually for pipes and
1841
 
                                    # sockets).
1842
 
            }
1843
 
        conditions_string = ' | '.join(name
1844
 
                                       for cond, name in
1845
 
                                       condition_names.iteritems()
1846
 
                                       if cond & condition)
1847
2062
        # error, or the other end of multiprocessing.Pipe has closed
1848
 
        if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):
 
2063
        if condition & (gobject.IO_ERR | gobject.IO_HUP):
1849
2064
            # Wait for other process to exit
1850
2065
            proc.join()
1851
2066
            return False
1909
2124
        return True
1910
2125
 
1911
2126
 
 
2127
def rfc3339_duration_to_delta(duration):
 
2128
    """Parse an RFC 3339 "duration" and return a datetime.timedelta
 
2129
    
 
2130
    >>> rfc3339_duration_to_delta("P7D")
 
2131
    datetime.timedelta(7)
 
2132
    >>> rfc3339_duration_to_delta("PT60S")
 
2133
    datetime.timedelta(0, 60)
 
2134
    >>> rfc3339_duration_to_delta("PT60M")
 
2135
    datetime.timedelta(0, 3600)
 
2136
    >>> rfc3339_duration_to_delta("PT24H")
 
2137
    datetime.timedelta(1)
 
2138
    >>> rfc3339_duration_to_delta("P1W")
 
2139
    datetime.timedelta(7)
 
2140
    >>> rfc3339_duration_to_delta("PT5M30S")
 
2141
    datetime.timedelta(0, 330)
 
2142
    >>> rfc3339_duration_to_delta("P1DT3M20S")
 
2143
    datetime.timedelta(1, 200)
 
2144
    """
 
2145
    
 
2146
    # Parsing an RFC 3339 duration with regular expressions is not
 
2147
    # possible - there would have to be multiple places for the same
 
2148
    # values, like seconds.  The current code, while more esoteric, is
 
2149
    # cleaner without depending on a parsing library.  If Python had a
 
2150
    # built-in library for parsing we would use it, but we'd like to
 
2151
    # avoid excessive use of external libraries.
 
2152
    
 
2153
    # New type for defining tokens, syntax, and semantics all-in-one
 
2154
    Token = collections.namedtuple("Token",
 
2155
                                   ("regexp", # To match token; if
 
2156
                                              # "value" is not None,
 
2157
                                              # must have a "group"
 
2158
                                              # containing digits
 
2159
                                    "value",  # datetime.timedelta or
 
2160
                                              # None
 
2161
                                    "followers")) # Tokens valid after
 
2162
                                                  # this token
 
2163
    # RFC 3339 "duration" tokens, syntax, and semantics; taken from
 
2164
    # the "duration" ABNF definition in RFC 3339, Appendix A.
 
2165
    token_end = Token(re.compile(r"$"), None, frozenset())
 
2166
    token_second = Token(re.compile(r"(\d+)S"),
 
2167
                         datetime.timedelta(seconds=1),
 
2168
                         frozenset((token_end,)))
 
2169
    token_minute = Token(re.compile(r"(\d+)M"),
 
2170
                         datetime.timedelta(minutes=1),
 
2171
                         frozenset((token_second, token_end)))
 
2172
    token_hour = Token(re.compile(r"(\d+)H"),
 
2173
                       datetime.timedelta(hours=1),
 
2174
                       frozenset((token_minute, token_end)))
 
2175
    token_time = Token(re.compile(r"T"),
 
2176
                       None,
 
2177
                       frozenset((token_hour, token_minute,
 
2178
                                  token_second)))
 
2179
    token_day = Token(re.compile(r"(\d+)D"),
 
2180
                      datetime.timedelta(days=1),
 
2181
                      frozenset((token_time, token_end)))
 
2182
    token_month = Token(re.compile(r"(\d+)M"),
 
2183
                        datetime.timedelta(weeks=4),
 
2184
                        frozenset((token_day, token_end)))
 
2185
    token_year = Token(re.compile(r"(\d+)Y"),
 
2186
                       datetime.timedelta(weeks=52),
 
2187
                       frozenset((token_month, token_end)))
 
2188
    token_week = Token(re.compile(r"(\d+)W"),
 
2189
                       datetime.timedelta(weeks=1),
 
2190
                       frozenset((token_end,)))
 
2191
    token_duration = Token(re.compile(r"P"), None,
 
2192
                           frozenset((token_year, token_month,
 
2193
                                      token_day, token_time,
 
2194
                                      token_week)))
 
2195
    # Define starting values
 
2196
    value = datetime.timedelta() # Value so far
 
2197
    found_token = None
 
2198
    followers = frozenset((token_duration,)) # Following valid tokens
 
2199
    s = duration                # String left to parse
 
2200
    # Loop until end token is found
 
2201
    while found_token is not token_end:
 
2202
        # Search for any currently valid tokens
 
2203
        for token in followers:
 
2204
            match = token.regexp.match(s)
 
2205
            if match is not None:
 
2206
                # Token found
 
2207
                if token.value is not None:
 
2208
                    # Value found, parse digits
 
2209
                    factor = int(match.group(1), 10)
 
2210
                    # Add to value so far
 
2211
                    value += factor * token.value
 
2212
                # Strip token from string
 
2213
                s = token.regexp.sub("", s, 1)
 
2214
                # Go to found token
 
2215
                found_token = token
 
2216
                # Set valid next tokens
 
2217
                followers = found_token.followers
 
2218
                break
 
2219
        else:
 
2220
            # No currently valid tokens were found
 
2221
            raise ValueError("Invalid RFC 3339 duration")
 
2222
    # End token found
 
2223
    return value
 
2224
 
 
2225
 
1912
2226
def string_to_delta(interval):
1913
2227
    """Parse a string and return a datetime.timedelta
1914
2228
    
1925
2239
    >>> string_to_delta('5m 30s')
1926
2240
    datetime.timedelta(0, 330)
1927
2241
    """
 
2242
    
 
2243
    try:
 
2244
        return rfc3339_duration_to_delta(interval)
 
2245
    except ValueError:
 
2246
        pass
 
2247
    
1928
2248
    timevalue = datetime.timedelta(0)
1929
2249
    for s in interval.split():
1930
2250
        try:
1931
 
            suffix = unicode(s[-1])
 
2251
            suffix = s[-1]
1932
2252
            value = int(s[:-1])
1933
2253
            if suffix == "d":
1934
2254
                delta = datetime.timedelta(value)
1941
2261
            elif suffix == "w":
1942
2262
                delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
1943
2263
            else:
1944
 
                raise ValueError("Unknown suffix %r" % suffix)
1945
 
        except (ValueError, IndexError) as e:
 
2264
                raise ValueError("Unknown suffix {!r}"
 
2265
                                 .format(suffix))
 
2266
        except IndexError as e:
1946
2267
            raise ValueError(*(e.args))
1947
2268
        timevalue += delta
1948
2269
    return timevalue
1961
2282
        sys.exit()
1962
2283
    if not noclose:
1963
2284
        # Close all standard open file descriptors
1964
 
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
 
2285
        null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
1965
2286
        if not stat.S_ISCHR(os.fstat(null).st_mode):
1966
 
            raise OSError(errno.ENODEV,
1967
 
                          "%s not a character device"
1968
 
                          % os.path.devnull)
 
2287
            raise OSError(errno.ENODEV, "{} not a character device"
 
2288
                          .format(os.devnull))
1969
2289
        os.dup2(null, sys.stdin.fileno())
1970
2290
        os.dup2(null, sys.stdout.fileno())
1971
2291
        os.dup2(null, sys.stderr.fileno())
1980
2300
    
1981
2301
    parser = argparse.ArgumentParser()
1982
2302
    parser.add_argument("-v", "--version", action="version",
1983
 
                        version = "%%(prog)s %s" % version,
 
2303
                        version = "%(prog)s {}".format(version),
1984
2304
                        help="show version number and exit")
1985
2305
    parser.add_argument("-i", "--interface", metavar="IF",
1986
2306
                        help="Bind to interface IF")
1992
2312
                        help="Run self-test")
1993
2313
    parser.add_argument("--debug", action="store_true",
1994
2314
                        help="Debug mode; run in foreground and log"
1995
 
                        " to terminal")
 
2315
                        " to terminal", default=None)
1996
2316
    parser.add_argument("--debuglevel", metavar="LEVEL",
1997
2317
                        help="Debug level for stdout output")
1998
2318
    parser.add_argument("--priority", help="GnuTLS"
2005
2325
                        " files")
2006
2326
    parser.add_argument("--no-dbus", action="store_false",
2007
2327
                        dest="use_dbus", help="Do not provide D-Bus"
2008
 
                        " system bus interface")
 
2328
                        " system bus interface", default=None)
2009
2329
    parser.add_argument("--no-ipv6", action="store_false",
2010
 
                        dest="use_ipv6", help="Do not use IPv6")
 
2330
                        dest="use_ipv6", help="Do not use IPv6",
 
2331
                        default=None)
2011
2332
    parser.add_argument("--no-restore", action="store_false",
2012
2333
                        dest="restore", help="Do not restore stored"
2013
 
                        " state")
 
2334
                        " state", default=None)
 
2335
    parser.add_argument("--socket", type=int,
 
2336
                        help="Specify a file descriptor to a network"
 
2337
                        " socket to use instead of creating one")
2014
2338
    parser.add_argument("--statedir", metavar="DIR",
2015
2339
                        help="Directory to save/restore state in")
 
2340
    parser.add_argument("--foreground", action="store_true",
 
2341
                        help="Run in foreground", default=None)
 
2342
    parser.add_argument("--no-zeroconf", action="store_false",
 
2343
                        dest="zeroconf", help="Do not use Zeroconf",
 
2344
                        default=None)
2016
2345
    
2017
2346
    options = parser.parse_args()
2018
2347
    
2019
2348
    if options.check:
2020
2349
        import doctest
2021
 
        doctest.testmod()
2022
 
        sys.exit()
 
2350
        fail_count, test_count = doctest.testmod()
 
2351
        sys.exit(os.EX_OK if fail_count == 0 else 1)
2023
2352
    
2024
2353
    # Default values for config file for server-global settings
2025
2354
    server_defaults = { "interface": "",
2027
2356
                        "port": "",
2028
2357
                        "debug": "False",
2029
2358
                        "priority":
2030
 
                        "SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
 
2359
                        "SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",
2031
2360
                        "servicename": "Mandos",
2032
2361
                        "use_dbus": "True",
2033
2362
                        "use_ipv6": "True",
2034
2363
                        "debuglevel": "",
2035
2364
                        "restore": "True",
2036
 
                        "statedir": "/var/lib/mandos"
 
2365
                        "socket": "",
 
2366
                        "statedir": "/var/lib/mandos",
 
2367
                        "foreground": "False",
 
2368
                        "zeroconf": "True",
2037
2369
                        }
2038
2370
    
2039
2371
    # Parse config file for server-global settings
2044
2376
    # Convert the SafeConfigParser object to a dict
2045
2377
    server_settings = server_config.defaults()
2046
2378
    # Use the appropriate methods on the non-string config options
2047
 
    for option in ("debug", "use_dbus", "use_ipv6"):
 
2379
    for option in ("debug", "use_dbus", "use_ipv6", "foreground"):
2048
2380
        server_settings[option] = server_config.getboolean("DEFAULT",
2049
2381
                                                           option)
2050
2382
    if server_settings["port"]:
2051
2383
        server_settings["port"] = server_config.getint("DEFAULT",
2052
2384
                                                       "port")
 
2385
    if server_settings["socket"]:
 
2386
        server_settings["socket"] = server_config.getint("DEFAULT",
 
2387
                                                         "socket")
 
2388
        # Later, stdin will, and stdout and stderr might, be dup'ed
 
2389
        # over with an opened os.devnull.  But we don't want this to
 
2390
        # happen with a supplied network socket.
 
2391
        if 0 <= server_settings["socket"] <= 2:
 
2392
            server_settings["socket"] = os.dup(server_settings
 
2393
                                               ["socket"])
2053
2394
    del server_config
2054
2395
    
2055
2396
    # Override the settings from the config file with command line
2057
2398
    for option in ("interface", "address", "port", "debug",
2058
2399
                   "priority", "servicename", "configdir",
2059
2400
                   "use_dbus", "use_ipv6", "debuglevel", "restore",
2060
 
                   "statedir"):
 
2401
                   "statedir", "socket", "foreground", "zeroconf"):
2061
2402
        value = getattr(options, option)
2062
2403
        if value is not None:
2063
2404
            server_settings[option] = value
2064
2405
    del options
2065
2406
    # Force all strings to be unicode
2066
2407
    for option in server_settings.keys():
2067
 
        if type(server_settings[option]) is str:
2068
 
            server_settings[option] = unicode(server_settings[option])
 
2408
        if isinstance(server_settings[option], bytes):
 
2409
            server_settings[option] = (server_settings[option]
 
2410
                                       .decode("utf-8"))
 
2411
    # Force all boolean options to be boolean
 
2412
    for option in ("debug", "use_dbus", "use_ipv6", "restore",
 
2413
                   "foreground", "zeroconf"):
 
2414
        server_settings[option] = bool(server_settings[option])
 
2415
    # Debug implies foreground
 
2416
    if server_settings["debug"]:
 
2417
        server_settings["foreground"] = True
2069
2418
    # Now we have our good server settings in "server_settings"
2070
2419
    
2071
2420
    ##################################################################
2072
2421
    
 
2422
    if (not server_settings["zeroconf"] and
 
2423
        not (server_settings["port"]
 
2424
             or server_settings["socket"] != "")):
 
2425
            parser.error("Needs port or socket to work without"
 
2426
                         " Zeroconf")
 
2427
    
2073
2428
    # For convenience
2074
2429
    debug = server_settings["debug"]
2075
2430
    debuglevel = server_settings["debuglevel"]
2077
2432
    use_ipv6 = server_settings["use_ipv6"]
2078
2433
    stored_state_path = os.path.join(server_settings["statedir"],
2079
2434
                                     stored_state_file)
 
2435
    foreground = server_settings["foreground"]
 
2436
    zeroconf = server_settings["zeroconf"]
2080
2437
    
2081
2438
    if debug:
2082
2439
        initlogger(debug, logging.DEBUG)
2089
2446
    
2090
2447
    if server_settings["servicename"] != "Mandos":
2091
2448
        syslogger.setFormatter(logging.Formatter
2092
 
                               ('Mandos (%s) [%%(process)d]:'
2093
 
                                ' %%(levelname)s: %%(message)s'
2094
 
                                % server_settings["servicename"]))
 
2449
                               ('Mandos ({}) [%(process)d]:'
 
2450
                                ' %(levelname)s: %(message)s'
 
2451
                                .format(server_settings
 
2452
                                        ["servicename"])))
2095
2453
    
2096
2454
    # Parse config file with clients
2097
 
    client_config = configparser.SafeConfigParser(Client.client_defaults)
 
2455
    client_config = configparser.SafeConfigParser(Client
 
2456
                                                  .client_defaults)
2098
2457
    client_config.read(os.path.join(server_settings["configdir"],
2099
2458
                                    "clients.conf"))
2100
2459
    
2101
2460
    global mandos_dbus_service
2102
2461
    mandos_dbus_service = None
2103
2462
    
 
2463
    socketfd = None
 
2464
    if server_settings["socket"] != "":
 
2465
        socketfd = server_settings["socket"]
2104
2466
    tcp_server = MandosServer((server_settings["address"],
2105
2467
                               server_settings["port"]),
2106
2468
                              ClientHandler,
2109
2471
                              use_ipv6=use_ipv6,
2110
2472
                              gnutls_priority=
2111
2473
                              server_settings["priority"],
2112
 
                              use_dbus=use_dbus)
2113
 
    if not debug:
2114
 
        pidfilename = "/var/run/mandos.pid"
 
2474
                              use_dbus=use_dbus,
 
2475
                              socketfd=socketfd)
 
2476
    if not foreground:
 
2477
        pidfilename = "/run/mandos.pid"
 
2478
        if not os.path.isdir("/run/."):
 
2479
            pidfilename = "/var/run/mandos.pid"
 
2480
        pidfile = None
2115
2481
        try:
2116
2482
            pidfile = open(pidfilename, "w")
2117
 
        except IOError:
2118
 
            logger.error("Could not open file %r", pidfilename)
 
2483
        except IOError as e:
 
2484
            logger.error("Could not open file %r", pidfilename,
 
2485
                         exc_info=e)
2119
2486
    
2120
 
    try:
2121
 
        uid = pwd.getpwnam("_mandos").pw_uid
2122
 
        gid = pwd.getpwnam("_mandos").pw_gid
2123
 
    except KeyError:
 
2487
    for name in ("_mandos", "mandos", "nobody"):
2124
2488
        try:
2125
 
            uid = pwd.getpwnam("mandos").pw_uid
2126
 
            gid = pwd.getpwnam("mandos").pw_gid
 
2489
            uid = pwd.getpwnam(name).pw_uid
 
2490
            gid = pwd.getpwnam(name).pw_gid
 
2491
            break
2127
2492
        except KeyError:
2128
 
            try:
2129
 
                uid = pwd.getpwnam("nobody").pw_uid
2130
 
                gid = pwd.getpwnam("nobody").pw_gid
2131
 
            except KeyError:
2132
 
                uid = 65534
2133
 
                gid = 65534
 
2493
            continue
 
2494
    else:
 
2495
        uid = 65534
 
2496
        gid = 65534
2134
2497
    try:
2135
2498
        os.setgid(gid)
2136
2499
        os.setuid(uid)
2137
2500
    except OSError as error:
2138
 
        if error[0] != errno.EPERM:
2139
 
            raise error
 
2501
        if error.errno != errno.EPERM:
 
2502
            raise
2140
2503
    
2141
2504
    if debug:
2142
2505
        # Enable all possible GnuTLS debugging
2153
2516
         .gnutls_global_set_log_function(debug_gnutls))
2154
2517
        
2155
2518
        # Redirect stdin so all checkers get /dev/null
2156
 
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
 
2519
        null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2157
2520
        os.dup2(null, sys.stdin.fileno())
2158
2521
        if null > 2:
2159
2522
            os.close(null)
2160
2523
    
2161
2524
    # Need to fork before connecting to D-Bus
2162
 
    if not debug:
 
2525
    if not foreground:
2163
2526
        # Close all input and output, do double fork, etc.
2164
2527
        daemon()
2165
2528
    
 
2529
    # multiprocessing will use threads, so before we use gobject we
 
2530
    # need to inform gobject that threads will be used.
2166
2531
    gobject.threads_init()
2167
2532
    
2168
2533
    global main_loop
2169
2534
    # From the Avahi example code
2170
 
    DBusGMainLoop(set_as_default=True )
 
2535
    DBusGMainLoop(set_as_default=True)
2171
2536
    main_loop = gobject.MainLoop()
2172
2537
    bus = dbus.SystemBus()
2173
2538
    # End of Avahi example code
2179
2544
                            ("se.bsnet.fukt.Mandos", bus,
2180
2545
                             do_not_queue=True))
2181
2546
        except dbus.exceptions.NameExistsException as e:
2182
 
            logger.error(unicode(e) + ", disabling D-Bus")
 
2547
            logger.error("Disabling D-Bus:", exc_info=e)
2183
2548
            use_dbus = False
2184
2549
            server_settings["use_dbus"] = False
2185
2550
            tcp_server.use_dbus = False
2186
 
    protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2187
 
    service = AvahiServiceToSyslog(name =
2188
 
                                   server_settings["servicename"],
2189
 
                                   servicetype = "_mandos._tcp",
2190
 
                                   protocol = protocol, bus = bus)
2191
 
    if server_settings["interface"]:
2192
 
        service.interface = (if_nametoindex
2193
 
                             (str(server_settings["interface"])))
 
2551
    if zeroconf:
 
2552
        protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
 
2553
        service = AvahiServiceToSyslog(name =
 
2554
                                       server_settings["servicename"],
 
2555
                                       servicetype = "_mandos._tcp",
 
2556
                                       protocol = protocol, bus = bus)
 
2557
        if server_settings["interface"]:
 
2558
            service.interface = (if_nametoindex
 
2559
                                 (server_settings["interface"]
 
2560
                                  .encode("utf-8")))
2194
2561
    
2195
2562
    global multiprocessing_manager
2196
2563
    multiprocessing_manager = multiprocessing.Manager()
2197
2564
    
2198
2565
    client_class = Client
2199
2566
    if use_dbus:
2200
 
        client_class = functools.partial(ClientDBusTransitional,
2201
 
                                         bus = bus)
 
2567
        client_class = functools.partial(ClientDBus, bus = bus)
2202
2568
    
2203
2569
    client_settings = Client.config_parser(client_config)
2204
2570
    old_client_settings = {}
2205
2571
    clients_data = {}
2206
2572
    
 
2573
    # This is used to redirect stdout and stderr for checker processes
 
2574
    global wnull
 
2575
    wnull = open(os.devnull, "w") # A writable /dev/null
 
2576
    # Only used if server is running in foreground but not in debug
 
2577
    # mode
 
2578
    if debug or not foreground:
 
2579
        wnull.close()
 
2580
    
2207
2581
    # Get client data and settings from last running state.
2208
2582
    if server_settings["restore"]:
2209
2583
        try:
2212
2586
                                                     (stored_state))
2213
2587
            os.remove(stored_state_path)
2214
2588
        except IOError as e:
2215
 
            logger.warning("Could not load persistent state: {0}"
2216
 
                           .format(e))
2217
 
            if e.errno != errno.ENOENT:
 
2589
            if e.errno == errno.ENOENT:
 
2590
                logger.warning("Could not load persistent state: {}"
 
2591
                                .format(os.strerror(e.errno)))
 
2592
            else:
 
2593
                logger.critical("Could not load persistent state:",
 
2594
                                exc_info=e)
2218
2595
                raise
2219
2596
        except EOFError as e:
2220
2597
            logger.warning("Could not load persistent state: "
2221
 
                           "EOFError: {0}".format(e))
 
2598
                           "EOFError:", exc_info=e)
2222
2599
    
2223
2600
    with PGPEngine() as pgp:
2224
 
        for client_name, client in clients_data.iteritems():
 
2601
        for client_name, client in clients_data.items():
 
2602
            # Skip removed clients
 
2603
            if client_name not in client_settings:
 
2604
                continue
 
2605
            
2225
2606
            # Decide which value to use after restoring saved state.
2226
2607
            # We have three different values: Old config file,
2227
2608
            # new config file, and saved state.
2241
2622
            
2242
2623
            # Clients who has passed its expire date can still be
2243
2624
            # enabled if its last checker was successful.  Clients
2244
 
            # whose checker failed before we stored its state is
2245
 
            # assumed to have failed all checkers during downtime.
 
2625
            # whose checker succeeded before we stored its state is
 
2626
            # assumed to have successfully run all checkers during
 
2627
            # downtime.
2246
2628
            if client["enabled"]:
2247
2629
                if datetime.datetime.utcnow() >= client["expires"]:
2248
2630
                    if not client["last_checked_ok"]:
2249
2631
                        logger.warning(
2250
 
                            "disabling client {0} - Client never "
2251
 
                            "performed a successfull checker"
2252
 
                            .format(client["name"]))
 
2632
                            "disabling client {} - Client never "
 
2633
                            "performed a successful checker"
 
2634
                            .format(client_name))
2253
2635
                        client["enabled"] = False
2254
2636
                    elif client["last_checker_status"] != 0:
2255
2637
                        logger.warning(
2256
 
                            "disabling client {0} - Client "
2257
 
                            "last checker failed with error code {1}"
2258
 
                            .format(client["name"],
 
2638
                            "disabling client {} - Client last"
 
2639
                            " checker failed with error code {}"
 
2640
                            .format(client_name,
2259
2641
                                    client["last_checker_status"]))
2260
2642
                        client["enabled"] = False
2261
2643
                    else:
2262
2644
                        client["expires"] = (datetime.datetime
2263
2645
                                             .utcnow()
2264
2646
                                             + client["timeout"])
2265
 
                    
 
2647
                        logger.debug("Last checker succeeded,"
 
2648
                                     " keeping {} enabled"
 
2649
                                     .format(client_name))
2266
2650
            try:
2267
2651
                client["secret"] = (
2268
2652
                    pgp.decrypt(client["encrypted_secret"],
2270
2654
                                ["secret"]))
2271
2655
            except PGPError:
2272
2656
                # If decryption fails, we use secret from new settings
2273
 
                logger.debug("Failed to decrypt {0} old secret"
 
2657
                logger.debug("Failed to decrypt {} old secret"
2274
2658
                             .format(client_name))
2275
2659
                client["secret"] = (
2276
2660
                    client_settings[client_name]["secret"])
2277
 
 
2278
2661
    
2279
2662
    # Add/remove clients based on new changes made to config
2280
 
    for client_name in set(old_client_settings) - set(client_settings):
 
2663
    for client_name in (set(old_client_settings)
 
2664
                        - set(client_settings)):
2281
2665
        del clients_data[client_name]
2282
 
    for client_name in set(client_settings) - set(old_client_settings):
 
2666
    for client_name in (set(client_settings)
 
2667
                        - set(old_client_settings)):
2283
2668
        clients_data[client_name] = client_settings[client_name]
2284
 
 
2285
 
    # Create clients all clients
2286
 
    for client_name, client in clients_data.iteritems():
 
2669
    
 
2670
    # Create all client objects
 
2671
    for client_name, client in clients_data.items():
2287
2672
        tcp_server.clients[client_name] = client_class(
2288
 
            name = client_name, settings = client)
 
2673
            name = client_name, settings = client,
 
2674
            server_settings = server_settings)
2289
2675
    
2290
2676
    if not tcp_server.clients:
2291
2677
        logger.warning("No clients defined")
2292
 
        
2293
 
    if not debug:
2294
 
        try:
2295
 
            with pidfile:
2296
 
                pid = os.getpid()
2297
 
                pidfile.write(str(pid) + "\n".encode("utf-8"))
2298
 
            del pidfile
2299
 
        except IOError:
2300
 
            logger.error("Could not write to file %r with PID %d",
2301
 
                         pidfilename, pid)
2302
 
        except NameError:
2303
 
            # "pidfile" was never created
2304
 
            pass
 
2678
    
 
2679
    if not foreground:
 
2680
        if pidfile is not None:
 
2681
            try:
 
2682
                with pidfile:
 
2683
                    pid = os.getpid()
 
2684
                    pidfile.write("{}\n".format(pid).encode("utf-8"))
 
2685
            except IOError:
 
2686
                logger.error("Could not write to file %r with PID %d",
 
2687
                             pidfilename, pid)
 
2688
        del pidfile
2305
2689
        del pidfilename
2306
 
        signal.signal(signal.SIGINT, signal.SIG_IGN)
2307
2690
    
2308
2691
    signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2309
2692
    signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
2310
2693
    
2311
2694
    if use_dbus:
2312
 
        class MandosDBusService(dbus.service.Object):
 
2695
        @alternate_dbus_interfaces({"se.recompile.Mandos":
 
2696
                                        "se.bsnet.fukt.Mandos"})
 
2697
        class MandosDBusService(DBusObjectWithProperties):
2313
2698
            """A D-Bus proxy object"""
2314
2699
            def __init__(self):
2315
2700
                dbus.service.Object.__init__(self, bus, "/")
2316
2701
            _interface = "se.recompile.Mandos"
2317
2702
            
 
2703
            @dbus_interface_annotations(_interface)
 
2704
            def _foo(self):
 
2705
                return { "org.freedesktop.DBus.Property"
 
2706
                         ".EmitsChangedSignal":
 
2707
                             "false"}
 
2708
            
2318
2709
            @dbus.service.signal(_interface, signature="o")
2319
2710
            def ClientAdded(self, objpath):
2320
2711
                "D-Bus signal"
2342
2733
            def GetAllClientsWithProperties(self):
2343
2734
                "D-Bus method"
2344
2735
                return dbus.Dictionary(
2345
 
                    ((c.dbus_object_path, c.GetAll(""))
2346
 
                     for c in tcp_server.clients.itervalues()),
 
2736
                    { c.dbus_object_path: c.GetAll("")
 
2737
                      for c in tcp_server.clients.itervalues() },
2347
2738
                    signature="oa{sv}")
2348
2739
            
2349
2740
            @dbus.service.method(_interface, in_signature="o")
2362
2753
            
2363
2754
            del _interface
2364
2755
        
2365
 
        class MandosDBusServiceTransitional(MandosDBusService):
2366
 
            __metaclass__ = AlternateDBusNamesMetaclass
2367
 
        mandos_dbus_service = MandosDBusServiceTransitional()
 
2756
        mandos_dbus_service = MandosDBusService()
2368
2757
    
2369
2758
    def cleanup():
2370
2759
        "Cleanup function; run on exit"
2371
 
        service.cleanup()
 
2760
        if zeroconf:
 
2761
            service.cleanup()
2372
2762
        
2373
2763
        multiprocessing.active_children()
 
2764
        wnull.close()
2374
2765
        if not (tcp_server.clients or client_settings):
2375
2766
            return
2376
2767
        
2387
2778
                
2388
2779
                # A list of attributes that can not be pickled
2389
2780
                # + secret.
2390
 
                exclude = set(("bus", "changedstate", "secret",
2391
 
                               "checker"))
 
2781
                exclude = { "bus", "changedstate", "secret",
 
2782
                            "checker", "server_settings" }
2392
2783
                for name, typ in (inspect.getmembers
2393
2784
                                  (dbus.service.Object)):
2394
2785
                    exclude.add(name)
2403
2794
                del client_settings[client.name]["secret"]
2404
2795
        
2405
2796
        try:
2406
 
            tempfd, tempname = tempfile.mkstemp(suffix=".pickle",
2407
 
                                                prefix="clients-",
2408
 
                                                dir=os.path.dirname
2409
 
                                                (stored_state_path))
2410
 
            with os.fdopen(tempfd, "wb") as stored_state:
 
2797
            with (tempfile.NamedTemporaryFile
 
2798
                  (mode='wb', suffix=".pickle", prefix='clients-',
 
2799
                   dir=os.path.dirname(stored_state_path),
 
2800
                   delete=False)) as stored_state:
2411
2801
                pickle.dump((clients, client_settings), stored_state)
 
2802
                tempname=stored_state.name
2412
2803
            os.rename(tempname, stored_state_path)
2413
2804
        except (IOError, OSError) as e:
2414
 
            logger.warning("Could not save persistent state: {0}"
2415
 
                           .format(e))
2416
2805
            if not debug:
2417
2806
                try:
2418
2807
                    os.remove(tempname)
2419
2808
                except NameError:
2420
2809
                    pass
2421
 
            if e.errno not in set((errno.ENOENT, errno.EACCES,
2422
 
                                   errno.EEXIST)):
2423
 
                raise e
 
2810
            if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
 
2811
                logger.warning("Could not save persistent state: {}"
 
2812
                               .format(os.strerror(e.errno)))
 
2813
            else:
 
2814
                logger.warning("Could not save persistent state:",
 
2815
                               exc_info=e)
 
2816
                raise
2424
2817
        
2425
2818
        # Delete all clients, and settings from config
2426
2819
        while tcp_server.clients:
2450
2843
    tcp_server.server_activate()
2451
2844
    
2452
2845
    # Find out what port we got
2453
 
    service.port = tcp_server.socket.getsockname()[1]
 
2846
    if zeroconf:
 
2847
        service.port = tcp_server.socket.getsockname()[1]
2454
2848
    if use_ipv6:
2455
2849
        logger.info("Now listening on address %r, port %d,"
2456
 
                    " flowinfo %d, scope_id %d"
2457
 
                    % tcp_server.socket.getsockname())
 
2850
                    " flowinfo %d, scope_id %d",
 
2851
                    *tcp_server.socket.getsockname())
2458
2852
    else:                       # IPv4
2459
 
        logger.info("Now listening on address %r, port %d"
2460
 
                    % tcp_server.socket.getsockname())
 
2853
        logger.info("Now listening on address %r, port %d",
 
2854
                    *tcp_server.socket.getsockname())
2461
2855
    
2462
2856
    #service.interface = tcp_server.socket.getsockname()[3]
2463
2857
    
2464
2858
    try:
2465
 
        # From the Avahi example code
2466
 
        try:
2467
 
            service.activate()
2468
 
        except dbus.exceptions.DBusException as error:
2469
 
            logger.critical("DBusException: %s", error)
2470
 
            cleanup()
2471
 
            sys.exit(1)
2472
 
        # End of Avahi example code
 
2859
        if zeroconf:
 
2860
            # From the Avahi example code
 
2861
            try:
 
2862
                service.activate()
 
2863
            except dbus.exceptions.DBusException as error:
 
2864
                logger.critical("D-Bus Exception", exc_info=error)
 
2865
                cleanup()
 
2866
                sys.exit(1)
 
2867
            # End of Avahi example code
2473
2868
        
2474
2869
        gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
2475
2870
                             lambda *args, **kwargs:
2479
2874
        logger.debug("Starting main loop")
2480
2875
        main_loop.run()
2481
2876
    except AvahiError as error:
2482
 
        logger.critical("AvahiError: %s", error)
 
2877
        logger.critical("Avahi Error", exc_info=error)
2483
2878
        cleanup()
2484
2879
        sys.exit(1)
2485
2880
    except KeyboardInterrupt: