/mandos/release

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/release

« back to all changes in this revision

Viewing changes to mandos

Merge from release branch.

Show diffs side-by-side

added added

removed removed

Lines of Context:
11
11
# "AvahiService" class, and some lines in "main".
12
12
13
13
# Everything else is
14
 
# Copyright © 2008,2009 Teddy Hogeborn
15
 
# Copyright © 2008,2009 Björn Påhlsson
 
14
# Copyright © 2008-2012 Teddy Hogeborn
 
15
# Copyright © 2008-2012 Björn Påhlsson
16
16
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
28
28
# along with this program.  If not, see
29
29
# <http://www.gnu.org/licenses/>.
30
30
31
 
# Contact the authors at <mandos@fukt.bsnet.se>.
 
31
# Contact the authors at <mandos@recompile.se>.
32
32
33
33
 
34
 
from __future__ import division, with_statement, absolute_import
 
34
from __future__ import (division, absolute_import, print_function,
 
35
                        unicode_literals)
 
36
 
 
37
from future_builtins import *
35
38
 
36
39
import SocketServer as socketserver
37
40
import socket
38
 
import optparse
 
41
import argparse
39
42
import datetime
40
43
import errno
41
44
import gnutls.crypto
61
64
import functools
62
65
import cPickle as pickle
63
66
import multiprocessing
 
67
import types
 
68
import binascii
 
69
import tempfile
 
70
import itertools
64
71
 
65
72
import dbus
66
73
import dbus.service
71
78
import ctypes.util
72
79
import xml.dom.minidom
73
80
import inspect
 
81
import GnuPGInterface
74
82
 
75
83
try:
76
84
    SO_BINDTODEVICE = socket.SO_BINDTODEVICE
80
88
    except ImportError:
81
89
        SO_BINDTODEVICE = None
82
90
 
83
 
 
84
 
version = "1.0.14"
85
 
 
86
 
logger = logging.Logger(u'mandos')
 
91
version = "1.5.5"
 
92
stored_state_file = "clients.pickle"
 
93
 
 
94
logger = logging.getLogger()
87
95
syslogger = (logging.handlers.SysLogHandler
88
96
             (facility = logging.handlers.SysLogHandler.LOG_DAEMON,
89
 
              address = "/dev/log"))
90
 
syslogger.setFormatter(logging.Formatter
91
 
                       (u'Mandos [%(process)d]: %(levelname)s:'
92
 
                        u' %(message)s'))
93
 
logger.addHandler(syslogger)
94
 
 
95
 
console = logging.StreamHandler()
96
 
console.setFormatter(logging.Formatter(u'%(name)s [%(process)d]:'
97
 
                                       u' %(levelname)s:'
98
 
                                       u' %(message)s'))
99
 
logger.addHandler(console)
100
 
 
101
 
multiprocessing_manager = multiprocessing.Manager()
 
97
              address = str("/dev/log")))
 
98
 
 
99
try:
 
100
    if_nametoindex = (ctypes.cdll.LoadLibrary
 
101
                      (ctypes.util.find_library("c"))
 
102
                      .if_nametoindex)
 
103
except (OSError, AttributeError):
 
104
    def if_nametoindex(interface):
 
105
        "Get an interface index the hard way, i.e. using fcntl()"
 
106
        SIOCGIFINDEX = 0x8933  # From /usr/include/linux/sockios.h
 
107
        with contextlib.closing(socket.socket()) as s:
 
108
            ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
 
109
                                struct.pack(str("16s16x"),
 
110
                                            interface))
 
111
        interface_index = struct.unpack(str("I"),
 
112
                                        ifreq[16:20])[0]
 
113
        return interface_index
 
114
 
 
115
 
 
116
def initlogger(debug, level=logging.WARNING):
 
117
    """init logger and add loglevel"""
 
118
    
 
119
    syslogger.setFormatter(logging.Formatter
 
120
                           ('Mandos [%(process)d]: %(levelname)s:'
 
121
                            ' %(message)s'))
 
122
    logger.addHandler(syslogger)
 
123
    
 
124
    if debug:
 
125
        console = logging.StreamHandler()
 
126
        console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
 
127
                                               ' [%(process)d]:'
 
128
                                               ' %(levelname)s:'
 
129
                                               ' %(message)s'))
 
130
        logger.addHandler(console)
 
131
    logger.setLevel(level)
 
132
 
 
133
 
 
134
class PGPError(Exception):
 
135
    """Exception if encryption/decryption fails"""
 
136
    pass
 
137
 
 
138
 
 
139
class PGPEngine(object):
 
140
    """A simple class for OpenPGP symmetric encryption & decryption"""
 
141
    def __init__(self):
 
142
        self.gnupg = GnuPGInterface.GnuPG()
 
143
        self.tempdir = tempfile.mkdtemp(prefix="mandos-")
 
144
        self.gnupg = GnuPGInterface.GnuPG()
 
145
        self.gnupg.options.meta_interactive = False
 
146
        self.gnupg.options.homedir = self.tempdir
 
147
        self.gnupg.options.extra_args.extend(['--force-mdc',
 
148
                                              '--quiet',
 
149
                                              '--no-use-agent'])
 
150
    
 
151
    def __enter__(self):
 
152
        return self
 
153
    
 
154
    def __exit__(self, exc_type, exc_value, traceback):
 
155
        self._cleanup()
 
156
        return False
 
157
    
 
158
    def __del__(self):
 
159
        self._cleanup()
 
160
    
 
161
    def _cleanup(self):
 
162
        if self.tempdir is not None:
 
163
            # Delete contents of tempdir
 
164
            for root, dirs, files in os.walk(self.tempdir,
 
165
                                             topdown = False):
 
166
                for filename in files:
 
167
                    os.remove(os.path.join(root, filename))
 
168
                for dirname in dirs:
 
169
                    os.rmdir(os.path.join(root, dirname))
 
170
            # Remove tempdir
 
171
            os.rmdir(self.tempdir)
 
172
            self.tempdir = None
 
173
    
 
174
    def password_encode(self, password):
 
175
        # Passphrase can not be empty and can not contain newlines or
 
176
        # NUL bytes.  So we prefix it and hex encode it.
 
177
        return b"mandos" + binascii.hexlify(password)
 
178
    
 
179
    def encrypt(self, data, password):
 
180
        self.gnupg.passphrase = self.password_encode(password)
 
181
        with open(os.devnull, "w") as devnull:
 
182
            try:
 
183
                proc = self.gnupg.run(['--symmetric'],
 
184
                                      create_fhs=['stdin', 'stdout'],
 
185
                                      attach_fhs={'stderr': devnull})
 
186
                with contextlib.closing(proc.handles['stdin']) as f:
 
187
                    f.write(data)
 
188
                with contextlib.closing(proc.handles['stdout']) as f:
 
189
                    ciphertext = f.read()
 
190
                proc.wait()
 
191
            except IOError as e:
 
192
                raise PGPError(e)
 
193
        self.gnupg.passphrase = None
 
194
        return ciphertext
 
195
    
 
196
    def decrypt(self, data, password):
 
197
        self.gnupg.passphrase = self.password_encode(password)
 
198
        with open(os.devnull, "w") as devnull:
 
199
            try:
 
200
                proc = self.gnupg.run(['--decrypt'],
 
201
                                      create_fhs=['stdin', 'stdout'],
 
202
                                      attach_fhs={'stderr': devnull})
 
203
                with contextlib.closing(proc.handles['stdin']) as f:
 
204
                    f.write(data)
 
205
                with contextlib.closing(proc.handles['stdout']) as f:
 
206
                    decrypted_plaintext = f.read()
 
207
                proc.wait()
 
208
            except IOError as e:
 
209
                raise PGPError(e)
 
210
        self.gnupg.passphrase = None
 
211
        return decrypted_plaintext
 
212
 
102
213
 
103
214
class AvahiError(Exception):
104
215
    def __init__(self, value, *args, **kwargs):
120
231
    Attributes:
121
232
    interface: integer; avahi.IF_UNSPEC or an interface index.
122
233
               Used to optionally bind to the specified interface.
123
 
    name: string; Example: u'Mandos'
124
 
    type: string; Example: u'_mandos._tcp'.
 
234
    name: string; Example: 'Mandos'
 
235
    type: string; Example: '_mandos._tcp'.
125
236
                  See <http://www.dns-sd.org/ServiceTypes.html>
126
237
    port: integer; what port to announce
127
238
    TXT: list of strings; TXT record for the service
134
245
    server: D-Bus Server
135
246
    bus: dbus.SystemBus()
136
247
    """
 
248
    
137
249
    def __init__(self, interface = avahi.IF_UNSPEC, name = None,
138
250
                 servicetype = None, port = None, TXT = None,
139
 
                 domain = u"", host = u"", max_renames = 32768,
 
251
                 domain = "", host = "", max_renames = 32768,
140
252
                 protocol = avahi.PROTO_UNSPEC, bus = None):
141
253
        self.interface = interface
142
254
        self.name = name
151
263
        self.group = None       # our entry group
152
264
        self.server = None
153
265
        self.bus = bus
 
266
        self.entry_group_state_changed_match = None
 
267
    
154
268
    def rename(self):
155
269
        """Derived from the Avahi example code"""
156
270
        if self.rename_count >= self.max_renames:
157
 
            logger.critical(u"No suitable Zeroconf service name found"
158
 
                            u" after %i retries, exiting.",
 
271
            logger.critical("No suitable Zeroconf service name found"
 
272
                            " after %i retries, exiting.",
159
273
                            self.rename_count)
160
 
            raise AvahiServiceError(u"Too many renames")
161
 
        self.name = self.server.GetAlternativeServiceName(self.name)
162
 
        logger.info(u"Changing Zeroconf service name to %r ...",
163
 
                    unicode(self.name))
164
 
        syslogger.setFormatter(logging.Formatter
165
 
                               (u'Mandos (%s) [%%(process)d]:'
166
 
                                u' %%(levelname)s: %%(message)s'
167
 
                                % self.name))
 
274
            raise AvahiServiceError("Too many renames")
 
275
        self.name = unicode(self.server
 
276
                            .GetAlternativeServiceName(self.name))
 
277
        logger.info("Changing Zeroconf service name to %r ...",
 
278
                    self.name)
168
279
        self.remove()
169
 
        self.add()
 
280
        try:
 
281
            self.add()
 
282
        except dbus.exceptions.DBusException as error:
 
283
            logger.critical("D-Bus Exception", exc_info=error)
 
284
            self.cleanup()
 
285
            os._exit(1)
170
286
        self.rename_count += 1
 
287
    
171
288
    def remove(self):
172
289
        """Derived from the Avahi example code"""
 
290
        if self.entry_group_state_changed_match is not None:
 
291
            self.entry_group_state_changed_match.remove()
 
292
            self.entry_group_state_changed_match = None
173
293
        if self.group is not None:
174
294
            self.group.Reset()
 
295
    
175
296
    def add(self):
176
297
        """Derived from the Avahi example code"""
 
298
        self.remove()
177
299
        if self.group is None:
178
300
            self.group = dbus.Interface(
179
301
                self.bus.get_object(avahi.DBUS_NAME,
180
302
                                    self.server.EntryGroupNew()),
181
303
                avahi.DBUS_INTERFACE_ENTRY_GROUP)
182
 
            self.group.connect_to_signal('StateChanged',
183
 
                                         self
184
 
                                         .entry_group_state_changed)
185
 
        logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
 
304
        self.entry_group_state_changed_match = (
 
305
            self.group.connect_to_signal(
 
306
                'StateChanged', self.entry_group_state_changed))
 
307
        logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
186
308
                     self.name, self.type)
187
309
        self.group.AddService(
188
310
            self.interface,
193
315
            dbus.UInt16(self.port),
194
316
            avahi.string_array_to_txt_array(self.TXT))
195
317
        self.group.Commit()
 
318
    
196
319
    def entry_group_state_changed(self, state, error):
197
320
        """Derived from the Avahi example code"""
198
 
        logger.debug(u"Avahi state change: %i", state)
 
321
        logger.debug("Avahi entry group state change: %i", state)
199
322
        
200
323
        if state == avahi.ENTRY_GROUP_ESTABLISHED:
201
 
            logger.debug(u"Zeroconf service established.")
 
324
            logger.debug("Zeroconf service established.")
202
325
        elif state == avahi.ENTRY_GROUP_COLLISION:
203
 
            logger.warning(u"Zeroconf service name collision.")
 
326
            logger.info("Zeroconf service name collision.")
204
327
            self.rename()
205
328
        elif state == avahi.ENTRY_GROUP_FAILURE:
206
 
            logger.critical(u"Avahi: Error in group state changed %s",
 
329
            logger.critical("Avahi: Error in group state changed %s",
207
330
                            unicode(error))
208
 
            raise AvahiGroupError(u"State changed: %s"
209
 
                                  % unicode(error))
 
331
            raise AvahiGroupError("State changed: {0!s}"
 
332
                                  .format(error))
 
333
    
210
334
    def cleanup(self):
211
335
        """Derived from the Avahi example code"""
212
336
        if self.group is not None:
213
 
            self.group.Free()
 
337
            try:
 
338
                self.group.Free()
 
339
            except (dbus.exceptions.UnknownMethodException,
 
340
                    dbus.exceptions.DBusException):
 
341
                pass
214
342
            self.group = None
215
 
    def server_state_changed(self, state):
 
343
        self.remove()
 
344
    
 
345
    def server_state_changed(self, state, error=None):
216
346
        """Derived from the Avahi example code"""
217
 
        if state == avahi.SERVER_COLLISION:
218
 
            logger.error(u"Zeroconf server name collision")
219
 
            self.remove()
 
347
        logger.debug("Avahi server state change: %i", state)
 
348
        bad_states = { avahi.SERVER_INVALID:
 
349
                           "Zeroconf server invalid",
 
350
                       avahi.SERVER_REGISTERING: None,
 
351
                       avahi.SERVER_COLLISION:
 
352
                           "Zeroconf server name collision",
 
353
                       avahi.SERVER_FAILURE:
 
354
                           "Zeroconf server failure" }
 
355
        if state in bad_states:
 
356
            if bad_states[state] is not None:
 
357
                if error is None:
 
358
                    logger.error(bad_states[state])
 
359
                else:
 
360
                    logger.error(bad_states[state] + ": %r", error)
 
361
            self.cleanup()
220
362
        elif state == avahi.SERVER_RUNNING:
221
363
            self.add()
 
364
        else:
 
365
            if error is None:
 
366
                logger.debug("Unknown state: %r", state)
 
367
            else:
 
368
                logger.debug("Unknown state: %r: %r", state, error)
 
369
    
222
370
    def activate(self):
223
371
        """Derived from the Avahi example code"""
224
372
        if self.server is None:
225
373
            self.server = dbus.Interface(
226
374
                self.bus.get_object(avahi.DBUS_NAME,
227
 
                                    avahi.DBUS_PATH_SERVER),
 
375
                                    avahi.DBUS_PATH_SERVER,
 
376
                                    follow_name_owner_changes=True),
228
377
                avahi.DBUS_INTERFACE_SERVER)
229
 
        self.server.connect_to_signal(u"StateChanged",
 
378
        self.server.connect_to_signal("StateChanged",
230
379
                                 self.server_state_changed)
231
380
        self.server_state_changed(self.server.GetState())
232
381
 
233
382
 
 
383
class AvahiServiceToSyslog(AvahiService):
 
384
    def rename(self):
 
385
        """Add the new name to the syslog messages"""
 
386
        ret = AvahiService.rename(self)
 
387
        syslogger.setFormatter(logging.Formatter
 
388
                               ('Mandos ({0}) [%(process)d]:'
 
389
                                ' %(levelname)s: %(message)s'
 
390
                                .format(self.name)))
 
391
        return ret
 
392
 
 
393
 
 
394
def timedelta_to_milliseconds(td):
 
395
    "Convert a datetime.timedelta() to milliseconds"
 
396
    return ((td.days * 24 * 60 * 60 * 1000)
 
397
            + (td.seconds * 1000)
 
398
            + (td.microseconds // 1000))
 
399
 
 
400
 
234
401
class Client(object):
235
402
    """A representation of a client host served by this server.
236
403
    
237
404
    Attributes:
238
 
    name:       string; from the config file, used in log messages and
239
 
                        D-Bus identifiers
 
405
    approved:   bool(); 'None' if not yet approved/disapproved
 
406
    approval_delay: datetime.timedelta(); Time to wait for approval
 
407
    approval_duration: datetime.timedelta(); Duration of one approval
 
408
    checker:    subprocess.Popen(); a running checker process used
 
409
                                    to see if the client lives.
 
410
                                    'None' if no process is running.
 
411
    checker_callback_tag: a gobject event source tag, or None
 
412
    checker_command: string; External command which is run to check
 
413
                     if client lives.  %() expansions are done at
 
414
                     runtime with vars(self) as dict, so that for
 
415
                     instance %(name)s can be used in the command.
 
416
    checker_initiator_tag: a gobject event source tag, or None
 
417
    created:    datetime.datetime(); (UTC) object creation
 
418
    client_structure: Object describing what attributes a client has
 
419
                      and is used for storing the client at exit
 
420
    current_checker_command: string; current running checker_command
 
421
    disable_initiator_tag: a gobject event source tag, or None
 
422
    enabled:    bool()
240
423
    fingerprint: string (40 or 32 hexadecimal digits); used to
241
424
                 uniquely identify the client
242
 
    secret:     bytestring; sent verbatim (over TLS) to client
243
425
    host:       string; available for use by the checker command
244
 
    created:    datetime.datetime(); (UTC) object creation
245
 
    last_enabled: datetime.datetime(); (UTC)
246
 
    enabled:    bool()
 
426
    interval:   datetime.timedelta(); How often to start a new checker
 
427
    last_approval_request: datetime.datetime(); (UTC) or None
247
428
    last_checked_ok: datetime.datetime(); (UTC) or None
 
429
    last_checker_status: integer between 0 and 255 reflecting exit
 
430
                         status of last checker. -1 reflects crashed
 
431
                         checker, -2 means no checker completed yet.
 
432
    last_enabled: datetime.datetime(); (UTC) or None
 
433
    name:       string; from the config file, used in log messages and
 
434
                        D-Bus identifiers
 
435
    secret:     bytestring; sent verbatim (over TLS) to client
248
436
    timeout:    datetime.timedelta(); How long from last_checked_ok
249
437
                                      until this client is disabled
250
 
    interval:   datetime.timedelta(); How often to start a new checker
251
 
    disable_hook:  If set, called by disable() as disable_hook(self)
252
 
    checker:    subprocess.Popen(); a running checker process used
253
 
                                    to see if the client lives.
254
 
                                    'None' if no process is running.
255
 
    checker_initiator_tag: a gobject event source tag, or None
256
 
    disable_initiator_tag: - '' -
257
 
    checker_callback_tag:  - '' -
258
 
    checker_command: string; External command which is run to check if
259
 
                     client lives.  %() expansions are done at
260
 
                     runtime with vars(self) as dict, so that for
261
 
                     instance %(name)s can be used in the command.
262
 
    current_checker_command: string; current running checker_command
263
 
    approved_delay: datetime.timedelta(); Time to wait for approval
264
 
    _approved:   bool(); 'None' if not yet approved/disapproved
265
 
    approved_duration: datetime.timedelta(); Duration of one approval
 
438
    extended_timeout:   extra long timeout when secret has been sent
 
439
    runtime_expansions: Allowed attributes for runtime expansion.
 
440
    expires:    datetime.datetime(); time (UTC) when a client will be
 
441
                disabled, or None
266
442
    """
267
443
    
268
 
    @staticmethod
269
 
    def _timedelta_to_milliseconds(td):
270
 
        "Convert a datetime.timedelta() to milliseconds"
271
 
        return ((td.days * 24 * 60 * 60 * 1000)
272
 
                + (td.seconds * 1000)
273
 
                + (td.microseconds // 1000))
 
444
    runtime_expansions = ("approval_delay", "approval_duration",
 
445
                          "created", "enabled", "expires",
 
446
                          "fingerprint", "host", "interval",
 
447
                          "last_approval_request", "last_checked_ok",
 
448
                          "last_enabled", "name", "timeout")
 
449
    client_defaults = { "timeout": "5m",
 
450
                        "extended_timeout": "15m",
 
451
                        "interval": "2m",
 
452
                        "checker": "fping -q -- %%(host)s",
 
453
                        "host": "",
 
454
                        "approval_delay": "0s",
 
455
                        "approval_duration": "1s",
 
456
                        "approved_by_default": "True",
 
457
                        "enabled": "True",
 
458
                        }
274
459
    
275
460
    def timeout_milliseconds(self):
276
461
        "Return the 'timeout' attribute in milliseconds"
277
 
        return self._timedelta_to_milliseconds(self.timeout)
 
462
        return timedelta_to_milliseconds(self.timeout)
 
463
    
 
464
    def extended_timeout_milliseconds(self):
 
465
        "Return the 'extended_timeout' attribute in milliseconds"
 
466
        return timedelta_to_milliseconds(self.extended_timeout)
278
467
    
279
468
    def interval_milliseconds(self):
280
469
        "Return the 'interval' attribute in milliseconds"
281
 
        return self._timedelta_to_milliseconds(self.interval)
282
 
 
283
 
    def approved_delay_milliseconds(self):
284
 
        return self._timedelta_to_milliseconds(self.approved_delay)
285
 
    
286
 
    def __init__(self, name = None, disable_hook=None, config=None):
287
 
        """Note: the 'checker' key in 'config' sets the
288
 
        'checker_command' attribute and *not* the 'checker'
289
 
        attribute."""
 
470
        return timedelta_to_milliseconds(self.interval)
 
471
    
 
472
    def approval_delay_milliseconds(self):
 
473
        return timedelta_to_milliseconds(self.approval_delay)
 
474
    
 
475
    @staticmethod
 
476
    def config_parser(config):
 
477
        """Construct a new dict of client settings of this form:
 
478
        { client_name: {setting_name: value, ...}, ...}
 
479
        with exceptions for any special settings as defined above.
 
480
        NOTE: Must be a pure function. Must return the same result
 
481
        value given the same arguments.
 
482
        """
 
483
        settings = {}
 
484
        for client_name in config.sections():
 
485
            section = dict(config.items(client_name))
 
486
            client = settings[client_name] = {}
 
487
            
 
488
            client["host"] = section["host"]
 
489
            # Reformat values from string types to Python types
 
490
            client["approved_by_default"] = config.getboolean(
 
491
                client_name, "approved_by_default")
 
492
            client["enabled"] = config.getboolean(client_name,
 
493
                                                  "enabled")
 
494
            
 
495
            client["fingerprint"] = (section["fingerprint"].upper()
 
496
                                     .replace(" ", ""))
 
497
            if "secret" in section:
 
498
                client["secret"] = section["secret"].decode("base64")
 
499
            elif "secfile" in section:
 
500
                with open(os.path.expanduser(os.path.expandvars
 
501
                                             (section["secfile"])),
 
502
                          "rb") as secfile:
 
503
                    client["secret"] = secfile.read()
 
504
            else:
 
505
                raise TypeError("No secret or secfile for section {0}"
 
506
                                .format(section))
 
507
            client["timeout"] = string_to_delta(section["timeout"])
 
508
            client["extended_timeout"] = string_to_delta(
 
509
                section["extended_timeout"])
 
510
            client["interval"] = string_to_delta(section["interval"])
 
511
            client["approval_delay"] = string_to_delta(
 
512
                section["approval_delay"])
 
513
            client["approval_duration"] = string_to_delta(
 
514
                section["approval_duration"])
 
515
            client["checker_command"] = section["checker"]
 
516
            client["last_approval_request"] = None
 
517
            client["last_checked_ok"] = None
 
518
            client["last_checker_status"] = -2
 
519
        
 
520
        return settings
 
521
    
 
522
    def __init__(self, settings, name = None):
290
523
        self.name = name
291
 
        if config is None:
292
 
            config = {}
293
 
        logger.debug(u"Creating client %r", self.name)
 
524
        # adding all client settings
 
525
        for setting, value in settings.iteritems():
 
526
            setattr(self, setting, value)
 
527
        
 
528
        if self.enabled:
 
529
            if not hasattr(self, "last_enabled"):
 
530
                self.last_enabled = datetime.datetime.utcnow()
 
531
            if not hasattr(self, "expires"):
 
532
                self.expires = (datetime.datetime.utcnow()
 
533
                                + self.timeout)
 
534
        else:
 
535
            self.last_enabled = None
 
536
            self.expires = None
 
537
        
 
538
        logger.debug("Creating client %r", self.name)
294
539
        # Uppercase and remove spaces from fingerprint for later
295
540
        # comparison purposes with return value from the fingerprint()
296
541
        # function
297
 
        self.fingerprint = (config[u"fingerprint"].upper()
298
 
                            .replace(u" ", u""))
299
 
        logger.debug(u"  Fingerprint: %s", self.fingerprint)
300
 
        if u"secret" in config:
301
 
            self.secret = config[u"secret"].decode(u"base64")
302
 
        elif u"secfile" in config:
303
 
            with open(os.path.expanduser(os.path.expandvars
304
 
                                         (config[u"secfile"])),
305
 
                      "rb") as secfile:
306
 
                self.secret = secfile.read()
307
 
        else:
308
 
            #XXX Need to allow secret on demand!
309
 
            raise TypeError(u"No secret or secfile for client %s"
310
 
                            % self.name)
311
 
        self.host = config.get(u"host", u"")
312
 
        self.created = datetime.datetime.utcnow()
313
 
        self.enabled = False
314
 
        self.last_enabled = None
315
 
        self.last_checked_ok = None
316
 
        self.timeout = string_to_delta(config[u"timeout"])
317
 
        self.interval = string_to_delta(config[u"interval"])
318
 
        self.disable_hook = disable_hook
 
542
        logger.debug("  Fingerprint: %s", self.fingerprint)
 
543
        self.created = settings.get("created",
 
544
                                    datetime.datetime.utcnow())
 
545
        
 
546
        # attributes specific for this server instance
319
547
        self.checker = None
320
548
        self.checker_initiator_tag = None
321
549
        self.disable_initiator_tag = None
322
550
        self.checker_callback_tag = None
323
 
        self.checker_command = config[u"checker"]
324
551
        self.current_checker_command = None
325
 
        self.last_connect = None
 
552
        self.approved = None
326
553
        self.approvals_pending = 0
327
 
        self._approved = None
328
 
        self.approved_by_default = config.get(u"approved_by_default",
329
 
                                              False)
330
 
        self.approved_delay = string_to_delta(
331
 
            config[u"approved_delay"])
332
 
        self.approved_duration = string_to_delta(
333
 
            config[u"approved_duration"])
334
 
        self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())
335
 
 
 
554
        self.changedstate = (multiprocessing_manager
 
555
                             .Condition(multiprocessing_manager
 
556
                                        .Lock()))
 
557
        self.client_structure = [attr for attr in
 
558
                                 self.__dict__.iterkeys()
 
559
                                 if not attr.startswith("_")]
 
560
        self.client_structure.append("client_structure")
 
561
        
 
562
        for name, t in inspect.getmembers(type(self),
 
563
                                          lambda obj:
 
564
                                              isinstance(obj,
 
565
                                                         property)):
 
566
            if not name.startswith("_"):
 
567
                self.client_structure.append(name)
 
568
    
 
569
    # Send notice to process children that client state has changed
336
570
    def send_changedstate(self):
337
 
        self.changedstate.acquire()
338
 
        self.changedstate.notify_all()
339
 
        self.changedstate.release()
340
 
        
 
571
        with self.changedstate:
 
572
            self.changedstate.notify_all()
 
573
    
341
574
    def enable(self):
342
575
        """Start this client's checker and timeout hooks"""
343
 
        if getattr(self, u"enabled", False):
 
576
        if getattr(self, "enabled", False):
344
577
            # Already enabled
345
578
            return
346
 
        self.send_changedstate()
 
579
        self.expires = datetime.datetime.utcnow() + self.timeout
 
580
        self.enabled = True
347
581
        self.last_enabled = datetime.datetime.utcnow()
 
582
        self.init_checker()
 
583
        self.send_changedstate()
 
584
    
 
585
    def disable(self, quiet=True):
 
586
        """Disable this client."""
 
587
        if not getattr(self, "enabled", False):
 
588
            return False
 
589
        if not quiet:
 
590
            logger.info("Disabling client %s", self.name)
 
591
        if getattr(self, "disable_initiator_tag", None) is not None:
 
592
            gobject.source_remove(self.disable_initiator_tag)
 
593
            self.disable_initiator_tag = None
 
594
        self.expires = None
 
595
        if getattr(self, "checker_initiator_tag", None) is not None:
 
596
            gobject.source_remove(self.checker_initiator_tag)
 
597
            self.checker_initiator_tag = None
 
598
        self.stop_checker()
 
599
        self.enabled = False
 
600
        if not quiet:
 
601
            self.send_changedstate()
 
602
        # Do not run this again if called by a gobject.timeout_add
 
603
        return False
 
604
    
 
605
    def __del__(self):
 
606
        self.disable()
 
607
    
 
608
    def init_checker(self):
348
609
        # Schedule a new checker to be started an 'interval' from now,
349
610
        # and every interval from then on.
 
611
        if self.checker_initiator_tag is not None:
 
612
            gobject.source_remove(self.checker_initiator_tag)
350
613
        self.checker_initiator_tag = (gobject.timeout_add
351
614
                                      (self.interval_milliseconds(),
352
615
                                       self.start_checker))
353
616
        # Schedule a disable() when 'timeout' has passed
 
617
        if self.disable_initiator_tag is not None:
 
618
            gobject.source_remove(self.disable_initiator_tag)
354
619
        self.disable_initiator_tag = (gobject.timeout_add
355
620
                                   (self.timeout_milliseconds(),
356
621
                                    self.disable))
357
 
        self.enabled = True
358
622
        # Also start a new checker *right now*.
359
623
        self.start_checker()
360
624
    
361
 
    def disable(self, quiet=True):
362
 
        """Disable this client."""
363
 
        if not getattr(self, "enabled", False):
364
 
            return False
365
 
        if not quiet:
366
 
            self.send_changedstate()
367
 
        if not quiet:
368
 
            logger.info(u"Disabling client %s", self.name)
369
 
        if getattr(self, u"disable_initiator_tag", False):
370
 
            gobject.source_remove(self.disable_initiator_tag)
371
 
            self.disable_initiator_tag = None
372
 
        if getattr(self, u"checker_initiator_tag", False):
373
 
            gobject.source_remove(self.checker_initiator_tag)
374
 
            self.checker_initiator_tag = None
375
 
        self.stop_checker()
376
 
        if self.disable_hook:
377
 
            self.disable_hook(self)
378
 
        self.enabled = False
379
 
        # Do not run this again if called by a gobject.timeout_add
380
 
        return False
381
 
    
382
 
    def __del__(self):
383
 
        self.disable_hook = None
384
 
        self.disable()
385
 
    
386
625
    def checker_callback(self, pid, condition, command):
387
626
        """The checker has completed, so take appropriate actions."""
388
627
        self.checker_callback_tag = None
389
628
        self.checker = None
390
629
        if os.WIFEXITED(condition):
391
 
            exitstatus = os.WEXITSTATUS(condition)
392
 
            if exitstatus == 0:
393
 
                logger.info(u"Checker for %(name)s succeeded",
 
630
            self.last_checker_status = os.WEXITSTATUS(condition)
 
631
            if self.last_checker_status == 0:
 
632
                logger.info("Checker for %(name)s succeeded",
394
633
                            vars(self))
395
634
                self.checked_ok()
396
635
            else:
397
 
                logger.info(u"Checker for %(name)s failed",
 
636
                logger.info("Checker for %(name)s failed",
398
637
                            vars(self))
399
638
        else:
400
 
            logger.warning(u"Checker for %(name)s crashed?",
 
639
            self.last_checker_status = -1
 
640
            logger.warning("Checker for %(name)s crashed?",
401
641
                           vars(self))
402
642
    
403
643
    def checked_ok(self):
404
 
        """Bump up the timeout for this client.
405
 
        
406
 
        This should only be called when the client has been seen,
407
 
        alive and well.
408
 
        """
 
644
        """Assert that the client has been seen, alive and well."""
409
645
        self.last_checked_ok = datetime.datetime.utcnow()
410
 
        gobject.source_remove(self.disable_initiator_tag)
411
 
        self.disable_initiator_tag = (gobject.timeout_add
412
 
                                      (self.timeout_milliseconds(),
413
 
                                       self.disable))
 
646
        self.last_checker_status = 0
 
647
        self.bump_timeout()
 
648
    
 
649
    def bump_timeout(self, timeout=None):
 
650
        """Bump up the timeout for this client."""
 
651
        if timeout is None:
 
652
            timeout = self.timeout
 
653
        if self.disable_initiator_tag is not None:
 
654
            gobject.source_remove(self.disable_initiator_tag)
 
655
            self.disable_initiator_tag = None
 
656
        if getattr(self, "enabled", False):
 
657
            self.disable_initiator_tag = (gobject.timeout_add
 
658
                                          (timedelta_to_milliseconds
 
659
                                           (timeout), self.disable))
 
660
            self.expires = datetime.datetime.utcnow() + timeout
 
661
    
 
662
    def need_approval(self):
 
663
        self.last_approval_request = datetime.datetime.utcnow()
414
664
    
415
665
    def start_checker(self):
416
666
        """Start a new checker subprocess if one is not running.
418
668
        If a checker already exists, leave it running and do
419
669
        nothing."""
420
670
        # The reason for not killing a running checker is that if we
421
 
        # did that, then if a checker (for some reason) started
422
 
        # running slowly and taking more than 'interval' time, the
423
 
        # client would inevitably timeout, since no checker would get
424
 
        # a chance to run to completion.  If we instead leave running
 
671
        # did that, and if a checker (for some reason) started running
 
672
        # slowly and taking more than 'interval' time, then the client
 
673
        # would inevitably timeout, since no checker would get a
 
674
        # chance to run to completion.  If we instead leave running
425
675
        # checkers alone, the checker would have to take more time
426
676
        # than 'timeout' for the client to be disabled, which is as it
427
677
        # should be.
429
679
        # If a checker exists, make sure it is not a zombie
430
680
        try:
431
681
            pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
432
 
        except (AttributeError, OSError), error:
 
682
        except (AttributeError, OSError) as error:
433
683
            if (isinstance(error, OSError)
434
684
                and error.errno != errno.ECHILD):
435
685
                raise error
436
686
        else:
437
687
            if pid:
438
 
                logger.warning(u"Checker was a zombie")
 
688
                logger.warning("Checker was a zombie")
439
689
                gobject.source_remove(self.checker_callback_tag)
440
690
                self.checker_callback(pid, status,
441
691
                                      self.current_checker_command)
442
692
        # Start a new checker if needed
443
693
        if self.checker is None:
 
694
            # Escape attributes for the shell
 
695
            escaped_attrs = dict(
 
696
                (attr, re.escape(unicode(getattr(self, attr))))
 
697
                for attr in
 
698
                self.runtime_expansions)
444
699
            try:
445
 
                # In case checker_command has exactly one % operator
446
 
                command = self.checker_command % self.host
447
 
            except TypeError:
448
 
                # Escape attributes for the shell
449
 
                escaped_attrs = dict((key,
450
 
                                      re.escape(unicode(str(val),
451
 
                                                        errors=
452
 
                                                        u'replace')))
453
 
                                     for key, val in
454
 
                                     vars(self).iteritems())
455
 
                try:
456
 
                    command = self.checker_command % escaped_attrs
457
 
                except TypeError, error:
458
 
                    logger.error(u'Could not format string "%s":'
459
 
                                 u' %s', self.checker_command, error)
460
 
                    return True # Try again later
 
700
                command = self.checker_command % escaped_attrs
 
701
            except TypeError as error:
 
702
                logger.error('Could not format string "%s"',
 
703
                             self.checker_command, exc_info=error)
 
704
                return True # Try again later
461
705
            self.current_checker_command = command
462
706
            try:
463
 
                logger.info(u"Starting checker %r for %s",
 
707
                logger.info("Starting checker %r for %s",
464
708
                            command, self.name)
465
709
                # We don't need to redirect stdout and stderr, since
466
710
                # in normal mode, that is already done by daemon(),
468
712
                # always replaced by /dev/null.)
469
713
                self.checker = subprocess.Popen(command,
470
714
                                                close_fds=True,
471
 
                                                shell=True, cwd=u"/")
472
 
                self.checker_callback_tag = (gobject.child_watch_add
473
 
                                             (self.checker.pid,
474
 
                                              self.checker_callback,
475
 
                                              data=command))
476
 
                # The checker may have completed before the gobject
477
 
                # watch was added.  Check for this.
478
 
                pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
479
 
                if pid:
480
 
                    gobject.source_remove(self.checker_callback_tag)
481
 
                    self.checker_callback(pid, status, command)
482
 
            except OSError, error:
483
 
                logger.error(u"Failed to start subprocess: %s",
484
 
                             error)
 
715
                                                shell=True, cwd="/")
 
716
            except OSError as error:
 
717
                logger.error("Failed to start subprocess",
 
718
                             exc_info=error)
 
719
            self.checker_callback_tag = (gobject.child_watch_add
 
720
                                         (self.checker.pid,
 
721
                                          self.checker_callback,
 
722
                                          data=command))
 
723
            # The checker may have completed before the gobject
 
724
            # watch was added.  Check for this.
 
725
            pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
 
726
            if pid:
 
727
                gobject.source_remove(self.checker_callback_tag)
 
728
                self.checker_callback(pid, status, command)
485
729
        # Re-run this periodically if run by gobject.timeout_add
486
730
        return True
487
731
    
490
734
        if self.checker_callback_tag:
491
735
            gobject.source_remove(self.checker_callback_tag)
492
736
            self.checker_callback_tag = None
493
 
        if getattr(self, u"checker", None) is None:
 
737
        if getattr(self, "checker", None) is None:
494
738
            return
495
 
        logger.debug(u"Stopping checker for %(name)s", vars(self))
 
739
        logger.debug("Stopping checker for %(name)s", vars(self))
496
740
        try:
497
 
            os.kill(self.checker.pid, signal.SIGTERM)
 
741
            self.checker.terminate()
498
742
            #time.sleep(0.5)
499
743
            #if self.checker.poll() is None:
500
 
            #    os.kill(self.checker.pid, signal.SIGKILL)
501
 
        except OSError, error:
 
744
            #    self.checker.kill()
 
745
        except OSError as error:
502
746
            if error.errno != errno.ESRCH: # No such process
503
747
                raise
504
748
        self.checker = None
505
749
 
506
 
def dbus_service_property(dbus_interface, signature=u"v",
507
 
                          access=u"readwrite", byte_arrays=False):
 
750
 
 
751
def dbus_service_property(dbus_interface, signature="v",
 
752
                          access="readwrite", byte_arrays=False):
508
753
    """Decorators for marking methods of a DBusObjectWithProperties to
509
754
    become properties on the D-Bus.
510
755
    
517
762
    """
518
763
    # Encoding deeply encoded byte arrays is not supported yet by the
519
764
    # "Set" method, so we fail early here:
520
 
    if byte_arrays and signature != u"ay":
521
 
        raise ValueError(u"Byte arrays not supported for non-'ay'"
522
 
                         u" signature %r" % signature)
 
765
    if byte_arrays and signature != "ay":
 
766
        raise ValueError("Byte arrays not supported for non-'ay'"
 
767
                         " signature {0!r}".format(signature))
523
768
    def decorator(func):
524
769
        func._dbus_is_property = True
525
770
        func._dbus_interface = dbus_interface
526
771
        func._dbus_signature = signature
527
772
        func._dbus_access = access
528
773
        func._dbus_name = func.__name__
529
 
        if func._dbus_name.endswith(u"_dbus_property"):
 
774
        if func._dbus_name.endswith("_dbus_property"):
530
775
            func._dbus_name = func._dbus_name[:-14]
531
 
        func._dbus_get_args_options = {u'byte_arrays': byte_arrays }
 
776
        func._dbus_get_args_options = {'byte_arrays': byte_arrays }
 
777
        return func
 
778
    return decorator
 
779
 
 
780
 
 
781
def dbus_interface_annotations(dbus_interface):
 
782
    """Decorator for marking functions returning interface annotations
 
783
    
 
784
    Usage:
 
785
    
 
786
    @dbus_interface_annotations("org.example.Interface")
 
787
    def _foo(self):  # Function name does not matter
 
788
        return {"org.freedesktop.DBus.Deprecated": "true",
 
789
                "org.freedesktop.DBus.Property.EmitsChangedSignal":
 
790
                    "false"}
 
791
    """
 
792
    def decorator(func):
 
793
        func._dbus_is_interface = True
 
794
        func._dbus_interface = dbus_interface
 
795
        func._dbus_name = dbus_interface
 
796
        return func
 
797
    return decorator
 
798
 
 
799
 
 
800
def dbus_annotations(annotations):
 
801
    """Decorator to annotate D-Bus methods, signals or properties
 
802
    Usage:
 
803
    
 
804
    @dbus_service_property("org.example.Interface", signature="b",
 
805
                           access="r")
 
806
    @dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",
 
807
                        "org.freedesktop.DBus.Property."
 
808
                        "EmitsChangedSignal": "false"})
 
809
    def Property_dbus_property(self):
 
810
        return dbus.Boolean(False)
 
811
    """
 
812
    def decorator(func):
 
813
        func._dbus_annotations = annotations
532
814
        return func
533
815
    return decorator
534
816
 
554
836
 
555
837
class DBusObjectWithProperties(dbus.service.Object):
556
838
    """A D-Bus object with properties.
557
 
 
 
839
    
558
840
    Classes inheriting from this can use the dbus_service_property
559
841
    decorator to expose methods as D-Bus properties.  It exposes the
560
842
    standard Get(), Set(), and GetAll() methods on the D-Bus.
561
843
    """
562
844
    
563
845
    @staticmethod
564
 
    def _is_dbus_property(obj):
565
 
        return getattr(obj, u"_dbus_is_property", False)
 
846
    def _is_dbus_thing(thing):
 
847
        """Returns a function testing if an attribute is a D-Bus thing
 
848
        
 
849
        If called like _is_dbus_thing("method") it returns a function
 
850
        suitable for use as predicate to inspect.getmembers().
 
851
        """
 
852
        return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),
 
853
                                   False)
566
854
    
567
 
    def _get_all_dbus_properties(self):
 
855
    def _get_all_dbus_things(self, thing):
568
856
        """Returns a generator of (name, attribute) pairs
569
857
        """
570
 
        return ((prop._dbus_name, prop)
571
 
                for name, prop in
572
 
                inspect.getmembers(self, self._is_dbus_property))
 
858
        return ((getattr(athing.__get__(self), "_dbus_name",
 
859
                         name),
 
860
                 athing.__get__(self))
 
861
                for cls in self.__class__.__mro__
 
862
                for name, athing in
 
863
                inspect.getmembers(cls,
 
864
                                   self._is_dbus_thing(thing)))
573
865
    
574
866
    def _get_dbus_property(self, interface_name, property_name):
575
867
        """Returns a bound method if one exists which is a D-Bus
576
868
        property with the specified name and interface.
577
869
        """
578
 
        for name in (property_name,
579
 
                     property_name + u"_dbus_property"):
580
 
            prop = getattr(self, name, None)
581
 
            if (prop is None
582
 
                or not self._is_dbus_property(prop)
583
 
                or prop._dbus_name != property_name
584
 
                or (interface_name and prop._dbus_interface
585
 
                    and interface_name != prop._dbus_interface)):
586
 
                continue
587
 
            return prop
 
870
        for cls in  self.__class__.__mro__:
 
871
            for name, value in (inspect.getmembers
 
872
                                (cls,
 
873
                                 self._is_dbus_thing("property"))):
 
874
                if (value._dbus_name == property_name
 
875
                    and value._dbus_interface == interface_name):
 
876
                    return value.__get__(self)
 
877
        
588
878
        # No such property
589
 
        raise DBusPropertyNotFound(self.dbus_object_path + u":"
590
 
                                   + interface_name + u"."
 
879
        raise DBusPropertyNotFound(self.dbus_object_path + ":"
 
880
                                   + interface_name + "."
591
881
                                   + property_name)
592
882
    
593
 
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ss",
594
 
                         out_signature=u"v")
 
883
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
 
884
                         out_signature="v")
595
885
    def Get(self, interface_name, property_name):
596
886
        """Standard D-Bus property Get() method, see D-Bus standard.
597
887
        """
598
888
        prop = self._get_dbus_property(interface_name, property_name)
599
 
        if prop._dbus_access == u"write":
 
889
        if prop._dbus_access == "write":
600
890
            raise DBusPropertyAccessException(property_name)
601
891
        value = prop()
602
 
        if not hasattr(value, u"variant_level"):
 
892
        if not hasattr(value, "variant_level"):
603
893
            return value
604
894
        return type(value)(value, variant_level=value.variant_level+1)
605
895
    
606
 
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ssv")
 
896
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
607
897
    def Set(self, interface_name, property_name, value):
608
898
        """Standard D-Bus property Set() method, see D-Bus standard.
609
899
        """
610
900
        prop = self._get_dbus_property(interface_name, property_name)
611
 
        if prop._dbus_access == u"read":
 
901
        if prop._dbus_access == "read":
612
902
            raise DBusPropertyAccessException(property_name)
613
 
        if prop._dbus_get_args_options[u"byte_arrays"]:
 
903
        if prop._dbus_get_args_options["byte_arrays"]:
614
904
            # The byte_arrays option is not supported yet on
615
905
            # signatures other than "ay".
616
 
            if prop._dbus_signature != u"ay":
 
906
            if prop._dbus_signature != "ay":
617
907
                raise ValueError
618
 
            value = dbus.ByteArray(''.join(unichr(byte)
619
 
                                           for byte in value))
 
908
            value = dbus.ByteArray(b''.join(chr(byte)
 
909
                                            for byte in value))
620
910
        prop(value)
621
911
    
622
 
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"s",
623
 
                         out_signature=u"a{sv}")
 
912
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
 
913
                         out_signature="a{sv}")
624
914
    def GetAll(self, interface_name):
625
915
        """Standard D-Bus property GetAll() method, see D-Bus
626
916
        standard.
627
 
 
 
917
        
628
918
        Note: Will not include properties with access="write".
629
919
        """
630
 
        all = {}
631
 
        for name, prop in self._get_all_dbus_properties():
 
920
        properties = {}
 
921
        for name, prop in self._get_all_dbus_things("property"):
632
922
            if (interface_name
633
923
                and interface_name != prop._dbus_interface):
634
924
                # Interface non-empty but did not match
635
925
                continue
636
926
            # Ignore write-only properties
637
 
            if prop._dbus_access == u"write":
 
927
            if prop._dbus_access == "write":
638
928
                continue
639
929
            value = prop()
640
 
            if not hasattr(value, u"variant_level"):
641
 
                all[name] = value
 
930
            if not hasattr(value, "variant_level"):
 
931
                properties[name] = value
642
932
                continue
643
 
            all[name] = type(value)(value, variant_level=
644
 
                                    value.variant_level+1)
645
 
        return dbus.Dictionary(all, signature=u"sv")
 
933
            properties[name] = type(value)(value, variant_level=
 
934
                                           value.variant_level+1)
 
935
        return dbus.Dictionary(properties, signature="sv")
646
936
    
647
937
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
648
 
                         out_signature=u"s",
 
938
                         out_signature="s",
649
939
                         path_keyword='object_path',
650
940
                         connection_keyword='connection')
651
941
    def Introspect(self, object_path, connection):
652
 
        """Standard D-Bus method, overloaded to insert property tags.
 
942
        """Overloading of standard D-Bus method.
 
943
        
 
944
        Inserts property tags and interface annotation tags.
653
945
        """
654
946
        xmlstring = dbus.service.Object.Introspect(self, object_path,
655
947
                                                   connection)
656
948
        try:
657
949
            document = xml.dom.minidom.parseString(xmlstring)
658
950
            def make_tag(document, name, prop):
659
 
                e = document.createElement(u"property")
660
 
                e.setAttribute(u"name", name)
661
 
                e.setAttribute(u"type", prop._dbus_signature)
662
 
                e.setAttribute(u"access", prop._dbus_access)
 
951
                e = document.createElement("property")
 
952
                e.setAttribute("name", name)
 
953
                e.setAttribute("type", prop._dbus_signature)
 
954
                e.setAttribute("access", prop._dbus_access)
663
955
                return e
664
 
            for if_tag in document.getElementsByTagName(u"interface"):
 
956
            for if_tag in document.getElementsByTagName("interface"):
 
957
                # Add property tags
665
958
                for tag in (make_tag(document, name, prop)
666
959
                            for name, prop
667
 
                            in self._get_all_dbus_properties()
 
960
                            in self._get_all_dbus_things("property")
668
961
                            if prop._dbus_interface
669
 
                            == if_tag.getAttribute(u"name")):
 
962
                            == if_tag.getAttribute("name")):
670
963
                    if_tag.appendChild(tag)
 
964
                # Add annotation tags
 
965
                for typ in ("method", "signal", "property"):
 
966
                    for tag in if_tag.getElementsByTagName(typ):
 
967
                        annots = dict()
 
968
                        for name, prop in (self.
 
969
                                           _get_all_dbus_things(typ)):
 
970
                            if (name == tag.getAttribute("name")
 
971
                                and prop._dbus_interface
 
972
                                == if_tag.getAttribute("name")):
 
973
                                annots.update(getattr
 
974
                                              (prop,
 
975
                                               "_dbus_annotations",
 
976
                                               {}))
 
977
                        for name, value in annots.iteritems():
 
978
                            ann_tag = document.createElement(
 
979
                                "annotation")
 
980
                            ann_tag.setAttribute("name", name)
 
981
                            ann_tag.setAttribute("value", value)
 
982
                            tag.appendChild(ann_tag)
 
983
                # Add interface annotation tags
 
984
                for annotation, value in dict(
 
985
                    itertools.chain.from_iterable(
 
986
                        annotations().iteritems()
 
987
                        for name, annotations in
 
988
                        self._get_all_dbus_things("interface")
 
989
                        if name == if_tag.getAttribute("name")
 
990
                        )).iteritems():
 
991
                    ann_tag = document.createElement("annotation")
 
992
                    ann_tag.setAttribute("name", annotation)
 
993
                    ann_tag.setAttribute("value", value)
 
994
                    if_tag.appendChild(ann_tag)
671
995
                # Add the names to the return values for the
672
996
                # "org.freedesktop.DBus.Properties" methods
673
 
                if (if_tag.getAttribute(u"name")
674
 
                    == u"org.freedesktop.DBus.Properties"):
675
 
                    for cn in if_tag.getElementsByTagName(u"method"):
676
 
                        if cn.getAttribute(u"name") == u"Get":
677
 
                            for arg in cn.getElementsByTagName(u"arg"):
678
 
                                if (arg.getAttribute(u"direction")
679
 
                                    == u"out"):
680
 
                                    arg.setAttribute(u"name", u"value")
681
 
                        elif cn.getAttribute(u"name") == u"GetAll":
682
 
                            for arg in cn.getElementsByTagName(u"arg"):
683
 
                                if (arg.getAttribute(u"direction")
684
 
                                    == u"out"):
685
 
                                    arg.setAttribute(u"name", u"props")
686
 
            xmlstring = document.toxml(u"utf-8")
 
997
                if (if_tag.getAttribute("name")
 
998
                    == "org.freedesktop.DBus.Properties"):
 
999
                    for cn in if_tag.getElementsByTagName("method"):
 
1000
                        if cn.getAttribute("name") == "Get":
 
1001
                            for arg in cn.getElementsByTagName("arg"):
 
1002
                                if (arg.getAttribute("direction")
 
1003
                                    == "out"):
 
1004
                                    arg.setAttribute("name", "value")
 
1005
                        elif cn.getAttribute("name") == "GetAll":
 
1006
                            for arg in cn.getElementsByTagName("arg"):
 
1007
                                if (arg.getAttribute("direction")
 
1008
                                    == "out"):
 
1009
                                    arg.setAttribute("name", "props")
 
1010
            xmlstring = document.toxml("utf-8")
687
1011
            document.unlink()
688
1012
        except (AttributeError, xml.dom.DOMException,
689
 
                xml.parsers.expat.ExpatError), error:
690
 
            logger.error(u"Failed to override Introspection method",
691
 
                         error)
 
1013
                xml.parsers.expat.ExpatError) as error:
 
1014
            logger.error("Failed to override Introspection method",
 
1015
                         exc_info=error)
692
1016
        return xmlstring
693
1017
 
694
1018
 
 
1019
def datetime_to_dbus(dt, variant_level=0):
 
1020
    """Convert a UTC datetime.datetime() to a D-Bus type."""
 
1021
    if dt is None:
 
1022
        return dbus.String("", variant_level = variant_level)
 
1023
    return dbus.String(dt.isoformat(),
 
1024
                       variant_level=variant_level)
 
1025
 
 
1026
 
 
1027
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
 
1028
    """A class decorator; applied to a subclass of
 
1029
    dbus.service.Object, it will add alternate D-Bus attributes with
 
1030
    interface names according to the "alt_interface_names" mapping.
 
1031
    Usage:
 
1032
    
 
1033
    @alternate_dbus_interfaces({"org.example.Interface":
 
1034
                                    "net.example.AlternateInterface"})
 
1035
    class SampleDBusObject(dbus.service.Object):
 
1036
        @dbus.service.method("org.example.Interface")
 
1037
        def SampleDBusMethod():
 
1038
            pass
 
1039
    
 
1040
    The above "SampleDBusMethod" on "SampleDBusObject" will be
 
1041
    reachable via two interfaces: "org.example.Interface" and
 
1042
    "net.example.AlternateInterface", the latter of which will have
 
1043
    its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
 
1044
    "true", unless "deprecate" is passed with a False value.
 
1045
    
 
1046
    This works for methods and signals, and also for D-Bus properties
 
1047
    (from DBusObjectWithProperties) and interfaces (from the
 
1048
    dbus_interface_annotations decorator).
 
1049
    """
 
1050
    def wrapper(cls):
 
1051
        for orig_interface_name, alt_interface_name in (
 
1052
            alt_interface_names.iteritems()):
 
1053
            attr = {}
 
1054
            interface_names = set()
 
1055
            # Go though all attributes of the class
 
1056
            for attrname, attribute in inspect.getmembers(cls):
 
1057
                # Ignore non-D-Bus attributes, and D-Bus attributes
 
1058
                # with the wrong interface name
 
1059
                if (not hasattr(attribute, "_dbus_interface")
 
1060
                    or not attribute._dbus_interface
 
1061
                    .startswith(orig_interface_name)):
 
1062
                    continue
 
1063
                # Create an alternate D-Bus interface name based on
 
1064
                # the current name
 
1065
                alt_interface = (attribute._dbus_interface
 
1066
                                 .replace(orig_interface_name,
 
1067
                                          alt_interface_name))
 
1068
                interface_names.add(alt_interface)
 
1069
                # Is this a D-Bus signal?
 
1070
                if getattr(attribute, "_dbus_is_signal", False):
 
1071
                    # Extract the original non-method function by
 
1072
                    # black magic
 
1073
                    nonmethod_func = (dict(
 
1074
                            zip(attribute.func_code.co_freevars,
 
1075
                                attribute.__closure__))["func"]
 
1076
                                      .cell_contents)
 
1077
                    # Create a new, but exactly alike, function
 
1078
                    # object, and decorate it to be a new D-Bus signal
 
1079
                    # with the alternate D-Bus interface name
 
1080
                    new_function = (dbus.service.signal
 
1081
                                    (alt_interface,
 
1082
                                     attribute._dbus_signature)
 
1083
                                    (types.FunctionType(
 
1084
                                nonmethod_func.func_code,
 
1085
                                nonmethod_func.func_globals,
 
1086
                                nonmethod_func.func_name,
 
1087
                                nonmethod_func.func_defaults,
 
1088
                                nonmethod_func.func_closure)))
 
1089
                    # Copy annotations, if any
 
1090
                    try:
 
1091
                        new_function._dbus_annotations = (
 
1092
                            dict(attribute._dbus_annotations))
 
1093
                    except AttributeError:
 
1094
                        pass
 
1095
                    # Define a creator of a function to call both the
 
1096
                    # original and alternate functions, so both the
 
1097
                    # original and alternate signals gets sent when
 
1098
                    # the function is called
 
1099
                    def fixscope(func1, func2):
 
1100
                        """This function is a scope container to pass
 
1101
                        func1 and func2 to the "call_both" function
 
1102
                        outside of its arguments"""
 
1103
                        def call_both(*args, **kwargs):
 
1104
                            """This function will emit two D-Bus
 
1105
                            signals by calling func1 and func2"""
 
1106
                            func1(*args, **kwargs)
 
1107
                            func2(*args, **kwargs)
 
1108
                        return call_both
 
1109
                    # Create the "call_both" function and add it to
 
1110
                    # the class
 
1111
                    attr[attrname] = fixscope(attribute, new_function)
 
1112
                # Is this a D-Bus method?
 
1113
                elif getattr(attribute, "_dbus_is_method", False):
 
1114
                    # Create a new, but exactly alike, function
 
1115
                    # object.  Decorate it to be a new D-Bus method
 
1116
                    # with the alternate D-Bus interface name.  Add it
 
1117
                    # to the class.
 
1118
                    attr[attrname] = (dbus.service.method
 
1119
                                      (alt_interface,
 
1120
                                       attribute._dbus_in_signature,
 
1121
                                       attribute._dbus_out_signature)
 
1122
                                      (types.FunctionType
 
1123
                                       (attribute.func_code,
 
1124
                                        attribute.func_globals,
 
1125
                                        attribute.func_name,
 
1126
                                        attribute.func_defaults,
 
1127
                                        attribute.func_closure)))
 
1128
                    # Copy annotations, if any
 
1129
                    try:
 
1130
                        attr[attrname]._dbus_annotations = (
 
1131
                            dict(attribute._dbus_annotations))
 
1132
                    except AttributeError:
 
1133
                        pass
 
1134
                # Is this a D-Bus property?
 
1135
                elif getattr(attribute, "_dbus_is_property", False):
 
1136
                    # Create a new, but exactly alike, function
 
1137
                    # object, and decorate it to be a new D-Bus
 
1138
                    # property with the alternate D-Bus interface
 
1139
                    # name.  Add it to the class.
 
1140
                    attr[attrname] = (dbus_service_property
 
1141
                                      (alt_interface,
 
1142
                                       attribute._dbus_signature,
 
1143
                                       attribute._dbus_access,
 
1144
                                       attribute
 
1145
                                       ._dbus_get_args_options
 
1146
                                       ["byte_arrays"])
 
1147
                                      (types.FunctionType
 
1148
                                       (attribute.func_code,
 
1149
                                        attribute.func_globals,
 
1150
                                        attribute.func_name,
 
1151
                                        attribute.func_defaults,
 
1152
                                        attribute.func_closure)))
 
1153
                    # Copy annotations, if any
 
1154
                    try:
 
1155
                        attr[attrname]._dbus_annotations = (
 
1156
                            dict(attribute._dbus_annotations))
 
1157
                    except AttributeError:
 
1158
                        pass
 
1159
                # Is this a D-Bus interface?
 
1160
                elif getattr(attribute, "_dbus_is_interface", False):
 
1161
                    # Create a new, but exactly alike, function
 
1162
                    # object.  Decorate it to be a new D-Bus interface
 
1163
                    # with the alternate D-Bus interface name.  Add it
 
1164
                    # to the class.
 
1165
                    attr[attrname] = (dbus_interface_annotations
 
1166
                                      (alt_interface)
 
1167
                                      (types.FunctionType
 
1168
                                       (attribute.func_code,
 
1169
                                        attribute.func_globals,
 
1170
                                        attribute.func_name,
 
1171
                                        attribute.func_defaults,
 
1172
                                        attribute.func_closure)))
 
1173
            if deprecate:
 
1174
                # Deprecate all alternate interfaces
 
1175
                iname="_AlternateDBusNames_interface_annotation{0}"
 
1176
                for interface_name in interface_names:
 
1177
                    @dbus_interface_annotations(interface_name)
 
1178
                    def func(self):
 
1179
                        return { "org.freedesktop.DBus.Deprecated":
 
1180
                                     "true" }
 
1181
                    # Find an unused name
 
1182
                    for aname in (iname.format(i)
 
1183
                                  for i in itertools.count()):
 
1184
                        if aname not in attr:
 
1185
                            attr[aname] = func
 
1186
                            break
 
1187
            if interface_names:
 
1188
                # Replace the class with a new subclass of it with
 
1189
                # methods, signals, etc. as created above.
 
1190
                cls = type(b"{0}Alternate".format(cls.__name__),
 
1191
                           (cls,), attr)
 
1192
        return cls
 
1193
    return wrapper
 
1194
 
 
1195
 
 
1196
@alternate_dbus_interfaces({"se.recompile.Mandos":
 
1197
                                "se.bsnet.fukt.Mandos"})
695
1198
class ClientDBus(Client, DBusObjectWithProperties):
696
1199
    """A Client class using D-Bus
697
1200
    
699
1202
    dbus_object_path: dbus.ObjectPath
700
1203
    bus: dbus.SystemBus()
701
1204
    """
 
1205
    
 
1206
    runtime_expansions = (Client.runtime_expansions
 
1207
                          + ("dbus_object_path",))
 
1208
    
702
1209
    # dbus.service.Object doesn't use super(), so we can't either.
703
1210
    
704
1211
    def __init__(self, bus = None, *args, **kwargs):
706
1213
        Client.__init__(self, *args, **kwargs)
707
1214
        # Only now, when this client is initialized, can it show up on
708
1215
        # the D-Bus
 
1216
        client_object_name = unicode(self.name).translate(
 
1217
            {ord("."): ord("_"),
 
1218
             ord("-"): ord("_")})
709
1219
        self.dbus_object_path = (dbus.ObjectPath
710
 
                                 (u"/clients/"
711
 
                                  + self.name.replace(u".", u"_")))
 
1220
                                 ("/clients/" + client_object_name))
712
1221
        DBusObjectWithProperties.__init__(self, self.bus,
713
1222
                                          self.dbus_object_path)
714
1223
    
715
 
    @staticmethod
716
 
    def _datetime_to_dbus(dt, variant_level=0):
717
 
        """Convert a UTC datetime.datetime() to a D-Bus type."""
718
 
        return dbus.String(dt.isoformat(),
719
 
                           variant_level=variant_level)
720
 
    
721
 
    def enable(self):
722
 
        oldstate = getattr(self, u"enabled", False)
723
 
        r = Client.enable(self)
724
 
        if oldstate != self.enabled:
725
 
            # Emit D-Bus signals
726
 
            self.PropertyChanged(dbus.String(u"enabled"),
727
 
                                 dbus.Boolean(True, variant_level=1))
728
 
            self.PropertyChanged(
729
 
                dbus.String(u"last_enabled"),
730
 
                self._datetime_to_dbus(self.last_enabled,
731
 
                                       variant_level=1))
732
 
        return r
733
 
    
734
 
    def disable(self, quiet = False):
735
 
        oldstate = getattr(self, u"enabled", False)
736
 
        r = Client.disable(self, quiet=quiet)
737
 
        if not quiet and oldstate != self.enabled:
738
 
            # Emit D-Bus signal
739
 
            self.PropertyChanged(dbus.String(u"enabled"),
740
 
                                 dbus.Boolean(False, variant_level=1))
741
 
        return r
 
1224
    def notifychangeproperty(transform_func,
 
1225
                             dbus_name, type_func=lambda x: x,
 
1226
                             variant_level=1):
 
1227
        """ Modify a variable so that it's a property which announces
 
1228
        its changes to DBus.
 
1229
        
 
1230
        transform_fun: Function that takes a value and a variant_level
 
1231
                       and transforms it to a D-Bus type.
 
1232
        dbus_name: D-Bus name of the variable
 
1233
        type_func: Function that transform the value before sending it
 
1234
                   to the D-Bus.  Default: no transform
 
1235
        variant_level: D-Bus variant level.  Default: 1
 
1236
        """
 
1237
        attrname = "_{0}".format(dbus_name)
 
1238
        def setter(self, value):
 
1239
            if hasattr(self, "dbus_object_path"):
 
1240
                if (not hasattr(self, attrname) or
 
1241
                    type_func(getattr(self, attrname, None))
 
1242
                    != type_func(value)):
 
1243
                    dbus_value = transform_func(type_func(value),
 
1244
                                                variant_level
 
1245
                                                =variant_level)
 
1246
                    self.PropertyChanged(dbus.String(dbus_name),
 
1247
                                         dbus_value)
 
1248
            setattr(self, attrname, value)
 
1249
        
 
1250
        return property(lambda self: getattr(self, attrname), setter)
 
1251
    
 
1252
    expires = notifychangeproperty(datetime_to_dbus, "Expires")
 
1253
    approvals_pending = notifychangeproperty(dbus.Boolean,
 
1254
                                             "ApprovalPending",
 
1255
                                             type_func = bool)
 
1256
    enabled = notifychangeproperty(dbus.Boolean, "Enabled")
 
1257
    last_enabled = notifychangeproperty(datetime_to_dbus,
 
1258
                                        "LastEnabled")
 
1259
    checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",
 
1260
                                   type_func = lambda checker:
 
1261
                                       checker is not None)
 
1262
    last_checked_ok = notifychangeproperty(datetime_to_dbus,
 
1263
                                           "LastCheckedOK")
 
1264
    last_checker_status = notifychangeproperty(dbus.Int16,
 
1265
                                               "LastCheckerStatus")
 
1266
    last_approval_request = notifychangeproperty(
 
1267
        datetime_to_dbus, "LastApprovalRequest")
 
1268
    approved_by_default = notifychangeproperty(dbus.Boolean,
 
1269
                                               "ApprovedByDefault")
 
1270
    approval_delay = notifychangeproperty(dbus.UInt64,
 
1271
                                          "ApprovalDelay",
 
1272
                                          type_func =
 
1273
                                          timedelta_to_milliseconds)
 
1274
    approval_duration = notifychangeproperty(
 
1275
        dbus.UInt64, "ApprovalDuration",
 
1276
        type_func = timedelta_to_milliseconds)
 
1277
    host = notifychangeproperty(dbus.String, "Host")
 
1278
    timeout = notifychangeproperty(dbus.UInt64, "Timeout",
 
1279
                                   type_func =
 
1280
                                   timedelta_to_milliseconds)
 
1281
    extended_timeout = notifychangeproperty(
 
1282
        dbus.UInt64, "ExtendedTimeout",
 
1283
        type_func = timedelta_to_milliseconds)
 
1284
    interval = notifychangeproperty(dbus.UInt64,
 
1285
                                    "Interval",
 
1286
                                    type_func =
 
1287
                                    timedelta_to_milliseconds)
 
1288
    checker_command = notifychangeproperty(dbus.String, "Checker")
 
1289
    
 
1290
    del notifychangeproperty
742
1291
    
743
1292
    def __del__(self, *args, **kwargs):
744
1293
        try:
745
1294
            self.remove_from_connection()
746
1295
        except LookupError:
747
1296
            pass
748
 
        if hasattr(DBusObjectWithProperties, u"__del__"):
 
1297
        if hasattr(DBusObjectWithProperties, "__del__"):
749
1298
            DBusObjectWithProperties.__del__(self, *args, **kwargs)
750
1299
        Client.__del__(self, *args, **kwargs)
751
1300
    
753
1302
                         *args, **kwargs):
754
1303
        self.checker_callback_tag = None
755
1304
        self.checker = None
756
 
        # Emit D-Bus signal
757
 
        self.PropertyChanged(dbus.String(u"checker_running"),
758
 
                             dbus.Boolean(False, variant_level=1))
759
1305
        if os.WIFEXITED(condition):
760
1306
            exitstatus = os.WEXITSTATUS(condition)
761
1307
            # Emit D-Bus signal
771
1317
        return Client.checker_callback(self, pid, condition, command,
772
1318
                                       *args, **kwargs)
773
1319
    
774
 
    def checked_ok(self, *args, **kwargs):
775
 
        r = Client.checked_ok(self, *args, **kwargs)
776
 
        # Emit D-Bus signal
777
 
        self.PropertyChanged(
778
 
            dbus.String(u"last_checked_ok"),
779
 
            (self._datetime_to_dbus(self.last_checked_ok,
780
 
                                    variant_level=1)))
781
 
        return r
782
 
    
783
1320
    def start_checker(self, *args, **kwargs):
784
1321
        old_checker = self.checker
785
1322
        if self.checker is not None:
792
1329
            and old_checker_pid != self.checker.pid):
793
1330
            # Emit D-Bus signal
794
1331
            self.CheckerStarted(self.current_checker_command)
795
 
            self.PropertyChanged(
796
 
                dbus.String(u"checker_running"),
797
 
                dbus.Boolean(True, variant_level=1))
798
1332
        return r
799
1333
    
800
 
    def stop_checker(self, *args, **kwargs):
801
 
        old_checker = getattr(self, u"checker", None)
802
 
        r = Client.stop_checker(self, *args, **kwargs)
803
 
        if (old_checker is not None
804
 
            and getattr(self, u"checker", None) is None):
805
 
            self.PropertyChanged(dbus.String(u"checker_running"),
806
 
                                 dbus.Boolean(False, variant_level=1))
807
 
        return r
808
 
 
809
1334
    def _reset_approved(self):
810
 
        self._approved = None
 
1335
        self.approved = None
811
1336
        return False
812
1337
    
813
1338
    def approve(self, value=True):
814
 
        self._approved = value
815
 
        gobject.timeout_add(self._timedelta_to_milliseconds(self.approved_duration, self._reset_approved))
816
 
 
817
 
    def approved_pending(self):
818
 
        return self.approvals_pending > 0
819
 
 
 
1339
        self.approved = value
 
1340
        gobject.timeout_add(timedelta_to_milliseconds
 
1341
                            (self.approval_duration),
 
1342
                            self._reset_approved)
 
1343
        self.send_changedstate()
820
1344
    
821
1345
    ## D-Bus methods, signals & properties
822
 
    _interface = u"se.bsnet.fukt.Mandos.Client"
 
1346
    _interface = "se.recompile.Mandos.Client"
 
1347
    
 
1348
    ## Interfaces
 
1349
    
 
1350
    @dbus_interface_annotations(_interface)
 
1351
    def _foo(self):
 
1352
        return { "org.freedesktop.DBus.Property.EmitsChangedSignal":
 
1353
                     "false"}
823
1354
    
824
1355
    ## Signals
825
1356
    
826
1357
    # CheckerCompleted - signal
827
 
    @dbus.service.signal(_interface, signature=u"nxs")
 
1358
    @dbus.service.signal(_interface, signature="nxs")
828
1359
    def CheckerCompleted(self, exitcode, waitstatus, command):
829
1360
        "D-Bus signal"
830
1361
        pass
831
1362
    
832
1363
    # CheckerStarted - signal
833
 
    @dbus.service.signal(_interface, signature=u"s")
 
1364
    @dbus.service.signal(_interface, signature="s")
834
1365
    def CheckerStarted(self, command):
835
1366
        "D-Bus signal"
836
1367
        pass
837
1368
    
838
1369
    # PropertyChanged - signal
839
 
    @dbus.service.signal(_interface, signature=u"sv")
 
1370
    @dbus.service.signal(_interface, signature="sv")
840
1371
    def PropertyChanged(self, property, value):
841
1372
        "D-Bus signal"
842
1373
        pass
844
1375
    # GotSecret - signal
845
1376
    @dbus.service.signal(_interface)
846
1377
    def GotSecret(self):
847
 
        "D-Bus signal"
 
1378
        """D-Bus signal
 
1379
        Is sent after a successful transfer of secret from the Mandos
 
1380
        server to mandos-client
 
1381
        """
848
1382
        pass
849
1383
    
850
1384
    # Rejected - signal
851
 
    @dbus.service.signal(_interface, signature=u"s")
 
1385
    @dbus.service.signal(_interface, signature="s")
852
1386
    def Rejected(self, reason):
853
1387
        "D-Bus signal"
854
1388
        pass
855
1389
    
856
1390
    # NeedApproval - signal
857
 
    @dbus.service.signal(_interface, signature=u"db")
 
1391
    @dbus.service.signal(_interface, signature="tb")
858
1392
    def NeedApproval(self, timeout, default):
859
1393
        "D-Bus signal"
860
 
        pass
 
1394
        return self.need_approval()
861
1395
    
862
1396
    ## Methods
863
 
 
 
1397
    
864
1398
    # Approve - method
865
 
    @dbus.service.method(_interface, in_signature=u"b")
 
1399
    @dbus.service.method(_interface, in_signature="b")
866
1400
    def Approve(self, value):
867
1401
        self.approve(value)
868
 
 
 
1402
    
869
1403
    # CheckedOK - method
870
1404
    @dbus.service.method(_interface)
871
1405
    def CheckedOK(self):
872
 
        return self.checked_ok()
 
1406
        self.checked_ok()
873
1407
    
874
1408
    # Enable - method
875
1409
    @dbus.service.method(_interface)
896
1430
    
897
1431
    ## Properties
898
1432
    
899
 
    # approved_pending - property
900
 
    @dbus_service_property(_interface, signature=u"b", access=u"read")
901
 
    def approved_pending_dbus_property(self):
902
 
        return dbus.Boolean(self.approved_pending())
903
 
    
904
 
    # approved_by_default - property
905
 
    @dbus_service_property(_interface, signature=u"b",
906
 
                           access=u"readwrite")
907
 
    def approved_by_default_dbus_property(self):
908
 
        return dbus.Boolean(self.approved_by_default)
909
 
    
910
 
    # approved_delay - property
911
 
    @dbus_service_property(_interface, signature=u"t",
912
 
                           access=u"readwrite")
913
 
    def approved_delay_dbus_property(self):
914
 
        return dbus.UInt64(self.approved_delay_milliseconds())
915
 
    
916
 
    # approved_duration - property
917
 
    @dbus_service_property(_interface, signature=u"t",
918
 
                           access=u"readwrite")
919
 
    def approved_duration_dbus_property(self):
920
 
        return dbus.UInt64(self._timedelta_to_milliseconds(
921
 
                self.approved_duration))
922
 
    
923
 
    # name - property
924
 
    @dbus_service_property(_interface, signature=u"s", access=u"read")
925
 
    def name_dbus_property(self):
 
1433
    # ApprovalPending - property
 
1434
    @dbus_service_property(_interface, signature="b", access="read")
 
1435
    def ApprovalPending_dbus_property(self):
 
1436
        return dbus.Boolean(bool(self.approvals_pending))
 
1437
    
 
1438
    # ApprovedByDefault - property
 
1439
    @dbus_service_property(_interface, signature="b",
 
1440
                           access="readwrite")
 
1441
    def ApprovedByDefault_dbus_property(self, value=None):
 
1442
        if value is None:       # get
 
1443
            return dbus.Boolean(self.approved_by_default)
 
1444
        self.approved_by_default = bool(value)
 
1445
    
 
1446
    # ApprovalDelay - property
 
1447
    @dbus_service_property(_interface, signature="t",
 
1448
                           access="readwrite")
 
1449
    def ApprovalDelay_dbus_property(self, value=None):
 
1450
        if value is None:       # get
 
1451
            return dbus.UInt64(self.approval_delay_milliseconds())
 
1452
        self.approval_delay = datetime.timedelta(0, 0, 0, value)
 
1453
    
 
1454
    # ApprovalDuration - property
 
1455
    @dbus_service_property(_interface, signature="t",
 
1456
                           access="readwrite")
 
1457
    def ApprovalDuration_dbus_property(self, value=None):
 
1458
        if value is None:       # get
 
1459
            return dbus.UInt64(timedelta_to_milliseconds(
 
1460
                    self.approval_duration))
 
1461
        self.approval_duration = datetime.timedelta(0, 0, 0, value)
 
1462
    
 
1463
    # Name - property
 
1464
    @dbus_service_property(_interface, signature="s", access="read")
 
1465
    def Name_dbus_property(self):
926
1466
        return dbus.String(self.name)
927
1467
    
928
 
    # fingerprint - property
929
 
    @dbus_service_property(_interface, signature=u"s", access=u"read")
930
 
    def fingerprint_dbus_property(self):
 
1468
    # Fingerprint - property
 
1469
    @dbus_service_property(_interface, signature="s", access="read")
 
1470
    def Fingerprint_dbus_property(self):
931
1471
        return dbus.String(self.fingerprint)
932
1472
    
933
 
    # host - property
934
 
    @dbus_service_property(_interface, signature=u"s",
935
 
                           access=u"readwrite")
936
 
    def host_dbus_property(self, value=None):
 
1473
    # Host - property
 
1474
    @dbus_service_property(_interface, signature="s",
 
1475
                           access="readwrite")
 
1476
    def Host_dbus_property(self, value=None):
937
1477
        if value is None:       # get
938
1478
            return dbus.String(self.host)
939
 
        self.host = value
940
 
        # Emit D-Bus signal
941
 
        self.PropertyChanged(dbus.String(u"host"),
942
 
                             dbus.String(value, variant_level=1))
943
 
    
944
 
    # created - property
945
 
    @dbus_service_property(_interface, signature=u"s", access=u"read")
946
 
    def created_dbus_property(self):
947
 
        return dbus.String(self._datetime_to_dbus(self.created))
948
 
    
949
 
    # last_enabled - property
950
 
    @dbus_service_property(_interface, signature=u"s", access=u"read")
951
 
    def last_enabled_dbus_property(self):
952
 
        if self.last_enabled is None:
953
 
            return dbus.String(u"")
954
 
        return dbus.String(self._datetime_to_dbus(self.last_enabled))
955
 
    
956
 
    # enabled - property
957
 
    @dbus_service_property(_interface, signature=u"b",
958
 
                           access=u"readwrite")
959
 
    def enabled_dbus_property(self, value=None):
 
1479
        self.host = unicode(value)
 
1480
    
 
1481
    # Created - property
 
1482
    @dbus_service_property(_interface, signature="s", access="read")
 
1483
    def Created_dbus_property(self):
 
1484
        return datetime_to_dbus(self.created)
 
1485
    
 
1486
    # LastEnabled - property
 
1487
    @dbus_service_property(_interface, signature="s", access="read")
 
1488
    def LastEnabled_dbus_property(self):
 
1489
        return datetime_to_dbus(self.last_enabled)
 
1490
    
 
1491
    # Enabled - property
 
1492
    @dbus_service_property(_interface, signature="b",
 
1493
                           access="readwrite")
 
1494
    def Enabled_dbus_property(self, value=None):
960
1495
        if value is None:       # get
961
1496
            return dbus.Boolean(self.enabled)
962
1497
        if value:
964
1499
        else:
965
1500
            self.disable()
966
1501
    
967
 
    # last_checked_ok - property
968
 
    @dbus_service_property(_interface, signature=u"s",
969
 
                           access=u"readwrite")
970
 
    def last_checked_ok_dbus_property(self, value=None):
 
1502
    # LastCheckedOK - property
 
1503
    @dbus_service_property(_interface, signature="s",
 
1504
                           access="readwrite")
 
1505
    def LastCheckedOK_dbus_property(self, value=None):
971
1506
        if value is not None:
972
1507
            self.checked_ok()
973
1508
            return
974
 
        if self.last_checked_ok is None:
975
 
            return dbus.String(u"")
976
 
        return dbus.String(self._datetime_to_dbus(self
977
 
                                                  .last_checked_ok))
978
 
    
979
 
    # timeout - property
980
 
    @dbus_service_property(_interface, signature=u"t",
981
 
                           access=u"readwrite")
982
 
    def timeout_dbus_property(self, value=None):
 
1509
        return datetime_to_dbus(self.last_checked_ok)
 
1510
    
 
1511
    # LastCheckerStatus - property
 
1512
    @dbus_service_property(_interface, signature="n",
 
1513
                           access="read")
 
1514
    def LastCheckerStatus_dbus_property(self):
 
1515
        return dbus.Int16(self.last_checker_status)
 
1516
    
 
1517
    # Expires - property
 
1518
    @dbus_service_property(_interface, signature="s", access="read")
 
1519
    def Expires_dbus_property(self):
 
1520
        return datetime_to_dbus(self.expires)
 
1521
    
 
1522
    # LastApprovalRequest - property
 
1523
    @dbus_service_property(_interface, signature="s", access="read")
 
1524
    def LastApprovalRequest_dbus_property(self):
 
1525
        return datetime_to_dbus(self.last_approval_request)
 
1526
    
 
1527
    # Timeout - property
 
1528
    @dbus_service_property(_interface, signature="t",
 
1529
                           access="readwrite")
 
1530
    def Timeout_dbus_property(self, value=None):
983
1531
        if value is None:       # get
984
1532
            return dbus.UInt64(self.timeout_milliseconds())
 
1533
        old_timeout = self.timeout
985
1534
        self.timeout = datetime.timedelta(0, 0, 0, value)
986
 
        # Emit D-Bus signal
987
 
        self.PropertyChanged(dbus.String(u"timeout"),
988
 
                             dbus.UInt64(value, variant_level=1))
989
 
        if getattr(self, u"disable_initiator_tag", None) is None:
990
 
            return
991
 
        # Reschedule timeout
992
 
        gobject.source_remove(self.disable_initiator_tag)
993
 
        self.disable_initiator_tag = None
994
 
        time_to_die = (self.
995
 
                       _timedelta_to_milliseconds((self
996
 
                                                   .last_checked_ok
997
 
                                                   + self.timeout)
998
 
                                                  - datetime.datetime
999
 
                                                  .utcnow()))
1000
 
        if time_to_die <= 0:
1001
 
            # The timeout has passed
1002
 
            self.disable()
1003
 
        else:
1004
 
            self.disable_initiator_tag = (gobject.timeout_add
1005
 
                                          (time_to_die, self.disable))
1006
 
    
1007
 
    # interval - property
1008
 
    @dbus_service_property(_interface, signature=u"t",
1009
 
                           access=u"readwrite")
1010
 
    def interval_dbus_property(self, value=None):
 
1535
        # Reschedule disabling
 
1536
        if self.enabled:
 
1537
            now = datetime.datetime.utcnow()
 
1538
            self.expires += self.timeout - old_timeout
 
1539
            if self.expires <= now:
 
1540
                # The timeout has passed
 
1541
                self.disable()
 
1542
            else:
 
1543
                if (getattr(self, "disable_initiator_tag", None)
 
1544
                    is None):
 
1545
                    return
 
1546
                gobject.source_remove(self.disable_initiator_tag)
 
1547
                self.disable_initiator_tag = (
 
1548
                    gobject.timeout_add(
 
1549
                        timedelta_to_milliseconds(self.expires - now),
 
1550
                        self.disable))
 
1551
    
 
1552
    # ExtendedTimeout - property
 
1553
    @dbus_service_property(_interface, signature="t",
 
1554
                           access="readwrite")
 
1555
    def ExtendedTimeout_dbus_property(self, value=None):
 
1556
        if value is None:       # get
 
1557
            return dbus.UInt64(self.extended_timeout_milliseconds())
 
1558
        self.extended_timeout = datetime.timedelta(0, 0, 0, value)
 
1559
    
 
1560
    # Interval - property
 
1561
    @dbus_service_property(_interface, signature="t",
 
1562
                           access="readwrite")
 
1563
    def Interval_dbus_property(self, value=None):
1011
1564
        if value is None:       # get
1012
1565
            return dbus.UInt64(self.interval_milliseconds())
1013
1566
        self.interval = datetime.timedelta(0, 0, 0, value)
1014
 
        # Emit D-Bus signal
1015
 
        self.PropertyChanged(dbus.String(u"interval"),
1016
 
                             dbus.UInt64(value, variant_level=1))
1017
 
        if getattr(self, u"checker_initiator_tag", None) is None:
 
1567
        if getattr(self, "checker_initiator_tag", None) is None:
1018
1568
            return
1019
 
        # Reschedule checker run
1020
 
        gobject.source_remove(self.checker_initiator_tag)
1021
 
        self.checker_initiator_tag = (gobject.timeout_add
1022
 
                                      (value, self.start_checker))
1023
 
        self.start_checker()    # Start one now, too
1024
 
 
1025
 
    # checker - property
1026
 
    @dbus_service_property(_interface, signature=u"s",
1027
 
                           access=u"readwrite")
1028
 
    def checker_dbus_property(self, value=None):
 
1569
        if self.enabled:
 
1570
            # Reschedule checker run
 
1571
            gobject.source_remove(self.checker_initiator_tag)
 
1572
            self.checker_initiator_tag = (gobject.timeout_add
 
1573
                                          (value, self.start_checker))
 
1574
            self.start_checker()    # Start one now, too
 
1575
    
 
1576
    # Checker - property
 
1577
    @dbus_service_property(_interface, signature="s",
 
1578
                           access="readwrite")
 
1579
    def Checker_dbus_property(self, value=None):
1029
1580
        if value is None:       # get
1030
1581
            return dbus.String(self.checker_command)
1031
 
        self.checker_command = value
1032
 
        # Emit D-Bus signal
1033
 
        self.PropertyChanged(dbus.String(u"checker"),
1034
 
                             dbus.String(self.checker_command,
1035
 
                                         variant_level=1))
 
1582
        self.checker_command = unicode(value)
1036
1583
    
1037
 
    # checker_running - property
1038
 
    @dbus_service_property(_interface, signature=u"b",
1039
 
                           access=u"readwrite")
1040
 
    def checker_running_dbus_property(self, value=None):
 
1584
    # CheckerRunning - property
 
1585
    @dbus_service_property(_interface, signature="b",
 
1586
                           access="readwrite")
 
1587
    def CheckerRunning_dbus_property(self, value=None):
1041
1588
        if value is None:       # get
1042
1589
            return dbus.Boolean(self.checker is not None)
1043
1590
        if value:
1045
1592
        else:
1046
1593
            self.stop_checker()
1047
1594
    
1048
 
    # object_path - property
1049
 
    @dbus_service_property(_interface, signature=u"o", access=u"read")
1050
 
    def object_path_dbus_property(self):
 
1595
    # ObjectPath - property
 
1596
    @dbus_service_property(_interface, signature="o", access="read")
 
1597
    def ObjectPath_dbus_property(self):
1051
1598
        return self.dbus_object_path # is already a dbus.ObjectPath
1052
1599
    
1053
 
    # secret = property
1054
 
    @dbus_service_property(_interface, signature=u"ay",
1055
 
                           access=u"write", byte_arrays=True)
1056
 
    def secret_dbus_property(self, value):
 
1600
    # Secret = property
 
1601
    @dbus_service_property(_interface, signature="ay",
 
1602
                           access="write", byte_arrays=True)
 
1603
    def Secret_dbus_property(self, value):
1057
1604
        self.secret = str(value)
1058
1605
    
1059
1606
    del _interface
1065
1612
        self._pipe.send(('init', fpr, address))
1066
1613
        if not self._pipe.recv():
1067
1614
            raise KeyError()
1068
 
 
 
1615
    
1069
1616
    def __getattribute__(self, name):
1070
 
        if(name == '_pipe'):
 
1617
        if name == '_pipe':
1071
1618
            return super(ProxyClient, self).__getattribute__(name)
1072
1619
        self._pipe.send(('getattr', name))
1073
1620
        data = self._pipe.recv()
1078
1625
                self._pipe.send(('funcall', name, args, kwargs))
1079
1626
                return self._pipe.recv()[1]
1080
1627
            return func
1081
 
 
 
1628
    
1082
1629
    def __setattr__(self, name, value):
1083
 
        if(name == '_pipe'):
 
1630
        if name == '_pipe':
1084
1631
            return super(ProxyClient, self).__setattr__(name, value)
1085
1632
        self._pipe.send(('setattr', name, value))
1086
1633
 
1093
1640
    
1094
1641
    def handle(self):
1095
1642
        with contextlib.closing(self.server.child_pipe) as child_pipe:
1096
 
            logger.info(u"TCP connection from: %s",
 
1643
            logger.info("TCP connection from: %s",
1097
1644
                        unicode(self.client_address))
1098
 
            logger.debug(u"Pipe FD: %d",
 
1645
            logger.debug("Pipe FD: %d",
1099
1646
                         self.server.child_pipe.fileno())
1100
 
 
 
1647
            
1101
1648
            session = (gnutls.connection
1102
1649
                       .ClientSession(self.request,
1103
1650
                                      gnutls.connection
1104
1651
                                      .X509Credentials()))
1105
 
 
 
1652
            
1106
1653
            # Note: gnutls.connection.X509Credentials is really a
1107
1654
            # generic GnuTLS certificate credentials object so long as
1108
1655
            # no X.509 keys are added to it.  Therefore, we can use it
1109
1656
            # here despite using OpenPGP certificates.
1110
 
 
1111
 
            #priority = u':'.join((u"NONE", u"+VERS-TLS1.1",
1112
 
            #                      u"+AES-256-CBC", u"+SHA1",
1113
 
            #                      u"+COMP-NULL", u"+CTYPE-OPENPGP",
1114
 
            #                      u"+DHE-DSS"))
 
1657
            
 
1658
            #priority = ':'.join(("NONE", "+VERS-TLS1.1",
 
1659
            #                      "+AES-256-CBC", "+SHA1",
 
1660
            #                      "+COMP-NULL", "+CTYPE-OPENPGP",
 
1661
            #                      "+DHE-DSS"))
1115
1662
            # Use a fallback default, since this MUST be set.
1116
1663
            priority = self.server.gnutls_priority
1117
1664
            if priority is None:
1118
 
                priority = u"NORMAL"
 
1665
                priority = "NORMAL"
1119
1666
            (gnutls.library.functions
1120
1667
             .gnutls_priority_set_direct(session._c_object,
1121
1668
                                         priority, None))
1122
 
 
 
1669
            
1123
1670
            # Start communication using the Mandos protocol
1124
1671
            # Get protocol number
1125
1672
            line = self.request.makefile().readline()
1126
 
            logger.debug(u"Protocol version: %r", line)
 
1673
            logger.debug("Protocol version: %r", line)
1127
1674
            try:
1128
1675
                if int(line.strip().split()[0]) > 1:
1129
1676
                    raise RuntimeError
1130
 
            except (ValueError, IndexError, RuntimeError), error:
1131
 
                logger.error(u"Unknown protocol version: %s", error)
 
1677
            except (ValueError, IndexError, RuntimeError) as error:
 
1678
                logger.error("Unknown protocol version: %s", error)
1132
1679
                return
1133
 
 
 
1680
            
1134
1681
            # Start GnuTLS connection
1135
1682
            try:
1136
1683
                session.handshake()
1137
 
            except gnutls.errors.GNUTLSError, error:
1138
 
                logger.warning(u"Handshake failed: %s", error)
 
1684
            except gnutls.errors.GNUTLSError as error:
 
1685
                logger.warning("Handshake failed: %s", error)
1139
1686
                # Do not run session.bye() here: the session is not
1140
1687
                # established.  Just abandon the request.
1141
1688
                return
1142
 
            logger.debug(u"Handshake succeeded")
1143
 
 
 
1689
            logger.debug("Handshake succeeded")
 
1690
            
1144
1691
            approval_required = False
1145
1692
            try:
1146
1693
                try:
1147
1694
                    fpr = self.fingerprint(self.peer_certificate
1148
1695
                                           (session))
1149
 
                except (TypeError, gnutls.errors.GNUTLSError), error:
1150
 
                    logger.warning(u"Bad certificate: %s", error)
 
1696
                except (TypeError,
 
1697
                        gnutls.errors.GNUTLSError) as error:
 
1698
                    logger.warning("Bad certificate: %s", error)
1151
1699
                    return
1152
 
                logger.debug(u"Fingerprint: %s", fpr)
1153
 
 
 
1700
                logger.debug("Fingerprint: %s", fpr)
 
1701
                
1154
1702
                try:
1155
1703
                    client = ProxyClient(child_pipe, fpr,
1156
1704
                                         self.client_address)
1157
1705
                except KeyError:
1158
1706
                    return
1159
1707
                
1160
 
                if client.approved_delay:
1161
 
                    delay = client.approved_delay
 
1708
                if client.approval_delay:
 
1709
                    delay = client.approval_delay
1162
1710
                    client.approvals_pending += 1
1163
1711
                    approval_required = True
1164
1712
                
1165
1713
                while True:
1166
1714
                    if not client.enabled:
1167
 
                        logger.warning(u"Client %s is disabled",
 
1715
                        logger.info("Client %s is disabled",
1168
1716
                                       client.name)
1169
1717
                        if self.server.use_dbus:
1170
1718
                            # Emit D-Bus signal
1171
 
                            client.Rejected("Disabled")                    
 
1719
                            client.Rejected("Disabled")
1172
1720
                        return
1173
1721
                    
1174
 
                    if client._approved or not client.approved_delay:
 
1722
                    if client.approved or not client.approval_delay:
1175
1723
                        #We are approved or approval is disabled
1176
1724
                        break
1177
 
                    elif client._approved is None:
1178
 
                        logger.info(u"Client %s need approval",
 
1725
                    elif client.approved is None:
 
1726
                        logger.info("Client %s needs approval",
1179
1727
                                    client.name)
1180
1728
                        if self.server.use_dbus:
1181
1729
                            # Emit D-Bus signal
1182
1730
                            client.NeedApproval(
1183
 
                                client.approved_delay_milliseconds(),
 
1731
                                client.approval_delay_milliseconds(),
1184
1732
                                client.approved_by_default)
1185
1733
                    else:
1186
 
                        logger.warning(u"Client %s was not approved",
 
1734
                        logger.warning("Client %s was not approved",
1187
1735
                                       client.name)
1188
1736
                        if self.server.use_dbus:
1189
1737
                            # Emit D-Bus signal
1190
 
                            client.Rejected("Disapproved")
 
1738
                            client.Rejected("Denied")
1191
1739
                        return
1192
1740
                    
1193
1741
                    #wait until timeout or approved
1194
 
                    #x = float(client._timedelta_to_milliseconds(delay))
1195
1742
                    time = datetime.datetime.now()
1196
1743
                    client.changedstate.acquire()
1197
 
                    client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))
 
1744
                    client.changedstate.wait(
 
1745
                        float(timedelta_to_milliseconds(delay)
 
1746
                              / 1000))
1198
1747
                    client.changedstate.release()
1199
1748
                    time2 = datetime.datetime.now()
1200
1749
                    if (time2 - time) >= delay:
1204
1753
                                           client.name)
1205
1754
                            if self.server.use_dbus:
1206
1755
                                # Emit D-Bus signal
1207
 
                                client.Rejected("Time out")
 
1756
                                client.Rejected("Approval timed out")
1208
1757
                            return
1209
1758
                        else:
1210
1759
                            break
1213
1762
                
1214
1763
                sent_size = 0
1215
1764
                while sent_size < len(client.secret):
1216
 
                    # XXX handle session exception
1217
 
                    sent = session.send(client.secret[sent_size:])
1218
 
                    logger.debug(u"Sent: %d, remaining: %d",
 
1765
                    try:
 
1766
                        sent = session.send(client.secret[sent_size:])
 
1767
                    except gnutls.errors.GNUTLSError as error:
 
1768
                        logger.warning("gnutls send failed",
 
1769
                                       exc_info=error)
 
1770
                        return
 
1771
                    logger.debug("Sent: %d, remaining: %d",
1219
1772
                                 sent, len(client.secret)
1220
1773
                                 - (sent_size + sent))
1221
1774
                    sent_size += sent
1222
 
 
1223
 
                logger.info(u"Sending secret to %s", client.name)
1224
 
                # bump the timeout as if seen
1225
 
                client.checked_ok()
 
1775
                
 
1776
                logger.info("Sending secret to %s", client.name)
 
1777
                # bump the timeout using extended_timeout
 
1778
                client.bump_timeout(client.extended_timeout)
1226
1779
                if self.server.use_dbus:
1227
1780
                    # Emit D-Bus signal
1228
1781
                    client.GotSecret()
1230
1783
            finally:
1231
1784
                if approval_required:
1232
1785
                    client.approvals_pending -= 1
1233
 
                session.bye()
 
1786
                try:
 
1787
                    session.bye()
 
1788
                except gnutls.errors.GNUTLSError as error:
 
1789
                    logger.warning("GnuTLS bye failed",
 
1790
                                   exc_info=error)
1234
1791
    
1235
1792
    @staticmethod
1236
1793
    def peer_certificate(session):
1246
1803
                     .gnutls_certificate_get_peers
1247
1804
                     (session._c_object, ctypes.byref(list_size)))
1248
1805
        if not bool(cert_list) and list_size.value != 0:
1249
 
            raise gnutls.errors.GNUTLSError(u"error getting peer"
1250
 
                                            u" certificate")
 
1806
            raise gnutls.errors.GNUTLSError("error getting peer"
 
1807
                                            " certificate")
1251
1808
        if list_size.value == 0:
1252
1809
            return None
1253
1810
        cert = cert_list[0]
1279
1836
        if crtverify.value != 0:
1280
1837
            gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1281
1838
            raise (gnutls.errors.CertificateSecurityError
1282
 
                   (u"Verify failed"))
 
1839
                   ("Verify failed"))
1283
1840
        # New buffer for the fingerprint
1284
1841
        buf = ctypes.create_string_buffer(20)
1285
1842
        buf_len = ctypes.c_size_t()
1292
1849
        # Convert the buffer to a Python bytestring
1293
1850
        fpr = ctypes.string_at(buf, buf_len.value)
1294
1851
        # Convert the bytestring to hexadecimal notation
1295
 
        hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
 
1852
        hex_fpr = binascii.hexlify(fpr).upper()
1296
1853
        return hex_fpr
1297
1854
 
1298
1855
 
1301
1858
    def sub_process_main(self, request, address):
1302
1859
        try:
1303
1860
            self.finish_request(request, address)
1304
 
        except:
 
1861
        except Exception:
1305
1862
            self.handle_error(request, address)
1306
1863
        self.close_request(request)
1307
 
            
 
1864
    
1308
1865
    def process_request(self, request, address):
1309
1866
        """Start a new process to process the request."""
1310
 
        multiprocessing.Process(target = self.sub_process_main,
1311
 
                                args = (request, address)).start()
 
1867
        proc = multiprocessing.Process(target = self.sub_process_main,
 
1868
                                       args = (request, address))
 
1869
        proc.start()
 
1870
        return proc
 
1871
 
1312
1872
 
1313
1873
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
1314
1874
    """ adds a pipe to the MixIn """
1318
1878
        This function creates a new pipe in self.pipe
1319
1879
        """
1320
1880
        parent_pipe, self.child_pipe = multiprocessing.Pipe()
1321
 
 
1322
 
        super(MultiprocessingMixInWithPipe,
1323
 
              self).process_request(request, client_address)
1324
 
        self.add_pipe(parent_pipe)
1325
 
    def add_pipe(self, parent_pipe):
 
1881
        
 
1882
        proc = MultiprocessingMixIn.process_request(self, request,
 
1883
                                                    client_address)
 
1884
        self.child_pipe.close()
 
1885
        self.add_pipe(parent_pipe, proc)
 
1886
    
 
1887
    def add_pipe(self, parent_pipe, proc):
1326
1888
        """Dummy function; override as necessary"""
1327
 
        pass
 
1889
        raise NotImplementedError
 
1890
 
1328
1891
 
1329
1892
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
1330
1893
                     socketserver.TCPServer, object):
1336
1899
        use_ipv6:       Boolean; to use IPv6 or not
1337
1900
    """
1338
1901
    def __init__(self, server_address, RequestHandlerClass,
1339
 
                 interface=None, use_ipv6=True):
 
1902
                 interface=None, use_ipv6=True, socketfd=None):
 
1903
        """If socketfd is set, use that file descriptor instead of
 
1904
        creating a new one with socket.socket().
 
1905
        """
1340
1906
        self.interface = interface
1341
1907
        if use_ipv6:
1342
1908
            self.address_family = socket.AF_INET6
 
1909
        if socketfd is not None:
 
1910
            # Save the file descriptor
 
1911
            self.socketfd = socketfd
 
1912
            # Save the original socket.socket() function
 
1913
            self.socket_socket = socket.socket
 
1914
            # To implement --socket, we monkey patch socket.socket.
 
1915
            # 
 
1916
            # (When socketserver.TCPServer is a new-style class, we
 
1917
            # could make self.socket into a property instead of monkey
 
1918
            # patching socket.socket.)
 
1919
            # 
 
1920
            # Create a one-time-only replacement for socket.socket()
 
1921
            @functools.wraps(socket.socket)
 
1922
            def socket_wrapper(*args, **kwargs):
 
1923
                # Restore original function so subsequent calls are
 
1924
                # not affected.
 
1925
                socket.socket = self.socket_socket
 
1926
                del self.socket_socket
 
1927
                # This time only, return a new socket object from the
 
1928
                # saved file descriptor.
 
1929
                return socket.fromfd(self.socketfd, *args, **kwargs)
 
1930
            # Replace socket.socket() function with wrapper
 
1931
            socket.socket = socket_wrapper
 
1932
        # The socketserver.TCPServer.__init__ will call
 
1933
        # socket.socket(), which might be our replacement,
 
1934
        # socket_wrapper(), if socketfd was set.
1343
1935
        socketserver.TCPServer.__init__(self, server_address,
1344
1936
                                        RequestHandlerClass)
 
1937
    
1345
1938
    def server_bind(self):
1346
1939
        """This overrides the normal server_bind() function
1347
1940
        to bind to an interface if one was specified, and also NOT to
1348
1941
        bind to an address or port if they were not specified."""
1349
1942
        if self.interface is not None:
1350
1943
            if SO_BINDTODEVICE is None:
1351
 
                logger.error(u"SO_BINDTODEVICE does not exist;"
1352
 
                             u" cannot bind to interface %s",
 
1944
                logger.error("SO_BINDTODEVICE does not exist;"
 
1945
                             " cannot bind to interface %s",
1353
1946
                             self.interface)
1354
1947
            else:
1355
1948
                try:
1356
1949
                    self.socket.setsockopt(socket.SOL_SOCKET,
1357
1950
                                           SO_BINDTODEVICE,
1358
1951
                                           str(self.interface
1359
 
                                               + u'\0'))
1360
 
                except socket.error, error:
1361
 
                    if error[0] == errno.EPERM:
1362
 
                        logger.error(u"No permission to"
1363
 
                                     u" bind to interface %s",
1364
 
                                     self.interface)
1365
 
                    elif error[0] == errno.ENOPROTOOPT:
1366
 
                        logger.error(u"SO_BINDTODEVICE not available;"
1367
 
                                     u" cannot bind to interface %s",
 
1952
                                               + '\0'))
 
1953
                except socket.error as error:
 
1954
                    if error.errno == errno.EPERM:
 
1955
                        logger.error("No permission to"
 
1956
                                     " bind to interface %s",
 
1957
                                     self.interface)
 
1958
                    elif error.errno == errno.ENOPROTOOPT:
 
1959
                        logger.error("SO_BINDTODEVICE not available;"
 
1960
                                     " cannot bind to interface %s",
 
1961
                                     self.interface)
 
1962
                    elif error.errno == errno.ENODEV:
 
1963
                        logger.error("Interface %s does not"
 
1964
                                     " exist, cannot bind",
1368
1965
                                     self.interface)
1369
1966
                    else:
1370
1967
                        raise
1372
1969
        if self.server_address[0] or self.server_address[1]:
1373
1970
            if not self.server_address[0]:
1374
1971
                if self.address_family == socket.AF_INET6:
1375
 
                    any_address = u"::" # in6addr_any
 
1972
                    any_address = "::" # in6addr_any
1376
1973
                else:
1377
1974
                    any_address = socket.INADDR_ANY
1378
1975
                self.server_address = (any_address,
1401
1998
    """
1402
1999
    def __init__(self, server_address, RequestHandlerClass,
1403
2000
                 interface=None, use_ipv6=True, clients=None,
1404
 
                 gnutls_priority=None, use_dbus=True):
 
2001
                 gnutls_priority=None, use_dbus=True, socketfd=None):
1405
2002
        self.enabled = False
1406
2003
        self.clients = clients
1407
2004
        if self.clients is None:
1408
 
            self.clients = set()
 
2005
            self.clients = {}
1409
2006
        self.use_dbus = use_dbus
1410
2007
        self.gnutls_priority = gnutls_priority
1411
2008
        IPv6_TCPServer.__init__(self, server_address,
1412
2009
                                RequestHandlerClass,
1413
2010
                                interface = interface,
1414
 
                                use_ipv6 = use_ipv6)
 
2011
                                use_ipv6 = use_ipv6,
 
2012
                                socketfd = socketfd)
1415
2013
    def server_activate(self):
1416
2014
        if self.enabled:
1417
2015
            return socketserver.TCPServer.server_activate(self)
 
2016
    
1418
2017
    def enable(self):
1419
2018
        self.enabled = True
1420
 
    def add_pipe(self, parent_pipe):
 
2019
    
 
2020
    def add_pipe(self, parent_pipe, proc):
1421
2021
        # Call "handle_ipc" for both data and EOF events
1422
2022
        gobject.io_add_watch(parent_pipe.fileno(),
1423
2023
                             gobject.IO_IN | gobject.IO_HUP,
1424
2024
                             functools.partial(self.handle_ipc,
1425
 
                                               parent_pipe = parent_pipe))
1426
 
        
 
2025
                                               parent_pipe =
 
2026
                                               parent_pipe,
 
2027
                                               proc = proc))
 
2028
    
1427
2029
    def handle_ipc(self, source, condition, parent_pipe=None,
1428
 
                   client_object=None):
1429
 
        condition_names = {
1430
 
            gobject.IO_IN: u"IN",   # There is data to read.
1431
 
            gobject.IO_OUT: u"OUT", # Data can be written (without
1432
 
                                    # blocking).
1433
 
            gobject.IO_PRI: u"PRI", # There is urgent data to read.
1434
 
            gobject.IO_ERR: u"ERR", # Error condition.
1435
 
            gobject.IO_HUP: u"HUP"  # Hung up (the connection has been
1436
 
                                    # broken, usually for pipes and
1437
 
                                    # sockets).
1438
 
            }
1439
 
        conditions_string = ' | '.join(name
1440
 
                                       for cond, name in
1441
 
                                       condition_names.iteritems()
1442
 
                                       if cond & condition)
1443
 
        logger.debug(u"Handling IPC: FD = %d, condition = %s", source,
1444
 
                     conditions_string)
 
2030
                   proc = None, client_object=None):
 
2031
        # error, or the other end of multiprocessing.Pipe has closed
 
2032
        if condition & (gobject.IO_ERR | gobject.IO_HUP):
 
2033
            # Wait for other process to exit
 
2034
            proc.join()
 
2035
            return False
1445
2036
        
1446
2037
        # Read a request from the child
1447
2038
        request = parent_pipe.recv()
1451
2042
            fpr = request[1]
1452
2043
            address = request[2]
1453
2044
            
1454
 
            for c in self.clients:
 
2045
            for c in self.clients.itervalues():
1455
2046
                if c.fingerprint == fpr:
1456
2047
                    client = c
1457
2048
                    break
1458
2049
            else:
1459
 
                logger.warning(u"Client not found for fingerprint: %s, ad"
1460
 
                               u"dress: %s", fpr, address)
 
2050
                logger.info("Client not found for fingerprint: %s, ad"
 
2051
                            "dress: %s", fpr, address)
1461
2052
                if self.use_dbus:
1462
2053
                    # Emit D-Bus signal
1463
 
                    mandos_dbus_service.ClientNotFound(fpr, address)
 
2054
                    mandos_dbus_service.ClientNotFound(fpr,
 
2055
                                                       address[0])
1464
2056
                parent_pipe.send(False)
1465
2057
                return False
1466
2058
            
1467
2059
            gobject.io_add_watch(parent_pipe.fileno(),
1468
2060
                                 gobject.IO_IN | gobject.IO_HUP,
1469
2061
                                 functools.partial(self.handle_ipc,
1470
 
                                                   parent_pipe = parent_pipe,
1471
 
                                                   client_object = client))
 
2062
                                                   parent_pipe =
 
2063
                                                   parent_pipe,
 
2064
                                                   proc = proc,
 
2065
                                                   client_object =
 
2066
                                                   client))
1472
2067
            parent_pipe.send(True)
1473
 
            # remove the old hook in favor of the new above hook on same fileno
 
2068
            # remove the old hook in favor of the new above hook on
 
2069
            # same fileno
1474
2070
            return False
1475
2071
        if command == 'funcall':
1476
2072
            funcname = request[1]
1477
2073
            args = request[2]
1478
2074
            kwargs = request[3]
1479
2075
            
1480
 
            parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))
1481
 
 
 
2076
            parent_pipe.send(('data', getattr(client_object,
 
2077
                                              funcname)(*args,
 
2078
                                                         **kwargs)))
 
2079
        
1482
2080
        if command == 'getattr':
1483
2081
            attrname = request[1]
1484
2082
            if callable(client_object.__getattribute__(attrname)):
1485
2083
                parent_pipe.send(('function',))
1486
2084
            else:
1487
 
                parent_pipe.send(('data', client_object.__getattribute__(attrname)))
1488
 
 
 
2085
                parent_pipe.send(('data', client_object
 
2086
                                  .__getattribute__(attrname)))
 
2087
        
1489
2088
        if command == 'setattr':
1490
2089
            attrname = request[1]
1491
2090
            value = request[2]
1492
2091
            setattr(client_object, attrname, value)
1493
 
            
 
2092
        
1494
2093
        return True
1495
2094
 
1496
2095
 
1497
2096
def string_to_delta(interval):
1498
2097
    """Parse a string and return a datetime.timedelta
1499
2098
    
1500
 
    >>> string_to_delta(u'7d')
 
2099
    >>> string_to_delta('7d')
1501
2100
    datetime.timedelta(7)
1502
 
    >>> string_to_delta(u'60s')
 
2101
    >>> string_to_delta('60s')
1503
2102
    datetime.timedelta(0, 60)
1504
 
    >>> string_to_delta(u'60m')
 
2103
    >>> string_to_delta('60m')
1505
2104
    datetime.timedelta(0, 3600)
1506
 
    >>> string_to_delta(u'24h')
 
2105
    >>> string_to_delta('24h')
1507
2106
    datetime.timedelta(1)
1508
 
    >>> string_to_delta(u'1w')
 
2107
    >>> string_to_delta('1w')
1509
2108
    datetime.timedelta(7)
1510
 
    >>> string_to_delta(u'5m 30s')
 
2109
    >>> string_to_delta('5m 30s')
1511
2110
    datetime.timedelta(0, 330)
1512
2111
    """
1513
2112
    timevalue = datetime.timedelta(0)
1515
2114
        try:
1516
2115
            suffix = unicode(s[-1])
1517
2116
            value = int(s[:-1])
1518
 
            if suffix == u"d":
 
2117
            if suffix == "d":
1519
2118
                delta = datetime.timedelta(value)
1520
 
            elif suffix == u"s":
 
2119
            elif suffix == "s":
1521
2120
                delta = datetime.timedelta(0, value)
1522
 
            elif suffix == u"m":
 
2121
            elif suffix == "m":
1523
2122
                delta = datetime.timedelta(0, 0, 0, 0, value)
1524
 
            elif suffix == u"h":
 
2123
            elif suffix == "h":
1525
2124
                delta = datetime.timedelta(0, 0, 0, 0, 0, value)
1526
 
            elif suffix == u"w":
 
2125
            elif suffix == "w":
1527
2126
                delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
1528
2127
            else:
1529
 
                raise ValueError(u"Unknown suffix %r" % suffix)
1530
 
        except (ValueError, IndexError), e:
1531
 
            raise ValueError(e.message)
 
2128
                raise ValueError("Unknown suffix {0!r}"
 
2129
                                 .format(suffix))
 
2130
        except (ValueError, IndexError) as e:
 
2131
            raise ValueError(*(e.args))
1532
2132
        timevalue += delta
1533
2133
    return timevalue
1534
2134
 
1535
2135
 
1536
 
def if_nametoindex(interface):
1537
 
    """Call the C function if_nametoindex(), or equivalent
1538
 
    
1539
 
    Note: This function cannot accept a unicode string."""
1540
 
    global if_nametoindex
1541
 
    try:
1542
 
        if_nametoindex = (ctypes.cdll.LoadLibrary
1543
 
                          (ctypes.util.find_library(u"c"))
1544
 
                          .if_nametoindex)
1545
 
    except (OSError, AttributeError):
1546
 
        logger.warning(u"Doing if_nametoindex the hard way")
1547
 
        def if_nametoindex(interface):
1548
 
            "Get an interface index the hard way, i.e. using fcntl()"
1549
 
            SIOCGIFINDEX = 0x8933  # From /usr/include/linux/sockios.h
1550
 
            with contextlib.closing(socket.socket()) as s:
1551
 
                ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
1552
 
                                    struct.pack(str(u"16s16x"),
1553
 
                                                interface))
1554
 
            interface_index = struct.unpack(str(u"I"),
1555
 
                                            ifreq[16:20])[0]
1556
 
            return interface_index
1557
 
    return if_nametoindex(interface)
1558
 
 
1559
 
 
1560
2136
def daemon(nochdir = False, noclose = False):
1561
2137
    """See daemon(3).  Standard BSD Unix function.
1562
2138
    
1565
2141
        sys.exit()
1566
2142
    os.setsid()
1567
2143
    if not nochdir:
1568
 
        os.chdir(u"/")
 
2144
        os.chdir("/")
1569
2145
    if os.fork():
1570
2146
        sys.exit()
1571
2147
    if not noclose:
1572
2148
        # Close all standard open file descriptors
1573
 
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
 
2149
        null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
1574
2150
        if not stat.S_ISCHR(os.fstat(null).st_mode):
1575
2151
            raise OSError(errno.ENODEV,
1576
 
                          u"%s not a character device"
1577
 
                          % os.path.devnull)
 
2152
                          "{0} not a character device"
 
2153
                          .format(os.devnull))
1578
2154
        os.dup2(null, sys.stdin.fileno())
1579
2155
        os.dup2(null, sys.stdout.fileno())
1580
2156
        os.dup2(null, sys.stderr.fileno())
1587
2163
    ##################################################################
1588
2164
    # Parsing of options, both command line and config file
1589
2165
    
1590
 
    parser = optparse.OptionParser(version = "%%prog %s" % version)
1591
 
    parser.add_option("-i", u"--interface", type=u"string",
1592
 
                      metavar="IF", help=u"Bind to interface IF")
1593
 
    parser.add_option("-a", u"--address", type=u"string",
1594
 
                      help=u"Address to listen for requests on")
1595
 
    parser.add_option("-p", u"--port", type=u"int",
1596
 
                      help=u"Port number to receive requests on")
1597
 
    parser.add_option("--check", action=u"store_true",
1598
 
                      help=u"Run self-test")
1599
 
    parser.add_option("--debug", action=u"store_true",
1600
 
                      help=u"Debug mode; run in foreground and log to"
1601
 
                      u" terminal")
1602
 
    parser.add_option("--priority", type=u"string", help=u"GnuTLS"
1603
 
                      u" priority string (see GnuTLS documentation)")
1604
 
    parser.add_option("--servicename", type=u"string",
1605
 
                      metavar=u"NAME", help=u"Zeroconf service name")
1606
 
    parser.add_option("--configdir", type=u"string",
1607
 
                      default=u"/etc/mandos", metavar=u"DIR",
1608
 
                      help=u"Directory to search for configuration"
1609
 
                      u" files")
1610
 
    parser.add_option("--no-dbus", action=u"store_false",
1611
 
                      dest=u"use_dbus", help=u"Do not provide D-Bus"
1612
 
                      u" system bus interface")
1613
 
    parser.add_option("--no-ipv6", action=u"store_false",
1614
 
                      dest=u"use_ipv6", help=u"Do not use IPv6")
1615
 
    options = parser.parse_args()[0]
 
2166
    parser = argparse.ArgumentParser()
 
2167
    parser.add_argument("-v", "--version", action="version",
 
2168
                        version = "%(prog)s {0}".format(version),
 
2169
                        help="show version number and exit")
 
2170
    parser.add_argument("-i", "--interface", metavar="IF",
 
2171
                        help="Bind to interface IF")
 
2172
    parser.add_argument("-a", "--address",
 
2173
                        help="Address to listen for requests on")
 
2174
    parser.add_argument("-p", "--port", type=int,
 
2175
                        help="Port number to receive requests on")
 
2176
    parser.add_argument("--check", action="store_true",
 
2177
                        help="Run self-test")
 
2178
    parser.add_argument("--debug", action="store_true",
 
2179
                        help="Debug mode; run in foreground and log"
 
2180
                        " to terminal")
 
2181
    parser.add_argument("--debuglevel", metavar="LEVEL",
 
2182
                        help="Debug level for stdout output")
 
2183
    parser.add_argument("--priority", help="GnuTLS"
 
2184
                        " priority string (see GnuTLS documentation)")
 
2185
    parser.add_argument("--servicename",
 
2186
                        metavar="NAME", help="Zeroconf service name")
 
2187
    parser.add_argument("--configdir",
 
2188
                        default="/etc/mandos", metavar="DIR",
 
2189
                        help="Directory to search for configuration"
 
2190
                        " files")
 
2191
    parser.add_argument("--no-dbus", action="store_false",
 
2192
                        dest="use_dbus", help="Do not provide D-Bus"
 
2193
                        " system bus interface")
 
2194
    parser.add_argument("--no-ipv6", action="store_false",
 
2195
                        dest="use_ipv6", help="Do not use IPv6")
 
2196
    parser.add_argument("--no-restore", action="store_false",
 
2197
                        dest="restore", help="Do not restore stored"
 
2198
                        " state")
 
2199
    parser.add_argument("--socket", type=int,
 
2200
                        help="Specify a file descriptor to a network"
 
2201
                        " socket to use instead of creating one")
 
2202
    parser.add_argument("--statedir", metavar="DIR",
 
2203
                        help="Directory to save/restore state in")
 
2204
    
 
2205
    options = parser.parse_args()
1616
2206
    
1617
2207
    if options.check:
1618
2208
        import doctest
1620
2210
        sys.exit()
1621
2211
    
1622
2212
    # Default values for config file for server-global settings
1623
 
    server_defaults = { u"interface": u"",
1624
 
                        u"address": u"",
1625
 
                        u"port": u"",
1626
 
                        u"debug": u"False",
1627
 
                        u"priority":
1628
 
                        u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
1629
 
                        u"servicename": u"Mandos",
1630
 
                        u"use_dbus": u"True",
1631
 
                        u"use_ipv6": u"True",
 
2213
    server_defaults = { "interface": "",
 
2214
                        "address": "",
 
2215
                        "port": "",
 
2216
                        "debug": "False",
 
2217
                        "priority":
 
2218
                        "SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
 
2219
                        "servicename": "Mandos",
 
2220
                        "use_dbus": "True",
 
2221
                        "use_ipv6": "True",
 
2222
                        "debuglevel": "",
 
2223
                        "restore": "True",
 
2224
                        "socket": "",
 
2225
                        "statedir": "/var/lib/mandos"
1632
2226
                        }
1633
2227
    
1634
2228
    # Parse config file for server-global settings
1635
2229
    server_config = configparser.SafeConfigParser(server_defaults)
1636
2230
    del server_defaults
1637
2231
    server_config.read(os.path.join(options.configdir,
1638
 
                                    u"mandos.conf"))
 
2232
                                    "mandos.conf"))
1639
2233
    # Convert the SafeConfigParser object to a dict
1640
2234
    server_settings = server_config.defaults()
1641
2235
    # Use the appropriate methods on the non-string config options
1642
 
    for option in (u"debug", u"use_dbus", u"use_ipv6"):
1643
 
        server_settings[option] = server_config.getboolean(u"DEFAULT",
 
2236
    for option in ("debug", "use_dbus", "use_ipv6"):
 
2237
        server_settings[option] = server_config.getboolean("DEFAULT",
1644
2238
                                                           option)
1645
2239
    if server_settings["port"]:
1646
 
        server_settings["port"] = server_config.getint(u"DEFAULT",
1647
 
                                                       u"port")
 
2240
        server_settings["port"] = server_config.getint("DEFAULT",
 
2241
                                                       "port")
 
2242
    if server_settings["socket"]:
 
2243
        server_settings["socket"] = server_config.getint("DEFAULT",
 
2244
                                                         "socket")
 
2245
        # Later, stdin will, and stdout and stderr might, be dup'ed
 
2246
        # over with an opened os.devnull.  But we don't want this to
 
2247
        # happen with a supplied network socket.
 
2248
        if 0 <= server_settings["socket"] <= 2:
 
2249
            server_settings["socket"] = os.dup(server_settings
 
2250
                                               ["socket"])
1648
2251
    del server_config
1649
2252
    
1650
2253
    # Override the settings from the config file with command line
1651
2254
    # options, if set.
1652
 
    for option in (u"interface", u"address", u"port", u"debug",
1653
 
                   u"priority", u"servicename", u"configdir",
1654
 
                   u"use_dbus", u"use_ipv6"):
 
2255
    for option in ("interface", "address", "port", "debug",
 
2256
                   "priority", "servicename", "configdir",
 
2257
                   "use_dbus", "use_ipv6", "debuglevel", "restore",
 
2258
                   "statedir", "socket"):
1655
2259
        value = getattr(options, option)
1656
2260
        if value is not None:
1657
2261
            server_settings[option] = value
1665
2269
    ##################################################################
1666
2270
    
1667
2271
    # For convenience
1668
 
    debug = server_settings[u"debug"]
1669
 
    use_dbus = server_settings[u"use_dbus"]
1670
 
    use_ipv6 = server_settings[u"use_ipv6"]
1671
 
    
1672
 
    if not debug:
1673
 
        syslogger.setLevel(logging.WARNING)
1674
 
        console.setLevel(logging.WARNING)
1675
 
    
1676
 
    if server_settings[u"servicename"] != u"Mandos":
 
2272
    debug = server_settings["debug"]
 
2273
    debuglevel = server_settings["debuglevel"]
 
2274
    use_dbus = server_settings["use_dbus"]
 
2275
    use_ipv6 = server_settings["use_ipv6"]
 
2276
    stored_state_path = os.path.join(server_settings["statedir"],
 
2277
                                     stored_state_file)
 
2278
    
 
2279
    if debug:
 
2280
        initlogger(debug, logging.DEBUG)
 
2281
    else:
 
2282
        if not debuglevel:
 
2283
            initlogger(debug)
 
2284
        else:
 
2285
            level = getattr(logging, debuglevel.upper())
 
2286
            initlogger(debug, level)
 
2287
    
 
2288
    if server_settings["servicename"] != "Mandos":
1677
2289
        syslogger.setFormatter(logging.Formatter
1678
 
                               (u'Mandos (%s) [%%(process)d]:'
1679
 
                                u' %%(levelname)s: %%(message)s'
1680
 
                                % server_settings[u"servicename"]))
 
2290
                               ('Mandos ({0}) [%(process)d]:'
 
2291
                                ' %(levelname)s: %(message)s'
 
2292
                                .format(server_settings
 
2293
                                        ["servicename"])))
1681
2294
    
1682
2295
    # Parse config file with clients
1683
 
    client_defaults = { u"timeout": u"1h",
1684
 
                        u"interval": u"5m",
1685
 
                        u"checker": u"fping -q -- %%(host)s",
1686
 
                        u"host": u"",
1687
 
                        u"approved_delay": u"5m",
1688
 
                        u"approved_duration": u"1s",
1689
 
                        }
1690
 
    client_config = configparser.SafeConfigParser(client_defaults)
1691
 
    client_config.read(os.path.join(server_settings[u"configdir"],
1692
 
                                    u"clients.conf"))
 
2296
    client_config = configparser.SafeConfigParser(Client
 
2297
                                                  .client_defaults)
 
2298
    client_config.read(os.path.join(server_settings["configdir"],
 
2299
                                    "clients.conf"))
1693
2300
    
1694
2301
    global mandos_dbus_service
1695
2302
    mandos_dbus_service = None
1696
2303
    
1697
 
    tcp_server = MandosServer((server_settings[u"address"],
1698
 
                               server_settings[u"port"]),
 
2304
    tcp_server = MandosServer((server_settings["address"],
 
2305
                               server_settings["port"]),
1699
2306
                              ClientHandler,
1700
 
                              interface=server_settings[u"interface"],
 
2307
                              interface=(server_settings["interface"]
 
2308
                                         or None),
1701
2309
                              use_ipv6=use_ipv6,
1702
2310
                              gnutls_priority=
1703
 
                              server_settings[u"priority"],
1704
 
                              use_dbus=use_dbus)
1705
 
    pidfilename = u"/var/run/mandos.pid"
1706
 
    try:
1707
 
        pidfile = open(pidfilename, u"w")
1708
 
    except IOError:
1709
 
        logger.error(u"Could not open file %r", pidfilename)
 
2311
                              server_settings["priority"],
 
2312
                              use_dbus=use_dbus,
 
2313
                              socketfd=(server_settings["socket"]
 
2314
                                        or None))
 
2315
    if not debug:
 
2316
        pidfilename = "/var/run/mandos.pid"
 
2317
        try:
 
2318
            pidfile = open(pidfilename, "w")
 
2319
        except IOError as e:
 
2320
            logger.error("Could not open file %r", pidfilename,
 
2321
                         exc_info=e)
1710
2322
    
1711
 
    try:
1712
 
        uid = pwd.getpwnam(u"_mandos").pw_uid
1713
 
        gid = pwd.getpwnam(u"_mandos").pw_gid
1714
 
    except KeyError:
 
2323
    for name in ("_mandos", "mandos", "nobody"):
1715
2324
        try:
1716
 
            uid = pwd.getpwnam(u"mandos").pw_uid
1717
 
            gid = pwd.getpwnam(u"mandos").pw_gid
 
2325
            uid = pwd.getpwnam(name).pw_uid
 
2326
            gid = pwd.getpwnam(name).pw_gid
 
2327
            break
1718
2328
        except KeyError:
1719
 
            try:
1720
 
                uid = pwd.getpwnam(u"nobody").pw_uid
1721
 
                gid = pwd.getpwnam(u"nobody").pw_gid
1722
 
            except KeyError:
1723
 
                uid = 65534
1724
 
                gid = 65534
 
2329
            continue
 
2330
    else:
 
2331
        uid = 65534
 
2332
        gid = 65534
1725
2333
    try:
1726
2334
        os.setgid(gid)
1727
2335
        os.setuid(uid)
1728
 
    except OSError, error:
1729
 
        if error[0] != errno.EPERM:
 
2336
    except OSError as error:
 
2337
        if error.errno != errno.EPERM:
1730
2338
            raise error
1731
2339
    
1732
 
    # Enable all possible GnuTLS debugging
1733
2340
    if debug:
 
2341
        # Enable all possible GnuTLS debugging
 
2342
        
1734
2343
        # "Use a log level over 10 to enable all debugging options."
1735
2344
        # - GnuTLS manual
1736
2345
        gnutls.library.functions.gnutls_global_set_log_level(11)
1737
2346
        
1738
2347
        @gnutls.library.types.gnutls_log_func
1739
2348
        def debug_gnutls(level, string):
1740
 
            logger.debug(u"GnuTLS: %s", string[:-1])
 
2349
            logger.debug("GnuTLS: %s", string[:-1])
1741
2350
        
1742
2351
        (gnutls.library.functions
1743
2352
         .gnutls_global_set_log_function(debug_gnutls))
 
2353
        
 
2354
        # Redirect stdin so all checkers get /dev/null
 
2355
        null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
 
2356
        os.dup2(null, sys.stdin.fileno())
 
2357
        if null > 2:
 
2358
            os.close(null)
 
2359
    
 
2360
    # Need to fork before connecting to D-Bus
 
2361
    if not debug:
 
2362
        # Close all input and output, do double fork, etc.
 
2363
        daemon()
 
2364
    
 
2365
    # multiprocessing will use threads, so before we use gobject we
 
2366
    # need to inform gobject that threads will be used.
 
2367
    gobject.threads_init()
1744
2368
    
1745
2369
    global main_loop
1746
2370
    # From the Avahi example code
1747
 
    DBusGMainLoop(set_as_default=True )
 
2371
    DBusGMainLoop(set_as_default=True)
1748
2372
    main_loop = gobject.MainLoop()
1749
2373
    bus = dbus.SystemBus()
1750
2374
    # End of Avahi example code
1751
2375
    if use_dbus:
1752
2376
        try:
1753
 
            bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos",
 
2377
            bus_name = dbus.service.BusName("se.recompile.Mandos",
1754
2378
                                            bus, do_not_queue=True)
1755
 
        except dbus.exceptions.NameExistsException, e:
1756
 
            logger.error(unicode(e) + u", disabling D-Bus")
 
2379
            old_bus_name = (dbus.service.BusName
 
2380
                            ("se.bsnet.fukt.Mandos", bus,
 
2381
                             do_not_queue=True))
 
2382
        except dbus.exceptions.NameExistsException as e:
 
2383
            logger.error("Disabling D-Bus:", exc_info=e)
1757
2384
            use_dbus = False
1758
 
            server_settings[u"use_dbus"] = False
 
2385
            server_settings["use_dbus"] = False
1759
2386
            tcp_server.use_dbus = False
1760
2387
    protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
1761
 
    service = AvahiService(name = server_settings[u"servicename"],
1762
 
                           servicetype = u"_mandos._tcp",
1763
 
                           protocol = protocol, bus = bus)
 
2388
    service = AvahiServiceToSyslog(name =
 
2389
                                   server_settings["servicename"],
 
2390
                                   servicetype = "_mandos._tcp",
 
2391
                                   protocol = protocol, bus = bus)
1764
2392
    if server_settings["interface"]:
1765
2393
        service.interface = (if_nametoindex
1766
 
                             (str(server_settings[u"interface"])))
 
2394
                             (str(server_settings["interface"])))
 
2395
    
 
2396
    global multiprocessing_manager
 
2397
    multiprocessing_manager = multiprocessing.Manager()
1767
2398
    
1768
2399
    client_class = Client
1769
2400
    if use_dbus:
1770
2401
        client_class = functools.partial(ClientDBus, bus = bus)
1771
 
    def client_config_items(config, section):
1772
 
        special_settings = {
1773
 
            "approved_by_default":
1774
 
                lambda: config.getboolean(section,
1775
 
                                          "approved_by_default"),
1776
 
            }
1777
 
        for name, value in config.items(section):
 
2402
    
 
2403
    client_settings = Client.config_parser(client_config)
 
2404
    old_client_settings = {}
 
2405
    clients_data = {}
 
2406
    
 
2407
    # Get client data and settings from last running state.
 
2408
    if server_settings["restore"]:
 
2409
        try:
 
2410
            with open(stored_state_path, "rb") as stored_state:
 
2411
                clients_data, old_client_settings = (pickle.load
 
2412
                                                     (stored_state))
 
2413
            os.remove(stored_state_path)
 
2414
        except IOError as e:
 
2415
            if e.errno == errno.ENOENT:
 
2416
                logger.warning("Could not load persistent state: {0}"
 
2417
                                .format(os.strerror(e.errno)))
 
2418
            else:
 
2419
                logger.critical("Could not load persistent state:",
 
2420
                                exc_info=e)
 
2421
                raise
 
2422
        except EOFError as e:
 
2423
            logger.warning("Could not load persistent state: "
 
2424
                           "EOFError:", exc_info=e)
 
2425
    
 
2426
    with PGPEngine() as pgp:
 
2427
        for client_name, client in clients_data.iteritems():
 
2428
            # Decide which value to use after restoring saved state.
 
2429
            # We have three different values: Old config file,
 
2430
            # new config file, and saved state.
 
2431
            # New config value takes precedence if it differs from old
 
2432
            # config value, otherwise use saved state.
 
2433
            for name, value in client_settings[client_name].items():
 
2434
                try:
 
2435
                    # For each value in new config, check if it
 
2436
                    # differs from the old config value (Except for
 
2437
                    # the "secret" attribute)
 
2438
                    if (name != "secret" and
 
2439
                        value != old_client_settings[client_name]
 
2440
                        [name]):
 
2441
                        client[name] = value
 
2442
                except KeyError:
 
2443
                    pass
 
2444
            
 
2445
            # Clients who has passed its expire date can still be
 
2446
            # enabled if its last checker was successful.  Clients
 
2447
            # whose checker succeeded before we stored its state is
 
2448
            # assumed to have successfully run all checkers during
 
2449
            # downtime.
 
2450
            if client["enabled"]:
 
2451
                if datetime.datetime.utcnow() >= client["expires"]:
 
2452
                    if not client["last_checked_ok"]:
 
2453
                        logger.warning(
 
2454
                            "disabling client {0} - Client never "
 
2455
                            "performed a successful checker"
 
2456
                            .format(client_name))
 
2457
                        client["enabled"] = False
 
2458
                    elif client["last_checker_status"] != 0:
 
2459
                        logger.warning(
 
2460
                            "disabling client {0} - Client "
 
2461
                            "last checker failed with error code {1}"
 
2462
                            .format(client_name,
 
2463
                                    client["last_checker_status"]))
 
2464
                        client["enabled"] = False
 
2465
                    else:
 
2466
                        client["expires"] = (datetime.datetime
 
2467
                                             .utcnow()
 
2468
                                             + client["timeout"])
 
2469
                        logger.debug("Last checker succeeded,"
 
2470
                                     " keeping {0} enabled"
 
2471
                                     .format(client_name))
1778
2472
            try:
1779
 
                yield (name, special_settings[name]())
1780
 
            except KeyError:
1781
 
                yield (name, value)
1782
 
    
1783
 
    tcp_server.clients.update(set(
1784
 
            client_class(name = section,
1785
 
                         config= dict(client_config_items(
1786
 
                        client_config, section)))
1787
 
            for section in client_config.sections()))
 
2473
                client["secret"] = (
 
2474
                    pgp.decrypt(client["encrypted_secret"],
 
2475
                                client_settings[client_name]
 
2476
                                ["secret"]))
 
2477
            except PGPError:
 
2478
                # If decryption fails, we use secret from new settings
 
2479
                logger.debug("Failed to decrypt {0} old secret"
 
2480
                             .format(client_name))
 
2481
                client["secret"] = (
 
2482
                    client_settings[client_name]["secret"])
 
2483
    
 
2484
    # Add/remove clients based on new changes made to config
 
2485
    for client_name in (set(old_client_settings)
 
2486
                        - set(client_settings)):
 
2487
        del clients_data[client_name]
 
2488
    for client_name in (set(client_settings)
 
2489
                        - set(old_client_settings)):
 
2490
        clients_data[client_name] = client_settings[client_name]
 
2491
    
 
2492
    # Create all client objects
 
2493
    for client_name, client in clients_data.iteritems():
 
2494
        tcp_server.clients[client_name] = client_class(
 
2495
            name = client_name, settings = client)
 
2496
    
1788
2497
    if not tcp_server.clients:
1789
 
        logger.warning(u"No clients defined")
1790
 
    
1791
 
    if debug:
1792
 
        # Redirect stdin so all checkers get /dev/null
1793
 
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1794
 
        os.dup2(null, sys.stdin.fileno())
1795
 
        if null > 2:
1796
 
            os.close(null)
1797
 
    else:
1798
 
        # No console logging
1799
 
        logger.removeHandler(console)
1800
 
        # Close all input and output, do double fork, etc.
1801
 
        daemon()
1802
 
    
1803
 
    try:
1804
 
        with pidfile:
1805
 
            pid = os.getpid()
1806
 
            pidfile.write(str(pid) + "\n")
1807
 
        del pidfile
1808
 
    except IOError:
1809
 
        logger.error(u"Could not write to file %r with PID %d",
1810
 
                     pidfilename, pid)
1811
 
    except NameError:
1812
 
        # "pidfile" was never created
1813
 
        pass
1814
 
    del pidfilename
 
2498
        logger.warning("No clients defined")
1815
2499
    
1816
2500
    if not debug:
1817
 
        signal.signal(signal.SIGINT, signal.SIG_IGN)
 
2501
        try:
 
2502
            with pidfile:
 
2503
                pid = os.getpid()
 
2504
                pidfile.write(str(pid) + "\n".encode("utf-8"))
 
2505
            del pidfile
 
2506
        except IOError:
 
2507
            logger.error("Could not write to file %r with PID %d",
 
2508
                         pidfilename, pid)
 
2509
        except NameError:
 
2510
            # "pidfile" was never created
 
2511
            pass
 
2512
        del pidfilename
 
2513
    
1818
2514
    signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
1819
2515
    signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
1820
2516
    
1821
2517
    if use_dbus:
1822
 
        class MandosDBusService(dbus.service.Object):
 
2518
        @alternate_dbus_interfaces({"se.recompile.Mandos":
 
2519
                                        "se.bsnet.fukt.Mandos"})
 
2520
        class MandosDBusService(DBusObjectWithProperties):
1823
2521
            """A D-Bus proxy object"""
1824
2522
            def __init__(self):
1825
 
                dbus.service.Object.__init__(self, bus, u"/")
1826
 
            _interface = u"se.bsnet.fukt.Mandos"
1827
 
            
1828
 
            @dbus.service.signal(_interface, signature=u"o")
 
2523
                dbus.service.Object.__init__(self, bus, "/")
 
2524
            _interface = "se.recompile.Mandos"
 
2525
            
 
2526
            @dbus_interface_annotations(_interface)
 
2527
            def _foo(self):
 
2528
                return { "org.freedesktop.DBus.Property"
 
2529
                         ".EmitsChangedSignal":
 
2530
                             "false"}
 
2531
            
 
2532
            @dbus.service.signal(_interface, signature="o")
1829
2533
            def ClientAdded(self, objpath):
1830
2534
                "D-Bus signal"
1831
2535
                pass
1832
2536
            
1833
 
            @dbus.service.signal(_interface, signature=u"ss")
 
2537
            @dbus.service.signal(_interface, signature="ss")
1834
2538
            def ClientNotFound(self, fingerprint, address):
1835
2539
                "D-Bus signal"
1836
2540
                pass
1837
2541
            
1838
 
            @dbus.service.signal(_interface, signature=u"os")
 
2542
            @dbus.service.signal(_interface, signature="os")
1839
2543
            def ClientRemoved(self, objpath, name):
1840
2544
                "D-Bus signal"
1841
2545
                pass
1842
2546
            
1843
 
            @dbus.service.method(_interface, out_signature=u"ao")
 
2547
            @dbus.service.method(_interface, out_signature="ao")
1844
2548
            def GetAllClients(self):
1845
2549
                "D-Bus method"
1846
2550
                return dbus.Array(c.dbus_object_path
1847
 
                                  for c in tcp_server.clients)
 
2551
                                  for c in
 
2552
                                  tcp_server.clients.itervalues())
1848
2553
            
1849
2554
            @dbus.service.method(_interface,
1850
 
                                 out_signature=u"a{oa{sv}}")
 
2555
                                 out_signature="a{oa{sv}}")
1851
2556
            def GetAllClientsWithProperties(self):
1852
2557
                "D-Bus method"
1853
2558
                return dbus.Dictionary(
1854
 
                    ((c.dbus_object_path, c.GetAll(u""))
1855
 
                     for c in tcp_server.clients),
1856
 
                    signature=u"oa{sv}")
 
2559
                    ((c.dbus_object_path, c.GetAll(""))
 
2560
                     for c in tcp_server.clients.itervalues()),
 
2561
                    signature="oa{sv}")
1857
2562
            
1858
 
            @dbus.service.method(_interface, in_signature=u"o")
 
2563
            @dbus.service.method(_interface, in_signature="o")
1859
2564
            def RemoveClient(self, object_path):
1860
2565
                "D-Bus method"
1861
 
                for c in tcp_server.clients:
 
2566
                for c in tcp_server.clients.itervalues():
1862
2567
                    if c.dbus_object_path == object_path:
1863
 
                        tcp_server.clients.remove(c)
 
2568
                        del tcp_server.clients[c.name]
1864
2569
                        c.remove_from_connection()
1865
2570
                        # Don't signal anything except ClientRemoved
1866
2571
                        c.disable(quiet=True)
1877
2582
        "Cleanup function; run on exit"
1878
2583
        service.cleanup()
1879
2584
        
 
2585
        multiprocessing.active_children()
 
2586
        if not (tcp_server.clients or client_settings):
 
2587
            return
 
2588
        
 
2589
        # Store client before exiting. Secrets are encrypted with key
 
2590
        # based on what config file has. If config file is
 
2591
        # removed/edited, old secret will thus be unrecovable.
 
2592
        clients = {}
 
2593
        with PGPEngine() as pgp:
 
2594
            for client in tcp_server.clients.itervalues():
 
2595
                key = client_settings[client.name]["secret"]
 
2596
                client.encrypted_secret = pgp.encrypt(client.secret,
 
2597
                                                      key)
 
2598
                client_dict = {}
 
2599
                
 
2600
                # A list of attributes that can not be pickled
 
2601
                # + secret.
 
2602
                exclude = set(("bus", "changedstate", "secret",
 
2603
                               "checker"))
 
2604
                for name, typ in (inspect.getmembers
 
2605
                                  (dbus.service.Object)):
 
2606
                    exclude.add(name)
 
2607
                
 
2608
                client_dict["encrypted_secret"] = (client
 
2609
                                                   .encrypted_secret)
 
2610
                for attr in client.client_structure:
 
2611
                    if attr not in exclude:
 
2612
                        client_dict[attr] = getattr(client, attr)
 
2613
                
 
2614
                clients[client.name] = client_dict
 
2615
                del client_settings[client.name]["secret"]
 
2616
        
 
2617
        try:
 
2618
            with (tempfile.NamedTemporaryFile
 
2619
                  (mode='wb', suffix=".pickle", prefix='clients-',
 
2620
                   dir=os.path.dirname(stored_state_path),
 
2621
                   delete=False)) as stored_state:
 
2622
                pickle.dump((clients, client_settings), stored_state)
 
2623
                tempname=stored_state.name
 
2624
            os.rename(tempname, stored_state_path)
 
2625
        except (IOError, OSError) as e:
 
2626
            if not debug:
 
2627
                try:
 
2628
                    os.remove(tempname)
 
2629
                except NameError:
 
2630
                    pass
 
2631
            if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
 
2632
                logger.warning("Could not save persistent state: {0}"
 
2633
                               .format(os.strerror(e.errno)))
 
2634
            else:
 
2635
                logger.warning("Could not save persistent state:",
 
2636
                               exc_info=e)
 
2637
                raise e
 
2638
        
 
2639
        # Delete all clients, and settings from config
1880
2640
        while tcp_server.clients:
1881
 
            client = tcp_server.clients.pop()
 
2641
            name, client = tcp_server.clients.popitem()
1882
2642
            if use_dbus:
1883
2643
                client.remove_from_connection()
1884
 
            client.disable_hook = None
1885
2644
            # Don't signal anything except ClientRemoved
1886
2645
            client.disable(quiet=True)
1887
2646
            if use_dbus:
1888
2647
                # Emit D-Bus signal
1889
 
                mandos_dbus_service.ClientRemoved(client.dbus_object_path,
 
2648
                mandos_dbus_service.ClientRemoved(client
 
2649
                                                  .dbus_object_path,
1890
2650
                                                  client.name)
 
2651
        client_settings.clear()
1891
2652
    
1892
2653
    atexit.register(cleanup)
1893
2654
    
1894
 
    for client in tcp_server.clients:
 
2655
    for client in tcp_server.clients.itervalues():
1895
2656
        if use_dbus:
1896
2657
            # Emit D-Bus signal
1897
2658
            mandos_dbus_service.ClientAdded(client.dbus_object_path)
1898
 
        client.enable()
 
2659
        # Need to initiate checking of clients
 
2660
        if client.enabled:
 
2661
            client.init_checker()
1899
2662
    
1900
2663
    tcp_server.enable()
1901
2664
    tcp_server.server_activate()
1903
2666
    # Find out what port we got
1904
2667
    service.port = tcp_server.socket.getsockname()[1]
1905
2668
    if use_ipv6:
1906
 
        logger.info(u"Now listening on address %r, port %d,"
1907
 
                    " flowinfo %d, scope_id %d"
1908
 
                    % tcp_server.socket.getsockname())
 
2669
        logger.info("Now listening on address %r, port %d,"
 
2670
                    " flowinfo %d, scope_id %d",
 
2671
                    *tcp_server.socket.getsockname())
1909
2672
    else:                       # IPv4
1910
 
        logger.info(u"Now listening on address %r, port %d"
1911
 
                    % tcp_server.socket.getsockname())
 
2673
        logger.info("Now listening on address %r, port %d",
 
2674
                    *tcp_server.socket.getsockname())
1912
2675
    
1913
2676
    #service.interface = tcp_server.socket.getsockname()[3]
1914
2677
    
1916
2679
        # From the Avahi example code
1917
2680
        try:
1918
2681
            service.activate()
1919
 
        except dbus.exceptions.DBusException, error:
1920
 
            logger.critical(u"DBusException: %s", error)
 
2682
        except dbus.exceptions.DBusException as error:
 
2683
            logger.critical("D-Bus Exception", exc_info=error)
1921
2684
            cleanup()
1922
2685
            sys.exit(1)
1923
2686
        # End of Avahi example code
1927
2690
                             (tcp_server.handle_request
1928
2691
                              (*args[2:], **kwargs) or True))
1929
2692
        
1930
 
        logger.debug(u"Starting main loop")
 
2693
        logger.debug("Starting main loop")
1931
2694
        main_loop.run()
1932
 
    except AvahiError, error:
1933
 
        logger.critical(u"AvahiError: %s", error)
 
2695
    except AvahiError as error:
 
2696
        logger.critical("Avahi Error", exc_info=error)
1934
2697
        cleanup()
1935
2698
        sys.exit(1)
1936
2699
    except KeyboardInterrupt:
1937
2700
        if debug:
1938
 
            print >> sys.stderr
1939
 
        logger.debug(u"Server received KeyboardInterrupt")
1940
 
    logger.debug(u"Server exiting")
 
2701
            print("", file=sys.stderr)
 
2702
        logger.debug("Server received KeyboardInterrupt")
 
2703
    logger.debug("Server exiting")
1941
2704
    # Must run before the D-Bus bus name gets deregistered
1942
2705
    cleanup()
1943
2706