/mandos/release

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/release

« back to all changes in this revision

Viewing changes to mandos

  • Committer: Teddy Hogeborn
  • Date: 2012-06-17 14:55:31 UTC
  • mto: (301.1.1 release) (237.7.272 trunk)
  • mto: This revision was merged to the branch mainline in revision 302.
  • Revision ID: teddy@recompile.se-20120617145531-o24z982oerm6xb6s
* mandos: New "--foreground" option.

Show diffs side-by-side

added added

removed removed

Lines of Context:
11
11
# "AvahiService" class, and some lines in "main".
12
12
13
13
# Everything else is
14
 
# Copyright © 2008-2011 Teddy Hogeborn
15
 
# Copyright © 2008-2011 Björn Påhlsson
 
14
# Copyright © 2008-2012 Teddy Hogeborn
 
15
# Copyright © 2008-2012 Björn Påhlsson
16
16
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
28
28
# along with this program.  If not, see
29
29
# <http://www.gnu.org/licenses/>.
30
30
31
 
# Contact the authors at <mandos@fukt.bsnet.se>.
 
31
# Contact the authors at <mandos@recompile.se>.
32
32
33
33
 
34
34
from __future__ import (division, absolute_import, print_function,
35
35
                        unicode_literals)
36
36
 
 
37
from future_builtins import *
 
38
 
37
39
import SocketServer as socketserver
38
40
import socket
39
41
import argparse
63
65
import cPickle as pickle
64
66
import multiprocessing
65
67
import types
 
68
import binascii
 
69
import tempfile
 
70
import itertools
66
71
 
67
72
import dbus
68
73
import dbus.service
73
78
import ctypes.util
74
79
import xml.dom.minidom
75
80
import inspect
 
81
import GnuPGInterface
76
82
 
77
83
try:
78
84
    SO_BINDTODEVICE = socket.SO_BINDTODEVICE
82
88
    except ImportError:
83
89
        SO_BINDTODEVICE = None
84
90
 
85
 
 
86
 
version = "1.3.1"
87
 
 
88
 
#logger = logging.getLogger('mandos')
89
 
logger = logging.Logger('mandos')
 
91
version = "1.5.5"
 
92
stored_state_file = "clients.pickle"
 
93
 
 
94
logger = logging.getLogger()
90
95
syslogger = (logging.handlers.SysLogHandler
91
96
             (facility = logging.handlers.SysLogHandler.LOG_DAEMON,
92
97
              address = str("/dev/log")))
93
 
syslogger.setFormatter(logging.Formatter
94
 
                       ('Mandos [%(process)d]: %(levelname)s:'
95
 
                        ' %(message)s'))
96
 
logger.addHandler(syslogger)
97
 
 
98
 
console = logging.StreamHandler()
99
 
console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'
100
 
                                       ' %(levelname)s:'
101
 
                                       ' %(message)s'))
102
 
logger.addHandler(console)
 
98
 
 
99
try:
 
100
    if_nametoindex = (ctypes.cdll.LoadLibrary
 
101
                      (ctypes.util.find_library("c"))
 
102
                      .if_nametoindex)
 
103
except (OSError, AttributeError):
 
104
    def if_nametoindex(interface):
 
105
        "Get an interface index the hard way, i.e. using fcntl()"
 
106
        SIOCGIFINDEX = 0x8933  # From /usr/include/linux/sockios.h
 
107
        with contextlib.closing(socket.socket()) as s:
 
108
            ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
 
109
                                struct.pack(str("16s16x"),
 
110
                                            interface))
 
111
        interface_index = struct.unpack(str("I"),
 
112
                                        ifreq[16:20])[0]
 
113
        return interface_index
 
114
 
 
115
 
 
116
def initlogger(debug, level=logging.WARNING):
 
117
    """init logger and add loglevel"""
 
118
    
 
119
    syslogger.setFormatter(logging.Formatter
 
120
                           ('Mandos [%(process)d]: %(levelname)s:'
 
121
                            ' %(message)s'))
 
122
    logger.addHandler(syslogger)
 
123
    
 
124
    if debug:
 
125
        console = logging.StreamHandler()
 
126
        console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
 
127
                                               ' [%(process)d]:'
 
128
                                               ' %(levelname)s:'
 
129
                                               ' %(message)s'))
 
130
        logger.addHandler(console)
 
131
    logger.setLevel(level)
 
132
 
 
133
 
 
134
class PGPError(Exception):
 
135
    """Exception if encryption/decryption fails"""
 
136
    pass
 
137
 
 
138
 
 
139
class PGPEngine(object):
 
140
    """A simple class for OpenPGP symmetric encryption & decryption"""
 
141
    def __init__(self):
 
142
        self.gnupg = GnuPGInterface.GnuPG()
 
143
        self.tempdir = tempfile.mkdtemp(prefix="mandos-")
 
144
        self.gnupg = GnuPGInterface.GnuPG()
 
145
        self.gnupg.options.meta_interactive = False
 
146
        self.gnupg.options.homedir = self.tempdir
 
147
        self.gnupg.options.extra_args.extend(['--force-mdc',
 
148
                                              '--quiet',
 
149
                                              '--no-use-agent'])
 
150
    
 
151
    def __enter__(self):
 
152
        return self
 
153
    
 
154
    def __exit__(self, exc_type, exc_value, traceback):
 
155
        self._cleanup()
 
156
        return False
 
157
    
 
158
    def __del__(self):
 
159
        self._cleanup()
 
160
    
 
161
    def _cleanup(self):
 
162
        if self.tempdir is not None:
 
163
            # Delete contents of tempdir
 
164
            for root, dirs, files in os.walk(self.tempdir,
 
165
                                             topdown = False):
 
166
                for filename in files:
 
167
                    os.remove(os.path.join(root, filename))
 
168
                for dirname in dirs:
 
169
                    os.rmdir(os.path.join(root, dirname))
 
170
            # Remove tempdir
 
171
            os.rmdir(self.tempdir)
 
172
            self.tempdir = None
 
173
    
 
174
    def password_encode(self, password):
 
175
        # Passphrase can not be empty and can not contain newlines or
 
176
        # NUL bytes.  So we prefix it and hex encode it.
 
177
        return b"mandos" + binascii.hexlify(password)
 
178
    
 
179
    def encrypt(self, data, password):
 
180
        self.gnupg.passphrase = self.password_encode(password)
 
181
        with open(os.devnull, "w") as devnull:
 
182
            try:
 
183
                proc = self.gnupg.run(['--symmetric'],
 
184
                                      create_fhs=['stdin', 'stdout'],
 
185
                                      attach_fhs={'stderr': devnull})
 
186
                with contextlib.closing(proc.handles['stdin']) as f:
 
187
                    f.write(data)
 
188
                with contextlib.closing(proc.handles['stdout']) as f:
 
189
                    ciphertext = f.read()
 
190
                proc.wait()
 
191
            except IOError as e:
 
192
                raise PGPError(e)
 
193
        self.gnupg.passphrase = None
 
194
        return ciphertext
 
195
    
 
196
    def decrypt(self, data, password):
 
197
        self.gnupg.passphrase = self.password_encode(password)
 
198
        with open(os.devnull, "w") as devnull:
 
199
            try:
 
200
                proc = self.gnupg.run(['--decrypt'],
 
201
                                      create_fhs=['stdin', 'stdout'],
 
202
                                      attach_fhs={'stderr': devnull})
 
203
                with contextlib.closing(proc.handles['stdin']) as f:
 
204
                    f.write(data)
 
205
                with contextlib.closing(proc.handles['stdout']) as f:
 
206
                    decrypted_plaintext = f.read()
 
207
                proc.wait()
 
208
            except IOError as e:
 
209
                raise PGPError(e)
 
210
        self.gnupg.passphrase = None
 
211
        return decrypted_plaintext
 
212
 
103
213
 
104
214
class AvahiError(Exception):
105
215
    def __init__(self, value, *args, **kwargs):
135
245
    server: D-Bus Server
136
246
    bus: dbus.SystemBus()
137
247
    """
 
248
    
138
249
    def __init__(self, interface = avahi.IF_UNSPEC, name = None,
139
250
                 servicetype = None, port = None, TXT = None,
140
251
                 domain = "", host = "", max_renames = 32768,
153
264
        self.server = None
154
265
        self.bus = bus
155
266
        self.entry_group_state_changed_match = None
 
267
    
156
268
    def rename(self):
157
269
        """Derived from the Avahi example code"""
158
270
        if self.rename_count >= self.max_renames:
160
272
                            " after %i retries, exiting.",
161
273
                            self.rename_count)
162
274
            raise AvahiServiceError("Too many renames")
163
 
        self.name = unicode(self.server.GetAlternativeServiceName(self.name))
 
275
        self.name = unicode(self.server
 
276
                            .GetAlternativeServiceName(self.name))
164
277
        logger.info("Changing Zeroconf service name to %r ...",
165
278
                    self.name)
166
 
        syslogger.setFormatter(logging.Formatter
167
 
                               ('Mandos (%s) [%%(process)d]:'
168
 
                                ' %%(levelname)s: %%(message)s'
169
 
                                % self.name))
170
279
        self.remove()
171
280
        try:
172
281
            self.add()
173
282
        except dbus.exceptions.DBusException as error:
174
 
            logger.critical("DBusException: %s", error)
 
283
            logger.critical("D-Bus Exception", exc_info=error)
175
284
            self.cleanup()
176
285
            os._exit(1)
177
286
        self.rename_count += 1
 
287
    
178
288
    def remove(self):
179
289
        """Derived from the Avahi example code"""
180
290
        if self.entry_group_state_changed_match is not None:
182
292
            self.entry_group_state_changed_match = None
183
293
        if self.group is not None:
184
294
            self.group.Reset()
 
295
    
185
296
    def add(self):
186
297
        """Derived from the Avahi example code"""
187
298
        self.remove()
192
303
                avahi.DBUS_INTERFACE_ENTRY_GROUP)
193
304
        self.entry_group_state_changed_match = (
194
305
            self.group.connect_to_signal(
195
 
                'StateChanged', self .entry_group_state_changed))
 
306
                'StateChanged', self.entry_group_state_changed))
196
307
        logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
197
308
                     self.name, self.type)
198
309
        self.group.AddService(
204
315
            dbus.UInt16(self.port),
205
316
            avahi.string_array_to_txt_array(self.TXT))
206
317
        self.group.Commit()
 
318
    
207
319
    def entry_group_state_changed(self, state, error):
208
320
        """Derived from the Avahi example code"""
209
321
        logger.debug("Avahi entry group state change: %i", state)
216
328
        elif state == avahi.ENTRY_GROUP_FAILURE:
217
329
            logger.critical("Avahi: Error in group state changed %s",
218
330
                            unicode(error))
219
 
            raise AvahiGroupError("State changed: %s"
220
 
                                  % unicode(error))
 
331
            raise AvahiGroupError("State changed: {0!s}"
 
332
                                  .format(error))
 
333
    
221
334
    def cleanup(self):
222
335
        """Derived from the Avahi example code"""
223
336
        if self.group is not None:
224
337
            try:
225
338
                self.group.Free()
226
339
            except (dbus.exceptions.UnknownMethodException,
227
 
                    dbus.exceptions.DBusException) as e:
 
340
                    dbus.exceptions.DBusException):
228
341
                pass
229
342
            self.group = None
230
343
        self.remove()
 
344
    
231
345
    def server_state_changed(self, state, error=None):
232
346
        """Derived from the Avahi example code"""
233
347
        logger.debug("Avahi server state change: %i", state)
252
366
                logger.debug("Unknown state: %r", state)
253
367
            else:
254
368
                logger.debug("Unknown state: %r: %r", state, error)
 
369
    
255
370
    def activate(self):
256
371
        """Derived from the Avahi example code"""
257
372
        if self.server is None:
265
380
        self.server_state_changed(self.server.GetState())
266
381
 
267
382
 
268
 
def _timedelta_to_milliseconds(td):
 
383
class AvahiServiceToSyslog(AvahiService):
 
384
    def rename(self):
 
385
        """Add the new name to the syslog messages"""
 
386
        ret = AvahiService.rename(self)
 
387
        syslogger.setFormatter(logging.Formatter
 
388
                               ('Mandos ({0}) [%(process)d]:'
 
389
                                ' %(levelname)s: %(message)s'
 
390
                                .format(self.name)))
 
391
        return ret
 
392
 
 
393
 
 
394
def timedelta_to_milliseconds(td):
269
395
    "Convert a datetime.timedelta() to milliseconds"
270
396
    return ((td.days * 24 * 60 * 60 * 1000)
271
397
            + (td.seconds * 1000)
272
398
            + (td.microseconds // 1000))
273
 
        
 
399
 
 
400
 
274
401
class Client(object):
275
402
    """A representation of a client host served by this server.
276
403
    
277
404
    Attributes:
278
 
    _approved:   bool(); 'None' if not yet approved/disapproved
 
405
    approved:   bool(); 'None' if not yet approved/disapproved
279
406
    approval_delay: datetime.timedelta(); Time to wait for approval
280
407
    approval_duration: datetime.timedelta(); Duration of one approval
281
408
    checker:    subprocess.Popen(); a running checker process used
288
415
                     instance %(name)s can be used in the command.
289
416
    checker_initiator_tag: a gobject event source tag, or None
290
417
    created:    datetime.datetime(); (UTC) object creation
 
418
    client_structure: Object describing what attributes a client has
 
419
                      and is used for storing the client at exit
291
420
    current_checker_command: string; current running checker_command
292
 
    disable_hook:  If set, called by disable() as disable_hook(self)
293
421
    disable_initiator_tag: a gobject event source tag, or None
294
422
    enabled:    bool()
295
423
    fingerprint: string (40 or 32 hexadecimal digits); used to
298
426
    interval:   datetime.timedelta(); How often to start a new checker
299
427
    last_approval_request: datetime.datetime(); (UTC) or None
300
428
    last_checked_ok: datetime.datetime(); (UTC) or None
301
 
    last_enabled: datetime.datetime(); (UTC)
 
429
    last_checker_status: integer between 0 and 255 reflecting exit
 
430
                         status of last checker. -1 reflects crashed
 
431
                         checker, -2 means no checker completed yet.
 
432
    last_enabled: datetime.datetime(); (UTC) or None
302
433
    name:       string; from the config file, used in log messages and
303
434
                        D-Bus identifiers
304
435
    secret:     bytestring; sent verbatim (over TLS) to client
305
436
    timeout:    datetime.timedelta(); How long from last_checked_ok
306
437
                                      until this client is disabled
307
 
    extended_timeout:   extra long timeout when password has been sent
 
438
    extended_timeout:   extra long timeout when secret has been sent
308
439
    runtime_expansions: Allowed attributes for runtime expansion.
309
440
    expires:    datetime.datetime(); time (UTC) when a client will be
310
441
                disabled, or None
311
442
    """
312
443
    
313
444
    runtime_expansions = ("approval_delay", "approval_duration",
314
 
                          "created", "enabled", "fingerprint",
315
 
                          "host", "interval", "last_checked_ok",
 
445
                          "created", "enabled", "expires",
 
446
                          "fingerprint", "host", "interval",
 
447
                          "last_approval_request", "last_checked_ok",
316
448
                          "last_enabled", "name", "timeout")
 
449
    client_defaults = { "timeout": "5m",
 
450
                        "extended_timeout": "15m",
 
451
                        "interval": "2m",
 
452
                        "checker": "fping -q -- %%(host)s",
 
453
                        "host": "",
 
454
                        "approval_delay": "0s",
 
455
                        "approval_duration": "1s",
 
456
                        "approved_by_default": "True",
 
457
                        "enabled": "True",
 
458
                        }
317
459
    
318
460
    def timeout_milliseconds(self):
319
461
        "Return the 'timeout' attribute in milliseconds"
320
 
        return _timedelta_to_milliseconds(self.timeout)
 
462
        return timedelta_to_milliseconds(self.timeout)
321
463
    
322
464
    def extended_timeout_milliseconds(self):
323
465
        "Return the 'extended_timeout' attribute in milliseconds"
324
 
        return _timedelta_to_milliseconds(self.extended_timeout)    
 
466
        return timedelta_to_milliseconds(self.extended_timeout)
325
467
    
326
468
    def interval_milliseconds(self):
327
469
        "Return the 'interval' attribute in milliseconds"
328
 
        return _timedelta_to_milliseconds(self.interval)
 
470
        return timedelta_to_milliseconds(self.interval)
329
471
    
330
472
    def approval_delay_milliseconds(self):
331
 
        return _timedelta_to_milliseconds(self.approval_delay)
332
 
    
333
 
    def __init__(self, name = None, disable_hook=None, config=None):
334
 
        """Note: the 'checker' key in 'config' sets the
335
 
        'checker_command' attribute and *not* the 'checker'
336
 
        attribute."""
 
473
        return timedelta_to_milliseconds(self.approval_delay)
 
474
    
 
475
    @staticmethod
 
476
    def config_parser(config):
 
477
        """Construct a new dict of client settings of this form:
 
478
        { client_name: {setting_name: value, ...}, ...}
 
479
        with exceptions for any special settings as defined above.
 
480
        NOTE: Must be a pure function. Must return the same result
 
481
        value given the same arguments.
 
482
        """
 
483
        settings = {}
 
484
        for client_name in config.sections():
 
485
            section = dict(config.items(client_name))
 
486
            client = settings[client_name] = {}
 
487
            
 
488
            client["host"] = section["host"]
 
489
            # Reformat values from string types to Python types
 
490
            client["approved_by_default"] = config.getboolean(
 
491
                client_name, "approved_by_default")
 
492
            client["enabled"] = config.getboolean(client_name,
 
493
                                                  "enabled")
 
494
            
 
495
            client["fingerprint"] = (section["fingerprint"].upper()
 
496
                                     .replace(" ", ""))
 
497
            if "secret" in section:
 
498
                client["secret"] = section["secret"].decode("base64")
 
499
            elif "secfile" in section:
 
500
                with open(os.path.expanduser(os.path.expandvars
 
501
                                             (section["secfile"])),
 
502
                          "rb") as secfile:
 
503
                    client["secret"] = secfile.read()
 
504
            else:
 
505
                raise TypeError("No secret or secfile for section {0}"
 
506
                                .format(section))
 
507
            client["timeout"] = string_to_delta(section["timeout"])
 
508
            client["extended_timeout"] = string_to_delta(
 
509
                section["extended_timeout"])
 
510
            client["interval"] = string_to_delta(section["interval"])
 
511
            client["approval_delay"] = string_to_delta(
 
512
                section["approval_delay"])
 
513
            client["approval_duration"] = string_to_delta(
 
514
                section["approval_duration"])
 
515
            client["checker_command"] = section["checker"]
 
516
            client["last_approval_request"] = None
 
517
            client["last_checked_ok"] = None
 
518
            client["last_checker_status"] = -2
 
519
        
 
520
        return settings
 
521
    
 
522
    def __init__(self, settings, name = None):
337
523
        self.name = name
338
 
        if config is None:
339
 
            config = {}
 
524
        # adding all client settings
 
525
        for setting, value in settings.iteritems():
 
526
            setattr(self, setting, value)
 
527
        
 
528
        if self.enabled:
 
529
            if not hasattr(self, "last_enabled"):
 
530
                self.last_enabled = datetime.datetime.utcnow()
 
531
            if not hasattr(self, "expires"):
 
532
                self.expires = (datetime.datetime.utcnow()
 
533
                                + self.timeout)
 
534
        else:
 
535
            self.last_enabled = None
 
536
            self.expires = None
 
537
        
340
538
        logger.debug("Creating client %r", self.name)
341
539
        # Uppercase and remove spaces from fingerprint for later
342
540
        # comparison purposes with return value from the fingerprint()
343
541
        # function
344
 
        self.fingerprint = (config["fingerprint"].upper()
345
 
                            .replace(" ", ""))
346
542
        logger.debug("  Fingerprint: %s", self.fingerprint)
347
 
        if "secret" in config:
348
 
            self.secret = config["secret"].decode("base64")
349
 
        elif "secfile" in config:
350
 
            with open(os.path.expanduser(os.path.expandvars
351
 
                                         (config["secfile"])),
352
 
                      "rb") as secfile:
353
 
                self.secret = secfile.read()
354
 
        else:
355
 
            raise TypeError("No secret or secfile for client %s"
356
 
                            % self.name)
357
 
        self.host = config.get("host", "")
358
 
        self.created = datetime.datetime.utcnow()
359
 
        self.enabled = False
360
 
        self.last_approval_request = None
361
 
        self.last_enabled = None
362
 
        self.last_checked_ok = None
363
 
        self.timeout = string_to_delta(config["timeout"])
364
 
        self.extended_timeout = string_to_delta(config["extended_timeout"])
365
 
        self.interval = string_to_delta(config["interval"])
366
 
        self.disable_hook = disable_hook
 
543
        self.created = settings.get("created",
 
544
                                    datetime.datetime.utcnow())
 
545
        
 
546
        # attributes specific for this server instance
367
547
        self.checker = None
368
548
        self.checker_initiator_tag = None
369
549
        self.disable_initiator_tag = None
370
 
        self.expires = None
371
550
        self.checker_callback_tag = None
372
 
        self.checker_command = config["checker"]
373
551
        self.current_checker_command = None
374
 
        self.last_connect = None
375
 
        self._approved = None
376
 
        self.approved_by_default = config.get("approved_by_default",
377
 
                                              True)
 
552
        self.approved = None
378
553
        self.approvals_pending = 0
379
 
        self.approval_delay = string_to_delta(
380
 
            config["approval_delay"])
381
 
        self.approval_duration = string_to_delta(
382
 
            config["approval_duration"])
383
 
        self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())
 
554
        self.changedstate = (multiprocessing_manager
 
555
                             .Condition(multiprocessing_manager
 
556
                                        .Lock()))
 
557
        self.client_structure = [attr for attr in
 
558
                                 self.__dict__.iterkeys()
 
559
                                 if not attr.startswith("_")]
 
560
        self.client_structure.append("client_structure")
 
561
        
 
562
        for name, t in inspect.getmembers(type(self),
 
563
                                          lambda obj:
 
564
                                              isinstance(obj,
 
565
                                                         property)):
 
566
            if not name.startswith("_"):
 
567
                self.client_structure.append(name)
384
568
    
 
569
    # Send notice to process children that client state has changed
385
570
    def send_changedstate(self):
386
 
        self.changedstate.acquire()
387
 
        self.changedstate.notify_all()
388
 
        self.changedstate.release()
389
 
        
 
571
        with self.changedstate:
 
572
            self.changedstate.notify_all()
 
573
    
390
574
    def enable(self):
391
575
        """Start this client's checker and timeout hooks"""
392
576
        if getattr(self, "enabled", False):
393
577
            # Already enabled
394
578
            return
 
579
        self.expires = datetime.datetime.utcnow() + self.timeout
 
580
        self.enabled = True
 
581
        self.last_enabled = datetime.datetime.utcnow()
 
582
        self.init_checker()
395
583
        self.send_changedstate()
 
584
    
 
585
    def disable(self, quiet=True):
 
586
        """Disable this client."""
 
587
        if not getattr(self, "enabled", False):
 
588
            return False
 
589
        if not quiet:
 
590
            logger.info("Disabling client %s", self.name)
 
591
        if getattr(self, "disable_initiator_tag", None) is not None:
 
592
            gobject.source_remove(self.disable_initiator_tag)
 
593
            self.disable_initiator_tag = None
 
594
        self.expires = None
 
595
        if getattr(self, "checker_initiator_tag", None) is not None:
 
596
            gobject.source_remove(self.checker_initiator_tag)
 
597
            self.checker_initiator_tag = None
 
598
        self.stop_checker()
 
599
        self.enabled = False
 
600
        if not quiet:
 
601
            self.send_changedstate()
 
602
        # Do not run this again if called by a gobject.timeout_add
 
603
        return False
 
604
    
 
605
    def __del__(self):
 
606
        self.disable()
 
607
    
 
608
    def init_checker(self):
396
609
        # Schedule a new checker to be started an 'interval' from now,
397
610
        # and every interval from then on.
 
611
        if self.checker_initiator_tag is not None:
 
612
            gobject.source_remove(self.checker_initiator_tag)
398
613
        self.checker_initiator_tag = (gobject.timeout_add
399
614
                                      (self.interval_milliseconds(),
400
615
                                       self.start_checker))
401
616
        # Schedule a disable() when 'timeout' has passed
402
 
        self.expires = datetime.datetime.utcnow() + self.timeout
 
617
        if self.disable_initiator_tag is not None:
 
618
            gobject.source_remove(self.disable_initiator_tag)
403
619
        self.disable_initiator_tag = (gobject.timeout_add
404
620
                                   (self.timeout_milliseconds(),
405
621
                                    self.disable))
406
 
        self.enabled = True
407
 
        self.last_enabled = datetime.datetime.utcnow()
408
622
        # Also start a new checker *right now*.
409
623
        self.start_checker()
410
624
    
411
 
    def disable(self, quiet=True):
412
 
        """Disable this client."""
413
 
        if not getattr(self, "enabled", False):
414
 
            return False
415
 
        if not quiet:
416
 
            self.send_changedstate()
417
 
        if not quiet:
418
 
            logger.info("Disabling client %s", self.name)
419
 
        if getattr(self, "disable_initiator_tag", False):
420
 
            gobject.source_remove(self.disable_initiator_tag)
421
 
            self.disable_initiator_tag = None
422
 
        self.expires = None
423
 
        if getattr(self, "checker_initiator_tag", False):
424
 
            gobject.source_remove(self.checker_initiator_tag)
425
 
            self.checker_initiator_tag = None
426
 
        self.stop_checker()
427
 
        if self.disable_hook:
428
 
            self.disable_hook(self)
429
 
        self.enabled = False
430
 
        # Do not run this again if called by a gobject.timeout_add
431
 
        return False
432
 
    
433
 
    def __del__(self):
434
 
        self.disable_hook = None
435
 
        self.disable()
436
 
    
437
625
    def checker_callback(self, pid, condition, command):
438
626
        """The checker has completed, so take appropriate actions."""
439
627
        self.checker_callback_tag = None
440
628
        self.checker = None
441
629
        if os.WIFEXITED(condition):
442
 
            exitstatus = os.WEXITSTATUS(condition)
443
 
            if exitstatus == 0:
 
630
            self.last_checker_status = os.WEXITSTATUS(condition)
 
631
            if self.last_checker_status == 0:
444
632
                logger.info("Checker for %(name)s succeeded",
445
633
                            vars(self))
446
634
                self.checked_ok()
448
636
                logger.info("Checker for %(name)s failed",
449
637
                            vars(self))
450
638
        else:
 
639
            self.last_checker_status = -1
451
640
            logger.warning("Checker for %(name)s crashed?",
452
641
                           vars(self))
453
642
    
454
 
    def checked_ok(self, timeout=None):
455
 
        """Bump up the timeout for this client.
456
 
        
457
 
        This should only be called when the client has been seen,
458
 
        alive and well.
459
 
        """
 
643
    def checked_ok(self):
 
644
        """Assert that the client has been seen, alive and well."""
 
645
        self.last_checked_ok = datetime.datetime.utcnow()
 
646
        self.last_checker_status = 0
 
647
        self.bump_timeout()
 
648
    
 
649
    def bump_timeout(self, timeout=None):
 
650
        """Bump up the timeout for this client."""
460
651
        if timeout is None:
461
652
            timeout = self.timeout
462
 
        self.last_checked_ok = datetime.datetime.utcnow()
463
 
        gobject.source_remove(self.disable_initiator_tag)
464
 
        self.expires = datetime.datetime.utcnow() + timeout
465
 
        self.disable_initiator_tag = (gobject.timeout_add
466
 
                                      (_timedelta_to_milliseconds(timeout),
467
 
                                       self.disable))
 
653
        if self.disable_initiator_tag is not None:
 
654
            gobject.source_remove(self.disable_initiator_tag)
 
655
            self.disable_initiator_tag = None
 
656
        if getattr(self, "enabled", False):
 
657
            self.disable_initiator_tag = (gobject.timeout_add
 
658
                                          (timedelta_to_milliseconds
 
659
                                           (timeout), self.disable))
 
660
            self.expires = datetime.datetime.utcnow() + timeout
468
661
    
469
662
    def need_approval(self):
470
663
        self.last_approval_request = datetime.datetime.utcnow()
475
668
        If a checker already exists, leave it running and do
476
669
        nothing."""
477
670
        # The reason for not killing a running checker is that if we
478
 
        # did that, then if a checker (for some reason) started
479
 
        # running slowly and taking more than 'interval' time, the
480
 
        # client would inevitably timeout, since no checker would get
481
 
        # a chance to run to completion.  If we instead leave running
 
671
        # did that, and if a checker (for some reason) started running
 
672
        # slowly and taking more than 'interval' time, then the client
 
673
        # would inevitably timeout, since no checker would get a
 
674
        # chance to run to completion.  If we instead leave running
482
675
        # checkers alone, the checker would have to take more time
483
676
        # than 'timeout' for the client to be disabled, which is as it
484
677
        # should be.
498
691
                                      self.current_checker_command)
499
692
        # Start a new checker if needed
500
693
        if self.checker is None:
 
694
            # Escape attributes for the shell
 
695
            escaped_attrs = dict(
 
696
                (attr, re.escape(unicode(getattr(self, attr))))
 
697
                for attr in
 
698
                self.runtime_expansions)
501
699
            try:
502
 
                # In case checker_command has exactly one % operator
503
 
                command = self.checker_command % self.host
504
 
            except TypeError:
505
 
                # Escape attributes for the shell
506
 
                escaped_attrs = dict(
507
 
                    (attr,
508
 
                     re.escape(unicode(str(getattr(self, attr, "")),
509
 
                                       errors=
510
 
                                       'replace')))
511
 
                    for attr in
512
 
                    self.runtime_expansions)
513
 
                
514
 
                try:
515
 
                    command = self.checker_command % escaped_attrs
516
 
                except TypeError as error:
517
 
                    logger.error('Could not format string "%s":'
518
 
                                 ' %s', self.checker_command, error)
519
 
                    return True # Try again later
 
700
                command = self.checker_command % escaped_attrs
 
701
            except TypeError as error:
 
702
                logger.error('Could not format string "%s"',
 
703
                             self.checker_command, exc_info=error)
 
704
                return True # Try again later
520
705
            self.current_checker_command = command
521
706
            try:
522
707
                logger.info("Starting checker %r for %s",
528
713
                self.checker = subprocess.Popen(command,
529
714
                                                close_fds=True,
530
715
                                                shell=True, cwd="/")
531
 
                self.checker_callback_tag = (gobject.child_watch_add
532
 
                                             (self.checker.pid,
533
 
                                              self.checker_callback,
534
 
                                              data=command))
535
 
                # The checker may have completed before the gobject
536
 
                # watch was added.  Check for this.
537
 
                pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
538
 
                if pid:
539
 
                    gobject.source_remove(self.checker_callback_tag)
540
 
                    self.checker_callback(pid, status, command)
541
716
            except OSError as error:
542
 
                logger.error("Failed to start subprocess: %s",
543
 
                             error)
 
717
                logger.error("Failed to start subprocess",
 
718
                             exc_info=error)
 
719
            self.checker_callback_tag = (gobject.child_watch_add
 
720
                                         (self.checker.pid,
 
721
                                          self.checker_callback,
 
722
                                          data=command))
 
723
            # The checker may have completed before the gobject
 
724
            # watch was added.  Check for this.
 
725
            pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
 
726
            if pid:
 
727
                gobject.source_remove(self.checker_callback_tag)
 
728
                self.checker_callback(pid, status, command)
544
729
        # Re-run this periodically if run by gobject.timeout_add
545
730
        return True
546
731
    
553
738
            return
554
739
        logger.debug("Stopping checker for %(name)s", vars(self))
555
740
        try:
556
 
            os.kill(self.checker.pid, signal.SIGTERM)
 
741
            self.checker.terminate()
557
742
            #time.sleep(0.5)
558
743
            #if self.checker.poll() is None:
559
 
            #    os.kill(self.checker.pid, signal.SIGKILL)
 
744
            #    self.checker.kill()
560
745
        except OSError as error:
561
746
            if error.errno != errno.ESRCH: # No such process
562
747
                raise
579
764
    # "Set" method, so we fail early here:
580
765
    if byte_arrays and signature != "ay":
581
766
        raise ValueError("Byte arrays not supported for non-'ay'"
582
 
                         " signature %r" % signature)
 
767
                         " signature {0!r}".format(signature))
583
768
    def decorator(func):
584
769
        func._dbus_is_property = True
585
770
        func._dbus_interface = dbus_interface
593
778
    return decorator
594
779
 
595
780
 
 
781
def dbus_interface_annotations(dbus_interface):
 
782
    """Decorator for marking functions returning interface annotations
 
783
    
 
784
    Usage:
 
785
    
 
786
    @dbus_interface_annotations("org.example.Interface")
 
787
    def _foo(self):  # Function name does not matter
 
788
        return {"org.freedesktop.DBus.Deprecated": "true",
 
789
                "org.freedesktop.DBus.Property.EmitsChangedSignal":
 
790
                    "false"}
 
791
    """
 
792
    def decorator(func):
 
793
        func._dbus_is_interface = True
 
794
        func._dbus_interface = dbus_interface
 
795
        func._dbus_name = dbus_interface
 
796
        return func
 
797
    return decorator
 
798
 
 
799
 
 
800
def dbus_annotations(annotations):
 
801
    """Decorator to annotate D-Bus methods, signals or properties
 
802
    Usage:
 
803
    
 
804
    @dbus_service_property("org.example.Interface", signature="b",
 
805
                           access="r")
 
806
    @dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",
 
807
                        "org.freedesktop.DBus.Property."
 
808
                        "EmitsChangedSignal": "false"})
 
809
    def Property_dbus_property(self):
 
810
        return dbus.Boolean(False)
 
811
    """
 
812
    def decorator(func):
 
813
        func._dbus_annotations = annotations
 
814
        return func
 
815
    return decorator
 
816
 
 
817
 
596
818
class DBusPropertyException(dbus.exceptions.DBusException):
597
819
    """A base class for D-Bus property-related exceptions
598
820
    """
621
843
    """
622
844
    
623
845
    @staticmethod
624
 
    def _is_dbus_property(obj):
625
 
        return getattr(obj, "_dbus_is_property", False)
 
846
    def _is_dbus_thing(thing):
 
847
        """Returns a function testing if an attribute is a D-Bus thing
 
848
        
 
849
        If called like _is_dbus_thing("method") it returns a function
 
850
        suitable for use as predicate to inspect.getmembers().
 
851
        """
 
852
        return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),
 
853
                                   False)
626
854
    
627
 
    def _get_all_dbus_properties(self):
 
855
    def _get_all_dbus_things(self, thing):
628
856
        """Returns a generator of (name, attribute) pairs
629
857
        """
630
 
        return ((prop.__get__(self)._dbus_name, prop.__get__(self))
 
858
        return ((getattr(athing.__get__(self), "_dbus_name",
 
859
                         name),
 
860
                 athing.__get__(self))
631
861
                for cls in self.__class__.__mro__
632
 
                for name, prop in inspect.getmembers(cls, self._is_dbus_property))
 
862
                for name, athing in
 
863
                inspect.getmembers(cls,
 
864
                                   self._is_dbus_thing(thing)))
633
865
    
634
866
    def _get_dbus_property(self, interface_name, property_name):
635
867
        """Returns a bound method if one exists which is a D-Bus
636
868
        property with the specified name and interface.
637
869
        """
638
870
        for cls in  self.__class__.__mro__:
639
 
            for name, value in inspect.getmembers(cls, self._is_dbus_property):
640
 
                if value._dbus_name == property_name and value._dbus_interface == interface_name:
 
871
            for name, value in (inspect.getmembers
 
872
                                (cls,
 
873
                                 self._is_dbus_thing("property"))):
 
874
                if (value._dbus_name == property_name
 
875
                    and value._dbus_interface == interface_name):
641
876
                    return value.__get__(self)
642
877
        
643
878
        # No such property
670
905
            # signatures other than "ay".
671
906
            if prop._dbus_signature != "ay":
672
907
                raise ValueError
673
 
            value = dbus.ByteArray(''.join(unichr(byte)
674
 
                                           for byte in value))
 
908
            value = dbus.ByteArray(b''.join(chr(byte)
 
909
                                            for byte in value))
675
910
        prop(value)
676
911
    
677
912
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
682
917
        
683
918
        Note: Will not include properties with access="write".
684
919
        """
685
 
        all = {}
686
 
        for name, prop in self._get_all_dbus_properties():
 
920
        properties = {}
 
921
        for name, prop in self._get_all_dbus_things("property"):
687
922
            if (interface_name
688
923
                and interface_name != prop._dbus_interface):
689
924
                # Interface non-empty but did not match
693
928
                continue
694
929
            value = prop()
695
930
            if not hasattr(value, "variant_level"):
696
 
                all[name] = value
 
931
                properties[name] = value
697
932
                continue
698
 
            all[name] = type(value)(value, variant_level=
699
 
                                    value.variant_level+1)
700
 
        return dbus.Dictionary(all, signature="sv")
 
933
            properties[name] = type(value)(value, variant_level=
 
934
                                           value.variant_level+1)
 
935
        return dbus.Dictionary(properties, signature="sv")
701
936
    
702
937
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
703
938
                         out_signature="s",
704
939
                         path_keyword='object_path',
705
940
                         connection_keyword='connection')
706
941
    def Introspect(self, object_path, connection):
707
 
        """Standard D-Bus method, overloaded to insert property tags.
 
942
        """Overloading of standard D-Bus method.
 
943
        
 
944
        Inserts property tags and interface annotation tags.
708
945
        """
709
946
        xmlstring = dbus.service.Object.Introspect(self, object_path,
710
947
                                                   connection)
717
954
                e.setAttribute("access", prop._dbus_access)
718
955
                return e
719
956
            for if_tag in document.getElementsByTagName("interface"):
 
957
                # Add property tags
720
958
                for tag in (make_tag(document, name, prop)
721
959
                            for name, prop
722
 
                            in self._get_all_dbus_properties()
 
960
                            in self._get_all_dbus_things("property")
723
961
                            if prop._dbus_interface
724
962
                            == if_tag.getAttribute("name")):
725
963
                    if_tag.appendChild(tag)
 
964
                # Add annotation tags
 
965
                for typ in ("method", "signal", "property"):
 
966
                    for tag in if_tag.getElementsByTagName(typ):
 
967
                        annots = dict()
 
968
                        for name, prop in (self.
 
969
                                           _get_all_dbus_things(typ)):
 
970
                            if (name == tag.getAttribute("name")
 
971
                                and prop._dbus_interface
 
972
                                == if_tag.getAttribute("name")):
 
973
                                annots.update(getattr
 
974
                                              (prop,
 
975
                                               "_dbus_annotations",
 
976
                                               {}))
 
977
                        for name, value in annots.iteritems():
 
978
                            ann_tag = document.createElement(
 
979
                                "annotation")
 
980
                            ann_tag.setAttribute("name", name)
 
981
                            ann_tag.setAttribute("value", value)
 
982
                            tag.appendChild(ann_tag)
 
983
                # Add interface annotation tags
 
984
                for annotation, value in dict(
 
985
                    itertools.chain.from_iterable(
 
986
                        annotations().iteritems()
 
987
                        for name, annotations in
 
988
                        self._get_all_dbus_things("interface")
 
989
                        if name == if_tag.getAttribute("name")
 
990
                        )).iteritems():
 
991
                    ann_tag = document.createElement("annotation")
 
992
                    ann_tag.setAttribute("name", annotation)
 
993
                    ann_tag.setAttribute("value", value)
 
994
                    if_tag.appendChild(ann_tag)
726
995
                # Add the names to the return values for the
727
996
                # "org.freedesktop.DBus.Properties" methods
728
997
                if (if_tag.getAttribute("name")
743
1012
        except (AttributeError, xml.dom.DOMException,
744
1013
                xml.parsers.expat.ExpatError) as error:
745
1014
            logger.error("Failed to override Introspection method",
746
 
                         error)
 
1015
                         exc_info=error)
747
1016
        return xmlstring
748
1017
 
749
1018
 
750
 
def datetime_to_dbus (dt, variant_level=0):
 
1019
def datetime_to_dbus(dt, variant_level=0):
751
1020
    """Convert a UTC datetime.datetime() to a D-Bus type."""
752
1021
    if dt is None:
753
1022
        return dbus.String("", variant_level = variant_level)
754
1023
    return dbus.String(dt.isoformat(),
755
1024
                       variant_level=variant_level)
756
1025
 
757
 
class AlternateDBusNamesMetaclass(DBusObjectWithProperties.__metaclass__):
758
 
    """Applied to an empty subclass of a D-Bus object, this metaclass
759
 
    will add additional D-Bus attributes matching a certain pattern.
 
1026
 
 
1027
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
 
1028
    """A class decorator; applied to a subclass of
 
1029
    dbus.service.Object, it will add alternate D-Bus attributes with
 
1030
    interface names according to the "alt_interface_names" mapping.
 
1031
    Usage:
 
1032
    
 
1033
    @alternate_dbus_interfaces({"org.example.Interface":
 
1034
                                    "net.example.AlternateInterface"})
 
1035
    class SampleDBusObject(dbus.service.Object):
 
1036
        @dbus.service.method("org.example.Interface")
 
1037
        def SampleDBusMethod():
 
1038
            pass
 
1039
    
 
1040
    The above "SampleDBusMethod" on "SampleDBusObject" will be
 
1041
    reachable via two interfaces: "org.example.Interface" and
 
1042
    "net.example.AlternateInterface", the latter of which will have
 
1043
    its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
 
1044
    "true", unless "deprecate" is passed with a False value.
 
1045
    
 
1046
    This works for methods and signals, and also for D-Bus properties
 
1047
    (from DBusObjectWithProperties) and interfaces (from the
 
1048
    dbus_interface_annotations decorator).
760
1049
    """
761
 
    def __new__(mcs, name, bases, attr):
762
 
        # Go through all the base classes which could have D-Bus
763
 
        # methods, signals, or properties in them
764
 
        for base in (b for b in bases
765
 
                     if issubclass(b, dbus.service.Object)):
766
 
            # Go though all attributes of the base class
767
 
            for attrname, attribute in inspect.getmembers(base):
 
1050
    def wrapper(cls):
 
1051
        for orig_interface_name, alt_interface_name in (
 
1052
            alt_interface_names.iteritems()):
 
1053
            attr = {}
 
1054
            interface_names = set()
 
1055
            # Go though all attributes of the class
 
1056
            for attrname, attribute in inspect.getmembers(cls):
768
1057
                # Ignore non-D-Bus attributes, and D-Bus attributes
769
1058
                # with the wrong interface name
770
1059
                if (not hasattr(attribute, "_dbus_interface")
771
1060
                    or not attribute._dbus_interface
772
 
                    .startswith("se.recompile.Mandos")):
 
1061
                    .startswith(orig_interface_name)):
773
1062
                    continue
774
1063
                # Create an alternate D-Bus interface name based on
775
1064
                # the current name
776
1065
                alt_interface = (attribute._dbus_interface
777
 
                                 .replace("se.recompile.Mandos",
778
 
                                          "se.bsnet.fukt.Mandos"))
 
1066
                                 .replace(orig_interface_name,
 
1067
                                          alt_interface_name))
 
1068
                interface_names.add(alt_interface)
779
1069
                # Is this a D-Bus signal?
780
1070
                if getattr(attribute, "_dbus_is_signal", False):
781
1071
                    # Extract the original non-method function by
796
1086
                                nonmethod_func.func_name,
797
1087
                                nonmethod_func.func_defaults,
798
1088
                                nonmethod_func.func_closure)))
 
1089
                    # Copy annotations, if any
 
1090
                    try:
 
1091
                        new_function._dbus_annotations = (
 
1092
                            dict(attribute._dbus_annotations))
 
1093
                    except AttributeError:
 
1094
                        pass
799
1095
                    # Define a creator of a function to call both the
800
 
                    # old and new functions, so both the old and new
801
 
                    # signals gets sent when the function is called
 
1096
                    # original and alternate functions, so both the
 
1097
                    # original and alternate signals gets sent when
 
1098
                    # the function is called
802
1099
                    def fixscope(func1, func2):
803
1100
                        """This function is a scope container to pass
804
1101
                        func1 and func2 to the "call_both" function
811
1108
                        return call_both
812
1109
                    # Create the "call_both" function and add it to
813
1110
                    # the class
814
 
                    attr[attrname] = fixscope(attribute,
815
 
                                              new_function)
 
1111
                    attr[attrname] = fixscope(attribute, new_function)
816
1112
                # Is this a D-Bus method?
817
1113
                elif getattr(attribute, "_dbus_is_method", False):
818
1114
                    # Create a new, but exactly alike, function
829
1125
                                        attribute.func_name,
830
1126
                                        attribute.func_defaults,
831
1127
                                        attribute.func_closure)))
 
1128
                    # Copy annotations, if any
 
1129
                    try:
 
1130
                        attr[attrname]._dbus_annotations = (
 
1131
                            dict(attribute._dbus_annotations))
 
1132
                    except AttributeError:
 
1133
                        pass
832
1134
                # Is this a D-Bus property?
833
1135
                elif getattr(attribute, "_dbus_is_property", False):
834
1136
                    # Create a new, but exactly alike, function
848
1150
                                        attribute.func_name,
849
1151
                                        attribute.func_defaults,
850
1152
                                        attribute.func_closure)))
851
 
        return type.__new__(mcs, name, bases, attr)
852
 
 
 
1153
                    # Copy annotations, if any
 
1154
                    try:
 
1155
                        attr[attrname]._dbus_annotations = (
 
1156
                            dict(attribute._dbus_annotations))
 
1157
                    except AttributeError:
 
1158
                        pass
 
1159
                # Is this a D-Bus interface?
 
1160
                elif getattr(attribute, "_dbus_is_interface", False):
 
1161
                    # Create a new, but exactly alike, function
 
1162
                    # object.  Decorate it to be a new D-Bus interface
 
1163
                    # with the alternate D-Bus interface name.  Add it
 
1164
                    # to the class.
 
1165
                    attr[attrname] = (dbus_interface_annotations
 
1166
                                      (alt_interface)
 
1167
                                      (types.FunctionType
 
1168
                                       (attribute.func_code,
 
1169
                                        attribute.func_globals,
 
1170
                                        attribute.func_name,
 
1171
                                        attribute.func_defaults,
 
1172
                                        attribute.func_closure)))
 
1173
            if deprecate:
 
1174
                # Deprecate all alternate interfaces
 
1175
                iname="_AlternateDBusNames_interface_annotation{0}"
 
1176
                for interface_name in interface_names:
 
1177
                    @dbus_interface_annotations(interface_name)
 
1178
                    def func(self):
 
1179
                        return { "org.freedesktop.DBus.Deprecated":
 
1180
                                     "true" }
 
1181
                    # Find an unused name
 
1182
                    for aname in (iname.format(i)
 
1183
                                  for i in itertools.count()):
 
1184
                        if aname not in attr:
 
1185
                            attr[aname] = func
 
1186
                            break
 
1187
            if interface_names:
 
1188
                # Replace the class with a new subclass of it with
 
1189
                # methods, signals, etc. as created above.
 
1190
                cls = type(b"{0}Alternate".format(cls.__name__),
 
1191
                           (cls,), attr)
 
1192
        return cls
 
1193
    return wrapper
 
1194
 
 
1195
 
 
1196
@alternate_dbus_interfaces({"se.recompile.Mandos":
 
1197
                                "se.bsnet.fukt.Mandos"})
853
1198
class ClientDBus(Client, DBusObjectWithProperties):
854
1199
    """A Client class using D-Bus
855
1200
    
864
1209
    # dbus.service.Object doesn't use super(), so we can't either.
865
1210
    
866
1211
    def __init__(self, bus = None, *args, **kwargs):
867
 
        self._approvals_pending = 0
868
1212
        self.bus = bus
869
1213
        Client.__init__(self, *args, **kwargs)
870
1214
        # Only now, when this client is initialized, can it show up on
876
1220
                                 ("/clients/" + client_object_name))
877
1221
        DBusObjectWithProperties.__init__(self, self.bus,
878
1222
                                          self.dbus_object_path)
879
 
        
 
1223
    
880
1224
    def notifychangeproperty(transform_func,
881
1225
                             dbus_name, type_func=lambda x: x,
882
1226
                             variant_level=1):
883
1227
        """ Modify a variable so that it's a property which announces
884
1228
        its changes to DBus.
885
 
 
886
 
        transform_fun: Function that takes a value and transforms it
887
 
                       to a D-Bus type.
 
1229
        
 
1230
        transform_fun: Function that takes a value and a variant_level
 
1231
                       and transforms it to a D-Bus type.
888
1232
        dbus_name: D-Bus name of the variable
889
1233
        type_func: Function that transform the value before sending it
890
1234
                   to the D-Bus.  Default: no transform
891
1235
        variant_level: D-Bus variant level.  Default: 1
892
1236
        """
893
 
        real_value = [None,]
 
1237
        attrname = "_{0}".format(dbus_name)
894
1238
        def setter(self, value):
895
 
            old_value = real_value[0]
896
 
            real_value[0] = value
897
1239
            if hasattr(self, "dbus_object_path"):
898
 
                if type_func(old_value) != type_func(real_value[0]):
899
 
                    dbus_value = transform_func(type_func(real_value[0]),
900
 
                                                variant_level)
 
1240
                if (not hasattr(self, attrname) or
 
1241
                    type_func(getattr(self, attrname, None))
 
1242
                    != type_func(value)):
 
1243
                    dbus_value = transform_func(type_func(value),
 
1244
                                                variant_level
 
1245
                                                =variant_level)
901
1246
                    self.PropertyChanged(dbus.String(dbus_name),
902
1247
                                         dbus_value)
 
1248
            setattr(self, attrname, value)
903
1249
        
904
 
        return property(lambda self: real_value[0], setter)
905
 
    
 
1250
        return property(lambda self: getattr(self, attrname), setter)
906
1251
    
907
1252
    expires = notifychangeproperty(datetime_to_dbus, "Expires")
908
1253
    approvals_pending = notifychangeproperty(dbus.Boolean,
912
1257
    last_enabled = notifychangeproperty(datetime_to_dbus,
913
1258
                                        "LastEnabled")
914
1259
    checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",
915
 
                                   type_func = lambda checker: checker is not None)
 
1260
                                   type_func = lambda checker:
 
1261
                                       checker is not None)
916
1262
    last_checked_ok = notifychangeproperty(datetime_to_dbus,
917
1263
                                           "LastCheckedOK")
918
 
    last_approval_request = notifychangeproperty(datetime_to_dbus,
919
 
                                                 "LastApprovalRequest")
 
1264
    last_checker_status = notifychangeproperty(dbus.Int16,
 
1265
                                               "LastCheckerStatus")
 
1266
    last_approval_request = notifychangeproperty(
 
1267
        datetime_to_dbus, "LastApprovalRequest")
920
1268
    approved_by_default = notifychangeproperty(dbus.Boolean,
921
1269
                                               "ApprovedByDefault")
922
 
    approval_delay = notifychangeproperty(dbus.UInt16, "ApprovalDelay",
923
 
                                          type_func = _timedelta_to_milliseconds)
924
 
    approval_duration = notifychangeproperty(dbus.UInt16, "ApprovalDuration",
925
 
                                             type_func = _timedelta_to_milliseconds)
 
1270
    approval_delay = notifychangeproperty(dbus.UInt64,
 
1271
                                          "ApprovalDelay",
 
1272
                                          type_func =
 
1273
                                          timedelta_to_milliseconds)
 
1274
    approval_duration = notifychangeproperty(
 
1275
        dbus.UInt64, "ApprovalDuration",
 
1276
        type_func = timedelta_to_milliseconds)
926
1277
    host = notifychangeproperty(dbus.String, "Host")
927
 
    timeout = notifychangeproperty(dbus.UInt16, "Timeout",
928
 
                                   type_func = _timedelta_to_milliseconds)
929
 
    extended_timeout = notifychangeproperty(dbus.UInt16, "ExtendedTimeout",
930
 
                                            type_func = _timedelta_to_milliseconds)
931
 
    interval = notifychangeproperty(dbus.UInt16, "Interval",
932
 
                                    type_func = _timedelta_to_milliseconds)
 
1278
    timeout = notifychangeproperty(dbus.UInt64, "Timeout",
 
1279
                                   type_func =
 
1280
                                   timedelta_to_milliseconds)
 
1281
    extended_timeout = notifychangeproperty(
 
1282
        dbus.UInt64, "ExtendedTimeout",
 
1283
        type_func = timedelta_to_milliseconds)
 
1284
    interval = notifychangeproperty(dbus.UInt64,
 
1285
                                    "Interval",
 
1286
                                    type_func =
 
1287
                                    timedelta_to_milliseconds)
933
1288
    checker_command = notifychangeproperty(dbus.String, "Checker")
934
1289
    
935
1290
    del notifychangeproperty
977
1332
        return r
978
1333
    
979
1334
    def _reset_approved(self):
980
 
        self._approved = None
 
1335
        self.approved = None
981
1336
        return False
982
1337
    
983
1338
    def approve(self, value=True):
984
 
        self.send_changedstate()
985
 
        self._approved = value
986
 
        gobject.timeout_add(_timedelta_to_milliseconds
 
1339
        self.approved = value
 
1340
        gobject.timeout_add(timedelta_to_milliseconds
987
1341
                            (self.approval_duration),
988
1342
                            self._reset_approved)
989
 
    
 
1343
        self.send_changedstate()
990
1344
    
991
1345
    ## D-Bus methods, signals & properties
992
1346
    _interface = "se.recompile.Mandos.Client"
993
1347
    
 
1348
    ## Interfaces
 
1349
    
 
1350
    @dbus_interface_annotations(_interface)
 
1351
    def _foo(self):
 
1352
        return { "org.freedesktop.DBus.Property.EmitsChangedSignal":
 
1353
                     "false"}
 
1354
    
994
1355
    ## Signals
995
1356
    
996
1357
    # CheckerCompleted - signal
1095
1456
                           access="readwrite")
1096
1457
    def ApprovalDuration_dbus_property(self, value=None):
1097
1458
        if value is None:       # get
1098
 
            return dbus.UInt64(_timedelta_to_milliseconds(
 
1459
            return dbus.UInt64(timedelta_to_milliseconds(
1099
1460
                    self.approval_duration))
1100
1461
        self.approval_duration = datetime.timedelta(0, 0, 0, value)
1101
1462
    
1115
1476
    def Host_dbus_property(self, value=None):
1116
1477
        if value is None:       # get
1117
1478
            return dbus.String(self.host)
1118
 
        self.host = value
 
1479
        self.host = unicode(value)
1119
1480
    
1120
1481
    # Created - property
1121
1482
    @dbus_service_property(_interface, signature="s", access="read")
1122
1483
    def Created_dbus_property(self):
1123
 
        return dbus.String(datetime_to_dbus(self.created))
 
1484
        return datetime_to_dbus(self.created)
1124
1485
    
1125
1486
    # LastEnabled - property
1126
1487
    @dbus_service_property(_interface, signature="s", access="read")
1147
1508
            return
1148
1509
        return datetime_to_dbus(self.last_checked_ok)
1149
1510
    
 
1511
    # LastCheckerStatus - property
 
1512
    @dbus_service_property(_interface, signature="n",
 
1513
                           access="read")
 
1514
    def LastCheckerStatus_dbus_property(self):
 
1515
        return dbus.Int16(self.last_checker_status)
 
1516
    
1150
1517
    # Expires - property
1151
1518
    @dbus_service_property(_interface, signature="s", access="read")
1152
1519
    def Expires_dbus_property(self):
1163
1530
    def Timeout_dbus_property(self, value=None):
1164
1531
        if value is None:       # get
1165
1532
            return dbus.UInt64(self.timeout_milliseconds())
 
1533
        old_timeout = self.timeout
1166
1534
        self.timeout = datetime.timedelta(0, 0, 0, value)
1167
 
        if getattr(self, "disable_initiator_tag", None) is None:
1168
 
            return
1169
 
        # Reschedule timeout
1170
 
        gobject.source_remove(self.disable_initiator_tag)
1171
 
        self.disable_initiator_tag = None
1172
 
        self.expires = None
1173
 
        time_to_die = (self.
1174
 
                       _timedelta_to_milliseconds((self
1175
 
                                                   .last_checked_ok
1176
 
                                                   + self.timeout)
1177
 
                                                  - datetime.datetime
1178
 
                                                  .utcnow()))
1179
 
        if time_to_die <= 0:
1180
 
            # The timeout has passed
1181
 
            self.disable()
1182
 
        else:
1183
 
            self.expires = (datetime.datetime.utcnow()
1184
 
                            + datetime.timedelta(milliseconds = time_to_die))
1185
 
            self.disable_initiator_tag = (gobject.timeout_add
1186
 
                                          (time_to_die, self.disable))
 
1535
        # Reschedule disabling
 
1536
        if self.enabled:
 
1537
            now = datetime.datetime.utcnow()
 
1538
            self.expires += self.timeout - old_timeout
 
1539
            if self.expires <= now:
 
1540
                # The timeout has passed
 
1541
                self.disable()
 
1542
            else:
 
1543
                if (getattr(self, "disable_initiator_tag", None)
 
1544
                    is None):
 
1545
                    return
 
1546
                gobject.source_remove(self.disable_initiator_tag)
 
1547
                self.disable_initiator_tag = (
 
1548
                    gobject.timeout_add(
 
1549
                        timedelta_to_milliseconds(self.expires - now),
 
1550
                        self.disable))
1187
1551
    
1188
1552
    # ExtendedTimeout - property
1189
1553
    @dbus_service_property(_interface, signature="t",
1202
1566
        self.interval = datetime.timedelta(0, 0, 0, value)
1203
1567
        if getattr(self, "checker_initiator_tag", None) is None:
1204
1568
            return
1205
 
        # Reschedule checker run
1206
 
        gobject.source_remove(self.checker_initiator_tag)
1207
 
        self.checker_initiator_tag = (gobject.timeout_add
1208
 
                                      (value, self.start_checker))
1209
 
        self.start_checker()    # Start one now, too
 
1569
        if self.enabled:
 
1570
            # Reschedule checker run
 
1571
            gobject.source_remove(self.checker_initiator_tag)
 
1572
            self.checker_initiator_tag = (gobject.timeout_add
 
1573
                                          (value, self.start_checker))
 
1574
            self.start_checker()    # Start one now, too
1210
1575
    
1211
1576
    # Checker - property
1212
1577
    @dbus_service_property(_interface, signature="s",
1214
1579
    def Checker_dbus_property(self, value=None):
1215
1580
        if value is None:       # get
1216
1581
            return dbus.String(self.checker_command)
1217
 
        self.checker_command = value
 
1582
        self.checker_command = unicode(value)
1218
1583
    
1219
1584
    # CheckerRunning - property
1220
1585
    @dbus_service_property(_interface, signature="b",
1249
1614
            raise KeyError()
1250
1615
    
1251
1616
    def __getattribute__(self, name):
1252
 
        if(name == '_pipe'):
 
1617
        if name == '_pipe':
1253
1618
            return super(ProxyClient, self).__getattribute__(name)
1254
1619
        self._pipe.send(('getattr', name))
1255
1620
        data = self._pipe.recv()
1262
1627
            return func
1263
1628
    
1264
1629
    def __setattr__(self, name, value):
1265
 
        if(name == '_pipe'):
 
1630
        if name == '_pipe':
1266
1631
            return super(ProxyClient, self).__setattr__(name, value)
1267
1632
        self._pipe.send(('setattr', name, value))
1268
1633
 
1269
 
class ClientDBusTransitional(ClientDBus):
1270
 
    __metaclass__ = AlternateDBusNamesMetaclass
1271
1634
 
1272
1635
class ClientHandler(socketserver.BaseRequestHandler, object):
1273
1636
    """A class to handle client connections.
1353
1716
                                       client.name)
1354
1717
                        if self.server.use_dbus:
1355
1718
                            # Emit D-Bus signal
1356
 
                            client.Rejected("Disabled")                    
 
1719
                            client.Rejected("Disabled")
1357
1720
                        return
1358
1721
                    
1359
 
                    if client._approved or not client.approval_delay:
 
1722
                    if client.approved or not client.approval_delay:
1360
1723
                        #We are approved or approval is disabled
1361
1724
                        break
1362
 
                    elif client._approved is None:
 
1725
                    elif client.approved is None:
1363
1726
                        logger.info("Client %s needs approval",
1364
1727
                                    client.name)
1365
1728
                        if self.server.use_dbus:
1376
1739
                        return
1377
1740
                    
1378
1741
                    #wait until timeout or approved
1379
 
                    #x = float(client._timedelta_to_milliseconds(delay))
1380
1742
                    time = datetime.datetime.now()
1381
1743
                    client.changedstate.acquire()
1382
 
                    client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))
 
1744
                    client.changedstate.wait(
 
1745
                        float(timedelta_to_milliseconds(delay)
 
1746
                              / 1000))
1383
1747
                    client.changedstate.release()
1384
1748
                    time2 = datetime.datetime.now()
1385
1749
                    if (time2 - time) >= delay:
1401
1765
                    try:
1402
1766
                        sent = session.send(client.secret[sent_size:])
1403
1767
                    except gnutls.errors.GNUTLSError as error:
1404
 
                        logger.warning("gnutls send failed")
 
1768
                        logger.warning("gnutls send failed",
 
1769
                                       exc_info=error)
1405
1770
                        return
1406
1771
                    logger.debug("Sent: %d, remaining: %d",
1407
1772
                                 sent, len(client.secret)
1409
1774
                    sent_size += sent
1410
1775
                
1411
1776
                logger.info("Sending secret to %s", client.name)
1412
 
                # bump the timeout as if seen
1413
 
                client.checked_ok(client.extended_timeout)
 
1777
                # bump the timeout using extended_timeout
 
1778
                client.bump_timeout(client.extended_timeout)
1414
1779
                if self.server.use_dbus:
1415
1780
                    # Emit D-Bus signal
1416
1781
                    client.GotSecret()
1421
1786
                try:
1422
1787
                    session.bye()
1423
1788
                except gnutls.errors.GNUTLSError as error:
1424
 
                    logger.warning("GnuTLS bye failed")
 
1789
                    logger.warning("GnuTLS bye failed",
 
1790
                                   exc_info=error)
1425
1791
    
1426
1792
    @staticmethod
1427
1793
    def peer_certificate(session):
1483
1849
        # Convert the buffer to a Python bytestring
1484
1850
        fpr = ctypes.string_at(buf, buf_len.value)
1485
1851
        # Convert the bytestring to hexadecimal notation
1486
 
        hex_fpr = ''.join("%02X" % ord(char) for char in fpr)
 
1852
        hex_fpr = binascii.hexlify(fpr).upper()
1487
1853
        return hex_fpr
1488
1854
 
1489
1855
 
1492
1858
    def sub_process_main(self, request, address):
1493
1859
        try:
1494
1860
            self.finish_request(request, address)
1495
 
        except:
 
1861
        except Exception:
1496
1862
            self.handle_error(request, address)
1497
1863
        self.close_request(request)
1498
 
            
 
1864
    
1499
1865
    def process_request(self, request, address):
1500
1866
        """Start a new process to process the request."""
1501
 
        multiprocessing.Process(target = self.sub_process_main,
1502
 
                                args = (request, address)).start()
 
1867
        proc = multiprocessing.Process(target = self.sub_process_main,
 
1868
                                       args = (request, address))
 
1869
        proc.start()
 
1870
        return proc
1503
1871
 
1504
1872
 
1505
1873
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
1511
1879
        """
1512
1880
        parent_pipe, self.child_pipe = multiprocessing.Pipe()
1513
1881
        
1514
 
        super(MultiprocessingMixInWithPipe,
1515
 
              self).process_request(request, client_address)
 
1882
        proc = MultiprocessingMixIn.process_request(self, request,
 
1883
                                                    client_address)
1516
1884
        self.child_pipe.close()
1517
 
        self.add_pipe(parent_pipe)
 
1885
        self.add_pipe(parent_pipe, proc)
1518
1886
    
1519
 
    def add_pipe(self, parent_pipe):
 
1887
    def add_pipe(self, parent_pipe, proc):
1520
1888
        """Dummy function; override as necessary"""
1521
1889
        raise NotImplementedError
1522
1890
 
1531
1899
        use_ipv6:       Boolean; to use IPv6 or not
1532
1900
    """
1533
1901
    def __init__(self, server_address, RequestHandlerClass,
1534
 
                 interface=None, use_ipv6=True):
 
1902
                 interface=None, use_ipv6=True, socketfd=None):
 
1903
        """If socketfd is set, use that file descriptor instead of
 
1904
        creating a new one with socket.socket().
 
1905
        """
1535
1906
        self.interface = interface
1536
1907
        if use_ipv6:
1537
1908
            self.address_family = socket.AF_INET6
 
1909
        if socketfd is not None:
 
1910
            # Save the file descriptor
 
1911
            self.socketfd = socketfd
 
1912
            # Save the original socket.socket() function
 
1913
            self.socket_socket = socket.socket
 
1914
            # To implement --socket, we monkey patch socket.socket.
 
1915
            # 
 
1916
            # (When socketserver.TCPServer is a new-style class, we
 
1917
            # could make self.socket into a property instead of monkey
 
1918
            # patching socket.socket.)
 
1919
            # 
 
1920
            # Create a one-time-only replacement for socket.socket()
 
1921
            @functools.wraps(socket.socket)
 
1922
            def socket_wrapper(*args, **kwargs):
 
1923
                # Restore original function so subsequent calls are
 
1924
                # not affected.
 
1925
                socket.socket = self.socket_socket
 
1926
                del self.socket_socket
 
1927
                # This time only, return a new socket object from the
 
1928
                # saved file descriptor.
 
1929
                return socket.fromfd(self.socketfd, *args, **kwargs)
 
1930
            # Replace socket.socket() function with wrapper
 
1931
            socket.socket = socket_wrapper
 
1932
        # The socketserver.TCPServer.__init__ will call
 
1933
        # socket.socket(), which might be our replacement,
 
1934
        # socket_wrapper(), if socketfd was set.
1538
1935
        socketserver.TCPServer.__init__(self, server_address,
1539
1936
                                        RequestHandlerClass)
 
1937
    
1540
1938
    def server_bind(self):
1541
1939
        """This overrides the normal server_bind() function
1542
1940
        to bind to an interface if one was specified, and also NOT to
1550
1948
                try:
1551
1949
                    self.socket.setsockopt(socket.SOL_SOCKET,
1552
1950
                                           SO_BINDTODEVICE,
1553
 
                                           str(self.interface
1554
 
                                               + '\0'))
 
1951
                                           str(self.interface + '\0'))
1555
1952
                except socket.error as error:
1556
 
                    if error[0] == errno.EPERM:
1557
 
                        logger.error("No permission to"
1558
 
                                     " bind to interface %s",
1559
 
                                     self.interface)
1560
 
                    elif error[0] == errno.ENOPROTOOPT:
 
1953
                    if error.errno == errno.EPERM:
 
1954
                        logger.error("No permission to bind to"
 
1955
                                     " interface %s", self.interface)
 
1956
                    elif error.errno == errno.ENOPROTOOPT:
1561
1957
                        logger.error("SO_BINDTODEVICE not available;"
1562
1958
                                     " cannot bind to interface %s",
1563
1959
                                     self.interface)
 
1960
                    elif error.errno == errno.ENODEV:
 
1961
                        logger.error("Interface %s does not exist,"
 
1962
                                     " cannot bind", self.interface)
1564
1963
                    else:
1565
1964
                        raise
1566
1965
        # Only bind(2) the socket if we really need to.
1596
1995
    """
1597
1996
    def __init__(self, server_address, RequestHandlerClass,
1598
1997
                 interface=None, use_ipv6=True, clients=None,
1599
 
                 gnutls_priority=None, use_dbus=True):
 
1998
                 gnutls_priority=None, use_dbus=True, socketfd=None):
1600
1999
        self.enabled = False
1601
2000
        self.clients = clients
1602
2001
        if self.clients is None:
1603
 
            self.clients = set()
 
2002
            self.clients = {}
1604
2003
        self.use_dbus = use_dbus
1605
2004
        self.gnutls_priority = gnutls_priority
1606
2005
        IPv6_TCPServer.__init__(self, server_address,
1607
2006
                                RequestHandlerClass,
1608
2007
                                interface = interface,
1609
 
                                use_ipv6 = use_ipv6)
 
2008
                                use_ipv6 = use_ipv6,
 
2009
                                socketfd = socketfd)
1610
2010
    def server_activate(self):
1611
2011
        if self.enabled:
1612
2012
            return socketserver.TCPServer.server_activate(self)
 
2013
    
1613
2014
    def enable(self):
1614
2015
        self.enabled = True
1615
 
    def add_pipe(self, parent_pipe):
 
2016
    
 
2017
    def add_pipe(self, parent_pipe, proc):
1616
2018
        # Call "handle_ipc" for both data and EOF events
1617
2019
        gobject.io_add_watch(parent_pipe.fileno(),
1618
2020
                             gobject.IO_IN | gobject.IO_HUP,
1619
2021
                             functools.partial(self.handle_ipc,
1620
 
                                               parent_pipe = parent_pipe))
1621
 
        
 
2022
                                               parent_pipe =
 
2023
                                               parent_pipe,
 
2024
                                               proc = proc))
 
2025
    
1622
2026
    def handle_ipc(self, source, condition, parent_pipe=None,
1623
 
                   client_object=None):
1624
 
        condition_names = {
1625
 
            gobject.IO_IN: "IN",   # There is data to read.
1626
 
            gobject.IO_OUT: "OUT", # Data can be written (without
1627
 
                                    # blocking).
1628
 
            gobject.IO_PRI: "PRI", # There is urgent data to read.
1629
 
            gobject.IO_ERR: "ERR", # Error condition.
1630
 
            gobject.IO_HUP: "HUP"  # Hung up (the connection has been
1631
 
                                    # broken, usually for pipes and
1632
 
                                    # sockets).
1633
 
            }
1634
 
        conditions_string = ' | '.join(name
1635
 
                                       for cond, name in
1636
 
                                       condition_names.iteritems()
1637
 
                                       if cond & condition)
1638
 
        # error or the other end of multiprocessing.Pipe has closed
1639
 
        if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):
 
2027
                   proc = None, client_object=None):
 
2028
        # error, or the other end of multiprocessing.Pipe has closed
 
2029
        if condition & (gobject.IO_ERR | gobject.IO_HUP):
 
2030
            # Wait for other process to exit
 
2031
            proc.join()
1640
2032
            return False
1641
2033
        
1642
2034
        # Read a request from the child
1647
2039
            fpr = request[1]
1648
2040
            address = request[2]
1649
2041
            
1650
 
            for c in self.clients:
 
2042
            for c in self.clients.itervalues():
1651
2043
                if c.fingerprint == fpr:
1652
2044
                    client = c
1653
2045
                    break
1656
2048
                            "dress: %s", fpr, address)
1657
2049
                if self.use_dbus:
1658
2050
                    # Emit D-Bus signal
1659
 
                    mandos_dbus_service.ClientNotFound(fpr, address[0])
 
2051
                    mandos_dbus_service.ClientNotFound(fpr,
 
2052
                                                       address[0])
1660
2053
                parent_pipe.send(False)
1661
2054
                return False
1662
2055
            
1663
2056
            gobject.io_add_watch(parent_pipe.fileno(),
1664
2057
                                 gobject.IO_IN | gobject.IO_HUP,
1665
2058
                                 functools.partial(self.handle_ipc,
1666
 
                                                   parent_pipe = parent_pipe,
1667
 
                                                   client_object = client))
 
2059
                                                   parent_pipe =
 
2060
                                                   parent_pipe,
 
2061
                                                   proc = proc,
 
2062
                                                   client_object =
 
2063
                                                   client))
1668
2064
            parent_pipe.send(True)
1669
 
            # remove the old hook in favor of the new above hook on same fileno
 
2065
            # remove the old hook in favor of the new above hook on
 
2066
            # same fileno
1670
2067
            return False
1671
2068
        if command == 'funcall':
1672
2069
            funcname = request[1]
1673
2070
            args = request[2]
1674
2071
            kwargs = request[3]
1675
2072
            
1676
 
            parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))
 
2073
            parent_pipe.send(('data', getattr(client_object,
 
2074
                                              funcname)(*args,
 
2075
                                                         **kwargs)))
1677
2076
        
1678
2077
        if command == 'getattr':
1679
2078
            attrname = request[1]
1680
2079
            if callable(client_object.__getattribute__(attrname)):
1681
2080
                parent_pipe.send(('function',))
1682
2081
            else:
1683
 
                parent_pipe.send(('data', client_object.__getattribute__(attrname)))
 
2082
                parent_pipe.send(('data', client_object
 
2083
                                  .__getattribute__(attrname)))
1684
2084
        
1685
2085
        if command == 'setattr':
1686
2086
            attrname = request[1]
1722
2122
            elif suffix == "w":
1723
2123
                delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
1724
2124
            else:
1725
 
                raise ValueError("Unknown suffix %r" % suffix)
 
2125
                raise ValueError("Unknown suffix {0!r}"
 
2126
                                 .format(suffix))
1726
2127
        except (ValueError, IndexError) as e:
1727
2128
            raise ValueError(*(e.args))
1728
2129
        timevalue += delta
1729
2130
    return timevalue
1730
2131
 
1731
2132
 
1732
 
def if_nametoindex(interface):
1733
 
    """Call the C function if_nametoindex(), or equivalent
1734
 
    
1735
 
    Note: This function cannot accept a unicode string."""
1736
 
    global if_nametoindex
1737
 
    try:
1738
 
        if_nametoindex = (ctypes.cdll.LoadLibrary
1739
 
                          (ctypes.util.find_library("c"))
1740
 
                          .if_nametoindex)
1741
 
    except (OSError, AttributeError):
1742
 
        logger.warning("Doing if_nametoindex the hard way")
1743
 
        def if_nametoindex(interface):
1744
 
            "Get an interface index the hard way, i.e. using fcntl()"
1745
 
            SIOCGIFINDEX = 0x8933  # From /usr/include/linux/sockios.h
1746
 
            with contextlib.closing(socket.socket()) as s:
1747
 
                ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
1748
 
                                    struct.pack(str("16s16x"),
1749
 
                                                interface))
1750
 
            interface_index = struct.unpack(str("I"),
1751
 
                                            ifreq[16:20])[0]
1752
 
            return interface_index
1753
 
    return if_nametoindex(interface)
1754
 
 
1755
 
 
1756
2133
def daemon(nochdir = False, noclose = False):
1757
2134
    """See daemon(3).  Standard BSD Unix function.
1758
2135
    
1766
2143
        sys.exit()
1767
2144
    if not noclose:
1768
2145
        # Close all standard open file descriptors
1769
 
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
 
2146
        null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
1770
2147
        if not stat.S_ISCHR(os.fstat(null).st_mode):
1771
2148
            raise OSError(errno.ENODEV,
1772
 
                          "%s not a character device"
1773
 
                          % os.path.devnull)
 
2149
                          "{0} not a character device"
 
2150
                          .format(os.devnull))
1774
2151
        os.dup2(null, sys.stdin.fileno())
1775
2152
        os.dup2(null, sys.stdout.fileno())
1776
2153
        os.dup2(null, sys.stderr.fileno())
1785
2162
    
1786
2163
    parser = argparse.ArgumentParser()
1787
2164
    parser.add_argument("-v", "--version", action="version",
1788
 
                        version = "%%(prog)s %s" % version,
 
2165
                        version = "%(prog)s {0}".format(version),
1789
2166
                        help="show version number and exit")
1790
2167
    parser.add_argument("-i", "--interface", metavar="IF",
1791
2168
                        help="Bind to interface IF")
1813
2190
                        " system bus interface")
1814
2191
    parser.add_argument("--no-ipv6", action="store_false",
1815
2192
                        dest="use_ipv6", help="Do not use IPv6")
 
2193
    parser.add_argument("--no-restore", action="store_false",
 
2194
                        dest="restore", help="Do not restore stored"
 
2195
                        " state")
 
2196
    parser.add_argument("--socket", type=int,
 
2197
                        help="Specify a file descriptor to a network"
 
2198
                        " socket to use instead of creating one")
 
2199
    parser.add_argument("--statedir", metavar="DIR",
 
2200
                        help="Directory to save/restore state in")
 
2201
    parser.add_argument("--foreground", action="store_true",
 
2202
                        help="Run in foreground")
 
2203
    
1816
2204
    options = parser.parse_args()
1817
2205
    
1818
2206
    if options.check:
1831
2219
                        "use_dbus": "True",
1832
2220
                        "use_ipv6": "True",
1833
2221
                        "debuglevel": "",
 
2222
                        "restore": "True",
 
2223
                        "socket": "",
 
2224
                        "statedir": "/var/lib/mandos",
 
2225
                        "foreground": "False",
1834
2226
                        }
1835
2227
    
1836
2228
    # Parse config file for server-global settings
1841
2233
    # Convert the SafeConfigParser object to a dict
1842
2234
    server_settings = server_config.defaults()
1843
2235
    # Use the appropriate methods on the non-string config options
1844
 
    for option in ("debug", "use_dbus", "use_ipv6"):
 
2236
    for option in ("debug", "use_dbus", "use_ipv6", "foreground"):
1845
2237
        server_settings[option] = server_config.getboolean("DEFAULT",
1846
2238
                                                           option)
1847
2239
    if server_settings["port"]:
1848
2240
        server_settings["port"] = server_config.getint("DEFAULT",
1849
2241
                                                       "port")
 
2242
    if server_settings["socket"]:
 
2243
        server_settings["socket"] = server_config.getint("DEFAULT",
 
2244
                                                         "socket")
 
2245
        # Later, stdin will, and stdout and stderr might, be dup'ed
 
2246
        # over with an opened os.devnull.  But we don't want this to
 
2247
        # happen with a supplied network socket.
 
2248
        if 0 <= server_settings["socket"] <= 2:
 
2249
            server_settings["socket"] = os.dup(server_settings
 
2250
                                               ["socket"])
1850
2251
    del server_config
1851
2252
    
1852
2253
    # Override the settings from the config file with command line
1853
2254
    # options, if set.
1854
2255
    for option in ("interface", "address", "port", "debug",
1855
2256
                   "priority", "servicename", "configdir",
1856
 
                   "use_dbus", "use_ipv6", "debuglevel"):
 
2257
                   "use_dbus", "use_ipv6", "debuglevel", "restore",
 
2258
                   "statedir", "socket", "foreground"):
1857
2259
        value = getattr(options, option)
1858
2260
        if value is not None:
1859
2261
            server_settings[option] = value
1862
2264
    for option in server_settings.keys():
1863
2265
        if type(server_settings[option]) is str:
1864
2266
            server_settings[option] = unicode(server_settings[option])
 
2267
    # Debug implies foreground
 
2268
    if server_settings["debug"]:
 
2269
        server_settings["foreground"] = True
1865
2270
    # Now we have our good server settings in "server_settings"
1866
2271
    
1867
2272
    ##################################################################
1871
2276
    debuglevel = server_settings["debuglevel"]
1872
2277
    use_dbus = server_settings["use_dbus"]
1873
2278
    use_ipv6 = server_settings["use_ipv6"]
 
2279
    stored_state_path = os.path.join(server_settings["statedir"],
 
2280
                                     stored_state_file)
 
2281
    foreground = server_settings["foreground"]
 
2282
    
 
2283
    if debug:
 
2284
        initlogger(debug, logging.DEBUG)
 
2285
    else:
 
2286
        if not debuglevel:
 
2287
            initlogger(debug)
 
2288
        else:
 
2289
            level = getattr(logging, debuglevel.upper())
 
2290
            initlogger(debug, level)
1874
2291
    
1875
2292
    if server_settings["servicename"] != "Mandos":
1876
2293
        syslogger.setFormatter(logging.Formatter
1877
 
                               ('Mandos (%s) [%%(process)d]:'
1878
 
                                ' %%(levelname)s: %%(message)s'
1879
 
                                % server_settings["servicename"]))
 
2294
                               ('Mandos ({0}) [%(process)d]:'
 
2295
                                ' %(levelname)s: %(message)s'
 
2296
                                .format(server_settings
 
2297
                                        ["servicename"])))
1880
2298
    
1881
2299
    # Parse config file with clients
1882
 
    client_defaults = { "timeout": "5m",
1883
 
                        "extended_timeout": "15m",
1884
 
                        "interval": "2m",
1885
 
                        "checker": "fping -q -- %%(host)s",
1886
 
                        "host": "",
1887
 
                        "approval_delay": "0s",
1888
 
                        "approval_duration": "1s",
1889
 
                        }
1890
 
    client_config = configparser.SafeConfigParser(client_defaults)
 
2300
    client_config = configparser.SafeConfigParser(Client
 
2301
                                                  .client_defaults)
1891
2302
    client_config.read(os.path.join(server_settings["configdir"],
1892
2303
                                    "clients.conf"))
1893
2304
    
1902
2313
                              use_ipv6=use_ipv6,
1903
2314
                              gnutls_priority=
1904
2315
                              server_settings["priority"],
1905
 
                              use_dbus=use_dbus)
1906
 
    if not debug:
 
2316
                              use_dbus=use_dbus,
 
2317
                              socketfd=(server_settings["socket"]
 
2318
                                        or None))
 
2319
    if not foreground:
1907
2320
        pidfilename = "/var/run/mandos.pid"
 
2321
        pidfile = None
1908
2322
        try:
1909
2323
            pidfile = open(pidfilename, "w")
1910
 
        except IOError:
1911
 
            logger.error("Could not open file %r", pidfilename)
 
2324
        except IOError as e:
 
2325
            logger.error("Could not open file %r", pidfilename,
 
2326
                         exc_info=e)
1912
2327
    
1913
 
    try:
1914
 
        uid = pwd.getpwnam("_mandos").pw_uid
1915
 
        gid = pwd.getpwnam("_mandos").pw_gid
1916
 
    except KeyError:
 
2328
    for name in ("_mandos", "mandos", "nobody"):
1917
2329
        try:
1918
 
            uid = pwd.getpwnam("mandos").pw_uid
1919
 
            gid = pwd.getpwnam("mandos").pw_gid
 
2330
            uid = pwd.getpwnam(name).pw_uid
 
2331
            gid = pwd.getpwnam(name).pw_gid
 
2332
            break
1920
2333
        except KeyError:
1921
 
            try:
1922
 
                uid = pwd.getpwnam("nobody").pw_uid
1923
 
                gid = pwd.getpwnam("nobody").pw_gid
1924
 
            except KeyError:
1925
 
                uid = 65534
1926
 
                gid = 65534
 
2334
            continue
 
2335
    else:
 
2336
        uid = 65534
 
2337
        gid = 65534
1927
2338
    try:
1928
2339
        os.setgid(gid)
1929
2340
        os.setuid(uid)
1930
2341
    except OSError as error:
1931
 
        if error[0] != errno.EPERM:
 
2342
        if error.errno != errno.EPERM:
1932
2343
            raise error
1933
2344
    
1934
 
    if not debug and not debuglevel:
1935
 
        syslogger.setLevel(logging.WARNING)
1936
 
        console.setLevel(logging.WARNING)
1937
 
    if debuglevel:
1938
 
        level = getattr(logging, debuglevel.upper())
1939
 
        syslogger.setLevel(level)
1940
 
        console.setLevel(level)
1941
 
    
1942
2345
    if debug:
1943
2346
        # Enable all possible GnuTLS debugging
1944
2347
        
1954
2357
         .gnutls_global_set_log_function(debug_gnutls))
1955
2358
        
1956
2359
        # Redirect stdin so all checkers get /dev/null
1957
 
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
 
2360
        null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
1958
2361
        os.dup2(null, sys.stdin.fileno())
1959
2362
        if null > 2:
1960
2363
            os.close(null)
1961
 
    else:
1962
 
        # No console logging
1963
 
        logger.removeHandler(console)
1964
2364
    
1965
2365
    # Need to fork before connecting to D-Bus
1966
 
    if not debug:
 
2366
    if not foreground:
1967
2367
        # Close all input and output, do double fork, etc.
1968
2368
        daemon()
1969
2369
    
 
2370
    # multiprocessing will use threads, so before we use gobject we
 
2371
    # need to inform gobject that threads will be used.
 
2372
    gobject.threads_init()
 
2373
    
1970
2374
    global main_loop
1971
2375
    # From the Avahi example code
1972
 
    DBusGMainLoop(set_as_default=True )
 
2376
    DBusGMainLoop(set_as_default=True)
1973
2377
    main_loop = gobject.MainLoop()
1974
2378
    bus = dbus.SystemBus()
1975
2379
    # End of Avahi example code
1977
2381
        try:
1978
2382
            bus_name = dbus.service.BusName("se.recompile.Mandos",
1979
2383
                                            bus, do_not_queue=True)
1980
 
            old_bus_name = dbus.service.BusName("se.bsnet.fukt.Mandos",
1981
 
                                                bus, do_not_queue=True)
 
2384
            old_bus_name = (dbus.service.BusName
 
2385
                            ("se.bsnet.fukt.Mandos", bus,
 
2386
                             do_not_queue=True))
1982
2387
        except dbus.exceptions.NameExistsException as e:
1983
 
            logger.error(unicode(e) + ", disabling D-Bus")
 
2388
            logger.error("Disabling D-Bus:", exc_info=e)
1984
2389
            use_dbus = False
1985
2390
            server_settings["use_dbus"] = False
1986
2391
            tcp_server.use_dbus = False
1987
2392
    protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
1988
 
    service = AvahiService(name = server_settings["servicename"],
1989
 
                           servicetype = "_mandos._tcp",
1990
 
                           protocol = protocol, bus = bus)
 
2393
    service = AvahiServiceToSyslog(name =
 
2394
                                   server_settings["servicename"],
 
2395
                                   servicetype = "_mandos._tcp",
 
2396
                                   protocol = protocol, bus = bus)
1991
2397
    if server_settings["interface"]:
1992
2398
        service.interface = (if_nametoindex
1993
2399
                             (str(server_settings["interface"])))
1997
2403
    
1998
2404
    client_class = Client
1999
2405
    if use_dbus:
2000
 
        client_class = functools.partial(ClientDBusTransitional, bus = bus)        
2001
 
    def client_config_items(config, section):
2002
 
        special_settings = {
2003
 
            "approved_by_default":
2004
 
                lambda: config.getboolean(section,
2005
 
                                          "approved_by_default"),
2006
 
            }
2007
 
        for name, value in config.items(section):
 
2406
        client_class = functools.partial(ClientDBus, bus = bus)
 
2407
    
 
2408
    client_settings = Client.config_parser(client_config)
 
2409
    old_client_settings = {}
 
2410
    clients_data = {}
 
2411
    
 
2412
    # Get client data and settings from last running state.
 
2413
    if server_settings["restore"]:
 
2414
        try:
 
2415
            with open(stored_state_path, "rb") as stored_state:
 
2416
                clients_data, old_client_settings = (pickle.load
 
2417
                                                     (stored_state))
 
2418
            os.remove(stored_state_path)
 
2419
        except IOError as e:
 
2420
            if e.errno == errno.ENOENT:
 
2421
                logger.warning("Could not load persistent state: {0}"
 
2422
                                .format(os.strerror(e.errno)))
 
2423
            else:
 
2424
                logger.critical("Could not load persistent state:",
 
2425
                                exc_info=e)
 
2426
                raise
 
2427
        except EOFError as e:
 
2428
            logger.warning("Could not load persistent state: "
 
2429
                           "EOFError:", exc_info=e)
 
2430
    
 
2431
    with PGPEngine() as pgp:
 
2432
        for client_name, client in clients_data.iteritems():
 
2433
            # Decide which value to use after restoring saved state.
 
2434
            # We have three different values: Old config file,
 
2435
            # new config file, and saved state.
 
2436
            # New config value takes precedence if it differs from old
 
2437
            # config value, otherwise use saved state.
 
2438
            for name, value in client_settings[client_name].items():
 
2439
                try:
 
2440
                    # For each value in new config, check if it
 
2441
                    # differs from the old config value (Except for
 
2442
                    # the "secret" attribute)
 
2443
                    if (name != "secret" and
 
2444
                        value != old_client_settings[client_name]
 
2445
                        [name]):
 
2446
                        client[name] = value
 
2447
                except KeyError:
 
2448
                    pass
 
2449
            
 
2450
            # Clients who has passed its expire date can still be
 
2451
            # enabled if its last checker was successful.  Clients
 
2452
            # whose checker succeeded before we stored its state is
 
2453
            # assumed to have successfully run all checkers during
 
2454
            # downtime.
 
2455
            if client["enabled"]:
 
2456
                if datetime.datetime.utcnow() >= client["expires"]:
 
2457
                    if not client["last_checked_ok"]:
 
2458
                        logger.warning(
 
2459
                            "disabling client {0} - Client never "
 
2460
                            "performed a successful checker"
 
2461
                            .format(client_name))
 
2462
                        client["enabled"] = False
 
2463
                    elif client["last_checker_status"] != 0:
 
2464
                        logger.warning(
 
2465
                            "disabling client {0} - Client "
 
2466
                            "last checker failed with error code {1}"
 
2467
                            .format(client_name,
 
2468
                                    client["last_checker_status"]))
 
2469
                        client["enabled"] = False
 
2470
                    else:
 
2471
                        client["expires"] = (datetime.datetime
 
2472
                                             .utcnow()
 
2473
                                             + client["timeout"])
 
2474
                        logger.debug("Last checker succeeded,"
 
2475
                                     " keeping {0} enabled"
 
2476
                                     .format(client_name))
2008
2477
            try:
2009
 
                yield (name, special_settings[name]())
2010
 
            except KeyError:
2011
 
                yield (name, value)
2012
 
    
2013
 
    tcp_server.clients.update(set(
2014
 
            client_class(name = section,
2015
 
                         config= dict(client_config_items(
2016
 
                        client_config, section)))
2017
 
            for section in client_config.sections()))
 
2478
                client["secret"] = (
 
2479
                    pgp.decrypt(client["encrypted_secret"],
 
2480
                                client_settings[client_name]
 
2481
                                ["secret"]))
 
2482
            except PGPError:
 
2483
                # If decryption fails, we use secret from new settings
 
2484
                logger.debug("Failed to decrypt {0} old secret"
 
2485
                             .format(client_name))
 
2486
                client["secret"] = (
 
2487
                    client_settings[client_name]["secret"])
 
2488
    
 
2489
    # Add/remove clients based on new changes made to config
 
2490
    for client_name in (set(old_client_settings)
 
2491
                        - set(client_settings)):
 
2492
        del clients_data[client_name]
 
2493
    for client_name in (set(client_settings)
 
2494
                        - set(old_client_settings)):
 
2495
        clients_data[client_name] = client_settings[client_name]
 
2496
    
 
2497
    # Create all client objects
 
2498
    for client_name, client in clients_data.iteritems():
 
2499
        tcp_server.clients[client_name] = client_class(
 
2500
            name = client_name, settings = client)
 
2501
    
2018
2502
    if not tcp_server.clients:
2019
2503
        logger.warning("No clients defined")
2020
 
        
2021
 
    if not debug:
2022
 
        try:
2023
 
            with pidfile:
2024
 
                pid = os.getpid()
2025
 
                pidfile.write(str(pid) + "\n".encode("utf-8"))
2026
 
            del pidfile
2027
 
        except IOError:
2028
 
            logger.error("Could not write to file %r with PID %d",
2029
 
                         pidfilename, pid)
2030
 
        except NameError:
2031
 
            # "pidfile" was never created
2032
 
            pass
 
2504
    
 
2505
    if not foreground:
 
2506
        if pidfile is not None:
 
2507
            try:
 
2508
                with pidfile:
 
2509
                    pid = os.getpid()
 
2510
                    pidfile.write(str(pid) + "\n".encode("utf-8"))
 
2511
            except IOError:
 
2512
                logger.error("Could not write to file %r with PID %d",
 
2513
                             pidfilename, pid)
 
2514
        del pidfile
2033
2515
        del pidfilename
2034
 
        
2035
 
        signal.signal(signal.SIGINT, signal.SIG_IGN)
2036
2516
    
2037
2517
    signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2038
2518
    signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
2039
2519
    
2040
2520
    if use_dbus:
2041
 
        class MandosDBusService(dbus.service.Object):
 
2521
        @alternate_dbus_interfaces({"se.recompile.Mandos":
 
2522
                                        "se.bsnet.fukt.Mandos"})
 
2523
        class MandosDBusService(DBusObjectWithProperties):
2042
2524
            """A D-Bus proxy object"""
2043
2525
            def __init__(self):
2044
2526
                dbus.service.Object.__init__(self, bus, "/")
2045
2527
            _interface = "se.recompile.Mandos"
2046
2528
            
 
2529
            @dbus_interface_annotations(_interface)
 
2530
            def _foo(self):
 
2531
                return { "org.freedesktop.DBus.Property"
 
2532
                         ".EmitsChangedSignal":
 
2533
                             "false"}
 
2534
            
2047
2535
            @dbus.service.signal(_interface, signature="o")
2048
2536
            def ClientAdded(self, objpath):
2049
2537
                "D-Bus signal"
2063
2551
            def GetAllClients(self):
2064
2552
                "D-Bus method"
2065
2553
                return dbus.Array(c.dbus_object_path
2066
 
                                  for c in tcp_server.clients)
 
2554
                                  for c in
 
2555
                                  tcp_server.clients.itervalues())
2067
2556
            
2068
2557
            @dbus.service.method(_interface,
2069
2558
                                 out_signature="a{oa{sv}}")
2071
2560
                "D-Bus method"
2072
2561
                return dbus.Dictionary(
2073
2562
                    ((c.dbus_object_path, c.GetAll(""))
2074
 
                     for c in tcp_server.clients),
 
2563
                     for c in tcp_server.clients.itervalues()),
2075
2564
                    signature="oa{sv}")
2076
2565
            
2077
2566
            @dbus.service.method(_interface, in_signature="o")
2078
2567
            def RemoveClient(self, object_path):
2079
2568
                "D-Bus method"
2080
 
                for c in tcp_server.clients:
 
2569
                for c in tcp_server.clients.itervalues():
2081
2570
                    if c.dbus_object_path == object_path:
2082
 
                        tcp_server.clients.remove(c)
 
2571
                        del tcp_server.clients[c.name]
2083
2572
                        c.remove_from_connection()
2084
2573
                        # Don't signal anything except ClientRemoved
2085
2574
                        c.disable(quiet=True)
2090
2579
            
2091
2580
            del _interface
2092
2581
        
2093
 
        class MandosDBusServiceTransitional(MandosDBusService):
2094
 
            __metaclass__ = AlternateDBusNamesMetaclass
2095
 
        mandos_dbus_service = MandosDBusServiceTransitional()
 
2582
        mandos_dbus_service = MandosDBusService()
2096
2583
    
2097
2584
    def cleanup():
2098
2585
        "Cleanup function; run on exit"
2099
2586
        service.cleanup()
2100
2587
        
 
2588
        multiprocessing.active_children()
 
2589
        if not (tcp_server.clients or client_settings):
 
2590
            return
 
2591
        
 
2592
        # Store client before exiting. Secrets are encrypted with key
 
2593
        # based on what config file has. If config file is
 
2594
        # removed/edited, old secret will thus be unrecovable.
 
2595
        clients = {}
 
2596
        with PGPEngine() as pgp:
 
2597
            for client in tcp_server.clients.itervalues():
 
2598
                key = client_settings[client.name]["secret"]
 
2599
                client.encrypted_secret = pgp.encrypt(client.secret,
 
2600
                                                      key)
 
2601
                client_dict = {}
 
2602
                
 
2603
                # A list of attributes that can not be pickled
 
2604
                # + secret.
 
2605
                exclude = set(("bus", "changedstate", "secret",
 
2606
                               "checker"))
 
2607
                for name, typ in (inspect.getmembers
 
2608
                                  (dbus.service.Object)):
 
2609
                    exclude.add(name)
 
2610
                
 
2611
                client_dict["encrypted_secret"] = (client
 
2612
                                                   .encrypted_secret)
 
2613
                for attr in client.client_structure:
 
2614
                    if attr not in exclude:
 
2615
                        client_dict[attr] = getattr(client, attr)
 
2616
                
 
2617
                clients[client.name] = client_dict
 
2618
                del client_settings[client.name]["secret"]
 
2619
        
 
2620
        try:
 
2621
            with (tempfile.NamedTemporaryFile
 
2622
                  (mode='wb', suffix=".pickle", prefix='clients-',
 
2623
                   dir=os.path.dirname(stored_state_path),
 
2624
                   delete=False)) as stored_state:
 
2625
                pickle.dump((clients, client_settings), stored_state)
 
2626
                tempname=stored_state.name
 
2627
            os.rename(tempname, stored_state_path)
 
2628
        except (IOError, OSError) as e:
 
2629
            if not debug:
 
2630
                try:
 
2631
                    os.remove(tempname)
 
2632
                except NameError:
 
2633
                    pass
 
2634
            if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
 
2635
                logger.warning("Could not save persistent state: {0}"
 
2636
                               .format(os.strerror(e.errno)))
 
2637
            else:
 
2638
                logger.warning("Could not save persistent state:",
 
2639
                               exc_info=e)
 
2640
                raise e
 
2641
        
 
2642
        # Delete all clients, and settings from config
2101
2643
        while tcp_server.clients:
2102
 
            client = tcp_server.clients.pop()
 
2644
            name, client = tcp_server.clients.popitem()
2103
2645
            if use_dbus:
2104
2646
                client.remove_from_connection()
2105
 
            client.disable_hook = None
2106
2647
            # Don't signal anything except ClientRemoved
2107
2648
            client.disable(quiet=True)
2108
2649
            if use_dbus:
2109
2650
                # Emit D-Bus signal
2110
 
                mandos_dbus_service.ClientRemoved(client.dbus_object_path,
 
2651
                mandos_dbus_service.ClientRemoved(client
 
2652
                                                  .dbus_object_path,
2111
2653
                                                  client.name)
 
2654
        client_settings.clear()
2112
2655
    
2113
2656
    atexit.register(cleanup)
2114
2657
    
2115
 
    for client in tcp_server.clients:
 
2658
    for client in tcp_server.clients.itervalues():
2116
2659
        if use_dbus:
2117
2660
            # Emit D-Bus signal
2118
2661
            mandos_dbus_service.ClientAdded(client.dbus_object_path)
2119
 
        client.enable()
 
2662
        # Need to initiate checking of clients
 
2663
        if client.enabled:
 
2664
            client.init_checker()
2120
2665
    
2121
2666
    tcp_server.enable()
2122
2667
    tcp_server.server_activate()
2125
2670
    service.port = tcp_server.socket.getsockname()[1]
2126
2671
    if use_ipv6:
2127
2672
        logger.info("Now listening on address %r, port %d,"
2128
 
                    " flowinfo %d, scope_id %d"
2129
 
                    % tcp_server.socket.getsockname())
 
2673
                    " flowinfo %d, scope_id %d",
 
2674
                    *tcp_server.socket.getsockname())
2130
2675
    else:                       # IPv4
2131
 
        logger.info("Now listening on address %r, port %d"
2132
 
                    % tcp_server.socket.getsockname())
 
2676
        logger.info("Now listening on address %r, port %d",
 
2677
                    *tcp_server.socket.getsockname())
2133
2678
    
2134
2679
    #service.interface = tcp_server.socket.getsockname()[3]
2135
2680
    
2138
2683
        try:
2139
2684
            service.activate()
2140
2685
        except dbus.exceptions.DBusException as error:
2141
 
            logger.critical("DBusException: %s", error)
 
2686
            logger.critical("D-Bus Exception", exc_info=error)
2142
2687
            cleanup()
2143
2688
            sys.exit(1)
2144
2689
        # End of Avahi example code
2151
2696
        logger.debug("Starting main loop")
2152
2697
        main_loop.run()
2153
2698
    except AvahiError as error:
2154
 
        logger.critical("AvahiError: %s", error)
 
2699
        logger.critical("Avahi Error", exc_info=error)
2155
2700
        cleanup()
2156
2701
        sys.exit(1)
2157
2702
    except KeyboardInterrupt:
2162
2707
    # Must run before the D-Bus bus name gets deregistered
2163
2708
    cleanup()
2164
2709
 
2165
 
 
2166
2710
if __name__ == '__main__':
2167
2711
    main()