/mandos/release

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/release

« back to all changes in this revision

Viewing changes to mandos

  • Committer: Teddy Hogeborn
  • Date: 2015-05-23 12:07:07 UTC
  • mto: (237.7.304 trunk)
  • mto: This revision was merged to the branch mainline in revision 325.
  • Revision ID: teddy@recompile.se-20150523120707-t5fq0brh2kxkvw8g
mandos: Some more minor changes to prepare for Python 3.

Show diffs side-by-side

added added

removed removed

Lines of Context:
1
 
#!/usr/bin/python
 
1
#!/usr/bin/python2.7
2
2
# -*- mode: python; coding: utf-8 -*-
3
3
4
4
# Mandos server - give out binary blobs to connecting clients.
11
11
# "AvahiService" class, and some lines in "main".
12
12
13
13
# Everything else is
14
 
# Copyright © 2008-2014 Teddy Hogeborn
15
 
# Copyright © 2008-2014 Björn Påhlsson
 
14
# Copyright © 2008-2015 Teddy Hogeborn
 
15
# Copyright © 2008-2015 Björn Påhlsson
16
16
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
36
36
 
37
37
from future_builtins import *
38
38
 
39
 
import SocketServer as socketserver
 
39
try:
 
40
    import SocketServer as socketserver
 
41
except ImportError:
 
42
    import socketserver
40
43
import socket
41
44
import argparse
42
45
import datetime
47
50
import gnutls.library.functions
48
51
import gnutls.library.constants
49
52
import gnutls.library.types
50
 
import ConfigParser as configparser
 
53
try:
 
54
    import ConfigParser as configparser
 
55
except ImportError:
 
56
    import configparser
51
57
import sys
52
58
import re
53
59
import os
62
68
import struct
63
69
import fcntl
64
70
import functools
65
 
import cPickle as pickle
 
71
try:
 
72
    import cPickle as pickle
 
73
except ImportError:
 
74
    import pickle
66
75
import multiprocessing
67
76
import types
68
77
import binascii
72
81
 
73
82
import dbus
74
83
import dbus.service
75
 
import gobject
 
84
try:
 
85
    import gobject
 
86
except ImportError:
 
87
    from gi.repository import GObject as gobject
76
88
import avahi
77
89
from dbus.mainloop.glib import DBusGMainLoop
78
90
import ctypes
88
100
    except ImportError:
89
101
        SO_BINDTODEVICE = None
90
102
 
91
 
version = "1.6.4"
 
103
if sys.version_info.major == 2:
 
104
    str = unicode
 
105
 
 
106
version = "1.6.9"
92
107
stored_state_file = "clients.pickle"
93
108
 
94
109
logger = logging.getLogger()
95
110
syslogger = None
96
111
 
97
112
try:
98
 
    if_nametoindex = (ctypes.cdll.LoadLibrary
99
 
                      (ctypes.util.find_library("c"))
100
 
                      .if_nametoindex)
 
113
    if_nametoindex = ctypes.cdll.LoadLibrary(
 
114
        ctypes.util.find_library("c")).if_nametoindex
101
115
except (OSError, AttributeError):
 
116
    
102
117
    def if_nametoindex(interface):
103
118
        "Get an interface index the hard way, i.e. using fcntl()"
104
119
        SIOCGIFINDEX = 0x8933  # From /usr/include/linux/sockios.h
105
120
        with contextlib.closing(socket.socket()) as s:
106
121
            ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
107
 
                                struct.pack(str("16s16x"),
108
 
                                            interface))
109
 
        interface_index = struct.unpack(str("I"),
110
 
                                        ifreq[16:20])[0]
 
122
                                struct.pack(b"16s16x", interface))
 
123
        interface_index = struct.unpack("I", ifreq[16:20])[0]
111
124
        return interface_index
112
125
 
113
126
 
114
127
def initlogger(debug, level=logging.WARNING):
115
128
    """init logger and add loglevel"""
116
129
    
117
 
    syslogger = (logging.handlers.SysLogHandler
118
 
                 (facility =
119
 
                  logging.handlers.SysLogHandler.LOG_DAEMON,
120
 
                  address = str("/dev/log")))
 
130
    global syslogger
 
131
    syslogger = (logging.handlers.SysLogHandler(
 
132
        facility = logging.handlers.SysLogHandler.LOG_DAEMON,
 
133
        address = "/dev/log"))
121
134
    syslogger.setFormatter(logging.Formatter
122
135
                           ('Mandos [%(process)d]: %(levelname)s:'
123
136
                            ' %(message)s'))
140
153
 
141
154
class PGPEngine(object):
142
155
    """A simple class for OpenPGP symmetric encryption & decryption"""
 
156
    
143
157
    def __init__(self):
144
158
        self.tempdir = tempfile.mkdtemp(prefix="mandos-")
145
159
        self.gnupgargs = ['--batch',
184
198
    
185
199
    def encrypt(self, data, password):
186
200
        passphrase = self.password_encode(password)
187
 
        with tempfile.NamedTemporaryFile(dir=self.tempdir
188
 
                                         ) as passfile:
 
201
        with tempfile.NamedTemporaryFile(
 
202
                dir=self.tempdir) as passfile:
189
203
            passfile.write(passphrase)
190
204
            passfile.flush()
191
205
            proc = subprocess.Popen(['gpg', '--symmetric',
202
216
    
203
217
    def decrypt(self, data, password):
204
218
        passphrase = self.password_encode(password)
205
 
        with tempfile.NamedTemporaryFile(dir = self.tempdir
206
 
                                         ) as passfile:
 
219
        with tempfile.NamedTemporaryFile(
 
220
                dir = self.tempdir) as passfile:
207
221
            passfile.write(passphrase)
208
222
            passfile.flush()
209
223
            proc = subprocess.Popen(['gpg', '--decrypt',
213
227
                                    stdin = subprocess.PIPE,
214
228
                                    stdout = subprocess.PIPE,
215
229
                                    stderr = subprocess.PIPE)
216
 
            decrypted_plaintext, err = proc.communicate(input
217
 
                                                        = data)
 
230
            decrypted_plaintext, err = proc.communicate(input = data)
218
231
        if proc.returncode != 0:
219
232
            raise PGPError(err)
220
233
        return decrypted_plaintext
223
236
class AvahiError(Exception):
224
237
    def __init__(self, value, *args, **kwargs):
225
238
        self.value = value
226
 
        super(AvahiError, self).__init__(value, *args, **kwargs)
227
 
    def __unicode__(self):
228
 
        return unicode(repr(self.value))
 
239
        return super(AvahiError, self).__init__(value, *args,
 
240
                                                **kwargs)
 
241
 
229
242
 
230
243
class AvahiServiceError(AvahiError):
231
244
    pass
232
245
 
 
246
 
233
247
class AvahiGroupError(AvahiError):
234
248
    pass
235
249
 
255
269
    bus: dbus.SystemBus()
256
270
    """
257
271
    
258
 
    def __init__(self, interface = avahi.IF_UNSPEC, name = None,
259
 
                 servicetype = None, port = None, TXT = None,
260
 
                 domain = "", host = "", max_renames = 32768,
261
 
                 protocol = avahi.PROTO_UNSPEC, bus = None):
 
272
    def __init__(self,
 
273
                 interface = avahi.IF_UNSPEC,
 
274
                 name = None,
 
275
                 servicetype = None,
 
276
                 port = None,
 
277
                 TXT = None,
 
278
                 domain = "",
 
279
                 host = "",
 
280
                 max_renames = 32768,
 
281
                 protocol = avahi.PROTO_UNSPEC,
 
282
                 bus = None):
262
283
        self.interface = interface
263
284
        self.name = name
264
285
        self.type = servicetype
274
295
        self.bus = bus
275
296
        self.entry_group_state_changed_match = None
276
297
    
277
 
    def rename(self):
 
298
    def rename(self, remove=True):
278
299
        """Derived from the Avahi example code"""
279
300
        if self.rename_count >= self.max_renames:
280
301
            logger.critical("No suitable Zeroconf service name found"
281
302
                            " after %i retries, exiting.",
282
303
                            self.rename_count)
283
304
            raise AvahiServiceError("Too many renames")
284
 
        self.name = unicode(self.server
285
 
                            .GetAlternativeServiceName(self.name))
 
305
        self.name = str(
 
306
            self.server.GetAlternativeServiceName(self.name))
 
307
        self.rename_count += 1
286
308
        logger.info("Changing Zeroconf service name to %r ...",
287
309
                    self.name)
288
 
        self.remove()
 
310
        if remove:
 
311
            self.remove()
289
312
        try:
290
313
            self.add()
291
314
        except dbus.exceptions.DBusException as error:
292
 
            logger.critical("D-Bus Exception", exc_info=error)
293
 
            self.cleanup()
294
 
            os._exit(1)
295
 
        self.rename_count += 1
 
315
            if (error.get_dbus_name()
 
316
                == "org.freedesktop.Avahi.CollisionError"):
 
317
                logger.info("Local Zeroconf service name collision.")
 
318
                return self.rename(remove=False)
 
319
            else:
 
320
                logger.critical("D-Bus Exception", exc_info=error)
 
321
                self.cleanup()
 
322
                os._exit(1)
296
323
    
297
324
    def remove(self):
298
325
        """Derived from the Avahi example code"""
336
363
            self.rename()
337
364
        elif state == avahi.ENTRY_GROUP_FAILURE:
338
365
            logger.critical("Avahi: Error in group state changed %s",
339
 
                            unicode(error))
340
 
            raise AvahiGroupError("State changed: {0!s}"
341
 
                                  .format(error))
 
366
                            str(error))
 
367
            raise AvahiGroupError("State changed: {!s}".format(error))
342
368
    
343
369
    def cleanup(self):
344
370
        """Derived from the Avahi example code"""
354
380
    def server_state_changed(self, state, error=None):
355
381
        """Derived from the Avahi example code"""
356
382
        logger.debug("Avahi server state change: %i", state)
357
 
        bad_states = { avahi.SERVER_INVALID:
358
 
                           "Zeroconf server invalid",
359
 
                       avahi.SERVER_REGISTERING: None,
360
 
                       avahi.SERVER_COLLISION:
361
 
                           "Zeroconf server name collision",
362
 
                       avahi.SERVER_FAILURE:
363
 
                           "Zeroconf server failure" }
 
383
        bad_states = {
 
384
            avahi.SERVER_INVALID: "Zeroconf server invalid",
 
385
            avahi.SERVER_REGISTERING: None,
 
386
            avahi.SERVER_COLLISION: "Zeroconf server name collision",
 
387
            avahi.SERVER_FAILURE: "Zeroconf server failure",
 
388
        }
364
389
        if state in bad_states:
365
390
            if bad_states[state] is not None:
366
391
                if error is None:
385
410
                                    follow_name_owner_changes=True),
386
411
                avahi.DBUS_INTERFACE_SERVER)
387
412
        self.server.connect_to_signal("StateChanged",
388
 
                                 self.server_state_changed)
 
413
                                      self.server_state_changed)
389
414
        self.server_state_changed(self.server.GetState())
390
415
 
391
416
 
392
417
class AvahiServiceToSyslog(AvahiService):
393
 
    def rename(self):
 
418
    def rename(self, *args, **kwargs):
394
419
        """Add the new name to the syslog messages"""
395
 
        ret = AvahiService.rename(self)
396
 
        syslogger.setFormatter(logging.Formatter
397
 
                               ('Mandos ({0}) [%(process)d]:'
398
 
                                ' %(levelname)s: %(message)s'
399
 
                                .format(self.name)))
 
420
        ret = AvahiService.rename(self, *args, **kwargs)
 
421
        syslogger.setFormatter(logging.Formatter(
 
422
            'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
 
423
            .format(self.name)))
400
424
        return ret
401
425
 
402
426
 
403
 
def timedelta_to_milliseconds(td):
404
 
    "Convert a datetime.timedelta() to milliseconds"
405
 
    return ((td.days * 24 * 60 * 60 * 1000)
406
 
            + (td.seconds * 1000)
407
 
            + (td.microseconds // 1000))
408
 
 
409
 
 
410
427
class Client(object):
411
428
    """A representation of a client host served by this server.
412
429
    
456
473
                          "fingerprint", "host", "interval",
457
474
                          "last_approval_request", "last_checked_ok",
458
475
                          "last_enabled", "name", "timeout")
459
 
    client_defaults = { "timeout": "PT5M",
460
 
                        "extended_timeout": "PT15M",
461
 
                        "interval": "PT2M",
462
 
                        "checker": "fping -q -- %%(host)s",
463
 
                        "host": "",
464
 
                        "approval_delay": "PT0S",
465
 
                        "approval_duration": "PT1S",
466
 
                        "approved_by_default": "True",
467
 
                        "enabled": "True",
468
 
                        }
469
 
    
470
 
    def timeout_milliseconds(self):
471
 
        "Return the 'timeout' attribute in milliseconds"
472
 
        return timedelta_to_milliseconds(self.timeout)
473
 
    
474
 
    def extended_timeout_milliseconds(self):
475
 
        "Return the 'extended_timeout' attribute in milliseconds"
476
 
        return timedelta_to_milliseconds(self.extended_timeout)
477
 
    
478
 
    def interval_milliseconds(self):
479
 
        "Return the 'interval' attribute in milliseconds"
480
 
        return timedelta_to_milliseconds(self.interval)
481
 
    
482
 
    def approval_delay_milliseconds(self):
483
 
        return timedelta_to_milliseconds(self.approval_delay)
 
476
    client_defaults = {
 
477
        "timeout": "PT5M",
 
478
        "extended_timeout": "PT15M",
 
479
        "interval": "PT2M",
 
480
        "checker": "fping -q -- %%(host)s",
 
481
        "host": "",
 
482
        "approval_delay": "PT0S",
 
483
        "approval_duration": "PT1S",
 
484
        "approved_by_default": "True",
 
485
        "enabled": "True",
 
486
    }
484
487
    
485
488
    @staticmethod
486
489
    def config_parser(config):
502
505
            client["enabled"] = config.getboolean(client_name,
503
506
                                                  "enabled")
504
507
            
 
508
            # Uppercase and remove spaces from fingerprint for later
 
509
            # comparison purposes with return value from the
 
510
            # fingerprint() function
505
511
            client["fingerprint"] = (section["fingerprint"].upper()
506
512
                                     .replace(" ", ""))
507
513
            if "secret" in section:
512
518
                          "rb") as secfile:
513
519
                    client["secret"] = secfile.read()
514
520
            else:
515
 
                raise TypeError("No secret or secfile for section {0}"
 
521
                raise TypeError("No secret or secfile for section {}"
516
522
                                .format(section))
517
523
            client["timeout"] = string_to_delta(section["timeout"])
518
524
            client["extended_timeout"] = string_to_delta(
535
541
            server_settings = {}
536
542
        self.server_settings = server_settings
537
543
        # adding all client settings
538
 
        for setting, value in settings.iteritems():
 
544
        for setting, value in settings.items():
539
545
            setattr(self, setting, value)
540
546
        
541
547
        if self.enabled:
549
555
            self.expires = None
550
556
        
551
557
        logger.debug("Creating client %r", self.name)
552
 
        # Uppercase and remove spaces from fingerprint for later
553
 
        # comparison purposes with return value from the fingerprint()
554
 
        # function
555
558
        logger.debug("  Fingerprint: %s", self.fingerprint)
556
559
        self.created = settings.get("created",
557
560
                                    datetime.datetime.utcnow())
564
567
        self.current_checker_command = None
565
568
        self.approved = None
566
569
        self.approvals_pending = 0
567
 
        self.changedstate = (multiprocessing_manager
568
 
                             .Condition(multiprocessing_manager
569
 
                                        .Lock()))
570
 
        self.client_structure = [attr for attr in
571
 
                                 self.__dict__.iterkeys()
 
570
        self.changedstate = multiprocessing_manager.Condition(
 
571
            multiprocessing_manager.Lock())
 
572
        self.client_structure = [attr
 
573
                                 for attr in self.__dict__.iterkeys()
572
574
                                 if not attr.startswith("_")]
573
575
        self.client_structure.append("client_structure")
574
576
        
575
 
        for name, t in inspect.getmembers(type(self),
576
 
                                          lambda obj:
577
 
                                              isinstance(obj,
578
 
                                                         property)):
 
577
        for name, t in inspect.getmembers(
 
578
                type(self), lambda obj: isinstance(obj, property)):
579
579
            if not name.startswith("_"):
580
580
                self.client_structure.append(name)
581
581
    
623
623
        # and every interval from then on.
624
624
        if self.checker_initiator_tag is not None:
625
625
            gobject.source_remove(self.checker_initiator_tag)
626
 
        self.checker_initiator_tag = (gobject.timeout_add
627
 
                                      (self.interval_milliseconds(),
628
 
                                       self.start_checker))
 
626
        self.checker_initiator_tag = gobject.timeout_add(
 
627
            int(self.interval.total_seconds() * 1000),
 
628
            self.start_checker)
629
629
        # Schedule a disable() when 'timeout' has passed
630
630
        if self.disable_initiator_tag is not None:
631
631
            gobject.source_remove(self.disable_initiator_tag)
632
 
        self.disable_initiator_tag = (gobject.timeout_add
633
 
                                   (self.timeout_milliseconds(),
634
 
                                    self.disable))
 
632
        self.disable_initiator_tag = gobject.timeout_add(
 
633
            int(self.timeout.total_seconds() * 1000), self.disable)
635
634
        # Also start a new checker *right now*.
636
635
        self.start_checker()
637
636
    
646
645
                            vars(self))
647
646
                self.checked_ok()
648
647
            else:
649
 
                logger.info("Checker for %(name)s failed",
650
 
                            vars(self))
 
648
                logger.info("Checker for %(name)s failed", vars(self))
651
649
        else:
652
650
            self.last_checker_status = -1
653
651
            logger.warning("Checker for %(name)s crashed?",
667
665
            gobject.source_remove(self.disable_initiator_tag)
668
666
            self.disable_initiator_tag = None
669
667
        if getattr(self, "enabled", False):
670
 
            self.disable_initiator_tag = (gobject.timeout_add
671
 
                                          (timedelta_to_milliseconds
672
 
                                           (timeout), self.disable))
 
668
            self.disable_initiator_tag = gobject.timeout_add(
 
669
                int(timeout.total_seconds() * 1000), self.disable)
673
670
            self.expires = datetime.datetime.utcnow() + timeout
674
671
    
675
672
    def need_approval(self):
706
703
        # Start a new checker if needed
707
704
        if self.checker is None:
708
705
            # Escape attributes for the shell
709
 
            escaped_attrs = dict(
710
 
                (attr, re.escape(unicode(getattr(self, attr))))
711
 
                for attr in
712
 
                self.runtime_expansions)
 
706
            escaped_attrs = {
 
707
                attr: re.escape(str(getattr(self, attr)))
 
708
                for attr in self.runtime_expansions }
713
709
            try:
714
710
                command = self.checker_command % escaped_attrs
715
711
            except TypeError as error:
716
712
                logger.error('Could not format string "%s"',
717
 
                             self.checker_command, exc_info=error)
718
 
                return True # Try again later
 
713
                             self.checker_command,
 
714
                             exc_info=error)
 
715
                return True     # Try again later
719
716
            self.current_checker_command = command
720
717
            try:
721
 
                logger.info("Starting checker %r for %s",
722
 
                            command, self.name)
 
718
                logger.info("Starting checker %r for %s", command,
 
719
                            self.name)
723
720
                # We don't need to redirect stdout and stderr, since
724
721
                # in normal mode, that is already done by daemon(),
725
722
                # and in debug mode we don't want to.  (Stdin is
734
731
                                       "stderr": wnull })
735
732
                self.checker = subprocess.Popen(command,
736
733
                                                close_fds=True,
737
 
                                                shell=True, cwd="/",
 
734
                                                shell=True,
 
735
                                                cwd="/",
738
736
                                                **popen_args)
739
737
            except OSError as error:
740
738
                logger.error("Failed to start subprocess",
741
739
                             exc_info=error)
742
740
                return True
743
 
            self.checker_callback_tag = (gobject.child_watch_add
744
 
                                         (self.checker.pid,
745
 
                                          self.checker_callback,
746
 
                                          data=command))
 
741
            self.checker_callback_tag = gobject.child_watch_add(
 
742
                self.checker.pid, self.checker_callback, data=command)
747
743
            # The checker may have completed before the gobject
748
744
            # watch was added.  Check for this.
749
745
            try:
780
776
        self.checker = None
781
777
 
782
778
 
783
 
def dbus_service_property(dbus_interface, signature="v",
784
 
                          access="readwrite", byte_arrays=False):
 
779
def dbus_service_property(dbus_interface,
 
780
                          signature="v",
 
781
                          access="readwrite",
 
782
                          byte_arrays=False):
785
783
    """Decorators for marking methods of a DBusObjectWithProperties to
786
784
    become properties on the D-Bus.
787
785
    
796
794
    # "Set" method, so we fail early here:
797
795
    if byte_arrays and signature != "ay":
798
796
        raise ValueError("Byte arrays not supported for non-'ay'"
799
 
                         " signature {0!r}".format(signature))
 
797
                         " signature {!r}".format(signature))
 
798
    
800
799
    def decorator(func):
801
800
        func._dbus_is_property = True
802
801
        func._dbus_interface = dbus_interface
807
806
            func._dbus_name = func._dbus_name[:-14]
808
807
        func._dbus_get_args_options = {'byte_arrays': byte_arrays }
809
808
        return func
 
809
    
810
810
    return decorator
811
811
 
812
812
 
821
821
                "org.freedesktop.DBus.Property.EmitsChangedSignal":
822
822
                    "false"}
823
823
    """
 
824
    
824
825
    def decorator(func):
825
826
        func._dbus_is_interface = True
826
827
        func._dbus_interface = dbus_interface
827
828
        func._dbus_name = dbus_interface
828
829
        return func
 
830
    
829
831
    return decorator
830
832
 
831
833
 
833
835
    """Decorator to annotate D-Bus methods, signals or properties
834
836
    Usage:
835
837
    
 
838
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",
 
839
                       "org.freedesktop.DBus.Property."
 
840
                       "EmitsChangedSignal": "false"})
836
841
    @dbus_service_property("org.example.Interface", signature="b",
837
842
                           access="r")
838
 
    @dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",
839
 
                        "org.freedesktop.DBus.Property."
840
 
                        "EmitsChangedSignal": "false"})
841
843
    def Property_dbus_property(self):
842
844
        return dbus.Boolean(False)
843
845
    """
 
846
    
844
847
    def decorator(func):
845
848
        func._dbus_annotations = annotations
846
849
        return func
 
850
    
847
851
    return decorator
848
852
 
849
853
 
850
854
class DBusPropertyException(dbus.exceptions.DBusException):
851
855
    """A base class for D-Bus property-related exceptions
852
856
    """
853
 
    def __unicode__(self):
854
 
        return unicode(str(self))
 
857
    pass
855
858
 
856
859
 
857
860
class DBusPropertyAccessException(DBusPropertyException):
881
884
        If called like _is_dbus_thing("method") it returns a function
882
885
        suitable for use as predicate to inspect.getmembers().
883
886
        """
884
 
        return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),
 
887
        return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
885
888
                                   False)
886
889
    
887
890
    def _get_all_dbus_things(self, thing):
888
891
        """Returns a generator of (name, attribute) pairs
889
892
        """
890
 
        return ((getattr(athing.__get__(self), "_dbus_name",
891
 
                         name),
 
893
        return ((getattr(athing.__get__(self), "_dbus_name", name),
892
894
                 athing.__get__(self))
893
895
                for cls in self.__class__.__mro__
894
896
                for name, athing in
895
 
                inspect.getmembers(cls,
896
 
                                   self._is_dbus_thing(thing)))
 
897
                inspect.getmembers(cls, self._is_dbus_thing(thing)))
897
898
    
898
899
    def _get_dbus_property(self, interface_name, property_name):
899
900
        """Returns a bound method if one exists which is a D-Bus
900
901
        property with the specified name and interface.
901
902
        """
902
 
        for cls in  self.__class__.__mro__:
903
 
            for name, value in (inspect.getmembers
904
 
                                (cls,
905
 
                                 self._is_dbus_thing("property"))):
 
903
        for cls in self.__class__.__mro__:
 
904
            for name, value in inspect.getmembers(
 
905
                    cls, self._is_dbus_thing("property")):
906
906
                if (value._dbus_name == property_name
907
907
                    and value._dbus_interface == interface_name):
908
908
                    return value.__get__(self)
909
909
        
910
910
        # No such property
911
 
        raise DBusPropertyNotFound(self.dbus_object_path + ":"
912
 
                                   + interface_name + "."
913
 
                                   + property_name)
 
911
        raise DBusPropertyNotFound("{}:{}.{}".format(
 
912
            self.dbus_object_path, interface_name, property_name))
914
913
    
915
 
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
 
914
    @dbus.service.method(dbus.PROPERTIES_IFACE,
 
915
                         in_signature="ss",
916
916
                         out_signature="v")
917
917
    def Get(self, interface_name, property_name):
918
918
        """Standard D-Bus property Get() method, see D-Bus standard.
937
937
            # signatures other than "ay".
938
938
            if prop._dbus_signature != "ay":
939
939
                raise ValueError("Byte arrays not supported for non-"
940
 
                                 "'ay' signature {0!r}"
 
940
                                 "'ay' signature {!r}"
941
941
                                 .format(prop._dbus_signature))
942
942
            value = dbus.ByteArray(b''.join(chr(byte)
943
943
                                            for byte in value))
944
944
        prop(value)
945
945
    
946
 
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
 
946
    @dbus.service.method(dbus.PROPERTIES_IFACE,
 
947
                         in_signature="s",
947
948
                         out_signature="a{sv}")
948
949
    def GetAll(self, interface_name):
949
950
        """Standard D-Bus property GetAll() method, see D-Bus
964
965
            if not hasattr(value, "variant_level"):
965
966
                properties[name] = value
966
967
                continue
967
 
            properties[name] = type(value)(value, variant_level=
968
 
                                           value.variant_level+1)
 
968
            properties[name] = type(value)(
 
969
                value, variant_level = value.variant_level + 1)
969
970
        return dbus.Dictionary(properties, signature="sv")
970
971
    
 
972
    @dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")
 
973
    def PropertiesChanged(self, interface_name, changed_properties,
 
974
                          invalidated_properties):
 
975
        """Standard D-Bus PropertiesChanged() signal, see D-Bus
 
976
        standard.
 
977
        """
 
978
        pass
 
979
    
971
980
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
972
981
                         out_signature="s",
973
982
                         path_keyword='object_path',
981
990
                                                   connection)
982
991
        try:
983
992
            document = xml.dom.minidom.parseString(xmlstring)
 
993
            
984
994
            def make_tag(document, name, prop):
985
995
                e = document.createElement("property")
986
996
                e.setAttribute("name", name)
987
997
                e.setAttribute("type", prop._dbus_signature)
988
998
                e.setAttribute("access", prop._dbus_access)
989
999
                return e
 
1000
            
990
1001
            for if_tag in document.getElementsByTagName("interface"):
991
1002
                # Add property tags
992
1003
                for tag in (make_tag(document, name, prop)
1004
1015
                            if (name == tag.getAttribute("name")
1005
1016
                                and prop._dbus_interface
1006
1017
                                == if_tag.getAttribute("name")):
1007
 
                                annots.update(getattr
1008
 
                                              (prop,
1009
 
                                               "_dbus_annotations",
1010
 
                                               {}))
1011
 
                        for name, value in annots.iteritems():
 
1018
                                annots.update(getattr(
 
1019
                                    prop, "_dbus_annotations", {}))
 
1020
                        for name, value in annots.items():
1012
1021
                            ann_tag = document.createElement(
1013
1022
                                "annotation")
1014
1023
                            ann_tag.setAttribute("name", name)
1017
1026
                # Add interface annotation tags
1018
1027
                for annotation, value in dict(
1019
1028
                    itertools.chain.from_iterable(
1020
 
                        annotations().iteritems()
1021
 
                        for name, annotations in
1022
 
                        self._get_all_dbus_things("interface")
 
1029
                        annotations().items()
 
1030
                        for name, annotations
 
1031
                        in self._get_all_dbus_things("interface")
1023
1032
                        if name == if_tag.getAttribute("name")
1024
 
                        )).iteritems():
 
1033
                        )).items():
1025
1034
                    ann_tag = document.createElement("annotation")
1026
1035
                    ann_tag.setAttribute("name", annotation)
1027
1036
                    ann_tag.setAttribute("value", value)
1054
1063
    """Convert a UTC datetime.datetime() to a D-Bus type."""
1055
1064
    if dt is None:
1056
1065
        return dbus.String("", variant_level = variant_level)
1057
 
    return dbus.String(dt.isoformat(),
1058
 
                       variant_level=variant_level)
 
1066
    return dbus.String(dt.isoformat(), variant_level=variant_level)
1059
1067
 
1060
1068
 
1061
1069
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
1081
1089
    (from DBusObjectWithProperties) and interfaces (from the
1082
1090
    dbus_interface_annotations decorator).
1083
1091
    """
 
1092
    
1084
1093
    def wrapper(cls):
1085
1094
        for orig_interface_name, alt_interface_name in (
1086
 
            alt_interface_names.iteritems()):
 
1095
                alt_interface_names.items()):
1087
1096
            attr = {}
1088
1097
            interface_names = set()
1089
1098
            # Go though all attributes of the class
1091
1100
                # Ignore non-D-Bus attributes, and D-Bus attributes
1092
1101
                # with the wrong interface name
1093
1102
                if (not hasattr(attribute, "_dbus_interface")
1094
 
                    or not attribute._dbus_interface
1095
 
                    .startswith(orig_interface_name)):
 
1103
                    or not attribute._dbus_interface.startswith(
 
1104
                        orig_interface_name)):
1096
1105
                    continue
1097
1106
                # Create an alternate D-Bus interface name based on
1098
1107
                # the current name
1099
 
                alt_interface = (attribute._dbus_interface
1100
 
                                 .replace(orig_interface_name,
1101
 
                                          alt_interface_name))
 
1108
                alt_interface = attribute._dbus_interface.replace(
 
1109
                    orig_interface_name, alt_interface_name)
1102
1110
                interface_names.add(alt_interface)
1103
1111
                # Is this a D-Bus signal?
1104
1112
                if getattr(attribute, "_dbus_is_signal", False):
1105
1113
                    # Extract the original non-method undecorated
1106
1114
                    # function by black magic
1107
1115
                    nonmethod_func = (dict(
1108
 
                            zip(attribute.func_code.co_freevars,
1109
 
                                attribute.__closure__))["func"]
1110
 
                                      .cell_contents)
 
1116
                        zip(attribute.func_code.co_freevars,
 
1117
                            attribute.__closure__))
 
1118
                                      ["func"].cell_contents)
1111
1119
                    # Create a new, but exactly alike, function
1112
1120
                    # object, and decorate it to be a new D-Bus signal
1113
1121
                    # with the alternate D-Bus interface name
1114
 
                    new_function = (dbus.service.signal
1115
 
                                    (alt_interface,
1116
 
                                     attribute._dbus_signature)
 
1122
                    new_function = (dbus.service.signal(
 
1123
                        alt_interface, attribute._dbus_signature)
1117
1124
                                    (types.FunctionType(
1118
 
                                nonmethod_func.func_code,
1119
 
                                nonmethod_func.func_globals,
1120
 
                                nonmethod_func.func_name,
1121
 
                                nonmethod_func.func_defaults,
1122
 
                                nonmethod_func.func_closure)))
 
1125
                                        nonmethod_func.func_code,
 
1126
                                        nonmethod_func.func_globals,
 
1127
                                        nonmethod_func.func_name,
 
1128
                                        nonmethod_func.func_defaults,
 
1129
                                        nonmethod_func.func_closure)))
1123
1130
                    # Copy annotations, if any
1124
1131
                    try:
1125
 
                        new_function._dbus_annotations = (
1126
 
                            dict(attribute._dbus_annotations))
 
1132
                        new_function._dbus_annotations = dict(
 
1133
                            attribute._dbus_annotations)
1127
1134
                    except AttributeError:
1128
1135
                        pass
1129
1136
                    # Define a creator of a function to call both the
1134
1141
                        """This function is a scope container to pass
1135
1142
                        func1 and func2 to the "call_both" function
1136
1143
                        outside of its arguments"""
 
1144
                        
1137
1145
                        def call_both(*args, **kwargs):
1138
1146
                            """This function will emit two D-Bus
1139
1147
                            signals by calling func1 and func2"""
1140
1148
                            func1(*args, **kwargs)
1141
1149
                            func2(*args, **kwargs)
 
1150
                        
1142
1151
                        return call_both
1143
1152
                    # Create the "call_both" function and add it to
1144
1153
                    # the class
1149
1158
                    # object.  Decorate it to be a new D-Bus method
1150
1159
                    # with the alternate D-Bus interface name.  Add it
1151
1160
                    # to the class.
1152
 
                    attr[attrname] = (dbus.service.method
1153
 
                                      (alt_interface,
1154
 
                                       attribute._dbus_in_signature,
1155
 
                                       attribute._dbus_out_signature)
1156
 
                                      (types.FunctionType
1157
 
                                       (attribute.func_code,
1158
 
                                        attribute.func_globals,
1159
 
                                        attribute.func_name,
1160
 
                                        attribute.func_defaults,
1161
 
                                        attribute.func_closure)))
 
1161
                    attr[attrname] = (
 
1162
                        dbus.service.method(
 
1163
                            alt_interface,
 
1164
                            attribute._dbus_in_signature,
 
1165
                            attribute._dbus_out_signature)
 
1166
                        (types.FunctionType(attribute.func_code,
 
1167
                                            attribute.func_globals,
 
1168
                                            attribute.func_name,
 
1169
                                            attribute.func_defaults,
 
1170
                                            attribute.func_closure)))
1162
1171
                    # Copy annotations, if any
1163
1172
                    try:
1164
 
                        attr[attrname]._dbus_annotations = (
1165
 
                            dict(attribute._dbus_annotations))
 
1173
                        attr[attrname]._dbus_annotations = dict(
 
1174
                            attribute._dbus_annotations)
1166
1175
                    except AttributeError:
1167
1176
                        pass
1168
1177
                # Is this a D-Bus property?
1171
1180
                    # object, and decorate it to be a new D-Bus
1172
1181
                    # property with the alternate D-Bus interface
1173
1182
                    # name.  Add it to the class.
1174
 
                    attr[attrname] = (dbus_service_property
1175
 
                                      (alt_interface,
1176
 
                                       attribute._dbus_signature,
1177
 
                                       attribute._dbus_access,
1178
 
                                       attribute
1179
 
                                       ._dbus_get_args_options
1180
 
                                       ["byte_arrays"])
1181
 
                                      (types.FunctionType
1182
 
                                       (attribute.func_code,
1183
 
                                        attribute.func_globals,
1184
 
                                        attribute.func_name,
1185
 
                                        attribute.func_defaults,
1186
 
                                        attribute.func_closure)))
 
1183
                    attr[attrname] = (dbus_service_property(
 
1184
                        alt_interface, attribute._dbus_signature,
 
1185
                        attribute._dbus_access,
 
1186
                        attribute._dbus_get_args_options
 
1187
                        ["byte_arrays"])
 
1188
                                      (types.FunctionType(
 
1189
                                          attribute.func_code,
 
1190
                                          attribute.func_globals,
 
1191
                                          attribute.func_name,
 
1192
                                          attribute.func_defaults,
 
1193
                                          attribute.func_closure)))
1187
1194
                    # Copy annotations, if any
1188
1195
                    try:
1189
 
                        attr[attrname]._dbus_annotations = (
1190
 
                            dict(attribute._dbus_annotations))
 
1196
                        attr[attrname]._dbus_annotations = dict(
 
1197
                            attribute._dbus_annotations)
1191
1198
                    except AttributeError:
1192
1199
                        pass
1193
1200
                # Is this a D-Bus interface?
1196
1203
                    # object.  Decorate it to be a new D-Bus interface
1197
1204
                    # with the alternate D-Bus interface name.  Add it
1198
1205
                    # to the class.
1199
 
                    attr[attrname] = (dbus_interface_annotations
1200
 
                                      (alt_interface)
1201
 
                                      (types.FunctionType
1202
 
                                       (attribute.func_code,
1203
 
                                        attribute.func_globals,
1204
 
                                        attribute.func_name,
1205
 
                                        attribute.func_defaults,
1206
 
                                        attribute.func_closure)))
 
1206
                    attr[attrname] = (
 
1207
                        dbus_interface_annotations(alt_interface)
 
1208
                        (types.FunctionType(attribute.func_code,
 
1209
                                            attribute.func_globals,
 
1210
                                            attribute.func_name,
 
1211
                                            attribute.func_defaults,
 
1212
                                            attribute.func_closure)))
1207
1213
            if deprecate:
1208
1214
                # Deprecate all alternate interfaces
1209
 
                iname="_AlternateDBusNames_interface_annotation{0}"
 
1215
                iname="_AlternateDBusNames_interface_annotation{}"
1210
1216
                for interface_name in interface_names:
 
1217
                    
1211
1218
                    @dbus_interface_annotations(interface_name)
1212
1219
                    def func(self):
1213
1220
                        return { "org.freedesktop.DBus.Deprecated":
1214
 
                                     "true" }
 
1221
                                 "true" }
1215
1222
                    # Find an unused name
1216
1223
                    for aname in (iname.format(i)
1217
1224
                                  for i in itertools.count()):
1221
1228
            if interface_names:
1222
1229
                # Replace the class with a new subclass of it with
1223
1230
                # methods, signals, etc. as created above.
1224
 
                cls = type(b"{0}Alternate".format(cls.__name__),
1225
 
                           (cls,), attr)
 
1231
                cls = type(b"{}Alternate".format(cls.__name__),
 
1232
                           (cls, ), attr)
1226
1233
        return cls
 
1234
    
1227
1235
    return wrapper
1228
1236
 
1229
1237
 
1230
1238
@alternate_dbus_interfaces({"se.recompile.Mandos":
1231
 
                                "se.bsnet.fukt.Mandos"})
 
1239
                            "se.bsnet.fukt.Mandos"})
1232
1240
class ClientDBus(Client, DBusObjectWithProperties):
1233
1241
    """A Client class using D-Bus
1234
1242
    
1238
1246
    """
1239
1247
    
1240
1248
    runtime_expansions = (Client.runtime_expansions
1241
 
                          + ("dbus_object_path",))
 
1249
                          + ("dbus_object_path", ))
 
1250
    
 
1251
    _interface = "se.recompile.Mandos.Client"
1242
1252
    
1243
1253
    # dbus.service.Object doesn't use super(), so we can't either.
1244
1254
    
1247
1257
        Client.__init__(self, *args, **kwargs)
1248
1258
        # Only now, when this client is initialized, can it show up on
1249
1259
        # the D-Bus
1250
 
        client_object_name = unicode(self.name).translate(
 
1260
        client_object_name = str(self.name).translate(
1251
1261
            {ord("."): ord("_"),
1252
1262
             ord("-"): ord("_")})
1253
 
        self.dbus_object_path = (dbus.ObjectPath
1254
 
                                 ("/clients/" + client_object_name))
 
1263
        self.dbus_object_path = dbus.ObjectPath(
 
1264
            "/clients/" + client_object_name)
1255
1265
        DBusObjectWithProperties.__init__(self, self.bus,
1256
1266
                                          self.dbus_object_path)
1257
1267
    
1258
 
    def notifychangeproperty(transform_func,
1259
 
                             dbus_name, type_func=lambda x: x,
1260
 
                             variant_level=1):
 
1268
    def notifychangeproperty(transform_func, dbus_name,
 
1269
                             type_func=lambda x: x,
 
1270
                             variant_level=1,
 
1271
                             invalidate_only=False,
 
1272
                             _interface=_interface):
1261
1273
        """ Modify a variable so that it's a property which announces
1262
1274
        its changes to DBus.
1263
1275
        
1268
1280
                   to the D-Bus.  Default: no transform
1269
1281
        variant_level: D-Bus variant level.  Default: 1
1270
1282
        """
1271
 
        attrname = "_{0}".format(dbus_name)
 
1283
        attrname = "_{}".format(dbus_name)
 
1284
        
1272
1285
        def setter(self, value):
1273
1286
            if hasattr(self, "dbus_object_path"):
1274
1287
                if (not hasattr(self, attrname) or
1275
1288
                    type_func(getattr(self, attrname, None))
1276
1289
                    != type_func(value)):
1277
 
                    dbus_value = transform_func(type_func(value),
1278
 
                                                variant_level
1279
 
                                                =variant_level)
1280
 
                    self.PropertyChanged(dbus.String(dbus_name),
1281
 
                                         dbus_value)
 
1290
                    if invalidate_only:
 
1291
                        self.PropertiesChanged(
 
1292
                            _interface, dbus.Dictionary(),
 
1293
                            dbus.Array((dbus_name, )))
 
1294
                    else:
 
1295
                        dbus_value = transform_func(
 
1296
                            type_func(value),
 
1297
                            variant_level = variant_level)
 
1298
                        self.PropertyChanged(dbus.String(dbus_name),
 
1299
                                             dbus_value)
 
1300
                        self.PropertiesChanged(
 
1301
                            _interface,
 
1302
                            dbus.Dictionary({ dbus.String(dbus_name):
 
1303
                                              dbus_value }),
 
1304
                            dbus.Array())
1282
1305
            setattr(self, attrname, value)
1283
1306
        
1284
1307
        return property(lambda self: getattr(self, attrname), setter)
1290
1313
    enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1291
1314
    last_enabled = notifychangeproperty(datetime_to_dbus,
1292
1315
                                        "LastEnabled")
1293
 
    checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",
1294
 
                                   type_func = lambda checker:
1295
 
                                       checker is not None)
 
1316
    checker = notifychangeproperty(
 
1317
        dbus.Boolean, "CheckerRunning",
 
1318
        type_func = lambda checker: checker is not None)
1296
1319
    last_checked_ok = notifychangeproperty(datetime_to_dbus,
1297
1320
                                           "LastCheckedOK")
1298
1321
    last_checker_status = notifychangeproperty(dbus.Int16,
1301
1324
        datetime_to_dbus, "LastApprovalRequest")
1302
1325
    approved_by_default = notifychangeproperty(dbus.Boolean,
1303
1326
                                               "ApprovedByDefault")
1304
 
    approval_delay = notifychangeproperty(dbus.UInt64,
1305
 
                                          "ApprovalDelay",
1306
 
                                          type_func =
1307
 
                                          timedelta_to_milliseconds)
 
1327
    approval_delay = notifychangeproperty(
 
1328
        dbus.UInt64, "ApprovalDelay",
 
1329
        type_func = lambda td: td.total_seconds() * 1000)
1308
1330
    approval_duration = notifychangeproperty(
1309
1331
        dbus.UInt64, "ApprovalDuration",
1310
 
        type_func = timedelta_to_milliseconds)
 
1332
        type_func = lambda td: td.total_seconds() * 1000)
1311
1333
    host = notifychangeproperty(dbus.String, "Host")
1312
 
    timeout = notifychangeproperty(dbus.UInt64, "Timeout",
1313
 
                                   type_func =
1314
 
                                   timedelta_to_milliseconds)
 
1334
    timeout = notifychangeproperty(
 
1335
        dbus.UInt64, "Timeout",
 
1336
        type_func = lambda td: td.total_seconds() * 1000)
1315
1337
    extended_timeout = notifychangeproperty(
1316
1338
        dbus.UInt64, "ExtendedTimeout",
1317
 
        type_func = timedelta_to_milliseconds)
1318
 
    interval = notifychangeproperty(dbus.UInt64,
1319
 
                                    "Interval",
1320
 
                                    type_func =
1321
 
                                    timedelta_to_milliseconds)
 
1339
        type_func = lambda td: td.total_seconds() * 1000)
 
1340
    interval = notifychangeproperty(
 
1341
        dbus.UInt64, "Interval",
 
1342
        type_func = lambda td: td.total_seconds() * 1000)
1322
1343
    checker_command = notifychangeproperty(dbus.String, "Checker")
 
1344
    secret = notifychangeproperty(dbus.ByteArray, "Secret",
 
1345
                                  invalidate_only=True)
1323
1346
    
1324
1347
    del notifychangeproperty
1325
1348
    
1367
1390
    
1368
1391
    def approve(self, value=True):
1369
1392
        self.approved = value
1370
 
        gobject.timeout_add(timedelta_to_milliseconds
1371
 
                            (self.approval_duration),
1372
 
                            self._reset_approved)
 
1393
        gobject.timeout_add(int(self.approval_duration.total_seconds()
 
1394
                                * 1000), self._reset_approved)
1373
1395
        self.send_changedstate()
1374
1396
    
1375
1397
    ## D-Bus methods, signals & properties
1376
 
    _interface = "se.recompile.Mandos.Client"
1377
1398
    
1378
1399
    ## Interfaces
1379
1400
    
1380
 
    @dbus_interface_annotations(_interface)
1381
 
    def _foo(self):
1382
 
        return { "org.freedesktop.DBus.Property.EmitsChangedSignal":
1383
 
                     "false"}
1384
 
    
1385
1401
    ## Signals
1386
1402
    
1387
1403
    # CheckerCompleted - signal
1397
1413
        pass
1398
1414
    
1399
1415
    # PropertyChanged - signal
 
1416
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1400
1417
    @dbus.service.signal(_interface, signature="sv")
1401
1418
    def PropertyChanged(self, property, value):
1402
1419
        "D-Bus signal"
1466
1483
        return dbus.Boolean(bool(self.approvals_pending))
1467
1484
    
1468
1485
    # ApprovedByDefault - property
1469
 
    @dbus_service_property(_interface, signature="b",
 
1486
    @dbus_service_property(_interface,
 
1487
                           signature="b",
1470
1488
                           access="readwrite")
1471
1489
    def ApprovedByDefault_dbus_property(self, value=None):
1472
1490
        if value is None:       # get
1474
1492
        self.approved_by_default = bool(value)
1475
1493
    
1476
1494
    # ApprovalDelay - property
1477
 
    @dbus_service_property(_interface, signature="t",
 
1495
    @dbus_service_property(_interface,
 
1496
                           signature="t",
1478
1497
                           access="readwrite")
1479
1498
    def ApprovalDelay_dbus_property(self, value=None):
1480
1499
        if value is None:       # get
1481
 
            return dbus.UInt64(self.approval_delay_milliseconds())
 
1500
            return dbus.UInt64(self.approval_delay.total_seconds()
 
1501
                               * 1000)
1482
1502
        self.approval_delay = datetime.timedelta(0, 0, 0, value)
1483
1503
    
1484
1504
    # ApprovalDuration - property
1485
 
    @dbus_service_property(_interface, signature="t",
 
1505
    @dbus_service_property(_interface,
 
1506
                           signature="t",
1486
1507
                           access="readwrite")
1487
1508
    def ApprovalDuration_dbus_property(self, value=None):
1488
1509
        if value is None:       # get
1489
 
            return dbus.UInt64(timedelta_to_milliseconds(
1490
 
                    self.approval_duration))
 
1510
            return dbus.UInt64(self.approval_duration.total_seconds()
 
1511
                               * 1000)
1491
1512
        self.approval_duration = datetime.timedelta(0, 0, 0, value)
1492
1513
    
1493
1514
    # Name - property
1501
1522
        return dbus.String(self.fingerprint)
1502
1523
    
1503
1524
    # Host - property
1504
 
    @dbus_service_property(_interface, signature="s",
 
1525
    @dbus_service_property(_interface,
 
1526
                           signature="s",
1505
1527
                           access="readwrite")
1506
1528
    def Host_dbus_property(self, value=None):
1507
1529
        if value is None:       # get
1508
1530
            return dbus.String(self.host)
1509
 
        self.host = unicode(value)
 
1531
        self.host = str(value)
1510
1532
    
1511
1533
    # Created - property
1512
1534
    @dbus_service_property(_interface, signature="s", access="read")
1519
1541
        return datetime_to_dbus(self.last_enabled)
1520
1542
    
1521
1543
    # Enabled - property
1522
 
    @dbus_service_property(_interface, signature="b",
 
1544
    @dbus_service_property(_interface,
 
1545
                           signature="b",
1523
1546
                           access="readwrite")
1524
1547
    def Enabled_dbus_property(self, value=None):
1525
1548
        if value is None:       # get
1530
1553
            self.disable()
1531
1554
    
1532
1555
    # LastCheckedOK - property
1533
 
    @dbus_service_property(_interface, signature="s",
 
1556
    @dbus_service_property(_interface,
 
1557
                           signature="s",
1534
1558
                           access="readwrite")
1535
1559
    def LastCheckedOK_dbus_property(self, value=None):
1536
1560
        if value is not None:
1539
1563
        return datetime_to_dbus(self.last_checked_ok)
1540
1564
    
1541
1565
    # LastCheckerStatus - property
1542
 
    @dbus_service_property(_interface, signature="n",
1543
 
                           access="read")
 
1566
    @dbus_service_property(_interface, signature="n", access="read")
1544
1567
    def LastCheckerStatus_dbus_property(self):
1545
1568
        return dbus.Int16(self.last_checker_status)
1546
1569
    
1555
1578
        return datetime_to_dbus(self.last_approval_request)
1556
1579
    
1557
1580
    # Timeout - property
1558
 
    @dbus_service_property(_interface, signature="t",
 
1581
    @dbus_service_property(_interface,
 
1582
                           signature="t",
1559
1583
                           access="readwrite")
1560
1584
    def Timeout_dbus_property(self, value=None):
1561
1585
        if value is None:       # get
1562
 
            return dbus.UInt64(self.timeout_milliseconds())
 
1586
            return dbus.UInt64(self.timeout.total_seconds() * 1000)
1563
1587
        old_timeout = self.timeout
1564
1588
        self.timeout = datetime.timedelta(0, 0, 0, value)
1565
1589
        # Reschedule disabling
1574
1598
                    is None):
1575
1599
                    return
1576
1600
                gobject.source_remove(self.disable_initiator_tag)
1577
 
                self.disable_initiator_tag = (
1578
 
                    gobject.timeout_add(
1579
 
                        timedelta_to_milliseconds(self.expires - now),
1580
 
                        self.disable))
 
1601
                self.disable_initiator_tag = gobject.timeout_add(
 
1602
                    int((self.expires - now).total_seconds() * 1000),
 
1603
                    self.disable)
1581
1604
    
1582
1605
    # ExtendedTimeout - property
1583
 
    @dbus_service_property(_interface, signature="t",
 
1606
    @dbus_service_property(_interface,
 
1607
                           signature="t",
1584
1608
                           access="readwrite")
1585
1609
    def ExtendedTimeout_dbus_property(self, value=None):
1586
1610
        if value is None:       # get
1587
 
            return dbus.UInt64(self.extended_timeout_milliseconds())
 
1611
            return dbus.UInt64(self.extended_timeout.total_seconds()
 
1612
                               * 1000)
1588
1613
        self.extended_timeout = datetime.timedelta(0, 0, 0, value)
1589
1614
    
1590
1615
    # Interval - property
1591
 
    @dbus_service_property(_interface, signature="t",
 
1616
    @dbus_service_property(_interface,
 
1617
                           signature="t",
1592
1618
                           access="readwrite")
1593
1619
    def Interval_dbus_property(self, value=None):
1594
1620
        if value is None:       # get
1595
 
            return dbus.UInt64(self.interval_milliseconds())
 
1621
            return dbus.UInt64(self.interval.total_seconds() * 1000)
1596
1622
        self.interval = datetime.timedelta(0, 0, 0, value)
1597
1623
        if getattr(self, "checker_initiator_tag", None) is None:
1598
1624
            return
1599
1625
        if self.enabled:
1600
1626
            # Reschedule checker run
1601
1627
            gobject.source_remove(self.checker_initiator_tag)
1602
 
            self.checker_initiator_tag = (gobject.timeout_add
1603
 
                                          (value, self.start_checker))
1604
 
            self.start_checker()    # Start one now, too
 
1628
            self.checker_initiator_tag = gobject.timeout_add(
 
1629
                value, self.start_checker)
 
1630
            self.start_checker() # Start one now, too
1605
1631
    
1606
1632
    # Checker - property
1607
 
    @dbus_service_property(_interface, signature="s",
 
1633
    @dbus_service_property(_interface,
 
1634
                           signature="s",
1608
1635
                           access="readwrite")
1609
1636
    def Checker_dbus_property(self, value=None):
1610
1637
        if value is None:       # get
1611
1638
            return dbus.String(self.checker_command)
1612
 
        self.checker_command = unicode(value)
 
1639
        self.checker_command = str(value)
1613
1640
    
1614
1641
    # CheckerRunning - property
1615
 
    @dbus_service_property(_interface, signature="b",
 
1642
    @dbus_service_property(_interface,
 
1643
                           signature="b",
1616
1644
                           access="readwrite")
1617
1645
    def CheckerRunning_dbus_property(self, value=None):
1618
1646
        if value is None:       # get
1628
1656
        return self.dbus_object_path # is already a dbus.ObjectPath
1629
1657
    
1630
1658
    # Secret = property
1631
 
    @dbus_service_property(_interface, signature="ay",
1632
 
                           access="write", byte_arrays=True)
 
1659
    @dbus_service_property(_interface,
 
1660
                           signature="ay",
 
1661
                           access="write",
 
1662
                           byte_arrays=True)
1633
1663
    def Secret_dbus_property(self, value):
1634
 
        self.secret = str(value)
 
1664
        self.secret = bytes(value)
1635
1665
    
1636
1666
    del _interface
1637
1667
 
1651
1681
        if data[0] == 'data':
1652
1682
            return data[1]
1653
1683
        if data[0] == 'function':
 
1684
            
1654
1685
            def func(*args, **kwargs):
1655
1686
                self._pipe.send(('funcall', name, args, kwargs))
1656
1687
                return self._pipe.recv()[1]
 
1688
            
1657
1689
            return func
1658
1690
    
1659
1691
    def __setattr__(self, name, value):
1671
1703
    def handle(self):
1672
1704
        with contextlib.closing(self.server.child_pipe) as child_pipe:
1673
1705
            logger.info("TCP connection from: %s",
1674
 
                        unicode(self.client_address))
 
1706
                        str(self.client_address))
1675
1707
            logger.debug("Pipe FD: %d",
1676
1708
                         self.server.child_pipe.fileno())
1677
1709
            
1678
 
            session = (gnutls.connection
1679
 
                       .ClientSession(self.request,
1680
 
                                      gnutls.connection
1681
 
                                      .X509Credentials()))
 
1710
            session = gnutls.connection.ClientSession(
 
1711
                self.request, gnutls.connection .X509Credentials())
1682
1712
            
1683
1713
            # Note: gnutls.connection.X509Credentials is really a
1684
1714
            # generic GnuTLS certificate credentials object so long as
1693
1723
            priority = self.server.gnutls_priority
1694
1724
            if priority is None:
1695
1725
                priority = "NORMAL"
1696
 
            (gnutls.library.functions
1697
 
             .gnutls_priority_set_direct(session._c_object,
1698
 
                                         priority, None))
 
1726
            gnutls.library.functions.gnutls_priority_set_direct(
 
1727
                session._c_object, priority, None)
1699
1728
            
1700
1729
            # Start communication using the Mandos protocol
1701
1730
            # Get protocol number
1721
1750
            approval_required = False
1722
1751
            try:
1723
1752
                try:
1724
 
                    fpr = self.fingerprint(self.peer_certificate
1725
 
                                           (session))
 
1753
                    fpr = self.fingerprint(
 
1754
                        self.peer_certificate(session))
1726
1755
                except (TypeError,
1727
1756
                        gnutls.errors.GNUTLSError) as error:
1728
1757
                    logger.warning("Bad certificate: %s", error)
1743
1772
                while True:
1744
1773
                    if not client.enabled:
1745
1774
                        logger.info("Client %s is disabled",
1746
 
                                       client.name)
 
1775
                                    client.name)
1747
1776
                        if self.server.use_dbus:
1748
1777
                            # Emit D-Bus signal
1749
1778
                            client.Rejected("Disabled")
1758
1787
                        if self.server.use_dbus:
1759
1788
                            # Emit D-Bus signal
1760
1789
                            client.NeedApproval(
1761
 
                                client.approval_delay_milliseconds(),
1762
 
                                client.approved_by_default)
 
1790
                                client.approval_delay.total_seconds()
 
1791
                                * 1000, client.approved_by_default)
1763
1792
                    else:
1764
1793
                        logger.warning("Client %s was not approved",
1765
1794
                                       client.name)
1771
1800
                    #wait until timeout or approved
1772
1801
                    time = datetime.datetime.now()
1773
1802
                    client.changedstate.acquire()
1774
 
                    client.changedstate.wait(
1775
 
                        float(timedelta_to_milliseconds(delay)
1776
 
                              / 1000))
 
1803
                    client.changedstate.wait(delay.total_seconds())
1777
1804
                    client.changedstate.release()
1778
1805
                    time2 = datetime.datetime.now()
1779
1806
                    if (time2 - time) >= delay:
1798
1825
                        logger.warning("gnutls send failed",
1799
1826
                                       exc_info=error)
1800
1827
                        return
1801
 
                    logger.debug("Sent: %d, remaining: %d",
1802
 
                                 sent, len(client.secret)
1803
 
                                 - (sent_size + sent))
 
1828
                    logger.debug("Sent: %d, remaining: %d", sent,
 
1829
                                 len(client.secret) - (sent_size
 
1830
                                                       + sent))
1804
1831
                    sent_size += sent
1805
1832
                
1806
1833
                logger.info("Sending secret to %s", client.name)
1823
1850
    def peer_certificate(session):
1824
1851
        "Return the peer's OpenPGP certificate as a bytestring"
1825
1852
        # If not an OpenPGP certificate...
1826
 
        if (gnutls.library.functions
1827
 
            .gnutls_certificate_type_get(session._c_object)
 
1853
        if (gnutls.library.functions.gnutls_certificate_type_get(
 
1854
                session._c_object)
1828
1855
            != gnutls.library.constants.GNUTLS_CRT_OPENPGP):
1829
1856
            # ...do the normal thing
1830
1857
            return session.peer_certificate
1844
1871
    def fingerprint(openpgp):
1845
1872
        "Convert an OpenPGP bytestring to a hexdigit fingerprint"
1846
1873
        # New GnuTLS "datum" with the OpenPGP public key
1847
 
        datum = (gnutls.library.types
1848
 
                 .gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
1849
 
                                             ctypes.POINTER
1850
 
                                             (ctypes.c_ubyte)),
1851
 
                                 ctypes.c_uint(len(openpgp))))
 
1874
        datum = gnutls.library.types.gnutls_datum_t(
 
1875
            ctypes.cast(ctypes.c_char_p(openpgp),
 
1876
                        ctypes.POINTER(ctypes.c_ubyte)),
 
1877
            ctypes.c_uint(len(openpgp)))
1852
1878
        # New empty GnuTLS certificate
1853
1879
        crt = gnutls.library.types.gnutls_openpgp_crt_t()
1854
 
        (gnutls.library.functions
1855
 
         .gnutls_openpgp_crt_init(ctypes.byref(crt)))
 
1880
        gnutls.library.functions.gnutls_openpgp_crt_init(
 
1881
            ctypes.byref(crt))
1856
1882
        # Import the OpenPGP public key into the certificate
1857
 
        (gnutls.library.functions
1858
 
         .gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
1859
 
                                    gnutls.library.constants
1860
 
                                    .GNUTLS_OPENPGP_FMT_RAW))
 
1883
        gnutls.library.functions.gnutls_openpgp_crt_import(
 
1884
            crt, ctypes.byref(datum),
 
1885
            gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
1861
1886
        # Verify the self signature in the key
1862
1887
        crtverify = ctypes.c_uint()
1863
 
        (gnutls.library.functions
1864
 
         .gnutls_openpgp_crt_verify_self(crt, 0,
1865
 
                                         ctypes.byref(crtverify)))
 
1888
        gnutls.library.functions.gnutls_openpgp_crt_verify_self(
 
1889
            crt, 0, ctypes.byref(crtverify))
1866
1890
        if crtverify.value != 0:
1867
1891
            gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1868
 
            raise (gnutls.errors.CertificateSecurityError
1869
 
                   ("Verify failed"))
 
1892
            raise gnutls.errors.CertificateSecurityError(
 
1893
                "Verify failed")
1870
1894
        # New buffer for the fingerprint
1871
1895
        buf = ctypes.create_string_buffer(20)
1872
1896
        buf_len = ctypes.c_size_t()
1873
1897
        # Get the fingerprint from the certificate into the buffer
1874
 
        (gnutls.library.functions
1875
 
         .gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
1876
 
                                             ctypes.byref(buf_len)))
 
1898
        gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint(
 
1899
            crt, ctypes.byref(buf), ctypes.byref(buf_len))
1877
1900
        # Deinit the certificate
1878
1901
        gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1879
1902
        # Convert the buffer to a Python bytestring
1885
1908
 
1886
1909
class MultiprocessingMixIn(object):
1887
1910
    """Like socketserver.ThreadingMixIn, but with multiprocessing"""
 
1911
    
1888
1912
    def sub_process_main(self, request, address):
1889
1913
        try:
1890
1914
            self.finish_request(request, address)
1902
1926
 
1903
1927
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
1904
1928
    """ adds a pipe to the MixIn """
 
1929
    
1905
1930
    def process_request(self, request, client_address):
1906
1931
        """Overrides and wraps the original process_request().
1907
1932
        
1928
1953
        interface:      None or a network interface name (string)
1929
1954
        use_ipv6:       Boolean; to use IPv6 or not
1930
1955
    """
 
1956
    
1931
1957
    def __init__(self, server_address, RequestHandlerClass,
1932
 
                 interface=None, use_ipv6=True, socketfd=None):
 
1958
                 interface=None,
 
1959
                 use_ipv6=True,
 
1960
                 socketfd=None):
1933
1961
        """If socketfd is set, use that file descriptor instead of
1934
1962
        creating a new one with socket.socket().
1935
1963
        """
1976
2004
                             self.interface)
1977
2005
            else:
1978
2006
                try:
1979
 
                    self.socket.setsockopt(socket.SOL_SOCKET,
1980
 
                                           SO_BINDTODEVICE,
1981
 
                                           str(self.interface + '\0'))
 
2007
                    self.socket.setsockopt(
 
2008
                        socket.SOL_SOCKET, SO_BINDTODEVICE,
 
2009
                        (self.interface + "\0").encode("utf-8"))
1982
2010
                except socket.error as error:
1983
2011
                    if error.errno == errno.EPERM:
1984
2012
                        logger.error("No permission to bind to"
2002
2030
                self.server_address = (any_address,
2003
2031
                                       self.server_address[1])
2004
2032
            elif not self.server_address[1]:
2005
 
                self.server_address = (self.server_address[0],
2006
 
                                       0)
 
2033
                self.server_address = (self.server_address[0], 0)
2007
2034
#                 if self.interface:
2008
2035
#                     self.server_address = (self.server_address[0],
2009
2036
#                                            0, # port
2023
2050
    
2024
2051
    Assumes a gobject.MainLoop event loop.
2025
2052
    """
 
2053
    
2026
2054
    def __init__(self, server_address, RequestHandlerClass,
2027
 
                 interface=None, use_ipv6=True, clients=None,
2028
 
                 gnutls_priority=None, use_dbus=True, socketfd=None):
 
2055
                 interface=None,
 
2056
                 use_ipv6=True,
 
2057
                 clients=None,
 
2058
                 gnutls_priority=None,
 
2059
                 use_dbus=True,
 
2060
                 socketfd=None):
2029
2061
        self.enabled = False
2030
2062
        self.clients = clients
2031
2063
        if self.clients is None:
2037
2069
                                interface = interface,
2038
2070
                                use_ipv6 = use_ipv6,
2039
2071
                                socketfd = socketfd)
 
2072
    
2040
2073
    def server_activate(self):
2041
2074
        if self.enabled:
2042
2075
            return socketserver.TCPServer.server_activate(self)
2046
2079
    
2047
2080
    def add_pipe(self, parent_pipe, proc):
2048
2081
        # Call "handle_ipc" for both data and EOF events
2049
 
        gobject.io_add_watch(parent_pipe.fileno(),
2050
 
                             gobject.IO_IN | gobject.IO_HUP,
2051
 
                             functools.partial(self.handle_ipc,
2052
 
                                               parent_pipe =
2053
 
                                               parent_pipe,
2054
 
                                               proc = proc))
 
2082
        gobject.io_add_watch(
 
2083
            parent_pipe.fileno(),
 
2084
            gobject.IO_IN | gobject.IO_HUP,
 
2085
            functools.partial(self.handle_ipc,
 
2086
                              parent_pipe = parent_pipe,
 
2087
                              proc = proc))
2055
2088
    
2056
 
    def handle_ipc(self, source, condition, parent_pipe=None,
2057
 
                   proc = None, client_object=None):
 
2089
    def handle_ipc(self, source, condition,
 
2090
                   parent_pipe=None,
 
2091
                   proc = None,
 
2092
                   client_object=None):
2058
2093
        # error, or the other end of multiprocessing.Pipe has closed
2059
2094
        if condition & (gobject.IO_ERR | gobject.IO_HUP):
2060
2095
            # Wait for other process to exit
2083
2118
                parent_pipe.send(False)
2084
2119
                return False
2085
2120
            
2086
 
            gobject.io_add_watch(parent_pipe.fileno(),
2087
 
                                 gobject.IO_IN | gobject.IO_HUP,
2088
 
                                 functools.partial(self.handle_ipc,
2089
 
                                                   parent_pipe =
2090
 
                                                   parent_pipe,
2091
 
                                                   proc = proc,
2092
 
                                                   client_object =
2093
 
                                                   client))
 
2121
            gobject.io_add_watch(
 
2122
                parent_pipe.fileno(),
 
2123
                gobject.IO_IN | gobject.IO_HUP,
 
2124
                functools.partial(self.handle_ipc,
 
2125
                                  parent_pipe = parent_pipe,
 
2126
                                  proc = proc,
 
2127
                                  client_object = client))
2094
2128
            parent_pipe.send(True)
2095
2129
            # remove the old hook in favor of the new above hook on
2096
2130
            # same fileno
2102
2136
            
2103
2137
            parent_pipe.send(('data', getattr(client_object,
2104
2138
                                              funcname)(*args,
2105
 
                                                         **kwargs)))
 
2139
                                                        **kwargs)))
2106
2140
        
2107
2141
        if command == 'getattr':
2108
2142
            attrname = request[1]
2109
2143
            if callable(client_object.__getattribute__(attrname)):
2110
 
                parent_pipe.send(('function',))
 
2144
                parent_pipe.send(('function', ))
2111
2145
            else:
2112
 
                parent_pipe.send(('data', client_object
2113
 
                                  .__getattribute__(attrname)))
 
2146
                parent_pipe.send((
 
2147
                    'data', client_object.__getattribute__(attrname)))
2114
2148
        
2115
2149
        if command == 'setattr':
2116
2150
            attrname = request[1]
2156
2190
                                              # None
2157
2191
                                    "followers")) # Tokens valid after
2158
2192
                                                  # this token
 
2193
    Token = collections.namedtuple("Token", (
 
2194
        "regexp",  # To match token; if "value" is not None, must have
 
2195
                   # a "group" containing digits
 
2196
        "value",   # datetime.timedelta or None
 
2197
        "followers"))           # Tokens valid after this token
2159
2198
    # RFC 3339 "duration" tokens, syntax, and semantics; taken from
2160
2199
    # the "duration" ABNF definition in RFC 3339, Appendix A.
2161
2200
    token_end = Token(re.compile(r"$"), None, frozenset())
2162
2201
    token_second = Token(re.compile(r"(\d+)S"),
2163
2202
                         datetime.timedelta(seconds=1),
2164
 
                         frozenset((token_end,)))
 
2203
                         frozenset((token_end, )))
2165
2204
    token_minute = Token(re.compile(r"(\d+)M"),
2166
2205
                         datetime.timedelta(minutes=1),
2167
2206
                         frozenset((token_second, token_end)))
2183
2222
                       frozenset((token_month, token_end)))
2184
2223
    token_week = Token(re.compile(r"(\d+)W"),
2185
2224
                       datetime.timedelta(weeks=1),
2186
 
                       frozenset((token_end,)))
 
2225
                       frozenset((token_end, )))
2187
2226
    token_duration = Token(re.compile(r"P"), None,
2188
2227
                           frozenset((token_year, token_month,
2189
2228
                                      token_day, token_time,
2190
 
                                      token_week))),
 
2229
                                      token_week)))
2191
2230
    # Define starting values
2192
2231
    value = datetime.timedelta() # Value so far
2193
2232
    found_token = None
2194
 
    followers = frozenset(token_duration,) # Following valid tokens
 
2233
    followers = frozenset((token_duration,)) # Following valid tokens
2195
2234
    s = duration                # String left to parse
2196
2235
    # Loop until end token is found
2197
2236
    while found_token is not token_end:
2244
2283
    timevalue = datetime.timedelta(0)
2245
2284
    for s in interval.split():
2246
2285
        try:
2247
 
            suffix = unicode(s[-1])
 
2286
            suffix = s[-1]
2248
2287
            value = int(s[:-1])
2249
2288
            if suffix == "d":
2250
2289
                delta = datetime.timedelta(value)
2257
2296
            elif suffix == "w":
2258
2297
                delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
2259
2298
            else:
2260
 
                raise ValueError("Unknown suffix {0!r}"
2261
 
                                 .format(suffix))
 
2299
                raise ValueError("Unknown suffix {!r}".format(suffix))
2262
2300
        except IndexError as e:
2263
2301
            raise ValueError(*(e.args))
2264
2302
        timevalue += delta
2281
2319
        null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2282
2320
        if not stat.S_ISCHR(os.fstat(null).st_mode):
2283
2321
            raise OSError(errno.ENODEV,
2284
 
                          "{0} not a character device"
 
2322
                          "{} not a character device"
2285
2323
                          .format(os.devnull))
2286
2324
        os.dup2(null, sys.stdin.fileno())
2287
2325
        os.dup2(null, sys.stdout.fileno())
2297
2335
    
2298
2336
    parser = argparse.ArgumentParser()
2299
2337
    parser.add_argument("-v", "--version", action="version",
2300
 
                        version = "%(prog)s {0}".format(version),
 
2338
                        version = "%(prog)s {}".format(version),
2301
2339
                        help="show version number and exit")
2302
2340
    parser.add_argument("-i", "--interface", metavar="IF",
2303
2341
                        help="Bind to interface IF")
2336
2374
                        help="Directory to save/restore state in")
2337
2375
    parser.add_argument("--foreground", action="store_true",
2338
2376
                        help="Run in foreground", default=None)
 
2377
    parser.add_argument("--no-zeroconf", action="store_false",
 
2378
                        dest="zeroconf", help="Do not use Zeroconf",
 
2379
                        default=None)
2339
2380
    
2340
2381
    options = parser.parse_args()
2341
2382
    
2350
2391
                        "port": "",
2351
2392
                        "debug": "False",
2352
2393
                        "priority":
2353
 
                        "SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",
 
2394
                        "SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
 
2395
                        ":+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",
2354
2396
                        "servicename": "Mandos",
2355
2397
                        "use_dbus": "True",
2356
2398
                        "use_ipv6": "True",
2359
2401
                        "socket": "",
2360
2402
                        "statedir": "/var/lib/mandos",
2361
2403
                        "foreground": "False",
2362
 
                        }
 
2404
                        "zeroconf": "True",
 
2405
                    }
2363
2406
    
2364
2407
    # Parse config file for server-global settings
2365
2408
    server_config = configparser.SafeConfigParser(server_defaults)
2366
2409
    del server_defaults
2367
 
    server_config.read(os.path.join(options.configdir,
2368
 
                                    "mandos.conf"))
 
2410
    server_config.read(os.path.join(options.configdir, "mandos.conf"))
2369
2411
    # Convert the SafeConfigParser object to a dict
2370
2412
    server_settings = server_config.defaults()
2371
2413
    # Use the appropriate methods on the non-string config options
2389
2431
    # Override the settings from the config file with command line
2390
2432
    # options, if set.
2391
2433
    for option in ("interface", "address", "port", "debug",
2392
 
                   "priority", "servicename", "configdir",
2393
 
                   "use_dbus", "use_ipv6", "debuglevel", "restore",
2394
 
                   "statedir", "socket", "foreground"):
 
2434
                   "priority", "servicename", "configdir", "use_dbus",
 
2435
                   "use_ipv6", "debuglevel", "restore", "statedir",
 
2436
                   "socket", "foreground", "zeroconf"):
2395
2437
        value = getattr(options, option)
2396
2438
        if value is not None:
2397
2439
            server_settings[option] = value
2398
2440
    del options
2399
2441
    # Force all strings to be unicode
2400
2442
    for option in server_settings.keys():
2401
 
        if type(server_settings[option]) is str:
2402
 
            server_settings[option] = unicode(server_settings[option])
 
2443
        if isinstance(server_settings[option], bytes):
 
2444
            server_settings[option] = (server_settings[option]
 
2445
                                       .decode("utf-8"))
2403
2446
    # Force all boolean options to be boolean
2404
2447
    for option in ("debug", "use_dbus", "use_ipv6", "restore",
2405
 
                   "foreground"):
 
2448
                   "foreground", "zeroconf"):
2406
2449
        server_settings[option] = bool(server_settings[option])
2407
2450
    # Debug implies foreground
2408
2451
    if server_settings["debug"]:
2411
2454
    
2412
2455
    ##################################################################
2413
2456
    
 
2457
    if (not server_settings["zeroconf"]
 
2458
        and not (server_settings["port"]
 
2459
                 or server_settings["socket"] != "")):
 
2460
        parser.error("Needs port or socket to work without Zeroconf")
 
2461
    
2414
2462
    # For convenience
2415
2463
    debug = server_settings["debug"]
2416
2464
    debuglevel = server_settings["debuglevel"]
2419
2467
    stored_state_path = os.path.join(server_settings["statedir"],
2420
2468
                                     stored_state_file)
2421
2469
    foreground = server_settings["foreground"]
 
2470
    zeroconf = server_settings["zeroconf"]
2422
2471
    
2423
2472
    if debug:
2424
2473
        initlogger(debug, logging.DEBUG)
2430
2479
            initlogger(debug, level)
2431
2480
    
2432
2481
    if server_settings["servicename"] != "Mandos":
2433
 
        syslogger.setFormatter(logging.Formatter
2434
 
                               ('Mandos ({0}) [%(process)d]:'
2435
 
                                ' %(levelname)s: %(message)s'
2436
 
                                .format(server_settings
2437
 
                                        ["servicename"])))
 
2482
        syslogger.setFormatter(
 
2483
            logging.Formatter('Mandos ({}) [%(process)d]:'
 
2484
                              ' %(levelname)s: %(message)s'.format(
 
2485
                                  server_settings["servicename"])))
2438
2486
    
2439
2487
    # Parse config file with clients
2440
2488
    client_config = configparser.SafeConfigParser(Client
2445
2493
    global mandos_dbus_service
2446
2494
    mandos_dbus_service = None
2447
2495
    
2448
 
    tcp_server = MandosServer((server_settings["address"],
2449
 
                               server_settings["port"]),
2450
 
                              ClientHandler,
2451
 
                              interface=(server_settings["interface"]
2452
 
                                         or None),
2453
 
                              use_ipv6=use_ipv6,
2454
 
                              gnutls_priority=
2455
 
                              server_settings["priority"],
2456
 
                              use_dbus=use_dbus,
2457
 
                              socketfd=(server_settings["socket"]
2458
 
                                        or None))
 
2496
    socketfd = None
 
2497
    if server_settings["socket"] != "":
 
2498
        socketfd = server_settings["socket"]
 
2499
    tcp_server = MandosServer(
 
2500
        (server_settings["address"], server_settings["port"]),
 
2501
        ClientHandler,
 
2502
        interface=(server_settings["interface"] or None),
 
2503
        use_ipv6=use_ipv6,
 
2504
        gnutls_priority=server_settings["priority"],
 
2505
        use_dbus=use_dbus,
 
2506
        socketfd=socketfd)
2459
2507
    if not foreground:
2460
2508
        pidfilename = "/run/mandos.pid"
2461
2509
        if not os.path.isdir("/run/."):
2495
2543
        def debug_gnutls(level, string):
2496
2544
            logger.debug("GnuTLS: %s", string[:-1])
2497
2545
        
2498
 
        (gnutls.library.functions
2499
 
         .gnutls_global_set_log_function(debug_gnutls))
 
2546
        gnutls.library.functions.gnutls_global_set_log_function(
 
2547
            debug_gnutls)
2500
2548
        
2501
2549
        # Redirect stdin so all checkers get /dev/null
2502
2550
        null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2522
2570
    if use_dbus:
2523
2571
        try:
2524
2572
            bus_name = dbus.service.BusName("se.recompile.Mandos",
2525
 
                                            bus, do_not_queue=True)
2526
 
            old_bus_name = (dbus.service.BusName
2527
 
                            ("se.bsnet.fukt.Mandos", bus,
2528
 
                             do_not_queue=True))
 
2573
                                            bus,
 
2574
                                            do_not_queue=True)
 
2575
            old_bus_name = dbus.service.BusName(
 
2576
                "se.bsnet.fukt.Mandos", bus,
 
2577
                do_not_queue=True)
2529
2578
        except dbus.exceptions.NameExistsException as e:
2530
2579
            logger.error("Disabling D-Bus:", exc_info=e)
2531
2580
            use_dbus = False
2532
2581
            server_settings["use_dbus"] = False
2533
2582
            tcp_server.use_dbus = False
2534
 
    protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2535
 
    service = AvahiServiceToSyslog(name =
2536
 
                                   server_settings["servicename"],
2537
 
                                   servicetype = "_mandos._tcp",
2538
 
                                   protocol = protocol, bus = bus)
2539
 
    if server_settings["interface"]:
2540
 
        service.interface = (if_nametoindex
2541
 
                             (str(server_settings["interface"])))
 
2583
    if zeroconf:
 
2584
        protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
 
2585
        service = AvahiServiceToSyslog(
 
2586
            name = server_settings["servicename"],
 
2587
            servicetype = "_mandos._tcp",
 
2588
            protocol = protocol,
 
2589
            bus = bus)
 
2590
        if server_settings["interface"]:
 
2591
            service.interface = if_nametoindex(
 
2592
                server_settings["interface"].encode("utf-8"))
2542
2593
    
2543
2594
    global multiprocessing_manager
2544
2595
    multiprocessing_manager = multiprocessing.Manager()
2563
2614
    if server_settings["restore"]:
2564
2615
        try:
2565
2616
            with open(stored_state_path, "rb") as stored_state:
2566
 
                clients_data, old_client_settings = (pickle.load
2567
 
                                                     (stored_state))
 
2617
                clients_data, old_client_settings = pickle.load(
 
2618
                    stored_state)
2568
2619
            os.remove(stored_state_path)
2569
2620
        except IOError as e:
2570
2621
            if e.errno == errno.ENOENT:
2571
 
                logger.warning("Could not load persistent state: {0}"
2572
 
                                .format(os.strerror(e.errno)))
 
2622
                logger.warning("Could not load persistent state:"
 
2623
                               " {}".format(os.strerror(e.errno)))
2573
2624
            else:
2574
2625
                logger.critical("Could not load persistent state:",
2575
2626
                                exc_info=e)
2576
2627
                raise
2577
2628
        except EOFError as e:
2578
2629
            logger.warning("Could not load persistent state: "
2579
 
                           "EOFError:", exc_info=e)
 
2630
                           "EOFError:",
 
2631
                           exc_info=e)
2580
2632
    
2581
2633
    with PGPEngine() as pgp:
2582
 
        for client_name, client in clients_data.iteritems():
 
2634
        for client_name, client in clients_data.items():
2583
2635
            # Skip removed clients
2584
2636
            if client_name not in client_settings:
2585
2637
                continue
2594
2646
                    # For each value in new config, check if it
2595
2647
                    # differs from the old config value (Except for
2596
2648
                    # the "secret" attribute)
2597
 
                    if (name != "secret" and
2598
 
                        value != old_client_settings[client_name]
2599
 
                        [name]):
 
2649
                    if (name != "secret"
 
2650
                        and (value !=
 
2651
                             old_client_settings[client_name][name])):
2600
2652
                        client[name] = value
2601
2653
                except KeyError:
2602
2654
                    pass
2610
2662
                if datetime.datetime.utcnow() >= client["expires"]:
2611
2663
                    if not client["last_checked_ok"]:
2612
2664
                        logger.warning(
2613
 
                            "disabling client {0} - Client never "
2614
 
                            "performed a successful checker"
2615
 
                            .format(client_name))
 
2665
                            "disabling client {} - Client never "
 
2666
                            "performed a successful checker".format(
 
2667
                                client_name))
2616
2668
                        client["enabled"] = False
2617
2669
                    elif client["last_checker_status"] != 0:
2618
2670
                        logger.warning(
2619
 
                            "disabling client {0} - Client "
2620
 
                            "last checker failed with error code {1}"
2621
 
                            .format(client_name,
2622
 
                                    client["last_checker_status"]))
 
2671
                            "disabling client {} - Client last"
 
2672
                            " checker failed with error code"
 
2673
                            " {}".format(
 
2674
                                client_name,
 
2675
                                client["last_checker_status"]))
2623
2676
                        client["enabled"] = False
2624
2677
                    else:
2625
 
                        client["expires"] = (datetime.datetime
2626
 
                                             .utcnow()
2627
 
                                             + client["timeout"])
 
2678
                        client["expires"] = (
 
2679
                            datetime.datetime.utcnow()
 
2680
                            + client["timeout"])
2628
2681
                        logger.debug("Last checker succeeded,"
2629
 
                                     " keeping {0} enabled"
2630
 
                                     .format(client_name))
 
2682
                                     " keeping {} enabled".format(
 
2683
                                         client_name))
2631
2684
            try:
2632
 
                client["secret"] = (
2633
 
                    pgp.decrypt(client["encrypted_secret"],
2634
 
                                client_settings[client_name]
2635
 
                                ["secret"]))
 
2685
                client["secret"] = pgp.decrypt(
 
2686
                    client["encrypted_secret"],
 
2687
                    client_settings[client_name]["secret"])
2636
2688
            except PGPError:
2637
2689
                # If decryption fails, we use secret from new settings
2638
 
                logger.debug("Failed to decrypt {0} old secret"
2639
 
                             .format(client_name))
2640
 
                client["secret"] = (
2641
 
                    client_settings[client_name]["secret"])
 
2690
                logger.debug("Failed to decrypt {} old secret".format(
 
2691
                    client_name))
 
2692
                client["secret"] = (client_settings[client_name]
 
2693
                                    ["secret"])
2642
2694
    
2643
2695
    # Add/remove clients based on new changes made to config
2644
2696
    for client_name in (set(old_client_settings)
2649
2701
        clients_data[client_name] = client_settings[client_name]
2650
2702
    
2651
2703
    # Create all client objects
2652
 
    for client_name, client in clients_data.iteritems():
 
2704
    for client_name, client in clients_data.items():
2653
2705
        tcp_server.clients[client_name] = client_class(
2654
 
            name = client_name, settings = client,
 
2706
            name = client_name,
 
2707
            settings = client,
2655
2708
            server_settings = server_settings)
2656
2709
    
2657
2710
    if not tcp_server.clients:
2662
2715
            try:
2663
2716
                with pidfile:
2664
2717
                    pid = os.getpid()
2665
 
                    pidfile.write(str(pid) + "\n".encode("utf-8"))
 
2718
                    pidfile.write("{}\n".format(pid).encode("utf-8"))
2666
2719
            except IOError:
2667
2720
                logger.error("Could not write to file %r with PID %d",
2668
2721
                             pidfilename, pid)
2673
2726
    signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
2674
2727
    
2675
2728
    if use_dbus:
2676
 
        @alternate_dbus_interfaces({"se.recompile.Mandos":
2677
 
                                        "se.bsnet.fukt.Mandos"})
 
2729
        
 
2730
        @alternate_dbus_interfaces(
 
2731
            { "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })
2678
2732
        class MandosDBusService(DBusObjectWithProperties):
2679
2733
            """A D-Bus proxy object"""
 
2734
            
2680
2735
            def __init__(self):
2681
2736
                dbus.service.Object.__init__(self, bus, "/")
 
2737
            
2682
2738
            _interface = "se.recompile.Mandos"
2683
2739
            
2684
2740
            @dbus_interface_annotations(_interface)
2685
2741
            def _foo(self):
2686
 
                return { "org.freedesktop.DBus.Property"
2687
 
                         ".EmitsChangedSignal":
2688
 
                             "false"}
 
2742
                return {
 
2743
                    "org.freedesktop.DBus.Property.EmitsChangedSignal":
 
2744
                    "false" }
2689
2745
            
2690
2746
            @dbus.service.signal(_interface, signature="o")
2691
2747
            def ClientAdded(self, objpath):
2705
2761
            @dbus.service.method(_interface, out_signature="ao")
2706
2762
            def GetAllClients(self):
2707
2763
                "D-Bus method"
2708
 
                return dbus.Array(c.dbus_object_path
2709
 
                                  for c in
 
2764
                return dbus.Array(c.dbus_object_path for c in
2710
2765
                                  tcp_server.clients.itervalues())
2711
2766
            
2712
2767
            @dbus.service.method(_interface,
2714
2769
            def GetAllClientsWithProperties(self):
2715
2770
                "D-Bus method"
2716
2771
                return dbus.Dictionary(
2717
 
                    ((c.dbus_object_path, c.GetAll(""))
2718
 
                     for c in tcp_server.clients.itervalues()),
 
2772
                    { c.dbus_object_path: c.GetAll("")
 
2773
                      for c in tcp_server.clients.itervalues() },
2719
2774
                    signature="oa{sv}")
2720
2775
            
2721
2776
            @dbus.service.method(_interface, in_signature="o")
2738
2793
    
2739
2794
    def cleanup():
2740
2795
        "Cleanup function; run on exit"
2741
 
        service.cleanup()
 
2796
        if zeroconf:
 
2797
            service.cleanup()
2742
2798
        
2743
2799
        multiprocessing.active_children()
2744
2800
        wnull.close()
2758
2814
                
2759
2815
                # A list of attributes that can not be pickled
2760
2816
                # + secret.
2761
 
                exclude = set(("bus", "changedstate", "secret",
2762
 
                               "checker", "server_settings"))
2763
 
                for name, typ in (inspect.getmembers
2764
 
                                  (dbus.service.Object)):
 
2817
                exclude = { "bus", "changedstate", "secret",
 
2818
                            "checker", "server_settings" }
 
2819
                for name, typ in inspect.getmembers(dbus.service
 
2820
                                                    .Object):
2765
2821
                    exclude.add(name)
2766
2822
                
2767
2823
                client_dict["encrypted_secret"] = (client
2774
2830
                del client_settings[client.name]["secret"]
2775
2831
        
2776
2832
        try:
2777
 
            with (tempfile.NamedTemporaryFile
2778
 
                  (mode='wb', suffix=".pickle", prefix='clients-',
2779
 
                   dir=os.path.dirname(stored_state_path),
2780
 
                   delete=False)) as stored_state:
 
2833
            with tempfile.NamedTemporaryFile(
 
2834
                    mode='wb',
 
2835
                    suffix=".pickle",
 
2836
                    prefix='clients-',
 
2837
                    dir=os.path.dirname(stored_state_path),
 
2838
                    delete=False) as stored_state:
2781
2839
                pickle.dump((clients, client_settings), stored_state)
2782
 
                tempname=stored_state.name
 
2840
                tempname = stored_state.name
2783
2841
            os.rename(tempname, stored_state_path)
2784
2842
        except (IOError, OSError) as e:
2785
2843
            if not debug:
2788
2846
                except NameError:
2789
2847
                    pass
2790
2848
            if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
2791
 
                logger.warning("Could not save persistent state: {0}"
 
2849
                logger.warning("Could not save persistent state: {}"
2792
2850
                               .format(os.strerror(e.errno)))
2793
2851
            else:
2794
2852
                logger.warning("Could not save persistent state:",
2804
2862
            client.disable(quiet=True)
2805
2863
            if use_dbus:
2806
2864
                # Emit D-Bus signal
2807
 
                mandos_dbus_service.ClientRemoved(client
2808
 
                                                  .dbus_object_path,
2809
 
                                                  client.name)
 
2865
                mandos_dbus_service.ClientRemoved(
 
2866
                    client.dbus_object_path, client.name)
2810
2867
        client_settings.clear()
2811
2868
    
2812
2869
    atexit.register(cleanup)
2823
2880
    tcp_server.server_activate()
2824
2881
    
2825
2882
    # Find out what port we got
2826
 
    service.port = tcp_server.socket.getsockname()[1]
 
2883
    if zeroconf:
 
2884
        service.port = tcp_server.socket.getsockname()[1]
2827
2885
    if use_ipv6:
2828
2886
        logger.info("Now listening on address %r, port %d,"
2829
2887
                    " flowinfo %d, scope_id %d",
2835
2893
    #service.interface = tcp_server.socket.getsockname()[3]
2836
2894
    
2837
2895
    try:
2838
 
        # From the Avahi example code
2839
 
        try:
2840
 
            service.activate()
2841
 
        except dbus.exceptions.DBusException as error:
2842
 
            logger.critical("D-Bus Exception", exc_info=error)
2843
 
            cleanup()
2844
 
            sys.exit(1)
2845
 
        # End of Avahi example code
 
2896
        if zeroconf:
 
2897
            # From the Avahi example code
 
2898
            try:
 
2899
                service.activate()
 
2900
            except dbus.exceptions.DBusException as error:
 
2901
                logger.critical("D-Bus Exception", exc_info=error)
 
2902
                cleanup()
 
2903
                sys.exit(1)
 
2904
            # End of Avahi example code
2846
2905
        
2847
2906
        gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
2848
2907
                             lambda *args, **kwargs:
2863
2922
    # Must run before the D-Bus bus name gets deregistered
2864
2923
    cleanup()
2865
2924
 
 
2925
 
2866
2926
if __name__ == '__main__':
2867
2927
    main()