/mandos/release

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/release

« back to all changes in this revision

Viewing changes to mandos

  • Committer: Teddy Hogeborn
  • Date: 2019-08-18 04:14:31 UTC
  • mto: This revision was merged to the branch mainline in revision 390.
  • Revision ID: teddy@recompile.se-20190818041431-jgt8pizlzjvxalj0
Debian package: Client: Install the systemd sysusers.d file

* debian/mandos-client.dirs (usr/lib/sysusers.d): New.

Show diffs side-by-side

added added

removed removed

Lines of Context:
1
1
#!/usr/bin/python
2
2
# -*- mode: python; coding: utf-8 -*-
3
 
 
3
#
4
4
# Mandos server - give out binary blobs to connecting clients.
5
 
 
5
#
6
6
# This program is partly derived from an example program for an Avahi
7
7
# service publisher, downloaded from
8
8
# <http://avahi.org/wiki/PythonPublishExample>.  This includes the
9
9
# methods "add", "remove", "server_state_changed",
10
10
# "entry_group_state_changed", "cleanup", and "activate" in the
11
11
# "AvahiService" class, and some lines in "main".
12
 
 
12
#
13
13
# Everything else is
14
 
# Copyright © 2008-2012 Teddy Hogeborn
15
 
# Copyright © 2008-2012 Björn Påhlsson
16
 
17
 
# This program is free software: you can redistribute it and/or modify
18
 
# it under the terms of the GNU General Public License as published by
 
14
# Copyright © 2008-2019 Teddy Hogeborn
 
15
# Copyright © 2008-2019 Björn Påhlsson
 
16
#
 
17
# This file is part of Mandos.
 
18
#
 
19
# Mandos is free software: you can redistribute it and/or modify it
 
20
# under the terms of the GNU General Public License as published by
19
21
# the Free Software Foundation, either version 3 of the License, or
20
22
# (at your option) any later version.
21
23
#
22
 
#     This program is distributed in the hope that it will be useful,
23
 
#     but WITHOUT ANY WARRANTY; without even the implied warranty of
 
24
#     Mandos is distributed in the hope that it will be useful, but
 
25
#     WITHOUT ANY WARRANTY; without even the implied warranty of
24
26
#     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
25
27
#     GNU General Public License for more details.
26
 
 
28
#
27
29
# You should have received a copy of the GNU General Public License
28
 
# along with this program.  If not, see
29
 
# <http://www.gnu.org/licenses/>.
30
 
 
30
# along with Mandos.  If not, see <http://www.gnu.org/licenses/>.
 
31
#
31
32
# Contact the authors at <mandos@recompile.se>.
32
 
 
33
#
33
34
 
34
35
from __future__ import (division, absolute_import, print_function,
35
36
                        unicode_literals)
36
37
 
37
 
from future_builtins import *
 
38
try:
 
39
    from future_builtins import *
 
40
except ImportError:
 
41
    pass
38
42
 
39
 
import SocketServer as socketserver
 
43
try:
 
44
    import SocketServer as socketserver
 
45
except ImportError:
 
46
    import socketserver
40
47
import socket
41
48
import argparse
42
49
import datetime
43
50
import errno
44
 
import gnutls.crypto
45
 
import gnutls.connection
46
 
import gnutls.errors
47
 
import gnutls.library.functions
48
 
import gnutls.library.constants
49
 
import gnutls.library.types
50
 
import ConfigParser as configparser
 
51
try:
 
52
    import ConfigParser as configparser
 
53
except ImportError:
 
54
    import configparser
51
55
import sys
52
56
import re
53
57
import os
62
66
import struct
63
67
import fcntl
64
68
import functools
65
 
import cPickle as pickle
 
69
try:
 
70
    import cPickle as pickle
 
71
except ImportError:
 
72
    import pickle
66
73
import multiprocessing
67
74
import types
68
75
import binascii
69
76
import tempfile
70
77
import itertools
71
78
import collections
 
79
import codecs
72
80
 
73
81
import dbus
74
82
import dbus.service
75
 
import gobject
76
 
import avahi
 
83
import gi
 
84
from gi.repository import GLib
77
85
from dbus.mainloop.glib import DBusGMainLoop
78
86
import ctypes
79
87
import ctypes.util
80
88
import xml.dom.minidom
81
89
import inspect
82
90
 
 
91
if sys.version_info.major == 2:
 
92
    __metaclass__ = type
 
93
 
 
94
# Try to find the value of SO_BINDTODEVICE:
83
95
try:
 
96
    # This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and
 
97
    # newer, and it is also the most natural place for it:
84
98
    SO_BINDTODEVICE = socket.SO_BINDTODEVICE
85
99
except AttributeError:
86
100
    try:
 
101
        # This is where SO_BINDTODEVICE was up to and including Python
 
102
        # 2.6, and also 3.2:
87
103
        from IN import SO_BINDTODEVICE
88
104
    except ImportError:
89
 
        SO_BINDTODEVICE = None
90
 
 
91
 
version = "1.6.0"
 
105
        # In Python 2.7 it seems to have been removed entirely.
 
106
        # Try running the C preprocessor:
 
107
        try:
 
108
            cc = subprocess.Popen(["cc", "--language=c", "-E",
 
109
                                   "/dev/stdin"],
 
110
                                  stdin=subprocess.PIPE,
 
111
                                  stdout=subprocess.PIPE)
 
112
            stdout = cc.communicate(
 
113
                "#include <sys/socket.h>\nSO_BINDTODEVICE\n")[0]
 
114
            SO_BINDTODEVICE = int(stdout.splitlines()[-1])
 
115
        except (OSError, ValueError, IndexError):
 
116
            # No value found
 
117
            SO_BINDTODEVICE = None
 
118
 
 
119
if sys.version_info.major == 2:
 
120
    str = unicode
 
121
 
 
122
if sys.version_info < (3, 2):
 
123
    configparser.Configparser = configparser.SafeConfigParser
 
124
 
 
125
version = "1.8.7"
92
126
stored_state_file = "clients.pickle"
93
127
 
94
128
logger = logging.getLogger()
95
 
syslogger = (logging.handlers.SysLogHandler
96
 
             (facility = logging.handlers.SysLogHandler.LOG_DAEMON,
97
 
              address = str("/dev/log")))
 
129
syslogger = None
98
130
 
99
131
try:
100
 
    if_nametoindex = (ctypes.cdll.LoadLibrary
101
 
                      (ctypes.util.find_library("c"))
102
 
                      .if_nametoindex)
 
132
    if_nametoindex = ctypes.cdll.LoadLibrary(
 
133
        ctypes.util.find_library("c")).if_nametoindex
103
134
except (OSError, AttributeError):
 
135
 
104
136
    def if_nametoindex(interface):
105
137
        "Get an interface index the hard way, i.e. using fcntl()"
106
138
        SIOCGIFINDEX = 0x8933  # From /usr/include/linux/sockios.h
107
139
        with contextlib.closing(socket.socket()) as s:
108
140
            ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
109
 
                                struct.pack(str("16s16x"),
110
 
                                            interface))
111
 
        interface_index = struct.unpack(str("I"),
112
 
                                        ifreq[16:20])[0]
 
141
                                struct.pack(b"16s16x", interface))
 
142
        interface_index = struct.unpack("I", ifreq[16:20])[0]
113
143
        return interface_index
114
144
 
115
145
 
 
146
def copy_function(func):
 
147
    """Make a copy of a function"""
 
148
    if sys.version_info.major == 2:
 
149
        return types.FunctionType(func.func_code,
 
150
                                  func.func_globals,
 
151
                                  func.func_name,
 
152
                                  func.func_defaults,
 
153
                                  func.func_closure)
 
154
    else:
 
155
        return types.FunctionType(func.__code__,
 
156
                                  func.__globals__,
 
157
                                  func.__name__,
 
158
                                  func.__defaults__,
 
159
                                  func.__closure__)
 
160
 
 
161
 
116
162
def initlogger(debug, level=logging.WARNING):
117
163
    """init logger and add loglevel"""
118
 
    
 
164
 
 
165
    global syslogger
 
166
    syslogger = (logging.handlers.SysLogHandler(
 
167
        facility=logging.handlers.SysLogHandler.LOG_DAEMON,
 
168
        address="/dev/log"))
119
169
    syslogger.setFormatter(logging.Formatter
120
170
                           ('Mandos [%(process)d]: %(levelname)s:'
121
171
                            ' %(message)s'))
122
172
    logger.addHandler(syslogger)
123
 
    
 
173
 
124
174
    if debug:
125
175
        console = logging.StreamHandler()
126
176
        console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
136
186
    pass
137
187
 
138
188
 
139
 
class PGPEngine(object):
 
189
class PGPEngine:
140
190
    """A simple class for OpenPGP symmetric encryption & decryption"""
 
191
 
141
192
    def __init__(self):
142
193
        self.tempdir = tempfile.mkdtemp(prefix="mandos-")
 
194
        self.gpg = "gpg"
 
195
        try:
 
196
            output = subprocess.check_output(["gpgconf"])
 
197
            for line in output.splitlines():
 
198
                name, text, path = line.split(b":")
 
199
                if name == "gpg":
 
200
                    self.gpg = path
 
201
                    break
 
202
        except OSError as e:
 
203
            if e.errno != errno.ENOENT:
 
204
                raise
143
205
        self.gnupgargs = ['--batch',
144
 
                          '--home', self.tempdir,
 
206
                          '--homedir', self.tempdir,
145
207
                          '--force-mdc',
146
 
                          '--quiet',
147
 
                          '--no-use-agent']
148
 
    
 
208
                          '--quiet']
 
209
        # Only GPG version 1 has the --no-use-agent option.
 
210
        if self.gpg == "gpg" or self.gpg.endswith("/gpg"):
 
211
            self.gnupgargs.append("--no-use-agent")
 
212
 
149
213
    def __enter__(self):
150
214
        return self
151
 
    
 
215
 
152
216
    def __exit__(self, exc_type, exc_value, traceback):
153
217
        self._cleanup()
154
218
        return False
155
 
    
 
219
 
156
220
    def __del__(self):
157
221
        self._cleanup()
158
 
    
 
222
 
159
223
    def _cleanup(self):
160
224
        if self.tempdir is not None:
161
225
            # Delete contents of tempdir
162
226
            for root, dirs, files in os.walk(self.tempdir,
163
 
                                             topdown = False):
 
227
                                             topdown=False):
164
228
                for filename in files:
165
229
                    os.remove(os.path.join(root, filename))
166
230
                for dirname in dirs:
168
232
            # Remove tempdir
169
233
            os.rmdir(self.tempdir)
170
234
            self.tempdir = None
171
 
    
 
235
 
172
236
    def password_encode(self, password):
173
237
        # Passphrase can not be empty and can not contain newlines or
174
238
        # NUL bytes.  So we prefix it and hex encode it.
175
 
        return b"mandos" + binascii.hexlify(password)
176
 
    
 
239
        encoded = b"mandos" + binascii.hexlify(password)
 
240
        if len(encoded) > 2048:
 
241
            # GnuPG can't handle long passwords, so encode differently
 
242
            encoded = (b"mandos" + password.replace(b"\\", b"\\\\")
 
243
                       .replace(b"\n", b"\\n")
 
244
                       .replace(b"\0", b"\\x00"))
 
245
        return encoded
 
246
 
177
247
    def encrypt(self, data, password):
178
248
        passphrase = self.password_encode(password)
179
 
        with tempfile.NamedTemporaryFile(dir=self.tempdir
180
 
                                         ) as passfile:
 
249
        with tempfile.NamedTemporaryFile(
 
250
                dir=self.tempdir) as passfile:
181
251
            passfile.write(passphrase)
182
252
            passfile.flush()
183
 
            proc = subprocess.Popen(['gpg', '--symmetric',
 
253
            proc = subprocess.Popen([self.gpg, '--symmetric',
184
254
                                     '--passphrase-file',
185
255
                                     passfile.name]
186
256
                                    + self.gnupgargs,
187
 
                                    stdin = subprocess.PIPE,
188
 
                                    stdout = subprocess.PIPE,
189
 
                                    stderr = subprocess.PIPE)
190
 
            ciphertext, err = proc.communicate(input = data)
 
257
                                    stdin=subprocess.PIPE,
 
258
                                    stdout=subprocess.PIPE,
 
259
                                    stderr=subprocess.PIPE)
 
260
            ciphertext, err = proc.communicate(input=data)
191
261
        if proc.returncode != 0:
192
262
            raise PGPError(err)
193
263
        return ciphertext
194
 
    
 
264
 
195
265
    def decrypt(self, data, password):
196
266
        passphrase = self.password_encode(password)
197
 
        with tempfile.NamedTemporaryFile(dir = self.tempdir
198
 
                                         ) as passfile:
 
267
        with tempfile.NamedTemporaryFile(
 
268
                dir=self.tempdir) as passfile:
199
269
            passfile.write(passphrase)
200
270
            passfile.flush()
201
 
            proc = subprocess.Popen(['gpg', '--decrypt',
 
271
            proc = subprocess.Popen([self.gpg, '--decrypt',
202
272
                                     '--passphrase-file',
203
273
                                     passfile.name]
204
274
                                    + self.gnupgargs,
205
 
                                    stdin = subprocess.PIPE,
206
 
                                    stdout = subprocess.PIPE,
207
 
                                    stderr = subprocess.PIPE)
208
 
            decrypted_plaintext, err = proc.communicate(input
209
 
                                                        = data)
 
275
                                    stdin=subprocess.PIPE,
 
276
                                    stdout=subprocess.PIPE,
 
277
                                    stderr=subprocess.PIPE)
 
278
            decrypted_plaintext, err = proc.communicate(input=data)
210
279
        if proc.returncode != 0:
211
280
            raise PGPError(err)
212
281
        return decrypted_plaintext
213
282
 
214
283
 
 
284
# Pretend that we have an Avahi module
 
285
class avahi:
 
286
    """This isn't so much a class as it is a module-like namespace."""
 
287
    IF_UNSPEC = -1               # avahi-common/address.h
 
288
    PROTO_UNSPEC = -1            # avahi-common/address.h
 
289
    PROTO_INET = 0               # avahi-common/address.h
 
290
    PROTO_INET6 = 1              # avahi-common/address.h
 
291
    DBUS_NAME = "org.freedesktop.Avahi"
 
292
    DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"
 
293
    DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"
 
294
    DBUS_PATH_SERVER = "/"
 
295
 
 
296
    @staticmethod
 
297
    def string_array_to_txt_array(t):
 
298
        return dbus.Array((dbus.ByteArray(s.encode("utf-8"))
 
299
                           for s in t), signature="ay")
 
300
    ENTRY_GROUP_ESTABLISHED = 2  # avahi-common/defs.h
 
301
    ENTRY_GROUP_COLLISION = 3    # avahi-common/defs.h
 
302
    ENTRY_GROUP_FAILURE = 4      # avahi-common/defs.h
 
303
    SERVER_INVALID = 0           # avahi-common/defs.h
 
304
    SERVER_REGISTERING = 1       # avahi-common/defs.h
 
305
    SERVER_RUNNING = 2           # avahi-common/defs.h
 
306
    SERVER_COLLISION = 3         # avahi-common/defs.h
 
307
    SERVER_FAILURE = 4           # avahi-common/defs.h
 
308
 
 
309
 
215
310
class AvahiError(Exception):
216
311
    def __init__(self, value, *args, **kwargs):
217
312
        self.value = value
218
 
        super(AvahiError, self).__init__(value, *args, **kwargs)
219
 
    def __unicode__(self):
220
 
        return unicode(repr(self.value))
 
313
        return super(AvahiError, self).__init__(value, *args,
 
314
                                                **kwargs)
 
315
 
221
316
 
222
317
class AvahiServiceError(AvahiError):
223
318
    pass
224
319
 
 
320
 
225
321
class AvahiGroupError(AvahiError):
226
322
    pass
227
323
 
228
324
 
229
 
class AvahiService(object):
 
325
class AvahiService:
230
326
    """An Avahi (Zeroconf) service.
231
 
    
 
327
 
232
328
    Attributes:
233
329
    interface: integer; avahi.IF_UNSPEC or an interface index.
234
330
               Used to optionally bind to the specified interface.
246
342
    server: D-Bus Server
247
343
    bus: dbus.SystemBus()
248
344
    """
249
 
    
250
 
    def __init__(self, interface = avahi.IF_UNSPEC, name = None,
251
 
                 servicetype = None, port = None, TXT = None,
252
 
                 domain = "", host = "", max_renames = 32768,
253
 
                 protocol = avahi.PROTO_UNSPEC, bus = None):
 
345
 
 
346
    def __init__(self,
 
347
                 interface=avahi.IF_UNSPEC,
 
348
                 name=None,
 
349
                 servicetype=None,
 
350
                 port=None,
 
351
                 TXT=None,
 
352
                 domain="",
 
353
                 host="",
 
354
                 max_renames=32768,
 
355
                 protocol=avahi.PROTO_UNSPEC,
 
356
                 bus=None):
254
357
        self.interface = interface
255
358
        self.name = name
256
359
        self.type = servicetype
265
368
        self.server = None
266
369
        self.bus = bus
267
370
        self.entry_group_state_changed_match = None
268
 
    
269
 
    def rename(self):
 
371
 
 
372
    def rename(self, remove=True):
270
373
        """Derived from the Avahi example code"""
271
374
        if self.rename_count >= self.max_renames:
272
375
            logger.critical("No suitable Zeroconf service name found"
273
376
                            " after %i retries, exiting.",
274
377
                            self.rename_count)
275
378
            raise AvahiServiceError("Too many renames")
276
 
        self.name = unicode(self.server
277
 
                            .GetAlternativeServiceName(self.name))
 
379
        self.name = str(
 
380
            self.server.GetAlternativeServiceName(self.name))
 
381
        self.rename_count += 1
278
382
        logger.info("Changing Zeroconf service name to %r ...",
279
383
                    self.name)
280
 
        self.remove()
 
384
        if remove:
 
385
            self.remove()
281
386
        try:
282
387
            self.add()
283
388
        except dbus.exceptions.DBusException as error:
284
 
            logger.critical("D-Bus Exception", exc_info=error)
285
 
            self.cleanup()
286
 
            os._exit(1)
287
 
        self.rename_count += 1
288
 
    
 
389
            if (error.get_dbus_name()
 
390
                == "org.freedesktop.Avahi.CollisionError"):
 
391
                logger.info("Local Zeroconf service name collision.")
 
392
                return self.rename(remove=False)
 
393
            else:
 
394
                logger.critical("D-Bus Exception", exc_info=error)
 
395
                self.cleanup()
 
396
                os._exit(1)
 
397
 
289
398
    def remove(self):
290
399
        """Derived from the Avahi example code"""
291
400
        if self.entry_group_state_changed_match is not None:
293
402
            self.entry_group_state_changed_match = None
294
403
        if self.group is not None:
295
404
            self.group.Reset()
296
 
    
 
405
 
297
406
    def add(self):
298
407
        """Derived from the Avahi example code"""
299
408
        self.remove()
316
425
            dbus.UInt16(self.port),
317
426
            avahi.string_array_to_txt_array(self.TXT))
318
427
        self.group.Commit()
319
 
    
 
428
 
320
429
    def entry_group_state_changed(self, state, error):
321
430
        """Derived from the Avahi example code"""
322
431
        logger.debug("Avahi entry group state change: %i", state)
323
 
        
 
432
 
324
433
        if state == avahi.ENTRY_GROUP_ESTABLISHED:
325
434
            logger.debug("Zeroconf service established.")
326
435
        elif state == avahi.ENTRY_GROUP_COLLISION:
328
437
            self.rename()
329
438
        elif state == avahi.ENTRY_GROUP_FAILURE:
330
439
            logger.critical("Avahi: Error in group state changed %s",
331
 
                            unicode(error))
332
 
            raise AvahiGroupError("State changed: {0!s}"
333
 
                                  .format(error))
334
 
    
 
440
                            str(error))
 
441
            raise AvahiGroupError("State changed: {!s}".format(error))
 
442
 
335
443
    def cleanup(self):
336
444
        """Derived from the Avahi example code"""
337
445
        if self.group is not None:
342
450
                pass
343
451
            self.group = None
344
452
        self.remove()
345
 
    
 
453
 
346
454
    def server_state_changed(self, state, error=None):
347
455
        """Derived from the Avahi example code"""
348
456
        logger.debug("Avahi server state change: %i", state)
349
 
        bad_states = { avahi.SERVER_INVALID:
350
 
                           "Zeroconf server invalid",
351
 
                       avahi.SERVER_REGISTERING: None,
352
 
                       avahi.SERVER_COLLISION:
353
 
                           "Zeroconf server name collision",
354
 
                       avahi.SERVER_FAILURE:
355
 
                           "Zeroconf server failure" }
 
457
        bad_states = {
 
458
            avahi.SERVER_INVALID: "Zeroconf server invalid",
 
459
            avahi.SERVER_REGISTERING: None,
 
460
            avahi.SERVER_COLLISION: "Zeroconf server name collision",
 
461
            avahi.SERVER_FAILURE: "Zeroconf server failure",
 
462
        }
356
463
        if state in bad_states:
357
464
            if bad_states[state] is not None:
358
465
                if error is None:
361
468
                    logger.error(bad_states[state] + ": %r", error)
362
469
            self.cleanup()
363
470
        elif state == avahi.SERVER_RUNNING:
364
 
            self.add()
 
471
            try:
 
472
                self.add()
 
473
            except dbus.exceptions.DBusException as error:
 
474
                if (error.get_dbus_name()
 
475
                    == "org.freedesktop.Avahi.CollisionError"):
 
476
                    logger.info("Local Zeroconf service name"
 
477
                                " collision.")
 
478
                    return self.rename(remove=False)
 
479
                else:
 
480
                    logger.critical("D-Bus Exception", exc_info=error)
 
481
                    self.cleanup()
 
482
                    os._exit(1)
365
483
        else:
366
484
            if error is None:
367
485
                logger.debug("Unknown state: %r", state)
368
486
            else:
369
487
                logger.debug("Unknown state: %r: %r", state, error)
370
 
    
 
488
 
371
489
    def activate(self):
372
490
        """Derived from the Avahi example code"""
373
491
        if self.server is None:
377
495
                                    follow_name_owner_changes=True),
378
496
                avahi.DBUS_INTERFACE_SERVER)
379
497
        self.server.connect_to_signal("StateChanged",
380
 
                                 self.server_state_changed)
 
498
                                      self.server_state_changed)
381
499
        self.server_state_changed(self.server.GetState())
382
500
 
383
501
 
384
502
class AvahiServiceToSyslog(AvahiService):
385
 
    def rename(self):
 
503
    def rename(self, *args, **kwargs):
386
504
        """Add the new name to the syslog messages"""
387
 
        ret = AvahiService.rename(self)
388
 
        syslogger.setFormatter(logging.Formatter
389
 
                               ('Mandos ({0}) [%(process)d]:'
390
 
                                ' %(levelname)s: %(message)s'
391
 
                                .format(self.name)))
 
505
        ret = super(AvahiServiceToSyslog, self).rename(*args, **kwargs)
 
506
        syslogger.setFormatter(logging.Formatter(
 
507
            'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
 
508
            .format(self.name)))
392
509
        return ret
393
510
 
394
511
 
395
 
def timedelta_to_milliseconds(td):
396
 
    "Convert a datetime.timedelta() to milliseconds"
397
 
    return ((td.days * 24 * 60 * 60 * 1000)
398
 
            + (td.seconds * 1000)
399
 
            + (td.microseconds // 1000))
400
 
 
401
 
 
402
 
class Client(object):
 
512
# Pretend that we have a GnuTLS module
 
513
class gnutls:
 
514
    """This isn't so much a class as it is a module-like namespace."""
 
515
 
 
516
    library = ctypes.util.find_library("gnutls")
 
517
    if library is None:
 
518
        library = ctypes.util.find_library("gnutls-deb0")
 
519
    _library = ctypes.cdll.LoadLibrary(library)
 
520
    del library
 
521
 
 
522
    # Unless otherwise indicated, the constants and types below are
 
523
    # all from the gnutls/gnutls.h C header file.
 
524
 
 
525
    # Constants
 
526
    E_SUCCESS = 0
 
527
    E_INTERRUPTED = -52
 
528
    E_AGAIN = -28
 
529
    CRT_OPENPGP = 2
 
530
    CRT_RAWPK = 3
 
531
    CLIENT = 2
 
532
    SHUT_RDWR = 0
 
533
    CRD_CERTIFICATE = 1
 
534
    E_NO_CERTIFICATE_FOUND = -49
 
535
    X509_FMT_DER = 0
 
536
    NO_TICKETS = 1<<10
 
537
    ENABLE_RAWPK = 1<<18
 
538
    CTYPE_PEERS = 3
 
539
    KEYID_USE_SHA256 = 1        # gnutls/x509.h
 
540
    OPENPGP_FMT_RAW = 0         # gnutls/openpgp.h
 
541
 
 
542
    # Types
 
543
    class session_int(ctypes.Structure):
 
544
        _fields_ = []
 
545
    session_t = ctypes.POINTER(session_int)
 
546
 
 
547
    class certificate_credentials_st(ctypes.Structure):
 
548
        _fields_ = []
 
549
    certificate_credentials_t = ctypes.POINTER(
 
550
        certificate_credentials_st)
 
551
    certificate_type_t = ctypes.c_int
 
552
 
 
553
    class datum_t(ctypes.Structure):
 
554
        _fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
 
555
                    ('size', ctypes.c_uint)]
 
556
 
 
557
    class openpgp_crt_int(ctypes.Structure):
 
558
        _fields_ = []
 
559
    openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
 
560
    openpgp_crt_fmt_t = ctypes.c_int  # gnutls/openpgp.h
 
561
    log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
 
562
    credentials_type_t = ctypes.c_int
 
563
    transport_ptr_t = ctypes.c_void_p
 
564
    close_request_t = ctypes.c_int
 
565
 
 
566
    # Exceptions
 
567
    class Error(Exception):
 
568
        def __init__(self, message=None, code=None, args=()):
 
569
            # Default usage is by a message string, but if a return
 
570
            # code is passed, convert it to a string with
 
571
            # gnutls.strerror()
 
572
            self.code = code
 
573
            if message is None and code is not None:
 
574
                message = gnutls.strerror(code)
 
575
            return super(gnutls.Error, self).__init__(
 
576
                message, *args)
 
577
 
 
578
    class CertificateSecurityError(Error):
 
579
        pass
 
580
 
 
581
    # Classes
 
582
    class Credentials:
 
583
        def __init__(self):
 
584
            self._c_object = gnutls.certificate_credentials_t()
 
585
            gnutls.certificate_allocate_credentials(
 
586
                ctypes.byref(self._c_object))
 
587
            self.type = gnutls.CRD_CERTIFICATE
 
588
 
 
589
        def __del__(self):
 
590
            gnutls.certificate_free_credentials(self._c_object)
 
591
 
 
592
    class ClientSession:
 
593
        def __init__(self, socket, credentials=None):
 
594
            self._c_object = gnutls.session_t()
 
595
            gnutls_flags = gnutls.CLIENT
 
596
            if gnutls.check_version(b"3.5.6"):
 
597
                gnutls_flags |= gnutls.NO_TICKETS
 
598
            if gnutls.has_rawpk:
 
599
                gnutls_flags |= gnutls.ENABLE_RAWPK
 
600
            gnutls.init(ctypes.byref(self._c_object), gnutls_flags)
 
601
            del gnutls_flags
 
602
            gnutls.set_default_priority(self._c_object)
 
603
            gnutls.transport_set_ptr(self._c_object, socket.fileno())
 
604
            gnutls.handshake_set_private_extensions(self._c_object,
 
605
                                                    True)
 
606
            self.socket = socket
 
607
            if credentials is None:
 
608
                credentials = gnutls.Credentials()
 
609
            gnutls.credentials_set(self._c_object, credentials.type,
 
610
                                   ctypes.cast(credentials._c_object,
 
611
                                               ctypes.c_void_p))
 
612
            self.credentials = credentials
 
613
 
 
614
        def __del__(self):
 
615
            gnutls.deinit(self._c_object)
 
616
 
 
617
        def handshake(self):
 
618
            return gnutls.handshake(self._c_object)
 
619
 
 
620
        def send(self, data):
 
621
            data = bytes(data)
 
622
            data_len = len(data)
 
623
            while data_len > 0:
 
624
                data_len -= gnutls.record_send(self._c_object,
 
625
                                               data[-data_len:],
 
626
                                               data_len)
 
627
 
 
628
        def bye(self):
 
629
            return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
 
630
 
 
631
    # Error handling functions
 
632
    def _error_code(result):
 
633
        """A function to raise exceptions on errors, suitable
 
634
        for the 'restype' attribute on ctypes functions"""
 
635
        if result >= 0:
 
636
            return result
 
637
        if result == gnutls.E_NO_CERTIFICATE_FOUND:
 
638
            raise gnutls.CertificateSecurityError(code=result)
 
639
        raise gnutls.Error(code=result)
 
640
 
 
641
    def _retry_on_error(result, func, arguments):
 
642
        """A function to retry on some errors, suitable
 
643
        for the 'errcheck' attribute on ctypes functions"""
 
644
        while result < 0:
 
645
            if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
 
646
                return _error_code(result)
 
647
            result = func(*arguments)
 
648
        return result
 
649
 
 
650
    # Unless otherwise indicated, the function declarations below are
 
651
    # all from the gnutls/gnutls.h C header file.
 
652
 
 
653
    # Functions
 
654
    priority_set_direct = _library.gnutls_priority_set_direct
 
655
    priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
 
656
                                    ctypes.POINTER(ctypes.c_char_p)]
 
657
    priority_set_direct.restype = _error_code
 
658
 
 
659
    init = _library.gnutls_init
 
660
    init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
 
661
    init.restype = _error_code
 
662
 
 
663
    set_default_priority = _library.gnutls_set_default_priority
 
664
    set_default_priority.argtypes = [session_t]
 
665
    set_default_priority.restype = _error_code
 
666
 
 
667
    record_send = _library.gnutls_record_send
 
668
    record_send.argtypes = [session_t, ctypes.c_void_p,
 
669
                            ctypes.c_size_t]
 
670
    record_send.restype = ctypes.c_ssize_t
 
671
    record_send.errcheck = _retry_on_error
 
672
 
 
673
    certificate_allocate_credentials = (
 
674
        _library.gnutls_certificate_allocate_credentials)
 
675
    certificate_allocate_credentials.argtypes = [
 
676
        ctypes.POINTER(certificate_credentials_t)]
 
677
    certificate_allocate_credentials.restype = _error_code
 
678
 
 
679
    certificate_free_credentials = (
 
680
        _library.gnutls_certificate_free_credentials)
 
681
    certificate_free_credentials.argtypes = [
 
682
        certificate_credentials_t]
 
683
    certificate_free_credentials.restype = None
 
684
 
 
685
    handshake_set_private_extensions = (
 
686
        _library.gnutls_handshake_set_private_extensions)
 
687
    handshake_set_private_extensions.argtypes = [session_t,
 
688
                                                 ctypes.c_int]
 
689
    handshake_set_private_extensions.restype = None
 
690
 
 
691
    credentials_set = _library.gnutls_credentials_set
 
692
    credentials_set.argtypes = [session_t, credentials_type_t,
 
693
                                ctypes.c_void_p]
 
694
    credentials_set.restype = _error_code
 
695
 
 
696
    strerror = _library.gnutls_strerror
 
697
    strerror.argtypes = [ctypes.c_int]
 
698
    strerror.restype = ctypes.c_char_p
 
699
 
 
700
    certificate_type_get = _library.gnutls_certificate_type_get
 
701
    certificate_type_get.argtypes = [session_t]
 
702
    certificate_type_get.restype = _error_code
 
703
 
 
704
    certificate_get_peers = _library.gnutls_certificate_get_peers
 
705
    certificate_get_peers.argtypes = [session_t,
 
706
                                      ctypes.POINTER(ctypes.c_uint)]
 
707
    certificate_get_peers.restype = ctypes.POINTER(datum_t)
 
708
 
 
709
    global_set_log_level = _library.gnutls_global_set_log_level
 
710
    global_set_log_level.argtypes = [ctypes.c_int]
 
711
    global_set_log_level.restype = None
 
712
 
 
713
    global_set_log_function = _library.gnutls_global_set_log_function
 
714
    global_set_log_function.argtypes = [log_func]
 
715
    global_set_log_function.restype = None
 
716
 
 
717
    deinit = _library.gnutls_deinit
 
718
    deinit.argtypes = [session_t]
 
719
    deinit.restype = None
 
720
 
 
721
    handshake = _library.gnutls_handshake
 
722
    handshake.argtypes = [session_t]
 
723
    handshake.restype = _error_code
 
724
    handshake.errcheck = _retry_on_error
 
725
 
 
726
    transport_set_ptr = _library.gnutls_transport_set_ptr
 
727
    transport_set_ptr.argtypes = [session_t, transport_ptr_t]
 
728
    transport_set_ptr.restype = None
 
729
 
 
730
    bye = _library.gnutls_bye
 
731
    bye.argtypes = [session_t, close_request_t]
 
732
    bye.restype = _error_code
 
733
    bye.errcheck = _retry_on_error
 
734
 
 
735
    check_version = _library.gnutls_check_version
 
736
    check_version.argtypes = [ctypes.c_char_p]
 
737
    check_version.restype = ctypes.c_char_p
 
738
 
 
739
    _need_version = b"3.3.0"
 
740
    if check_version(_need_version) is None:
 
741
        raise self.Error("Needs GnuTLS {} or later"
 
742
                         .format(_need_version))
 
743
 
 
744
    _tls_rawpk_version = b"3.6.6"
 
745
    has_rawpk = bool(check_version(_tls_rawpk_version))
 
746
 
 
747
    if has_rawpk:
 
748
        # Types
 
749
        class pubkey_st(ctypes.Structure):
 
750
            _fields = []
 
751
        pubkey_t = ctypes.POINTER(pubkey_st)
 
752
 
 
753
        x509_crt_fmt_t = ctypes.c_int
 
754
 
 
755
        # All the function declarations below are from gnutls/abstract.h
 
756
        pubkey_init = _library.gnutls_pubkey_init
 
757
        pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]
 
758
        pubkey_init.restype = _error_code
 
759
 
 
760
        pubkey_import = _library.gnutls_pubkey_import
 
761
        pubkey_import.argtypes = [pubkey_t, ctypes.POINTER(datum_t),
 
762
                                  x509_crt_fmt_t]
 
763
        pubkey_import.restype = _error_code
 
764
 
 
765
        pubkey_get_key_id = _library.gnutls_pubkey_get_key_id
 
766
        pubkey_get_key_id.argtypes = [pubkey_t, ctypes.c_int,
 
767
                                      ctypes.POINTER(ctypes.c_ubyte),
 
768
                                      ctypes.POINTER(ctypes.c_size_t)]
 
769
        pubkey_get_key_id.restype = _error_code
 
770
 
 
771
        pubkey_deinit = _library.gnutls_pubkey_deinit
 
772
        pubkey_deinit.argtypes = [pubkey_t]
 
773
        pubkey_deinit.restype = None
 
774
    else:
 
775
        # All the function declarations below are from gnutls/openpgp.h
 
776
 
 
777
        openpgp_crt_init = _library.gnutls_openpgp_crt_init
 
778
        openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
 
779
        openpgp_crt_init.restype = _error_code
 
780
 
 
781
        openpgp_crt_import = _library.gnutls_openpgp_crt_import
 
782
        openpgp_crt_import.argtypes = [openpgp_crt_t,
 
783
                                       ctypes.POINTER(datum_t),
 
784
                                       openpgp_crt_fmt_t]
 
785
        openpgp_crt_import.restype = _error_code
 
786
 
 
787
        openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
 
788
        openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
 
789
                                            ctypes.POINTER(ctypes.c_uint)]
 
790
        openpgp_crt_verify_self.restype = _error_code
 
791
 
 
792
        openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
 
793
        openpgp_crt_deinit.argtypes = [openpgp_crt_t]
 
794
        openpgp_crt_deinit.restype = None
 
795
 
 
796
        openpgp_crt_get_fingerprint = (
 
797
            _library.gnutls_openpgp_crt_get_fingerprint)
 
798
        openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
 
799
                                                ctypes.c_void_p,
 
800
                                                ctypes.POINTER(
 
801
                                                    ctypes.c_size_t)]
 
802
        openpgp_crt_get_fingerprint.restype = _error_code
 
803
 
 
804
    if check_version(b"3.6.4"):
 
805
        certificate_type_get2 = _library.gnutls_certificate_type_get2
 
806
        certificate_type_get2.argtypes = [session_t, ctypes.c_int]
 
807
        certificate_type_get2.restype = _error_code
 
808
 
 
809
    # Remove non-public functions
 
810
    del _error_code, _retry_on_error
 
811
 
 
812
 
 
813
def call_pipe(connection,       # : multiprocessing.Connection
 
814
              func, *args, **kwargs):
 
815
    """This function is meant to be called by multiprocessing.Process
 
816
 
 
817
    This function runs func(*args, **kwargs), and writes the resulting
 
818
    return value on the provided multiprocessing.Connection.
 
819
    """
 
820
    connection.send(func(*args, **kwargs))
 
821
    connection.close()
 
822
 
 
823
 
 
824
class Client:
403
825
    """A representation of a client host served by this server.
404
 
    
 
826
 
405
827
    Attributes:
406
828
    approved:   bool(); 'None' if not yet approved/disapproved
407
829
    approval_delay: datetime.timedelta(); Time to wait for approval
408
830
    approval_duration: datetime.timedelta(); Duration of one approval
409
 
    checker:    subprocess.Popen(); a running checker process used
410
 
                                    to see if the client lives.
411
 
                                    'None' if no process is running.
412
 
    checker_callback_tag: a gobject event source tag, or None
 
831
    checker: multiprocessing.Process(); a running checker process used
 
832
             to see if the client lives. 'None' if no process is
 
833
             running.
 
834
    checker_callback_tag: a GLib event source tag, or None
413
835
    checker_command: string; External command which is run to check
414
836
                     if client lives.  %() expansions are done at
415
837
                     runtime with vars(self) as dict, so that for
416
838
                     instance %(name)s can be used in the command.
417
 
    checker_initiator_tag: a gobject event source tag, or None
 
839
    checker_initiator_tag: a GLib event source tag, or None
418
840
    created:    datetime.datetime(); (UTC) object creation
419
841
    client_structure: Object describing what attributes a client has
420
842
                      and is used for storing the client at exit
421
843
    current_checker_command: string; current running checker_command
422
 
    disable_initiator_tag: a gobject event source tag, or None
 
844
    disable_initiator_tag: a GLib event source tag, or None
423
845
    enabled:    bool()
424
846
    fingerprint: string (40 or 32 hexadecimal digits); used to
425
 
                 uniquely identify the client
 
847
                 uniquely identify an OpenPGP client
 
848
    key_id: string (64 hexadecimal digits); used to uniquely identify
 
849
            a client using raw public keys
426
850
    host:       string; available for use by the checker command
427
851
    interval:   datetime.timedelta(); How often to start a new checker
428
852
    last_approval_request: datetime.datetime(); (UTC) or None
430
854
    last_checker_status: integer between 0 and 255 reflecting exit
431
855
                         status of last checker. -1 reflects crashed
432
856
                         checker, -2 means no checker completed yet.
 
857
    last_checker_signal: The signal which killed the last checker, if
 
858
                         last_checker_status is -1
433
859
    last_enabled: datetime.datetime(); (UTC) or None
434
860
    name:       string; from the config file, used in log messages and
435
861
                        D-Bus identifiers
440
866
    runtime_expansions: Allowed attributes for runtime expansion.
441
867
    expires:    datetime.datetime(); time (UTC) when a client will be
442
868
                disabled, or None
 
869
    server_settings: The server_settings dict from main()
443
870
    """
444
 
    
 
871
 
445
872
    runtime_expansions = ("approval_delay", "approval_duration",
446
 
                          "created", "enabled", "expires",
 
873
                          "created", "enabled", "expires", "key_id",
447
874
                          "fingerprint", "host", "interval",
448
875
                          "last_approval_request", "last_checked_ok",
449
876
                          "last_enabled", "name", "timeout")
450
 
    client_defaults = { "timeout": "PT5M",
451
 
                        "extended_timeout": "PT15M",
452
 
                        "interval": "PT2M",
453
 
                        "checker": "fping -q -- %%(host)s",
454
 
                        "host": "",
455
 
                        "approval_delay": "PT0S",
456
 
                        "approval_duration": "PT1S",
457
 
                        "approved_by_default": "True",
458
 
                        "enabled": "True",
459
 
                        }
460
 
    
461
 
    def timeout_milliseconds(self):
462
 
        "Return the 'timeout' attribute in milliseconds"
463
 
        return timedelta_to_milliseconds(self.timeout)
464
 
    
465
 
    def extended_timeout_milliseconds(self):
466
 
        "Return the 'extended_timeout' attribute in milliseconds"
467
 
        return timedelta_to_milliseconds(self.extended_timeout)
468
 
    
469
 
    def interval_milliseconds(self):
470
 
        "Return the 'interval' attribute in milliseconds"
471
 
        return timedelta_to_milliseconds(self.interval)
472
 
    
473
 
    def approval_delay_milliseconds(self):
474
 
        return timedelta_to_milliseconds(self.approval_delay)
475
 
    
 
877
    client_defaults = {
 
878
        "timeout": "PT5M",
 
879
        "extended_timeout": "PT15M",
 
880
        "interval": "PT2M",
 
881
        "checker": "fping -q -- %%(host)s",
 
882
        "host": "",
 
883
        "approval_delay": "PT0S",
 
884
        "approval_duration": "PT1S",
 
885
        "approved_by_default": "True",
 
886
        "enabled": "True",
 
887
    }
 
888
 
476
889
    @staticmethod
477
890
    def config_parser(config):
478
891
        """Construct a new dict of client settings of this form:
485
898
        for client_name in config.sections():
486
899
            section = dict(config.items(client_name))
487
900
            client = settings[client_name] = {}
488
 
            
 
901
 
489
902
            client["host"] = section["host"]
490
903
            # Reformat values from string types to Python types
491
904
            client["approved_by_default"] = config.getboolean(
492
905
                client_name, "approved_by_default")
493
906
            client["enabled"] = config.getboolean(client_name,
494
907
                                                  "enabled")
495
 
            
 
908
 
 
909
            # Uppercase and remove spaces from key_id and fingerprint
 
910
            # for later comparison purposes with return value from the
 
911
            # key_id() and fingerprint() functions
 
912
            client["key_id"] = (section.get("key_id", "").upper()
 
913
                                .replace(" ", ""))
496
914
            client["fingerprint"] = (section["fingerprint"].upper()
497
915
                                     .replace(" ", ""))
498
916
            if "secret" in section:
499
 
                client["secret"] = section["secret"].decode("base64")
 
917
                client["secret"] = codecs.decode(section["secret"]
 
918
                                                 .encode("utf-8"),
 
919
                                                 "base64")
500
920
            elif "secfile" in section:
501
921
                with open(os.path.expanduser(os.path.expandvars
502
922
                                             (section["secfile"])),
503
923
                          "rb") as secfile:
504
924
                    client["secret"] = secfile.read()
505
925
            else:
506
 
                raise TypeError("No secret or secfile for section {0}"
 
926
                raise TypeError("No secret or secfile for section {}"
507
927
                                .format(section))
508
928
            client["timeout"] = string_to_delta(section["timeout"])
509
929
            client["extended_timeout"] = string_to_delta(
517
937
            client["last_approval_request"] = None
518
938
            client["last_checked_ok"] = None
519
939
            client["last_checker_status"] = -2
520
 
        
 
940
 
521
941
        return settings
522
 
    
523
 
    def __init__(self, settings, name = None):
 
942
 
 
943
    def __init__(self, settings, name=None, server_settings=None):
524
944
        self.name = name
 
945
        if server_settings is None:
 
946
            server_settings = {}
 
947
        self.server_settings = server_settings
525
948
        # adding all client settings
526
 
        for setting, value in settings.iteritems():
 
949
        for setting, value in settings.items():
527
950
            setattr(self, setting, value)
528
 
        
 
951
 
529
952
        if self.enabled:
530
953
            if not hasattr(self, "last_enabled"):
531
954
                self.last_enabled = datetime.datetime.utcnow()
535
958
        else:
536
959
            self.last_enabled = None
537
960
            self.expires = None
538
 
        
 
961
 
539
962
        logger.debug("Creating client %r", self.name)
540
 
        # Uppercase and remove spaces from fingerprint for later
541
 
        # comparison purposes with return value from the fingerprint()
542
 
        # function
 
963
        logger.debug("  Key ID: %s", self.key_id)
543
964
        logger.debug("  Fingerprint: %s", self.fingerprint)
544
965
        self.created = settings.get("created",
545
966
                                    datetime.datetime.utcnow())
546
 
        
 
967
 
547
968
        # attributes specific for this server instance
548
969
        self.checker = None
549
970
        self.checker_initiator_tag = None
552
973
        self.current_checker_command = None
553
974
        self.approved = None
554
975
        self.approvals_pending = 0
555
 
        self.changedstate = (multiprocessing_manager
556
 
                             .Condition(multiprocessing_manager
557
 
                                        .Lock()))
558
 
        self.client_structure = [attr for attr in
559
 
                                 self.__dict__.iterkeys()
 
976
        self.changedstate = multiprocessing_manager.Condition(
 
977
            multiprocessing_manager.Lock())
 
978
        self.client_structure = [attr
 
979
                                 for attr in self.__dict__.keys()
560
980
                                 if not attr.startswith("_")]
561
981
        self.client_structure.append("client_structure")
562
 
        
563
 
        for name, t in inspect.getmembers(type(self),
564
 
                                          lambda obj:
565
 
                                              isinstance(obj,
566
 
                                                         property)):
 
982
 
 
983
        for name, t in inspect.getmembers(
 
984
                type(self), lambda obj: isinstance(obj, property)):
567
985
            if not name.startswith("_"):
568
986
                self.client_structure.append(name)
569
 
    
 
987
 
570
988
    # Send notice to process children that client state has changed
571
989
    def send_changedstate(self):
572
990
        with self.changedstate:
573
991
            self.changedstate.notify_all()
574
 
    
 
992
 
575
993
    def enable(self):
576
994
        """Start this client's checker and timeout hooks"""
577
995
        if getattr(self, "enabled", False):
582
1000
        self.last_enabled = datetime.datetime.utcnow()
583
1001
        self.init_checker()
584
1002
        self.send_changedstate()
585
 
    
 
1003
 
586
1004
    def disable(self, quiet=True):
587
1005
        """Disable this client."""
588
1006
        if not getattr(self, "enabled", False):
590
1008
        if not quiet:
591
1009
            logger.info("Disabling client %s", self.name)
592
1010
        if getattr(self, "disable_initiator_tag", None) is not None:
593
 
            gobject.source_remove(self.disable_initiator_tag)
 
1011
            GLib.source_remove(self.disable_initiator_tag)
594
1012
            self.disable_initiator_tag = None
595
1013
        self.expires = None
596
1014
        if getattr(self, "checker_initiator_tag", None) is not None:
597
 
            gobject.source_remove(self.checker_initiator_tag)
 
1015
            GLib.source_remove(self.checker_initiator_tag)
598
1016
            self.checker_initiator_tag = None
599
1017
        self.stop_checker()
600
1018
        self.enabled = False
601
1019
        if not quiet:
602
1020
            self.send_changedstate()
603
 
        # Do not run this again if called by a gobject.timeout_add
 
1021
        # Do not run this again if called by a GLib.timeout_add
604
1022
        return False
605
 
    
 
1023
 
606
1024
    def __del__(self):
607
1025
        self.disable()
608
 
    
 
1026
 
609
1027
    def init_checker(self):
610
1028
        # Schedule a new checker to be started an 'interval' from now,
611
1029
        # and every interval from then on.
612
1030
        if self.checker_initiator_tag is not None:
613
 
            gobject.source_remove(self.checker_initiator_tag)
614
 
        self.checker_initiator_tag = (gobject.timeout_add
615
 
                                      (self.interval_milliseconds(),
616
 
                                       self.start_checker))
 
1031
            GLib.source_remove(self.checker_initiator_tag)
 
1032
        self.checker_initiator_tag = GLib.timeout_add(
 
1033
            int(self.interval.total_seconds() * 1000),
 
1034
            self.start_checker)
617
1035
        # Schedule a disable() when 'timeout' has passed
618
1036
        if self.disable_initiator_tag is not None:
619
 
            gobject.source_remove(self.disable_initiator_tag)
620
 
        self.disable_initiator_tag = (gobject.timeout_add
621
 
                                   (self.timeout_milliseconds(),
622
 
                                    self.disable))
 
1037
            GLib.source_remove(self.disable_initiator_tag)
 
1038
        self.disable_initiator_tag = GLib.timeout_add(
 
1039
            int(self.timeout.total_seconds() * 1000), self.disable)
623
1040
        # Also start a new checker *right now*.
624
1041
        self.start_checker()
625
 
    
626
 
    def checker_callback(self, pid, condition, command):
 
1042
 
 
1043
    def checker_callback(self, source, condition, connection,
 
1044
                         command):
627
1045
        """The checker has completed, so take appropriate actions."""
 
1046
        # Read return code from connection (see call_pipe)
 
1047
        returncode = connection.recv()
 
1048
        connection.close()
 
1049
        self.checker.join()
628
1050
        self.checker_callback_tag = None
629
1051
        self.checker = None
630
 
        if os.WIFEXITED(condition):
631
 
            self.last_checker_status = os.WEXITSTATUS(condition)
 
1052
 
 
1053
        if returncode >= 0:
 
1054
            self.last_checker_status = returncode
 
1055
            self.last_checker_signal = None
632
1056
            if self.last_checker_status == 0:
633
1057
                logger.info("Checker for %(name)s succeeded",
634
1058
                            vars(self))
635
1059
                self.checked_ok()
636
1060
            else:
637
 
                logger.info("Checker for %(name)s failed",
638
 
                            vars(self))
 
1061
                logger.info("Checker for %(name)s failed", vars(self))
639
1062
        else:
640
1063
            self.last_checker_status = -1
 
1064
            self.last_checker_signal = -returncode
641
1065
            logger.warning("Checker for %(name)s crashed?",
642
1066
                           vars(self))
643
 
    
 
1067
        return False
 
1068
 
644
1069
    def checked_ok(self):
645
1070
        """Assert that the client has been seen, alive and well."""
646
1071
        self.last_checked_ok = datetime.datetime.utcnow()
647
1072
        self.last_checker_status = 0
 
1073
        self.last_checker_signal = None
648
1074
        self.bump_timeout()
649
 
    
 
1075
 
650
1076
    def bump_timeout(self, timeout=None):
651
1077
        """Bump up the timeout for this client."""
652
1078
        if timeout is None:
653
1079
            timeout = self.timeout
654
1080
        if self.disable_initiator_tag is not None:
655
 
            gobject.source_remove(self.disable_initiator_tag)
 
1081
            GLib.source_remove(self.disable_initiator_tag)
656
1082
            self.disable_initiator_tag = None
657
1083
        if getattr(self, "enabled", False):
658
 
            self.disable_initiator_tag = (gobject.timeout_add
659
 
                                          (timedelta_to_milliseconds
660
 
                                           (timeout), self.disable))
 
1084
            self.disable_initiator_tag = GLib.timeout_add(
 
1085
                int(timeout.total_seconds() * 1000), self.disable)
661
1086
            self.expires = datetime.datetime.utcnow() + timeout
662
 
    
 
1087
 
663
1088
    def need_approval(self):
664
1089
        self.last_approval_request = datetime.datetime.utcnow()
665
 
    
 
1090
 
666
1091
    def start_checker(self):
667
1092
        """Start a new checker subprocess if one is not running.
668
 
        
 
1093
 
669
1094
        If a checker already exists, leave it running and do
670
1095
        nothing."""
671
1096
        # The reason for not killing a running checker is that if we
676
1101
        # checkers alone, the checker would have to take more time
677
1102
        # than 'timeout' for the client to be disabled, which is as it
678
1103
        # should be.
679
 
        
680
 
        # If a checker exists, make sure it is not a zombie
681
 
        try:
682
 
            pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
683
 
        except (AttributeError, OSError) as error:
684
 
            if (isinstance(error, OSError)
685
 
                and error.errno != errno.ECHILD):
686
 
                raise error
687
 
        else:
688
 
            if pid:
689
 
                logger.warning("Checker was a zombie")
690
 
                gobject.source_remove(self.checker_callback_tag)
691
 
                self.checker_callback(pid, status,
692
 
                                      self.current_checker_command)
 
1104
 
 
1105
        if self.checker is not None and not self.checker.is_alive():
 
1106
            logger.warning("Checker was not alive; joining")
 
1107
            self.checker.join()
 
1108
            self.checker = None
693
1109
        # Start a new checker if needed
694
1110
        if self.checker is None:
695
1111
            # Escape attributes for the shell
696
 
            escaped_attrs = dict(
697
 
                (attr, re.escape(unicode(getattr(self, attr))))
698
 
                for attr in
699
 
                self.runtime_expansions)
 
1112
            escaped_attrs = {
 
1113
                attr: re.escape(str(getattr(self, attr)))
 
1114
                for attr in self.runtime_expansions}
700
1115
            try:
701
1116
                command = self.checker_command % escaped_attrs
702
1117
            except TypeError as error:
703
1118
                logger.error('Could not format string "%s"',
704
 
                             self.checker_command, exc_info=error)
705
 
                return True # Try again later
 
1119
                             self.checker_command,
 
1120
                             exc_info=error)
 
1121
                return True     # Try again later
706
1122
            self.current_checker_command = command
707
 
            try:
708
 
                logger.info("Starting checker %r for %s",
709
 
                            command, self.name)
710
 
                # We don't need to redirect stdout and stderr, since
711
 
                # in normal mode, that is already done by daemon(),
712
 
                # and in debug mode we don't want to.  (Stdin is
713
 
                # always replaced by /dev/null.)
714
 
                self.checker = subprocess.Popen(command,
715
 
                                                close_fds=True,
716
 
                                                shell=True, cwd="/")
717
 
            except OSError as error:
718
 
                logger.error("Failed to start subprocess",
719
 
                             exc_info=error)
720
 
                return True
721
 
            self.checker_callback_tag = (gobject.child_watch_add
722
 
                                         (self.checker.pid,
723
 
                                          self.checker_callback,
724
 
                                          data=command))
725
 
            # The checker may have completed before the gobject
726
 
            # watch was added.  Check for this.
727
 
            try:
728
 
                pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
729
 
            except OSError as error:
730
 
                if error.errno == errno.ECHILD:
731
 
                    # This should never happen
732
 
                    logger.error("Child process vanished",
733
 
                                 exc_info=error)
734
 
                    return True
735
 
                raise
736
 
            if pid:
737
 
                gobject.source_remove(self.checker_callback_tag)
738
 
                self.checker_callback(pid, status, command)
739
 
        # Re-run this periodically if run by gobject.timeout_add
 
1123
            logger.info("Starting checker %r for %s", command,
 
1124
                        self.name)
 
1125
            # We don't need to redirect stdout and stderr, since
 
1126
            # in normal mode, that is already done by daemon(),
 
1127
            # and in debug mode we don't want to.  (Stdin is
 
1128
            # always replaced by /dev/null.)
 
1129
            # The exception is when not debugging but nevertheless
 
1130
            # running in the foreground; use the previously
 
1131
            # created wnull.
 
1132
            popen_args = {"close_fds": True,
 
1133
                          "shell": True,
 
1134
                          "cwd": "/"}
 
1135
            if (not self.server_settings["debug"]
 
1136
                and self.server_settings["foreground"]):
 
1137
                popen_args.update({"stdout": wnull,
 
1138
                                   "stderr": wnull})
 
1139
            pipe = multiprocessing.Pipe(duplex=False)
 
1140
            self.checker = multiprocessing.Process(
 
1141
                target=call_pipe,
 
1142
                args=(pipe[1], subprocess.call, command),
 
1143
                kwargs=popen_args)
 
1144
            self.checker.start()
 
1145
            self.checker_callback_tag = GLib.io_add_watch(
 
1146
                pipe[0].fileno(), GLib.IO_IN,
 
1147
                self.checker_callback, pipe[0], command)
 
1148
        # Re-run this periodically if run by GLib.timeout_add
740
1149
        return True
741
 
    
 
1150
 
742
1151
    def stop_checker(self):
743
1152
        """Force the checker process, if any, to stop."""
744
1153
        if self.checker_callback_tag:
745
 
            gobject.source_remove(self.checker_callback_tag)
 
1154
            GLib.source_remove(self.checker_callback_tag)
746
1155
            self.checker_callback_tag = None
747
1156
        if getattr(self, "checker", None) is None:
748
1157
            return
749
1158
        logger.debug("Stopping checker for %(name)s", vars(self))
750
 
        try:
751
 
            self.checker.terminate()
752
 
            #time.sleep(0.5)
753
 
            #if self.checker.poll() is None:
754
 
            #    self.checker.kill()
755
 
        except OSError as error:
756
 
            if error.errno != errno.ESRCH: # No such process
757
 
                raise
 
1159
        self.checker.terminate()
758
1160
        self.checker = None
759
1161
 
760
1162
 
761
 
def dbus_service_property(dbus_interface, signature="v",
762
 
                          access="readwrite", byte_arrays=False):
 
1163
def dbus_service_property(dbus_interface,
 
1164
                          signature="v",
 
1165
                          access="readwrite",
 
1166
                          byte_arrays=False):
763
1167
    """Decorators for marking methods of a DBusObjectWithProperties to
764
1168
    become properties on the D-Bus.
765
 
    
 
1169
 
766
1170
    The decorated method will be called with no arguments by "Get"
767
1171
    and with one argument by "Set".
768
 
    
 
1172
 
769
1173
    The parameters, where they are supported, are the same as
770
1174
    dbus.service.method, except there is only "signature", since the
771
1175
    type from Get() and the type sent to Set() is the same.
774
1178
    # "Set" method, so we fail early here:
775
1179
    if byte_arrays and signature != "ay":
776
1180
        raise ValueError("Byte arrays not supported for non-'ay'"
777
 
                         " signature {0!r}".format(signature))
 
1181
                         " signature {!r}".format(signature))
 
1182
 
778
1183
    def decorator(func):
779
1184
        func._dbus_is_property = True
780
1185
        func._dbus_interface = dbus_interface
783
1188
        func._dbus_name = func.__name__
784
1189
        if func._dbus_name.endswith("_dbus_property"):
785
1190
            func._dbus_name = func._dbus_name[:-14]
786
 
        func._dbus_get_args_options = {'byte_arrays': byte_arrays }
 
1191
        func._dbus_get_args_options = {'byte_arrays': byte_arrays}
787
1192
        return func
 
1193
 
788
1194
    return decorator
789
1195
 
790
1196
 
791
1197
def dbus_interface_annotations(dbus_interface):
792
1198
    """Decorator for marking functions returning interface annotations
793
 
    
 
1199
 
794
1200
    Usage:
795
 
    
 
1201
 
796
1202
    @dbus_interface_annotations("org.example.Interface")
797
1203
    def _foo(self):  # Function name does not matter
798
1204
        return {"org.freedesktop.DBus.Deprecated": "true",
799
1205
                "org.freedesktop.DBus.Property.EmitsChangedSignal":
800
1206
                    "false"}
801
1207
    """
 
1208
 
802
1209
    def decorator(func):
803
1210
        func._dbus_is_interface = True
804
1211
        func._dbus_interface = dbus_interface
805
1212
        func._dbus_name = dbus_interface
806
1213
        return func
 
1214
 
807
1215
    return decorator
808
1216
 
809
1217
 
810
1218
def dbus_annotations(annotations):
811
1219
    """Decorator to annotate D-Bus methods, signals or properties
812
1220
    Usage:
813
 
    
 
1221
 
 
1222
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",
 
1223
                       "org.freedesktop.DBus.Property."
 
1224
                       "EmitsChangedSignal": "false"})
814
1225
    @dbus_service_property("org.example.Interface", signature="b",
815
1226
                           access="r")
816
 
    @dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",
817
 
                        "org.freedesktop.DBus.Property."
818
 
                        "EmitsChangedSignal": "false"})
819
1227
    def Property_dbus_property(self):
820
1228
        return dbus.Boolean(False)
 
1229
 
 
1230
    See also the DBusObjectWithAnnotations class.
821
1231
    """
 
1232
 
822
1233
    def decorator(func):
823
1234
        func._dbus_annotations = annotations
824
1235
        return func
 
1236
 
825
1237
    return decorator
826
1238
 
827
1239
 
828
1240
class DBusPropertyException(dbus.exceptions.DBusException):
829
1241
    """A base class for D-Bus property-related exceptions
830
1242
    """
831
 
    def __unicode__(self):
832
 
        return unicode(str(self))
 
1243
    pass
833
1244
 
834
1245
 
835
1246
class DBusPropertyAccessException(DBusPropertyException):
844
1255
    pass
845
1256
 
846
1257
 
847
 
class DBusObjectWithProperties(dbus.service.Object):
848
 
    """A D-Bus object with properties.
849
 
    
850
 
    Classes inheriting from this can use the dbus_service_property
851
 
    decorator to expose methods as D-Bus properties.  It exposes the
852
 
    standard Get(), Set(), and GetAll() methods on the D-Bus.
 
1258
class DBusObjectWithAnnotations(dbus.service.Object):
 
1259
    """A D-Bus object with annotations.
 
1260
 
 
1261
    Classes inheriting from this can use the dbus_annotations
 
1262
    decorator to add annotations to methods or signals.
853
1263
    """
854
 
    
 
1264
 
855
1265
    @staticmethod
856
1266
    def _is_dbus_thing(thing):
857
1267
        """Returns a function testing if an attribute is a D-Bus thing
858
 
        
 
1268
 
859
1269
        If called like _is_dbus_thing("method") it returns a function
860
1270
        suitable for use as predicate to inspect.getmembers().
861
1271
        """
862
 
        return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),
 
1272
        return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
863
1273
                                   False)
864
 
    
 
1274
 
865
1275
    def _get_all_dbus_things(self, thing):
866
1276
        """Returns a generator of (name, attribute) pairs
867
1277
        """
868
 
        return ((getattr(athing.__get__(self), "_dbus_name",
869
 
                         name),
 
1278
        return ((getattr(athing.__get__(self), "_dbus_name", name),
870
1279
                 athing.__get__(self))
871
1280
                for cls in self.__class__.__mro__
872
1281
                for name, athing in
873
 
                inspect.getmembers(cls,
874
 
                                   self._is_dbus_thing(thing)))
875
 
    
 
1282
                inspect.getmembers(cls, self._is_dbus_thing(thing)))
 
1283
 
 
1284
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
 
1285
                         out_signature="s",
 
1286
                         path_keyword='object_path',
 
1287
                         connection_keyword='connection')
 
1288
    def Introspect(self, object_path, connection):
 
1289
        """Overloading of standard D-Bus method.
 
1290
 
 
1291
        Inserts annotation tags on methods and signals.
 
1292
        """
 
1293
        xmlstring = dbus.service.Object.Introspect(self, object_path,
 
1294
                                                   connection)
 
1295
        try:
 
1296
            document = xml.dom.minidom.parseString(xmlstring)
 
1297
 
 
1298
            for if_tag in document.getElementsByTagName("interface"):
 
1299
                # Add annotation tags
 
1300
                for typ in ("method", "signal"):
 
1301
                    for tag in if_tag.getElementsByTagName(typ):
 
1302
                        annots = dict()
 
1303
                        for name, prop in (self.
 
1304
                                           _get_all_dbus_things(typ)):
 
1305
                            if (name == tag.getAttribute("name")
 
1306
                                and prop._dbus_interface
 
1307
                                == if_tag.getAttribute("name")):
 
1308
                                annots.update(getattr(
 
1309
                                    prop, "_dbus_annotations", {}))
 
1310
                        for name, value in annots.items():
 
1311
                            ann_tag = document.createElement(
 
1312
                                "annotation")
 
1313
                            ann_tag.setAttribute("name", name)
 
1314
                            ann_tag.setAttribute("value", value)
 
1315
                            tag.appendChild(ann_tag)
 
1316
                # Add interface annotation tags
 
1317
                for annotation, value in dict(
 
1318
                    itertools.chain.from_iterable(
 
1319
                        annotations().items()
 
1320
                        for name, annotations
 
1321
                        in self._get_all_dbus_things("interface")
 
1322
                        if name == if_tag.getAttribute("name")
 
1323
                        )).items():
 
1324
                    ann_tag = document.createElement("annotation")
 
1325
                    ann_tag.setAttribute("name", annotation)
 
1326
                    ann_tag.setAttribute("value", value)
 
1327
                    if_tag.appendChild(ann_tag)
 
1328
                # Fix argument name for the Introspect method itself
 
1329
                if (if_tag.getAttribute("name")
 
1330
                    == dbus.INTROSPECTABLE_IFACE):
 
1331
                    for cn in if_tag.getElementsByTagName("method"):
 
1332
                        if cn.getAttribute("name") == "Introspect":
 
1333
                            for arg in cn.getElementsByTagName("arg"):
 
1334
                                if (arg.getAttribute("direction")
 
1335
                                    == "out"):
 
1336
                                    arg.setAttribute("name",
 
1337
                                                     "xml_data")
 
1338
            xmlstring = document.toxml("utf-8")
 
1339
            document.unlink()
 
1340
        except (AttributeError, xml.dom.DOMException,
 
1341
                xml.parsers.expat.ExpatError) as error:
 
1342
            logger.error("Failed to override Introspection method",
 
1343
                         exc_info=error)
 
1344
        return xmlstring
 
1345
 
 
1346
 
 
1347
class DBusObjectWithProperties(DBusObjectWithAnnotations):
 
1348
    """A D-Bus object with properties.
 
1349
 
 
1350
    Classes inheriting from this can use the dbus_service_property
 
1351
    decorator to expose methods as D-Bus properties.  It exposes the
 
1352
    standard Get(), Set(), and GetAll() methods on the D-Bus.
 
1353
    """
 
1354
 
876
1355
    def _get_dbus_property(self, interface_name, property_name):
877
1356
        """Returns a bound method if one exists which is a D-Bus
878
1357
        property with the specified name and interface.
879
1358
        """
880
 
        for cls in  self.__class__.__mro__:
881
 
            for name, value in (inspect.getmembers
882
 
                                (cls,
883
 
                                 self._is_dbus_thing("property"))):
 
1359
        for cls in self.__class__.__mro__:
 
1360
            for name, value in inspect.getmembers(
 
1361
                    cls, self._is_dbus_thing("property")):
884
1362
                if (value._dbus_name == property_name
885
1363
                    and value._dbus_interface == interface_name):
886
1364
                    return value.__get__(self)
887
 
        
 
1365
 
888
1366
        # No such property
889
 
        raise DBusPropertyNotFound(self.dbus_object_path + ":"
890
 
                                   + interface_name + "."
891
 
                                   + property_name)
892
 
    
893
 
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
 
1367
        raise DBusPropertyNotFound("{}:{}.{}".format(
 
1368
            self.dbus_object_path, interface_name, property_name))
 
1369
 
 
1370
    @classmethod
 
1371
    def _get_all_interface_names(cls):
 
1372
        """Get a sequence of all interfaces supported by an object"""
 
1373
        return (name for name in set(getattr(getattr(x, attr),
 
1374
                                             "_dbus_interface", None)
 
1375
                                     for x in (inspect.getmro(cls))
 
1376
                                     for attr in dir(x))
 
1377
                if name is not None)
 
1378
 
 
1379
    @dbus.service.method(dbus.PROPERTIES_IFACE,
 
1380
                         in_signature="ss",
894
1381
                         out_signature="v")
895
1382
    def Get(self, interface_name, property_name):
896
1383
        """Standard D-Bus property Get() method, see D-Bus standard.
902
1389
        if not hasattr(value, "variant_level"):
903
1390
            return value
904
1391
        return type(value)(value, variant_level=value.variant_level+1)
905
 
    
 
1392
 
906
1393
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
907
1394
    def Set(self, interface_name, property_name, value):
908
1395
        """Standard D-Bus property Set() method, see D-Bus standard.
914
1401
            # The byte_arrays option is not supported yet on
915
1402
            # signatures other than "ay".
916
1403
            if prop._dbus_signature != "ay":
917
 
                raise ValueError
 
1404
                raise ValueError("Byte arrays not supported for non-"
 
1405
                                 "'ay' signature {!r}"
 
1406
                                 .format(prop._dbus_signature))
918
1407
            value = dbus.ByteArray(b''.join(chr(byte)
919
1408
                                            for byte in value))
920
1409
        prop(value)
921
 
    
922
 
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
 
1410
 
 
1411
    @dbus.service.method(dbus.PROPERTIES_IFACE,
 
1412
                         in_signature="s",
923
1413
                         out_signature="a{sv}")
924
1414
    def GetAll(self, interface_name):
925
1415
        """Standard D-Bus property GetAll() method, see D-Bus
926
1416
        standard.
927
 
        
 
1417
 
928
1418
        Note: Will not include properties with access="write".
929
1419
        """
930
1420
        properties = {}
940
1430
            if not hasattr(value, "variant_level"):
941
1431
                properties[name] = value
942
1432
                continue
943
 
            properties[name] = type(value)(value, variant_level=
944
 
                                           value.variant_level+1)
 
1433
            properties[name] = type(value)(
 
1434
                value, variant_level=value.variant_level + 1)
945
1435
        return dbus.Dictionary(properties, signature="sv")
946
 
    
 
1436
 
 
1437
    @dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")
 
1438
    def PropertiesChanged(self, interface_name, changed_properties,
 
1439
                          invalidated_properties):
 
1440
        """Standard D-Bus PropertiesChanged() signal, see D-Bus
 
1441
        standard.
 
1442
        """
 
1443
        pass
 
1444
 
947
1445
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
948
1446
                         out_signature="s",
949
1447
                         path_keyword='object_path',
950
1448
                         connection_keyword='connection')
951
1449
    def Introspect(self, object_path, connection):
952
1450
        """Overloading of standard D-Bus method.
953
 
        
 
1451
 
954
1452
        Inserts property tags and interface annotation tags.
955
1453
        """
956
 
        xmlstring = dbus.service.Object.Introspect(self, object_path,
957
 
                                                   connection)
 
1454
        xmlstring = DBusObjectWithAnnotations.Introspect(self,
 
1455
                                                         object_path,
 
1456
                                                         connection)
958
1457
        try:
959
1458
            document = xml.dom.minidom.parseString(xmlstring)
 
1459
 
960
1460
            def make_tag(document, name, prop):
961
1461
                e = document.createElement("property")
962
1462
                e.setAttribute("name", name)
963
1463
                e.setAttribute("type", prop._dbus_signature)
964
1464
                e.setAttribute("access", prop._dbus_access)
965
1465
                return e
 
1466
 
966
1467
            for if_tag in document.getElementsByTagName("interface"):
967
1468
                # Add property tags
968
1469
                for tag in (make_tag(document, name, prop)
971
1472
                            if prop._dbus_interface
972
1473
                            == if_tag.getAttribute("name")):
973
1474
                    if_tag.appendChild(tag)
974
 
                # Add annotation tags
975
 
                for typ in ("method", "signal", "property"):
976
 
                    for tag in if_tag.getElementsByTagName(typ):
977
 
                        annots = dict()
978
 
                        for name, prop in (self.
979
 
                                           _get_all_dbus_things(typ)):
980
 
                            if (name == tag.getAttribute("name")
981
 
                                and prop._dbus_interface
982
 
                                == if_tag.getAttribute("name")):
983
 
                                annots.update(getattr
984
 
                                              (prop,
985
 
                                               "_dbus_annotations",
986
 
                                               {}))
987
 
                        for name, value in annots.iteritems():
988
 
                            ann_tag = document.createElement(
989
 
                                "annotation")
990
 
                            ann_tag.setAttribute("name", name)
991
 
                            ann_tag.setAttribute("value", value)
992
 
                            tag.appendChild(ann_tag)
993
 
                # Add interface annotation tags
994
 
                for annotation, value in dict(
995
 
                    itertools.chain.from_iterable(
996
 
                        annotations().iteritems()
997
 
                        for name, annotations in
998
 
                        self._get_all_dbus_things("interface")
999
 
                        if name == if_tag.getAttribute("name")
1000
 
                        )).iteritems():
1001
 
                    ann_tag = document.createElement("annotation")
1002
 
                    ann_tag.setAttribute("name", annotation)
1003
 
                    ann_tag.setAttribute("value", value)
1004
 
                    if_tag.appendChild(ann_tag)
 
1475
                # Add annotation tags for properties
 
1476
                for tag in if_tag.getElementsByTagName("property"):
 
1477
                    annots = dict()
 
1478
                    for name, prop in self._get_all_dbus_things(
 
1479
                            "property"):
 
1480
                        if (name == tag.getAttribute("name")
 
1481
                            and prop._dbus_interface
 
1482
                            == if_tag.getAttribute("name")):
 
1483
                            annots.update(getattr(
 
1484
                                prop, "_dbus_annotations", {}))
 
1485
                    for name, value in annots.items():
 
1486
                        ann_tag = document.createElement(
 
1487
                            "annotation")
 
1488
                        ann_tag.setAttribute("name", name)
 
1489
                        ann_tag.setAttribute("value", value)
 
1490
                        tag.appendChild(ann_tag)
1005
1491
                # Add the names to the return values for the
1006
1492
                # "org.freedesktop.DBus.Properties" methods
1007
1493
                if (if_tag.getAttribute("name")
1026
1512
        return xmlstring
1027
1513
 
1028
1514
 
 
1515
try:
 
1516
    dbus.OBJECT_MANAGER_IFACE
 
1517
except AttributeError:
 
1518
    dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
 
1519
 
 
1520
 
 
1521
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
 
1522
    """A D-Bus object with an ObjectManager.
 
1523
 
 
1524
    Classes inheriting from this exposes the standard
 
1525
    GetManagedObjects call and the InterfacesAdded and
 
1526
    InterfacesRemoved signals on the standard
 
1527
    "org.freedesktop.DBus.ObjectManager" interface.
 
1528
 
 
1529
    Note: No signals are sent automatically; they must be sent
 
1530
    manually.
 
1531
    """
 
1532
    @dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
 
1533
                         out_signature="a{oa{sa{sv}}}")
 
1534
    def GetManagedObjects(self):
 
1535
        """This function must be overridden"""
 
1536
        raise NotImplementedError()
 
1537
 
 
1538
    @dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
 
1539
                         signature="oa{sa{sv}}")
 
1540
    def InterfacesAdded(self, object_path, interfaces_and_properties):
 
1541
        pass
 
1542
 
 
1543
    @dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature="oas")
 
1544
    def InterfacesRemoved(self, object_path, interfaces):
 
1545
        pass
 
1546
 
 
1547
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
 
1548
                         out_signature="s",
 
1549
                         path_keyword='object_path',
 
1550
                         connection_keyword='connection')
 
1551
    def Introspect(self, object_path, connection):
 
1552
        """Overloading of standard D-Bus method.
 
1553
 
 
1554
        Override return argument name of GetManagedObjects to be
 
1555
        "objpath_interfaces_and_properties"
 
1556
        """
 
1557
        xmlstring = DBusObjectWithAnnotations.Introspect(self,
 
1558
                                                         object_path,
 
1559
                                                         connection)
 
1560
        try:
 
1561
            document = xml.dom.minidom.parseString(xmlstring)
 
1562
 
 
1563
            for if_tag in document.getElementsByTagName("interface"):
 
1564
                # Fix argument name for the GetManagedObjects method
 
1565
                if (if_tag.getAttribute("name")
 
1566
                    == dbus.OBJECT_MANAGER_IFACE):
 
1567
                    for cn in if_tag.getElementsByTagName("method"):
 
1568
                        if (cn.getAttribute("name")
 
1569
                            == "GetManagedObjects"):
 
1570
                            for arg in cn.getElementsByTagName("arg"):
 
1571
                                if (arg.getAttribute("direction")
 
1572
                                    == "out"):
 
1573
                                    arg.setAttribute(
 
1574
                                        "name",
 
1575
                                        "objpath_interfaces"
 
1576
                                        "_and_properties")
 
1577
            xmlstring = document.toxml("utf-8")
 
1578
            document.unlink()
 
1579
        except (AttributeError, xml.dom.DOMException,
 
1580
                xml.parsers.expat.ExpatError) as error:
 
1581
            logger.error("Failed to override Introspection method",
 
1582
                         exc_info=error)
 
1583
        return xmlstring
 
1584
 
 
1585
 
1029
1586
def datetime_to_dbus(dt, variant_level=0):
1030
1587
    """Convert a UTC datetime.datetime() to a D-Bus type."""
1031
1588
    if dt is None:
1032
 
        return dbus.String("", variant_level = variant_level)
1033
 
    return dbus.String(dt.isoformat(),
1034
 
                       variant_level=variant_level)
 
1589
        return dbus.String("", variant_level=variant_level)
 
1590
    return dbus.String(dt.isoformat(), variant_level=variant_level)
1035
1591
 
1036
1592
 
1037
1593
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
1039
1595
    dbus.service.Object, it will add alternate D-Bus attributes with
1040
1596
    interface names according to the "alt_interface_names" mapping.
1041
1597
    Usage:
1042
 
    
 
1598
 
1043
1599
    @alternate_dbus_interfaces({"org.example.Interface":
1044
1600
                                    "net.example.AlternateInterface"})
1045
1601
    class SampleDBusObject(dbus.service.Object):
1046
1602
        @dbus.service.method("org.example.Interface")
1047
1603
        def SampleDBusMethod():
1048
1604
            pass
1049
 
    
 
1605
 
1050
1606
    The above "SampleDBusMethod" on "SampleDBusObject" will be
1051
1607
    reachable via two interfaces: "org.example.Interface" and
1052
1608
    "net.example.AlternateInterface", the latter of which will have
1053
1609
    its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
1054
1610
    "true", unless "deprecate" is passed with a False value.
1055
 
    
 
1611
 
1056
1612
    This works for methods and signals, and also for D-Bus properties
1057
1613
    (from DBusObjectWithProperties) and interfaces (from the
1058
1614
    dbus_interface_annotations decorator).
1059
1615
    """
 
1616
 
1060
1617
    def wrapper(cls):
1061
1618
        for orig_interface_name, alt_interface_name in (
1062
 
            alt_interface_names.iteritems()):
 
1619
                alt_interface_names.items()):
1063
1620
            attr = {}
1064
1621
            interface_names = set()
1065
1622
            # Go though all attributes of the class
1067
1624
                # Ignore non-D-Bus attributes, and D-Bus attributes
1068
1625
                # with the wrong interface name
1069
1626
                if (not hasattr(attribute, "_dbus_interface")
1070
 
                    or not attribute._dbus_interface
1071
 
                    .startswith(orig_interface_name)):
 
1627
                    or not attribute._dbus_interface.startswith(
 
1628
                        orig_interface_name)):
1072
1629
                    continue
1073
1630
                # Create an alternate D-Bus interface name based on
1074
1631
                # the current name
1075
 
                alt_interface = (attribute._dbus_interface
1076
 
                                 .replace(orig_interface_name,
1077
 
                                          alt_interface_name))
 
1632
                alt_interface = attribute._dbus_interface.replace(
 
1633
                    orig_interface_name, alt_interface_name)
1078
1634
                interface_names.add(alt_interface)
1079
1635
                # Is this a D-Bus signal?
1080
1636
                if getattr(attribute, "_dbus_is_signal", False):
1081
1637
                    # Extract the original non-method undecorated
1082
1638
                    # function by black magic
1083
 
                    nonmethod_func = (dict(
 
1639
                    if sys.version_info.major == 2:
 
1640
                        nonmethod_func = (dict(
1084
1641
                            zip(attribute.func_code.co_freevars,
1085
 
                                attribute.__closure__))["func"]
1086
 
                                      .cell_contents)
 
1642
                                attribute.__closure__))
 
1643
                                          ["func"].cell_contents)
 
1644
                    else:
 
1645
                        nonmethod_func = (dict(
 
1646
                            zip(attribute.__code__.co_freevars,
 
1647
                                attribute.__closure__))
 
1648
                                          ["func"].cell_contents)
1087
1649
                    # Create a new, but exactly alike, function
1088
1650
                    # object, and decorate it to be a new D-Bus signal
1089
1651
                    # with the alternate D-Bus interface name
1090
 
                    new_function = (dbus.service.signal
1091
 
                                    (alt_interface,
1092
 
                                     attribute._dbus_signature)
1093
 
                                    (types.FunctionType(
1094
 
                                nonmethod_func.func_code,
1095
 
                                nonmethod_func.func_globals,
1096
 
                                nonmethod_func.func_name,
1097
 
                                nonmethod_func.func_defaults,
1098
 
                                nonmethod_func.func_closure)))
 
1652
                    new_function = copy_function(nonmethod_func)
 
1653
                    new_function = (dbus.service.signal(
 
1654
                        alt_interface,
 
1655
                        attribute._dbus_signature)(new_function))
1099
1656
                    # Copy annotations, if any
1100
1657
                    try:
1101
 
                        new_function._dbus_annotations = (
1102
 
                            dict(attribute._dbus_annotations))
 
1658
                        new_function._dbus_annotations = dict(
 
1659
                            attribute._dbus_annotations)
1103
1660
                    except AttributeError:
1104
1661
                        pass
 
1662
 
1105
1663
                    # Define a creator of a function to call both the
1106
1664
                    # original and alternate functions, so both the
1107
1665
                    # original and alternate signals gets sent when
1110
1668
                        """This function is a scope container to pass
1111
1669
                        func1 and func2 to the "call_both" function
1112
1670
                        outside of its arguments"""
 
1671
 
 
1672
                        @functools.wraps(func2)
1113
1673
                        def call_both(*args, **kwargs):
1114
1674
                            """This function will emit two D-Bus
1115
1675
                            signals by calling func1 and func2"""
1116
1676
                            func1(*args, **kwargs)
1117
1677
                            func2(*args, **kwargs)
 
1678
                        # Make wrapper function look like a D-Bus
 
1679
                        # signal
 
1680
                        for name, attr in inspect.getmembers(func2):
 
1681
                            if name.startswith("_dbus_"):
 
1682
                                setattr(call_both, name, attr)
 
1683
 
1118
1684
                        return call_both
1119
1685
                    # Create the "call_both" function and add it to
1120
1686
                    # the class
1125
1691
                    # object.  Decorate it to be a new D-Bus method
1126
1692
                    # with the alternate D-Bus interface name.  Add it
1127
1693
                    # to the class.
1128
 
                    attr[attrname] = (dbus.service.method
1129
 
                                      (alt_interface,
1130
 
                                       attribute._dbus_in_signature,
1131
 
                                       attribute._dbus_out_signature)
1132
 
                                      (types.FunctionType
1133
 
                                       (attribute.func_code,
1134
 
                                        attribute.func_globals,
1135
 
                                        attribute.func_name,
1136
 
                                        attribute.func_defaults,
1137
 
                                        attribute.func_closure)))
 
1694
                    attr[attrname] = (
 
1695
                        dbus.service.method(
 
1696
                            alt_interface,
 
1697
                            attribute._dbus_in_signature,
 
1698
                            attribute._dbus_out_signature)
 
1699
                        (copy_function(attribute)))
1138
1700
                    # Copy annotations, if any
1139
1701
                    try:
1140
 
                        attr[attrname]._dbus_annotations = (
1141
 
                            dict(attribute._dbus_annotations))
 
1702
                        attr[attrname]._dbus_annotations = dict(
 
1703
                            attribute._dbus_annotations)
1142
1704
                    except AttributeError:
1143
1705
                        pass
1144
1706
                # Is this a D-Bus property?
1147
1709
                    # object, and decorate it to be a new D-Bus
1148
1710
                    # property with the alternate D-Bus interface
1149
1711
                    # name.  Add it to the class.
1150
 
                    attr[attrname] = (dbus_service_property
1151
 
                                      (alt_interface,
1152
 
                                       attribute._dbus_signature,
1153
 
                                       attribute._dbus_access,
1154
 
                                       attribute
1155
 
                                       ._dbus_get_args_options
1156
 
                                       ["byte_arrays"])
1157
 
                                      (types.FunctionType
1158
 
                                       (attribute.func_code,
1159
 
                                        attribute.func_globals,
1160
 
                                        attribute.func_name,
1161
 
                                        attribute.func_defaults,
1162
 
                                        attribute.func_closure)))
 
1712
                    attr[attrname] = (dbus_service_property(
 
1713
                        alt_interface, attribute._dbus_signature,
 
1714
                        attribute._dbus_access,
 
1715
                        attribute._dbus_get_args_options
 
1716
                        ["byte_arrays"])
 
1717
                                      (copy_function(attribute)))
1163
1718
                    # Copy annotations, if any
1164
1719
                    try:
1165
 
                        attr[attrname]._dbus_annotations = (
1166
 
                            dict(attribute._dbus_annotations))
 
1720
                        attr[attrname]._dbus_annotations = dict(
 
1721
                            attribute._dbus_annotations)
1167
1722
                    except AttributeError:
1168
1723
                        pass
1169
1724
                # Is this a D-Bus interface?
1172
1727
                    # object.  Decorate it to be a new D-Bus interface
1173
1728
                    # with the alternate D-Bus interface name.  Add it
1174
1729
                    # to the class.
1175
 
                    attr[attrname] = (dbus_interface_annotations
1176
 
                                      (alt_interface)
1177
 
                                      (types.FunctionType
1178
 
                                       (attribute.func_code,
1179
 
                                        attribute.func_globals,
1180
 
                                        attribute.func_name,
1181
 
                                        attribute.func_defaults,
1182
 
                                        attribute.func_closure)))
 
1730
                    attr[attrname] = (
 
1731
                        dbus_interface_annotations(alt_interface)
 
1732
                        (copy_function(attribute)))
1183
1733
            if deprecate:
1184
1734
                # Deprecate all alternate interfaces
1185
 
                iname="_AlternateDBusNames_interface_annotation{0}"
 
1735
                iname = "_AlternateDBusNames_interface_annotation{}"
1186
1736
                for interface_name in interface_names:
 
1737
 
1187
1738
                    @dbus_interface_annotations(interface_name)
1188
1739
                    def func(self):
1189
 
                        return { "org.freedesktop.DBus.Deprecated":
1190
 
                                     "true" }
 
1740
                        return {"org.freedesktop.DBus.Deprecated":
 
1741
                                "true"}
1191
1742
                    # Find an unused name
1192
1743
                    for aname in (iname.format(i)
1193
1744
                                  for i in itertools.count()):
1197
1748
            if interface_names:
1198
1749
                # Replace the class with a new subclass of it with
1199
1750
                # methods, signals, etc. as created above.
1200
 
                cls = type(b"{0}Alternate".format(cls.__name__),
1201
 
                           (cls,), attr)
 
1751
                if sys.version_info.major == 2:
 
1752
                    cls = type(b"{}Alternate".format(cls.__name__),
 
1753
                               (cls, ), attr)
 
1754
                else:
 
1755
                    cls = type("{}Alternate".format(cls.__name__),
 
1756
                               (cls, ), attr)
1202
1757
        return cls
 
1758
 
1203
1759
    return wrapper
1204
1760
 
1205
1761
 
1206
1762
@alternate_dbus_interfaces({"se.recompile.Mandos":
1207
 
                                "se.bsnet.fukt.Mandos"})
 
1763
                            "se.bsnet.fukt.Mandos"})
1208
1764
class ClientDBus(Client, DBusObjectWithProperties):
1209
1765
    """A Client class using D-Bus
1210
 
    
 
1766
 
1211
1767
    Attributes:
1212
1768
    dbus_object_path: dbus.ObjectPath
1213
1769
    bus: dbus.SystemBus()
1214
1770
    """
1215
 
    
 
1771
 
1216
1772
    runtime_expansions = (Client.runtime_expansions
1217
 
                          + ("dbus_object_path",))
1218
 
    
 
1773
                          + ("dbus_object_path", ))
 
1774
 
 
1775
    _interface = "se.recompile.Mandos.Client"
 
1776
 
1219
1777
    # dbus.service.Object doesn't use super(), so we can't either.
1220
 
    
1221
 
    def __init__(self, bus = None, *args, **kwargs):
 
1778
 
 
1779
    def __init__(self, bus=None, *args, **kwargs):
1222
1780
        self.bus = bus
1223
1781
        Client.__init__(self, *args, **kwargs)
1224
1782
        # Only now, when this client is initialized, can it show up on
1225
1783
        # the D-Bus
1226
 
        client_object_name = unicode(self.name).translate(
 
1784
        client_object_name = str(self.name).translate(
1227
1785
            {ord("."): ord("_"),
1228
1786
             ord("-"): ord("_")})
1229
 
        self.dbus_object_path = (dbus.ObjectPath
1230
 
                                 ("/clients/" + client_object_name))
 
1787
        self.dbus_object_path = dbus.ObjectPath(
 
1788
            "/clients/" + client_object_name)
1231
1789
        DBusObjectWithProperties.__init__(self, self.bus,
1232
1790
                                          self.dbus_object_path)
1233
 
    
1234
 
    def notifychangeproperty(transform_func,
1235
 
                             dbus_name, type_func=lambda x: x,
1236
 
                             variant_level=1):
 
1791
 
 
1792
    def notifychangeproperty(transform_func, dbus_name,
 
1793
                             type_func=lambda x: x,
 
1794
                             variant_level=1,
 
1795
                             invalidate_only=False,
 
1796
                             _interface=_interface):
1237
1797
        """ Modify a variable so that it's a property which announces
1238
1798
        its changes to DBus.
1239
 
        
 
1799
 
1240
1800
        transform_fun: Function that takes a value and a variant_level
1241
1801
                       and transforms it to a D-Bus type.
1242
1802
        dbus_name: D-Bus name of the variable
1244
1804
                   to the D-Bus.  Default: no transform
1245
1805
        variant_level: D-Bus variant level.  Default: 1
1246
1806
        """
1247
 
        attrname = "_{0}".format(dbus_name)
 
1807
        attrname = "_{}".format(dbus_name)
 
1808
 
1248
1809
        def setter(self, value):
1249
1810
            if hasattr(self, "dbus_object_path"):
1250
1811
                if (not hasattr(self, attrname) or
1251
1812
                    type_func(getattr(self, attrname, None))
1252
1813
                    != type_func(value)):
1253
 
                    dbus_value = transform_func(type_func(value),
1254
 
                                                variant_level
1255
 
                                                =variant_level)
1256
 
                    self.PropertyChanged(dbus.String(dbus_name),
1257
 
                                         dbus_value)
 
1814
                    if invalidate_only:
 
1815
                        self.PropertiesChanged(
 
1816
                            _interface, dbus.Dictionary(),
 
1817
                            dbus.Array((dbus_name, )))
 
1818
                    else:
 
1819
                        dbus_value = transform_func(
 
1820
                            type_func(value),
 
1821
                            variant_level=variant_level)
 
1822
                        self.PropertyChanged(dbus.String(dbus_name),
 
1823
                                             dbus_value)
 
1824
                        self.PropertiesChanged(
 
1825
                            _interface,
 
1826
                            dbus.Dictionary({dbus.String(dbus_name):
 
1827
                                             dbus_value}),
 
1828
                            dbus.Array())
1258
1829
            setattr(self, attrname, value)
1259
 
        
 
1830
 
1260
1831
        return property(lambda self: getattr(self, attrname), setter)
1261
 
    
 
1832
 
1262
1833
    expires = notifychangeproperty(datetime_to_dbus, "Expires")
1263
1834
    approvals_pending = notifychangeproperty(dbus.Boolean,
1264
1835
                                             "ApprovalPending",
1265
 
                                             type_func = bool)
 
1836
                                             type_func=bool)
1266
1837
    enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1267
1838
    last_enabled = notifychangeproperty(datetime_to_dbus,
1268
1839
                                        "LastEnabled")
1269
 
    checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",
1270
 
                                   type_func = lambda checker:
1271
 
                                       checker is not None)
 
1840
    checker = notifychangeproperty(
 
1841
        dbus.Boolean, "CheckerRunning",
 
1842
        type_func=lambda checker: checker is not None)
1272
1843
    last_checked_ok = notifychangeproperty(datetime_to_dbus,
1273
1844
                                           "LastCheckedOK")
1274
1845
    last_checker_status = notifychangeproperty(dbus.Int16,
1277
1848
        datetime_to_dbus, "LastApprovalRequest")
1278
1849
    approved_by_default = notifychangeproperty(dbus.Boolean,
1279
1850
                                               "ApprovedByDefault")
1280
 
    approval_delay = notifychangeproperty(dbus.UInt64,
1281
 
                                          "ApprovalDelay",
1282
 
                                          type_func =
1283
 
                                          timedelta_to_milliseconds)
 
1851
    approval_delay = notifychangeproperty(
 
1852
        dbus.UInt64, "ApprovalDelay",
 
1853
        type_func=lambda td: td.total_seconds() * 1000)
1284
1854
    approval_duration = notifychangeproperty(
1285
1855
        dbus.UInt64, "ApprovalDuration",
1286
 
        type_func = timedelta_to_milliseconds)
 
1856
        type_func=lambda td: td.total_seconds() * 1000)
1287
1857
    host = notifychangeproperty(dbus.String, "Host")
1288
 
    timeout = notifychangeproperty(dbus.UInt64, "Timeout",
1289
 
                                   type_func =
1290
 
                                   timedelta_to_milliseconds)
 
1858
    timeout = notifychangeproperty(
 
1859
        dbus.UInt64, "Timeout",
 
1860
        type_func=lambda td: td.total_seconds() * 1000)
1291
1861
    extended_timeout = notifychangeproperty(
1292
1862
        dbus.UInt64, "ExtendedTimeout",
1293
 
        type_func = timedelta_to_milliseconds)
1294
 
    interval = notifychangeproperty(dbus.UInt64,
1295
 
                                    "Interval",
1296
 
                                    type_func =
1297
 
                                    timedelta_to_milliseconds)
 
1863
        type_func=lambda td: td.total_seconds() * 1000)
 
1864
    interval = notifychangeproperty(
 
1865
        dbus.UInt64, "Interval",
 
1866
        type_func=lambda td: td.total_seconds() * 1000)
1298
1867
    checker_command = notifychangeproperty(dbus.String, "Checker")
1299
 
    
 
1868
    secret = notifychangeproperty(dbus.ByteArray, "Secret",
 
1869
                                  invalidate_only=True)
 
1870
 
1300
1871
    del notifychangeproperty
1301
 
    
 
1872
 
1302
1873
    def __del__(self, *args, **kwargs):
1303
1874
        try:
1304
1875
            self.remove_from_connection()
1307
1878
        if hasattr(DBusObjectWithProperties, "__del__"):
1308
1879
            DBusObjectWithProperties.__del__(self, *args, **kwargs)
1309
1880
        Client.__del__(self, *args, **kwargs)
1310
 
    
1311
 
    def checker_callback(self, pid, condition, command,
1312
 
                         *args, **kwargs):
1313
 
        self.checker_callback_tag = None
1314
 
        self.checker = None
1315
 
        if os.WIFEXITED(condition):
1316
 
            exitstatus = os.WEXITSTATUS(condition)
 
1881
 
 
1882
    def checker_callback(self, source, condition,
 
1883
                         connection, command, *args, **kwargs):
 
1884
        ret = Client.checker_callback(self, source, condition,
 
1885
                                      connection, command, *args,
 
1886
                                      **kwargs)
 
1887
        exitstatus = self.last_checker_status
 
1888
        if exitstatus >= 0:
1317
1889
            # Emit D-Bus signal
1318
1890
            self.CheckerCompleted(dbus.Int16(exitstatus),
1319
 
                                  dbus.Int64(condition),
 
1891
                                  # This is specific to GNU libC
 
1892
                                  dbus.Int64(exitstatus << 8),
1320
1893
                                  dbus.String(command))
1321
1894
        else:
1322
1895
            # Emit D-Bus signal
1323
1896
            self.CheckerCompleted(dbus.Int16(-1),
1324
 
                                  dbus.Int64(condition),
 
1897
                                  dbus.Int64(
 
1898
                                      # This is specific to GNU libC
 
1899
                                      (exitstatus << 8)
 
1900
                                      | self.last_checker_signal),
1325
1901
                                  dbus.String(command))
1326
 
        
1327
 
        return Client.checker_callback(self, pid, condition, command,
1328
 
                                       *args, **kwargs)
1329
 
    
 
1902
        return ret
 
1903
 
1330
1904
    def start_checker(self, *args, **kwargs):
1331
 
        old_checker = self.checker
1332
 
        if self.checker is not None:
1333
 
            old_checker_pid = self.checker.pid
1334
 
        else:
1335
 
            old_checker_pid = None
 
1905
        old_checker_pid = getattr(self.checker, "pid", None)
1336
1906
        r = Client.start_checker(self, *args, **kwargs)
1337
1907
        # Only if new checker process was started
1338
1908
        if (self.checker is not None
1340
1910
            # Emit D-Bus signal
1341
1911
            self.CheckerStarted(self.current_checker_command)
1342
1912
        return r
1343
 
    
 
1913
 
1344
1914
    def _reset_approved(self):
1345
1915
        self.approved = None
1346
1916
        return False
1347
 
    
 
1917
 
1348
1918
    def approve(self, value=True):
1349
1919
        self.approved = value
1350
 
        gobject.timeout_add(timedelta_to_milliseconds
1351
 
                            (self.approval_duration),
1352
 
                            self._reset_approved)
 
1920
        GLib.timeout_add(int(self.approval_duration.total_seconds()
 
1921
                             * 1000), self._reset_approved)
1353
1922
        self.send_changedstate()
1354
 
    
1355
 
    ## D-Bus methods, signals & properties
1356
 
    _interface = "se.recompile.Mandos.Client"
1357
 
    
1358
 
    ## Interfaces
1359
 
    
1360
 
    @dbus_interface_annotations(_interface)
1361
 
    def _foo(self):
1362
 
        return { "org.freedesktop.DBus.Property.EmitsChangedSignal":
1363
 
                     "false"}
1364
 
    
1365
 
    ## Signals
1366
 
    
 
1923
 
 
1924
    #  D-Bus methods, signals & properties
 
1925
 
 
1926
    #  Interfaces
 
1927
 
 
1928
    #  Signals
 
1929
 
1367
1930
    # CheckerCompleted - signal
1368
1931
    @dbus.service.signal(_interface, signature="nxs")
1369
1932
    def CheckerCompleted(self, exitcode, waitstatus, command):
1370
1933
        "D-Bus signal"
1371
1934
        pass
1372
 
    
 
1935
 
1373
1936
    # CheckerStarted - signal
1374
1937
    @dbus.service.signal(_interface, signature="s")
1375
1938
    def CheckerStarted(self, command):
1376
1939
        "D-Bus signal"
1377
1940
        pass
1378
 
    
 
1941
 
1379
1942
    # PropertyChanged - signal
 
1943
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1380
1944
    @dbus.service.signal(_interface, signature="sv")
1381
1945
    def PropertyChanged(self, property, value):
1382
1946
        "D-Bus signal"
1383
1947
        pass
1384
 
    
 
1948
 
1385
1949
    # GotSecret - signal
1386
1950
    @dbus.service.signal(_interface)
1387
1951
    def GotSecret(self):
1390
1954
        server to mandos-client
1391
1955
        """
1392
1956
        pass
1393
 
    
 
1957
 
1394
1958
    # Rejected - signal
1395
1959
    @dbus.service.signal(_interface, signature="s")
1396
1960
    def Rejected(self, reason):
1397
1961
        "D-Bus signal"
1398
1962
        pass
1399
 
    
 
1963
 
1400
1964
    # NeedApproval - signal
1401
1965
    @dbus.service.signal(_interface, signature="tb")
1402
1966
    def NeedApproval(self, timeout, default):
1403
1967
        "D-Bus signal"
1404
1968
        return self.need_approval()
1405
 
    
1406
 
    ## Methods
1407
 
    
 
1969
 
 
1970
    #  Methods
 
1971
 
1408
1972
    # Approve - method
1409
1973
    @dbus.service.method(_interface, in_signature="b")
1410
1974
    def Approve(self, value):
1411
1975
        self.approve(value)
1412
 
    
 
1976
 
1413
1977
    # CheckedOK - method
1414
1978
    @dbus.service.method(_interface)
1415
1979
    def CheckedOK(self):
1416
1980
        self.checked_ok()
1417
 
    
 
1981
 
1418
1982
    # Enable - method
 
1983
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1419
1984
    @dbus.service.method(_interface)
1420
1985
    def Enable(self):
1421
1986
        "D-Bus method"
1422
1987
        self.enable()
1423
 
    
 
1988
 
1424
1989
    # StartChecker - method
 
1990
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1425
1991
    @dbus.service.method(_interface)
1426
1992
    def StartChecker(self):
1427
1993
        "D-Bus method"
1428
1994
        self.start_checker()
1429
 
    
 
1995
 
1430
1996
    # Disable - method
 
1997
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1431
1998
    @dbus.service.method(_interface)
1432
1999
    def Disable(self):
1433
2000
        "D-Bus method"
1434
2001
        self.disable()
1435
 
    
 
2002
 
1436
2003
    # StopChecker - method
 
2004
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1437
2005
    @dbus.service.method(_interface)
1438
2006
    def StopChecker(self):
1439
2007
        self.stop_checker()
1440
 
    
1441
 
    ## Properties
1442
 
    
 
2008
 
 
2009
    #  Properties
 
2010
 
1443
2011
    # ApprovalPending - property
1444
2012
    @dbus_service_property(_interface, signature="b", access="read")
1445
2013
    def ApprovalPending_dbus_property(self):
1446
2014
        return dbus.Boolean(bool(self.approvals_pending))
1447
 
    
 
2015
 
1448
2016
    # ApprovedByDefault - property
1449
 
    @dbus_service_property(_interface, signature="b",
 
2017
    @dbus_service_property(_interface,
 
2018
                           signature="b",
1450
2019
                           access="readwrite")
1451
2020
    def ApprovedByDefault_dbus_property(self, value=None):
1452
2021
        if value is None:       # get
1453
2022
            return dbus.Boolean(self.approved_by_default)
1454
2023
        self.approved_by_default = bool(value)
1455
 
    
 
2024
 
1456
2025
    # ApprovalDelay - property
1457
 
    @dbus_service_property(_interface, signature="t",
 
2026
    @dbus_service_property(_interface,
 
2027
                           signature="t",
1458
2028
                           access="readwrite")
1459
2029
    def ApprovalDelay_dbus_property(self, value=None):
1460
2030
        if value is None:       # get
1461
 
            return dbus.UInt64(self.approval_delay_milliseconds())
 
2031
            return dbus.UInt64(self.approval_delay.total_seconds()
 
2032
                               * 1000)
1462
2033
        self.approval_delay = datetime.timedelta(0, 0, 0, value)
1463
 
    
 
2034
 
1464
2035
    # ApprovalDuration - property
1465
 
    @dbus_service_property(_interface, signature="t",
 
2036
    @dbus_service_property(_interface,
 
2037
                           signature="t",
1466
2038
                           access="readwrite")
1467
2039
    def ApprovalDuration_dbus_property(self, value=None):
1468
2040
        if value is None:       # get
1469
 
            return dbus.UInt64(timedelta_to_milliseconds(
1470
 
                    self.approval_duration))
 
2041
            return dbus.UInt64(self.approval_duration.total_seconds()
 
2042
                               * 1000)
1471
2043
        self.approval_duration = datetime.timedelta(0, 0, 0, value)
1472
 
    
 
2044
 
1473
2045
    # Name - property
 
2046
    @dbus_annotations(
 
2047
        {"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1474
2048
    @dbus_service_property(_interface, signature="s", access="read")
1475
2049
    def Name_dbus_property(self):
1476
2050
        return dbus.String(self.name)
1477
 
    
 
2051
 
 
2052
    # KeyID - property
 
2053
    @dbus_annotations(
 
2054
        {"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
 
2055
    @dbus_service_property(_interface, signature="s", access="read")
 
2056
    def KeyID_dbus_property(self):
 
2057
        return dbus.String(self.key_id)
 
2058
 
1478
2059
    # Fingerprint - property
 
2060
    @dbus_annotations(
 
2061
        {"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1479
2062
    @dbus_service_property(_interface, signature="s", access="read")
1480
2063
    def Fingerprint_dbus_property(self):
1481
2064
        return dbus.String(self.fingerprint)
1482
 
    
 
2065
 
1483
2066
    # Host - property
1484
 
    @dbus_service_property(_interface, signature="s",
 
2067
    @dbus_service_property(_interface,
 
2068
                           signature="s",
1485
2069
                           access="readwrite")
1486
2070
    def Host_dbus_property(self, value=None):
1487
2071
        if value is None:       # get
1488
2072
            return dbus.String(self.host)
1489
 
        self.host = unicode(value)
1490
 
    
 
2073
        self.host = str(value)
 
2074
 
1491
2075
    # Created - property
 
2076
    @dbus_annotations(
 
2077
        {"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1492
2078
    @dbus_service_property(_interface, signature="s", access="read")
1493
2079
    def Created_dbus_property(self):
1494
2080
        return datetime_to_dbus(self.created)
1495
 
    
 
2081
 
1496
2082
    # LastEnabled - property
1497
2083
    @dbus_service_property(_interface, signature="s", access="read")
1498
2084
    def LastEnabled_dbus_property(self):
1499
2085
        return datetime_to_dbus(self.last_enabled)
1500
 
    
 
2086
 
1501
2087
    # Enabled - property
1502
 
    @dbus_service_property(_interface, signature="b",
 
2088
    @dbus_service_property(_interface,
 
2089
                           signature="b",
1503
2090
                           access="readwrite")
1504
2091
    def Enabled_dbus_property(self, value=None):
1505
2092
        if value is None:       # get
1508
2095
            self.enable()
1509
2096
        else:
1510
2097
            self.disable()
1511
 
    
 
2098
 
1512
2099
    # LastCheckedOK - property
1513
 
    @dbus_service_property(_interface, signature="s",
 
2100
    @dbus_service_property(_interface,
 
2101
                           signature="s",
1514
2102
                           access="readwrite")
1515
2103
    def LastCheckedOK_dbus_property(self, value=None):
1516
2104
        if value is not None:
1517
2105
            self.checked_ok()
1518
2106
            return
1519
2107
        return datetime_to_dbus(self.last_checked_ok)
1520
 
    
 
2108
 
1521
2109
    # LastCheckerStatus - property
1522
 
    @dbus_service_property(_interface, signature="n",
1523
 
                           access="read")
 
2110
    @dbus_service_property(_interface, signature="n", access="read")
1524
2111
    def LastCheckerStatus_dbus_property(self):
1525
2112
        return dbus.Int16(self.last_checker_status)
1526
 
    
 
2113
 
1527
2114
    # Expires - property
1528
2115
    @dbus_service_property(_interface, signature="s", access="read")
1529
2116
    def Expires_dbus_property(self):
1530
2117
        return datetime_to_dbus(self.expires)
1531
 
    
 
2118
 
1532
2119
    # LastApprovalRequest - property
1533
2120
    @dbus_service_property(_interface, signature="s", access="read")
1534
2121
    def LastApprovalRequest_dbus_property(self):
1535
2122
        return datetime_to_dbus(self.last_approval_request)
1536
 
    
 
2123
 
1537
2124
    # Timeout - property
1538
 
    @dbus_service_property(_interface, signature="t",
 
2125
    @dbus_service_property(_interface,
 
2126
                           signature="t",
1539
2127
                           access="readwrite")
1540
2128
    def Timeout_dbus_property(self, value=None):
1541
2129
        if value is None:       # get
1542
 
            return dbus.UInt64(self.timeout_milliseconds())
 
2130
            return dbus.UInt64(self.timeout.total_seconds() * 1000)
1543
2131
        old_timeout = self.timeout
1544
2132
        self.timeout = datetime.timedelta(0, 0, 0, value)
1545
2133
        # Reschedule disabling
1553
2141
                if (getattr(self, "disable_initiator_tag", None)
1554
2142
                    is None):
1555
2143
                    return
1556
 
                gobject.source_remove(self.disable_initiator_tag)
1557
 
                self.disable_initiator_tag = (
1558
 
                    gobject.timeout_add(
1559
 
                        timedelta_to_milliseconds(self.expires - now),
1560
 
                        self.disable))
1561
 
    
 
2144
                GLib.source_remove(self.disable_initiator_tag)
 
2145
                self.disable_initiator_tag = GLib.timeout_add(
 
2146
                    int((self.expires - now).total_seconds() * 1000),
 
2147
                    self.disable)
 
2148
 
1562
2149
    # ExtendedTimeout - property
1563
 
    @dbus_service_property(_interface, signature="t",
 
2150
    @dbus_service_property(_interface,
 
2151
                           signature="t",
1564
2152
                           access="readwrite")
1565
2153
    def ExtendedTimeout_dbus_property(self, value=None):
1566
2154
        if value is None:       # get
1567
 
            return dbus.UInt64(self.extended_timeout_milliseconds())
 
2155
            return dbus.UInt64(self.extended_timeout.total_seconds()
 
2156
                               * 1000)
1568
2157
        self.extended_timeout = datetime.timedelta(0, 0, 0, value)
1569
 
    
 
2158
 
1570
2159
    # Interval - property
1571
 
    @dbus_service_property(_interface, signature="t",
 
2160
    @dbus_service_property(_interface,
 
2161
                           signature="t",
1572
2162
                           access="readwrite")
1573
2163
    def Interval_dbus_property(self, value=None):
1574
2164
        if value is None:       # get
1575
 
            return dbus.UInt64(self.interval_milliseconds())
 
2165
            return dbus.UInt64(self.interval.total_seconds() * 1000)
1576
2166
        self.interval = datetime.timedelta(0, 0, 0, value)
1577
2167
        if getattr(self, "checker_initiator_tag", None) is None:
1578
2168
            return
1579
2169
        if self.enabled:
1580
2170
            # Reschedule checker run
1581
 
            gobject.source_remove(self.checker_initiator_tag)
1582
 
            self.checker_initiator_tag = (gobject.timeout_add
1583
 
                                          (value, self.start_checker))
1584
 
            self.start_checker()    # Start one now, too
1585
 
    
 
2171
            GLib.source_remove(self.checker_initiator_tag)
 
2172
            self.checker_initiator_tag = GLib.timeout_add(
 
2173
                value, self.start_checker)
 
2174
            self.start_checker()  # Start one now, too
 
2175
 
1586
2176
    # Checker - property
1587
 
    @dbus_service_property(_interface, signature="s",
 
2177
    @dbus_service_property(_interface,
 
2178
                           signature="s",
1588
2179
                           access="readwrite")
1589
2180
    def Checker_dbus_property(self, value=None):
1590
2181
        if value is None:       # get
1591
2182
            return dbus.String(self.checker_command)
1592
 
        self.checker_command = unicode(value)
1593
 
    
 
2183
        self.checker_command = str(value)
 
2184
 
1594
2185
    # CheckerRunning - property
1595
 
    @dbus_service_property(_interface, signature="b",
 
2186
    @dbus_service_property(_interface,
 
2187
                           signature="b",
1596
2188
                           access="readwrite")
1597
2189
    def CheckerRunning_dbus_property(self, value=None):
1598
2190
        if value is None:       # get
1601
2193
            self.start_checker()
1602
2194
        else:
1603
2195
            self.stop_checker()
1604
 
    
 
2196
 
1605
2197
    # ObjectPath - property
 
2198
    @dbus_annotations(
 
2199
        {"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",
 
2200
         "org.freedesktop.DBus.Deprecated": "true"})
1606
2201
    @dbus_service_property(_interface, signature="o", access="read")
1607
2202
    def ObjectPath_dbus_property(self):
1608
 
        return self.dbus_object_path # is already a dbus.ObjectPath
1609
 
    
 
2203
        return self.dbus_object_path  # is already a dbus.ObjectPath
 
2204
 
1610
2205
    # Secret = property
1611
 
    @dbus_service_property(_interface, signature="ay",
1612
 
                           access="write", byte_arrays=True)
 
2206
    @dbus_annotations(
 
2207
        {"org.freedesktop.DBus.Property.EmitsChangedSignal":
 
2208
         "invalidates"})
 
2209
    @dbus_service_property(_interface,
 
2210
                           signature="ay",
 
2211
                           access="write",
 
2212
                           byte_arrays=True)
1613
2213
    def Secret_dbus_property(self, value):
1614
 
        self.secret = str(value)
1615
 
    
 
2214
        self.secret = bytes(value)
 
2215
 
1616
2216
    del _interface
1617
2217
 
1618
2218
 
1619
 
class ProxyClient(object):
1620
 
    def __init__(self, child_pipe, fpr, address):
 
2219
class ProxyClient:
 
2220
    def __init__(self, child_pipe, key_id, fpr, address):
1621
2221
        self._pipe = child_pipe
1622
 
        self._pipe.send(('init', fpr, address))
 
2222
        self._pipe.send(('init', key_id, fpr, address))
1623
2223
        if not self._pipe.recv():
1624
 
            raise KeyError()
1625
 
    
 
2224
            raise KeyError(key_id or fpr)
 
2225
 
1626
2226
    def __getattribute__(self, name):
1627
2227
        if name == '_pipe':
1628
2228
            return super(ProxyClient, self).__getattribute__(name)
1631
2231
        if data[0] == 'data':
1632
2232
            return data[1]
1633
2233
        if data[0] == 'function':
 
2234
 
1634
2235
            def func(*args, **kwargs):
1635
2236
                self._pipe.send(('funcall', name, args, kwargs))
1636
2237
                return self._pipe.recv()[1]
 
2238
 
1637
2239
            return func
1638
 
    
 
2240
 
1639
2241
    def __setattr__(self, name, value):
1640
2242
        if name == '_pipe':
1641
2243
            return super(ProxyClient, self).__setattr__(name, value)
1644
2246
 
1645
2247
class ClientHandler(socketserver.BaseRequestHandler, object):
1646
2248
    """A class to handle client connections.
1647
 
    
 
2249
 
1648
2250
    Instantiated once for each connection to handle it.
1649
2251
    Note: This will run in its own forked process."""
1650
 
    
 
2252
 
1651
2253
    def handle(self):
1652
2254
        with contextlib.closing(self.server.child_pipe) as child_pipe:
1653
2255
            logger.info("TCP connection from: %s",
1654
 
                        unicode(self.client_address))
 
2256
                        str(self.client_address))
1655
2257
            logger.debug("Pipe FD: %d",
1656
2258
                         self.server.child_pipe.fileno())
1657
 
            
1658
 
            session = (gnutls.connection
1659
 
                       .ClientSession(self.request,
1660
 
                                      gnutls.connection
1661
 
                                      .X509Credentials()))
1662
 
            
1663
 
            # Note: gnutls.connection.X509Credentials is really a
1664
 
            # generic GnuTLS certificate credentials object so long as
1665
 
            # no X.509 keys are added to it.  Therefore, we can use it
1666
 
            # here despite using OpenPGP certificates.
1667
 
            
1668
 
            #priority = ':'.join(("NONE", "+VERS-TLS1.1",
1669
 
            #                      "+AES-256-CBC", "+SHA1",
1670
 
            #                      "+COMP-NULL", "+CTYPE-OPENPGP",
1671
 
            #                      "+DHE-DSS"))
 
2259
 
 
2260
            session = gnutls.ClientSession(self.request)
 
2261
 
 
2262
            # priority = ':'.join(("NONE", "+VERS-TLS1.1",
 
2263
            #                       "+AES-256-CBC", "+SHA1",
 
2264
            #                       "+COMP-NULL", "+CTYPE-OPENPGP",
 
2265
            #                       "+DHE-DSS"))
1672
2266
            # Use a fallback default, since this MUST be set.
1673
2267
            priority = self.server.gnutls_priority
1674
2268
            if priority is None:
1675
2269
                priority = "NORMAL"
1676
 
            (gnutls.library.functions
1677
 
             .gnutls_priority_set_direct(session._c_object,
1678
 
                                         priority, None))
1679
 
            
 
2270
            gnutls.priority_set_direct(session._c_object,
 
2271
                                       priority.encode("utf-8"),
 
2272
                                       None)
 
2273
 
1680
2274
            # Start communication using the Mandos protocol
1681
2275
            # Get protocol number
1682
2276
            line = self.request.makefile().readline()
1683
2277
            logger.debug("Protocol version: %r", line)
1684
2278
            try:
1685
2279
                if int(line.strip().split()[0]) > 1:
1686
 
                    raise RuntimeError
 
2280
                    raise RuntimeError(line)
1687
2281
            except (ValueError, IndexError, RuntimeError) as error:
1688
2282
                logger.error("Unknown protocol version: %s", error)
1689
2283
                return
1690
 
            
 
2284
 
1691
2285
            # Start GnuTLS connection
1692
2286
            try:
1693
2287
                session.handshake()
1694
 
            except gnutls.errors.GNUTLSError as error:
 
2288
            except gnutls.Error as error:
1695
2289
                logger.warning("Handshake failed: %s", error)
1696
2290
                # Do not run session.bye() here: the session is not
1697
2291
                # established.  Just abandon the request.
1698
2292
                return
1699
2293
            logger.debug("Handshake succeeded")
1700
 
            
 
2294
 
1701
2295
            approval_required = False
1702
2296
            try:
1703
 
                try:
1704
 
                    fpr = self.fingerprint(self.peer_certificate
1705
 
                                           (session))
1706
 
                except (TypeError,
1707
 
                        gnutls.errors.GNUTLSError) as error:
1708
 
                    logger.warning("Bad certificate: %s", error)
1709
 
                    return
1710
 
                logger.debug("Fingerprint: %s", fpr)
1711
 
                
1712
 
                try:
1713
 
                    client = ProxyClient(child_pipe, fpr,
 
2297
                if gnutls.has_rawpk:
 
2298
                    fpr = b""
 
2299
                    try:
 
2300
                        key_id = self.key_id(
 
2301
                            self.peer_certificate(session))
 
2302
                    except (TypeError, gnutls.Error) as error:
 
2303
                        logger.warning("Bad certificate: %s", error)
 
2304
                        return
 
2305
                    logger.debug("Key ID: %s", key_id)
 
2306
 
 
2307
                else:
 
2308
                    key_id = b""
 
2309
                    try:
 
2310
                        fpr = self.fingerprint(
 
2311
                            self.peer_certificate(session))
 
2312
                    except (TypeError, gnutls.Error) as error:
 
2313
                        logger.warning("Bad certificate: %s", error)
 
2314
                        return
 
2315
                    logger.debug("Fingerprint: %s", fpr)
 
2316
 
 
2317
                try:
 
2318
                    client = ProxyClient(child_pipe, key_id, fpr,
1714
2319
                                         self.client_address)
1715
2320
                except KeyError:
1716
2321
                    return
1717
 
                
 
2322
 
1718
2323
                if client.approval_delay:
1719
2324
                    delay = client.approval_delay
1720
2325
                    client.approvals_pending += 1
1721
2326
                    approval_required = True
1722
 
                
 
2327
 
1723
2328
                while True:
1724
2329
                    if not client.enabled:
1725
2330
                        logger.info("Client %s is disabled",
1726
 
                                       client.name)
 
2331
                                    client.name)
1727
2332
                        if self.server.use_dbus:
1728
2333
                            # Emit D-Bus signal
1729
2334
                            client.Rejected("Disabled")
1730
2335
                        return
1731
 
                    
 
2336
 
1732
2337
                    if client.approved or not client.approval_delay:
1733
 
                        #We are approved or approval is disabled
 
2338
                        # We are approved or approval is disabled
1734
2339
                        break
1735
2340
                    elif client.approved is None:
1736
2341
                        logger.info("Client %s needs approval",
1738
2343
                        if self.server.use_dbus:
1739
2344
                            # Emit D-Bus signal
1740
2345
                            client.NeedApproval(
1741
 
                                client.approval_delay_milliseconds(),
1742
 
                                client.approved_by_default)
 
2346
                                client.approval_delay.total_seconds()
 
2347
                                * 1000, client.approved_by_default)
1743
2348
                    else:
1744
2349
                        logger.warning("Client %s was not approved",
1745
2350
                                       client.name)
1747
2352
                            # Emit D-Bus signal
1748
2353
                            client.Rejected("Denied")
1749
2354
                        return
1750
 
                    
1751
 
                    #wait until timeout or approved
 
2355
 
 
2356
                    # wait until timeout or approved
1752
2357
                    time = datetime.datetime.now()
1753
2358
                    client.changedstate.acquire()
1754
 
                    client.changedstate.wait(
1755
 
                        float(timedelta_to_milliseconds(delay)
1756
 
                              / 1000))
 
2359
                    client.changedstate.wait(delay.total_seconds())
1757
2360
                    client.changedstate.release()
1758
2361
                    time2 = datetime.datetime.now()
1759
2362
                    if (time2 - time) >= delay:
1769
2372
                            break
1770
2373
                    else:
1771
2374
                        delay -= time2 - time
1772
 
                
1773
 
                sent_size = 0
1774
 
                while sent_size < len(client.secret):
1775
 
                    try:
1776
 
                        sent = session.send(client.secret[sent_size:])
1777
 
                    except gnutls.errors.GNUTLSError as error:
1778
 
                        logger.warning("gnutls send failed",
1779
 
                                       exc_info=error)
1780
 
                        return
1781
 
                    logger.debug("Sent: %d, remaining: %d",
1782
 
                                 sent, len(client.secret)
1783
 
                                 - (sent_size + sent))
1784
 
                    sent_size += sent
1785
 
                
 
2375
 
 
2376
                try:
 
2377
                    session.send(client.secret)
 
2378
                except gnutls.Error as error:
 
2379
                    logger.warning("gnutls send failed",
 
2380
                                   exc_info=error)
 
2381
                    return
 
2382
 
1786
2383
                logger.info("Sending secret to %s", client.name)
1787
2384
                # bump the timeout using extended_timeout
1788
2385
                client.bump_timeout(client.extended_timeout)
1789
2386
                if self.server.use_dbus:
1790
2387
                    # Emit D-Bus signal
1791
2388
                    client.GotSecret()
1792
 
            
 
2389
 
1793
2390
            finally:
1794
2391
                if approval_required:
1795
2392
                    client.approvals_pending -= 1
1796
2393
                try:
1797
2394
                    session.bye()
1798
 
                except gnutls.errors.GNUTLSError as error:
 
2395
                except gnutls.Error as error:
1799
2396
                    logger.warning("GnuTLS bye failed",
1800
2397
                                   exc_info=error)
1801
 
    
 
2398
 
1802
2399
    @staticmethod
1803
2400
    def peer_certificate(session):
1804
 
        "Return the peer's OpenPGP certificate as a bytestring"
1805
 
        # If not an OpenPGP certificate...
1806
 
        if (gnutls.library.functions
1807
 
            .gnutls_certificate_type_get(session._c_object)
1808
 
            != gnutls.library.constants.GNUTLS_CRT_OPENPGP):
1809
 
            # ...do the normal thing
1810
 
            return session.peer_certificate
 
2401
        "Return the peer's certificate as a bytestring"
 
2402
        try:
 
2403
            cert_type = gnutls.certificate_type_get2(session._c_object,
 
2404
                                                     gnutls.CTYPE_PEERS)
 
2405
        except AttributeError:
 
2406
            cert_type = gnutls.certificate_type_get(session._c_object)
 
2407
        if gnutls.has_rawpk:
 
2408
            valid_cert_types = frozenset((gnutls.CRT_RAWPK,))
 
2409
        else:
 
2410
            valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))
 
2411
        # If not a valid certificate type...
 
2412
        if cert_type not in valid_cert_types:
 
2413
            logger.info("Cert type %r not in %r", cert_type,
 
2414
                        valid_cert_types)
 
2415
            # ...return invalid data
 
2416
            return b""
1811
2417
        list_size = ctypes.c_uint(1)
1812
 
        cert_list = (gnutls.library.functions
1813
 
                     .gnutls_certificate_get_peers
 
2418
        cert_list = (gnutls.certificate_get_peers
1814
2419
                     (session._c_object, ctypes.byref(list_size)))
1815
2420
        if not bool(cert_list) and list_size.value != 0:
1816
 
            raise gnutls.errors.GNUTLSError("error getting peer"
1817
 
                                            " certificate")
 
2421
            raise gnutls.Error("error getting peer certificate")
1818
2422
        if list_size.value == 0:
1819
2423
            return None
1820
2424
        cert = cert_list[0]
1821
2425
        return ctypes.string_at(cert.data, cert.size)
1822
 
    
 
2426
 
 
2427
    @staticmethod
 
2428
    def key_id(certificate):
 
2429
        "Convert a certificate bytestring to a hexdigit key ID"
 
2430
        # New GnuTLS "datum" with the public key
 
2431
        datum = gnutls.datum_t(
 
2432
            ctypes.cast(ctypes.c_char_p(certificate),
 
2433
                        ctypes.POINTER(ctypes.c_ubyte)),
 
2434
            ctypes.c_uint(len(certificate)))
 
2435
        # XXX all these need to be created in the gnutls "module"
 
2436
        # New empty GnuTLS certificate
 
2437
        pubkey = gnutls.pubkey_t()
 
2438
        gnutls.pubkey_init(ctypes.byref(pubkey))
 
2439
        # Import the raw public key into the certificate
 
2440
        gnutls.pubkey_import(pubkey,
 
2441
                             ctypes.byref(datum),
 
2442
                             gnutls.X509_FMT_DER)
 
2443
        # New buffer for the key ID
 
2444
        buf = ctypes.create_string_buffer(32)
 
2445
        buf_len = ctypes.c_size_t(len(buf))
 
2446
        # Get the key ID from the raw public key into the buffer
 
2447
        gnutls.pubkey_get_key_id(pubkey,
 
2448
                                 gnutls.KEYID_USE_SHA256,
 
2449
                                 ctypes.cast(ctypes.byref(buf),
 
2450
                                             ctypes.POINTER(ctypes.c_ubyte)),
 
2451
                                 ctypes.byref(buf_len))
 
2452
        # Deinit the certificate
 
2453
        gnutls.pubkey_deinit(pubkey)
 
2454
 
 
2455
        # Convert the buffer to a Python bytestring
 
2456
        key_id = ctypes.string_at(buf, buf_len.value)
 
2457
        # Convert the bytestring to hexadecimal notation
 
2458
        hex_key_id = binascii.hexlify(key_id).upper()
 
2459
        return hex_key_id
 
2460
 
1823
2461
    @staticmethod
1824
2462
    def fingerprint(openpgp):
1825
2463
        "Convert an OpenPGP bytestring to a hexdigit fingerprint"
1826
2464
        # New GnuTLS "datum" with the OpenPGP public key
1827
 
        datum = (gnutls.library.types
1828
 
                 .gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
1829
 
                                             ctypes.POINTER
1830
 
                                             (ctypes.c_ubyte)),
1831
 
                                 ctypes.c_uint(len(openpgp))))
 
2465
        datum = gnutls.datum_t(
 
2466
            ctypes.cast(ctypes.c_char_p(openpgp),
 
2467
                        ctypes.POINTER(ctypes.c_ubyte)),
 
2468
            ctypes.c_uint(len(openpgp)))
1832
2469
        # New empty GnuTLS certificate
1833
 
        crt = gnutls.library.types.gnutls_openpgp_crt_t()
1834
 
        (gnutls.library.functions
1835
 
         .gnutls_openpgp_crt_init(ctypes.byref(crt)))
 
2470
        crt = gnutls.openpgp_crt_t()
 
2471
        gnutls.openpgp_crt_init(ctypes.byref(crt))
1836
2472
        # Import the OpenPGP public key into the certificate
1837
 
        (gnutls.library.functions
1838
 
         .gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
1839
 
                                    gnutls.library.constants
1840
 
                                    .GNUTLS_OPENPGP_FMT_RAW))
 
2473
        gnutls.openpgp_crt_import(crt, ctypes.byref(datum),
 
2474
                                  gnutls.OPENPGP_FMT_RAW)
1841
2475
        # Verify the self signature in the key
1842
2476
        crtverify = ctypes.c_uint()
1843
 
        (gnutls.library.functions
1844
 
         .gnutls_openpgp_crt_verify_self(crt, 0,
1845
 
                                         ctypes.byref(crtverify)))
 
2477
        gnutls.openpgp_crt_verify_self(crt, 0,
 
2478
                                       ctypes.byref(crtverify))
1846
2479
        if crtverify.value != 0:
1847
 
            gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1848
 
            raise (gnutls.errors.CertificateSecurityError
1849
 
                   ("Verify failed"))
 
2480
            gnutls.openpgp_crt_deinit(crt)
 
2481
            raise gnutls.CertificateSecurityError(code
 
2482
                                                  =crtverify.value)
1850
2483
        # New buffer for the fingerprint
1851
2484
        buf = ctypes.create_string_buffer(20)
1852
2485
        buf_len = ctypes.c_size_t()
1853
2486
        # Get the fingerprint from the certificate into the buffer
1854
 
        (gnutls.library.functions
1855
 
         .gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
1856
 
                                             ctypes.byref(buf_len)))
 
2487
        gnutls.openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
 
2488
                                           ctypes.byref(buf_len))
1857
2489
        # Deinit the certificate
1858
 
        gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
 
2490
        gnutls.openpgp_crt_deinit(crt)
1859
2491
        # Convert the buffer to a Python bytestring
1860
2492
        fpr = ctypes.string_at(buf, buf_len.value)
1861
2493
        # Convert the bytestring to hexadecimal notation
1863
2495
        return hex_fpr
1864
2496
 
1865
2497
 
1866
 
class MultiprocessingMixIn(object):
 
2498
class MultiprocessingMixIn:
1867
2499
    """Like socketserver.ThreadingMixIn, but with multiprocessing"""
 
2500
 
1868
2501
    def sub_process_main(self, request, address):
1869
2502
        try:
1870
2503
            self.finish_request(request, address)
1871
2504
        except Exception:
1872
2505
            self.handle_error(request, address)
1873
2506
        self.close_request(request)
1874
 
    
 
2507
 
1875
2508
    def process_request(self, request, address):
1876
2509
        """Start a new process to process the request."""
1877
 
        proc = multiprocessing.Process(target = self.sub_process_main,
1878
 
                                       args = (request, address))
 
2510
        proc = multiprocessing.Process(target=self.sub_process_main,
 
2511
                                       args=(request, address))
1879
2512
        proc.start()
1880
2513
        return proc
1881
2514
 
1882
2515
 
1883
 
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
 
2516
class MultiprocessingMixInWithPipe(MultiprocessingMixIn):
1884
2517
    """ adds a pipe to the MixIn """
 
2518
 
1885
2519
    def process_request(self, request, client_address):
1886
2520
        """Overrides and wraps the original process_request().
1887
 
        
 
2521
 
1888
2522
        This function creates a new pipe in self.pipe
1889
2523
        """
1890
2524
        parent_pipe, self.child_pipe = multiprocessing.Pipe()
1891
 
        
 
2525
 
1892
2526
        proc = MultiprocessingMixIn.process_request(self, request,
1893
2527
                                                    client_address)
1894
2528
        self.child_pipe.close()
1895
2529
        self.add_pipe(parent_pipe, proc)
1896
 
    
 
2530
 
1897
2531
    def add_pipe(self, parent_pipe, proc):
1898
2532
        """Dummy function; override as necessary"""
1899
 
        raise NotImplementedError
 
2533
        raise NotImplementedError()
1900
2534
 
1901
2535
 
1902
2536
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
1903
 
                     socketserver.TCPServer, object):
 
2537
                     socketserver.TCPServer):
1904
2538
    """IPv6-capable TCP server.  Accepts 'None' as address and/or port
1905
 
    
 
2539
 
1906
2540
    Attributes:
1907
2541
        enabled:        Boolean; whether this server is activated yet
1908
2542
        interface:      None or a network interface name (string)
1909
2543
        use_ipv6:       Boolean; to use IPv6 or not
1910
2544
    """
 
2545
 
1911
2546
    def __init__(self, server_address, RequestHandlerClass,
1912
 
                 interface=None, use_ipv6=True, socketfd=None):
 
2547
                 interface=None,
 
2548
                 use_ipv6=True,
 
2549
                 socketfd=None):
1913
2550
        """If socketfd is set, use that file descriptor instead of
1914
2551
        creating a new one with socket.socket().
1915
2552
        """
1921
2558
            self.socketfd = socketfd
1922
2559
            # Save the original socket.socket() function
1923
2560
            self.socket_socket = socket.socket
 
2561
 
1924
2562
            # To implement --socket, we monkey patch socket.socket.
1925
 
            # 
 
2563
            #
1926
2564
            # (When socketserver.TCPServer is a new-style class, we
1927
2565
            # could make self.socket into a property instead of monkey
1928
2566
            # patching socket.socket.)
1929
 
            # 
 
2567
            #
1930
2568
            # Create a one-time-only replacement for socket.socket()
1931
2569
            @functools.wraps(socket.socket)
1932
2570
            def socket_wrapper(*args, **kwargs):
1944
2582
        # socket_wrapper(), if socketfd was set.
1945
2583
        socketserver.TCPServer.__init__(self, server_address,
1946
2584
                                        RequestHandlerClass)
1947
 
    
 
2585
 
1948
2586
    def server_bind(self):
1949
2587
        """This overrides the normal server_bind() function
1950
2588
        to bind to an interface if one was specified, and also NOT to
1951
2589
        bind to an address or port if they were not specified."""
 
2590
        global SO_BINDTODEVICE
1952
2591
        if self.interface is not None:
1953
2592
            if SO_BINDTODEVICE is None:
1954
 
                logger.error("SO_BINDTODEVICE does not exist;"
1955
 
                             " cannot bind to interface %s",
1956
 
                             self.interface)
1957
 
            else:
1958
 
                try:
1959
 
                    self.socket.setsockopt(socket.SOL_SOCKET,
1960
 
                                           SO_BINDTODEVICE,
1961
 
                                           str(self.interface + '\0'))
1962
 
                except socket.error as error:
1963
 
                    if error.errno == errno.EPERM:
1964
 
                        logger.error("No permission to bind to"
1965
 
                                     " interface %s", self.interface)
1966
 
                    elif error.errno == errno.ENOPROTOOPT:
1967
 
                        logger.error("SO_BINDTODEVICE not available;"
1968
 
                                     " cannot bind to interface %s",
1969
 
                                     self.interface)
1970
 
                    elif error.errno == errno.ENODEV:
1971
 
                        logger.error("Interface %s does not exist,"
1972
 
                                     " cannot bind", self.interface)
1973
 
                    else:
1974
 
                        raise
 
2593
                # Fall back to a hard-coded value which seems to be
 
2594
                # common enough.
 
2595
                logger.warning("SO_BINDTODEVICE not found, trying 25")
 
2596
                SO_BINDTODEVICE = 25
 
2597
            try:
 
2598
                self.socket.setsockopt(
 
2599
                    socket.SOL_SOCKET, SO_BINDTODEVICE,
 
2600
                    (self.interface + "\0").encode("utf-8"))
 
2601
            except socket.error as error:
 
2602
                if error.errno == errno.EPERM:
 
2603
                    logger.error("No permission to bind to"
 
2604
                                 " interface %s", self.interface)
 
2605
                elif error.errno == errno.ENOPROTOOPT:
 
2606
                    logger.error("SO_BINDTODEVICE not available;"
 
2607
                                 " cannot bind to interface %s",
 
2608
                                 self.interface)
 
2609
                elif error.errno == errno.ENODEV:
 
2610
                    logger.error("Interface %s does not exist,"
 
2611
                                 " cannot bind", self.interface)
 
2612
                else:
 
2613
                    raise
1975
2614
        # Only bind(2) the socket if we really need to.
1976
2615
        if self.server_address[0] or self.server_address[1]:
 
2616
            if self.server_address[1]:
 
2617
                self.allow_reuse_address = True
1977
2618
            if not self.server_address[0]:
1978
2619
                if self.address_family == socket.AF_INET6:
1979
 
                    any_address = "::" # in6addr_any
 
2620
                    any_address = "::"  # in6addr_any
1980
2621
                else:
1981
 
                    any_address = socket.INADDR_ANY
 
2622
                    any_address = "0.0.0.0"  # INADDR_ANY
1982
2623
                self.server_address = (any_address,
1983
2624
                                       self.server_address[1])
1984
2625
            elif not self.server_address[1]:
1985
 
                self.server_address = (self.server_address[0],
1986
 
                                       0)
 
2626
                self.server_address = (self.server_address[0], 0)
1987
2627
#                 if self.interface:
1988
2628
#                     self.server_address = (self.server_address[0],
1989
2629
#                                            0, # port
1995
2635
 
1996
2636
class MandosServer(IPv6_TCPServer):
1997
2637
    """Mandos server.
1998
 
    
 
2638
 
1999
2639
    Attributes:
2000
2640
        clients:        set of Client objects
2001
2641
        gnutls_priority GnuTLS priority string
2002
2642
        use_dbus:       Boolean; to emit D-Bus signals or not
2003
 
    
2004
 
    Assumes a gobject.MainLoop event loop.
 
2643
 
 
2644
    Assumes a GLib.MainLoop event loop.
2005
2645
    """
 
2646
 
2006
2647
    def __init__(self, server_address, RequestHandlerClass,
2007
 
                 interface=None, use_ipv6=True, clients=None,
2008
 
                 gnutls_priority=None, use_dbus=True, socketfd=None):
 
2648
                 interface=None,
 
2649
                 use_ipv6=True,
 
2650
                 clients=None,
 
2651
                 gnutls_priority=None,
 
2652
                 use_dbus=True,
 
2653
                 socketfd=None):
2009
2654
        self.enabled = False
2010
2655
        self.clients = clients
2011
2656
        if self.clients is None:
2014
2659
        self.gnutls_priority = gnutls_priority
2015
2660
        IPv6_TCPServer.__init__(self, server_address,
2016
2661
                                RequestHandlerClass,
2017
 
                                interface = interface,
2018
 
                                use_ipv6 = use_ipv6,
2019
 
                                socketfd = socketfd)
 
2662
                                interface=interface,
 
2663
                                use_ipv6=use_ipv6,
 
2664
                                socketfd=socketfd)
 
2665
 
2020
2666
    def server_activate(self):
2021
2667
        if self.enabled:
2022
2668
            return socketserver.TCPServer.server_activate(self)
2023
 
    
 
2669
 
2024
2670
    def enable(self):
2025
2671
        self.enabled = True
2026
 
    
 
2672
 
2027
2673
    def add_pipe(self, parent_pipe, proc):
2028
2674
        # Call "handle_ipc" for both data and EOF events
2029
 
        gobject.io_add_watch(parent_pipe.fileno(),
2030
 
                             gobject.IO_IN | gobject.IO_HUP,
2031
 
                             functools.partial(self.handle_ipc,
2032
 
                                               parent_pipe =
2033
 
                                               parent_pipe,
2034
 
                                               proc = proc))
2035
 
    
2036
 
    def handle_ipc(self, source, condition, parent_pipe=None,
2037
 
                   proc = None, client_object=None):
 
2675
        GLib.io_add_watch(
 
2676
            parent_pipe.fileno(),
 
2677
            GLib.IO_IN | GLib.IO_HUP,
 
2678
            functools.partial(self.handle_ipc,
 
2679
                              parent_pipe=parent_pipe,
 
2680
                              proc=proc))
 
2681
 
 
2682
    def handle_ipc(self, source, condition,
 
2683
                   parent_pipe=None,
 
2684
                   proc=None,
 
2685
                   client_object=None):
2038
2686
        # error, or the other end of multiprocessing.Pipe has closed
2039
 
        if condition & (gobject.IO_ERR | gobject.IO_HUP):
 
2687
        if condition & (GLib.IO_ERR | GLib.IO_HUP):
2040
2688
            # Wait for other process to exit
2041
2689
            proc.join()
2042
2690
            return False
2043
 
        
 
2691
 
2044
2692
        # Read a request from the child
2045
2693
        request = parent_pipe.recv()
2046
2694
        command = request[0]
2047
 
        
 
2695
 
2048
2696
        if command == 'init':
2049
 
            fpr = request[1]
2050
 
            address = request[2]
2051
 
            
2052
 
            for c in self.clients.itervalues():
2053
 
                if c.fingerprint == fpr:
 
2697
            key_id = request[1].decode("ascii")
 
2698
            fpr = request[2].decode("ascii")
 
2699
            address = request[3]
 
2700
 
 
2701
            for c in self.clients.values():
 
2702
                if key_id == "E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855":
 
2703
                    continue
 
2704
                if key_id and c.key_id == key_id:
 
2705
                    client = c
 
2706
                    break
 
2707
                if fpr and c.fingerprint == fpr:
2054
2708
                    client = c
2055
2709
                    break
2056
2710
            else:
2057
 
                logger.info("Client not found for fingerprint: %s, ad"
2058
 
                            "dress: %s", fpr, address)
 
2711
                logger.info("Client not found for key ID: %s, address"
 
2712
                            ": %s", key_id or fpr, address)
2059
2713
                if self.use_dbus:
2060
2714
                    # Emit D-Bus signal
2061
 
                    mandos_dbus_service.ClientNotFound(fpr,
 
2715
                    mandos_dbus_service.ClientNotFound(key_id or fpr,
2062
2716
                                                       address[0])
2063
2717
                parent_pipe.send(False)
2064
2718
                return False
2065
 
            
2066
 
            gobject.io_add_watch(parent_pipe.fileno(),
2067
 
                                 gobject.IO_IN | gobject.IO_HUP,
2068
 
                                 functools.partial(self.handle_ipc,
2069
 
                                                   parent_pipe =
2070
 
                                                   parent_pipe,
2071
 
                                                   proc = proc,
2072
 
                                                   client_object =
2073
 
                                                   client))
 
2719
 
 
2720
            GLib.io_add_watch(
 
2721
                parent_pipe.fileno(),
 
2722
                GLib.IO_IN | GLib.IO_HUP,
 
2723
                functools.partial(self.handle_ipc,
 
2724
                                  parent_pipe=parent_pipe,
 
2725
                                  proc=proc,
 
2726
                                  client_object=client))
2074
2727
            parent_pipe.send(True)
2075
2728
            # remove the old hook in favor of the new above hook on
2076
2729
            # same fileno
2079
2732
            funcname = request[1]
2080
2733
            args = request[2]
2081
2734
            kwargs = request[3]
2082
 
            
 
2735
 
2083
2736
            parent_pipe.send(('data', getattr(client_object,
2084
2737
                                              funcname)(*args,
2085
 
                                                         **kwargs)))
2086
 
        
 
2738
                                                        **kwargs)))
 
2739
 
2087
2740
        if command == 'getattr':
2088
2741
            attrname = request[1]
2089
 
            if callable(client_object.__getattribute__(attrname)):
2090
 
                parent_pipe.send(('function',))
 
2742
            if isinstance(client_object.__getattribute__(attrname),
 
2743
                          collections.Callable):
 
2744
                parent_pipe.send(('function', ))
2091
2745
            else:
2092
 
                parent_pipe.send(('data', client_object
2093
 
                                  .__getattribute__(attrname)))
2094
 
        
 
2746
                parent_pipe.send((
 
2747
                    'data', client_object.__getattribute__(attrname)))
 
2748
 
2095
2749
        if command == 'setattr':
2096
2750
            attrname = request[1]
2097
2751
            value = request[2]
2098
2752
            setattr(client_object, attrname, value)
2099
 
        
 
2753
 
2100
2754
        return True
2101
2755
 
2102
2756
 
2103
2757
def rfc3339_duration_to_delta(duration):
2104
2758
    """Parse an RFC 3339 "duration" and return a datetime.timedelta
2105
 
    
 
2759
 
2106
2760
    >>> rfc3339_duration_to_delta("P7D")
2107
2761
    datetime.timedelta(7)
2108
2762
    >>> rfc3339_duration_to_delta("PT60S")
2118
2772
    >>> rfc3339_duration_to_delta("P1DT3M20S")
2119
2773
    datetime.timedelta(1, 200)
2120
2774
    """
2121
 
    
 
2775
 
2122
2776
    # Parsing an RFC 3339 duration with regular expressions is not
2123
2777
    # possible - there would have to be multiple places for the same
2124
2778
    # values, like seconds.  The current code, while more esoteric, is
2125
2779
    # cleaner without depending on a parsing library.  If Python had a
2126
2780
    # built-in library for parsing we would use it, but we'd like to
2127
2781
    # avoid excessive use of external libraries.
2128
 
    
 
2782
 
2129
2783
    # New type for defining tokens, syntax, and semantics all-in-one
2130
 
    Token = collections.namedtuple("Token",
2131
 
                                   ("regexp", # To match token; if
2132
 
                                              # "value" is not None,
2133
 
                                              # must have a "group"
2134
 
                                              # containing digits
2135
 
                                    "value",  # datetime.timedelta or
2136
 
                                              # None
2137
 
                                    "followers")) # Tokens valid after
2138
 
                                                  # this token
 
2784
    Token = collections.namedtuple("Token", (
 
2785
        "regexp",  # To match token; if "value" is not None, must have
 
2786
                   # a "group" containing digits
 
2787
        "value",   # datetime.timedelta or None
 
2788
        "followers"))           # Tokens valid after this token
2139
2789
    # RFC 3339 "duration" tokens, syntax, and semantics; taken from
2140
2790
    # the "duration" ABNF definition in RFC 3339, Appendix A.
2141
2791
    token_end = Token(re.compile(r"$"), None, frozenset())
2142
2792
    token_second = Token(re.compile(r"(\d+)S"),
2143
2793
                         datetime.timedelta(seconds=1),
2144
 
                         frozenset((token_end,)))
 
2794
                         frozenset((token_end, )))
2145
2795
    token_minute = Token(re.compile(r"(\d+)M"),
2146
2796
                         datetime.timedelta(minutes=1),
2147
2797
                         frozenset((token_second, token_end)))
2163
2813
                       frozenset((token_month, token_end)))
2164
2814
    token_week = Token(re.compile(r"(\d+)W"),
2165
2815
                       datetime.timedelta(weeks=1),
2166
 
                       frozenset((token_end,)))
 
2816
                       frozenset((token_end, )))
2167
2817
    token_duration = Token(re.compile(r"P"), None,
2168
2818
                           frozenset((token_year, token_month,
2169
2819
                                      token_day, token_time,
2170
 
                                      token_week))),
2171
 
    # Define starting values
2172
 
    value = datetime.timedelta() # Value so far
 
2820
                                      token_week)))
 
2821
    # Define starting values:
 
2822
    # Value so far
 
2823
    value = datetime.timedelta()
2173
2824
    found_token = None
2174
 
    followers = frozenset(token_duration,) # Following valid tokens
2175
 
    s = duration                # String left to parse
 
2825
    # Following valid tokens
 
2826
    followers = frozenset((token_duration, ))
 
2827
    # String left to parse
 
2828
    s = duration
2176
2829
    # Loop until end token is found
2177
2830
    while found_token is not token_end:
2178
2831
        # Search for any currently valid tokens
2194
2847
                break
2195
2848
        else:
2196
2849
            # No currently valid tokens were found
2197
 
            raise ValueError("Invalid RFC 3339 duration")
 
2850
            raise ValueError("Invalid RFC 3339 duration: {!r}"
 
2851
                             .format(duration))
2198
2852
    # End token found
2199
2853
    return value
2200
2854
 
2201
2855
 
2202
2856
def string_to_delta(interval):
2203
2857
    """Parse a string and return a datetime.timedelta
2204
 
    
 
2858
 
2205
2859
    >>> string_to_delta('7d')
2206
2860
    datetime.timedelta(7)
2207
2861
    >>> string_to_delta('60s')
2215
2869
    >>> string_to_delta('5m 30s')
2216
2870
    datetime.timedelta(0, 330)
2217
2871
    """
2218
 
    
 
2872
 
2219
2873
    try:
2220
2874
        return rfc3339_duration_to_delta(interval)
2221
2875
    except ValueError:
2222
2876
        pass
2223
 
    
 
2877
 
2224
2878
    timevalue = datetime.timedelta(0)
2225
2879
    for s in interval.split():
2226
2880
        try:
2227
 
            suffix = unicode(s[-1])
 
2881
            suffix = s[-1]
2228
2882
            value = int(s[:-1])
2229
2883
            if suffix == "d":
2230
2884
                delta = datetime.timedelta(value)
2237
2891
            elif suffix == "w":
2238
2892
                delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
2239
2893
            else:
2240
 
                raise ValueError("Unknown suffix {0!r}"
2241
 
                                 .format(suffix))
2242
 
        except (ValueError, IndexError) as e:
 
2894
                raise ValueError("Unknown suffix {!r}".format(suffix))
 
2895
        except IndexError as e:
2243
2896
            raise ValueError(*(e.args))
2244
2897
        timevalue += delta
2245
2898
    return timevalue
2246
2899
 
2247
2900
 
2248
 
def daemon(nochdir = False, noclose = False):
 
2901
def daemon(nochdir=False, noclose=False):
2249
2902
    """See daemon(3).  Standard BSD Unix function.
2250
 
    
 
2903
 
2251
2904
    This should really exist as os.daemon, but it doesn't (yet)."""
2252
2905
    if os.fork():
2253
2906
        sys.exit()
2261
2914
        null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2262
2915
        if not stat.S_ISCHR(os.fstat(null).st_mode):
2263
2916
            raise OSError(errno.ENODEV,
2264
 
                          "{0} not a character device"
 
2917
                          "{} not a character device"
2265
2918
                          .format(os.devnull))
2266
2919
        os.dup2(null, sys.stdin.fileno())
2267
2920
        os.dup2(null, sys.stdout.fileno())
2271
2924
 
2272
2925
 
2273
2926
def main():
2274
 
    
 
2927
 
2275
2928
    ##################################################################
2276
2929
    # Parsing of options, both command line and config file
2277
 
    
 
2930
 
2278
2931
    parser = argparse.ArgumentParser()
2279
2932
    parser.add_argument("-v", "--version", action="version",
2280
 
                        version = "%(prog)s {0}".format(version),
 
2933
                        version="%(prog)s {}".format(version),
2281
2934
                        help="show version number and exit")
2282
2935
    parser.add_argument("-i", "--interface", metavar="IF",
2283
2936
                        help="Bind to interface IF")
2289
2942
                        help="Run self-test")
2290
2943
    parser.add_argument("--debug", action="store_true",
2291
2944
                        help="Debug mode; run in foreground and log"
2292
 
                        " to terminal")
 
2945
                        " to terminal", default=None)
2293
2946
    parser.add_argument("--debuglevel", metavar="LEVEL",
2294
2947
                        help="Debug level for stdout output")
2295
2948
    parser.add_argument("--priority", help="GnuTLS"
2302
2955
                        " files")
2303
2956
    parser.add_argument("--no-dbus", action="store_false",
2304
2957
                        dest="use_dbus", help="Do not provide D-Bus"
2305
 
                        " system bus interface")
 
2958
                        " system bus interface", default=None)
2306
2959
    parser.add_argument("--no-ipv6", action="store_false",
2307
 
                        dest="use_ipv6", help="Do not use IPv6")
 
2960
                        dest="use_ipv6", help="Do not use IPv6",
 
2961
                        default=None)
2308
2962
    parser.add_argument("--no-restore", action="store_false",
2309
2963
                        dest="restore", help="Do not restore stored"
2310
 
                        " state")
 
2964
                        " state", default=None)
2311
2965
    parser.add_argument("--socket", type=int,
2312
2966
                        help="Specify a file descriptor to a network"
2313
2967
                        " socket to use instead of creating one")
2314
2968
    parser.add_argument("--statedir", metavar="DIR",
2315
2969
                        help="Directory to save/restore state in")
2316
2970
    parser.add_argument("--foreground", action="store_true",
2317
 
                        help="Run in foreground")
2318
 
    
 
2971
                        help="Run in foreground", default=None)
 
2972
    parser.add_argument("--no-zeroconf", action="store_false",
 
2973
                        dest="zeroconf", help="Do not use Zeroconf",
 
2974
                        default=None)
 
2975
 
2319
2976
    options = parser.parse_args()
2320
 
    
 
2977
 
2321
2978
    if options.check:
2322
2979
        import doctest
2323
 
        doctest.testmod()
2324
 
        sys.exit()
2325
 
    
 
2980
        fail_count, test_count = doctest.testmod()
 
2981
        sys.exit(os.EX_OK if fail_count == 0 else 1)
 
2982
 
2326
2983
    # Default values for config file for server-global settings
2327
 
    server_defaults = { "interface": "",
2328
 
                        "address": "",
2329
 
                        "port": "",
2330
 
                        "debug": "False",
2331
 
                        "priority":
2332
 
                        "SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
2333
 
                        "servicename": "Mandos",
2334
 
                        "use_dbus": "True",
2335
 
                        "use_ipv6": "True",
2336
 
                        "debuglevel": "",
2337
 
                        "restore": "True",
2338
 
                        "socket": "",
2339
 
                        "statedir": "/var/lib/mandos",
2340
 
                        "foreground": "False",
2341
 
                        }
2342
 
    
 
2984
    if gnutls.has_rawpk:
 
2985
        priority = ("SECURE128:!CTYPE-X.509:+CTYPE-RAWPK:!RSA"
 
2986
                    ":!VERS-ALL:+VERS-TLS1.3:%PROFILE_ULTRA")
 
2987
    else:
 
2988
        priority = ("SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
 
2989
                    ":+SIGN-DSA-SHA256")
 
2990
    server_defaults = {"interface": "",
 
2991
                       "address": "",
 
2992
                       "port": "",
 
2993
                       "debug": "False",
 
2994
                       "priority": priority,
 
2995
                       "servicename": "Mandos",
 
2996
                       "use_dbus": "True",
 
2997
                       "use_ipv6": "True",
 
2998
                       "debuglevel": "",
 
2999
                       "restore": "True",
 
3000
                       "socket": "",
 
3001
                       "statedir": "/var/lib/mandos",
 
3002
                       "foreground": "False",
 
3003
                       "zeroconf": "True",
 
3004
                       }
 
3005
    del priority
 
3006
 
2343
3007
    # Parse config file for server-global settings
2344
 
    server_config = configparser.SafeConfigParser(server_defaults)
 
3008
    server_config = configparser.ConfigParser(server_defaults)
2345
3009
    del server_defaults
2346
 
    server_config.read(os.path.join(options.configdir,
2347
 
                                    "mandos.conf"))
2348
 
    # Convert the SafeConfigParser object to a dict
 
3010
    server_config.read(os.path.join(options.configdir, "mandos.conf"))
 
3011
    # Convert the ConfigParser object to a dict
2349
3012
    server_settings = server_config.defaults()
2350
3013
    # Use the appropriate methods on the non-string config options
2351
 
    for option in ("debug", "use_dbus", "use_ipv6", "foreground"):
 
3014
    for option in ("debug", "use_dbus", "use_ipv6", "restore",
 
3015
                   "foreground", "zeroconf"):
2352
3016
        server_settings[option] = server_config.getboolean("DEFAULT",
2353
3017
                                                           option)
2354
3018
    if server_settings["port"]:
2364
3028
            server_settings["socket"] = os.dup(server_settings
2365
3029
                                               ["socket"])
2366
3030
    del server_config
2367
 
    
 
3031
 
2368
3032
    # Override the settings from the config file with command line
2369
3033
    # options, if set.
2370
3034
    for option in ("interface", "address", "port", "debug",
2371
 
                   "priority", "servicename", "configdir",
2372
 
                   "use_dbus", "use_ipv6", "debuglevel", "restore",
2373
 
                   "statedir", "socket", "foreground"):
 
3035
                   "priority", "servicename", "configdir", "use_dbus",
 
3036
                   "use_ipv6", "debuglevel", "restore", "statedir",
 
3037
                   "socket", "foreground", "zeroconf"):
2374
3038
        value = getattr(options, option)
2375
3039
        if value is not None:
2376
3040
            server_settings[option] = value
2377
3041
    del options
2378
3042
    # Force all strings to be unicode
2379
3043
    for option in server_settings.keys():
2380
 
        if type(server_settings[option]) is str:
2381
 
            server_settings[option] = unicode(server_settings[option])
 
3044
        if isinstance(server_settings[option], bytes):
 
3045
            server_settings[option] = (server_settings[option]
 
3046
                                       .decode("utf-8"))
 
3047
    # Force all boolean options to be boolean
 
3048
    for option in ("debug", "use_dbus", "use_ipv6", "restore",
 
3049
                   "foreground", "zeroconf"):
 
3050
        server_settings[option] = bool(server_settings[option])
2382
3051
    # Debug implies foreground
2383
3052
    if server_settings["debug"]:
2384
3053
        server_settings["foreground"] = True
2385
3054
    # Now we have our good server settings in "server_settings"
2386
 
    
 
3055
 
2387
3056
    ##################################################################
2388
 
    
 
3057
 
 
3058
    if (not server_settings["zeroconf"]
 
3059
        and not (server_settings["port"]
 
3060
                 or server_settings["socket"] != "")):
 
3061
        parser.error("Needs port or socket to work without Zeroconf")
 
3062
 
2389
3063
    # For convenience
2390
3064
    debug = server_settings["debug"]
2391
3065
    debuglevel = server_settings["debuglevel"]
2394
3068
    stored_state_path = os.path.join(server_settings["statedir"],
2395
3069
                                     stored_state_file)
2396
3070
    foreground = server_settings["foreground"]
2397
 
    
 
3071
    zeroconf = server_settings["zeroconf"]
 
3072
 
2398
3073
    if debug:
2399
3074
        initlogger(debug, logging.DEBUG)
2400
3075
    else:
2403
3078
        else:
2404
3079
            level = getattr(logging, debuglevel.upper())
2405
3080
            initlogger(debug, level)
2406
 
    
 
3081
 
2407
3082
    if server_settings["servicename"] != "Mandos":
2408
 
        syslogger.setFormatter(logging.Formatter
2409
 
                               ('Mandos ({0}) [%(process)d]:'
2410
 
                                ' %(levelname)s: %(message)s'
2411
 
                                .format(server_settings
2412
 
                                        ["servicename"])))
2413
 
    
 
3083
        syslogger.setFormatter(
 
3084
            logging.Formatter('Mandos ({}) [%(process)d]:'
 
3085
                              ' %(levelname)s: %(message)s'.format(
 
3086
                                  server_settings["servicename"])))
 
3087
 
2414
3088
    # Parse config file with clients
2415
 
    client_config = configparser.SafeConfigParser(Client
2416
 
                                                  .client_defaults)
 
3089
    client_config = configparser.ConfigParser(Client.client_defaults)
2417
3090
    client_config.read(os.path.join(server_settings["configdir"],
2418
3091
                                    "clients.conf"))
2419
 
    
 
3092
 
2420
3093
    global mandos_dbus_service
2421
3094
    mandos_dbus_service = None
2422
 
    
2423
 
    tcp_server = MandosServer((server_settings["address"],
2424
 
                               server_settings["port"]),
2425
 
                              ClientHandler,
2426
 
                              interface=(server_settings["interface"]
2427
 
                                         or None),
2428
 
                              use_ipv6=use_ipv6,
2429
 
                              gnutls_priority=
2430
 
                              server_settings["priority"],
2431
 
                              use_dbus=use_dbus,
2432
 
                              socketfd=(server_settings["socket"]
2433
 
                                        or None))
 
3095
 
 
3096
    socketfd = None
 
3097
    if server_settings["socket"] != "":
 
3098
        socketfd = server_settings["socket"]
 
3099
    tcp_server = MandosServer(
 
3100
        (server_settings["address"], server_settings["port"]),
 
3101
        ClientHandler,
 
3102
        interface=(server_settings["interface"] or None),
 
3103
        use_ipv6=use_ipv6,
 
3104
        gnutls_priority=server_settings["priority"],
 
3105
        use_dbus=use_dbus,
 
3106
        socketfd=socketfd)
2434
3107
    if not foreground:
2435
 
        pidfilename = "/var/run/mandos.pid"
 
3108
        pidfilename = "/run/mandos.pid"
 
3109
        if not os.path.isdir("/run/."):
 
3110
            pidfilename = "/var/run/mandos.pid"
2436
3111
        pidfile = None
2437
3112
        try:
2438
 
            pidfile = open(pidfilename, "w")
 
3113
            pidfile = codecs.open(pidfilename, "w", encoding="utf-8")
2439
3114
        except IOError as e:
2440
3115
            logger.error("Could not open file %r", pidfilename,
2441
3116
                         exc_info=e)
2442
 
    
2443
 
    for name in ("_mandos", "mandos", "nobody"):
 
3117
 
 
3118
    for name, group in (("_mandos", "_mandos"),
 
3119
                        ("mandos", "mandos"),
 
3120
                        ("nobody", "nogroup")):
2444
3121
        try:
2445
3122
            uid = pwd.getpwnam(name).pw_uid
2446
 
            gid = pwd.getpwnam(name).pw_gid
 
3123
            gid = pwd.getpwnam(group).pw_gid
2447
3124
            break
2448
3125
        except KeyError:
2449
3126
            continue
2453
3130
    try:
2454
3131
        os.setgid(gid)
2455
3132
        os.setuid(uid)
 
3133
        if debug:
 
3134
            logger.debug("Did setuid/setgid to {}:{}".format(uid,
 
3135
                                                             gid))
2456
3136
    except OSError as error:
 
3137
        logger.warning("Failed to setuid/setgid to {}:{}: {}"
 
3138
                       .format(uid, gid, os.strerror(error.errno)))
2457
3139
        if error.errno != errno.EPERM:
2458
 
            raise error
2459
 
    
 
3140
            raise
 
3141
 
2460
3142
    if debug:
2461
3143
        # Enable all possible GnuTLS debugging
2462
 
        
 
3144
 
2463
3145
        # "Use a log level over 10 to enable all debugging options."
2464
3146
        # - GnuTLS manual
2465
 
        gnutls.library.functions.gnutls_global_set_log_level(11)
2466
 
        
2467
 
        @gnutls.library.types.gnutls_log_func
 
3147
        gnutls.global_set_log_level(11)
 
3148
 
 
3149
        @gnutls.log_func
2468
3150
        def debug_gnutls(level, string):
2469
3151
            logger.debug("GnuTLS: %s", string[:-1])
2470
 
        
2471
 
        (gnutls.library.functions
2472
 
         .gnutls_global_set_log_function(debug_gnutls))
2473
 
        
 
3152
 
 
3153
        gnutls.global_set_log_function(debug_gnutls)
 
3154
 
2474
3155
        # Redirect stdin so all checkers get /dev/null
2475
3156
        null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2476
3157
        os.dup2(null, sys.stdin.fileno())
2477
3158
        if null > 2:
2478
3159
            os.close(null)
2479
 
    
 
3160
 
2480
3161
    # Need to fork before connecting to D-Bus
2481
3162
    if not foreground:
2482
3163
        # Close all input and output, do double fork, etc.
2483
3164
        daemon()
2484
 
    
2485
 
    # multiprocessing will use threads, so before we use gobject we
2486
 
    # need to inform gobject that threads will be used.
2487
 
    gobject.threads_init()
2488
 
    
 
3165
 
 
3166
    if gi.version_info < (3, 10, 2):
 
3167
        # multiprocessing will use threads, so before we use GLib we
 
3168
        # need to inform GLib that threads will be used.
 
3169
        GLib.threads_init()
 
3170
 
2489
3171
    global main_loop
2490
3172
    # From the Avahi example code
2491
3173
    DBusGMainLoop(set_as_default=True)
2492
 
    main_loop = gobject.MainLoop()
 
3174
    main_loop = GLib.MainLoop()
2493
3175
    bus = dbus.SystemBus()
2494
3176
    # End of Avahi example code
2495
3177
    if use_dbus:
2496
3178
        try:
2497
3179
            bus_name = dbus.service.BusName("se.recompile.Mandos",
2498
 
                                            bus, do_not_queue=True)
2499
 
            old_bus_name = (dbus.service.BusName
2500
 
                            ("se.bsnet.fukt.Mandos", bus,
2501
 
                             do_not_queue=True))
2502
 
        except dbus.exceptions.NameExistsException as e:
 
3180
                                            bus,
 
3181
                                            do_not_queue=True)
 
3182
            old_bus_name = dbus.service.BusName(
 
3183
                "se.bsnet.fukt.Mandos", bus,
 
3184
                do_not_queue=True)
 
3185
        except dbus.exceptions.DBusException as e:
2503
3186
            logger.error("Disabling D-Bus:", exc_info=e)
2504
3187
            use_dbus = False
2505
3188
            server_settings["use_dbus"] = False
2506
3189
            tcp_server.use_dbus = False
2507
 
    protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2508
 
    service = AvahiServiceToSyslog(name =
2509
 
                                   server_settings["servicename"],
2510
 
                                   servicetype = "_mandos._tcp",
2511
 
                                   protocol = protocol, bus = bus)
2512
 
    if server_settings["interface"]:
2513
 
        service.interface = (if_nametoindex
2514
 
                             (str(server_settings["interface"])))
2515
 
    
 
3190
    if zeroconf:
 
3191
        protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
 
3192
        service = AvahiServiceToSyslog(
 
3193
            name=server_settings["servicename"],
 
3194
            servicetype="_mandos._tcp",
 
3195
            protocol=protocol,
 
3196
            bus=bus)
 
3197
        if server_settings["interface"]:
 
3198
            service.interface = if_nametoindex(
 
3199
                server_settings["interface"].encode("utf-8"))
 
3200
 
2516
3201
    global multiprocessing_manager
2517
3202
    multiprocessing_manager = multiprocessing.Manager()
2518
 
    
 
3203
 
2519
3204
    client_class = Client
2520
3205
    if use_dbus:
2521
 
        client_class = functools.partial(ClientDBus, bus = bus)
2522
 
    
 
3206
        client_class = functools.partial(ClientDBus, bus=bus)
 
3207
 
2523
3208
    client_settings = Client.config_parser(client_config)
2524
3209
    old_client_settings = {}
2525
3210
    clients_data = {}
2526
 
    
 
3211
 
 
3212
    # This is used to redirect stdout and stderr for checker processes
 
3213
    global wnull
 
3214
    wnull = open(os.devnull, "w")  # A writable /dev/null
 
3215
    # Only used if server is running in foreground but not in debug
 
3216
    # mode
 
3217
    if debug or not foreground:
 
3218
        wnull.close()
 
3219
 
2527
3220
    # Get client data and settings from last running state.
2528
3221
    if server_settings["restore"]:
2529
3222
        try:
2530
3223
            with open(stored_state_path, "rb") as stored_state:
2531
 
                clients_data, old_client_settings = (pickle.load
2532
 
                                                     (stored_state))
 
3224
                if sys.version_info.major == 2:
 
3225
                    clients_data, old_client_settings = pickle.load(
 
3226
                        stored_state)
 
3227
                else:
 
3228
                    bytes_clients_data, bytes_old_client_settings = (
 
3229
                        pickle.load(stored_state, encoding="bytes"))
 
3230
                    #   Fix bytes to strings
 
3231
                    #  clients_data
 
3232
                    # .keys()
 
3233
                    clients_data = {(key.decode("utf-8")
 
3234
                                     if isinstance(key, bytes)
 
3235
                                     else key): value
 
3236
                                    for key, value in
 
3237
                                    bytes_clients_data.items()}
 
3238
                    del bytes_clients_data
 
3239
                    for key in clients_data:
 
3240
                        value = {(k.decode("utf-8")
 
3241
                                  if isinstance(k, bytes) else k): v
 
3242
                                 for k, v in
 
3243
                                 clients_data[key].items()}
 
3244
                        clients_data[key] = value
 
3245
                        # .client_structure
 
3246
                        value["client_structure"] = [
 
3247
                            (s.decode("utf-8")
 
3248
                             if isinstance(s, bytes)
 
3249
                             else s) for s in
 
3250
                            value["client_structure"]]
 
3251
                        # .name & .host
 
3252
                        for k in ("name", "host"):
 
3253
                            if isinstance(value[k], bytes):
 
3254
                                value[k] = value[k].decode("utf-8")
 
3255
                        if "key_id" not in value:
 
3256
                            value["key_id"] = ""
 
3257
                        elif "fingerprint" not in value:
 
3258
                            value["fingerprint"] = ""
 
3259
                    #  old_client_settings
 
3260
                    # .keys()
 
3261
                    old_client_settings = {
 
3262
                        (key.decode("utf-8")
 
3263
                         if isinstance(key, bytes)
 
3264
                         else key): value
 
3265
                        for key, value in
 
3266
                        bytes_old_client_settings.items()}
 
3267
                    del bytes_old_client_settings
 
3268
                    # .host
 
3269
                    for value in old_client_settings.values():
 
3270
                        if isinstance(value["host"], bytes):
 
3271
                            value["host"] = (value["host"]
 
3272
                                             .decode("utf-8"))
2533
3273
            os.remove(stored_state_path)
2534
3274
        except IOError as e:
2535
3275
            if e.errno == errno.ENOENT:
2536
 
                logger.warning("Could not load persistent state: {0}"
2537
 
                                .format(os.strerror(e.errno)))
 
3276
                logger.warning("Could not load persistent state:"
 
3277
                               " {}".format(os.strerror(e.errno)))
2538
3278
            else:
2539
3279
                logger.critical("Could not load persistent state:",
2540
3280
                                exc_info=e)
2541
3281
                raise
2542
3282
        except EOFError as e:
2543
3283
            logger.warning("Could not load persistent state: "
2544
 
                           "EOFError:", exc_info=e)
2545
 
    
 
3284
                           "EOFError:",
 
3285
                           exc_info=e)
 
3286
 
2546
3287
    with PGPEngine() as pgp:
2547
 
        for client_name, client in clients_data.iteritems():
 
3288
        for client_name, client in clients_data.items():
 
3289
            # Skip removed clients
 
3290
            if client_name not in client_settings:
 
3291
                continue
 
3292
 
2548
3293
            # Decide which value to use after restoring saved state.
2549
3294
            # We have three different values: Old config file,
2550
3295
            # new config file, and saved state.
2555
3300
                    # For each value in new config, check if it
2556
3301
                    # differs from the old config value (Except for
2557
3302
                    # the "secret" attribute)
2558
 
                    if (name != "secret" and
2559
 
                        value != old_client_settings[client_name]
2560
 
                        [name]):
 
3303
                    if (name != "secret"
 
3304
                        and (value !=
 
3305
                             old_client_settings[client_name][name])):
2561
3306
                        client[name] = value
2562
3307
                except KeyError:
2563
3308
                    pass
2564
 
            
 
3309
 
2565
3310
            # Clients who has passed its expire date can still be
2566
 
            # enabled if its last checker was successful.  Clients
 
3311
            # enabled if its last checker was successful.  A Client
2567
3312
            # whose checker succeeded before we stored its state is
2568
3313
            # assumed to have successfully run all checkers during
2569
3314
            # downtime.
2571
3316
                if datetime.datetime.utcnow() >= client["expires"]:
2572
3317
                    if not client["last_checked_ok"]:
2573
3318
                        logger.warning(
2574
 
                            "disabling client {0} - Client never "
2575
 
                            "performed a successful checker"
2576
 
                            .format(client_name))
 
3319
                            "disabling client {} - Client never "
 
3320
                            "performed a successful checker".format(
 
3321
                                client_name))
2577
3322
                        client["enabled"] = False
2578
3323
                    elif client["last_checker_status"] != 0:
2579
3324
                        logger.warning(
2580
 
                            "disabling client {0} - Client "
2581
 
                            "last checker failed with error code {1}"
2582
 
                            .format(client_name,
2583
 
                                    client["last_checker_status"]))
 
3325
                            "disabling client {} - Client last"
 
3326
                            " checker failed with error code"
 
3327
                            " {}".format(
 
3328
                                client_name,
 
3329
                                client["last_checker_status"]))
2584
3330
                        client["enabled"] = False
2585
3331
                    else:
2586
 
                        client["expires"] = (datetime.datetime
2587
 
                                             .utcnow()
2588
 
                                             + client["timeout"])
 
3332
                        client["expires"] = (
 
3333
                            datetime.datetime.utcnow()
 
3334
                            + client["timeout"])
2589
3335
                        logger.debug("Last checker succeeded,"
2590
 
                                     " keeping {0} enabled"
2591
 
                                     .format(client_name))
 
3336
                                     " keeping {} enabled".format(
 
3337
                                         client_name))
2592
3338
            try:
2593
 
                client["secret"] = (
2594
 
                    pgp.decrypt(client["encrypted_secret"],
2595
 
                                client_settings[client_name]
2596
 
                                ["secret"]))
 
3339
                client["secret"] = pgp.decrypt(
 
3340
                    client["encrypted_secret"],
 
3341
                    client_settings[client_name]["secret"])
2597
3342
            except PGPError:
2598
3343
                # If decryption fails, we use secret from new settings
2599
 
                logger.debug("Failed to decrypt {0} old secret"
2600
 
                             .format(client_name))
2601
 
                client["secret"] = (
2602
 
                    client_settings[client_name]["secret"])
2603
 
    
 
3344
                logger.debug("Failed to decrypt {} old secret".format(
 
3345
                    client_name))
 
3346
                client["secret"] = (client_settings[client_name]
 
3347
                                    ["secret"])
 
3348
 
2604
3349
    # Add/remove clients based on new changes made to config
2605
3350
    for client_name in (set(old_client_settings)
2606
3351
                        - set(client_settings)):
2608
3353
    for client_name in (set(client_settings)
2609
3354
                        - set(old_client_settings)):
2610
3355
        clients_data[client_name] = client_settings[client_name]
2611
 
    
 
3356
 
2612
3357
    # Create all client objects
2613
 
    for client_name, client in clients_data.iteritems():
 
3358
    for client_name, client in clients_data.items():
2614
3359
        tcp_server.clients[client_name] = client_class(
2615
 
            name = client_name, settings = client)
2616
 
    
 
3360
            name=client_name,
 
3361
            settings=client,
 
3362
            server_settings=server_settings)
 
3363
 
2617
3364
    if not tcp_server.clients:
2618
3365
        logger.warning("No clients defined")
2619
 
    
 
3366
 
2620
3367
    if not foreground:
2621
3368
        if pidfile is not None:
 
3369
            pid = os.getpid()
2622
3370
            try:
2623
3371
                with pidfile:
2624
 
                    pid = os.getpid()
2625
 
                    pidfile.write(str(pid) + "\n".encode("utf-8"))
 
3372
                    print(pid, file=pidfile)
2626
3373
            except IOError:
2627
3374
                logger.error("Could not write to file %r with PID %d",
2628
3375
                             pidfilename, pid)
2629
3376
        del pidfile
2630
3377
        del pidfilename
2631
 
    
2632
 
    signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2633
 
    signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
2634
 
    
 
3378
 
 
3379
    for termsig in (signal.SIGHUP, signal.SIGTERM):
 
3380
        GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,
 
3381
                             lambda: main_loop.quit() and False)
 
3382
 
2635
3383
    if use_dbus:
2636
 
        @alternate_dbus_interfaces({"se.recompile.Mandos":
2637
 
                                        "se.bsnet.fukt.Mandos"})
2638
 
        class MandosDBusService(DBusObjectWithProperties):
 
3384
 
 
3385
        @alternate_dbus_interfaces(
 
3386
            {"se.recompile.Mandos": "se.bsnet.fukt.Mandos"})
 
3387
        class MandosDBusService(DBusObjectWithObjectManager):
2639
3388
            """A D-Bus proxy object"""
 
3389
 
2640
3390
            def __init__(self):
2641
3391
                dbus.service.Object.__init__(self, bus, "/")
 
3392
 
2642
3393
            _interface = "se.recompile.Mandos"
2643
 
            
2644
 
            @dbus_interface_annotations(_interface)
2645
 
            def _foo(self):
2646
 
                return { "org.freedesktop.DBus.Property"
2647
 
                         ".EmitsChangedSignal":
2648
 
                             "false"}
2649
 
            
 
3394
 
2650
3395
            @dbus.service.signal(_interface, signature="o")
2651
3396
            def ClientAdded(self, objpath):
2652
3397
                "D-Bus signal"
2653
3398
                pass
2654
 
            
 
3399
 
2655
3400
            @dbus.service.signal(_interface, signature="ss")
2656
 
            def ClientNotFound(self, fingerprint, address):
 
3401
            def ClientNotFound(self, key_id, address):
2657
3402
                "D-Bus signal"
2658
3403
                pass
2659
 
            
 
3404
 
 
3405
            @dbus_annotations({"org.freedesktop.DBus.Deprecated":
 
3406
                               "true"})
2660
3407
            @dbus.service.signal(_interface, signature="os")
2661
3408
            def ClientRemoved(self, objpath, name):
2662
3409
                "D-Bus signal"
2663
3410
                pass
2664
 
            
 
3411
 
 
3412
            @dbus_annotations({"org.freedesktop.DBus.Deprecated":
 
3413
                               "true"})
2665
3414
            @dbus.service.method(_interface, out_signature="ao")
2666
3415
            def GetAllClients(self):
2667
3416
                "D-Bus method"
2668
 
                return dbus.Array(c.dbus_object_path
2669
 
                                  for c in
2670
 
                                  tcp_server.clients.itervalues())
2671
 
            
 
3417
                return dbus.Array(c.dbus_object_path for c in
 
3418
                                  tcp_server.clients.values())
 
3419
 
 
3420
            @dbus_annotations({"org.freedesktop.DBus.Deprecated":
 
3421
                               "true"})
2672
3422
            @dbus.service.method(_interface,
2673
3423
                                 out_signature="a{oa{sv}}")
2674
3424
            def GetAllClientsWithProperties(self):
2675
3425
                "D-Bus method"
2676
3426
                return dbus.Dictionary(
2677
 
                    ((c.dbus_object_path, c.GetAll(""))
2678
 
                     for c in tcp_server.clients.itervalues()),
 
3427
                    {c.dbus_object_path: c.GetAll(
 
3428
                        "se.recompile.Mandos.Client")
 
3429
                     for c in tcp_server.clients.values()},
2679
3430
                    signature="oa{sv}")
2680
 
            
 
3431
 
2681
3432
            @dbus.service.method(_interface, in_signature="o")
2682
3433
            def RemoveClient(self, object_path):
2683
3434
                "D-Bus method"
2684
 
                for c in tcp_server.clients.itervalues():
 
3435
                for c in tcp_server.clients.values():
2685
3436
                    if c.dbus_object_path == object_path:
2686
3437
                        del tcp_server.clients[c.name]
2687
3438
                        c.remove_from_connection()
2688
 
                        # Don't signal anything except ClientRemoved
 
3439
                        # Don't signal the disabling
2689
3440
                        c.disable(quiet=True)
2690
 
                        # Emit D-Bus signal
2691
 
                        self.ClientRemoved(object_path, c.name)
 
3441
                        # Emit D-Bus signal for removal
 
3442
                        self.client_removed_signal(c)
2692
3443
                        return
2693
3444
                raise KeyError(object_path)
2694
 
            
 
3445
 
2695
3446
            del _interface
2696
 
        
 
3447
 
 
3448
            @dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
 
3449
                                 out_signature="a{oa{sa{sv}}}")
 
3450
            def GetManagedObjects(self):
 
3451
                """D-Bus method"""
 
3452
                return dbus.Dictionary(
 
3453
                    {client.dbus_object_path:
 
3454
                     dbus.Dictionary(
 
3455
                         {interface: client.GetAll(interface)
 
3456
                          for interface in
 
3457
                          client._get_all_interface_names()})
 
3458
                     for client in tcp_server.clients.values()})
 
3459
 
 
3460
            def client_added_signal(self, client):
 
3461
                """Send the new standard signal and the old signal"""
 
3462
                if use_dbus:
 
3463
                    # New standard signal
 
3464
                    self.InterfacesAdded(
 
3465
                        client.dbus_object_path,
 
3466
                        dbus.Dictionary(
 
3467
                            {interface: client.GetAll(interface)
 
3468
                             for interface in
 
3469
                             client._get_all_interface_names()}))
 
3470
                    # Old signal
 
3471
                    self.ClientAdded(client.dbus_object_path)
 
3472
 
 
3473
            def client_removed_signal(self, client):
 
3474
                """Send the new standard signal and the old signal"""
 
3475
                if use_dbus:
 
3476
                    # New standard signal
 
3477
                    self.InterfacesRemoved(
 
3478
                        client.dbus_object_path,
 
3479
                        client._get_all_interface_names())
 
3480
                    # Old signal
 
3481
                    self.ClientRemoved(client.dbus_object_path,
 
3482
                                       client.name)
 
3483
 
2697
3484
        mandos_dbus_service = MandosDBusService()
2698
 
    
 
3485
 
 
3486
    # Save modules to variables to exempt the modules from being
 
3487
    # unloaded before the function registered with atexit() is run.
 
3488
    mp = multiprocessing
 
3489
    wn = wnull
 
3490
 
2699
3491
    def cleanup():
2700
3492
        "Cleanup function; run on exit"
2701
 
        service.cleanup()
2702
 
        
2703
 
        multiprocessing.active_children()
 
3493
        if zeroconf:
 
3494
            service.cleanup()
 
3495
 
 
3496
        mp.active_children()
 
3497
        wn.close()
2704
3498
        if not (tcp_server.clients or client_settings):
2705
3499
            return
2706
 
        
 
3500
 
2707
3501
        # Store client before exiting. Secrets are encrypted with key
2708
3502
        # based on what config file has. If config file is
2709
3503
        # removed/edited, old secret will thus be unrecovable.
2710
3504
        clients = {}
2711
3505
        with PGPEngine() as pgp:
2712
 
            for client in tcp_server.clients.itervalues():
 
3506
            for client in tcp_server.clients.values():
2713
3507
                key = client_settings[client.name]["secret"]
2714
3508
                client.encrypted_secret = pgp.encrypt(client.secret,
2715
3509
                                                      key)
2716
3510
                client_dict = {}
2717
 
                
 
3511
 
2718
3512
                # A list of attributes that can not be pickled
2719
3513
                # + secret.
2720
 
                exclude = set(("bus", "changedstate", "secret",
2721
 
                               "checker"))
2722
 
                for name, typ in (inspect.getmembers
2723
 
                                  (dbus.service.Object)):
 
3514
                exclude = {"bus", "changedstate", "secret",
 
3515
                           "checker", "server_settings"}
 
3516
                for name, typ in inspect.getmembers(dbus.service
 
3517
                                                    .Object):
2724
3518
                    exclude.add(name)
2725
 
                
 
3519
 
2726
3520
                client_dict["encrypted_secret"] = (client
2727
3521
                                                   .encrypted_secret)
2728
3522
                for attr in client.client_structure:
2729
3523
                    if attr not in exclude:
2730
3524
                        client_dict[attr] = getattr(client, attr)
2731
 
                
 
3525
 
2732
3526
                clients[client.name] = client_dict
2733
3527
                del client_settings[client.name]["secret"]
2734
 
        
 
3528
 
2735
3529
        try:
2736
 
            with (tempfile.NamedTemporaryFile
2737
 
                  (mode='wb', suffix=".pickle", prefix='clients-',
2738
 
                   dir=os.path.dirname(stored_state_path),
2739
 
                   delete=False)) as stored_state:
2740
 
                pickle.dump((clients, client_settings), stored_state)
2741
 
                tempname=stored_state.name
 
3530
            with tempfile.NamedTemporaryFile(
 
3531
                    mode='wb',
 
3532
                    suffix=".pickle",
 
3533
                    prefix='clients-',
 
3534
                    dir=os.path.dirname(stored_state_path),
 
3535
                    delete=False) as stored_state:
 
3536
                pickle.dump((clients, client_settings), stored_state,
 
3537
                            protocol=2)
 
3538
                tempname = stored_state.name
2742
3539
            os.rename(tempname, stored_state_path)
2743
3540
        except (IOError, OSError) as e:
2744
3541
            if not debug:
2747
3544
                except NameError:
2748
3545
                    pass
2749
3546
            if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
2750
 
                logger.warning("Could not save persistent state: {0}"
 
3547
                logger.warning("Could not save persistent state: {}"
2751
3548
                               .format(os.strerror(e.errno)))
2752
3549
            else:
2753
3550
                logger.warning("Could not save persistent state:",
2754
3551
                               exc_info=e)
2755
 
                raise e
2756
 
        
 
3552
                raise
 
3553
 
2757
3554
        # Delete all clients, and settings from config
2758
3555
        while tcp_server.clients:
2759
3556
            name, client = tcp_server.clients.popitem()
2760
3557
            if use_dbus:
2761
3558
                client.remove_from_connection()
2762
 
            # Don't signal anything except ClientRemoved
 
3559
            # Don't signal the disabling
2763
3560
            client.disable(quiet=True)
 
3561
            # Emit D-Bus signal for removal
2764
3562
            if use_dbus:
2765
 
                # Emit D-Bus signal
2766
 
                mandos_dbus_service.ClientRemoved(client
2767
 
                                                  .dbus_object_path,
2768
 
                                                  client.name)
 
3563
                mandos_dbus_service.client_removed_signal(client)
2769
3564
        client_settings.clear()
2770
 
    
 
3565
 
2771
3566
    atexit.register(cleanup)
2772
 
    
2773
 
    for client in tcp_server.clients.itervalues():
 
3567
 
 
3568
    for client in tcp_server.clients.values():
2774
3569
        if use_dbus:
2775
 
            # Emit D-Bus signal
2776
 
            mandos_dbus_service.ClientAdded(client.dbus_object_path)
 
3570
            # Emit D-Bus signal for adding
 
3571
            mandos_dbus_service.client_added_signal(client)
2777
3572
        # Need to initiate checking of clients
2778
3573
        if client.enabled:
2779
3574
            client.init_checker()
2780
 
    
 
3575
 
2781
3576
    tcp_server.enable()
2782
3577
    tcp_server.server_activate()
2783
 
    
 
3578
 
2784
3579
    # Find out what port we got
2785
 
    service.port = tcp_server.socket.getsockname()[1]
 
3580
    if zeroconf:
 
3581
        service.port = tcp_server.socket.getsockname()[1]
2786
3582
    if use_ipv6:
2787
3583
        logger.info("Now listening on address %r, port %d,"
2788
3584
                    " flowinfo %d, scope_id %d",
2790
3586
    else:                       # IPv4
2791
3587
        logger.info("Now listening on address %r, port %d",
2792
3588
                    *tcp_server.socket.getsockname())
2793
 
    
2794
 
    #service.interface = tcp_server.socket.getsockname()[3]
2795
 
    
 
3589
 
 
3590
    # service.interface = tcp_server.socket.getsockname()[3]
 
3591
 
2796
3592
    try:
2797
 
        # From the Avahi example code
2798
 
        try:
2799
 
            service.activate()
2800
 
        except dbus.exceptions.DBusException as error:
2801
 
            logger.critical("D-Bus Exception", exc_info=error)
2802
 
            cleanup()
2803
 
            sys.exit(1)
2804
 
        # End of Avahi example code
2805
 
        
2806
 
        gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
2807
 
                             lambda *args, **kwargs:
2808
 
                             (tcp_server.handle_request
2809
 
                              (*args[2:], **kwargs) or True))
2810
 
        
 
3593
        if zeroconf:
 
3594
            # From the Avahi example code
 
3595
            try:
 
3596
                service.activate()
 
3597
            except dbus.exceptions.DBusException as error:
 
3598
                logger.critical("D-Bus Exception", exc_info=error)
 
3599
                cleanup()
 
3600
                sys.exit(1)
 
3601
            # End of Avahi example code
 
3602
 
 
3603
        GLib.io_add_watch(tcp_server.fileno(), GLib.IO_IN,
 
3604
                          lambda *args, **kwargs:
 
3605
                          (tcp_server.handle_request
 
3606
                           (*args[2:], **kwargs) or True))
 
3607
 
2811
3608
        logger.debug("Starting main loop")
2812
3609
        main_loop.run()
2813
3610
    except AvahiError as error:
2822
3619
    # Must run before the D-Bus bus name gets deregistered
2823
3620
    cleanup()
2824
3621
 
 
3622
 
2825
3623
if __name__ == '__main__':
2826
3624
    main()