/mandos/release

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/release

« back to all changes in this revision

Viewing changes to mandos

  • Committer: Teddy Hogeborn
  • Date: 2022-04-24 11:45:13 UTC
  • mto: This revision was merged to the branch mainline in revision 406.
  • Revision ID: teddy@recompile.se-20220424114513-0rvlunnjhgs3deus
mandos-monitor: Update boilerplate code

* mandos-monitor: Show warnings by default.

Show diffs side-by-side

added added

removed removed

Lines of Context:
1
 
#!/usr/bin/python
2
 
# -*- mode: python; coding: utf-8 -*-
3
 
 
1
#!/usr/bin/python3 -bI
 
2
# -*- mode: python; after-save-hook: (lambda () (let ((command (if (fboundp 'file-local-name) (file-local-name (buffer-file-name)) (or (file-remote-p (buffer-file-name) 'localname) (buffer-file-name))))) (if (= (progn (if (get-buffer "*Test*") (kill-buffer "*Test*")) (process-file-shell-command (format "%s --check" (shell-quote-argument command)) nil "*Test*")) 0) (let ((w (get-buffer-window "*Test*"))) (if w (delete-window w))) (progn (with-current-buffer "*Test*" (compilation-mode)) (display-buffer "*Test*" '(display-buffer-in-side-window)))))); coding: utf-8 -*-
 
3
#
4
4
# Mandos server - give out binary blobs to connecting clients.
5
 
 
5
#
6
6
# This program is partly derived from an example program for an Avahi
7
7
# service publisher, downloaded from
8
8
# <http://avahi.org/wiki/PythonPublishExample>.  This includes the
9
9
# methods "add", "remove", "server_state_changed",
10
10
# "entry_group_state_changed", "cleanup", and "activate" in the
11
11
# "AvahiService" class, and some lines in "main".
12
 
 
12
#
13
13
# Everything else is
14
 
# Copyright © 2008-2012 Teddy Hogeborn
15
 
# Copyright © 2008-2012 Björn Påhlsson
16
 
17
 
# This program is free software: you can redistribute it and/or modify
18
 
# it under the terms of the GNU General Public License as published by
 
14
# Copyright © 2008-2020 Teddy Hogeborn
 
15
# Copyright © 2008-2020 Björn Påhlsson
 
16
#
 
17
# This file is part of Mandos.
 
18
#
 
19
# Mandos is free software: you can redistribute it and/or modify it
 
20
# under the terms of the GNU General Public License as published by
19
21
# the Free Software Foundation, either version 3 of the License, or
20
22
# (at your option) any later version.
21
23
#
22
 
#     This program is distributed in the hope that it will be useful,
23
 
#     but WITHOUT ANY WARRANTY; without even the implied warranty of
 
24
#     Mandos is distributed in the hope that it will be useful, but
 
25
#     WITHOUT ANY WARRANTY; without even the implied warranty of
24
26
#     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
25
27
#     GNU General Public License for more details.
26
 
 
28
#
27
29
# You should have received a copy of the GNU General Public License
28
 
# along with this program.  If not, see
29
 
# <http://www.gnu.org/licenses/>.
30
 
 
30
# along with Mandos.  If not, see <http://www.gnu.org/licenses/>.
 
31
#
31
32
# Contact the authors at <mandos@recompile.se>.
32
 
 
33
#
33
34
 
34
35
from __future__ import (division, absolute_import, print_function,
35
36
                        unicode_literals)
36
37
 
37
 
from future_builtins import *
 
38
try:
 
39
    from future_builtins import *
 
40
except ImportError:
 
41
    pass
38
42
 
39
 
import SocketServer as socketserver
 
43
try:
 
44
    import SocketServer as socketserver
 
45
except ImportError:
 
46
    import socketserver
40
47
import socket
41
48
import argparse
42
49
import datetime
43
50
import errno
44
 
import gnutls.crypto
45
 
import gnutls.connection
46
 
import gnutls.errors
47
 
import gnutls.library.functions
48
 
import gnutls.library.constants
49
 
import gnutls.library.types
50
 
import ConfigParser as configparser
 
51
try:
 
52
    import ConfigParser as configparser
 
53
except ImportError:
 
54
    import configparser
51
55
import sys
52
56
import re
53
57
import os
62
66
import struct
63
67
import fcntl
64
68
import functools
65
 
import cPickle as pickle
 
69
try:
 
70
    import cPickle as pickle
 
71
except ImportError:
 
72
    import pickle
66
73
import multiprocessing
67
74
import types
68
75
import binascii
69
76
import tempfile
70
77
import itertools
71
78
import collections
 
79
import codecs
 
80
import unittest
 
81
import random
 
82
import shlex
72
83
 
73
84
import dbus
74
85
import dbus.service
75
 
import gobject
76
 
import avahi
 
86
import gi
 
87
from gi.repository import GLib
77
88
from dbus.mainloop.glib import DBusGMainLoop
78
89
import ctypes
79
90
import ctypes.util
80
91
import xml.dom.minidom
81
92
import inspect
82
93
 
83
 
try:
 
94
if sys.version_info.major == 2:
 
95
    __metaclass__ = type
 
96
    str = unicode
 
97
 
 
98
# Add collections.abc.Callable if it does not exist
 
99
try:
 
100
    collections.abc.Callable
 
101
except AttributeError:
 
102
    class abc:
 
103
        Callable = collections.Callable
 
104
    collections.abc = abc
 
105
    del abc
 
106
 
 
107
# Add shlex.quote if it does not exist
 
108
try:
 
109
    shlex.quote
 
110
except AttributeError:
 
111
    shlex.quote = re.escape
 
112
 
 
113
# Show warnings by default
 
114
if not sys.warnoptions:
 
115
    import warnings
 
116
    warnings.simplefilter("default")
 
117
 
 
118
# Try to find the value of SO_BINDTODEVICE:
 
119
try:
 
120
    # This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and
 
121
    # newer, and it is also the most natural place for it:
84
122
    SO_BINDTODEVICE = socket.SO_BINDTODEVICE
85
123
except AttributeError:
86
124
    try:
 
125
        # This is where SO_BINDTODEVICE was up to and including Python
 
126
        # 2.6, and also 3.2:
87
127
        from IN import SO_BINDTODEVICE
88
128
    except ImportError:
89
 
        SO_BINDTODEVICE = None
90
 
 
91
 
version = "1.6.1"
 
129
        # In Python 2.7 it seems to have been removed entirely.
 
130
        # Try running the C preprocessor:
 
131
        try:
 
132
            cc = subprocess.Popen(["cc", "--language=c", "-E",
 
133
                                   "/dev/stdin"],
 
134
                                  stdin=subprocess.PIPE,
 
135
                                  stdout=subprocess.PIPE)
 
136
            stdout = cc.communicate(
 
137
                "#include <sys/socket.h>\nSO_BINDTODEVICE\n")[0]
 
138
            SO_BINDTODEVICE = int(stdout.splitlines()[-1])
 
139
        except (OSError, ValueError, IndexError):
 
140
            # No value found
 
141
            SO_BINDTODEVICE = None
 
142
 
 
143
if sys.version_info < (3, 2):
 
144
    configparser.Configparser = configparser.SafeConfigParser
 
145
 
 
146
version = "1.8.14"
92
147
stored_state_file = "clients.pickle"
93
148
 
94
149
logger = logging.getLogger()
95
 
syslogger = (logging.handlers.SysLogHandler
96
 
             (facility = logging.handlers.SysLogHandler.LOG_DAEMON,
97
 
              address = str("/dev/log")))
 
150
logging.captureWarnings(True)   # Show warnings via the logging system
 
151
syslogger = None
98
152
 
99
153
try:
100
 
    if_nametoindex = (ctypes.cdll.LoadLibrary
101
 
                      (ctypes.util.find_library("c"))
102
 
                      .if_nametoindex)
 
154
    if_nametoindex = ctypes.cdll.LoadLibrary(
 
155
        ctypes.util.find_library("c")).if_nametoindex
103
156
except (OSError, AttributeError):
 
157
 
104
158
    def if_nametoindex(interface):
105
159
        "Get an interface index the hard way, i.e. using fcntl()"
106
160
        SIOCGIFINDEX = 0x8933  # From /usr/include/linux/sockios.h
107
161
        with contextlib.closing(socket.socket()) as s:
108
162
            ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
109
 
                                struct.pack(str("16s16x"),
110
 
                                            interface))
111
 
        interface_index = struct.unpack(str("I"),
112
 
                                        ifreq[16:20])[0]
 
163
                                struct.pack(b"16s16x", interface))
 
164
        interface_index = struct.unpack("I", ifreq[16:20])[0]
113
165
        return interface_index
114
166
 
115
167
 
 
168
def copy_function(func):
 
169
    """Make a copy of a function"""
 
170
    if sys.version_info.major == 2:
 
171
        return types.FunctionType(func.func_code,
 
172
                                  func.func_globals,
 
173
                                  func.func_name,
 
174
                                  func.func_defaults,
 
175
                                  func.func_closure)
 
176
    else:
 
177
        return types.FunctionType(func.__code__,
 
178
                                  func.__globals__,
 
179
                                  func.__name__,
 
180
                                  func.__defaults__,
 
181
                                  func.__closure__)
 
182
 
 
183
 
116
184
def initlogger(debug, level=logging.WARNING):
117
185
    """init logger and add loglevel"""
118
 
    
 
186
 
 
187
    global syslogger
 
188
    syslogger = (logging.handlers.SysLogHandler(
 
189
        facility=logging.handlers.SysLogHandler.LOG_DAEMON,
 
190
        address="/dev/log"))
119
191
    syslogger.setFormatter(logging.Formatter
120
 
                           ('Mandos [%(process)d]: %(levelname)s:'
121
 
                            ' %(message)s'))
 
192
                           ("Mandos [%(process)d]: %(levelname)s:"
 
193
                            " %(message)s"))
122
194
    logger.addHandler(syslogger)
123
 
    
 
195
 
124
196
    if debug:
125
197
        console = logging.StreamHandler()
126
 
        console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
127
 
                                               ' [%(process)d]:'
128
 
                                               ' %(levelname)s:'
129
 
                                               ' %(message)s'))
 
198
        console.setFormatter(logging.Formatter("%(asctime)s %(name)s"
 
199
                                               " [%(process)d]:"
 
200
                                               " %(levelname)s:"
 
201
                                               " %(message)s"))
130
202
        logger.addHandler(console)
131
203
    logger.setLevel(level)
132
204
 
136
208
    pass
137
209
 
138
210
 
139
 
class PGPEngine(object):
 
211
class PGPEngine:
140
212
    """A simple class for OpenPGP symmetric encryption & decryption"""
 
213
 
141
214
    def __init__(self):
142
215
        self.tempdir = tempfile.mkdtemp(prefix="mandos-")
143
 
        self.gnupgargs = ['--batch',
144
 
                          '--home', self.tempdir,
145
 
                          '--force-mdc',
146
 
                          '--quiet',
147
 
                          '--no-use-agent']
148
 
    
 
216
        self.gpg = "gpg"
 
217
        try:
 
218
            output = subprocess.check_output(["gpgconf"])
 
219
            for line in output.splitlines():
 
220
                name, text, path = line.split(b":")
 
221
                if name == b"gpg":
 
222
                    self.gpg = path
 
223
                    break
 
224
        except OSError as e:
 
225
            if e.errno != errno.ENOENT:
 
226
                raise
 
227
        self.gnupgargs = ["--batch",
 
228
                          "--homedir", self.tempdir,
 
229
                          "--force-mdc",
 
230
                          "--quiet"]
 
231
        # Only GPG version 1 has the --no-use-agent option.
 
232
        if self.gpg == b"gpg" or self.gpg.endswith(b"/gpg"):
 
233
            self.gnupgargs.append("--no-use-agent")
 
234
 
149
235
    def __enter__(self):
150
236
        return self
151
 
    
 
237
 
152
238
    def __exit__(self, exc_type, exc_value, traceback):
153
239
        self._cleanup()
154
240
        return False
155
 
    
 
241
 
156
242
    def __del__(self):
157
243
        self._cleanup()
158
 
    
 
244
 
159
245
    def _cleanup(self):
160
246
        if self.tempdir is not None:
161
247
            # Delete contents of tempdir
162
248
            for root, dirs, files in os.walk(self.tempdir,
163
 
                                             topdown = False):
 
249
                                             topdown=False):
164
250
                for filename in files:
165
251
                    os.remove(os.path.join(root, filename))
166
252
                for dirname in dirs:
168
254
            # Remove tempdir
169
255
            os.rmdir(self.tempdir)
170
256
            self.tempdir = None
171
 
    
 
257
 
172
258
    def password_encode(self, password):
173
259
        # Passphrase can not be empty and can not contain newlines or
174
260
        # NUL bytes.  So we prefix it and hex encode it.
175
 
        return b"mandos" + binascii.hexlify(password)
176
 
    
 
261
        encoded = b"mandos" + binascii.hexlify(password)
 
262
        if len(encoded) > 2048:
 
263
            # GnuPG can't handle long passwords, so encode differently
 
264
            encoded = (b"mandos" + password.replace(b"\\", b"\\\\")
 
265
                       .replace(b"\n", b"\\n")
 
266
                       .replace(b"\0", b"\\x00"))
 
267
        return encoded
 
268
 
177
269
    def encrypt(self, data, password):
178
270
        passphrase = self.password_encode(password)
179
 
        with tempfile.NamedTemporaryFile(dir=self.tempdir
180
 
                                         ) as passfile:
 
271
        with tempfile.NamedTemporaryFile(
 
272
                dir=self.tempdir) as passfile:
181
273
            passfile.write(passphrase)
182
274
            passfile.flush()
183
 
            proc = subprocess.Popen(['gpg', '--symmetric',
184
 
                                     '--passphrase-file',
 
275
            proc = subprocess.Popen([self.gpg, "--symmetric",
 
276
                                     "--passphrase-file",
185
277
                                     passfile.name]
186
278
                                    + self.gnupgargs,
187
 
                                    stdin = subprocess.PIPE,
188
 
                                    stdout = subprocess.PIPE,
189
 
                                    stderr = subprocess.PIPE)
190
 
            ciphertext, err = proc.communicate(input = data)
 
279
                                    stdin=subprocess.PIPE,
 
280
                                    stdout=subprocess.PIPE,
 
281
                                    stderr=subprocess.PIPE)
 
282
            ciphertext, err = proc.communicate(input=data)
191
283
        if proc.returncode != 0:
192
284
            raise PGPError(err)
193
285
        return ciphertext
194
 
    
 
286
 
195
287
    def decrypt(self, data, password):
196
288
        passphrase = self.password_encode(password)
197
 
        with tempfile.NamedTemporaryFile(dir = self.tempdir
198
 
                                         ) as passfile:
 
289
        with tempfile.NamedTemporaryFile(
 
290
                dir=self.tempdir) as passfile:
199
291
            passfile.write(passphrase)
200
292
            passfile.flush()
201
 
            proc = subprocess.Popen(['gpg', '--decrypt',
202
 
                                     '--passphrase-file',
 
293
            proc = subprocess.Popen([self.gpg, "--decrypt",
 
294
                                     "--passphrase-file",
203
295
                                     passfile.name]
204
296
                                    + self.gnupgargs,
205
 
                                    stdin = subprocess.PIPE,
206
 
                                    stdout = subprocess.PIPE,
207
 
                                    stderr = subprocess.PIPE)
208
 
            decrypted_plaintext, err = proc.communicate(input
209
 
                                                        = data)
 
297
                                    stdin=subprocess.PIPE,
 
298
                                    stdout=subprocess.PIPE,
 
299
                                    stderr=subprocess.PIPE)
 
300
            decrypted_plaintext, err = proc.communicate(input=data)
210
301
        if proc.returncode != 0:
211
302
            raise PGPError(err)
212
303
        return decrypted_plaintext
213
304
 
214
305
 
 
306
# Pretend that we have an Avahi module
 
307
class avahi:
 
308
    """This isn't so much a class as it is a module-like namespace."""
 
309
    IF_UNSPEC = -1               # avahi-common/address.h
 
310
    PROTO_UNSPEC = -1            # avahi-common/address.h
 
311
    PROTO_INET = 0               # avahi-common/address.h
 
312
    PROTO_INET6 = 1              # avahi-common/address.h
 
313
    DBUS_NAME = "org.freedesktop.Avahi"
 
314
    DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"
 
315
    DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"
 
316
    DBUS_PATH_SERVER = "/"
 
317
 
 
318
    @staticmethod
 
319
    def string_array_to_txt_array(t):
 
320
        return dbus.Array((dbus.ByteArray(s.encode("utf-8"))
 
321
                           for s in t), signature="ay")
 
322
    ENTRY_GROUP_ESTABLISHED = 2  # avahi-common/defs.h
 
323
    ENTRY_GROUP_COLLISION = 3    # avahi-common/defs.h
 
324
    ENTRY_GROUP_FAILURE = 4      # avahi-common/defs.h
 
325
    SERVER_INVALID = 0           # avahi-common/defs.h
 
326
    SERVER_REGISTERING = 1       # avahi-common/defs.h
 
327
    SERVER_RUNNING = 2           # avahi-common/defs.h
 
328
    SERVER_COLLISION = 3         # avahi-common/defs.h
 
329
    SERVER_FAILURE = 4           # avahi-common/defs.h
 
330
 
 
331
 
215
332
class AvahiError(Exception):
216
333
    def __init__(self, value, *args, **kwargs):
217
334
        self.value = value
218
 
        super(AvahiError, self).__init__(value, *args, **kwargs)
219
 
    def __unicode__(self):
220
 
        return unicode(repr(self.value))
 
335
        return super(AvahiError, self).__init__(value, *args,
 
336
                                                **kwargs)
 
337
 
221
338
 
222
339
class AvahiServiceError(AvahiError):
223
340
    pass
224
341
 
 
342
 
225
343
class AvahiGroupError(AvahiError):
226
344
    pass
227
345
 
228
346
 
229
 
class AvahiService(object):
 
347
class AvahiService:
230
348
    """An Avahi (Zeroconf) service.
231
 
    
 
349
 
232
350
    Attributes:
233
351
    interface: integer; avahi.IF_UNSPEC or an interface index.
234
352
               Used to optionally bind to the specified interface.
235
 
    name: string; Example: 'Mandos'
236
 
    type: string; Example: '_mandos._tcp'.
 
353
    name: string; Example: "Mandos"
 
354
    type: string; Example: "_mandos._tcp".
237
355
     See <https://www.iana.org/assignments/service-names-port-numbers>
238
356
    port: integer; what port to announce
239
357
    TXT: list of strings; TXT record for the service
246
364
    server: D-Bus Server
247
365
    bus: dbus.SystemBus()
248
366
    """
249
 
    
250
 
    def __init__(self, interface = avahi.IF_UNSPEC, name = None,
251
 
                 servicetype = None, port = None, TXT = None,
252
 
                 domain = "", host = "", max_renames = 32768,
253
 
                 protocol = avahi.PROTO_UNSPEC, bus = None):
 
367
 
 
368
    def __init__(self,
 
369
                 interface=avahi.IF_UNSPEC,
 
370
                 name=None,
 
371
                 servicetype=None,
 
372
                 port=None,
 
373
                 TXT=None,
 
374
                 domain="",
 
375
                 host="",
 
376
                 max_renames=32768,
 
377
                 protocol=avahi.PROTO_UNSPEC,
 
378
                 bus=None):
254
379
        self.interface = interface
255
380
        self.name = name
256
381
        self.type = servicetype
265
390
        self.server = None
266
391
        self.bus = bus
267
392
        self.entry_group_state_changed_match = None
268
 
    
269
 
    def rename(self):
 
393
 
 
394
    def rename(self, remove=True):
270
395
        """Derived from the Avahi example code"""
271
396
        if self.rename_count >= self.max_renames:
272
397
            logger.critical("No suitable Zeroconf service name found"
273
398
                            " after %i retries, exiting.",
274
399
                            self.rename_count)
275
400
            raise AvahiServiceError("Too many renames")
276
 
        self.name = unicode(self.server
277
 
                            .GetAlternativeServiceName(self.name))
 
401
        self.name = str(
 
402
            self.server.GetAlternativeServiceName(self.name))
 
403
        self.rename_count += 1
278
404
        logger.info("Changing Zeroconf service name to %r ...",
279
405
                    self.name)
280
 
        self.remove()
 
406
        if remove:
 
407
            self.remove()
281
408
        try:
282
409
            self.add()
283
410
        except dbus.exceptions.DBusException as error:
284
 
            logger.critical("D-Bus Exception", exc_info=error)
285
 
            self.cleanup()
286
 
            os._exit(1)
287
 
        self.rename_count += 1
288
 
    
 
411
            if (error.get_dbus_name()
 
412
                == "org.freedesktop.Avahi.CollisionError"):
 
413
                logger.info("Local Zeroconf service name collision.")
 
414
                return self.rename(remove=False)
 
415
            else:
 
416
                logger.critical("D-Bus Exception", exc_info=error)
 
417
                self.cleanup()
 
418
                os._exit(1)
 
419
 
289
420
    def remove(self):
290
421
        """Derived from the Avahi example code"""
291
422
        if self.entry_group_state_changed_match is not None:
293
424
            self.entry_group_state_changed_match = None
294
425
        if self.group is not None:
295
426
            self.group.Reset()
296
 
    
 
427
 
297
428
    def add(self):
298
429
        """Derived from the Avahi example code"""
299
430
        self.remove()
304
435
                avahi.DBUS_INTERFACE_ENTRY_GROUP)
305
436
        self.entry_group_state_changed_match = (
306
437
            self.group.connect_to_signal(
307
 
                'StateChanged', self.entry_group_state_changed))
 
438
                "StateChanged", self.entry_group_state_changed))
308
439
        logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
309
440
                     self.name, self.type)
310
441
        self.group.AddService(
316
447
            dbus.UInt16(self.port),
317
448
            avahi.string_array_to_txt_array(self.TXT))
318
449
        self.group.Commit()
319
 
    
 
450
 
320
451
    def entry_group_state_changed(self, state, error):
321
452
        """Derived from the Avahi example code"""
322
453
        logger.debug("Avahi entry group state change: %i", state)
323
 
        
 
454
 
324
455
        if state == avahi.ENTRY_GROUP_ESTABLISHED:
325
456
            logger.debug("Zeroconf service established.")
326
457
        elif state == avahi.ENTRY_GROUP_COLLISION:
328
459
            self.rename()
329
460
        elif state == avahi.ENTRY_GROUP_FAILURE:
330
461
            logger.critical("Avahi: Error in group state changed %s",
331
 
                            unicode(error))
332
 
            raise AvahiGroupError("State changed: {0!s}"
333
 
                                  .format(error))
334
 
    
 
462
                            str(error))
 
463
            raise AvahiGroupError("State changed: {!s}".format(error))
 
464
 
335
465
    def cleanup(self):
336
466
        """Derived from the Avahi example code"""
337
467
        if self.group is not None:
342
472
                pass
343
473
            self.group = None
344
474
        self.remove()
345
 
    
 
475
 
346
476
    def server_state_changed(self, state, error=None):
347
477
        """Derived from the Avahi example code"""
348
478
        logger.debug("Avahi server state change: %i", state)
349
 
        bad_states = { avahi.SERVER_INVALID:
350
 
                           "Zeroconf server invalid",
351
 
                       avahi.SERVER_REGISTERING: None,
352
 
                       avahi.SERVER_COLLISION:
353
 
                           "Zeroconf server name collision",
354
 
                       avahi.SERVER_FAILURE:
355
 
                           "Zeroconf server failure" }
 
479
        bad_states = {
 
480
            avahi.SERVER_INVALID: "Zeroconf server invalid",
 
481
            avahi.SERVER_REGISTERING: None,
 
482
            avahi.SERVER_COLLISION: "Zeroconf server name collision",
 
483
            avahi.SERVER_FAILURE: "Zeroconf server failure",
 
484
        }
356
485
        if state in bad_states:
357
486
            if bad_states[state] is not None:
358
487
                if error is None:
361
490
                    logger.error(bad_states[state] + ": %r", error)
362
491
            self.cleanup()
363
492
        elif state == avahi.SERVER_RUNNING:
364
 
            self.add()
 
493
            try:
 
494
                self.add()
 
495
            except dbus.exceptions.DBusException as error:
 
496
                if (error.get_dbus_name()
 
497
                    == "org.freedesktop.Avahi.CollisionError"):
 
498
                    logger.info("Local Zeroconf service name"
 
499
                                " collision.")
 
500
                    return self.rename(remove=False)
 
501
                else:
 
502
                    logger.critical("D-Bus Exception", exc_info=error)
 
503
                    self.cleanup()
 
504
                    os._exit(1)
365
505
        else:
366
506
            if error is None:
367
507
                logger.debug("Unknown state: %r", state)
368
508
            else:
369
509
                logger.debug("Unknown state: %r: %r", state, error)
370
 
    
 
510
 
371
511
    def activate(self):
372
512
        """Derived from the Avahi example code"""
373
513
        if self.server is None:
377
517
                                    follow_name_owner_changes=True),
378
518
                avahi.DBUS_INTERFACE_SERVER)
379
519
        self.server.connect_to_signal("StateChanged",
380
 
                                 self.server_state_changed)
 
520
                                      self.server_state_changed)
381
521
        self.server_state_changed(self.server.GetState())
382
522
 
383
523
 
384
524
class AvahiServiceToSyslog(AvahiService):
385
 
    def rename(self):
 
525
    def rename(self, *args, **kwargs):
386
526
        """Add the new name to the syslog messages"""
387
 
        ret = AvahiService.rename(self)
388
 
        syslogger.setFormatter(logging.Formatter
389
 
                               ('Mandos ({0}) [%(process)d]:'
390
 
                                ' %(levelname)s: %(message)s'
391
 
                                .format(self.name)))
 
527
        ret = super(AvahiServiceToSyslog, self).rename(*args,
 
528
                                                       **kwargs)
 
529
        syslogger.setFormatter(logging.Formatter(
 
530
            "Mandos ({}) [%(process)d]: %(levelname)s: %(message)s"
 
531
            .format(self.name)))
392
532
        return ret
393
533
 
394
534
 
395
 
def timedelta_to_milliseconds(td):
396
 
    "Convert a datetime.timedelta() to milliseconds"
397
 
    return ((td.days * 24 * 60 * 60 * 1000)
398
 
            + (td.seconds * 1000)
399
 
            + (td.microseconds // 1000))
400
 
 
401
 
 
402
 
class Client(object):
 
535
# Pretend that we have a GnuTLS module
 
536
class gnutls:
 
537
    """This isn't so much a class as it is a module-like namespace."""
 
538
 
 
539
    library = ctypes.util.find_library("gnutls")
 
540
    if library is None:
 
541
        library = ctypes.util.find_library("gnutls-deb0")
 
542
    _library = ctypes.cdll.LoadLibrary(library)
 
543
    del library
 
544
 
 
545
    # Unless otherwise indicated, the constants and types below are
 
546
    # all from the gnutls/gnutls.h C header file.
 
547
 
 
548
    # Constants
 
549
    E_SUCCESS = 0
 
550
    E_INTERRUPTED = -52
 
551
    E_AGAIN = -28
 
552
    CRT_OPENPGP = 2
 
553
    CRT_RAWPK = 3
 
554
    CLIENT = 2
 
555
    SHUT_RDWR = 0
 
556
    CRD_CERTIFICATE = 1
 
557
    E_NO_CERTIFICATE_FOUND = -49
 
558
    X509_FMT_DER = 0
 
559
    NO_TICKETS = 1<<10
 
560
    ENABLE_RAWPK = 1<<18
 
561
    CTYPE_PEERS = 3
 
562
    KEYID_USE_SHA256 = 1        # gnutls/x509.h
 
563
    OPENPGP_FMT_RAW = 0         # gnutls/openpgp.h
 
564
 
 
565
    # Types
 
566
    class _session_int(ctypes.Structure):
 
567
        _fields_ = []
 
568
    session_t = ctypes.POINTER(_session_int)
 
569
 
 
570
    class certificate_credentials_st(ctypes.Structure):
 
571
        _fields_ = []
 
572
    certificate_credentials_t = ctypes.POINTER(
 
573
        certificate_credentials_st)
 
574
    certificate_type_t = ctypes.c_int
 
575
 
 
576
    class datum_t(ctypes.Structure):
 
577
        _fields_ = [("data", ctypes.POINTER(ctypes.c_ubyte)),
 
578
                    ("size", ctypes.c_uint)]
 
579
 
 
580
    class _openpgp_crt_int(ctypes.Structure):
 
581
        _fields_ = []
 
582
    openpgp_crt_t = ctypes.POINTER(_openpgp_crt_int)
 
583
    openpgp_crt_fmt_t = ctypes.c_int  # gnutls/openpgp.h
 
584
    log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
 
585
    credentials_type_t = ctypes.c_int
 
586
    transport_ptr_t = ctypes.c_void_p
 
587
    close_request_t = ctypes.c_int
 
588
 
 
589
    # Exceptions
 
590
    class Error(Exception):
 
591
        def __init__(self, message=None, code=None, args=()):
 
592
            # Default usage is by a message string, but if a return
 
593
            # code is passed, convert it to a string with
 
594
            # gnutls.strerror()
 
595
            self.code = code
 
596
            if message is None and code is not None:
 
597
                message = gnutls.strerror(code).decode(
 
598
                    "utf-8", errors="replace")
 
599
            return super(gnutls.Error, self).__init__(
 
600
                message, *args)
 
601
 
 
602
    class CertificateSecurityError(Error):
 
603
        pass
 
604
 
 
605
    class PointerTo:
 
606
        def __init__(self, cls):
 
607
            self.cls = cls
 
608
 
 
609
        def from_param(self, obj):
 
610
            if not isinstance(obj, self.cls):
 
611
                raise TypeError("Not of type {}: {!r}"
 
612
                                .format(self.cls.__name__, obj))
 
613
            return ctypes.byref(obj.from_param(obj))
 
614
 
 
615
    class CastToVoidPointer:
 
616
        def __init__(self, cls):
 
617
            self.cls = cls
 
618
 
 
619
        def from_param(self, obj):
 
620
            if not isinstance(obj, self.cls):
 
621
                raise TypeError("Not of type {}: {!r}"
 
622
                                .format(self.cls.__name__, obj))
 
623
            return ctypes.cast(obj.from_param(obj), ctypes.c_void_p)
 
624
 
 
625
    class With_from_param:
 
626
        @classmethod
 
627
        def from_param(cls, obj):
 
628
            return obj._as_parameter_
 
629
 
 
630
    # Classes
 
631
    class Credentials(With_from_param):
 
632
        def __init__(self):
 
633
            self._as_parameter_ = gnutls.certificate_credentials_t()
 
634
            gnutls.certificate_allocate_credentials(self)
 
635
            self.type = gnutls.CRD_CERTIFICATE
 
636
 
 
637
        def __del__(self):
 
638
            gnutls.certificate_free_credentials(self)
 
639
 
 
640
    class ClientSession(With_from_param):
 
641
        def __init__(self, socket, credentials=None):
 
642
            self._as_parameter_ = gnutls.session_t()
 
643
            gnutls_flags = gnutls.CLIENT
 
644
            if gnutls.check_version(b"3.5.6"):
 
645
                gnutls_flags |= gnutls.NO_TICKETS
 
646
            if gnutls.has_rawpk:
 
647
                gnutls_flags |= gnutls.ENABLE_RAWPK
 
648
            gnutls.init(self, gnutls_flags)
 
649
            del gnutls_flags
 
650
            gnutls.set_default_priority(self)
 
651
            gnutls.transport_set_ptr(self, socket.fileno())
 
652
            gnutls.handshake_set_private_extensions(self, True)
 
653
            self.socket = socket
 
654
            if credentials is None:
 
655
                credentials = gnutls.Credentials()
 
656
            gnutls.credentials_set(self, credentials.type,
 
657
                                   credentials)
 
658
            self.credentials = credentials
 
659
 
 
660
        def __del__(self):
 
661
            gnutls.deinit(self)
 
662
 
 
663
        def handshake(self):
 
664
            return gnutls.handshake(self)
 
665
 
 
666
        def send(self, data):
 
667
            data = bytes(data)
 
668
            data_len = len(data)
 
669
            while data_len > 0:
 
670
                data_len -= gnutls.record_send(self, data[-data_len:],
 
671
                                               data_len)
 
672
 
 
673
        def bye(self):
 
674
            return gnutls.bye(self, gnutls.SHUT_RDWR)
 
675
 
 
676
    # Error handling functions
 
677
    def _error_code(result):
 
678
        """A function to raise exceptions on errors, suitable
 
679
        for the "restype" attribute on ctypes functions"""
 
680
        if result >= gnutls.E_SUCCESS:
 
681
            return result
 
682
        if result == gnutls.E_NO_CERTIFICATE_FOUND:
 
683
            raise gnutls.CertificateSecurityError(code=result)
 
684
        raise gnutls.Error(code=result)
 
685
 
 
686
    def _retry_on_error(result, func, arguments,
 
687
                        _error_code=_error_code):
 
688
        """A function to retry on some errors, suitable
 
689
        for the "errcheck" attribute on ctypes functions"""
 
690
        while result < gnutls.E_SUCCESS:
 
691
            if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
 
692
                return _error_code(result)
 
693
            result = func(*arguments)
 
694
        return result
 
695
 
 
696
    # Unless otherwise indicated, the function declarations below are
 
697
    # all from the gnutls/gnutls.h C header file.
 
698
 
 
699
    # Functions
 
700
    priority_set_direct = _library.gnutls_priority_set_direct
 
701
    priority_set_direct.argtypes = [ClientSession, ctypes.c_char_p,
 
702
                                    ctypes.POINTER(ctypes.c_char_p)]
 
703
    priority_set_direct.restype = _error_code
 
704
 
 
705
    init = _library.gnutls_init
 
706
    init.argtypes = [PointerTo(ClientSession), ctypes.c_int]
 
707
    init.restype = _error_code
 
708
 
 
709
    set_default_priority = _library.gnutls_set_default_priority
 
710
    set_default_priority.argtypes = [ClientSession]
 
711
    set_default_priority.restype = _error_code
 
712
 
 
713
    record_send = _library.gnutls_record_send
 
714
    record_send.argtypes = [ClientSession, ctypes.c_void_p,
 
715
                            ctypes.c_size_t]
 
716
    record_send.restype = ctypes.c_ssize_t
 
717
    record_send.errcheck = _retry_on_error
 
718
 
 
719
    certificate_allocate_credentials = (
 
720
        _library.gnutls_certificate_allocate_credentials)
 
721
    certificate_allocate_credentials.argtypes = [
 
722
        PointerTo(Credentials)]
 
723
    certificate_allocate_credentials.restype = _error_code
 
724
 
 
725
    certificate_free_credentials = (
 
726
        _library.gnutls_certificate_free_credentials)
 
727
    certificate_free_credentials.argtypes = [Credentials]
 
728
    certificate_free_credentials.restype = None
 
729
 
 
730
    handshake_set_private_extensions = (
 
731
        _library.gnutls_handshake_set_private_extensions)
 
732
    handshake_set_private_extensions.argtypes = [ClientSession,
 
733
                                                 ctypes.c_int]
 
734
    handshake_set_private_extensions.restype = None
 
735
 
 
736
    credentials_set = _library.gnutls_credentials_set
 
737
    credentials_set.argtypes = [ClientSession, credentials_type_t,
 
738
                                CastToVoidPointer(Credentials)]
 
739
    credentials_set.restype = _error_code
 
740
 
 
741
    strerror = _library.gnutls_strerror
 
742
    strerror.argtypes = [ctypes.c_int]
 
743
    strerror.restype = ctypes.c_char_p
 
744
 
 
745
    certificate_type_get = _library.gnutls_certificate_type_get
 
746
    certificate_type_get.argtypes = [ClientSession]
 
747
    certificate_type_get.restype = _error_code
 
748
 
 
749
    certificate_get_peers = _library.gnutls_certificate_get_peers
 
750
    certificate_get_peers.argtypes = [ClientSession,
 
751
                                      ctypes.POINTER(ctypes.c_uint)]
 
752
    certificate_get_peers.restype = ctypes.POINTER(datum_t)
 
753
 
 
754
    global_set_log_level = _library.gnutls_global_set_log_level
 
755
    global_set_log_level.argtypes = [ctypes.c_int]
 
756
    global_set_log_level.restype = None
 
757
 
 
758
    global_set_log_function = _library.gnutls_global_set_log_function
 
759
    global_set_log_function.argtypes = [log_func]
 
760
    global_set_log_function.restype = None
 
761
 
 
762
    deinit = _library.gnutls_deinit
 
763
    deinit.argtypes = [ClientSession]
 
764
    deinit.restype = None
 
765
 
 
766
    handshake = _library.gnutls_handshake
 
767
    handshake.argtypes = [ClientSession]
 
768
    handshake.restype = ctypes.c_int
 
769
    handshake.errcheck = _retry_on_error
 
770
 
 
771
    transport_set_ptr = _library.gnutls_transport_set_ptr
 
772
    transport_set_ptr.argtypes = [ClientSession, transport_ptr_t]
 
773
    transport_set_ptr.restype = None
 
774
 
 
775
    bye = _library.gnutls_bye
 
776
    bye.argtypes = [ClientSession, close_request_t]
 
777
    bye.restype = ctypes.c_int
 
778
    bye.errcheck = _retry_on_error
 
779
 
 
780
    check_version = _library.gnutls_check_version
 
781
    check_version.argtypes = [ctypes.c_char_p]
 
782
    check_version.restype = ctypes.c_char_p
 
783
 
 
784
    _need_version = b"3.3.0"
 
785
    if check_version(_need_version) is None:
 
786
        raise self.Error("Needs GnuTLS {} or later"
 
787
                         .format(_need_version))
 
788
 
 
789
    _tls_rawpk_version = b"3.6.6"
 
790
    has_rawpk = bool(check_version(_tls_rawpk_version))
 
791
 
 
792
    if has_rawpk:
 
793
        # Types
 
794
        class pubkey_st(ctypes.Structure):
 
795
            _fields = []
 
796
        pubkey_t = ctypes.POINTER(pubkey_st)
 
797
 
 
798
        x509_crt_fmt_t = ctypes.c_int
 
799
 
 
800
        # All the function declarations below are from
 
801
        # gnutls/abstract.h
 
802
        pubkey_init = _library.gnutls_pubkey_init
 
803
        pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]
 
804
        pubkey_init.restype = _error_code
 
805
 
 
806
        pubkey_import = _library.gnutls_pubkey_import
 
807
        pubkey_import.argtypes = [pubkey_t, ctypes.POINTER(datum_t),
 
808
                                  x509_crt_fmt_t]
 
809
        pubkey_import.restype = _error_code
 
810
 
 
811
        pubkey_get_key_id = _library.gnutls_pubkey_get_key_id
 
812
        pubkey_get_key_id.argtypes = [pubkey_t, ctypes.c_int,
 
813
                                      ctypes.POINTER(ctypes.c_ubyte),
 
814
                                      ctypes.POINTER(ctypes.c_size_t)]
 
815
        pubkey_get_key_id.restype = _error_code
 
816
 
 
817
        pubkey_deinit = _library.gnutls_pubkey_deinit
 
818
        pubkey_deinit.argtypes = [pubkey_t]
 
819
        pubkey_deinit.restype = None
 
820
    else:
 
821
        # All the function declarations below are from
 
822
        # gnutls/openpgp.h
 
823
 
 
824
        openpgp_crt_init = _library.gnutls_openpgp_crt_init
 
825
        openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
 
826
        openpgp_crt_init.restype = _error_code
 
827
 
 
828
        openpgp_crt_import = _library.gnutls_openpgp_crt_import
 
829
        openpgp_crt_import.argtypes = [openpgp_crt_t,
 
830
                                       ctypes.POINTER(datum_t),
 
831
                                       openpgp_crt_fmt_t]
 
832
        openpgp_crt_import.restype = _error_code
 
833
 
 
834
        openpgp_crt_verify_self = \
 
835
            _library.gnutls_openpgp_crt_verify_self
 
836
        openpgp_crt_verify_self.argtypes = [
 
837
            openpgp_crt_t,
 
838
            ctypes.c_uint,
 
839
            ctypes.POINTER(ctypes.c_uint),
 
840
        ]
 
841
        openpgp_crt_verify_self.restype = _error_code
 
842
 
 
843
        openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
 
844
        openpgp_crt_deinit.argtypes = [openpgp_crt_t]
 
845
        openpgp_crt_deinit.restype = None
 
846
 
 
847
        openpgp_crt_get_fingerprint = (
 
848
            _library.gnutls_openpgp_crt_get_fingerprint)
 
849
        openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
 
850
                                                ctypes.c_void_p,
 
851
                                                ctypes.POINTER(
 
852
                                                    ctypes.c_size_t)]
 
853
        openpgp_crt_get_fingerprint.restype = _error_code
 
854
 
 
855
    if check_version(b"3.6.4"):
 
856
        certificate_type_get2 = _library.gnutls_certificate_type_get2
 
857
        certificate_type_get2.argtypes = [ClientSession, ctypes.c_int]
 
858
        certificate_type_get2.restype = _error_code
 
859
 
 
860
    # Remove non-public functions
 
861
    del _error_code, _retry_on_error
 
862
 
 
863
 
 
864
def call_pipe(connection,       # : multiprocessing.Connection
 
865
              func, *args, **kwargs):
 
866
    """This function is meant to be called by multiprocessing.Process
 
867
 
 
868
    This function runs func(*args, **kwargs), and writes the resulting
 
869
    return value on the provided multiprocessing.Connection.
 
870
    """
 
871
    connection.send(func(*args, **kwargs))
 
872
    connection.close()
 
873
 
 
874
 
 
875
class Client:
403
876
    """A representation of a client host served by this server.
404
 
    
 
877
 
405
878
    Attributes:
406
 
    approved:   bool(); 'None' if not yet approved/disapproved
 
879
    approved:   bool(); None if not yet approved/disapproved
407
880
    approval_delay: datetime.timedelta(); Time to wait for approval
408
881
    approval_duration: datetime.timedelta(); Duration of one approval
409
 
    checker:    subprocess.Popen(); a running checker process used
410
 
                                    to see if the client lives.
411
 
                                    'None' if no process is running.
412
 
    checker_callback_tag: a gobject event source tag, or None
 
882
    checker: multiprocessing.Process(); a running checker process used
 
883
             to see if the client lives. None if no process is
 
884
             running.
 
885
    checker_callback_tag: a GLib event source tag, or None
413
886
    checker_command: string; External command which is run to check
414
887
                     if client lives.  %() expansions are done at
415
888
                     runtime with vars(self) as dict, so that for
416
889
                     instance %(name)s can be used in the command.
417
 
    checker_initiator_tag: a gobject event source tag, or None
 
890
    checker_initiator_tag: a GLib event source tag, or None
418
891
    created:    datetime.datetime(); (UTC) object creation
419
892
    client_structure: Object describing what attributes a client has
420
893
                      and is used for storing the client at exit
421
894
    current_checker_command: string; current running checker_command
422
 
    disable_initiator_tag: a gobject event source tag, or None
 
895
    disable_initiator_tag: a GLib event source tag, or None
423
896
    enabled:    bool()
424
897
    fingerprint: string (40 or 32 hexadecimal digits); used to
425
 
                 uniquely identify the client
 
898
                 uniquely identify an OpenPGP client
 
899
    key_id: string (64 hexadecimal digits); used to uniquely identify
 
900
            a client using raw public keys
426
901
    host:       string; available for use by the checker command
427
902
    interval:   datetime.timedelta(); How often to start a new checker
428
903
    last_approval_request: datetime.datetime(); (UTC) or None
430
905
    last_checker_status: integer between 0 and 255 reflecting exit
431
906
                         status of last checker. -1 reflects crashed
432
907
                         checker, -2 means no checker completed yet.
 
908
    last_checker_signal: The signal which killed the last checker, if
 
909
                         last_checker_status is -1
433
910
    last_enabled: datetime.datetime(); (UTC) or None
434
911
    name:       string; from the config file, used in log messages and
435
912
                        D-Bus identifiers
442
919
                disabled, or None
443
920
    server_settings: The server_settings dict from main()
444
921
    """
445
 
    
 
922
 
446
923
    runtime_expansions = ("approval_delay", "approval_duration",
447
 
                          "created", "enabled", "expires",
 
924
                          "created", "enabled", "expires", "key_id",
448
925
                          "fingerprint", "host", "interval",
449
926
                          "last_approval_request", "last_checked_ok",
450
927
                          "last_enabled", "name", "timeout")
451
 
    client_defaults = { "timeout": "PT5M",
452
 
                        "extended_timeout": "PT15M",
453
 
                        "interval": "PT2M",
454
 
                        "checker": "fping -q -- %%(host)s",
455
 
                        "host": "",
456
 
                        "approval_delay": "PT0S",
457
 
                        "approval_duration": "PT1S",
458
 
                        "approved_by_default": "True",
459
 
                        "enabled": "True",
460
 
                        }
461
 
    
462
 
    def timeout_milliseconds(self):
463
 
        "Return the 'timeout' attribute in milliseconds"
464
 
        return timedelta_to_milliseconds(self.timeout)
465
 
    
466
 
    def extended_timeout_milliseconds(self):
467
 
        "Return the 'extended_timeout' attribute in milliseconds"
468
 
        return timedelta_to_milliseconds(self.extended_timeout)
469
 
    
470
 
    def interval_milliseconds(self):
471
 
        "Return the 'interval' attribute in milliseconds"
472
 
        return timedelta_to_milliseconds(self.interval)
473
 
    
474
 
    def approval_delay_milliseconds(self):
475
 
        return timedelta_to_milliseconds(self.approval_delay)
476
 
    
 
928
    client_defaults = {
 
929
        "timeout": "PT5M",
 
930
        "extended_timeout": "PT15M",
 
931
        "interval": "PT2M",
 
932
        "checker": "fping -q -- %%(host)s",
 
933
        "host": "",
 
934
        "approval_delay": "PT0S",
 
935
        "approval_duration": "PT1S",
 
936
        "approved_by_default": "True",
 
937
        "enabled": "True",
 
938
    }
 
939
 
477
940
    @staticmethod
478
941
    def config_parser(config):
479
942
        """Construct a new dict of client settings of this form:
486
949
        for client_name in config.sections():
487
950
            section = dict(config.items(client_name))
488
951
            client = settings[client_name] = {}
489
 
            
 
952
 
490
953
            client["host"] = section["host"]
491
954
            # Reformat values from string types to Python types
492
955
            client["approved_by_default"] = config.getboolean(
493
956
                client_name, "approved_by_default")
494
957
            client["enabled"] = config.getboolean(client_name,
495
958
                                                  "enabled")
496
 
            
 
959
 
 
960
            # Uppercase and remove spaces from key_id and fingerprint
 
961
            # for later comparison purposes with return value from the
 
962
            # key_id() and fingerprint() functions
 
963
            client["key_id"] = (section.get("key_id", "").upper()
 
964
                                .replace(" ", ""))
497
965
            client["fingerprint"] = (section["fingerprint"].upper()
498
966
                                     .replace(" ", ""))
499
967
            if "secret" in section:
500
 
                client["secret"] = section["secret"].decode("base64")
 
968
                client["secret"] = codecs.decode(section["secret"]
 
969
                                                 .encode("utf-8"),
 
970
                                                 "base64")
501
971
            elif "secfile" in section:
502
972
                with open(os.path.expanduser(os.path.expandvars
503
973
                                             (section["secfile"])),
504
974
                          "rb") as secfile:
505
975
                    client["secret"] = secfile.read()
506
976
            else:
507
 
                raise TypeError("No secret or secfile for section {0}"
 
977
                raise TypeError("No secret or secfile for section {}"
508
978
                                .format(section))
509
979
            client["timeout"] = string_to_delta(section["timeout"])
510
980
            client["extended_timeout"] = string_to_delta(
518
988
            client["last_approval_request"] = None
519
989
            client["last_checked_ok"] = None
520
990
            client["last_checker_status"] = -2
521
 
        
 
991
 
522
992
        return settings
523
 
    
524
 
    def __init__(self, settings, name = None, server_settings=None):
 
993
 
 
994
    def __init__(self, settings, name=None, server_settings=None):
525
995
        self.name = name
526
996
        if server_settings is None:
527
997
            server_settings = {}
528
998
        self.server_settings = server_settings
529
999
        # adding all client settings
530
 
        for setting, value in settings.iteritems():
 
1000
        for setting, value in settings.items():
531
1001
            setattr(self, setting, value)
532
 
        
 
1002
 
533
1003
        if self.enabled:
534
1004
            if not hasattr(self, "last_enabled"):
535
1005
                self.last_enabled = datetime.datetime.utcnow()
539
1009
        else:
540
1010
            self.last_enabled = None
541
1011
            self.expires = None
542
 
        
 
1012
 
543
1013
        logger.debug("Creating client %r", self.name)
544
 
        # Uppercase and remove spaces from fingerprint for later
545
 
        # comparison purposes with return value from the fingerprint()
546
 
        # function
 
1014
        logger.debug("  Key ID: %s", self.key_id)
547
1015
        logger.debug("  Fingerprint: %s", self.fingerprint)
548
1016
        self.created = settings.get("created",
549
1017
                                    datetime.datetime.utcnow())
550
 
        
 
1018
 
551
1019
        # attributes specific for this server instance
552
1020
        self.checker = None
553
1021
        self.checker_initiator_tag = None
556
1024
        self.current_checker_command = None
557
1025
        self.approved = None
558
1026
        self.approvals_pending = 0
559
 
        self.changedstate = (multiprocessing_manager
560
 
                             .Condition(multiprocessing_manager
561
 
                                        .Lock()))
562
 
        self.client_structure = [attr for attr in
563
 
                                 self.__dict__.iterkeys()
 
1027
        self.changedstate = multiprocessing_manager.Condition(
 
1028
            multiprocessing_manager.Lock())
 
1029
        self.client_structure = [attr
 
1030
                                 for attr in self.__dict__.keys()
564
1031
                                 if not attr.startswith("_")]
565
1032
        self.client_structure.append("client_structure")
566
 
        
567
 
        for name, t in inspect.getmembers(type(self),
568
 
                                          lambda obj:
569
 
                                              isinstance(obj,
570
 
                                                         property)):
 
1033
 
 
1034
        for name, t in inspect.getmembers(
 
1035
                type(self), lambda obj: isinstance(obj, property)):
571
1036
            if not name.startswith("_"):
572
1037
                self.client_structure.append(name)
573
 
    
 
1038
 
574
1039
    # Send notice to process children that client state has changed
575
1040
    def send_changedstate(self):
576
1041
        with self.changedstate:
577
1042
            self.changedstate.notify_all()
578
 
    
 
1043
 
579
1044
    def enable(self):
580
1045
        """Start this client's checker and timeout hooks"""
581
1046
        if getattr(self, "enabled", False):
586
1051
        self.last_enabled = datetime.datetime.utcnow()
587
1052
        self.init_checker()
588
1053
        self.send_changedstate()
589
 
    
 
1054
 
590
1055
    def disable(self, quiet=True):
591
1056
        """Disable this client."""
592
1057
        if not getattr(self, "enabled", False):
594
1059
        if not quiet:
595
1060
            logger.info("Disabling client %s", self.name)
596
1061
        if getattr(self, "disable_initiator_tag", None) is not None:
597
 
            gobject.source_remove(self.disable_initiator_tag)
 
1062
            GLib.source_remove(self.disable_initiator_tag)
598
1063
            self.disable_initiator_tag = None
599
1064
        self.expires = None
600
1065
        if getattr(self, "checker_initiator_tag", None) is not None:
601
 
            gobject.source_remove(self.checker_initiator_tag)
 
1066
            GLib.source_remove(self.checker_initiator_tag)
602
1067
            self.checker_initiator_tag = None
603
1068
        self.stop_checker()
604
1069
        self.enabled = False
605
1070
        if not quiet:
606
1071
            self.send_changedstate()
607
 
        # Do not run this again if called by a gobject.timeout_add
 
1072
        # Do not run this again if called by a GLib.timeout_add
608
1073
        return False
609
 
    
 
1074
 
610
1075
    def __del__(self):
611
1076
        self.disable()
612
 
    
 
1077
 
613
1078
    def init_checker(self):
614
1079
        # Schedule a new checker to be started an 'interval' from now,
615
1080
        # and every interval from then on.
616
1081
        if self.checker_initiator_tag is not None:
617
 
            gobject.source_remove(self.checker_initiator_tag)
618
 
        self.checker_initiator_tag = (gobject.timeout_add
619
 
                                      (self.interval_milliseconds(),
620
 
                                       self.start_checker))
 
1082
            GLib.source_remove(self.checker_initiator_tag)
 
1083
        self.checker_initiator_tag = GLib.timeout_add(
 
1084
            random.randrange(int(self.interval.total_seconds() * 1000
 
1085
                                 + 1)),
 
1086
            self.start_checker)
621
1087
        # Schedule a disable() when 'timeout' has passed
622
1088
        if self.disable_initiator_tag is not None:
623
 
            gobject.source_remove(self.disable_initiator_tag)
624
 
        self.disable_initiator_tag = (gobject.timeout_add
625
 
                                   (self.timeout_milliseconds(),
626
 
                                    self.disable))
 
1089
            GLib.source_remove(self.disable_initiator_tag)
 
1090
        self.disable_initiator_tag = GLib.timeout_add(
 
1091
            int(self.timeout.total_seconds() * 1000), self.disable)
627
1092
        # Also start a new checker *right now*.
628
1093
        self.start_checker()
629
 
    
630
 
    def checker_callback(self, pid, condition, command):
 
1094
 
 
1095
    def checker_callback(self, source, condition, connection,
 
1096
                         command):
631
1097
        """The checker has completed, so take appropriate actions."""
 
1098
        # Read return code from connection (see call_pipe)
 
1099
        returncode = connection.recv()
 
1100
        connection.close()
 
1101
        if self.checker is not None:
 
1102
            self.checker.join()
632
1103
        self.checker_callback_tag = None
633
1104
        self.checker = None
634
 
        if os.WIFEXITED(condition):
635
 
            self.last_checker_status = os.WEXITSTATUS(condition)
 
1105
 
 
1106
        if returncode >= 0:
 
1107
            self.last_checker_status = returncode
 
1108
            self.last_checker_signal = None
636
1109
            if self.last_checker_status == 0:
637
1110
                logger.info("Checker for %(name)s succeeded",
638
1111
                            vars(self))
639
1112
                self.checked_ok()
640
1113
            else:
641
 
                logger.info("Checker for %(name)s failed",
642
 
                            vars(self))
 
1114
                logger.info("Checker for %(name)s failed", vars(self))
643
1115
        else:
644
1116
            self.last_checker_status = -1
 
1117
            self.last_checker_signal = -returncode
645
1118
            logger.warning("Checker for %(name)s crashed?",
646
1119
                           vars(self))
647
 
    
 
1120
        return False
 
1121
 
648
1122
    def checked_ok(self):
649
1123
        """Assert that the client has been seen, alive and well."""
650
1124
        self.last_checked_ok = datetime.datetime.utcnow()
651
1125
        self.last_checker_status = 0
 
1126
        self.last_checker_signal = None
652
1127
        self.bump_timeout()
653
 
    
 
1128
 
654
1129
    def bump_timeout(self, timeout=None):
655
1130
        """Bump up the timeout for this client."""
656
1131
        if timeout is None:
657
1132
            timeout = self.timeout
658
1133
        if self.disable_initiator_tag is not None:
659
 
            gobject.source_remove(self.disable_initiator_tag)
 
1134
            GLib.source_remove(self.disable_initiator_tag)
660
1135
            self.disable_initiator_tag = None
661
1136
        if getattr(self, "enabled", False):
662
 
            self.disable_initiator_tag = (gobject.timeout_add
663
 
                                          (timedelta_to_milliseconds
664
 
                                           (timeout), self.disable))
 
1137
            self.disable_initiator_tag = GLib.timeout_add(
 
1138
                int(timeout.total_seconds() * 1000), self.disable)
665
1139
            self.expires = datetime.datetime.utcnow() + timeout
666
 
    
 
1140
 
667
1141
    def need_approval(self):
668
1142
        self.last_approval_request = datetime.datetime.utcnow()
669
 
    
 
1143
 
670
1144
    def start_checker(self):
671
1145
        """Start a new checker subprocess if one is not running.
672
 
        
 
1146
 
673
1147
        If a checker already exists, leave it running and do
674
1148
        nothing."""
675
1149
        # The reason for not killing a running checker is that if we
680
1154
        # checkers alone, the checker would have to take more time
681
1155
        # than 'timeout' for the client to be disabled, which is as it
682
1156
        # should be.
683
 
        
684
 
        # If a checker exists, make sure it is not a zombie
685
 
        try:
686
 
            pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
687
 
        except (AttributeError, OSError) as error:
688
 
            if (isinstance(error, OSError)
689
 
                and error.errno != errno.ECHILD):
690
 
                raise error
691
 
        else:
692
 
            if pid:
693
 
                logger.warning("Checker was a zombie")
694
 
                gobject.source_remove(self.checker_callback_tag)
695
 
                self.checker_callback(pid, status,
696
 
                                      self.current_checker_command)
 
1157
 
 
1158
        if self.checker is not None and not self.checker.is_alive():
 
1159
            logger.warning("Checker was not alive; joining")
 
1160
            self.checker.join()
 
1161
            self.checker = None
697
1162
        # Start a new checker if needed
698
1163
        if self.checker is None:
699
1164
            # Escape attributes for the shell
700
 
            escaped_attrs = dict(
701
 
                (attr, re.escape(unicode(getattr(self, attr))))
702
 
                for attr in
703
 
                self.runtime_expansions)
 
1165
            escaped_attrs = {
 
1166
                attr: shlex.quote(str(getattr(self, attr)))
 
1167
                for attr in self.runtime_expansions}
704
1168
            try:
705
1169
                command = self.checker_command % escaped_attrs
706
1170
            except TypeError as error:
707
1171
                logger.error('Could not format string "%s"',
708
 
                             self.checker_command, exc_info=error)
709
 
                return True # Try again later
 
1172
                             self.checker_command,
 
1173
                             exc_info=error)
 
1174
                return True     # Try again later
710
1175
            self.current_checker_command = command
711
 
            try:
712
 
                logger.info("Starting checker %r for %s",
713
 
                            command, self.name)
714
 
                # We don't need to redirect stdout and stderr, since
715
 
                # in normal mode, that is already done by daemon(),
716
 
                # and in debug mode we don't want to.  (Stdin is
717
 
                # always replaced by /dev/null.)
718
 
                # The exception is when not debugging but nevertheless
719
 
                # running in the foreground; use the previously
720
 
                # created wnull.
721
 
                popen_args = {}
722
 
                if (not self.server_settings["debug"]
723
 
                    and self.server_settings["foreground"]):
724
 
                    popen_args.update({"stdout": wnull,
725
 
                                       "stderr": wnull })
726
 
                self.checker = subprocess.Popen(command,
727
 
                                                close_fds=True,
728
 
                                                shell=True, cwd="/",
729
 
                                                **popen_args)
730
 
            except OSError as error:
731
 
                logger.error("Failed to start subprocess",
732
 
                             exc_info=error)
733
 
                return True
734
 
            self.checker_callback_tag = (gobject.child_watch_add
735
 
                                         (self.checker.pid,
736
 
                                          self.checker_callback,
737
 
                                          data=command))
738
 
            # The checker may have completed before the gobject
739
 
            # watch was added.  Check for this.
740
 
            try:
741
 
                pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
742
 
            except OSError as error:
743
 
                if error.errno == errno.ECHILD:
744
 
                    # This should never happen
745
 
                    logger.error("Child process vanished",
746
 
                                 exc_info=error)
747
 
                    return True
748
 
                raise
749
 
            if pid:
750
 
                gobject.source_remove(self.checker_callback_tag)
751
 
                self.checker_callback(pid, status, command)
752
 
        # Re-run this periodically if run by gobject.timeout_add
 
1176
            logger.info("Starting checker %r for %s", command,
 
1177
                        self.name)
 
1178
            # We don't need to redirect stdout and stderr, since
 
1179
            # in normal mode, that is already done by daemon(),
 
1180
            # and in debug mode we don't want to.  (Stdin is
 
1181
            # always replaced by /dev/null.)
 
1182
            # The exception is when not debugging but nevertheless
 
1183
            # running in the foreground; use the previously
 
1184
            # created wnull.
 
1185
            popen_args = {"close_fds": True,
 
1186
                          "shell": True,
 
1187
                          "cwd": "/"}
 
1188
            if (not self.server_settings["debug"]
 
1189
                and self.server_settings["foreground"]):
 
1190
                popen_args.update({"stdout": wnull,
 
1191
                                   "stderr": wnull})
 
1192
            pipe = multiprocessing.Pipe(duplex=False)
 
1193
            self.checker = multiprocessing.Process(
 
1194
                target=call_pipe,
 
1195
                args=(pipe[1], subprocess.call, command),
 
1196
                kwargs=popen_args)
 
1197
            self.checker.start()
 
1198
            self.checker_callback_tag = GLib.io_add_watch(
 
1199
                GLib.IOChannel.unix_new(pipe[0].fileno()),
 
1200
                GLib.PRIORITY_DEFAULT, GLib.IO_IN,
 
1201
                self.checker_callback, pipe[0], command)
 
1202
        # Re-run this periodically if run by GLib.timeout_add
753
1203
        return True
754
 
    
 
1204
 
755
1205
    def stop_checker(self):
756
1206
        """Force the checker process, if any, to stop."""
757
1207
        if self.checker_callback_tag:
758
 
            gobject.source_remove(self.checker_callback_tag)
 
1208
            GLib.source_remove(self.checker_callback_tag)
759
1209
            self.checker_callback_tag = None
760
1210
        if getattr(self, "checker", None) is None:
761
1211
            return
762
1212
        logger.debug("Stopping checker for %(name)s", vars(self))
763
 
        try:
764
 
            self.checker.terminate()
765
 
            #time.sleep(0.5)
766
 
            #if self.checker.poll() is None:
767
 
            #    self.checker.kill()
768
 
        except OSError as error:
769
 
            if error.errno != errno.ESRCH: # No such process
770
 
                raise
 
1213
        self.checker.terminate()
771
1214
        self.checker = None
772
1215
 
773
1216
 
774
 
def dbus_service_property(dbus_interface, signature="v",
775
 
                          access="readwrite", byte_arrays=False):
 
1217
def dbus_service_property(dbus_interface,
 
1218
                          signature="v",
 
1219
                          access="readwrite",
 
1220
                          byte_arrays=False):
776
1221
    """Decorators for marking methods of a DBusObjectWithProperties to
777
1222
    become properties on the D-Bus.
778
 
    
 
1223
 
779
1224
    The decorated method will be called with no arguments by "Get"
780
1225
    and with one argument by "Set".
781
 
    
 
1226
 
782
1227
    The parameters, where they are supported, are the same as
783
1228
    dbus.service.method, except there is only "signature", since the
784
1229
    type from Get() and the type sent to Set() is the same.
787
1232
    # "Set" method, so we fail early here:
788
1233
    if byte_arrays and signature != "ay":
789
1234
        raise ValueError("Byte arrays not supported for non-'ay'"
790
 
                         " signature {0!r}".format(signature))
 
1235
                         " signature {!r}".format(signature))
 
1236
 
791
1237
    def decorator(func):
792
1238
        func._dbus_is_property = True
793
1239
        func._dbus_interface = dbus_interface
796
1242
        func._dbus_name = func.__name__
797
1243
        if func._dbus_name.endswith("_dbus_property"):
798
1244
            func._dbus_name = func._dbus_name[:-14]
799
 
        func._dbus_get_args_options = {'byte_arrays': byte_arrays }
 
1245
        func._dbus_get_args_options = {"byte_arrays": byte_arrays}
800
1246
        return func
 
1247
 
801
1248
    return decorator
802
1249
 
803
1250
 
804
1251
def dbus_interface_annotations(dbus_interface):
805
1252
    """Decorator for marking functions returning interface annotations
806
 
    
 
1253
 
807
1254
    Usage:
808
 
    
 
1255
 
809
1256
    @dbus_interface_annotations("org.example.Interface")
810
1257
    def _foo(self):  # Function name does not matter
811
1258
        return {"org.freedesktop.DBus.Deprecated": "true",
812
1259
                "org.freedesktop.DBus.Property.EmitsChangedSignal":
813
1260
                    "false"}
814
1261
    """
 
1262
 
815
1263
    def decorator(func):
816
1264
        func._dbus_is_interface = True
817
1265
        func._dbus_interface = dbus_interface
818
1266
        func._dbus_name = dbus_interface
819
1267
        return func
 
1268
 
820
1269
    return decorator
821
1270
 
822
1271
 
823
1272
def dbus_annotations(annotations):
824
1273
    """Decorator to annotate D-Bus methods, signals or properties
825
1274
    Usage:
826
 
    
 
1275
 
 
1276
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",
 
1277
                       "org.freedesktop.DBus.Property."
 
1278
                       "EmitsChangedSignal": "false"})
827
1279
    @dbus_service_property("org.example.Interface", signature="b",
828
1280
                           access="r")
829
 
    @dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",
830
 
                        "org.freedesktop.DBus.Property."
831
 
                        "EmitsChangedSignal": "false"})
832
1281
    def Property_dbus_property(self):
833
1282
        return dbus.Boolean(False)
 
1283
 
 
1284
    See also the DBusObjectWithAnnotations class.
834
1285
    """
 
1286
 
835
1287
    def decorator(func):
836
1288
        func._dbus_annotations = annotations
837
1289
        return func
 
1290
 
838
1291
    return decorator
839
1292
 
840
1293
 
841
1294
class DBusPropertyException(dbus.exceptions.DBusException):
842
1295
    """A base class for D-Bus property-related exceptions
843
1296
    """
844
 
    def __unicode__(self):
845
 
        return unicode(str(self))
 
1297
    pass
846
1298
 
847
1299
 
848
1300
class DBusPropertyAccessException(DBusPropertyException):
857
1309
    pass
858
1310
 
859
1311
 
860
 
class DBusObjectWithProperties(dbus.service.Object):
861
 
    """A D-Bus object with properties.
862
 
    
863
 
    Classes inheriting from this can use the dbus_service_property
864
 
    decorator to expose methods as D-Bus properties.  It exposes the
865
 
    standard Get(), Set(), and GetAll() methods on the D-Bus.
 
1312
class DBusObjectWithAnnotations(dbus.service.Object):
 
1313
    """A D-Bus object with annotations.
 
1314
 
 
1315
    Classes inheriting from this can use the dbus_annotations
 
1316
    decorator to add annotations to methods or signals.
866
1317
    """
867
 
    
 
1318
 
868
1319
    @staticmethod
869
1320
    def _is_dbus_thing(thing):
870
1321
        """Returns a function testing if an attribute is a D-Bus thing
871
 
        
 
1322
 
872
1323
        If called like _is_dbus_thing("method") it returns a function
873
1324
        suitable for use as predicate to inspect.getmembers().
874
1325
        """
875
 
        return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),
 
1326
        return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
876
1327
                                   False)
877
 
    
 
1328
 
878
1329
    def _get_all_dbus_things(self, thing):
879
1330
        """Returns a generator of (name, attribute) pairs
880
1331
        """
881
 
        return ((getattr(athing.__get__(self), "_dbus_name",
882
 
                         name),
 
1332
        return ((getattr(athing.__get__(self), "_dbus_name", name),
883
1333
                 athing.__get__(self))
884
1334
                for cls in self.__class__.__mro__
885
1335
                for name, athing in
886
 
                inspect.getmembers(cls,
887
 
                                   self._is_dbus_thing(thing)))
888
 
    
 
1336
                inspect.getmembers(cls, self._is_dbus_thing(thing)))
 
1337
 
 
1338
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
 
1339
                         out_signature="s",
 
1340
                         path_keyword="object_path",
 
1341
                         connection_keyword="connection")
 
1342
    def Introspect(self, object_path, connection):
 
1343
        """Overloading of standard D-Bus method.
 
1344
 
 
1345
        Inserts annotation tags on methods and signals.
 
1346
        """
 
1347
        xmlstring = dbus.service.Object.Introspect(self, object_path,
 
1348
                                                   connection)
 
1349
        try:
 
1350
            document = xml.dom.minidom.parseString(xmlstring)
 
1351
 
 
1352
            for if_tag in document.getElementsByTagName("interface"):
 
1353
                # Add annotation tags
 
1354
                for typ in ("method", "signal"):
 
1355
                    for tag in if_tag.getElementsByTagName(typ):
 
1356
                        annots = dict()
 
1357
                        for name, prop in (self.
 
1358
                                           _get_all_dbus_things(typ)):
 
1359
                            if (name == tag.getAttribute("name")
 
1360
                                and prop._dbus_interface
 
1361
                                == if_tag.getAttribute("name")):
 
1362
                                annots.update(getattr(
 
1363
                                    prop, "_dbus_annotations", {}))
 
1364
                        for name, value in annots.items():
 
1365
                            ann_tag = document.createElement(
 
1366
                                "annotation")
 
1367
                            ann_tag.setAttribute("name", name)
 
1368
                            ann_tag.setAttribute("value", value)
 
1369
                            tag.appendChild(ann_tag)
 
1370
                # Add interface annotation tags
 
1371
                for annotation, value in dict(
 
1372
                    itertools.chain.from_iterable(
 
1373
                        annotations().items()
 
1374
                        for name, annotations
 
1375
                        in self._get_all_dbus_things("interface")
 
1376
                        if name == if_tag.getAttribute("name")
 
1377
                        )).items():
 
1378
                    ann_tag = document.createElement("annotation")
 
1379
                    ann_tag.setAttribute("name", annotation)
 
1380
                    ann_tag.setAttribute("value", value)
 
1381
                    if_tag.appendChild(ann_tag)
 
1382
                # Fix argument name for the Introspect method itself
 
1383
                if (if_tag.getAttribute("name")
 
1384
                    == dbus.INTROSPECTABLE_IFACE):
 
1385
                    for cn in if_tag.getElementsByTagName("method"):
 
1386
                        if cn.getAttribute("name") == "Introspect":
 
1387
                            for arg in cn.getElementsByTagName("arg"):
 
1388
                                if (arg.getAttribute("direction")
 
1389
                                    == "out"):
 
1390
                                    arg.setAttribute("name",
 
1391
                                                     "xml_data")
 
1392
            xmlstring = document.toxml("utf-8")
 
1393
            document.unlink()
 
1394
        except (AttributeError, xml.dom.DOMException,
 
1395
                xml.parsers.expat.ExpatError) as error:
 
1396
            logger.error("Failed to override Introspection method",
 
1397
                         exc_info=error)
 
1398
        return xmlstring
 
1399
 
 
1400
 
 
1401
class DBusObjectWithProperties(DBusObjectWithAnnotations):
 
1402
    """A D-Bus object with properties.
 
1403
 
 
1404
    Classes inheriting from this can use the dbus_service_property
 
1405
    decorator to expose methods as D-Bus properties.  It exposes the
 
1406
    standard Get(), Set(), and GetAll() methods on the D-Bus.
 
1407
    """
 
1408
 
889
1409
    def _get_dbus_property(self, interface_name, property_name):
890
1410
        """Returns a bound method if one exists which is a D-Bus
891
1411
        property with the specified name and interface.
892
1412
        """
893
 
        for cls in  self.__class__.__mro__:
894
 
            for name, value in (inspect.getmembers
895
 
                                (cls,
896
 
                                 self._is_dbus_thing("property"))):
 
1413
        for cls in self.__class__.__mro__:
 
1414
            for name, value in inspect.getmembers(
 
1415
                    cls, self._is_dbus_thing("property")):
897
1416
                if (value._dbus_name == property_name
898
1417
                    and value._dbus_interface == interface_name):
899
1418
                    return value.__get__(self)
900
 
        
 
1419
 
901
1420
        # No such property
902
 
        raise DBusPropertyNotFound(self.dbus_object_path + ":"
903
 
                                   + interface_name + "."
904
 
                                   + property_name)
905
 
    
906
 
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
 
1421
        raise DBusPropertyNotFound("{}:{}.{}".format(
 
1422
            self.dbus_object_path, interface_name, property_name))
 
1423
 
 
1424
    @classmethod
 
1425
    def _get_all_interface_names(cls):
 
1426
        """Get a sequence of all interfaces supported by an object"""
 
1427
        return (name for name in set(getattr(getattr(x, attr),
 
1428
                                             "_dbus_interface", None)
 
1429
                                     for x in (inspect.getmro(cls))
 
1430
                                     for attr in dir(x))
 
1431
                if name is not None)
 
1432
 
 
1433
    @dbus.service.method(dbus.PROPERTIES_IFACE,
 
1434
                         in_signature="ss",
907
1435
                         out_signature="v")
908
1436
    def Get(self, interface_name, property_name):
909
1437
        """Standard D-Bus property Get() method, see D-Bus standard.
915
1443
        if not hasattr(value, "variant_level"):
916
1444
            return value
917
1445
        return type(value)(value, variant_level=value.variant_level+1)
918
 
    
 
1446
 
919
1447
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
920
1448
    def Set(self, interface_name, property_name, value):
921
1449
        """Standard D-Bus property Set() method, see D-Bus standard.
927
1455
            # The byte_arrays option is not supported yet on
928
1456
            # signatures other than "ay".
929
1457
            if prop._dbus_signature != "ay":
930
 
                raise ValueError
931
 
            value = dbus.ByteArray(b''.join(chr(byte)
932
 
                                            for byte in value))
 
1458
                raise ValueError("Byte arrays not supported for non-"
 
1459
                                 "'ay' signature {!r}"
 
1460
                                 .format(prop._dbus_signature))
 
1461
            value = dbus.ByteArray(bytes(value))
933
1462
        prop(value)
934
 
    
935
 
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
 
1463
 
 
1464
    @dbus.service.method(dbus.PROPERTIES_IFACE,
 
1465
                         in_signature="s",
936
1466
                         out_signature="a{sv}")
937
1467
    def GetAll(self, interface_name):
938
1468
        """Standard D-Bus property GetAll() method, see D-Bus
939
1469
        standard.
940
 
        
 
1470
 
941
1471
        Note: Will not include properties with access="write".
942
1472
        """
943
1473
        properties = {}
953
1483
            if not hasattr(value, "variant_level"):
954
1484
                properties[name] = value
955
1485
                continue
956
 
            properties[name] = type(value)(value, variant_level=
957
 
                                           value.variant_level+1)
 
1486
            properties[name] = type(value)(
 
1487
                value, variant_level=value.variant_level + 1)
958
1488
        return dbus.Dictionary(properties, signature="sv")
959
 
    
 
1489
 
 
1490
    @dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")
 
1491
    def PropertiesChanged(self, interface_name, changed_properties,
 
1492
                          invalidated_properties):
 
1493
        """Standard D-Bus PropertiesChanged() signal, see D-Bus
 
1494
        standard.
 
1495
        """
 
1496
        pass
 
1497
 
960
1498
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
961
1499
                         out_signature="s",
962
 
                         path_keyword='object_path',
963
 
                         connection_keyword='connection')
 
1500
                         path_keyword="object_path",
 
1501
                         connection_keyword="connection")
964
1502
    def Introspect(self, object_path, connection):
965
1503
        """Overloading of standard D-Bus method.
966
 
        
 
1504
 
967
1505
        Inserts property tags and interface annotation tags.
968
1506
        """
969
 
        xmlstring = dbus.service.Object.Introspect(self, object_path,
970
 
                                                   connection)
 
1507
        xmlstring = DBusObjectWithAnnotations.Introspect(self,
 
1508
                                                         object_path,
 
1509
                                                         connection)
971
1510
        try:
972
1511
            document = xml.dom.minidom.parseString(xmlstring)
 
1512
 
973
1513
            def make_tag(document, name, prop):
974
1514
                e = document.createElement("property")
975
1515
                e.setAttribute("name", name)
976
1516
                e.setAttribute("type", prop._dbus_signature)
977
1517
                e.setAttribute("access", prop._dbus_access)
978
1518
                return e
 
1519
 
979
1520
            for if_tag in document.getElementsByTagName("interface"):
980
1521
                # Add property tags
981
1522
                for tag in (make_tag(document, name, prop)
984
1525
                            if prop._dbus_interface
985
1526
                            == if_tag.getAttribute("name")):
986
1527
                    if_tag.appendChild(tag)
987
 
                # Add annotation tags
988
 
                for typ in ("method", "signal", "property"):
989
 
                    for tag in if_tag.getElementsByTagName(typ):
990
 
                        annots = dict()
991
 
                        for name, prop in (self.
992
 
                                           _get_all_dbus_things(typ)):
993
 
                            if (name == tag.getAttribute("name")
994
 
                                and prop._dbus_interface
995
 
                                == if_tag.getAttribute("name")):
996
 
                                annots.update(getattr
997
 
                                              (prop,
998
 
                                               "_dbus_annotations",
999
 
                                               {}))
1000
 
                        for name, value in annots.iteritems():
1001
 
                            ann_tag = document.createElement(
1002
 
                                "annotation")
1003
 
                            ann_tag.setAttribute("name", name)
1004
 
                            ann_tag.setAttribute("value", value)
1005
 
                            tag.appendChild(ann_tag)
1006
 
                # Add interface annotation tags
1007
 
                for annotation, value in dict(
1008
 
                    itertools.chain.from_iterable(
1009
 
                        annotations().iteritems()
1010
 
                        for name, annotations in
1011
 
                        self._get_all_dbus_things("interface")
1012
 
                        if name == if_tag.getAttribute("name")
1013
 
                        )).iteritems():
1014
 
                    ann_tag = document.createElement("annotation")
1015
 
                    ann_tag.setAttribute("name", annotation)
1016
 
                    ann_tag.setAttribute("value", value)
1017
 
                    if_tag.appendChild(ann_tag)
 
1528
                # Add annotation tags for properties
 
1529
                for tag in if_tag.getElementsByTagName("property"):
 
1530
                    annots = dict()
 
1531
                    for name, prop in self._get_all_dbus_things(
 
1532
                            "property"):
 
1533
                        if (name == tag.getAttribute("name")
 
1534
                            and prop._dbus_interface
 
1535
                            == if_tag.getAttribute("name")):
 
1536
                            annots.update(getattr(
 
1537
                                prop, "_dbus_annotations", {}))
 
1538
                    for name, value in annots.items():
 
1539
                        ann_tag = document.createElement(
 
1540
                            "annotation")
 
1541
                        ann_tag.setAttribute("name", name)
 
1542
                        ann_tag.setAttribute("value", value)
 
1543
                        tag.appendChild(ann_tag)
1018
1544
                # Add the names to the return values for the
1019
1545
                # "org.freedesktop.DBus.Properties" methods
1020
1546
                if (if_tag.getAttribute("name")
1039
1565
        return xmlstring
1040
1566
 
1041
1567
 
 
1568
try:
 
1569
    dbus.OBJECT_MANAGER_IFACE
 
1570
except AttributeError:
 
1571
    dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
 
1572
 
 
1573
 
 
1574
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
 
1575
    """A D-Bus object with an ObjectManager.
 
1576
 
 
1577
    Classes inheriting from this exposes the standard
 
1578
    GetManagedObjects call and the InterfacesAdded and
 
1579
    InterfacesRemoved signals on the standard
 
1580
    "org.freedesktop.DBus.ObjectManager" interface.
 
1581
 
 
1582
    Note: No signals are sent automatically; they must be sent
 
1583
    manually.
 
1584
    """
 
1585
    @dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
 
1586
                         out_signature="a{oa{sa{sv}}}")
 
1587
    def GetManagedObjects(self):
 
1588
        """This function must be overridden"""
 
1589
        raise NotImplementedError()
 
1590
 
 
1591
    @dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
 
1592
                         signature="oa{sa{sv}}")
 
1593
    def InterfacesAdded(self, object_path, interfaces_and_properties):
 
1594
        pass
 
1595
 
 
1596
    @dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature="oas")
 
1597
    def InterfacesRemoved(self, object_path, interfaces):
 
1598
        pass
 
1599
 
 
1600
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
 
1601
                         out_signature="s",
 
1602
                         path_keyword="object_path",
 
1603
                         connection_keyword="connection")
 
1604
    def Introspect(self, object_path, connection):
 
1605
        """Overloading of standard D-Bus method.
 
1606
 
 
1607
        Override return argument name of GetManagedObjects to be
 
1608
        "objpath_interfaces_and_properties"
 
1609
        """
 
1610
        xmlstring = DBusObjectWithAnnotations.Introspect(self,
 
1611
                                                         object_path,
 
1612
                                                         connection)
 
1613
        try:
 
1614
            document = xml.dom.minidom.parseString(xmlstring)
 
1615
 
 
1616
            for if_tag in document.getElementsByTagName("interface"):
 
1617
                # Fix argument name for the GetManagedObjects method
 
1618
                if (if_tag.getAttribute("name")
 
1619
                    == dbus.OBJECT_MANAGER_IFACE):
 
1620
                    for cn in if_tag.getElementsByTagName("method"):
 
1621
                        if (cn.getAttribute("name")
 
1622
                            == "GetManagedObjects"):
 
1623
                            for arg in cn.getElementsByTagName("arg"):
 
1624
                                if (arg.getAttribute("direction")
 
1625
                                    == "out"):
 
1626
                                    arg.setAttribute(
 
1627
                                        "name",
 
1628
                                        "objpath_interfaces"
 
1629
                                        "_and_properties")
 
1630
            xmlstring = document.toxml("utf-8")
 
1631
            document.unlink()
 
1632
        except (AttributeError, xml.dom.DOMException,
 
1633
                xml.parsers.expat.ExpatError) as error:
 
1634
            logger.error("Failed to override Introspection method",
 
1635
                         exc_info=error)
 
1636
        return xmlstring
 
1637
 
 
1638
 
1042
1639
def datetime_to_dbus(dt, variant_level=0):
1043
1640
    """Convert a UTC datetime.datetime() to a D-Bus type."""
1044
1641
    if dt is None:
1045
 
        return dbus.String("", variant_level = variant_level)
1046
 
    return dbus.String(dt.isoformat(),
1047
 
                       variant_level=variant_level)
 
1642
        return dbus.String("", variant_level=variant_level)
 
1643
    return dbus.String(dt.isoformat(), variant_level=variant_level)
1048
1644
 
1049
1645
 
1050
1646
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
1052
1648
    dbus.service.Object, it will add alternate D-Bus attributes with
1053
1649
    interface names according to the "alt_interface_names" mapping.
1054
1650
    Usage:
1055
 
    
 
1651
 
1056
1652
    @alternate_dbus_interfaces({"org.example.Interface":
1057
1653
                                    "net.example.AlternateInterface"})
1058
1654
    class SampleDBusObject(dbus.service.Object):
1059
1655
        @dbus.service.method("org.example.Interface")
1060
1656
        def SampleDBusMethod():
1061
1657
            pass
1062
 
    
 
1658
 
1063
1659
    The above "SampleDBusMethod" on "SampleDBusObject" will be
1064
1660
    reachable via two interfaces: "org.example.Interface" and
1065
1661
    "net.example.AlternateInterface", the latter of which will have
1066
1662
    its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
1067
1663
    "true", unless "deprecate" is passed with a False value.
1068
 
    
 
1664
 
1069
1665
    This works for methods and signals, and also for D-Bus properties
1070
1666
    (from DBusObjectWithProperties) and interfaces (from the
1071
1667
    dbus_interface_annotations decorator).
1072
1668
    """
 
1669
 
1073
1670
    def wrapper(cls):
1074
1671
        for orig_interface_name, alt_interface_name in (
1075
 
            alt_interface_names.iteritems()):
 
1672
                alt_interface_names.items()):
1076
1673
            attr = {}
1077
1674
            interface_names = set()
1078
1675
            # Go though all attributes of the class
1080
1677
                # Ignore non-D-Bus attributes, and D-Bus attributes
1081
1678
                # with the wrong interface name
1082
1679
                if (not hasattr(attribute, "_dbus_interface")
1083
 
                    or not attribute._dbus_interface
1084
 
                    .startswith(orig_interface_name)):
 
1680
                    or not attribute._dbus_interface.startswith(
 
1681
                        orig_interface_name)):
1085
1682
                    continue
1086
1683
                # Create an alternate D-Bus interface name based on
1087
1684
                # the current name
1088
 
                alt_interface = (attribute._dbus_interface
1089
 
                                 .replace(orig_interface_name,
1090
 
                                          alt_interface_name))
 
1685
                alt_interface = attribute._dbus_interface.replace(
 
1686
                    orig_interface_name, alt_interface_name)
1091
1687
                interface_names.add(alt_interface)
1092
1688
                # Is this a D-Bus signal?
1093
1689
                if getattr(attribute, "_dbus_is_signal", False):
1094
1690
                    # Extract the original non-method undecorated
1095
1691
                    # function by black magic
1096
 
                    nonmethod_func = (dict(
 
1692
                    if sys.version_info.major == 2:
 
1693
                        nonmethod_func = (dict(
1097
1694
                            zip(attribute.func_code.co_freevars,
1098
 
                                attribute.__closure__))["func"]
1099
 
                                      .cell_contents)
 
1695
                                attribute.__closure__))
 
1696
                                          ["func"].cell_contents)
 
1697
                    else:
 
1698
                        nonmethod_func = (dict(
 
1699
                            zip(attribute.__code__.co_freevars,
 
1700
                                attribute.__closure__))
 
1701
                                          ["func"].cell_contents)
1100
1702
                    # Create a new, but exactly alike, function
1101
1703
                    # object, and decorate it to be a new D-Bus signal
1102
1704
                    # with the alternate D-Bus interface name
1103
 
                    new_function = (dbus.service.signal
1104
 
                                    (alt_interface,
1105
 
                                     attribute._dbus_signature)
1106
 
                                    (types.FunctionType(
1107
 
                                nonmethod_func.func_code,
1108
 
                                nonmethod_func.func_globals,
1109
 
                                nonmethod_func.func_name,
1110
 
                                nonmethod_func.func_defaults,
1111
 
                                nonmethod_func.func_closure)))
 
1705
                    new_function = copy_function(nonmethod_func)
 
1706
                    new_function = (dbus.service.signal(
 
1707
                        alt_interface,
 
1708
                        attribute._dbus_signature)(new_function))
1112
1709
                    # Copy annotations, if any
1113
1710
                    try:
1114
 
                        new_function._dbus_annotations = (
1115
 
                            dict(attribute._dbus_annotations))
 
1711
                        new_function._dbus_annotations = dict(
 
1712
                            attribute._dbus_annotations)
1116
1713
                    except AttributeError:
1117
1714
                        pass
 
1715
 
1118
1716
                    # Define a creator of a function to call both the
1119
1717
                    # original and alternate functions, so both the
1120
1718
                    # original and alternate signals gets sent when
1123
1721
                        """This function is a scope container to pass
1124
1722
                        func1 and func2 to the "call_both" function
1125
1723
                        outside of its arguments"""
 
1724
 
 
1725
                        @functools.wraps(func2)
1126
1726
                        def call_both(*args, **kwargs):
1127
1727
                            """This function will emit two D-Bus
1128
1728
                            signals by calling func1 and func2"""
1129
1729
                            func1(*args, **kwargs)
1130
1730
                            func2(*args, **kwargs)
 
1731
                        # Make wrapper function look like a D-Bus
 
1732
                        # signal
 
1733
                        for name, attr in inspect.getmembers(func2):
 
1734
                            if name.startswith("_dbus_"):
 
1735
                                setattr(call_both, name, attr)
 
1736
 
1131
1737
                        return call_both
1132
1738
                    # Create the "call_both" function and add it to
1133
1739
                    # the class
1138
1744
                    # object.  Decorate it to be a new D-Bus method
1139
1745
                    # with the alternate D-Bus interface name.  Add it
1140
1746
                    # to the class.
1141
 
                    attr[attrname] = (dbus.service.method
1142
 
                                      (alt_interface,
1143
 
                                       attribute._dbus_in_signature,
1144
 
                                       attribute._dbus_out_signature)
1145
 
                                      (types.FunctionType
1146
 
                                       (attribute.func_code,
1147
 
                                        attribute.func_globals,
1148
 
                                        attribute.func_name,
1149
 
                                        attribute.func_defaults,
1150
 
                                        attribute.func_closure)))
 
1747
                    attr[attrname] = (
 
1748
                        dbus.service.method(
 
1749
                            alt_interface,
 
1750
                            attribute._dbus_in_signature,
 
1751
                            attribute._dbus_out_signature)
 
1752
                        (copy_function(attribute)))
1151
1753
                    # Copy annotations, if any
1152
1754
                    try:
1153
 
                        attr[attrname]._dbus_annotations = (
1154
 
                            dict(attribute._dbus_annotations))
 
1755
                        attr[attrname]._dbus_annotations = dict(
 
1756
                            attribute._dbus_annotations)
1155
1757
                    except AttributeError:
1156
1758
                        pass
1157
1759
                # Is this a D-Bus property?
1160
1762
                    # object, and decorate it to be a new D-Bus
1161
1763
                    # property with the alternate D-Bus interface
1162
1764
                    # name.  Add it to the class.
1163
 
                    attr[attrname] = (dbus_service_property
1164
 
                                      (alt_interface,
1165
 
                                       attribute._dbus_signature,
1166
 
                                       attribute._dbus_access,
1167
 
                                       attribute
1168
 
                                       ._dbus_get_args_options
1169
 
                                       ["byte_arrays"])
1170
 
                                      (types.FunctionType
1171
 
                                       (attribute.func_code,
1172
 
                                        attribute.func_globals,
1173
 
                                        attribute.func_name,
1174
 
                                        attribute.func_defaults,
1175
 
                                        attribute.func_closure)))
 
1765
                    attr[attrname] = (dbus_service_property(
 
1766
                        alt_interface, attribute._dbus_signature,
 
1767
                        attribute._dbus_access,
 
1768
                        attribute._dbus_get_args_options
 
1769
                        ["byte_arrays"])
 
1770
                                      (copy_function(attribute)))
1176
1771
                    # Copy annotations, if any
1177
1772
                    try:
1178
 
                        attr[attrname]._dbus_annotations = (
1179
 
                            dict(attribute._dbus_annotations))
 
1773
                        attr[attrname]._dbus_annotations = dict(
 
1774
                            attribute._dbus_annotations)
1180
1775
                    except AttributeError:
1181
1776
                        pass
1182
1777
                # Is this a D-Bus interface?
1185
1780
                    # object.  Decorate it to be a new D-Bus interface
1186
1781
                    # with the alternate D-Bus interface name.  Add it
1187
1782
                    # to the class.
1188
 
                    attr[attrname] = (dbus_interface_annotations
1189
 
                                      (alt_interface)
1190
 
                                      (types.FunctionType
1191
 
                                       (attribute.func_code,
1192
 
                                        attribute.func_globals,
1193
 
                                        attribute.func_name,
1194
 
                                        attribute.func_defaults,
1195
 
                                        attribute.func_closure)))
 
1783
                    attr[attrname] = (
 
1784
                        dbus_interface_annotations(alt_interface)
 
1785
                        (copy_function(attribute)))
1196
1786
            if deprecate:
1197
1787
                # Deprecate all alternate interfaces
1198
 
                iname="_AlternateDBusNames_interface_annotation{0}"
 
1788
                iname = "_AlternateDBusNames_interface_annotation{}"
1199
1789
                for interface_name in interface_names:
 
1790
 
1200
1791
                    @dbus_interface_annotations(interface_name)
1201
1792
                    def func(self):
1202
 
                        return { "org.freedesktop.DBus.Deprecated":
1203
 
                                     "true" }
 
1793
                        return {"org.freedesktop.DBus.Deprecated":
 
1794
                                "true"}
1204
1795
                    # Find an unused name
1205
1796
                    for aname in (iname.format(i)
1206
1797
                                  for i in itertools.count()):
1210
1801
            if interface_names:
1211
1802
                # Replace the class with a new subclass of it with
1212
1803
                # methods, signals, etc. as created above.
1213
 
                cls = type(b"{0}Alternate".format(cls.__name__),
1214
 
                           (cls,), attr)
 
1804
                if sys.version_info.major == 2:
 
1805
                    cls = type(b"{}Alternate".format(cls.__name__),
 
1806
                               (cls, ), attr)
 
1807
                else:
 
1808
                    cls = type("{}Alternate".format(cls.__name__),
 
1809
                               (cls, ), attr)
1215
1810
        return cls
 
1811
 
1216
1812
    return wrapper
1217
1813
 
1218
1814
 
1219
1815
@alternate_dbus_interfaces({"se.recompile.Mandos":
1220
 
                                "se.bsnet.fukt.Mandos"})
 
1816
                            "se.bsnet.fukt.Mandos"})
1221
1817
class ClientDBus(Client, DBusObjectWithProperties):
1222
1818
    """A Client class using D-Bus
1223
 
    
 
1819
 
1224
1820
    Attributes:
1225
1821
    dbus_object_path: dbus.ObjectPath
1226
1822
    bus: dbus.SystemBus()
1227
1823
    """
1228
 
    
 
1824
 
1229
1825
    runtime_expansions = (Client.runtime_expansions
1230
 
                          + ("dbus_object_path",))
1231
 
    
 
1826
                          + ("dbus_object_path", ))
 
1827
 
 
1828
    _interface = "se.recompile.Mandos.Client"
 
1829
 
1232
1830
    # dbus.service.Object doesn't use super(), so we can't either.
1233
 
    
1234
 
    def __init__(self, bus = None, *args, **kwargs):
 
1831
 
 
1832
    def __init__(self, bus=None, *args, **kwargs):
1235
1833
        self.bus = bus
1236
1834
        Client.__init__(self, *args, **kwargs)
1237
1835
        # Only now, when this client is initialized, can it show up on
1238
1836
        # the D-Bus
1239
 
        client_object_name = unicode(self.name).translate(
 
1837
        client_object_name = str(self.name).translate(
1240
1838
            {ord("."): ord("_"),
1241
1839
             ord("-"): ord("_")})
1242
 
        self.dbus_object_path = (dbus.ObjectPath
1243
 
                                 ("/clients/" + client_object_name))
 
1840
        self.dbus_object_path = dbus.ObjectPath(
 
1841
            "/clients/" + client_object_name)
1244
1842
        DBusObjectWithProperties.__init__(self, self.bus,
1245
1843
                                          self.dbus_object_path)
1246
 
    
1247
 
    def notifychangeproperty(transform_func,
1248
 
                             dbus_name, type_func=lambda x: x,
1249
 
                             variant_level=1):
 
1844
 
 
1845
    def notifychangeproperty(transform_func, dbus_name,
 
1846
                             type_func=lambda x: x,
 
1847
                             variant_level=1,
 
1848
                             invalidate_only=False,
 
1849
                             _interface=_interface):
1250
1850
        """ Modify a variable so that it's a property which announces
1251
1851
        its changes to DBus.
1252
 
        
 
1852
 
1253
1853
        transform_fun: Function that takes a value and a variant_level
1254
1854
                       and transforms it to a D-Bus type.
1255
1855
        dbus_name: D-Bus name of the variable
1257
1857
                   to the D-Bus.  Default: no transform
1258
1858
        variant_level: D-Bus variant level.  Default: 1
1259
1859
        """
1260
 
        attrname = "_{0}".format(dbus_name)
 
1860
        attrname = "_{}".format(dbus_name)
 
1861
 
1261
1862
        def setter(self, value):
1262
1863
            if hasattr(self, "dbus_object_path"):
1263
1864
                if (not hasattr(self, attrname) or
1264
1865
                    type_func(getattr(self, attrname, None))
1265
1866
                    != type_func(value)):
1266
 
                    dbus_value = transform_func(type_func(value),
1267
 
                                                variant_level
1268
 
                                                =variant_level)
1269
 
                    self.PropertyChanged(dbus.String(dbus_name),
1270
 
                                         dbus_value)
 
1867
                    if invalidate_only:
 
1868
                        self.PropertiesChanged(
 
1869
                            _interface, dbus.Dictionary(),
 
1870
                            dbus.Array((dbus_name, )))
 
1871
                    else:
 
1872
                        dbus_value = transform_func(
 
1873
                            type_func(value),
 
1874
                            variant_level=variant_level)
 
1875
                        self.PropertyChanged(dbus.String(dbus_name),
 
1876
                                             dbus_value)
 
1877
                        self.PropertiesChanged(
 
1878
                            _interface,
 
1879
                            dbus.Dictionary({dbus.String(dbus_name):
 
1880
                                             dbus_value}),
 
1881
                            dbus.Array())
1271
1882
            setattr(self, attrname, value)
1272
 
        
 
1883
 
1273
1884
        return property(lambda self: getattr(self, attrname), setter)
1274
 
    
 
1885
 
1275
1886
    expires = notifychangeproperty(datetime_to_dbus, "Expires")
1276
1887
    approvals_pending = notifychangeproperty(dbus.Boolean,
1277
1888
                                             "ApprovalPending",
1278
 
                                             type_func = bool)
 
1889
                                             type_func=bool)
1279
1890
    enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1280
1891
    last_enabled = notifychangeproperty(datetime_to_dbus,
1281
1892
                                        "LastEnabled")
1282
 
    checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",
1283
 
                                   type_func = lambda checker:
1284
 
                                       checker is not None)
 
1893
    checker = notifychangeproperty(
 
1894
        dbus.Boolean, "CheckerRunning",
 
1895
        type_func=lambda checker: checker is not None)
1285
1896
    last_checked_ok = notifychangeproperty(datetime_to_dbus,
1286
1897
                                           "LastCheckedOK")
1287
1898
    last_checker_status = notifychangeproperty(dbus.Int16,
1290
1901
        datetime_to_dbus, "LastApprovalRequest")
1291
1902
    approved_by_default = notifychangeproperty(dbus.Boolean,
1292
1903
                                               "ApprovedByDefault")
1293
 
    approval_delay = notifychangeproperty(dbus.UInt64,
1294
 
                                          "ApprovalDelay",
1295
 
                                          type_func =
1296
 
                                          timedelta_to_milliseconds)
 
1904
    approval_delay = notifychangeproperty(
 
1905
        dbus.UInt64, "ApprovalDelay",
 
1906
        type_func=lambda td: td.total_seconds() * 1000)
1297
1907
    approval_duration = notifychangeproperty(
1298
1908
        dbus.UInt64, "ApprovalDuration",
1299
 
        type_func = timedelta_to_milliseconds)
 
1909
        type_func=lambda td: td.total_seconds() * 1000)
1300
1910
    host = notifychangeproperty(dbus.String, "Host")
1301
 
    timeout = notifychangeproperty(dbus.UInt64, "Timeout",
1302
 
                                   type_func =
1303
 
                                   timedelta_to_milliseconds)
 
1911
    timeout = notifychangeproperty(
 
1912
        dbus.UInt64, "Timeout",
 
1913
        type_func=lambda td: td.total_seconds() * 1000)
1304
1914
    extended_timeout = notifychangeproperty(
1305
1915
        dbus.UInt64, "ExtendedTimeout",
1306
 
        type_func = timedelta_to_milliseconds)
1307
 
    interval = notifychangeproperty(dbus.UInt64,
1308
 
                                    "Interval",
1309
 
                                    type_func =
1310
 
                                    timedelta_to_milliseconds)
 
1916
        type_func=lambda td: td.total_seconds() * 1000)
 
1917
    interval = notifychangeproperty(
 
1918
        dbus.UInt64, "Interval",
 
1919
        type_func=lambda td: td.total_seconds() * 1000)
1311
1920
    checker_command = notifychangeproperty(dbus.String, "Checker")
1312
 
    
 
1921
    secret = notifychangeproperty(dbus.ByteArray, "Secret",
 
1922
                                  invalidate_only=True)
 
1923
 
1313
1924
    del notifychangeproperty
1314
 
    
 
1925
 
1315
1926
    def __del__(self, *args, **kwargs):
1316
1927
        try:
1317
1928
            self.remove_from_connection()
1320
1931
        if hasattr(DBusObjectWithProperties, "__del__"):
1321
1932
            DBusObjectWithProperties.__del__(self, *args, **kwargs)
1322
1933
        Client.__del__(self, *args, **kwargs)
1323
 
    
1324
 
    def checker_callback(self, pid, condition, command,
1325
 
                         *args, **kwargs):
1326
 
        self.checker_callback_tag = None
1327
 
        self.checker = None
1328
 
        if os.WIFEXITED(condition):
1329
 
            exitstatus = os.WEXITSTATUS(condition)
 
1934
 
 
1935
    def checker_callback(self, source, condition,
 
1936
                         connection, command, *args, **kwargs):
 
1937
        ret = Client.checker_callback(self, source, condition,
 
1938
                                      connection, command, *args,
 
1939
                                      **kwargs)
 
1940
        exitstatus = self.last_checker_status
 
1941
        if exitstatus >= 0:
1330
1942
            # Emit D-Bus signal
1331
1943
            self.CheckerCompleted(dbus.Int16(exitstatus),
1332
 
                                  dbus.Int64(condition),
 
1944
                                  # This is specific to GNU libC
 
1945
                                  dbus.Int64(exitstatus << 8),
1333
1946
                                  dbus.String(command))
1334
1947
        else:
1335
1948
            # Emit D-Bus signal
1336
1949
            self.CheckerCompleted(dbus.Int16(-1),
1337
 
                                  dbus.Int64(condition),
 
1950
                                  dbus.Int64(
 
1951
                                      # This is specific to GNU libC
 
1952
                                      (exitstatus << 8)
 
1953
                                      | self.last_checker_signal),
1338
1954
                                  dbus.String(command))
1339
 
        
1340
 
        return Client.checker_callback(self, pid, condition, command,
1341
 
                                       *args, **kwargs)
1342
 
    
 
1955
        return ret
 
1956
 
1343
1957
    def start_checker(self, *args, **kwargs):
1344
 
        old_checker = self.checker
1345
 
        if self.checker is not None:
1346
 
            old_checker_pid = self.checker.pid
1347
 
        else:
1348
 
            old_checker_pid = None
 
1958
        old_checker_pid = getattr(self.checker, "pid", None)
1349
1959
        r = Client.start_checker(self, *args, **kwargs)
1350
1960
        # Only if new checker process was started
1351
1961
        if (self.checker is not None
1353
1963
            # Emit D-Bus signal
1354
1964
            self.CheckerStarted(self.current_checker_command)
1355
1965
        return r
1356
 
    
 
1966
 
1357
1967
    def _reset_approved(self):
1358
1968
        self.approved = None
1359
1969
        return False
1360
 
    
 
1970
 
1361
1971
    def approve(self, value=True):
1362
1972
        self.approved = value
1363
 
        gobject.timeout_add(timedelta_to_milliseconds
1364
 
                            (self.approval_duration),
1365
 
                            self._reset_approved)
 
1973
        GLib.timeout_add(int(self.approval_duration.total_seconds()
 
1974
                             * 1000), self._reset_approved)
1366
1975
        self.send_changedstate()
1367
 
    
1368
 
    ## D-Bus methods, signals & properties
1369
 
    _interface = "se.recompile.Mandos.Client"
1370
 
    
1371
 
    ## Interfaces
1372
 
    
1373
 
    @dbus_interface_annotations(_interface)
1374
 
    def _foo(self):
1375
 
        return { "org.freedesktop.DBus.Property.EmitsChangedSignal":
1376
 
                     "false"}
1377
 
    
1378
 
    ## Signals
1379
 
    
 
1976
 
 
1977
    #  D-Bus methods, signals & properties
 
1978
 
 
1979
    #  Interfaces
 
1980
 
 
1981
    #  Signals
 
1982
 
1380
1983
    # CheckerCompleted - signal
1381
1984
    @dbus.service.signal(_interface, signature="nxs")
1382
1985
    def CheckerCompleted(self, exitcode, waitstatus, command):
1383
1986
        "D-Bus signal"
1384
1987
        pass
1385
 
    
 
1988
 
1386
1989
    # CheckerStarted - signal
1387
1990
    @dbus.service.signal(_interface, signature="s")
1388
1991
    def CheckerStarted(self, command):
1389
1992
        "D-Bus signal"
1390
1993
        pass
1391
 
    
 
1994
 
1392
1995
    # PropertyChanged - signal
 
1996
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1393
1997
    @dbus.service.signal(_interface, signature="sv")
1394
1998
    def PropertyChanged(self, property, value):
1395
1999
        "D-Bus signal"
1396
2000
        pass
1397
 
    
 
2001
 
1398
2002
    # GotSecret - signal
1399
2003
    @dbus.service.signal(_interface)
1400
2004
    def GotSecret(self):
1403
2007
        server to mandos-client
1404
2008
        """
1405
2009
        pass
1406
 
    
 
2010
 
1407
2011
    # Rejected - signal
1408
2012
    @dbus.service.signal(_interface, signature="s")
1409
2013
    def Rejected(self, reason):
1410
2014
        "D-Bus signal"
1411
2015
        pass
1412
 
    
 
2016
 
1413
2017
    # NeedApproval - signal
1414
2018
    @dbus.service.signal(_interface, signature="tb")
1415
2019
    def NeedApproval(self, timeout, default):
1416
2020
        "D-Bus signal"
1417
2021
        return self.need_approval()
1418
 
    
1419
 
    ## Methods
1420
 
    
 
2022
 
 
2023
    #  Methods
 
2024
 
1421
2025
    # Approve - method
1422
2026
    @dbus.service.method(_interface, in_signature="b")
1423
2027
    def Approve(self, value):
1424
2028
        self.approve(value)
1425
 
    
 
2029
 
1426
2030
    # CheckedOK - method
1427
2031
    @dbus.service.method(_interface)
1428
2032
    def CheckedOK(self):
1429
2033
        self.checked_ok()
1430
 
    
 
2034
 
1431
2035
    # Enable - method
 
2036
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1432
2037
    @dbus.service.method(_interface)
1433
2038
    def Enable(self):
1434
2039
        "D-Bus method"
1435
2040
        self.enable()
1436
 
    
 
2041
 
1437
2042
    # StartChecker - method
 
2043
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1438
2044
    @dbus.service.method(_interface)
1439
2045
    def StartChecker(self):
1440
2046
        "D-Bus method"
1441
2047
        self.start_checker()
1442
 
    
 
2048
 
1443
2049
    # Disable - method
 
2050
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1444
2051
    @dbus.service.method(_interface)
1445
2052
    def Disable(self):
1446
2053
        "D-Bus method"
1447
2054
        self.disable()
1448
 
    
 
2055
 
1449
2056
    # StopChecker - method
 
2057
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1450
2058
    @dbus.service.method(_interface)
1451
2059
    def StopChecker(self):
1452
2060
        self.stop_checker()
1453
 
    
1454
 
    ## Properties
1455
 
    
 
2061
 
 
2062
    #  Properties
 
2063
 
1456
2064
    # ApprovalPending - property
1457
2065
    @dbus_service_property(_interface, signature="b", access="read")
1458
2066
    def ApprovalPending_dbus_property(self):
1459
2067
        return dbus.Boolean(bool(self.approvals_pending))
1460
 
    
 
2068
 
1461
2069
    # ApprovedByDefault - property
1462
 
    @dbus_service_property(_interface, signature="b",
 
2070
    @dbus_service_property(_interface,
 
2071
                           signature="b",
1463
2072
                           access="readwrite")
1464
2073
    def ApprovedByDefault_dbus_property(self, value=None):
1465
2074
        if value is None:       # get
1466
2075
            return dbus.Boolean(self.approved_by_default)
1467
2076
        self.approved_by_default = bool(value)
1468
 
    
 
2077
 
1469
2078
    # ApprovalDelay - property
1470
 
    @dbus_service_property(_interface, signature="t",
 
2079
    @dbus_service_property(_interface,
 
2080
                           signature="t",
1471
2081
                           access="readwrite")
1472
2082
    def ApprovalDelay_dbus_property(self, value=None):
1473
2083
        if value is None:       # get
1474
 
            return dbus.UInt64(self.approval_delay_milliseconds())
 
2084
            return dbus.UInt64(self.approval_delay.total_seconds()
 
2085
                               * 1000)
1475
2086
        self.approval_delay = datetime.timedelta(0, 0, 0, value)
1476
 
    
 
2087
 
1477
2088
    # ApprovalDuration - property
1478
 
    @dbus_service_property(_interface, signature="t",
 
2089
    @dbus_service_property(_interface,
 
2090
                           signature="t",
1479
2091
                           access="readwrite")
1480
2092
    def ApprovalDuration_dbus_property(self, value=None):
1481
2093
        if value is None:       # get
1482
 
            return dbus.UInt64(timedelta_to_milliseconds(
1483
 
                    self.approval_duration))
 
2094
            return dbus.UInt64(self.approval_duration.total_seconds()
 
2095
                               * 1000)
1484
2096
        self.approval_duration = datetime.timedelta(0, 0, 0, value)
1485
 
    
 
2097
 
1486
2098
    # Name - property
 
2099
    @dbus_annotations(
 
2100
        {"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1487
2101
    @dbus_service_property(_interface, signature="s", access="read")
1488
2102
    def Name_dbus_property(self):
1489
2103
        return dbus.String(self.name)
1490
 
    
 
2104
 
 
2105
    # KeyID - property
 
2106
    @dbus_annotations(
 
2107
        {"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
 
2108
    @dbus_service_property(_interface, signature="s", access="read")
 
2109
    def KeyID_dbus_property(self):
 
2110
        return dbus.String(self.key_id)
 
2111
 
1491
2112
    # Fingerprint - property
 
2113
    @dbus_annotations(
 
2114
        {"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1492
2115
    @dbus_service_property(_interface, signature="s", access="read")
1493
2116
    def Fingerprint_dbus_property(self):
1494
2117
        return dbus.String(self.fingerprint)
1495
 
    
 
2118
 
1496
2119
    # Host - property
1497
 
    @dbus_service_property(_interface, signature="s",
 
2120
    @dbus_service_property(_interface,
 
2121
                           signature="s",
1498
2122
                           access="readwrite")
1499
2123
    def Host_dbus_property(self, value=None):
1500
2124
        if value is None:       # get
1501
2125
            return dbus.String(self.host)
1502
 
        self.host = unicode(value)
1503
 
    
 
2126
        self.host = str(value)
 
2127
 
1504
2128
    # Created - property
 
2129
    @dbus_annotations(
 
2130
        {"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1505
2131
    @dbus_service_property(_interface, signature="s", access="read")
1506
2132
    def Created_dbus_property(self):
1507
2133
        return datetime_to_dbus(self.created)
1508
 
    
 
2134
 
1509
2135
    # LastEnabled - property
1510
2136
    @dbus_service_property(_interface, signature="s", access="read")
1511
2137
    def LastEnabled_dbus_property(self):
1512
2138
        return datetime_to_dbus(self.last_enabled)
1513
 
    
 
2139
 
1514
2140
    # Enabled - property
1515
 
    @dbus_service_property(_interface, signature="b",
 
2141
    @dbus_service_property(_interface,
 
2142
                           signature="b",
1516
2143
                           access="readwrite")
1517
2144
    def Enabled_dbus_property(self, value=None):
1518
2145
        if value is None:       # get
1521
2148
            self.enable()
1522
2149
        else:
1523
2150
            self.disable()
1524
 
    
 
2151
 
1525
2152
    # LastCheckedOK - property
1526
 
    @dbus_service_property(_interface, signature="s",
 
2153
    @dbus_service_property(_interface,
 
2154
                           signature="s",
1527
2155
                           access="readwrite")
1528
2156
    def LastCheckedOK_dbus_property(self, value=None):
1529
2157
        if value is not None:
1530
2158
            self.checked_ok()
1531
2159
            return
1532
2160
        return datetime_to_dbus(self.last_checked_ok)
1533
 
    
 
2161
 
1534
2162
    # LastCheckerStatus - property
1535
 
    @dbus_service_property(_interface, signature="n",
1536
 
                           access="read")
 
2163
    @dbus_service_property(_interface, signature="n", access="read")
1537
2164
    def LastCheckerStatus_dbus_property(self):
1538
2165
        return dbus.Int16(self.last_checker_status)
1539
 
    
 
2166
 
1540
2167
    # Expires - property
1541
2168
    @dbus_service_property(_interface, signature="s", access="read")
1542
2169
    def Expires_dbus_property(self):
1543
2170
        return datetime_to_dbus(self.expires)
1544
 
    
 
2171
 
1545
2172
    # LastApprovalRequest - property
1546
2173
    @dbus_service_property(_interface, signature="s", access="read")
1547
2174
    def LastApprovalRequest_dbus_property(self):
1548
2175
        return datetime_to_dbus(self.last_approval_request)
1549
 
    
 
2176
 
1550
2177
    # Timeout - property
1551
 
    @dbus_service_property(_interface, signature="t",
 
2178
    @dbus_service_property(_interface,
 
2179
                           signature="t",
1552
2180
                           access="readwrite")
1553
2181
    def Timeout_dbus_property(self, value=None):
1554
2182
        if value is None:       # get
1555
 
            return dbus.UInt64(self.timeout_milliseconds())
 
2183
            return dbus.UInt64(self.timeout.total_seconds() * 1000)
1556
2184
        old_timeout = self.timeout
1557
2185
        self.timeout = datetime.timedelta(0, 0, 0, value)
1558
2186
        # Reschedule disabling
1566
2194
                if (getattr(self, "disable_initiator_tag", None)
1567
2195
                    is None):
1568
2196
                    return
1569
 
                gobject.source_remove(self.disable_initiator_tag)
1570
 
                self.disable_initiator_tag = (
1571
 
                    gobject.timeout_add(
1572
 
                        timedelta_to_milliseconds(self.expires - now),
1573
 
                        self.disable))
1574
 
    
 
2197
                GLib.source_remove(self.disable_initiator_tag)
 
2198
                self.disable_initiator_tag = GLib.timeout_add(
 
2199
                    int((self.expires - now).total_seconds() * 1000),
 
2200
                    self.disable)
 
2201
 
1575
2202
    # ExtendedTimeout - property
1576
 
    @dbus_service_property(_interface, signature="t",
 
2203
    @dbus_service_property(_interface,
 
2204
                           signature="t",
1577
2205
                           access="readwrite")
1578
2206
    def ExtendedTimeout_dbus_property(self, value=None):
1579
2207
        if value is None:       # get
1580
 
            return dbus.UInt64(self.extended_timeout_milliseconds())
 
2208
            return dbus.UInt64(self.extended_timeout.total_seconds()
 
2209
                               * 1000)
1581
2210
        self.extended_timeout = datetime.timedelta(0, 0, 0, value)
1582
 
    
 
2211
 
1583
2212
    # Interval - property
1584
 
    @dbus_service_property(_interface, signature="t",
 
2213
    @dbus_service_property(_interface,
 
2214
                           signature="t",
1585
2215
                           access="readwrite")
1586
2216
    def Interval_dbus_property(self, value=None):
1587
2217
        if value is None:       # get
1588
 
            return dbus.UInt64(self.interval_milliseconds())
 
2218
            return dbus.UInt64(self.interval.total_seconds() * 1000)
1589
2219
        self.interval = datetime.timedelta(0, 0, 0, value)
1590
2220
        if getattr(self, "checker_initiator_tag", None) is None:
1591
2221
            return
1592
2222
        if self.enabled:
1593
2223
            # Reschedule checker run
1594
 
            gobject.source_remove(self.checker_initiator_tag)
1595
 
            self.checker_initiator_tag = (gobject.timeout_add
1596
 
                                          (value, self.start_checker))
1597
 
            self.start_checker()    # Start one now, too
1598
 
    
 
2224
            GLib.source_remove(self.checker_initiator_tag)
 
2225
            self.checker_initiator_tag = GLib.timeout_add(
 
2226
                value, self.start_checker)
 
2227
            self.start_checker()  # Start one now, too
 
2228
 
1599
2229
    # Checker - property
1600
 
    @dbus_service_property(_interface, signature="s",
 
2230
    @dbus_service_property(_interface,
 
2231
                           signature="s",
1601
2232
                           access="readwrite")
1602
2233
    def Checker_dbus_property(self, value=None):
1603
2234
        if value is None:       # get
1604
2235
            return dbus.String(self.checker_command)
1605
 
        self.checker_command = unicode(value)
1606
 
    
 
2236
        self.checker_command = str(value)
 
2237
 
1607
2238
    # CheckerRunning - property
1608
 
    @dbus_service_property(_interface, signature="b",
 
2239
    @dbus_service_property(_interface,
 
2240
                           signature="b",
1609
2241
                           access="readwrite")
1610
2242
    def CheckerRunning_dbus_property(self, value=None):
1611
2243
        if value is None:       # get
1614
2246
            self.start_checker()
1615
2247
        else:
1616
2248
            self.stop_checker()
1617
 
    
 
2249
 
1618
2250
    # ObjectPath - property
 
2251
    @dbus_annotations(
 
2252
        {"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",
 
2253
         "org.freedesktop.DBus.Deprecated": "true"})
1619
2254
    @dbus_service_property(_interface, signature="o", access="read")
1620
2255
    def ObjectPath_dbus_property(self):
1621
 
        return self.dbus_object_path # is already a dbus.ObjectPath
1622
 
    
 
2256
        return self.dbus_object_path  # is already a dbus.ObjectPath
 
2257
 
1623
2258
    # Secret = property
1624
 
    @dbus_service_property(_interface, signature="ay",
1625
 
                           access="write", byte_arrays=True)
 
2259
    @dbus_annotations(
 
2260
        {"org.freedesktop.DBus.Property.EmitsChangedSignal":
 
2261
         "invalidates"})
 
2262
    @dbus_service_property(_interface,
 
2263
                           signature="ay",
 
2264
                           access="write",
 
2265
                           byte_arrays=True)
1626
2266
    def Secret_dbus_property(self, value):
1627
 
        self.secret = str(value)
1628
 
    
 
2267
        self.secret = bytes(value)
 
2268
 
1629
2269
    del _interface
1630
2270
 
1631
2271
 
1632
 
class ProxyClient(object):
1633
 
    def __init__(self, child_pipe, fpr, address):
 
2272
class ProxyClient:
 
2273
    def __init__(self, child_pipe, key_id, fpr, address):
1634
2274
        self._pipe = child_pipe
1635
 
        self._pipe.send(('init', fpr, address))
 
2275
        self._pipe.send(("init", key_id, fpr, address))
1636
2276
        if not self._pipe.recv():
1637
 
            raise KeyError()
1638
 
    
 
2277
            raise KeyError(key_id or fpr)
 
2278
 
1639
2279
    def __getattribute__(self, name):
1640
 
        if name == '_pipe':
 
2280
        if name == "_pipe":
1641
2281
            return super(ProxyClient, self).__getattribute__(name)
1642
 
        self._pipe.send(('getattr', name))
 
2282
        self._pipe.send(("getattr", name))
1643
2283
        data = self._pipe.recv()
1644
 
        if data[0] == 'data':
 
2284
        if data[0] == "data":
1645
2285
            return data[1]
1646
 
        if data[0] == 'function':
 
2286
        if data[0] == "function":
 
2287
 
1647
2288
            def func(*args, **kwargs):
1648
 
                self._pipe.send(('funcall', name, args, kwargs))
 
2289
                self._pipe.send(("funcall", name, args, kwargs))
1649
2290
                return self._pipe.recv()[1]
 
2291
 
1650
2292
            return func
1651
 
    
 
2293
 
1652
2294
    def __setattr__(self, name, value):
1653
 
        if name == '_pipe':
 
2295
        if name == "_pipe":
1654
2296
            return super(ProxyClient, self).__setattr__(name, value)
1655
 
        self._pipe.send(('setattr', name, value))
 
2297
        self._pipe.send(("setattr", name, value))
1656
2298
 
1657
2299
 
1658
2300
class ClientHandler(socketserver.BaseRequestHandler, object):
1659
2301
    """A class to handle client connections.
1660
 
    
 
2302
 
1661
2303
    Instantiated once for each connection to handle it.
1662
2304
    Note: This will run in its own forked process."""
1663
 
    
 
2305
 
1664
2306
    def handle(self):
1665
2307
        with contextlib.closing(self.server.child_pipe) as child_pipe:
1666
2308
            logger.info("TCP connection from: %s",
1667
 
                        unicode(self.client_address))
 
2309
                        str(self.client_address))
1668
2310
            logger.debug("Pipe FD: %d",
1669
2311
                         self.server.child_pipe.fileno())
1670
 
            
1671
 
            session = (gnutls.connection
1672
 
                       .ClientSession(self.request,
1673
 
                                      gnutls.connection
1674
 
                                      .X509Credentials()))
1675
 
            
1676
 
            # Note: gnutls.connection.X509Credentials is really a
1677
 
            # generic GnuTLS certificate credentials object so long as
1678
 
            # no X.509 keys are added to it.  Therefore, we can use it
1679
 
            # here despite using OpenPGP certificates.
1680
 
            
1681
 
            #priority = ':'.join(("NONE", "+VERS-TLS1.1",
1682
 
            #                      "+AES-256-CBC", "+SHA1",
1683
 
            #                      "+COMP-NULL", "+CTYPE-OPENPGP",
1684
 
            #                      "+DHE-DSS"))
 
2312
 
 
2313
            session = gnutls.ClientSession(self.request)
 
2314
 
 
2315
            # priority = ":".join(("NONE", "+VERS-TLS1.1",
 
2316
            #                       "+AES-256-CBC", "+SHA1",
 
2317
            #                       "+COMP-NULL", "+CTYPE-OPENPGP",
 
2318
            #                       "+DHE-DSS"))
1685
2319
            # Use a fallback default, since this MUST be set.
1686
2320
            priority = self.server.gnutls_priority
1687
2321
            if priority is None:
1688
2322
                priority = "NORMAL"
1689
 
            (gnutls.library.functions
1690
 
             .gnutls_priority_set_direct(session._c_object,
1691
 
                                         priority, None))
1692
 
            
 
2323
            gnutls.priority_set_direct(session,
 
2324
                                       priority.encode("utf-8"), None)
 
2325
 
1693
2326
            # Start communication using the Mandos protocol
1694
2327
            # Get protocol number
1695
2328
            line = self.request.makefile().readline()
1696
2329
            logger.debug("Protocol version: %r", line)
1697
2330
            try:
1698
2331
                if int(line.strip().split()[0]) > 1:
1699
 
                    raise RuntimeError
 
2332
                    raise RuntimeError(line)
1700
2333
            except (ValueError, IndexError, RuntimeError) as error:
1701
2334
                logger.error("Unknown protocol version: %s", error)
1702
2335
                return
1703
 
            
 
2336
 
1704
2337
            # Start GnuTLS connection
1705
2338
            try:
1706
2339
                session.handshake()
1707
 
            except gnutls.errors.GNUTLSError as error:
 
2340
            except gnutls.Error as error:
1708
2341
                logger.warning("Handshake failed: %s", error)
1709
2342
                # Do not run session.bye() here: the session is not
1710
2343
                # established.  Just abandon the request.
1711
2344
                return
1712
2345
            logger.debug("Handshake succeeded")
1713
 
            
 
2346
 
1714
2347
            approval_required = False
1715
2348
            try:
1716
 
                try:
1717
 
                    fpr = self.fingerprint(self.peer_certificate
1718
 
                                           (session))
1719
 
                except (TypeError,
1720
 
                        gnutls.errors.GNUTLSError) as error:
1721
 
                    logger.warning("Bad certificate: %s", error)
1722
 
                    return
1723
 
                logger.debug("Fingerprint: %s", fpr)
1724
 
                
1725
 
                try:
1726
 
                    client = ProxyClient(child_pipe, fpr,
 
2349
                if gnutls.has_rawpk:
 
2350
                    fpr = b""
 
2351
                    try:
 
2352
                        key_id = self.key_id(
 
2353
                            self.peer_certificate(session))
 
2354
                    except (TypeError, gnutls.Error) as error:
 
2355
                        logger.warning("Bad certificate: %s", error)
 
2356
                        return
 
2357
                    logger.debug("Key ID: %s",
 
2358
                                 key_id.decode("utf-8",
 
2359
                                               errors="replace"))
 
2360
 
 
2361
                else:
 
2362
                    key_id = b""
 
2363
                    try:
 
2364
                        fpr = self.fingerprint(
 
2365
                            self.peer_certificate(session))
 
2366
                    except (TypeError, gnutls.Error) as error:
 
2367
                        logger.warning("Bad certificate: %s", error)
 
2368
                        return
 
2369
                    logger.debug("Fingerprint: %s", fpr)
 
2370
 
 
2371
                try:
 
2372
                    client = ProxyClient(child_pipe, key_id, fpr,
1727
2373
                                         self.client_address)
1728
2374
                except KeyError:
1729
2375
                    return
1730
 
                
 
2376
 
1731
2377
                if client.approval_delay:
1732
2378
                    delay = client.approval_delay
1733
2379
                    client.approvals_pending += 1
1734
2380
                    approval_required = True
1735
 
                
 
2381
 
1736
2382
                while True:
1737
2383
                    if not client.enabled:
1738
2384
                        logger.info("Client %s is disabled",
1739
 
                                       client.name)
 
2385
                                    client.name)
1740
2386
                        if self.server.use_dbus:
1741
2387
                            # Emit D-Bus signal
1742
2388
                            client.Rejected("Disabled")
1743
2389
                        return
1744
 
                    
 
2390
 
1745
2391
                    if client.approved or not client.approval_delay:
1746
 
                        #We are approved or approval is disabled
 
2392
                        # We are approved or approval is disabled
1747
2393
                        break
1748
2394
                    elif client.approved is None:
1749
2395
                        logger.info("Client %s needs approval",
1751
2397
                        if self.server.use_dbus:
1752
2398
                            # Emit D-Bus signal
1753
2399
                            client.NeedApproval(
1754
 
                                client.approval_delay_milliseconds(),
1755
 
                                client.approved_by_default)
 
2400
                                client.approval_delay.total_seconds()
 
2401
                                * 1000, client.approved_by_default)
1756
2402
                    else:
1757
2403
                        logger.warning("Client %s was not approved",
1758
2404
                                       client.name)
1760
2406
                            # Emit D-Bus signal
1761
2407
                            client.Rejected("Denied")
1762
2408
                        return
1763
 
                    
1764
 
                    #wait until timeout or approved
 
2409
 
 
2410
                    # wait until timeout or approved
1765
2411
                    time = datetime.datetime.now()
1766
2412
                    client.changedstate.acquire()
1767
 
                    client.changedstate.wait(
1768
 
                        float(timedelta_to_milliseconds(delay)
1769
 
                              / 1000))
 
2413
                    client.changedstate.wait(delay.total_seconds())
1770
2414
                    client.changedstate.release()
1771
2415
                    time2 = datetime.datetime.now()
1772
2416
                    if (time2 - time) >= delay:
1782
2426
                            break
1783
2427
                    else:
1784
2428
                        delay -= time2 - time
1785
 
                
1786
 
                sent_size = 0
1787
 
                while sent_size < len(client.secret):
1788
 
                    try:
1789
 
                        sent = session.send(client.secret[sent_size:])
1790
 
                    except gnutls.errors.GNUTLSError as error:
1791
 
                        logger.warning("gnutls send failed",
1792
 
                                       exc_info=error)
1793
 
                        return
1794
 
                    logger.debug("Sent: %d, remaining: %d",
1795
 
                                 sent, len(client.secret)
1796
 
                                 - (sent_size + sent))
1797
 
                    sent_size += sent
1798
 
                
 
2429
 
 
2430
                try:
 
2431
                    session.send(client.secret)
 
2432
                except gnutls.Error as error:
 
2433
                    logger.warning("gnutls send failed",
 
2434
                                   exc_info=error)
 
2435
                    return
 
2436
 
1799
2437
                logger.info("Sending secret to %s", client.name)
1800
2438
                # bump the timeout using extended_timeout
1801
2439
                client.bump_timeout(client.extended_timeout)
1802
2440
                if self.server.use_dbus:
1803
2441
                    # Emit D-Bus signal
1804
2442
                    client.GotSecret()
1805
 
            
 
2443
 
1806
2444
            finally:
1807
2445
                if approval_required:
1808
2446
                    client.approvals_pending -= 1
1809
2447
                try:
1810
2448
                    session.bye()
1811
 
                except gnutls.errors.GNUTLSError as error:
 
2449
                except gnutls.Error as error:
1812
2450
                    logger.warning("GnuTLS bye failed",
1813
2451
                                   exc_info=error)
1814
 
    
 
2452
 
1815
2453
    @staticmethod
1816
2454
    def peer_certificate(session):
1817
 
        "Return the peer's OpenPGP certificate as a bytestring"
1818
 
        # If not an OpenPGP certificate...
1819
 
        if (gnutls.library.functions
1820
 
            .gnutls_certificate_type_get(session._c_object)
1821
 
            != gnutls.library.constants.GNUTLS_CRT_OPENPGP):
1822
 
            # ...do the normal thing
1823
 
            return session.peer_certificate
 
2455
        "Return the peer's certificate as a bytestring"
 
2456
        try:
 
2457
            cert_type = gnutls.certificate_type_get2(
 
2458
                session, gnutls.CTYPE_PEERS)
 
2459
        except AttributeError:
 
2460
            cert_type = gnutls.certificate_type_get(session)
 
2461
        if gnutls.has_rawpk:
 
2462
            valid_cert_types = frozenset((gnutls.CRT_RAWPK,))
 
2463
        else:
 
2464
            valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))
 
2465
        # If not a valid certificate type...
 
2466
        if cert_type not in valid_cert_types:
 
2467
            logger.info("Cert type %r not in %r", cert_type,
 
2468
                        valid_cert_types)
 
2469
            # ...return invalid data
 
2470
            return b""
1824
2471
        list_size = ctypes.c_uint(1)
1825
 
        cert_list = (gnutls.library.functions
1826
 
                     .gnutls_certificate_get_peers
1827
 
                     (session._c_object, ctypes.byref(list_size)))
 
2472
        cert_list = (gnutls.certificate_get_peers
 
2473
                     (session, ctypes.byref(list_size)))
1828
2474
        if not bool(cert_list) and list_size.value != 0:
1829
 
            raise gnutls.errors.GNUTLSError("error getting peer"
1830
 
                                            " certificate")
 
2475
            raise gnutls.Error("error getting peer certificate")
1831
2476
        if list_size.value == 0:
1832
2477
            return None
1833
2478
        cert = cert_list[0]
1834
2479
        return ctypes.string_at(cert.data, cert.size)
1835
 
    
 
2480
 
 
2481
    @staticmethod
 
2482
    def key_id(certificate):
 
2483
        "Convert a certificate bytestring to a hexdigit key ID"
 
2484
        # New GnuTLS "datum" with the public key
 
2485
        datum = gnutls.datum_t(
 
2486
            ctypes.cast(ctypes.c_char_p(certificate),
 
2487
                        ctypes.POINTER(ctypes.c_ubyte)),
 
2488
            ctypes.c_uint(len(certificate)))
 
2489
        # XXX all these need to be created in the gnutls "module"
 
2490
        # New empty GnuTLS certificate
 
2491
        pubkey = gnutls.pubkey_t()
 
2492
        gnutls.pubkey_init(ctypes.byref(pubkey))
 
2493
        # Import the raw public key into the certificate
 
2494
        gnutls.pubkey_import(pubkey,
 
2495
                             ctypes.byref(datum),
 
2496
                             gnutls.X509_FMT_DER)
 
2497
        # New buffer for the key ID
 
2498
        buf = ctypes.create_string_buffer(32)
 
2499
        buf_len = ctypes.c_size_t(len(buf))
 
2500
        # Get the key ID from the raw public key into the buffer
 
2501
        gnutls.pubkey_get_key_id(
 
2502
            pubkey,
 
2503
            gnutls.KEYID_USE_SHA256,
 
2504
            ctypes.cast(ctypes.byref(buf),
 
2505
                        ctypes.POINTER(ctypes.c_ubyte)),
 
2506
            ctypes.byref(buf_len))
 
2507
        # Deinit the certificate
 
2508
        gnutls.pubkey_deinit(pubkey)
 
2509
 
 
2510
        # Convert the buffer to a Python bytestring
 
2511
        key_id = ctypes.string_at(buf, buf_len.value)
 
2512
        # Convert the bytestring to hexadecimal notation
 
2513
        hex_key_id = binascii.hexlify(key_id).upper()
 
2514
        return hex_key_id
 
2515
 
1836
2516
    @staticmethod
1837
2517
    def fingerprint(openpgp):
1838
2518
        "Convert an OpenPGP bytestring to a hexdigit fingerprint"
1839
2519
        # New GnuTLS "datum" with the OpenPGP public key
1840
 
        datum = (gnutls.library.types
1841
 
                 .gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
1842
 
                                             ctypes.POINTER
1843
 
                                             (ctypes.c_ubyte)),
1844
 
                                 ctypes.c_uint(len(openpgp))))
 
2520
        datum = gnutls.datum_t(
 
2521
            ctypes.cast(ctypes.c_char_p(openpgp),
 
2522
                        ctypes.POINTER(ctypes.c_ubyte)),
 
2523
            ctypes.c_uint(len(openpgp)))
1845
2524
        # New empty GnuTLS certificate
1846
 
        crt = gnutls.library.types.gnutls_openpgp_crt_t()
1847
 
        (gnutls.library.functions
1848
 
         .gnutls_openpgp_crt_init(ctypes.byref(crt)))
 
2525
        crt = gnutls.openpgp_crt_t()
 
2526
        gnutls.openpgp_crt_init(ctypes.byref(crt))
1849
2527
        # Import the OpenPGP public key into the certificate
1850
 
        (gnutls.library.functions
1851
 
         .gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
1852
 
                                    gnutls.library.constants
1853
 
                                    .GNUTLS_OPENPGP_FMT_RAW))
 
2528
        gnutls.openpgp_crt_import(crt, ctypes.byref(datum),
 
2529
                                  gnutls.OPENPGP_FMT_RAW)
1854
2530
        # Verify the self signature in the key
1855
2531
        crtverify = ctypes.c_uint()
1856
 
        (gnutls.library.functions
1857
 
         .gnutls_openpgp_crt_verify_self(crt, 0,
1858
 
                                         ctypes.byref(crtverify)))
 
2532
        gnutls.openpgp_crt_verify_self(crt, 0,
 
2533
                                       ctypes.byref(crtverify))
1859
2534
        if crtverify.value != 0:
1860
 
            gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1861
 
            raise (gnutls.errors.CertificateSecurityError
1862
 
                   ("Verify failed"))
 
2535
            gnutls.openpgp_crt_deinit(crt)
 
2536
            raise gnutls.CertificateSecurityError(code
 
2537
                                                  =crtverify.value)
1863
2538
        # New buffer for the fingerprint
1864
2539
        buf = ctypes.create_string_buffer(20)
1865
2540
        buf_len = ctypes.c_size_t()
1866
2541
        # Get the fingerprint from the certificate into the buffer
1867
 
        (gnutls.library.functions
1868
 
         .gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
1869
 
                                             ctypes.byref(buf_len)))
 
2542
        gnutls.openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
 
2543
                                           ctypes.byref(buf_len))
1870
2544
        # Deinit the certificate
1871
 
        gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
 
2545
        gnutls.openpgp_crt_deinit(crt)
1872
2546
        # Convert the buffer to a Python bytestring
1873
2547
        fpr = ctypes.string_at(buf, buf_len.value)
1874
2548
        # Convert the bytestring to hexadecimal notation
1876
2550
        return hex_fpr
1877
2551
 
1878
2552
 
1879
 
class MultiprocessingMixIn(object):
 
2553
class MultiprocessingMixIn:
1880
2554
    """Like socketserver.ThreadingMixIn, but with multiprocessing"""
 
2555
 
1881
2556
    def sub_process_main(self, request, address):
1882
2557
        try:
1883
2558
            self.finish_request(request, address)
1884
2559
        except Exception:
1885
2560
            self.handle_error(request, address)
1886
2561
        self.close_request(request)
1887
 
    
 
2562
 
1888
2563
    def process_request(self, request, address):
1889
2564
        """Start a new process to process the request."""
1890
 
        proc = multiprocessing.Process(target = self.sub_process_main,
1891
 
                                       args = (request, address))
 
2565
        proc = multiprocessing.Process(target=self.sub_process_main,
 
2566
                                       args=(request, address))
1892
2567
        proc.start()
1893
2568
        return proc
1894
2569
 
1895
2570
 
1896
 
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
 
2571
class MultiprocessingMixInWithPipe(MultiprocessingMixIn):
1897
2572
    """ adds a pipe to the MixIn """
 
2573
 
1898
2574
    def process_request(self, request, client_address):
1899
2575
        """Overrides and wraps the original process_request().
1900
 
        
 
2576
 
1901
2577
        This function creates a new pipe in self.pipe
1902
2578
        """
1903
2579
        parent_pipe, self.child_pipe = multiprocessing.Pipe()
1904
 
        
 
2580
 
1905
2581
        proc = MultiprocessingMixIn.process_request(self, request,
1906
2582
                                                    client_address)
1907
2583
        self.child_pipe.close()
1908
2584
        self.add_pipe(parent_pipe, proc)
1909
 
    
 
2585
 
1910
2586
    def add_pipe(self, parent_pipe, proc):
1911
2587
        """Dummy function; override as necessary"""
1912
 
        raise NotImplementedError
 
2588
        raise NotImplementedError()
1913
2589
 
1914
2590
 
1915
2591
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
1916
 
                     socketserver.TCPServer, object):
1917
 
    """IPv6-capable TCP server.  Accepts 'None' as address and/or port
1918
 
    
 
2592
                     socketserver.TCPServer):
 
2593
    """IPv6-capable TCP server.  Accepts None as address and/or port
 
2594
 
1919
2595
    Attributes:
1920
2596
        enabled:        Boolean; whether this server is activated yet
1921
2597
        interface:      None or a network interface name (string)
1922
2598
        use_ipv6:       Boolean; to use IPv6 or not
1923
2599
    """
 
2600
 
1924
2601
    def __init__(self, server_address, RequestHandlerClass,
1925
 
                 interface=None, use_ipv6=True, socketfd=None):
 
2602
                 interface=None,
 
2603
                 use_ipv6=True,
 
2604
                 socketfd=None):
1926
2605
        """If socketfd is set, use that file descriptor instead of
1927
2606
        creating a new one with socket.socket().
1928
2607
        """
1934
2613
            self.socketfd = socketfd
1935
2614
            # Save the original socket.socket() function
1936
2615
            self.socket_socket = socket.socket
 
2616
 
1937
2617
            # To implement --socket, we monkey patch socket.socket.
1938
 
            # 
 
2618
            #
1939
2619
            # (When socketserver.TCPServer is a new-style class, we
1940
2620
            # could make self.socket into a property instead of monkey
1941
2621
            # patching socket.socket.)
1942
 
            # 
 
2622
            #
1943
2623
            # Create a one-time-only replacement for socket.socket()
1944
2624
            @functools.wraps(socket.socket)
1945
2625
            def socket_wrapper(*args, **kwargs):
1957
2637
        # socket_wrapper(), if socketfd was set.
1958
2638
        socketserver.TCPServer.__init__(self, server_address,
1959
2639
                                        RequestHandlerClass)
1960
 
    
 
2640
 
1961
2641
    def server_bind(self):
1962
2642
        """This overrides the normal server_bind() function
1963
2643
        to bind to an interface if one was specified, and also NOT to
1964
2644
        bind to an address or port if they were not specified."""
 
2645
        global SO_BINDTODEVICE
1965
2646
        if self.interface is not None:
1966
2647
            if SO_BINDTODEVICE is None:
1967
 
                logger.error("SO_BINDTODEVICE does not exist;"
1968
 
                             " cannot bind to interface %s",
1969
 
                             self.interface)
1970
 
            else:
1971
 
                try:
1972
 
                    self.socket.setsockopt(socket.SOL_SOCKET,
1973
 
                                           SO_BINDTODEVICE,
1974
 
                                           str(self.interface + '\0'))
1975
 
                except socket.error as error:
1976
 
                    if error.errno == errno.EPERM:
1977
 
                        logger.error("No permission to bind to"
1978
 
                                     " interface %s", self.interface)
1979
 
                    elif error.errno == errno.ENOPROTOOPT:
1980
 
                        logger.error("SO_BINDTODEVICE not available;"
1981
 
                                     " cannot bind to interface %s",
1982
 
                                     self.interface)
1983
 
                    elif error.errno == errno.ENODEV:
1984
 
                        logger.error("Interface %s does not exist,"
1985
 
                                     " cannot bind", self.interface)
1986
 
                    else:
1987
 
                        raise
 
2648
                # Fall back to a hard-coded value which seems to be
 
2649
                # common enough.
 
2650
                logger.warning("SO_BINDTODEVICE not found, trying 25")
 
2651
                SO_BINDTODEVICE = 25
 
2652
            try:
 
2653
                self.socket.setsockopt(
 
2654
                    socket.SOL_SOCKET, SO_BINDTODEVICE,
 
2655
                    (self.interface + "\0").encode("utf-8"))
 
2656
            except socket.error as error:
 
2657
                if error.errno == errno.EPERM:
 
2658
                    logger.error("No permission to bind to"
 
2659
                                 " interface %s", self.interface)
 
2660
                elif error.errno == errno.ENOPROTOOPT:
 
2661
                    logger.error("SO_BINDTODEVICE not available;"
 
2662
                                 " cannot bind to interface %s",
 
2663
                                 self.interface)
 
2664
                elif error.errno == errno.ENODEV:
 
2665
                    logger.error("Interface %s does not exist,"
 
2666
                                 " cannot bind", self.interface)
 
2667
                else:
 
2668
                    raise
1988
2669
        # Only bind(2) the socket if we really need to.
1989
2670
        if self.server_address[0] or self.server_address[1]:
 
2671
            if self.server_address[1]:
 
2672
                self.allow_reuse_address = True
1990
2673
            if not self.server_address[0]:
1991
2674
                if self.address_family == socket.AF_INET6:
1992
 
                    any_address = "::" # in6addr_any
 
2675
                    any_address = "::"  # in6addr_any
1993
2676
                else:
1994
 
                    any_address = "0.0.0.0" # INADDR_ANY
 
2677
                    any_address = "0.0.0.0"  # INADDR_ANY
1995
2678
                self.server_address = (any_address,
1996
2679
                                       self.server_address[1])
1997
2680
            elif not self.server_address[1]:
1998
 
                self.server_address = (self.server_address[0],
1999
 
                                       0)
 
2681
                self.server_address = (self.server_address[0], 0)
2000
2682
#                 if self.interface:
2001
2683
#                     self.server_address = (self.server_address[0],
2002
2684
#                                            0, # port
2008
2690
 
2009
2691
class MandosServer(IPv6_TCPServer):
2010
2692
    """Mandos server.
2011
 
    
 
2693
 
2012
2694
    Attributes:
2013
2695
        clients:        set of Client objects
2014
2696
        gnutls_priority GnuTLS priority string
2015
2697
        use_dbus:       Boolean; to emit D-Bus signals or not
2016
 
    
2017
 
    Assumes a gobject.MainLoop event loop.
 
2698
 
 
2699
    Assumes a GLib.MainLoop event loop.
2018
2700
    """
 
2701
 
2019
2702
    def __init__(self, server_address, RequestHandlerClass,
2020
 
                 interface=None, use_ipv6=True, clients=None,
2021
 
                 gnutls_priority=None, use_dbus=True, socketfd=None):
 
2703
                 interface=None,
 
2704
                 use_ipv6=True,
 
2705
                 clients=None,
 
2706
                 gnutls_priority=None,
 
2707
                 use_dbus=True,
 
2708
                 socketfd=None):
2022
2709
        self.enabled = False
2023
2710
        self.clients = clients
2024
2711
        if self.clients is None:
2027
2714
        self.gnutls_priority = gnutls_priority
2028
2715
        IPv6_TCPServer.__init__(self, server_address,
2029
2716
                                RequestHandlerClass,
2030
 
                                interface = interface,
2031
 
                                use_ipv6 = use_ipv6,
2032
 
                                socketfd = socketfd)
 
2717
                                interface=interface,
 
2718
                                use_ipv6=use_ipv6,
 
2719
                                socketfd=socketfd)
 
2720
 
2033
2721
    def server_activate(self):
2034
2722
        if self.enabled:
2035
2723
            return socketserver.TCPServer.server_activate(self)
2036
 
    
 
2724
 
2037
2725
    def enable(self):
2038
2726
        self.enabled = True
2039
 
    
 
2727
 
2040
2728
    def add_pipe(self, parent_pipe, proc):
2041
2729
        # Call "handle_ipc" for both data and EOF events
2042
 
        gobject.io_add_watch(parent_pipe.fileno(),
2043
 
                             gobject.IO_IN | gobject.IO_HUP,
2044
 
                             functools.partial(self.handle_ipc,
2045
 
                                               parent_pipe =
2046
 
                                               parent_pipe,
2047
 
                                               proc = proc))
2048
 
    
2049
 
    def handle_ipc(self, source, condition, parent_pipe=None,
2050
 
                   proc = None, client_object=None):
 
2730
        GLib.io_add_watch(
 
2731
            GLib.IOChannel.unix_new(parent_pipe.fileno()),
 
2732
            GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
 
2733
            functools.partial(self.handle_ipc,
 
2734
                              parent_pipe=parent_pipe,
 
2735
                              proc=proc))
 
2736
 
 
2737
    def handle_ipc(self, source, condition,
 
2738
                   parent_pipe=None,
 
2739
                   proc=None,
 
2740
                   client_object=None):
2051
2741
        # error, or the other end of multiprocessing.Pipe has closed
2052
 
        if condition & (gobject.IO_ERR | gobject.IO_HUP):
 
2742
        if condition & (GLib.IO_ERR | GLib.IO_HUP):
2053
2743
            # Wait for other process to exit
2054
2744
            proc.join()
2055
2745
            return False
2056
 
        
 
2746
 
2057
2747
        # Read a request from the child
2058
2748
        request = parent_pipe.recv()
2059
2749
        command = request[0]
2060
 
        
2061
 
        if command == 'init':
2062
 
            fpr = request[1]
2063
 
            address = request[2]
2064
 
            
2065
 
            for c in self.clients.itervalues():
2066
 
                if c.fingerprint == fpr:
 
2750
 
 
2751
        if command == "init":
 
2752
            key_id = request[1].decode("ascii")
 
2753
            fpr = request[2].decode("ascii")
 
2754
            address = request[3]
 
2755
 
 
2756
            for c in self.clients.values():
 
2757
                if key_id == ("E3B0C44298FC1C149AFBF4C8996FB924"
 
2758
                              "27AE41E4649B934CA495991B7852B855"):
 
2759
                    continue
 
2760
                if key_id and c.key_id == key_id:
 
2761
                    client = c
 
2762
                    break
 
2763
                if fpr and c.fingerprint == fpr:
2067
2764
                    client = c
2068
2765
                    break
2069
2766
            else:
2070
 
                logger.info("Client not found for fingerprint: %s, ad"
2071
 
                            "dress: %s", fpr, address)
 
2767
                logger.info("Client not found for key ID: %s, address"
 
2768
                            ": %s", key_id or fpr, address)
2072
2769
                if self.use_dbus:
2073
2770
                    # Emit D-Bus signal
2074
 
                    mandos_dbus_service.ClientNotFound(fpr,
 
2771
                    mandos_dbus_service.ClientNotFound(key_id or fpr,
2075
2772
                                                       address[0])
2076
2773
                parent_pipe.send(False)
2077
2774
                return False
2078
 
            
2079
 
            gobject.io_add_watch(parent_pipe.fileno(),
2080
 
                                 gobject.IO_IN | gobject.IO_HUP,
2081
 
                                 functools.partial(self.handle_ipc,
2082
 
                                                   parent_pipe =
2083
 
                                                   parent_pipe,
2084
 
                                                   proc = proc,
2085
 
                                                   client_object =
2086
 
                                                   client))
 
2775
 
 
2776
            GLib.io_add_watch(
 
2777
                GLib.IOChannel.unix_new(parent_pipe.fileno()),
 
2778
                GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
 
2779
                functools.partial(self.handle_ipc,
 
2780
                                  parent_pipe=parent_pipe,
 
2781
                                  proc=proc,
 
2782
                                  client_object=client))
2087
2783
            parent_pipe.send(True)
2088
2784
            # remove the old hook in favor of the new above hook on
2089
2785
            # same fileno
2090
2786
            return False
2091
 
        if command == 'funcall':
 
2787
        if command == "funcall":
2092
2788
            funcname = request[1]
2093
2789
            args = request[2]
2094
2790
            kwargs = request[3]
2095
 
            
2096
 
            parent_pipe.send(('data', getattr(client_object,
 
2791
 
 
2792
            parent_pipe.send(("data", getattr(client_object,
2097
2793
                                              funcname)(*args,
2098
 
                                                         **kwargs)))
2099
 
        
2100
 
        if command == 'getattr':
 
2794
                                                        **kwargs)))
 
2795
 
 
2796
        if command == "getattr":
2101
2797
            attrname = request[1]
2102
 
            if callable(client_object.__getattribute__(attrname)):
2103
 
                parent_pipe.send(('function',))
 
2798
            if isinstance(client_object.__getattribute__(attrname),
 
2799
                          collections.abc.Callable):
 
2800
                parent_pipe.send(("function", ))
2104
2801
            else:
2105
 
                parent_pipe.send(('data', client_object
2106
 
                                  .__getattribute__(attrname)))
2107
 
        
2108
 
        if command == 'setattr':
 
2802
                parent_pipe.send((
 
2803
                    "data", client_object.__getattribute__(attrname)))
 
2804
 
 
2805
        if command == "setattr":
2109
2806
            attrname = request[1]
2110
2807
            value = request[2]
2111
2808
            setattr(client_object, attrname, value)
2112
 
        
 
2809
 
2113
2810
        return True
2114
2811
 
2115
2812
 
2116
2813
def rfc3339_duration_to_delta(duration):
2117
2814
    """Parse an RFC 3339 "duration" and return a datetime.timedelta
2118
 
    
2119
 
    >>> rfc3339_duration_to_delta("P7D")
2120
 
    datetime.timedelta(7)
2121
 
    >>> rfc3339_duration_to_delta("PT60S")
2122
 
    datetime.timedelta(0, 60)
2123
 
    >>> rfc3339_duration_to_delta("PT60M")
2124
 
    datetime.timedelta(0, 3600)
2125
 
    >>> rfc3339_duration_to_delta("PT24H")
2126
 
    datetime.timedelta(1)
2127
 
    >>> rfc3339_duration_to_delta("P1W")
2128
 
    datetime.timedelta(7)
2129
 
    >>> rfc3339_duration_to_delta("PT5M30S")
2130
 
    datetime.timedelta(0, 330)
2131
 
    >>> rfc3339_duration_to_delta("P1DT3M20S")
2132
 
    datetime.timedelta(1, 200)
 
2815
 
 
2816
    >>> timedelta = datetime.timedelta
 
2817
    >>> rfc3339_duration_to_delta("P7D") == timedelta(7)
 
2818
    True
 
2819
    >>> rfc3339_duration_to_delta("PT60S") == timedelta(0, 60)
 
2820
    True
 
2821
    >>> rfc3339_duration_to_delta("PT60M") == timedelta(0, 3600)
 
2822
    True
 
2823
    >>> rfc3339_duration_to_delta("PT24H") == timedelta(1)
 
2824
    True
 
2825
    >>> rfc3339_duration_to_delta("P1W") == timedelta(7)
 
2826
    True
 
2827
    >>> rfc3339_duration_to_delta("PT5M30S") == timedelta(0, 330)
 
2828
    True
 
2829
    >>> rfc3339_duration_to_delta("P1DT3M20S") == timedelta(1, 200)
 
2830
    True
 
2831
    >>> del timedelta
2133
2832
    """
2134
 
    
 
2833
 
2135
2834
    # Parsing an RFC 3339 duration with regular expressions is not
2136
2835
    # possible - there would have to be multiple places for the same
2137
2836
    # values, like seconds.  The current code, while more esoteric, is
2138
2837
    # cleaner without depending on a parsing library.  If Python had a
2139
2838
    # built-in library for parsing we would use it, but we'd like to
2140
2839
    # avoid excessive use of external libraries.
2141
 
    
 
2840
 
2142
2841
    # New type for defining tokens, syntax, and semantics all-in-one
2143
 
    Token = collections.namedtuple("Token",
2144
 
                                   ("regexp", # To match token; if
2145
 
                                              # "value" is not None,
2146
 
                                              # must have a "group"
2147
 
                                              # containing digits
2148
 
                                    "value",  # datetime.timedelta or
2149
 
                                              # None
2150
 
                                    "followers")) # Tokens valid after
2151
 
                                                  # this token
 
2842
    Token = collections.namedtuple("Token", (
 
2843
        "regexp",  # To match token; if "value" is not None, must have
 
2844
                   # a "group" containing digits
 
2845
        "value",   # datetime.timedelta or None
 
2846
        "followers"))           # Tokens valid after this token
2152
2847
    # RFC 3339 "duration" tokens, syntax, and semantics; taken from
2153
2848
    # the "duration" ABNF definition in RFC 3339, Appendix A.
2154
2849
    token_end = Token(re.compile(r"$"), None, frozenset())
2155
2850
    token_second = Token(re.compile(r"(\d+)S"),
2156
2851
                         datetime.timedelta(seconds=1),
2157
 
                         frozenset((token_end,)))
 
2852
                         frozenset((token_end, )))
2158
2853
    token_minute = Token(re.compile(r"(\d+)M"),
2159
2854
                         datetime.timedelta(minutes=1),
2160
2855
                         frozenset((token_second, token_end)))
2176
2871
                       frozenset((token_month, token_end)))
2177
2872
    token_week = Token(re.compile(r"(\d+)W"),
2178
2873
                       datetime.timedelta(weeks=1),
2179
 
                       frozenset((token_end,)))
 
2874
                       frozenset((token_end, )))
2180
2875
    token_duration = Token(re.compile(r"P"), None,
2181
2876
                           frozenset((token_year, token_month,
2182
2877
                                      token_day, token_time,
2183
 
                                      token_week))),
2184
 
    # Define starting values
2185
 
    value = datetime.timedelta() # Value so far
 
2878
                                      token_week)))
 
2879
    # Define starting values:
 
2880
    # Value so far
 
2881
    value = datetime.timedelta()
2186
2882
    found_token = None
2187
 
    followers = frozenset(token_duration,) # Following valid tokens
2188
 
    s = duration                # String left to parse
 
2883
    # Following valid tokens
 
2884
    followers = frozenset((token_duration, ))
 
2885
    # String left to parse
 
2886
    s = duration
2189
2887
    # Loop until end token is found
2190
2888
    while found_token is not token_end:
2191
2889
        # Search for any currently valid tokens
2207
2905
                break
2208
2906
        else:
2209
2907
            # No currently valid tokens were found
2210
 
            raise ValueError("Invalid RFC 3339 duration")
 
2908
            raise ValueError("Invalid RFC 3339 duration: {!r}"
 
2909
                             .format(duration))
2211
2910
    # End token found
2212
2911
    return value
2213
2912
 
2214
2913
 
2215
2914
def string_to_delta(interval):
2216
2915
    """Parse a string and return a datetime.timedelta
2217
 
    
2218
 
    >>> string_to_delta('7d')
2219
 
    datetime.timedelta(7)
2220
 
    >>> string_to_delta('60s')
2221
 
    datetime.timedelta(0, 60)
2222
 
    >>> string_to_delta('60m')
2223
 
    datetime.timedelta(0, 3600)
2224
 
    >>> string_to_delta('24h')
2225
 
    datetime.timedelta(1)
2226
 
    >>> string_to_delta('1w')
2227
 
    datetime.timedelta(7)
2228
 
    >>> string_to_delta('5m 30s')
2229
 
    datetime.timedelta(0, 330)
 
2916
 
 
2917
    >>> string_to_delta("7d") == datetime.timedelta(7)
 
2918
    True
 
2919
    >>> string_to_delta("60s") == datetime.timedelta(0, 60)
 
2920
    True
 
2921
    >>> string_to_delta("60m") == datetime.timedelta(0, 3600)
 
2922
    True
 
2923
    >>> string_to_delta("24h") == datetime.timedelta(1)
 
2924
    True
 
2925
    >>> string_to_delta("1w") == datetime.timedelta(7)
 
2926
    True
 
2927
    >>> string_to_delta("5m 30s") == datetime.timedelta(0, 330)
 
2928
    True
2230
2929
    """
2231
 
    
 
2930
 
2232
2931
    try:
2233
2932
        return rfc3339_duration_to_delta(interval)
2234
2933
    except ValueError:
2235
2934
        pass
2236
 
    
 
2935
 
2237
2936
    timevalue = datetime.timedelta(0)
2238
2937
    for s in interval.split():
2239
2938
        try:
2240
 
            suffix = unicode(s[-1])
 
2939
            suffix = s[-1]
2241
2940
            value = int(s[:-1])
2242
2941
            if suffix == "d":
2243
2942
                delta = datetime.timedelta(value)
2250
2949
            elif suffix == "w":
2251
2950
                delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
2252
2951
            else:
2253
 
                raise ValueError("Unknown suffix {0!r}"
2254
 
                                 .format(suffix))
2255
 
        except (ValueError, IndexError) as e:
 
2952
                raise ValueError("Unknown suffix {!r}".format(suffix))
 
2953
        except IndexError as e:
2256
2954
            raise ValueError(*(e.args))
2257
2955
        timevalue += delta
2258
2956
    return timevalue
2259
2957
 
2260
2958
 
2261
 
def daemon(nochdir = False, noclose = False):
 
2959
def daemon(nochdir=False, noclose=False):
2262
2960
    """See daemon(3).  Standard BSD Unix function.
2263
 
    
 
2961
 
2264
2962
    This should really exist as os.daemon, but it doesn't (yet)."""
2265
2963
    if os.fork():
2266
2964
        sys.exit()
2274
2972
        null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2275
2973
        if not stat.S_ISCHR(os.fstat(null).st_mode):
2276
2974
            raise OSError(errno.ENODEV,
2277
 
                          "{0} not a character device"
 
2975
                          "{} not a character device"
2278
2976
                          .format(os.devnull))
2279
2977
        os.dup2(null, sys.stdin.fileno())
2280
2978
        os.dup2(null, sys.stdout.fileno())
2284
2982
 
2285
2983
 
2286
2984
def main():
2287
 
    
 
2985
 
2288
2986
    ##################################################################
2289
2987
    # Parsing of options, both command line and config file
2290
 
    
 
2988
 
2291
2989
    parser = argparse.ArgumentParser()
2292
2990
    parser.add_argument("-v", "--version", action="version",
2293
 
                        version = "%(prog)s {0}".format(version),
 
2991
                        version="%(prog)s {}".format(version),
2294
2992
                        help="show version number and exit")
2295
2993
    parser.add_argument("-i", "--interface", metavar="IF",
2296
2994
                        help="Bind to interface IF")
2329
3027
                        help="Directory to save/restore state in")
2330
3028
    parser.add_argument("--foreground", action="store_true",
2331
3029
                        help="Run in foreground", default=None)
2332
 
    
 
3030
    parser.add_argument("--no-zeroconf", action="store_false",
 
3031
                        dest="zeroconf", help="Do not use Zeroconf",
 
3032
                        default=None)
 
3033
 
2333
3034
    options = parser.parse_args()
2334
 
    
2335
 
    if options.check:
2336
 
        import doctest
2337
 
        doctest.testmod()
2338
 
        sys.exit()
2339
 
    
 
3035
 
2340
3036
    # Default values for config file for server-global settings
2341
 
    server_defaults = { "interface": "",
2342
 
                        "address": "",
2343
 
                        "port": "",
2344
 
                        "debug": "False",
2345
 
                        "priority":
2346
 
                        "SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:+SIGN-RSA-SHA224",
2347
 
                        "servicename": "Mandos",
2348
 
                        "use_dbus": "True",
2349
 
                        "use_ipv6": "True",
2350
 
                        "debuglevel": "",
2351
 
                        "restore": "True",
2352
 
                        "socket": "",
2353
 
                        "statedir": "/var/lib/mandos",
2354
 
                        "foreground": "False",
2355
 
                        }
2356
 
    
 
3037
    if gnutls.has_rawpk:
 
3038
        priority = ("SECURE128:!CTYPE-X.509:+CTYPE-RAWPK:!RSA"
 
3039
                    ":!VERS-ALL:+VERS-TLS1.3:%PROFILE_ULTRA")
 
3040
    else:
 
3041
        priority = ("SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
 
3042
                    ":+SIGN-DSA-SHA256")
 
3043
    server_defaults = {"interface": "",
 
3044
                       "address": "",
 
3045
                       "port": "",
 
3046
                       "debug": "False",
 
3047
                       "priority": priority,
 
3048
                       "servicename": "Mandos",
 
3049
                       "use_dbus": "True",
 
3050
                       "use_ipv6": "True",
 
3051
                       "debuglevel": "",
 
3052
                       "restore": "True",
 
3053
                       "socket": "",
 
3054
                       "statedir": "/var/lib/mandos",
 
3055
                       "foreground": "False",
 
3056
                       "zeroconf": "True",
 
3057
                       }
 
3058
    del priority
 
3059
 
2357
3060
    # Parse config file for server-global settings
2358
 
    server_config = configparser.SafeConfigParser(server_defaults)
 
3061
    server_config = configparser.ConfigParser(server_defaults)
2359
3062
    del server_defaults
2360
 
    server_config.read(os.path.join(options.configdir,
2361
 
                                    "mandos.conf"))
2362
 
    # Convert the SafeConfigParser object to a dict
 
3063
    server_config.read(os.path.join(options.configdir, "mandos.conf"))
 
3064
    # Convert the ConfigParser object to a dict
2363
3065
    server_settings = server_config.defaults()
2364
3066
    # Use the appropriate methods on the non-string config options
2365
 
    for option in ("debug", "use_dbus", "use_ipv6", "foreground"):
 
3067
    for option in ("debug", "use_dbus", "use_ipv6", "restore",
 
3068
                   "foreground", "zeroconf"):
2366
3069
        server_settings[option] = server_config.getboolean("DEFAULT",
2367
3070
                                                           option)
2368
3071
    if server_settings["port"]:
2378
3081
            server_settings["socket"] = os.dup(server_settings
2379
3082
                                               ["socket"])
2380
3083
    del server_config
2381
 
    
 
3084
 
2382
3085
    # Override the settings from the config file with command line
2383
3086
    # options, if set.
2384
3087
    for option in ("interface", "address", "port", "debug",
2385
 
                   "priority", "servicename", "configdir",
2386
 
                   "use_dbus", "use_ipv6", "debuglevel", "restore",
2387
 
                   "statedir", "socket", "foreground"):
 
3088
                   "priority", "servicename", "configdir", "use_dbus",
 
3089
                   "use_ipv6", "debuglevel", "restore", "statedir",
 
3090
                   "socket", "foreground", "zeroconf"):
2388
3091
        value = getattr(options, option)
2389
3092
        if value is not None:
2390
3093
            server_settings[option] = value
2391
3094
    del options
2392
3095
    # Force all strings to be unicode
2393
3096
    for option in server_settings.keys():
2394
 
        if type(server_settings[option]) is str:
2395
 
            server_settings[option] = unicode(server_settings[option])
 
3097
        if isinstance(server_settings[option], bytes):
 
3098
            server_settings[option] = (server_settings[option]
 
3099
                                       .decode("utf-8"))
2396
3100
    # Force all boolean options to be boolean
2397
3101
    for option in ("debug", "use_dbus", "use_ipv6", "restore",
2398
 
                   "foreground"):
 
3102
                   "foreground", "zeroconf"):
2399
3103
        server_settings[option] = bool(server_settings[option])
2400
3104
    # Debug implies foreground
2401
3105
    if server_settings["debug"]:
2402
3106
        server_settings["foreground"] = True
2403
3107
    # Now we have our good server settings in "server_settings"
2404
 
    
 
3108
 
2405
3109
    ##################################################################
2406
 
    
 
3110
 
 
3111
    if (not server_settings["zeroconf"]
 
3112
        and not (server_settings["port"]
 
3113
                 or server_settings["socket"] != "")):
 
3114
        parser.error("Needs port or socket to work without Zeroconf")
 
3115
 
2407
3116
    # For convenience
2408
3117
    debug = server_settings["debug"]
2409
3118
    debuglevel = server_settings["debuglevel"]
2412
3121
    stored_state_path = os.path.join(server_settings["statedir"],
2413
3122
                                     stored_state_file)
2414
3123
    foreground = server_settings["foreground"]
2415
 
    
 
3124
    zeroconf = server_settings["zeroconf"]
 
3125
 
2416
3126
    if debug:
2417
3127
        initlogger(debug, logging.DEBUG)
2418
3128
    else:
2421
3131
        else:
2422
3132
            level = getattr(logging, debuglevel.upper())
2423
3133
            initlogger(debug, level)
2424
 
    
 
3134
 
2425
3135
    if server_settings["servicename"] != "Mandos":
2426
 
        syslogger.setFormatter(logging.Formatter
2427
 
                               ('Mandos ({0}) [%(process)d]:'
2428
 
                                ' %(levelname)s: %(message)s'
2429
 
                                .format(server_settings
2430
 
                                        ["servicename"])))
2431
 
    
 
3136
        syslogger.setFormatter(
 
3137
            logging.Formatter("Mandos ({}) [%(process)d]:"
 
3138
                              " %(levelname)s: %(message)s".format(
 
3139
                                  server_settings["servicename"])))
 
3140
 
2432
3141
    # Parse config file with clients
2433
 
    client_config = configparser.SafeConfigParser(Client
2434
 
                                                  .client_defaults)
 
3142
    client_config = configparser.ConfigParser(Client.client_defaults)
2435
3143
    client_config.read(os.path.join(server_settings["configdir"],
2436
3144
                                    "clients.conf"))
2437
 
    
 
3145
 
2438
3146
    global mandos_dbus_service
2439
3147
    mandos_dbus_service = None
2440
 
    
2441
 
    tcp_server = MandosServer((server_settings["address"],
2442
 
                               server_settings["port"]),
2443
 
                              ClientHandler,
2444
 
                              interface=(server_settings["interface"]
2445
 
                                         or None),
2446
 
                              use_ipv6=use_ipv6,
2447
 
                              gnutls_priority=
2448
 
                              server_settings["priority"],
2449
 
                              use_dbus=use_dbus,
2450
 
                              socketfd=(server_settings["socket"]
2451
 
                                        or None))
 
3148
 
 
3149
    socketfd = None
 
3150
    if server_settings["socket"] != "":
 
3151
        socketfd = server_settings["socket"]
 
3152
    tcp_server = MandosServer(
 
3153
        (server_settings["address"], server_settings["port"]),
 
3154
        ClientHandler,
 
3155
        interface=(server_settings["interface"] or None),
 
3156
        use_ipv6=use_ipv6,
 
3157
        gnutls_priority=server_settings["priority"],
 
3158
        use_dbus=use_dbus,
 
3159
        socketfd=socketfd)
2452
3160
    if not foreground:
2453
 
        pidfilename = "/var/run/mandos.pid"
 
3161
        pidfilename = "/run/mandos.pid"
 
3162
        if not os.path.isdir("/run/."):
 
3163
            pidfilename = "/var/run/mandos.pid"
2454
3164
        pidfile = None
2455
3165
        try:
2456
 
            pidfile = open(pidfilename, "w")
 
3166
            pidfile = codecs.open(pidfilename, "w", encoding="utf-8")
2457
3167
        except IOError as e:
2458
3168
            logger.error("Could not open file %r", pidfilename,
2459
3169
                         exc_info=e)
2460
 
    
2461
 
    for name in ("_mandos", "mandos", "nobody"):
 
3170
 
 
3171
    for name, group in (("_mandos", "_mandos"),
 
3172
                        ("mandos", "mandos"),
 
3173
                        ("nobody", "nogroup")):
2462
3174
        try:
2463
3175
            uid = pwd.getpwnam(name).pw_uid
2464
 
            gid = pwd.getpwnam(name).pw_gid
 
3176
            gid = pwd.getpwnam(group).pw_gid
2465
3177
            break
2466
3178
        except KeyError:
2467
3179
            continue
2471
3183
    try:
2472
3184
        os.setgid(gid)
2473
3185
        os.setuid(uid)
 
3186
        if debug:
 
3187
            logger.debug("Did setuid/setgid to {}:{}".format(uid,
 
3188
                                                             gid))
2474
3189
    except OSError as error:
 
3190
        logger.warning("Failed to setuid/setgid to {}:{}: {}"
 
3191
                       .format(uid, gid, os.strerror(error.errno)))
2475
3192
        if error.errno != errno.EPERM:
2476
 
            raise error
2477
 
    
 
3193
            raise
 
3194
 
2478
3195
    if debug:
2479
3196
        # Enable all possible GnuTLS debugging
2480
 
        
 
3197
 
2481
3198
        # "Use a log level over 10 to enable all debugging options."
2482
3199
        # - GnuTLS manual
2483
 
        gnutls.library.functions.gnutls_global_set_log_level(11)
2484
 
        
2485
 
        @gnutls.library.types.gnutls_log_func
 
3200
        gnutls.global_set_log_level(11)
 
3201
 
 
3202
        @gnutls.log_func
2486
3203
        def debug_gnutls(level, string):
2487
 
            logger.debug("GnuTLS: %s", string[:-1])
2488
 
        
2489
 
        (gnutls.library.functions
2490
 
         .gnutls_global_set_log_function(debug_gnutls))
2491
 
        
 
3204
            logger.debug("GnuTLS: %s",
 
3205
                         string[:-1].decode("utf-8",
 
3206
                                            errors="replace"))
 
3207
 
 
3208
        gnutls.global_set_log_function(debug_gnutls)
 
3209
 
2492
3210
        # Redirect stdin so all checkers get /dev/null
2493
3211
        null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2494
3212
        os.dup2(null, sys.stdin.fileno())
2495
3213
        if null > 2:
2496
3214
            os.close(null)
2497
 
    
 
3215
 
2498
3216
    # Need to fork before connecting to D-Bus
2499
3217
    if not foreground:
2500
3218
        # Close all input and output, do double fork, etc.
2501
3219
        daemon()
2502
 
    
2503
 
    # multiprocessing will use threads, so before we use gobject we
2504
 
    # need to inform gobject that threads will be used.
2505
 
    gobject.threads_init()
2506
 
    
 
3220
 
 
3221
    if gi.version_info < (3, 10, 2):
 
3222
        # multiprocessing will use threads, so before we use GLib we
 
3223
        # need to inform GLib that threads will be used.
 
3224
        GLib.threads_init()
 
3225
 
2507
3226
    global main_loop
2508
3227
    # From the Avahi example code
2509
3228
    DBusGMainLoop(set_as_default=True)
2510
 
    main_loop = gobject.MainLoop()
 
3229
    main_loop = GLib.MainLoop()
2511
3230
    bus = dbus.SystemBus()
2512
3231
    # End of Avahi example code
2513
3232
    if use_dbus:
2514
3233
        try:
2515
3234
            bus_name = dbus.service.BusName("se.recompile.Mandos",
2516
 
                                            bus, do_not_queue=True)
2517
 
            old_bus_name = (dbus.service.BusName
2518
 
                            ("se.bsnet.fukt.Mandos", bus,
2519
 
                             do_not_queue=True))
2520
 
        except dbus.exceptions.NameExistsException as e:
 
3235
                                            bus,
 
3236
                                            do_not_queue=True)
 
3237
            old_bus_name = dbus.service.BusName(
 
3238
                "se.bsnet.fukt.Mandos", bus,
 
3239
                do_not_queue=True)
 
3240
        except dbus.exceptions.DBusException as e:
2521
3241
            logger.error("Disabling D-Bus:", exc_info=e)
2522
3242
            use_dbus = False
2523
3243
            server_settings["use_dbus"] = False
2524
3244
            tcp_server.use_dbus = False
2525
 
    protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2526
 
    service = AvahiServiceToSyslog(name =
2527
 
                                   server_settings["servicename"],
2528
 
                                   servicetype = "_mandos._tcp",
2529
 
                                   protocol = protocol, bus = bus)
2530
 
    if server_settings["interface"]:
2531
 
        service.interface = (if_nametoindex
2532
 
                             (str(server_settings["interface"])))
2533
 
    
 
3245
    if zeroconf:
 
3246
        protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
 
3247
        service = AvahiServiceToSyslog(
 
3248
            name=server_settings["servicename"],
 
3249
            servicetype="_mandos._tcp",
 
3250
            protocol=protocol,
 
3251
            bus=bus)
 
3252
        if server_settings["interface"]:
 
3253
            service.interface = if_nametoindex(
 
3254
                server_settings["interface"].encode("utf-8"))
 
3255
 
2534
3256
    global multiprocessing_manager
2535
3257
    multiprocessing_manager = multiprocessing.Manager()
2536
 
    
 
3258
 
2537
3259
    client_class = Client
2538
3260
    if use_dbus:
2539
 
        client_class = functools.partial(ClientDBus, bus = bus)
2540
 
    
 
3261
        client_class = functools.partial(ClientDBus, bus=bus)
 
3262
 
2541
3263
    client_settings = Client.config_parser(client_config)
2542
3264
    old_client_settings = {}
2543
3265
    clients_data = {}
2544
 
    
 
3266
 
2545
3267
    # This is used to redirect stdout and stderr for checker processes
2546
3268
    global wnull
2547
 
    wnull = open(os.devnull, "w") # A writable /dev/null
 
3269
    wnull = open(os.devnull, "w")  # A writable /dev/null
2548
3270
    # Only used if server is running in foreground but not in debug
2549
3271
    # mode
2550
3272
    if debug or not foreground:
2551
3273
        wnull.close()
2552
 
    
 
3274
 
2553
3275
    # Get client data and settings from last running state.
2554
3276
    if server_settings["restore"]:
2555
3277
        try:
2556
3278
            with open(stored_state_path, "rb") as stored_state:
2557
 
                clients_data, old_client_settings = (pickle.load
2558
 
                                                     (stored_state))
 
3279
                if sys.version_info.major == 2:
 
3280
                    clients_data, old_client_settings = pickle.load(
 
3281
                        stored_state)
 
3282
                else:
 
3283
                    bytes_clients_data, bytes_old_client_settings = (
 
3284
                        pickle.load(stored_state, encoding="bytes"))
 
3285
                    #   Fix bytes to strings
 
3286
                    #  clients_data
 
3287
                    # .keys()
 
3288
                    clients_data = {(key.decode("utf-8")
 
3289
                                     if isinstance(key, bytes)
 
3290
                                     else key): value
 
3291
                                    for key, value in
 
3292
                                    bytes_clients_data.items()}
 
3293
                    del bytes_clients_data
 
3294
                    for key in clients_data:
 
3295
                        value = {(k.decode("utf-8")
 
3296
                                  if isinstance(k, bytes) else k): v
 
3297
                                 for k, v in
 
3298
                                 clients_data[key].items()}
 
3299
                        clients_data[key] = value
 
3300
                        # .client_structure
 
3301
                        value["client_structure"] = [
 
3302
                            (s.decode("utf-8")
 
3303
                             if isinstance(s, bytes)
 
3304
                             else s) for s in
 
3305
                            value["client_structure"]]
 
3306
                        # .name, .host, and .checker_command
 
3307
                        for k in ("name", "host", "checker_command"):
 
3308
                            if isinstance(value[k], bytes):
 
3309
                                value[k] = value[k].decode("utf-8")
 
3310
                        if "key_id" not in value:
 
3311
                            value["key_id"] = ""
 
3312
                        elif "fingerprint" not in value:
 
3313
                            value["fingerprint"] = ""
 
3314
                    #  old_client_settings
 
3315
                    # .keys()
 
3316
                    old_client_settings = {
 
3317
                        (key.decode("utf-8")
 
3318
                         if isinstance(key, bytes)
 
3319
                         else key): value
 
3320
                        for key, value in
 
3321
                        bytes_old_client_settings.items()}
 
3322
                    del bytes_old_client_settings
 
3323
                    # .host and .checker_command
 
3324
                    for value in old_client_settings.values():
 
3325
                        for attribute in ("host", "checker_command"):
 
3326
                            if isinstance(value[attribute], bytes):
 
3327
                                value[attribute] = (value[attribute]
 
3328
                                                    .decode("utf-8"))
2559
3329
            os.remove(stored_state_path)
2560
3330
        except IOError as e:
2561
3331
            if e.errno == errno.ENOENT:
2562
 
                logger.warning("Could not load persistent state: {0}"
2563
 
                                .format(os.strerror(e.errno)))
 
3332
                logger.warning("Could not load persistent state:"
 
3333
                               " {}".format(os.strerror(e.errno)))
2564
3334
            else:
2565
3335
                logger.critical("Could not load persistent state:",
2566
3336
                                exc_info=e)
2567
3337
                raise
2568
3338
        except EOFError as e:
2569
3339
            logger.warning("Could not load persistent state: "
2570
 
                           "EOFError:", exc_info=e)
2571
 
    
 
3340
                           "EOFError:",
 
3341
                           exc_info=e)
 
3342
 
2572
3343
    with PGPEngine() as pgp:
2573
 
        for client_name, client in clients_data.iteritems():
 
3344
        for client_name, client in clients_data.items():
2574
3345
            # Skip removed clients
2575
3346
            if client_name not in client_settings:
2576
3347
                continue
2577
 
            
 
3348
 
2578
3349
            # Decide which value to use after restoring saved state.
2579
3350
            # We have three different values: Old config file,
2580
3351
            # new config file, and saved state.
2585
3356
                    # For each value in new config, check if it
2586
3357
                    # differs from the old config value (Except for
2587
3358
                    # the "secret" attribute)
2588
 
                    if (name != "secret" and
2589
 
                        value != old_client_settings[client_name]
2590
 
                        [name]):
 
3359
                    if (name != "secret"
 
3360
                        and (value !=
 
3361
                             old_client_settings[client_name][name])):
2591
3362
                        client[name] = value
2592
3363
                except KeyError:
2593
3364
                    pass
2594
 
            
 
3365
 
2595
3366
            # Clients who has passed its expire date can still be
2596
 
            # enabled if its last checker was successful.  Clients
 
3367
            # enabled if its last checker was successful.  A Client
2597
3368
            # whose checker succeeded before we stored its state is
2598
3369
            # assumed to have successfully run all checkers during
2599
3370
            # downtime.
2601
3372
                if datetime.datetime.utcnow() >= client["expires"]:
2602
3373
                    if not client["last_checked_ok"]:
2603
3374
                        logger.warning(
2604
 
                            "disabling client {0} - Client never "
2605
 
                            "performed a successful checker"
2606
 
                            .format(client_name))
 
3375
                            "disabling client {} - Client never "
 
3376
                            "performed a successful checker".format(
 
3377
                                client_name))
2607
3378
                        client["enabled"] = False
2608
3379
                    elif client["last_checker_status"] != 0:
2609
3380
                        logger.warning(
2610
 
                            "disabling client {0} - Client "
2611
 
                            "last checker failed with error code {1}"
2612
 
                            .format(client_name,
2613
 
                                    client["last_checker_status"]))
 
3381
                            "disabling client {} - Client last"
 
3382
                            " checker failed with error code"
 
3383
                            " {}".format(
 
3384
                                client_name,
 
3385
                                client["last_checker_status"]))
2614
3386
                        client["enabled"] = False
2615
3387
                    else:
2616
 
                        client["expires"] = (datetime.datetime
2617
 
                                             .utcnow()
2618
 
                                             + client["timeout"])
 
3388
                        client["expires"] = (
 
3389
                            datetime.datetime.utcnow()
 
3390
                            + client["timeout"])
2619
3391
                        logger.debug("Last checker succeeded,"
2620
 
                                     " keeping {0} enabled"
2621
 
                                     .format(client_name))
 
3392
                                     " keeping {} enabled".format(
 
3393
                                         client_name))
2622
3394
            try:
2623
 
                client["secret"] = (
2624
 
                    pgp.decrypt(client["encrypted_secret"],
2625
 
                                client_settings[client_name]
2626
 
                                ["secret"]))
 
3395
                client["secret"] = pgp.decrypt(
 
3396
                    client["encrypted_secret"],
 
3397
                    client_settings[client_name]["secret"])
2627
3398
            except PGPError:
2628
3399
                # If decryption fails, we use secret from new settings
2629
 
                logger.debug("Failed to decrypt {0} old secret"
2630
 
                             .format(client_name))
2631
 
                client["secret"] = (
2632
 
                    client_settings[client_name]["secret"])
2633
 
    
 
3400
                logger.debug("Failed to decrypt {} old secret".format(
 
3401
                    client_name))
 
3402
                client["secret"] = (client_settings[client_name]
 
3403
                                    ["secret"])
 
3404
 
2634
3405
    # Add/remove clients based on new changes made to config
2635
3406
    for client_name in (set(old_client_settings)
2636
3407
                        - set(client_settings)):
2638
3409
    for client_name in (set(client_settings)
2639
3410
                        - set(old_client_settings)):
2640
3411
        clients_data[client_name] = client_settings[client_name]
2641
 
    
 
3412
 
2642
3413
    # Create all client objects
2643
 
    for client_name, client in clients_data.iteritems():
 
3414
    for client_name, client in clients_data.items():
2644
3415
        tcp_server.clients[client_name] = client_class(
2645
 
            name = client_name, settings = client,
2646
 
            server_settings = server_settings)
2647
 
    
 
3416
            name=client_name,
 
3417
            settings=client,
 
3418
            server_settings=server_settings)
 
3419
 
2648
3420
    if not tcp_server.clients:
2649
3421
        logger.warning("No clients defined")
2650
 
    
 
3422
 
2651
3423
    if not foreground:
2652
3424
        if pidfile is not None:
 
3425
            pid = os.getpid()
2653
3426
            try:
2654
3427
                with pidfile:
2655
 
                    pid = os.getpid()
2656
 
                    pidfile.write(str(pid) + "\n".encode("utf-8"))
 
3428
                    print(pid, file=pidfile)
2657
3429
            except IOError:
2658
3430
                logger.error("Could not write to file %r with PID %d",
2659
3431
                             pidfilename, pid)
2660
3432
        del pidfile
2661
3433
        del pidfilename
2662
 
    
2663
 
    signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2664
 
    signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
2665
 
    
 
3434
 
 
3435
    for termsig in (signal.SIGHUP, signal.SIGTERM):
 
3436
        GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,
 
3437
                             lambda: main_loop.quit() and False)
 
3438
 
2666
3439
    if use_dbus:
2667
 
        @alternate_dbus_interfaces({"se.recompile.Mandos":
2668
 
                                        "se.bsnet.fukt.Mandos"})
2669
 
        class MandosDBusService(DBusObjectWithProperties):
 
3440
 
 
3441
        @alternate_dbus_interfaces(
 
3442
            {"se.recompile.Mandos": "se.bsnet.fukt.Mandos"})
 
3443
        class MandosDBusService(DBusObjectWithObjectManager):
2670
3444
            """A D-Bus proxy object"""
 
3445
 
2671
3446
            def __init__(self):
2672
3447
                dbus.service.Object.__init__(self, bus, "/")
 
3448
 
2673
3449
            _interface = "se.recompile.Mandos"
2674
 
            
2675
 
            @dbus_interface_annotations(_interface)
2676
 
            def _foo(self):
2677
 
                return { "org.freedesktop.DBus.Property"
2678
 
                         ".EmitsChangedSignal":
2679
 
                             "false"}
2680
 
            
 
3450
 
2681
3451
            @dbus.service.signal(_interface, signature="o")
2682
3452
            def ClientAdded(self, objpath):
2683
3453
                "D-Bus signal"
2684
3454
                pass
2685
 
            
 
3455
 
2686
3456
            @dbus.service.signal(_interface, signature="ss")
2687
 
            def ClientNotFound(self, fingerprint, address):
 
3457
            def ClientNotFound(self, key_id, address):
2688
3458
                "D-Bus signal"
2689
3459
                pass
2690
 
            
 
3460
 
 
3461
            @dbus_annotations({"org.freedesktop.DBus.Deprecated":
 
3462
                               "true"})
2691
3463
            @dbus.service.signal(_interface, signature="os")
2692
3464
            def ClientRemoved(self, objpath, name):
2693
3465
                "D-Bus signal"
2694
3466
                pass
2695
 
            
 
3467
 
 
3468
            @dbus_annotations({"org.freedesktop.DBus.Deprecated":
 
3469
                               "true"})
2696
3470
            @dbus.service.method(_interface, out_signature="ao")
2697
3471
            def GetAllClients(self):
2698
3472
                "D-Bus method"
2699
 
                return dbus.Array(c.dbus_object_path
2700
 
                                  for c in
2701
 
                                  tcp_server.clients.itervalues())
2702
 
            
 
3473
                return dbus.Array(c.dbus_object_path for c in
 
3474
                                  tcp_server.clients.values())
 
3475
 
 
3476
            @dbus_annotations({"org.freedesktop.DBus.Deprecated":
 
3477
                               "true"})
2703
3478
            @dbus.service.method(_interface,
2704
3479
                                 out_signature="a{oa{sv}}")
2705
3480
            def GetAllClientsWithProperties(self):
2706
3481
                "D-Bus method"
2707
3482
                return dbus.Dictionary(
2708
 
                    ((c.dbus_object_path, c.GetAll(""))
2709
 
                     for c in tcp_server.clients.itervalues()),
 
3483
                    {c.dbus_object_path: c.GetAll(
 
3484
                        "se.recompile.Mandos.Client")
 
3485
                     for c in tcp_server.clients.values()},
2710
3486
                    signature="oa{sv}")
2711
 
            
 
3487
 
2712
3488
            @dbus.service.method(_interface, in_signature="o")
2713
3489
            def RemoveClient(self, object_path):
2714
3490
                "D-Bus method"
2715
 
                for c in tcp_server.clients.itervalues():
 
3491
                for c in tcp_server.clients.values():
2716
3492
                    if c.dbus_object_path == object_path:
2717
3493
                        del tcp_server.clients[c.name]
2718
3494
                        c.remove_from_connection()
2719
 
                        # Don't signal anything except ClientRemoved
 
3495
                        # Don't signal the disabling
2720
3496
                        c.disable(quiet=True)
2721
 
                        # Emit D-Bus signal
2722
 
                        self.ClientRemoved(object_path, c.name)
 
3497
                        # Emit D-Bus signal for removal
 
3498
                        self.client_removed_signal(c)
2723
3499
                        return
2724
3500
                raise KeyError(object_path)
2725
 
            
 
3501
 
2726
3502
            del _interface
2727
 
        
 
3503
 
 
3504
            @dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
 
3505
                                 out_signature="a{oa{sa{sv}}}")
 
3506
            def GetManagedObjects(self):
 
3507
                """D-Bus method"""
 
3508
                return dbus.Dictionary(
 
3509
                    {client.dbus_object_path:
 
3510
                     dbus.Dictionary(
 
3511
                         {interface: client.GetAll(interface)
 
3512
                          for interface in
 
3513
                          client._get_all_interface_names()})
 
3514
                     for client in tcp_server.clients.values()})
 
3515
 
 
3516
            def client_added_signal(self, client):
 
3517
                """Send the new standard signal and the old signal"""
 
3518
                if use_dbus:
 
3519
                    # New standard signal
 
3520
                    self.InterfacesAdded(
 
3521
                        client.dbus_object_path,
 
3522
                        dbus.Dictionary(
 
3523
                            {interface: client.GetAll(interface)
 
3524
                             for interface in
 
3525
                             client._get_all_interface_names()}))
 
3526
                    # Old signal
 
3527
                    self.ClientAdded(client.dbus_object_path)
 
3528
 
 
3529
            def client_removed_signal(self, client):
 
3530
                """Send the new standard signal and the old signal"""
 
3531
                if use_dbus:
 
3532
                    # New standard signal
 
3533
                    self.InterfacesRemoved(
 
3534
                        client.dbus_object_path,
 
3535
                        client._get_all_interface_names())
 
3536
                    # Old signal
 
3537
                    self.ClientRemoved(client.dbus_object_path,
 
3538
                                       client.name)
 
3539
 
2728
3540
        mandos_dbus_service = MandosDBusService()
2729
 
    
 
3541
 
 
3542
    # Save modules to variables to exempt the modules from being
 
3543
    # unloaded before the function registered with atexit() is run.
 
3544
    mp = multiprocessing
 
3545
    wn = wnull
 
3546
 
2730
3547
    def cleanup():
2731
3548
        "Cleanup function; run on exit"
2732
 
        service.cleanup()
2733
 
        
2734
 
        multiprocessing.active_children()
2735
 
        wnull.close()
 
3549
        if zeroconf:
 
3550
            service.cleanup()
 
3551
 
 
3552
        mp.active_children()
 
3553
        wn.close()
2736
3554
        if not (tcp_server.clients or client_settings):
2737
3555
            return
2738
 
        
 
3556
 
2739
3557
        # Store client before exiting. Secrets are encrypted with key
2740
3558
        # based on what config file has. If config file is
2741
3559
        # removed/edited, old secret will thus be unrecovable.
2742
3560
        clients = {}
2743
3561
        with PGPEngine() as pgp:
2744
 
            for client in tcp_server.clients.itervalues():
 
3562
            for client in tcp_server.clients.values():
2745
3563
                key = client_settings[client.name]["secret"]
2746
3564
                client.encrypted_secret = pgp.encrypt(client.secret,
2747
3565
                                                      key)
2748
3566
                client_dict = {}
2749
 
                
 
3567
 
2750
3568
                # A list of attributes that can not be pickled
2751
3569
                # + secret.
2752
 
                exclude = set(("bus", "changedstate", "secret",
2753
 
                               "checker", "server_settings"))
2754
 
                for name, typ in (inspect.getmembers
2755
 
                                  (dbus.service.Object)):
 
3570
                exclude = {"bus", "changedstate", "secret",
 
3571
                           "checker", "server_settings"}
 
3572
                for name, typ in inspect.getmembers(dbus.service
 
3573
                                                    .Object):
2756
3574
                    exclude.add(name)
2757
 
                
 
3575
 
2758
3576
                client_dict["encrypted_secret"] = (client
2759
3577
                                                   .encrypted_secret)
2760
3578
                for attr in client.client_structure:
2761
3579
                    if attr not in exclude:
2762
3580
                        client_dict[attr] = getattr(client, attr)
2763
 
                
 
3581
 
2764
3582
                clients[client.name] = client_dict
2765
3583
                del client_settings[client.name]["secret"]
2766
 
        
 
3584
 
2767
3585
        try:
2768
 
            with (tempfile.NamedTemporaryFile
2769
 
                  (mode='wb', suffix=".pickle", prefix='clients-',
2770
 
                   dir=os.path.dirname(stored_state_path),
2771
 
                   delete=False)) as stored_state:
2772
 
                pickle.dump((clients, client_settings), stored_state)
2773
 
                tempname=stored_state.name
 
3586
            with tempfile.NamedTemporaryFile(
 
3587
                    mode="wb",
 
3588
                    suffix=".pickle",
 
3589
                    prefix="clients-",
 
3590
                    dir=os.path.dirname(stored_state_path),
 
3591
                    delete=False) as stored_state:
 
3592
                pickle.dump((clients, client_settings), stored_state,
 
3593
                            protocol=2)
 
3594
                tempname = stored_state.name
2774
3595
            os.rename(tempname, stored_state_path)
2775
3596
        except (IOError, OSError) as e:
2776
3597
            if not debug:
2779
3600
                except NameError:
2780
3601
                    pass
2781
3602
            if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
2782
 
                logger.warning("Could not save persistent state: {0}"
 
3603
                logger.warning("Could not save persistent state: {}"
2783
3604
                               .format(os.strerror(e.errno)))
2784
3605
            else:
2785
3606
                logger.warning("Could not save persistent state:",
2786
3607
                               exc_info=e)
2787
 
                raise e
2788
 
        
 
3608
                raise
 
3609
 
2789
3610
        # Delete all clients, and settings from config
2790
3611
        while tcp_server.clients:
2791
3612
            name, client = tcp_server.clients.popitem()
2792
3613
            if use_dbus:
2793
3614
                client.remove_from_connection()
2794
 
            # Don't signal anything except ClientRemoved
 
3615
            # Don't signal the disabling
2795
3616
            client.disable(quiet=True)
 
3617
            # Emit D-Bus signal for removal
2796
3618
            if use_dbus:
2797
 
                # Emit D-Bus signal
2798
 
                mandos_dbus_service.ClientRemoved(client
2799
 
                                                  .dbus_object_path,
2800
 
                                                  client.name)
 
3619
                mandos_dbus_service.client_removed_signal(client)
2801
3620
        client_settings.clear()
2802
 
    
 
3621
 
2803
3622
    atexit.register(cleanup)
2804
 
    
2805
 
    for client in tcp_server.clients.itervalues():
 
3623
 
 
3624
    for client in tcp_server.clients.values():
2806
3625
        if use_dbus:
2807
 
            # Emit D-Bus signal
2808
 
            mandos_dbus_service.ClientAdded(client.dbus_object_path)
 
3626
            # Emit D-Bus signal for adding
 
3627
            mandos_dbus_service.client_added_signal(client)
2809
3628
        # Need to initiate checking of clients
2810
3629
        if client.enabled:
2811
3630
            client.init_checker()
2812
 
    
 
3631
 
2813
3632
    tcp_server.enable()
2814
3633
    tcp_server.server_activate()
2815
 
    
 
3634
 
2816
3635
    # Find out what port we got
2817
 
    service.port = tcp_server.socket.getsockname()[1]
 
3636
    if zeroconf:
 
3637
        service.port = tcp_server.socket.getsockname()[1]
2818
3638
    if use_ipv6:
2819
3639
        logger.info("Now listening on address %r, port %d,"
2820
3640
                    " flowinfo %d, scope_id %d",
2822
3642
    else:                       # IPv4
2823
3643
        logger.info("Now listening on address %r, port %d",
2824
3644
                    *tcp_server.socket.getsockname())
2825
 
    
2826
 
    #service.interface = tcp_server.socket.getsockname()[3]
2827
 
    
 
3645
 
 
3646
    # service.interface = tcp_server.socket.getsockname()[3]
 
3647
 
2828
3648
    try:
2829
 
        # From the Avahi example code
2830
 
        try:
2831
 
            service.activate()
2832
 
        except dbus.exceptions.DBusException as error:
2833
 
            logger.critical("D-Bus Exception", exc_info=error)
2834
 
            cleanup()
2835
 
            sys.exit(1)
2836
 
        # End of Avahi example code
2837
 
        
2838
 
        gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
2839
 
                             lambda *args, **kwargs:
2840
 
                             (tcp_server.handle_request
2841
 
                              (*args[2:], **kwargs) or True))
2842
 
        
 
3649
        if zeroconf:
 
3650
            # From the Avahi example code
 
3651
            try:
 
3652
                service.activate()
 
3653
            except dbus.exceptions.DBusException as error:
 
3654
                logger.critical("D-Bus Exception", exc_info=error)
 
3655
                cleanup()
 
3656
                sys.exit(1)
 
3657
            # End of Avahi example code
 
3658
 
 
3659
        GLib.io_add_watch(
 
3660
            GLib.IOChannel.unix_new(tcp_server.fileno()),
 
3661
            GLib.PRIORITY_DEFAULT, GLib.IO_IN,
 
3662
            lambda *args, **kwargs: (tcp_server.handle_request
 
3663
                                     (*args[2:], **kwargs) or True))
 
3664
 
2843
3665
        logger.debug("Starting main loop")
2844
3666
        main_loop.run()
2845
3667
    except AvahiError as error:
2854
3676
    # Must run before the D-Bus bus name gets deregistered
2855
3677
    cleanup()
2856
3678
 
2857
 
if __name__ == '__main__':
2858
 
    main()
 
3679
 
 
3680
def should_only_run_tests():
 
3681
    parser = argparse.ArgumentParser(add_help=False)
 
3682
    parser.add_argument("--check", action="store_true")
 
3683
    args, unknown_args = parser.parse_known_args()
 
3684
    run_tests = args.check
 
3685
    if run_tests:
 
3686
        # Remove --check argument from sys.argv
 
3687
        sys.argv[1:] = unknown_args
 
3688
    return run_tests
 
3689
 
 
3690
# Add all tests from doctest strings
 
3691
def load_tests(loader, tests, none):
 
3692
    import doctest
 
3693
    tests.addTests(doctest.DocTestSuite())
 
3694
    return tests
 
3695
 
 
3696
if __name__ == "__main__":
 
3697
    try:
 
3698
        if should_only_run_tests():
 
3699
            # Call using ./mandos --check [--verbose]
 
3700
            unittest.main()
 
3701
        else:
 
3702
            main()
 
3703
    finally:
 
3704
        logging.shutdown()