/mandos/release

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/release

« back to all changes in this revision

Viewing changes to mandos

  • Committer: Björn Påhlsson
  • Date: 2011-10-15 16:48:03 UTC
  • Revision ID: belorn@fukt.bsnet.se-20111015164803-61q3hzrv91d042mb
Tags: version-1.4.1-1
* Makefile (version): Changed to "1.4.1".
* NEWS (Version 1.4.1): New entry.
* debian/changelog (1.4.1-1): - '' -

Show diffs side-by-side

added added

removed removed

Lines of Context:
11
11
# "AvahiService" class, and some lines in "main".
12
12
13
13
# Everything else is
14
 
# Copyright © 2008,2009 Teddy Hogeborn
15
 
# Copyright © 2008,2009 Björn Påhlsson
 
14
# Copyright © 2008-2011 Teddy Hogeborn
 
15
# Copyright © 2008-2011 Björn Påhlsson
16
16
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
28
28
# along with this program.  If not, see
29
29
# <http://www.gnu.org/licenses/>.
30
30
31
 
# Contact the authors at <mandos@fukt.bsnet.se>.
 
31
# Contact the authors at <mandos@recompile.se>.
32
32
33
33
 
34
 
from __future__ import division, with_statement, absolute_import
 
34
from __future__ import (division, absolute_import, print_function,
 
35
                        unicode_literals)
35
36
 
36
37
import SocketServer as socketserver
37
38
import socket
38
 
import optparse
 
39
import argparse
39
40
import datetime
40
41
import errno
41
42
import gnutls.crypto
60
61
import fcntl
61
62
import functools
62
63
import cPickle as pickle
 
64
import multiprocessing
 
65
import types
63
66
 
64
67
import dbus
65
68
import dbus.service
80
83
        SO_BINDTODEVICE = None
81
84
 
82
85
 
83
 
version = "1.0.14"
 
86
version = "1.4.1"
84
87
 
85
 
logger = logging.Logger(u'mandos')
 
88
#logger = logging.getLogger('mandos')
 
89
logger = logging.Logger('mandos')
86
90
syslogger = (logging.handlers.SysLogHandler
87
91
             (facility = logging.handlers.SysLogHandler.LOG_DAEMON,
88
 
              address = "/dev/log"))
 
92
              address = str("/dev/log")))
89
93
syslogger.setFormatter(logging.Formatter
90
 
                       (u'Mandos [%(process)d]: %(levelname)s:'
91
 
                        u' %(message)s'))
 
94
                       ('Mandos [%(process)d]: %(levelname)s:'
 
95
                        ' %(message)s'))
92
96
logger.addHandler(syslogger)
93
97
 
94
98
console = logging.StreamHandler()
95
 
console.setFormatter(logging.Formatter(u'%(name)s [%(process)d]:'
96
 
                                       u' %(levelname)s:'
97
 
                                       u' %(message)s'))
 
99
console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'
 
100
                                       ' %(levelname)s:'
 
101
                                       ' %(message)s'))
98
102
logger.addHandler(console)
99
103
 
100
104
class AvahiError(Exception):
117
121
    Attributes:
118
122
    interface: integer; avahi.IF_UNSPEC or an interface index.
119
123
               Used to optionally bind to the specified interface.
120
 
    name: string; Example: u'Mandos'
121
 
    type: string; Example: u'_mandos._tcp'.
 
124
    name: string; Example: 'Mandos'
 
125
    type: string; Example: '_mandos._tcp'.
122
126
                  See <http://www.dns-sd.org/ServiceTypes.html>
123
127
    port: integer; what port to announce
124
128
    TXT: list of strings; TXT record for the service
133
137
    """
134
138
    def __init__(self, interface = avahi.IF_UNSPEC, name = None,
135
139
                 servicetype = None, port = None, TXT = None,
136
 
                 domain = u"", host = u"", max_renames = 32768,
 
140
                 domain = "", host = "", max_renames = 32768,
137
141
                 protocol = avahi.PROTO_UNSPEC, bus = None):
138
142
        self.interface = interface
139
143
        self.name = name
148
152
        self.group = None       # our entry group
149
153
        self.server = None
150
154
        self.bus = bus
 
155
        self.entry_group_state_changed_match = None
151
156
    def rename(self):
152
157
        """Derived from the Avahi example code"""
153
158
        if self.rename_count >= self.max_renames:
154
 
            logger.critical(u"No suitable Zeroconf service name found"
155
 
                            u" after %i retries, exiting.",
 
159
            logger.critical("No suitable Zeroconf service name found"
 
160
                            " after %i retries, exiting.",
156
161
                            self.rename_count)
157
 
            raise AvahiServiceError(u"Too many renames")
158
 
        self.name = self.server.GetAlternativeServiceName(self.name)
159
 
        logger.info(u"Changing Zeroconf service name to %r ...",
160
 
                    unicode(self.name))
 
162
            raise AvahiServiceError("Too many renames")
 
163
        self.name = unicode(self.server
 
164
                            .GetAlternativeServiceName(self.name))
 
165
        logger.info("Changing Zeroconf service name to %r ...",
 
166
                    self.name)
161
167
        syslogger.setFormatter(logging.Formatter
162
 
                               (u'Mandos (%s) [%%(process)d]:'
163
 
                                u' %%(levelname)s: %%(message)s'
 
168
                               ('Mandos (%s) [%%(process)d]:'
 
169
                                ' %%(levelname)s: %%(message)s'
164
170
                                % self.name))
165
171
        self.remove()
166
 
        self.add()
 
172
        try:
 
173
            self.add()
 
174
        except dbus.exceptions.DBusException as error:
 
175
            logger.critical("DBusException: %s", error)
 
176
            self.cleanup()
 
177
            os._exit(1)
167
178
        self.rename_count += 1
168
179
    def remove(self):
169
180
        """Derived from the Avahi example code"""
 
181
        if self.entry_group_state_changed_match is not None:
 
182
            self.entry_group_state_changed_match.remove()
 
183
            self.entry_group_state_changed_match = None
170
184
        if self.group is not None:
171
185
            self.group.Reset()
172
186
    def add(self):
173
187
        """Derived from the Avahi example code"""
 
188
        self.remove()
174
189
        if self.group is None:
175
190
            self.group = dbus.Interface(
176
191
                self.bus.get_object(avahi.DBUS_NAME,
177
192
                                    self.server.EntryGroupNew()),
178
193
                avahi.DBUS_INTERFACE_ENTRY_GROUP)
179
 
            self.group.connect_to_signal('StateChanged',
180
 
                                         self
181
 
                                         .entry_group_state_changed)
182
 
        logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
 
194
        self.entry_group_state_changed_match = (
 
195
            self.group.connect_to_signal(
 
196
                'StateChanged', self .entry_group_state_changed))
 
197
        logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
183
198
                     self.name, self.type)
184
199
        self.group.AddService(
185
200
            self.interface,
192
207
        self.group.Commit()
193
208
    def entry_group_state_changed(self, state, error):
194
209
        """Derived from the Avahi example code"""
195
 
        logger.debug(u"Avahi state change: %i", state)
 
210
        logger.debug("Avahi entry group state change: %i", state)
196
211
        
197
212
        if state == avahi.ENTRY_GROUP_ESTABLISHED:
198
 
            logger.debug(u"Zeroconf service established.")
 
213
            logger.debug("Zeroconf service established.")
199
214
        elif state == avahi.ENTRY_GROUP_COLLISION:
200
 
            logger.warning(u"Zeroconf service name collision.")
 
215
            logger.info("Zeroconf service name collision.")
201
216
            self.rename()
202
217
        elif state == avahi.ENTRY_GROUP_FAILURE:
203
 
            logger.critical(u"Avahi: Error in group state changed %s",
 
218
            logger.critical("Avahi: Error in group state changed %s",
204
219
                            unicode(error))
205
 
            raise AvahiGroupError(u"State changed: %s"
 
220
            raise AvahiGroupError("State changed: %s"
206
221
                                  % unicode(error))
207
222
    def cleanup(self):
208
223
        """Derived from the Avahi example code"""
209
224
        if self.group is not None:
210
 
            self.group.Free()
 
225
            try:
 
226
                self.group.Free()
 
227
            except (dbus.exceptions.UnknownMethodException,
 
228
                    dbus.exceptions.DBusException) as e:
 
229
                pass
211
230
            self.group = None
212
 
    def server_state_changed(self, state):
 
231
        self.remove()
 
232
    def server_state_changed(self, state, error=None):
213
233
        """Derived from the Avahi example code"""
214
 
        if state == avahi.SERVER_COLLISION:
215
 
            logger.error(u"Zeroconf server name collision")
216
 
            self.remove()
 
234
        logger.debug("Avahi server state change: %i", state)
 
235
        bad_states = { avahi.SERVER_INVALID:
 
236
                           "Zeroconf server invalid",
 
237
                       avahi.SERVER_REGISTERING: None,
 
238
                       avahi.SERVER_COLLISION:
 
239
                           "Zeroconf server name collision",
 
240
                       avahi.SERVER_FAILURE:
 
241
                           "Zeroconf server failure" }
 
242
        if state in bad_states:
 
243
            if bad_states[state] is not None:
 
244
                if error is None:
 
245
                    logger.error(bad_states[state])
 
246
                else:
 
247
                    logger.error(bad_states[state] + ": %r", error)
 
248
            self.cleanup()
217
249
        elif state == avahi.SERVER_RUNNING:
218
250
            self.add()
 
251
        else:
 
252
            if error is None:
 
253
                logger.debug("Unknown state: %r", state)
 
254
            else:
 
255
                logger.debug("Unknown state: %r: %r", state, error)
219
256
    def activate(self):
220
257
        """Derived from the Avahi example code"""
221
258
        if self.server is None:
222
259
            self.server = dbus.Interface(
223
260
                self.bus.get_object(avahi.DBUS_NAME,
224
 
                                    avahi.DBUS_PATH_SERVER),
 
261
                                    avahi.DBUS_PATH_SERVER,
 
262
                                    follow_name_owner_changes=True),
225
263
                avahi.DBUS_INTERFACE_SERVER)
226
 
        self.server.connect_to_signal(u"StateChanged",
 
264
        self.server.connect_to_signal("StateChanged",
227
265
                                 self.server_state_changed)
228
266
        self.server_state_changed(self.server.GetState())
229
267
 
230
268
 
 
269
def _timedelta_to_milliseconds(td):
 
270
    "Convert a datetime.timedelta() to milliseconds"
 
271
    return ((td.days * 24 * 60 * 60 * 1000)
 
272
            + (td.seconds * 1000)
 
273
            + (td.microseconds // 1000))
 
274
        
231
275
class Client(object):
232
276
    """A representation of a client host served by this server.
233
277
    
234
278
    Attributes:
235
 
    name:       string; from the config file, used in log messages and
236
 
                        D-Bus identifiers
 
279
    _approved:   bool(); 'None' if not yet approved/disapproved
 
280
    approval_delay: datetime.timedelta(); Time to wait for approval
 
281
    approval_duration: datetime.timedelta(); Duration of one approval
 
282
    checker:    subprocess.Popen(); a running checker process used
 
283
                                    to see if the client lives.
 
284
                                    'None' if no process is running.
 
285
    checker_callback_tag: a gobject event source tag, or None
 
286
    checker_command: string; External command which is run to check
 
287
                     if client lives.  %() expansions are done at
 
288
                     runtime with vars(self) as dict, so that for
 
289
                     instance %(name)s can be used in the command.
 
290
    checker_initiator_tag: a gobject event source tag, or None
 
291
    created:    datetime.datetime(); (UTC) object creation
 
292
    current_checker_command: string; current running checker_command
 
293
    disable_hook:  If set, called by disable() as disable_hook(self)
 
294
    disable_initiator_tag: a gobject event source tag, or None
 
295
    enabled:    bool()
237
296
    fingerprint: string (40 or 32 hexadecimal digits); used to
238
297
                 uniquely identify the client
239
 
    secret:     bytestring; sent verbatim (over TLS) to client
240
298
    host:       string; available for use by the checker command
241
 
    created:    datetime.datetime(); (UTC) object creation
 
299
    interval:   datetime.timedelta(); How often to start a new checker
 
300
    last_approval_request: datetime.datetime(); (UTC) or None
 
301
    last_checked_ok: datetime.datetime(); (UTC) or None
242
302
    last_enabled: datetime.datetime(); (UTC)
243
 
    enabled:    bool()
244
 
    last_checked_ok: datetime.datetime(); (UTC) or None
 
303
    name:       string; from the config file, used in log messages and
 
304
                        D-Bus identifiers
 
305
    secret:     bytestring; sent verbatim (over TLS) to client
245
306
    timeout:    datetime.timedelta(); How long from last_checked_ok
246
307
                                      until this client is disabled
247
 
    interval:   datetime.timedelta(); How often to start a new checker
248
 
    disable_hook:  If set, called by disable() as disable_hook(self)
249
 
    checker:    subprocess.Popen(); a running checker process used
250
 
                                    to see if the client lives.
251
 
                                    'None' if no process is running.
252
 
    checker_initiator_tag: a gobject event source tag, or None
253
 
    disable_initiator_tag: - '' -
254
 
    checker_callback_tag:  - '' -
255
 
    checker_command: string; External command which is run to check if
256
 
                     client lives.  %() expansions are done at
257
 
                     runtime with vars(self) as dict, so that for
258
 
                     instance %(name)s can be used in the command.
259
 
    current_checker_command: string; current running checker_command
 
308
    extended_timeout:   extra long timeout when password has been sent
 
309
    runtime_expansions: Allowed attributes for runtime expansion.
 
310
    expires:    datetime.datetime(); time (UTC) when a client will be
 
311
                disabled, or None
260
312
    """
261
313
    
262
 
    @staticmethod
263
 
    def _timedelta_to_milliseconds(td):
264
 
        "Convert a datetime.timedelta() to milliseconds"
265
 
        return ((td.days * 24 * 60 * 60 * 1000)
266
 
                + (td.seconds * 1000)
267
 
                + (td.microseconds // 1000))
 
314
    runtime_expansions = ("approval_delay", "approval_duration",
 
315
                          "created", "enabled", "fingerprint",
 
316
                          "host", "interval", "last_checked_ok",
 
317
                          "last_enabled", "name", "timeout")
268
318
    
269
319
    def timeout_milliseconds(self):
270
320
        "Return the 'timeout' attribute in milliseconds"
271
 
        return self._timedelta_to_milliseconds(self.timeout)
 
321
        return _timedelta_to_milliseconds(self.timeout)
 
322
    
 
323
    def extended_timeout_milliseconds(self):
 
324
        "Return the 'extended_timeout' attribute in milliseconds"
 
325
        return _timedelta_to_milliseconds(self.extended_timeout)
272
326
    
273
327
    def interval_milliseconds(self):
274
328
        "Return the 'interval' attribute in milliseconds"
275
 
        return self._timedelta_to_milliseconds(self.interval)
 
329
        return _timedelta_to_milliseconds(self.interval)
 
330
    
 
331
    def approval_delay_milliseconds(self):
 
332
        return _timedelta_to_milliseconds(self.approval_delay)
276
333
    
277
334
    def __init__(self, name = None, disable_hook=None, config=None):
278
335
        """Note: the 'checker' key in 'config' sets the
281
338
        self.name = name
282
339
        if config is None:
283
340
            config = {}
284
 
        logger.debug(u"Creating client %r", self.name)
 
341
        logger.debug("Creating client %r", self.name)
285
342
        # Uppercase and remove spaces from fingerprint for later
286
343
        # comparison purposes with return value from the fingerprint()
287
344
        # function
288
 
        self.fingerprint = (config[u"fingerprint"].upper()
289
 
                            .replace(u" ", u""))
290
 
        logger.debug(u"  Fingerprint: %s", self.fingerprint)
291
 
        if u"secret" in config:
292
 
            self.secret = config[u"secret"].decode(u"base64")
293
 
        elif u"secfile" in config:
 
345
        self.fingerprint = (config["fingerprint"].upper()
 
346
                            .replace(" ", ""))
 
347
        logger.debug("  Fingerprint: %s", self.fingerprint)
 
348
        if "secret" in config:
 
349
            self.secret = config["secret"].decode("base64")
 
350
        elif "secfile" in config:
294
351
            with open(os.path.expanduser(os.path.expandvars
295
 
                                         (config[u"secfile"])),
 
352
                                         (config["secfile"])),
296
353
                      "rb") as secfile:
297
354
                self.secret = secfile.read()
298
355
        else:
299
 
            raise TypeError(u"No secret or secfile for client %s"
 
356
            raise TypeError("No secret or secfile for client %s"
300
357
                            % self.name)
301
 
        self.host = config.get(u"host", u"")
 
358
        self.host = config.get("host", "")
302
359
        self.created = datetime.datetime.utcnow()
303
360
        self.enabled = False
 
361
        self.last_approval_request = None
304
362
        self.last_enabled = None
305
363
        self.last_checked_ok = None
306
 
        self.timeout = string_to_delta(config[u"timeout"])
307
 
        self.interval = string_to_delta(config[u"interval"])
 
364
        self.timeout = string_to_delta(config["timeout"])
 
365
        self.extended_timeout = string_to_delta(config
 
366
                                                ["extended_timeout"])
 
367
        self.interval = string_to_delta(config["interval"])
308
368
        self.disable_hook = disable_hook
309
369
        self.checker = None
310
370
        self.checker_initiator_tag = None
311
371
        self.disable_initiator_tag = None
 
372
        self.expires = None
312
373
        self.checker_callback_tag = None
313
 
        self.checker_command = config[u"checker"]
 
374
        self.checker_command = config["checker"]
314
375
        self.current_checker_command = None
315
376
        self.last_connect = None
 
377
        self._approved = None
 
378
        self.approved_by_default = config.get("approved_by_default",
 
379
                                              True)
 
380
        self.approvals_pending = 0
 
381
        self.approval_delay = string_to_delta(
 
382
            config["approval_delay"])
 
383
        self.approval_duration = string_to_delta(
 
384
            config["approval_duration"])
 
385
        self.changedstate = (multiprocessing_manager
 
386
                             .Condition(multiprocessing_manager
 
387
                                        .Lock()))
 
388
    
 
389
    def send_changedstate(self):
 
390
        self.changedstate.acquire()
 
391
        self.changedstate.notify_all()
 
392
        self.changedstate.release()
316
393
    
317
394
    def enable(self):
318
395
        """Start this client's checker and timeout hooks"""
319
 
        if getattr(self, u"enabled", False):
 
396
        if getattr(self, "enabled", False):
320
397
            # Already enabled
321
398
            return
322
 
        self.last_enabled = datetime.datetime.utcnow()
 
399
        self.send_changedstate()
323
400
        # Schedule a new checker to be started an 'interval' from now,
324
401
        # and every interval from then on.
325
402
        self.checker_initiator_tag = (gobject.timeout_add
326
403
                                      (self.interval_milliseconds(),
327
404
                                       self.start_checker))
328
405
        # Schedule a disable() when 'timeout' has passed
 
406
        self.expires = datetime.datetime.utcnow() + self.timeout
329
407
        self.disable_initiator_tag = (gobject.timeout_add
330
408
                                   (self.timeout_milliseconds(),
331
409
                                    self.disable))
332
410
        self.enabled = True
 
411
        self.last_enabled = datetime.datetime.utcnow()
333
412
        # Also start a new checker *right now*.
334
413
        self.start_checker()
335
414
    
338
417
        if not getattr(self, "enabled", False):
339
418
            return False
340
419
        if not quiet:
341
 
            logger.info(u"Disabling client %s", self.name)
342
 
        if getattr(self, u"disable_initiator_tag", False):
 
420
            self.send_changedstate()
 
421
        if not quiet:
 
422
            logger.info("Disabling client %s", self.name)
 
423
        if getattr(self, "disable_initiator_tag", False):
343
424
            gobject.source_remove(self.disable_initiator_tag)
344
425
            self.disable_initiator_tag = None
345
 
        if getattr(self, u"checker_initiator_tag", False):
 
426
        self.expires = None
 
427
        if getattr(self, "checker_initiator_tag", False):
346
428
            gobject.source_remove(self.checker_initiator_tag)
347
429
            self.checker_initiator_tag = None
348
430
        self.stop_checker()
363
445
        if os.WIFEXITED(condition):
364
446
            exitstatus = os.WEXITSTATUS(condition)
365
447
            if exitstatus == 0:
366
 
                logger.info(u"Checker for %(name)s succeeded",
 
448
                logger.info("Checker for %(name)s succeeded",
367
449
                            vars(self))
368
450
                self.checked_ok()
369
451
            else:
370
 
                logger.info(u"Checker for %(name)s failed",
 
452
                logger.info("Checker for %(name)s failed",
371
453
                            vars(self))
372
454
        else:
373
 
            logger.warning(u"Checker for %(name)s crashed?",
 
455
            logger.warning("Checker for %(name)s crashed?",
374
456
                           vars(self))
375
457
    
376
 
    def checked_ok(self):
 
458
    def checked_ok(self, timeout=None):
377
459
        """Bump up the timeout for this client.
378
460
        
379
461
        This should only be called when the client has been seen,
380
462
        alive and well.
381
463
        """
 
464
        if timeout is None:
 
465
            timeout = self.timeout
382
466
        self.last_checked_ok = datetime.datetime.utcnow()
383
 
        gobject.source_remove(self.disable_initiator_tag)
384
 
        self.disable_initiator_tag = (gobject.timeout_add
385
 
                                      (self.timeout_milliseconds(),
386
 
                                       self.disable))
 
467
        if self.disable_initiator_tag is not None:
 
468
            gobject.source_remove(self.disable_initiator_tag)
 
469
        if getattr(self, "enabled", False):
 
470
            self.disable_initiator_tag = (gobject.timeout_add
 
471
                                          (_timedelta_to_milliseconds
 
472
                                           (timeout), self.disable))
 
473
            self.expires = datetime.datetime.utcnow() + timeout
 
474
    
 
475
    def need_approval(self):
 
476
        self.last_approval_request = datetime.datetime.utcnow()
387
477
    
388
478
    def start_checker(self):
389
479
        """Start a new checker subprocess if one is not running.
402
492
        # If a checker exists, make sure it is not a zombie
403
493
        try:
404
494
            pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
405
 
        except (AttributeError, OSError), error:
 
495
        except (AttributeError, OSError) as error:
406
496
            if (isinstance(error, OSError)
407
497
                and error.errno != errno.ECHILD):
408
498
                raise error
409
499
        else:
410
500
            if pid:
411
 
                logger.warning(u"Checker was a zombie")
 
501
                logger.warning("Checker was a zombie")
412
502
                gobject.source_remove(self.checker_callback_tag)
413
503
                self.checker_callback(pid, status,
414
504
                                      self.current_checker_command)
419
509
                command = self.checker_command % self.host
420
510
            except TypeError:
421
511
                # Escape attributes for the shell
422
 
                escaped_attrs = dict((key,
423
 
                                      re.escape(unicode(str(val),
424
 
                                                        errors=
425
 
                                                        u'replace')))
426
 
                                     for key, val in
427
 
                                     vars(self).iteritems())
 
512
                escaped_attrs = dict(
 
513
                    (attr,
 
514
                     re.escape(unicode(str(getattr(self, attr, "")),
 
515
                                       errors=
 
516
                                       'replace')))
 
517
                    for attr in
 
518
                    self.runtime_expansions)
 
519
                
428
520
                try:
429
521
                    command = self.checker_command % escaped_attrs
430
 
                except TypeError, error:
431
 
                    logger.error(u'Could not format string "%s":'
432
 
                                 u' %s', self.checker_command, error)
 
522
                except TypeError as error:
 
523
                    logger.error('Could not format string "%s":'
 
524
                                 ' %s', self.checker_command, error)
433
525
                    return True # Try again later
434
526
            self.current_checker_command = command
435
527
            try:
436
 
                logger.info(u"Starting checker %r for %s",
 
528
                logger.info("Starting checker %r for %s",
437
529
                            command, self.name)
438
530
                # We don't need to redirect stdout and stderr, since
439
531
                # in normal mode, that is already done by daemon(),
441
533
                # always replaced by /dev/null.)
442
534
                self.checker = subprocess.Popen(command,
443
535
                                                close_fds=True,
444
 
                                                shell=True, cwd=u"/")
 
536
                                                shell=True, cwd="/")
445
537
                self.checker_callback_tag = (gobject.child_watch_add
446
538
                                             (self.checker.pid,
447
539
                                              self.checker_callback,
452
544
                if pid:
453
545
                    gobject.source_remove(self.checker_callback_tag)
454
546
                    self.checker_callback(pid, status, command)
455
 
            except OSError, error:
456
 
                logger.error(u"Failed to start subprocess: %s",
 
547
            except OSError as error:
 
548
                logger.error("Failed to start subprocess: %s",
457
549
                             error)
458
550
        # Re-run this periodically if run by gobject.timeout_add
459
551
        return True
463
555
        if self.checker_callback_tag:
464
556
            gobject.source_remove(self.checker_callback_tag)
465
557
            self.checker_callback_tag = None
466
 
        if getattr(self, u"checker", None) is None:
 
558
        if getattr(self, "checker", None) is None:
467
559
            return
468
 
        logger.debug(u"Stopping checker for %(name)s", vars(self))
 
560
        logger.debug("Stopping checker for %(name)s", vars(self))
469
561
        try:
470
562
            os.kill(self.checker.pid, signal.SIGTERM)
471
563
            #time.sleep(0.5)
472
564
            #if self.checker.poll() is None:
473
565
            #    os.kill(self.checker.pid, signal.SIGKILL)
474
 
        except OSError, error:
 
566
        except OSError as error:
475
567
            if error.errno != errno.ESRCH: # No such process
476
568
                raise
477
569
        self.checker = None
478
570
 
479
571
 
480
 
def dbus_service_property(dbus_interface, signature=u"v",
481
 
                          access=u"readwrite", byte_arrays=False):
 
572
def dbus_service_property(dbus_interface, signature="v",
 
573
                          access="readwrite", byte_arrays=False):
482
574
    """Decorators for marking methods of a DBusObjectWithProperties to
483
575
    become properties on the D-Bus.
484
576
    
491
583
    """
492
584
    # Encoding deeply encoded byte arrays is not supported yet by the
493
585
    # "Set" method, so we fail early here:
494
 
    if byte_arrays and signature != u"ay":
495
 
        raise ValueError(u"Byte arrays not supported for non-'ay'"
496
 
                         u" signature %r" % signature)
 
586
    if byte_arrays and signature != "ay":
 
587
        raise ValueError("Byte arrays not supported for non-'ay'"
 
588
                         " signature %r" % signature)
497
589
    def decorator(func):
498
590
        func._dbus_is_property = True
499
591
        func._dbus_interface = dbus_interface
500
592
        func._dbus_signature = signature
501
593
        func._dbus_access = access
502
594
        func._dbus_name = func.__name__
503
 
        if func._dbus_name.endswith(u"_dbus_property"):
 
595
        if func._dbus_name.endswith("_dbus_property"):
504
596
            func._dbus_name = func._dbus_name[:-14]
505
 
        func._dbus_get_args_options = {u'byte_arrays': byte_arrays }
 
597
        func._dbus_get_args_options = {'byte_arrays': byte_arrays }
506
598
        return func
507
599
    return decorator
508
600
 
528
620
 
529
621
class DBusObjectWithProperties(dbus.service.Object):
530
622
    """A D-Bus object with properties.
531
 
 
 
623
    
532
624
    Classes inheriting from this can use the dbus_service_property
533
625
    decorator to expose methods as D-Bus properties.  It exposes the
534
626
    standard Get(), Set(), and GetAll() methods on the D-Bus.
536
628
    
537
629
    @staticmethod
538
630
    def _is_dbus_property(obj):
539
 
        return getattr(obj, u"_dbus_is_property", False)
 
631
        return getattr(obj, "_dbus_is_property", False)
540
632
    
541
633
    def _get_all_dbus_properties(self):
542
634
        """Returns a generator of (name, attribute) pairs
543
635
        """
544
 
        return ((prop._dbus_name, prop)
 
636
        return ((prop.__get__(self)._dbus_name, prop.__get__(self))
 
637
                for cls in self.__class__.__mro__
545
638
                for name, prop in
546
 
                inspect.getmembers(self, self._is_dbus_property))
 
639
                inspect.getmembers(cls, self._is_dbus_property))
547
640
    
548
641
    def _get_dbus_property(self, interface_name, property_name):
549
642
        """Returns a bound method if one exists which is a D-Bus
550
643
        property with the specified name and interface.
551
644
        """
552
 
        for name in (property_name,
553
 
                     property_name + u"_dbus_property"):
554
 
            prop = getattr(self, name, None)
555
 
            if (prop is None
556
 
                or not self._is_dbus_property(prop)
557
 
                or prop._dbus_name != property_name
558
 
                or (interface_name and prop._dbus_interface
559
 
                    and interface_name != prop._dbus_interface)):
560
 
                continue
561
 
            return prop
 
645
        for cls in  self.__class__.__mro__:
 
646
            for name, value in (inspect.getmembers
 
647
                                (cls, self._is_dbus_property)):
 
648
                if (value._dbus_name == property_name
 
649
                    and value._dbus_interface == interface_name):
 
650
                    return value.__get__(self)
 
651
        
562
652
        # No such property
563
 
        raise DBusPropertyNotFound(self.dbus_object_path + u":"
564
 
                                   + interface_name + u"."
 
653
        raise DBusPropertyNotFound(self.dbus_object_path + ":"
 
654
                                   + interface_name + "."
565
655
                                   + property_name)
566
656
    
567
 
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ss",
568
 
                         out_signature=u"v")
 
657
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
 
658
                         out_signature="v")
569
659
    def Get(self, interface_name, property_name):
570
660
        """Standard D-Bus property Get() method, see D-Bus standard.
571
661
        """
572
662
        prop = self._get_dbus_property(interface_name, property_name)
573
 
        if prop._dbus_access == u"write":
 
663
        if prop._dbus_access == "write":
574
664
            raise DBusPropertyAccessException(property_name)
575
665
        value = prop()
576
 
        if not hasattr(value, u"variant_level"):
 
666
        if not hasattr(value, "variant_level"):
577
667
            return value
578
668
        return type(value)(value, variant_level=value.variant_level+1)
579
669
    
580
 
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ssv")
 
670
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
581
671
    def Set(self, interface_name, property_name, value):
582
672
        """Standard D-Bus property Set() method, see D-Bus standard.
583
673
        """
584
674
        prop = self._get_dbus_property(interface_name, property_name)
585
 
        if prop._dbus_access == u"read":
 
675
        if prop._dbus_access == "read":
586
676
            raise DBusPropertyAccessException(property_name)
587
 
        if prop._dbus_get_args_options[u"byte_arrays"]:
 
677
        if prop._dbus_get_args_options["byte_arrays"]:
588
678
            # The byte_arrays option is not supported yet on
589
679
            # signatures other than "ay".
590
 
            if prop._dbus_signature != u"ay":
 
680
            if prop._dbus_signature != "ay":
591
681
                raise ValueError
592
682
            value = dbus.ByteArray(''.join(unichr(byte)
593
683
                                           for byte in value))
594
684
        prop(value)
595
685
    
596
 
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"s",
597
 
                         out_signature=u"a{sv}")
 
686
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
 
687
                         out_signature="a{sv}")
598
688
    def GetAll(self, interface_name):
599
689
        """Standard D-Bus property GetAll() method, see D-Bus
600
690
        standard.
601
 
 
 
691
        
602
692
        Note: Will not include properties with access="write".
603
693
        """
604
694
        all = {}
608
698
                # Interface non-empty but did not match
609
699
                continue
610
700
            # Ignore write-only properties
611
 
            if prop._dbus_access == u"write":
 
701
            if prop._dbus_access == "write":
612
702
                continue
613
703
            value = prop()
614
 
            if not hasattr(value, u"variant_level"):
 
704
            if not hasattr(value, "variant_level"):
615
705
                all[name] = value
616
706
                continue
617
707
            all[name] = type(value)(value, variant_level=
618
708
                                    value.variant_level+1)
619
 
        return dbus.Dictionary(all, signature=u"sv")
 
709
        return dbus.Dictionary(all, signature="sv")
620
710
    
621
711
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
622
 
                         out_signature=u"s",
 
712
                         out_signature="s",
623
713
                         path_keyword='object_path',
624
714
                         connection_keyword='connection')
625
715
    def Introspect(self, object_path, connection):
630
720
        try:
631
721
            document = xml.dom.minidom.parseString(xmlstring)
632
722
            def make_tag(document, name, prop):
633
 
                e = document.createElement(u"property")
634
 
                e.setAttribute(u"name", name)
635
 
                e.setAttribute(u"type", prop._dbus_signature)
636
 
                e.setAttribute(u"access", prop._dbus_access)
 
723
                e = document.createElement("property")
 
724
                e.setAttribute("name", name)
 
725
                e.setAttribute("type", prop._dbus_signature)
 
726
                e.setAttribute("access", prop._dbus_access)
637
727
                return e
638
 
            for if_tag in document.getElementsByTagName(u"interface"):
 
728
            for if_tag in document.getElementsByTagName("interface"):
639
729
                for tag in (make_tag(document, name, prop)
640
730
                            for name, prop
641
731
                            in self._get_all_dbus_properties()
642
732
                            if prop._dbus_interface
643
 
                            == if_tag.getAttribute(u"name")):
 
733
                            == if_tag.getAttribute("name")):
644
734
                    if_tag.appendChild(tag)
645
735
                # Add the names to the return values for the
646
736
                # "org.freedesktop.DBus.Properties" methods
647
 
                if (if_tag.getAttribute(u"name")
648
 
                    == u"org.freedesktop.DBus.Properties"):
649
 
                    for cn in if_tag.getElementsByTagName(u"method"):
650
 
                        if cn.getAttribute(u"name") == u"Get":
651
 
                            for arg in cn.getElementsByTagName(u"arg"):
652
 
                                if (arg.getAttribute(u"direction")
653
 
                                    == u"out"):
654
 
                                    arg.setAttribute(u"name", u"value")
655
 
                        elif cn.getAttribute(u"name") == u"GetAll":
656
 
                            for arg in cn.getElementsByTagName(u"arg"):
657
 
                                if (arg.getAttribute(u"direction")
658
 
                                    == u"out"):
659
 
                                    arg.setAttribute(u"name", u"props")
660
 
            xmlstring = document.toxml(u"utf-8")
 
737
                if (if_tag.getAttribute("name")
 
738
                    == "org.freedesktop.DBus.Properties"):
 
739
                    for cn in if_tag.getElementsByTagName("method"):
 
740
                        if cn.getAttribute("name") == "Get":
 
741
                            for arg in cn.getElementsByTagName("arg"):
 
742
                                if (arg.getAttribute("direction")
 
743
                                    == "out"):
 
744
                                    arg.setAttribute("name", "value")
 
745
                        elif cn.getAttribute("name") == "GetAll":
 
746
                            for arg in cn.getElementsByTagName("arg"):
 
747
                                if (arg.getAttribute("direction")
 
748
                                    == "out"):
 
749
                                    arg.setAttribute("name", "props")
 
750
            xmlstring = document.toxml("utf-8")
661
751
            document.unlink()
662
752
        except (AttributeError, xml.dom.DOMException,
663
 
                xml.parsers.expat.ExpatError), error:
664
 
            logger.error(u"Failed to override Introspection method",
 
753
                xml.parsers.expat.ExpatError) as error:
 
754
            logger.error("Failed to override Introspection method",
665
755
                         error)
666
756
        return xmlstring
667
757
 
668
758
 
 
759
def datetime_to_dbus (dt, variant_level=0):
 
760
    """Convert a UTC datetime.datetime() to a D-Bus type."""
 
761
    if dt is None:
 
762
        return dbus.String("", variant_level = variant_level)
 
763
    return dbus.String(dt.isoformat(),
 
764
                       variant_level=variant_level)
 
765
 
 
766
class AlternateDBusNamesMetaclass(DBusObjectWithProperties
 
767
                                  .__metaclass__):
 
768
    """Applied to an empty subclass of a D-Bus object, this metaclass
 
769
    will add additional D-Bus attributes matching a certain pattern.
 
770
    """
 
771
    def __new__(mcs, name, bases, attr):
 
772
        # Go through all the base classes which could have D-Bus
 
773
        # methods, signals, or properties in them
 
774
        for base in (b for b in bases
 
775
                     if issubclass(b, dbus.service.Object)):
 
776
            # Go though all attributes of the base class
 
777
            for attrname, attribute in inspect.getmembers(base):
 
778
                # Ignore non-D-Bus attributes, and D-Bus attributes
 
779
                # with the wrong interface name
 
780
                if (not hasattr(attribute, "_dbus_interface")
 
781
                    or not attribute._dbus_interface
 
782
                    .startswith("se.recompile.Mandos")):
 
783
                    continue
 
784
                # Create an alternate D-Bus interface name based on
 
785
                # the current name
 
786
                alt_interface = (attribute._dbus_interface
 
787
                                 .replace("se.recompile.Mandos",
 
788
                                          "se.bsnet.fukt.Mandos"))
 
789
                # Is this a D-Bus signal?
 
790
                if getattr(attribute, "_dbus_is_signal", False):
 
791
                    # Extract the original non-method function by
 
792
                    # black magic
 
793
                    nonmethod_func = (dict(
 
794
                            zip(attribute.func_code.co_freevars,
 
795
                                attribute.__closure__))["func"]
 
796
                                      .cell_contents)
 
797
                    # Create a new, but exactly alike, function
 
798
                    # object, and decorate it to be a new D-Bus signal
 
799
                    # with the alternate D-Bus interface name
 
800
                    new_function = (dbus.service.signal
 
801
                                    (alt_interface,
 
802
                                     attribute._dbus_signature)
 
803
                                    (types.FunctionType(
 
804
                                nonmethod_func.func_code,
 
805
                                nonmethod_func.func_globals,
 
806
                                nonmethod_func.func_name,
 
807
                                nonmethod_func.func_defaults,
 
808
                                nonmethod_func.func_closure)))
 
809
                    # Define a creator of a function to call both the
 
810
                    # old and new functions, so both the old and new
 
811
                    # signals gets sent when the function is called
 
812
                    def fixscope(func1, func2):
 
813
                        """This function is a scope container to pass
 
814
                        func1 and func2 to the "call_both" function
 
815
                        outside of its arguments"""
 
816
                        def call_both(*args, **kwargs):
 
817
                            """This function will emit two D-Bus
 
818
                            signals by calling func1 and func2"""
 
819
                            func1(*args, **kwargs)
 
820
                            func2(*args, **kwargs)
 
821
                        return call_both
 
822
                    # Create the "call_both" function and add it to
 
823
                    # the class
 
824
                    attr[attrname] = fixscope(attribute,
 
825
                                              new_function)
 
826
                # Is this a D-Bus method?
 
827
                elif getattr(attribute, "_dbus_is_method", False):
 
828
                    # Create a new, but exactly alike, function
 
829
                    # object.  Decorate it to be a new D-Bus method
 
830
                    # with the alternate D-Bus interface name.  Add it
 
831
                    # to the class.
 
832
                    attr[attrname] = (dbus.service.method
 
833
                                      (alt_interface,
 
834
                                       attribute._dbus_in_signature,
 
835
                                       attribute._dbus_out_signature)
 
836
                                      (types.FunctionType
 
837
                                       (attribute.func_code,
 
838
                                        attribute.func_globals,
 
839
                                        attribute.func_name,
 
840
                                        attribute.func_defaults,
 
841
                                        attribute.func_closure)))
 
842
                # Is this a D-Bus property?
 
843
                elif getattr(attribute, "_dbus_is_property", False):
 
844
                    # Create a new, but exactly alike, function
 
845
                    # object, and decorate it to be a new D-Bus
 
846
                    # property with the alternate D-Bus interface
 
847
                    # name.  Add it to the class.
 
848
                    attr[attrname] = (dbus_service_property
 
849
                                      (alt_interface,
 
850
                                       attribute._dbus_signature,
 
851
                                       attribute._dbus_access,
 
852
                                       attribute
 
853
                                       ._dbus_get_args_options
 
854
                                       ["byte_arrays"])
 
855
                                      (types.FunctionType
 
856
                                       (attribute.func_code,
 
857
                                        attribute.func_globals,
 
858
                                        attribute.func_name,
 
859
                                        attribute.func_defaults,
 
860
                                        attribute.func_closure)))
 
861
        return type.__new__(mcs, name, bases, attr)
 
862
 
669
863
class ClientDBus(Client, DBusObjectWithProperties):
670
864
    """A Client class using D-Bus
671
865
    
673
867
    dbus_object_path: dbus.ObjectPath
674
868
    bus: dbus.SystemBus()
675
869
    """
 
870
    
 
871
    runtime_expansions = (Client.runtime_expansions
 
872
                          + ("dbus_object_path",))
 
873
    
676
874
    # dbus.service.Object doesn't use super(), so we can't either.
677
875
    
678
876
    def __init__(self, bus = None, *args, **kwargs):
 
877
        self._approvals_pending = 0
679
878
        self.bus = bus
680
879
        Client.__init__(self, *args, **kwargs)
681
880
        # Only now, when this client is initialized, can it show up on
682
881
        # the D-Bus
 
882
        client_object_name = unicode(self.name).translate(
 
883
            {ord("."): ord("_"),
 
884
             ord("-"): ord("_")})
683
885
        self.dbus_object_path = (dbus.ObjectPath
684
 
                                 (u"/clients/"
685
 
                                  + self.name.replace(u".", u"_")))
 
886
                                 ("/clients/" + client_object_name))
686
887
        DBusObjectWithProperties.__init__(self, self.bus,
687
888
                                          self.dbus_object_path)
688
 
    
689
 
    @staticmethod
690
 
    def _datetime_to_dbus(dt, variant_level=0):
691
 
        """Convert a UTC datetime.datetime() to a D-Bus type."""
692
 
        return dbus.String(dt.isoformat(),
693
 
                           variant_level=variant_level)
694
 
    
695
 
    def enable(self):
696
 
        oldstate = getattr(self, u"enabled", False)
697
 
        r = Client.enable(self)
698
 
        if oldstate != self.enabled:
699
 
            # Emit D-Bus signals
700
 
            self.PropertyChanged(dbus.String(u"enabled"),
701
 
                                 dbus.Boolean(True, variant_level=1))
702
 
            self.PropertyChanged(
703
 
                dbus.String(u"last_enabled"),
704
 
                self._datetime_to_dbus(self.last_enabled,
705
 
                                       variant_level=1))
706
 
        return r
707
 
    
708
 
    def disable(self, quiet = False):
709
 
        oldstate = getattr(self, u"enabled", False)
710
 
        r = Client.disable(self, quiet=quiet)
711
 
        if not quiet and oldstate != self.enabled:
712
 
            # Emit D-Bus signal
713
 
            self.PropertyChanged(dbus.String(u"enabled"),
714
 
                                 dbus.Boolean(False, variant_level=1))
715
 
        return r
 
889
        
 
890
    def notifychangeproperty(transform_func,
 
891
                             dbus_name, type_func=lambda x: x,
 
892
                             variant_level=1):
 
893
        """ Modify a variable so that it's a property which announces
 
894
        its changes to DBus.
 
895
 
 
896
        transform_fun: Function that takes a value and a variant_level
 
897
                       and transforms it to a D-Bus type.
 
898
        dbus_name: D-Bus name of the variable
 
899
        type_func: Function that transform the value before sending it
 
900
                   to the D-Bus.  Default: no transform
 
901
        variant_level: D-Bus variant level.  Default: 1
 
902
        """
 
903
        attrname = "_{0}".format(dbus_name)
 
904
        def setter(self, value):
 
905
            if hasattr(self, "dbus_object_path"):
 
906
                if (not hasattr(self, attrname) or
 
907
                    type_func(getattr(self, attrname, None))
 
908
                    != type_func(value)):
 
909
                    dbus_value = transform_func(type_func(value),
 
910
                                                variant_level
 
911
                                                =variant_level)
 
912
                    self.PropertyChanged(dbus.String(dbus_name),
 
913
                                         dbus_value)
 
914
            setattr(self, attrname, value)
 
915
        
 
916
        return property(lambda self: getattr(self, attrname), setter)
 
917
    
 
918
    
 
919
    expires = notifychangeproperty(datetime_to_dbus, "Expires")
 
920
    approvals_pending = notifychangeproperty(dbus.Boolean,
 
921
                                             "ApprovalPending",
 
922
                                             type_func = bool)
 
923
    enabled = notifychangeproperty(dbus.Boolean, "Enabled")
 
924
    last_enabled = notifychangeproperty(datetime_to_dbus,
 
925
                                        "LastEnabled")
 
926
    checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",
 
927
                                   type_func = lambda checker:
 
928
                                       checker is not None)
 
929
    last_checked_ok = notifychangeproperty(datetime_to_dbus,
 
930
                                           "LastCheckedOK")
 
931
    last_approval_request = notifychangeproperty(
 
932
        datetime_to_dbus, "LastApprovalRequest")
 
933
    approved_by_default = notifychangeproperty(dbus.Boolean,
 
934
                                               "ApprovedByDefault")
 
935
    approval_delay = notifychangeproperty(dbus.UInt16,
 
936
                                          "ApprovalDelay",
 
937
                                          type_func =
 
938
                                          _timedelta_to_milliseconds)
 
939
    approval_duration = notifychangeproperty(
 
940
        dbus.UInt16, "ApprovalDuration",
 
941
        type_func = _timedelta_to_milliseconds)
 
942
    host = notifychangeproperty(dbus.String, "Host")
 
943
    timeout = notifychangeproperty(dbus.UInt16, "Timeout",
 
944
                                   type_func =
 
945
                                   _timedelta_to_milliseconds)
 
946
    extended_timeout = notifychangeproperty(
 
947
        dbus.UInt16, "ExtendedTimeout",
 
948
        type_func = _timedelta_to_milliseconds)
 
949
    interval = notifychangeproperty(dbus.UInt16,
 
950
                                    "Interval",
 
951
                                    type_func =
 
952
                                    _timedelta_to_milliseconds)
 
953
    checker_command = notifychangeproperty(dbus.String, "Checker")
 
954
    
 
955
    del notifychangeproperty
716
956
    
717
957
    def __del__(self, *args, **kwargs):
718
958
        try:
719
959
            self.remove_from_connection()
720
960
        except LookupError:
721
961
            pass
722
 
        if hasattr(DBusObjectWithProperties, u"__del__"):
 
962
        if hasattr(DBusObjectWithProperties, "__del__"):
723
963
            DBusObjectWithProperties.__del__(self, *args, **kwargs)
724
964
        Client.__del__(self, *args, **kwargs)
725
965
    
727
967
                         *args, **kwargs):
728
968
        self.checker_callback_tag = None
729
969
        self.checker = None
730
 
        # Emit D-Bus signal
731
 
        self.PropertyChanged(dbus.String(u"checker_running"),
732
 
                             dbus.Boolean(False, variant_level=1))
733
970
        if os.WIFEXITED(condition):
734
971
            exitstatus = os.WEXITSTATUS(condition)
735
972
            # Emit D-Bus signal
745
982
        return Client.checker_callback(self, pid, condition, command,
746
983
                                       *args, **kwargs)
747
984
    
748
 
    def checked_ok(self, *args, **kwargs):
749
 
        r = Client.checked_ok(self, *args, **kwargs)
750
 
        # Emit D-Bus signal
751
 
        self.PropertyChanged(
752
 
            dbus.String(u"last_checked_ok"),
753
 
            (self._datetime_to_dbus(self.last_checked_ok,
754
 
                                    variant_level=1)))
755
 
        return r
756
 
    
757
985
    def start_checker(self, *args, **kwargs):
758
986
        old_checker = self.checker
759
987
        if self.checker is not None:
766
994
            and old_checker_pid != self.checker.pid):
767
995
            # Emit D-Bus signal
768
996
            self.CheckerStarted(self.current_checker_command)
769
 
            self.PropertyChanged(
770
 
                dbus.String(u"checker_running"),
771
 
                dbus.Boolean(True, variant_level=1))
772
 
        return r
773
 
    
774
 
    def stop_checker(self, *args, **kwargs):
775
 
        old_checker = getattr(self, u"checker", None)
776
 
        r = Client.stop_checker(self, *args, **kwargs)
777
 
        if (old_checker is not None
778
 
            and getattr(self, u"checker", None) is None):
779
 
            self.PropertyChanged(dbus.String(u"checker_running"),
780
 
                                 dbus.Boolean(False, variant_level=1))
781
 
        return r
782
 
    
783
 
    ## D-Bus methods & signals
784
 
    _interface = u"se.bsnet.fukt.Mandos.Client"
785
 
    
786
 
    # CheckedOK - method
787
 
    @dbus.service.method(_interface)
788
 
    def CheckedOK(self):
789
 
        return self.checked_ok()
 
997
        return r
 
998
    
 
999
    def _reset_approved(self):
 
1000
        self._approved = None
 
1001
        return False
 
1002
    
 
1003
    def approve(self, value=True):
 
1004
        self.send_changedstate()
 
1005
        self._approved = value
 
1006
        gobject.timeout_add(_timedelta_to_milliseconds
 
1007
                            (self.approval_duration),
 
1008
                            self._reset_approved)
 
1009
    
 
1010
    
 
1011
    ## D-Bus methods, signals & properties
 
1012
    _interface = "se.recompile.Mandos.Client"
 
1013
    
 
1014
    ## Signals
790
1015
    
791
1016
    # CheckerCompleted - signal
792
 
    @dbus.service.signal(_interface, signature=u"nxs")
 
1017
    @dbus.service.signal(_interface, signature="nxs")
793
1018
    def CheckerCompleted(self, exitcode, waitstatus, command):
794
1019
        "D-Bus signal"
795
1020
        pass
796
1021
    
797
1022
    # CheckerStarted - signal
798
 
    @dbus.service.signal(_interface, signature=u"s")
 
1023
    @dbus.service.signal(_interface, signature="s")
799
1024
    def CheckerStarted(self, command):
800
1025
        "D-Bus signal"
801
1026
        pass
802
1027
    
803
1028
    # PropertyChanged - signal
804
 
    @dbus.service.signal(_interface, signature=u"sv")
 
1029
    @dbus.service.signal(_interface, signature="sv")
805
1030
    def PropertyChanged(self, property, value):
806
1031
        "D-Bus signal"
807
1032
        pass
809
1034
    # GotSecret - signal
810
1035
    @dbus.service.signal(_interface)
811
1036
    def GotSecret(self):
812
 
        "D-Bus signal"
 
1037
        """D-Bus signal
 
1038
        Is sent after a successful transfer of secret from the Mandos
 
1039
        server to mandos-client
 
1040
        """
813
1041
        pass
814
1042
    
815
1043
    # Rejected - signal
816
 
    @dbus.service.signal(_interface)
817
 
    def Rejected(self):
 
1044
    @dbus.service.signal(_interface, signature="s")
 
1045
    def Rejected(self, reason):
818
1046
        "D-Bus signal"
819
1047
        pass
820
1048
    
 
1049
    # NeedApproval - signal
 
1050
    @dbus.service.signal(_interface, signature="tb")
 
1051
    def NeedApproval(self, timeout, default):
 
1052
        "D-Bus signal"
 
1053
        return self.need_approval()
 
1054
    
 
1055
    ## Methods
 
1056
    
 
1057
    # Approve - method
 
1058
    @dbus.service.method(_interface, in_signature="b")
 
1059
    def Approve(self, value):
 
1060
        self.approve(value)
 
1061
    
 
1062
    # CheckedOK - method
 
1063
    @dbus.service.method(_interface)
 
1064
    def CheckedOK(self):
 
1065
        self.checked_ok()
 
1066
    
821
1067
    # Enable - method
822
1068
    @dbus.service.method(_interface)
823
1069
    def Enable(self):
841
1087
    def StopChecker(self):
842
1088
        self.stop_checker()
843
1089
    
844
 
    # name - property
845
 
    @dbus_service_property(_interface, signature=u"s", access=u"read")
846
 
    def name_dbus_property(self):
 
1090
    ## Properties
 
1091
    
 
1092
    # ApprovalPending - property
 
1093
    @dbus_service_property(_interface, signature="b", access="read")
 
1094
    def ApprovalPending_dbus_property(self):
 
1095
        return dbus.Boolean(bool(self.approvals_pending))
 
1096
    
 
1097
    # ApprovedByDefault - property
 
1098
    @dbus_service_property(_interface, signature="b",
 
1099
                           access="readwrite")
 
1100
    def ApprovedByDefault_dbus_property(self, value=None):
 
1101
        if value is None:       # get
 
1102
            return dbus.Boolean(self.approved_by_default)
 
1103
        self.approved_by_default = bool(value)
 
1104
    
 
1105
    # ApprovalDelay - property
 
1106
    @dbus_service_property(_interface, signature="t",
 
1107
                           access="readwrite")
 
1108
    def ApprovalDelay_dbus_property(self, value=None):
 
1109
        if value is None:       # get
 
1110
            return dbus.UInt64(self.approval_delay_milliseconds())
 
1111
        self.approval_delay = datetime.timedelta(0, 0, 0, value)
 
1112
    
 
1113
    # ApprovalDuration - property
 
1114
    @dbus_service_property(_interface, signature="t",
 
1115
                           access="readwrite")
 
1116
    def ApprovalDuration_dbus_property(self, value=None):
 
1117
        if value is None:       # get
 
1118
            return dbus.UInt64(_timedelta_to_milliseconds(
 
1119
                    self.approval_duration))
 
1120
        self.approval_duration = datetime.timedelta(0, 0, 0, value)
 
1121
    
 
1122
    # Name - property
 
1123
    @dbus_service_property(_interface, signature="s", access="read")
 
1124
    def Name_dbus_property(self):
847
1125
        return dbus.String(self.name)
848
1126
    
849
 
    # fingerprint - property
850
 
    @dbus_service_property(_interface, signature=u"s", access=u"read")
851
 
    def fingerprint_dbus_property(self):
 
1127
    # Fingerprint - property
 
1128
    @dbus_service_property(_interface, signature="s", access="read")
 
1129
    def Fingerprint_dbus_property(self):
852
1130
        return dbus.String(self.fingerprint)
853
1131
    
854
 
    # host - property
855
 
    @dbus_service_property(_interface, signature=u"s",
856
 
                           access=u"readwrite")
857
 
    def host_dbus_property(self, value=None):
 
1132
    # Host - property
 
1133
    @dbus_service_property(_interface, signature="s",
 
1134
                           access="readwrite")
 
1135
    def Host_dbus_property(self, value=None):
858
1136
        if value is None:       # get
859
1137
            return dbus.String(self.host)
860
1138
        self.host = value
861
 
        # Emit D-Bus signal
862
 
        self.PropertyChanged(dbus.String(u"host"),
863
 
                             dbus.String(value, variant_level=1))
864
 
    
865
 
    # created - property
866
 
    @dbus_service_property(_interface, signature=u"s", access=u"read")
867
 
    def created_dbus_property(self):
868
 
        return dbus.String(self._datetime_to_dbus(self.created))
869
 
    
870
 
    # last_enabled - property
871
 
    @dbus_service_property(_interface, signature=u"s", access=u"read")
872
 
    def last_enabled_dbus_property(self):
873
 
        if self.last_enabled is None:
874
 
            return dbus.String(u"")
875
 
        return dbus.String(self._datetime_to_dbus(self.last_enabled))
876
 
    
877
 
    # enabled - property
878
 
    @dbus_service_property(_interface, signature=u"b",
879
 
                           access=u"readwrite")
880
 
    def enabled_dbus_property(self, value=None):
 
1139
    
 
1140
    # Created - property
 
1141
    @dbus_service_property(_interface, signature="s", access="read")
 
1142
    def Created_dbus_property(self):
 
1143
        return dbus.String(datetime_to_dbus(self.created))
 
1144
    
 
1145
    # LastEnabled - property
 
1146
    @dbus_service_property(_interface, signature="s", access="read")
 
1147
    def LastEnabled_dbus_property(self):
 
1148
        return datetime_to_dbus(self.last_enabled)
 
1149
    
 
1150
    # Enabled - property
 
1151
    @dbus_service_property(_interface, signature="b",
 
1152
                           access="readwrite")
 
1153
    def Enabled_dbus_property(self, value=None):
881
1154
        if value is None:       # get
882
1155
            return dbus.Boolean(self.enabled)
883
1156
        if value:
885
1158
        else:
886
1159
            self.disable()
887
1160
    
888
 
    # last_checked_ok - property
889
 
    @dbus_service_property(_interface, signature=u"s",
890
 
                           access=u"readwrite")
891
 
    def last_checked_ok_dbus_property(self, value=None):
 
1161
    # LastCheckedOK - property
 
1162
    @dbus_service_property(_interface, signature="s",
 
1163
                           access="readwrite")
 
1164
    def LastCheckedOK_dbus_property(self, value=None):
892
1165
        if value is not None:
893
1166
            self.checked_ok()
894
1167
            return
895
 
        if self.last_checked_ok is None:
896
 
            return dbus.String(u"")
897
 
        return dbus.String(self._datetime_to_dbus(self
898
 
                                                  .last_checked_ok))
899
 
    
900
 
    # timeout - property
901
 
    @dbus_service_property(_interface, signature=u"t",
902
 
                           access=u"readwrite")
903
 
    def timeout_dbus_property(self, value=None):
 
1168
        return datetime_to_dbus(self.last_checked_ok)
 
1169
    
 
1170
    # Expires - property
 
1171
    @dbus_service_property(_interface, signature="s", access="read")
 
1172
    def Expires_dbus_property(self):
 
1173
        return datetime_to_dbus(self.expires)
 
1174
    
 
1175
    # LastApprovalRequest - property
 
1176
    @dbus_service_property(_interface, signature="s", access="read")
 
1177
    def LastApprovalRequest_dbus_property(self):
 
1178
        return datetime_to_dbus(self.last_approval_request)
 
1179
    
 
1180
    # Timeout - property
 
1181
    @dbus_service_property(_interface, signature="t",
 
1182
                           access="readwrite")
 
1183
    def Timeout_dbus_property(self, value=None):
904
1184
        if value is None:       # get
905
1185
            return dbus.UInt64(self.timeout_milliseconds())
906
1186
        self.timeout = datetime.timedelta(0, 0, 0, value)
907
 
        # Emit D-Bus signal
908
 
        self.PropertyChanged(dbus.String(u"timeout"),
909
 
                             dbus.UInt64(value, variant_level=1))
910
 
        if getattr(self, u"disable_initiator_tag", None) is None:
 
1187
        if getattr(self, "disable_initiator_tag", None) is None:
911
1188
            return
912
1189
        # Reschedule timeout
913
1190
        gobject.source_remove(self.disable_initiator_tag)
914
1191
        self.disable_initiator_tag = None
915
 
        time_to_die = (self.
916
 
                       _timedelta_to_milliseconds((self
917
 
                                                   .last_checked_ok
918
 
                                                   + self.timeout)
919
 
                                                  - datetime.datetime
920
 
                                                  .utcnow()))
 
1192
        self.expires = None
 
1193
        time_to_die = _timedelta_to_milliseconds((self
 
1194
                                                  .last_checked_ok
 
1195
                                                  + self.timeout)
 
1196
                                                 - datetime.datetime
 
1197
                                                 .utcnow())
921
1198
        if time_to_die <= 0:
922
1199
            # The timeout has passed
923
1200
            self.disable()
924
1201
        else:
 
1202
            self.expires = (datetime.datetime.utcnow()
 
1203
                            + datetime.timedelta(milliseconds =
 
1204
                                                 time_to_die))
925
1205
            self.disable_initiator_tag = (gobject.timeout_add
926
1206
                                          (time_to_die, self.disable))
927
1207
    
928
 
    # interval - property
929
 
    @dbus_service_property(_interface, signature=u"t",
930
 
                           access=u"readwrite")
931
 
    def interval_dbus_property(self, value=None):
 
1208
    # ExtendedTimeout - property
 
1209
    @dbus_service_property(_interface, signature="t",
 
1210
                           access="readwrite")
 
1211
    def ExtendedTimeout_dbus_property(self, value=None):
 
1212
        if value is None:       # get
 
1213
            return dbus.UInt64(self.extended_timeout_milliseconds())
 
1214
        self.extended_timeout = datetime.timedelta(0, 0, 0, value)
 
1215
    
 
1216
    # Interval - property
 
1217
    @dbus_service_property(_interface, signature="t",
 
1218
                           access="readwrite")
 
1219
    def Interval_dbus_property(self, value=None):
932
1220
        if value is None:       # get
933
1221
            return dbus.UInt64(self.interval_milliseconds())
934
1222
        self.interval = datetime.timedelta(0, 0, 0, value)
935
 
        # Emit D-Bus signal
936
 
        self.PropertyChanged(dbus.String(u"interval"),
937
 
                             dbus.UInt64(value, variant_level=1))
938
 
        if getattr(self, u"checker_initiator_tag", None) is None:
 
1223
        if getattr(self, "checker_initiator_tag", None) is None:
939
1224
            return
940
1225
        # Reschedule checker run
941
1226
        gobject.source_remove(self.checker_initiator_tag)
942
1227
        self.checker_initiator_tag = (gobject.timeout_add
943
1228
                                      (value, self.start_checker))
944
1229
        self.start_checker()    # Start one now, too
945
 
 
946
 
    # checker - property
947
 
    @dbus_service_property(_interface, signature=u"s",
948
 
                           access=u"readwrite")
949
 
    def checker_dbus_property(self, value=None):
 
1230
    
 
1231
    # Checker - property
 
1232
    @dbus_service_property(_interface, signature="s",
 
1233
                           access="readwrite")
 
1234
    def Checker_dbus_property(self, value=None):
950
1235
        if value is None:       # get
951
1236
            return dbus.String(self.checker_command)
952
1237
        self.checker_command = value
953
 
        # Emit D-Bus signal
954
 
        self.PropertyChanged(dbus.String(u"checker"),
955
 
                             dbus.String(self.checker_command,
956
 
                                         variant_level=1))
957
1238
    
958
 
    # checker_running - property
959
 
    @dbus_service_property(_interface, signature=u"b",
960
 
                           access=u"readwrite")
961
 
    def checker_running_dbus_property(self, value=None):
 
1239
    # CheckerRunning - property
 
1240
    @dbus_service_property(_interface, signature="b",
 
1241
                           access="readwrite")
 
1242
    def CheckerRunning_dbus_property(self, value=None):
962
1243
        if value is None:       # get
963
1244
            return dbus.Boolean(self.checker is not None)
964
1245
        if value:
966
1247
        else:
967
1248
            self.stop_checker()
968
1249
    
969
 
    # object_path - property
970
 
    @dbus_service_property(_interface, signature=u"o", access=u"read")
971
 
    def object_path_dbus_property(self):
 
1250
    # ObjectPath - property
 
1251
    @dbus_service_property(_interface, signature="o", access="read")
 
1252
    def ObjectPath_dbus_property(self):
972
1253
        return self.dbus_object_path # is already a dbus.ObjectPath
973
1254
    
974
 
    # secret = property
975
 
    @dbus_service_property(_interface, signature=u"ay",
976
 
                           access=u"write", byte_arrays=True)
977
 
    def secret_dbus_property(self, value):
 
1255
    # Secret = property
 
1256
    @dbus_service_property(_interface, signature="ay",
 
1257
                           access="write", byte_arrays=True)
 
1258
    def Secret_dbus_property(self, value):
978
1259
        self.secret = str(value)
979
1260
    
980
1261
    del _interface
981
1262
 
982
1263
 
 
1264
class ProxyClient(object):
 
1265
    def __init__(self, child_pipe, fpr, address):
 
1266
        self._pipe = child_pipe
 
1267
        self._pipe.send(('init', fpr, address))
 
1268
        if not self._pipe.recv():
 
1269
            raise KeyError()
 
1270
    
 
1271
    def __getattribute__(self, name):
 
1272
        if(name == '_pipe'):
 
1273
            return super(ProxyClient, self).__getattribute__(name)
 
1274
        self._pipe.send(('getattr', name))
 
1275
        data = self._pipe.recv()
 
1276
        if data[0] == 'data':
 
1277
            return data[1]
 
1278
        if data[0] == 'function':
 
1279
            def func(*args, **kwargs):
 
1280
                self._pipe.send(('funcall', name, args, kwargs))
 
1281
                return self._pipe.recv()[1]
 
1282
            return func
 
1283
    
 
1284
    def __setattr__(self, name, value):
 
1285
        if(name == '_pipe'):
 
1286
            return super(ProxyClient, self).__setattr__(name, value)
 
1287
        self._pipe.send(('setattr', name, value))
 
1288
 
 
1289
class ClientDBusTransitional(ClientDBus):
 
1290
    __metaclass__ = AlternateDBusNamesMetaclass
 
1291
 
983
1292
class ClientHandler(socketserver.BaseRequestHandler, object):
984
1293
    """A class to handle client connections.
985
1294
    
987
1296
    Note: This will run in its own forked process."""
988
1297
    
989
1298
    def handle(self):
990
 
        logger.info(u"TCP connection from: %s",
991
 
                    unicode(self.client_address))
992
 
        logger.debug(u"IPC Pipe FD: %d", self.server.child_pipe[1])
993
 
        # Open IPC pipe to parent process
994
 
        with contextlib.nested(os.fdopen(self.server.child_pipe[1],
995
 
                                         u"w", 1),
996
 
                               os.fdopen(self.server.parent_pipe[0],
997
 
                                         u"r", 0)) as (ipc,
998
 
                                                       ipc_return):
 
1299
        with contextlib.closing(self.server.child_pipe) as child_pipe:
 
1300
            logger.info("TCP connection from: %s",
 
1301
                        unicode(self.client_address))
 
1302
            logger.debug("Pipe FD: %d",
 
1303
                         self.server.child_pipe.fileno())
 
1304
            
999
1305
            session = (gnutls.connection
1000
1306
                       .ClientSession(self.request,
1001
1307
                                      gnutls.connection
1002
1308
                                      .X509Credentials()))
1003
1309
            
1004
 
            line = self.request.makefile().readline()
1005
 
            logger.debug(u"Protocol version: %r", line)
1006
 
            try:
1007
 
                if int(line.strip().split()[0]) > 1:
1008
 
                    raise RuntimeError
1009
 
            except (ValueError, IndexError, RuntimeError), error:
1010
 
                logger.error(u"Unknown protocol version: %s", error)
1011
 
                return
1012
 
            
1013
1310
            # Note: gnutls.connection.X509Credentials is really a
1014
1311
            # generic GnuTLS certificate credentials object so long as
1015
1312
            # no X.509 keys are added to it.  Therefore, we can use it
1016
1313
            # here despite using OpenPGP certificates.
1017
1314
            
1018
 
            #priority = u':'.join((u"NONE", u"+VERS-TLS1.1",
1019
 
            #                      u"+AES-256-CBC", u"+SHA1",
1020
 
            #                      u"+COMP-NULL", u"+CTYPE-OPENPGP",
1021
 
            #                      u"+DHE-DSS"))
 
1315
            #priority = ':'.join(("NONE", "+VERS-TLS1.1",
 
1316
            #                      "+AES-256-CBC", "+SHA1",
 
1317
            #                      "+COMP-NULL", "+CTYPE-OPENPGP",
 
1318
            #                      "+DHE-DSS"))
1022
1319
            # Use a fallback default, since this MUST be set.
1023
1320
            priority = self.server.gnutls_priority
1024
1321
            if priority is None:
1025
 
                priority = u"NORMAL"
 
1322
                priority = "NORMAL"
1026
1323
            (gnutls.library.functions
1027
1324
             .gnutls_priority_set_direct(session._c_object,
1028
1325
                                         priority, None))
1029
1326
            
 
1327
            # Start communication using the Mandos protocol
 
1328
            # Get protocol number
 
1329
            line = self.request.makefile().readline()
 
1330
            logger.debug("Protocol version: %r", line)
 
1331
            try:
 
1332
                if int(line.strip().split()[0]) > 1:
 
1333
                    raise RuntimeError
 
1334
            except (ValueError, IndexError, RuntimeError) as error:
 
1335
                logger.error("Unknown protocol version: %s", error)
 
1336
                return
 
1337
            
 
1338
            # Start GnuTLS connection
1030
1339
            try:
1031
1340
                session.handshake()
1032
 
            except gnutls.errors.GNUTLSError, error:
1033
 
                logger.warning(u"Handshake failed: %s", error)
 
1341
            except gnutls.errors.GNUTLSError as error:
 
1342
                logger.warning("Handshake failed: %s", error)
1034
1343
                # Do not run session.bye() here: the session is not
1035
1344
                # established.  Just abandon the request.
1036
1345
                return
1037
 
            logger.debug(u"Handshake succeeded")
 
1346
            logger.debug("Handshake succeeded")
 
1347
            
 
1348
            approval_required = False
1038
1349
            try:
1039
1350
                try:
1040
1351
                    fpr = self.fingerprint(self.peer_certificate
1041
1352
                                           (session))
1042
 
                except (TypeError, gnutls.errors.GNUTLSError), error:
1043
 
                    logger.warning(u"Bad certificate: %s", error)
1044
 
                    return
1045
 
                logger.debug(u"Fingerprint: %s", fpr)
1046
 
 
1047
 
                for c in self.server.clients:
1048
 
                    if c.fingerprint == fpr:
1049
 
                        client = c
 
1353
                except (TypeError,
 
1354
                        gnutls.errors.GNUTLSError) as error:
 
1355
                    logger.warning("Bad certificate: %s", error)
 
1356
                    return
 
1357
                logger.debug("Fingerprint: %s", fpr)
 
1358
                
 
1359
                try:
 
1360
                    client = ProxyClient(child_pipe, fpr,
 
1361
                                         self.client_address)
 
1362
                except KeyError:
 
1363
                    return
 
1364
                
 
1365
                if client.approval_delay:
 
1366
                    delay = client.approval_delay
 
1367
                    client.approvals_pending += 1
 
1368
                    approval_required = True
 
1369
                
 
1370
                while True:
 
1371
                    if not client.enabled:
 
1372
                        logger.info("Client %s is disabled",
 
1373
                                       client.name)
 
1374
                        if self.server.use_dbus:
 
1375
                            # Emit D-Bus signal
 
1376
                            client.Rejected("Disabled")
 
1377
                        return
 
1378
                    
 
1379
                    if client._approved or not client.approval_delay:
 
1380
                        #We are approved or approval is disabled
1050
1381
                        break
1051
 
                else:
1052
 
                    ipc.write(u"NOTFOUND %s %s\n"
1053
 
                              % (fpr, unicode(self.client_address)))
1054
 
                    return
1055
 
                # Have to check if client.enabled, since it is
1056
 
                # possible that the client was disabled since the
1057
 
                # GnuTLS session was established.
1058
 
                ipc.write(u"GETATTR enabled %s\n" % fpr)
1059
 
                enabled = pickle.load(ipc_return)
1060
 
                if not enabled:
1061
 
                    ipc.write(u"DISABLED %s\n" % client.name)
1062
 
                    return
1063
 
                ipc.write(u"SENDING %s\n" % client.name)
 
1382
                    elif client._approved is None:
 
1383
                        logger.info("Client %s needs approval",
 
1384
                                    client.name)
 
1385
                        if self.server.use_dbus:
 
1386
                            # Emit D-Bus signal
 
1387
                            client.NeedApproval(
 
1388
                                client.approval_delay_milliseconds(),
 
1389
                                client.approved_by_default)
 
1390
                    else:
 
1391
                        logger.warning("Client %s was not approved",
 
1392
                                       client.name)
 
1393
                        if self.server.use_dbus:
 
1394
                            # Emit D-Bus signal
 
1395
                            client.Rejected("Denied")
 
1396
                        return
 
1397
                    
 
1398
                    #wait until timeout or approved
 
1399
                    time = datetime.datetime.now()
 
1400
                    client.changedstate.acquire()
 
1401
                    (client.changedstate.wait
 
1402
                     (float(client._timedelta_to_milliseconds(delay)
 
1403
                            / 1000)))
 
1404
                    client.changedstate.release()
 
1405
                    time2 = datetime.datetime.now()
 
1406
                    if (time2 - time) >= delay:
 
1407
                        if not client.approved_by_default:
 
1408
                            logger.warning("Client %s timed out while"
 
1409
                                           " waiting for approval",
 
1410
                                           client.name)
 
1411
                            if self.server.use_dbus:
 
1412
                                # Emit D-Bus signal
 
1413
                                client.Rejected("Approval timed out")
 
1414
                            return
 
1415
                        else:
 
1416
                            break
 
1417
                    else:
 
1418
                        delay -= time2 - time
 
1419
                
1064
1420
                sent_size = 0
1065
1421
                while sent_size < len(client.secret):
1066
 
                    sent = session.send(client.secret[sent_size:])
1067
 
                    logger.debug(u"Sent: %d, remaining: %d",
 
1422
                    try:
 
1423
                        sent = session.send(client.secret[sent_size:])
 
1424
                    except gnutls.errors.GNUTLSError as error:
 
1425
                        logger.warning("gnutls send failed")
 
1426
                        return
 
1427
                    logger.debug("Sent: %d, remaining: %d",
1068
1428
                                 sent, len(client.secret)
1069
1429
                                 - (sent_size + sent))
1070
1430
                    sent_size += sent
 
1431
                
 
1432
                logger.info("Sending secret to %s", client.name)
 
1433
                # bump the timeout using extended_timeout
 
1434
                client.checked_ok(client.extended_timeout)
 
1435
                if self.server.use_dbus:
 
1436
                    # Emit D-Bus signal
 
1437
                    client.GotSecret()
 
1438
            
1071
1439
            finally:
1072
 
                session.bye()
 
1440
                if approval_required:
 
1441
                    client.approvals_pending -= 1
 
1442
                try:
 
1443
                    session.bye()
 
1444
                except gnutls.errors.GNUTLSError as error:
 
1445
                    logger.warning("GnuTLS bye failed")
1073
1446
    
1074
1447
    @staticmethod
1075
1448
    def peer_certificate(session):
1085
1458
                     .gnutls_certificate_get_peers
1086
1459
                     (session._c_object, ctypes.byref(list_size)))
1087
1460
        if not bool(cert_list) and list_size.value != 0:
1088
 
            raise gnutls.errors.GNUTLSError(u"error getting peer"
1089
 
                                            u" certificate")
 
1461
            raise gnutls.errors.GNUTLSError("error getting peer"
 
1462
                                            " certificate")
1090
1463
        if list_size.value == 0:
1091
1464
            return None
1092
1465
        cert = cert_list[0]
1118
1491
        if crtverify.value != 0:
1119
1492
            gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1120
1493
            raise (gnutls.errors.CertificateSecurityError
1121
 
                   (u"Verify failed"))
 
1494
                   ("Verify failed"))
1122
1495
        # New buffer for the fingerprint
1123
1496
        buf = ctypes.create_string_buffer(20)
1124
1497
        buf_len = ctypes.c_size_t()
1131
1504
        # Convert the buffer to a Python bytestring
1132
1505
        fpr = ctypes.string_at(buf, buf_len.value)
1133
1506
        # Convert the bytestring to hexadecimal notation
1134
 
        hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
 
1507
        hex_fpr = ''.join("%02X" % ord(char) for char in fpr)
1135
1508
        return hex_fpr
1136
1509
 
1137
1510
 
1138
 
class ForkingMixInWithPipes(socketserver.ForkingMixIn, object):
1139
 
    """Like socketserver.ForkingMixIn, but also pass a pipe pair."""
 
1511
class MultiprocessingMixIn(object):
 
1512
    """Like socketserver.ThreadingMixIn, but with multiprocessing"""
 
1513
    def sub_process_main(self, request, address):
 
1514
        try:
 
1515
            self.finish_request(request, address)
 
1516
        except:
 
1517
            self.handle_error(request, address)
 
1518
        self.close_request(request)
 
1519
    
 
1520
    def process_request(self, request, address):
 
1521
        """Start a new process to process the request."""
 
1522
        proc = multiprocessing.Process(target = self.sub_process_main,
 
1523
                                       args = (request,
 
1524
                                               address))
 
1525
        proc.start()
 
1526
        return proc
 
1527
 
 
1528
 
 
1529
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
 
1530
    """ adds a pipe to the MixIn """
1140
1531
    def process_request(self, request, client_address):
1141
1532
        """Overrides and wraps the original process_request().
1142
1533
        
1143
1534
        This function creates a new pipe in self.pipe
1144
1535
        """
1145
 
        self.child_pipe = os.pipe() # Child writes here
1146
 
        self.parent_pipe = os.pipe() # Parent writes here
1147
 
        super(ForkingMixInWithPipes,
1148
 
              self).process_request(request, client_address)
1149
 
        # Close unused ends for parent
1150
 
        os.close(self.parent_pipe[0]) # close read end
1151
 
        os.close(self.child_pipe[1])  # close write end
1152
 
        self.add_pipe_fds(self.child_pipe[0], self.parent_pipe[1])
1153
 
    def add_pipe_fds(self, child_pipe_fd, parent_pipe_fd):
 
1536
        parent_pipe, self.child_pipe = multiprocessing.Pipe()
 
1537
        
 
1538
        proc = MultiprocessingMixIn.process_request(self, request,
 
1539
                                                    client_address)
 
1540
        self.child_pipe.close()
 
1541
        self.add_pipe(parent_pipe, proc)
 
1542
    
 
1543
    def add_pipe(self, parent_pipe, proc):
1154
1544
        """Dummy function; override as necessary"""
1155
 
        os.close(child_pipe_fd)
1156
 
        os.close(parent_pipe_fd)
1157
 
 
1158
 
 
1159
 
class IPv6_TCPServer(ForkingMixInWithPipes,
 
1545
        raise NotImplementedError
 
1546
 
 
1547
 
 
1548
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
1160
1549
                     socketserver.TCPServer, object):
1161
1550
    """IPv6-capable TCP server.  Accepts 'None' as address and/or port
1162
1551
    
1178
1567
        bind to an address or port if they were not specified."""
1179
1568
        if self.interface is not None:
1180
1569
            if SO_BINDTODEVICE is None:
1181
 
                logger.error(u"SO_BINDTODEVICE does not exist;"
1182
 
                             u" cannot bind to interface %s",
 
1570
                logger.error("SO_BINDTODEVICE does not exist;"
 
1571
                             " cannot bind to interface %s",
1183
1572
                             self.interface)
1184
1573
            else:
1185
1574
                try:
1186
1575
                    self.socket.setsockopt(socket.SOL_SOCKET,
1187
1576
                                           SO_BINDTODEVICE,
1188
1577
                                           str(self.interface
1189
 
                                               + u'\0'))
1190
 
                except socket.error, error:
 
1578
                                               + '\0'))
 
1579
                except socket.error as error:
1191
1580
                    if error[0] == errno.EPERM:
1192
 
                        logger.error(u"No permission to"
1193
 
                                     u" bind to interface %s",
 
1581
                        logger.error("No permission to"
 
1582
                                     " bind to interface %s",
1194
1583
                                     self.interface)
1195
1584
                    elif error[0] == errno.ENOPROTOOPT:
1196
 
                        logger.error(u"SO_BINDTODEVICE not available;"
1197
 
                                     u" cannot bind to interface %s",
 
1585
                        logger.error("SO_BINDTODEVICE not available;"
 
1586
                                     " cannot bind to interface %s",
1198
1587
                                     self.interface)
1199
1588
                    else:
1200
1589
                        raise
1202
1591
        if self.server_address[0] or self.server_address[1]:
1203
1592
            if not self.server_address[0]:
1204
1593
                if self.address_family == socket.AF_INET6:
1205
 
                    any_address = u"::" # in6addr_any
 
1594
                    any_address = "::" # in6addr_any
1206
1595
                else:
1207
1596
                    any_address = socket.INADDR_ANY
1208
1597
                self.server_address = (any_address,
1245
1634
    def server_activate(self):
1246
1635
        if self.enabled:
1247
1636
            return socketserver.TCPServer.server_activate(self)
 
1637
    
1248
1638
    def enable(self):
1249
1639
        self.enabled = True
1250
 
    def add_pipe_fds(self, child_pipe_fd, parent_pipe_fd):
 
1640
    
 
1641
    def add_pipe(self, parent_pipe, proc):
1251
1642
        # Call "handle_ipc" for both data and EOF events
1252
 
        gobject.io_add_watch(child_pipe_fd,
 
1643
        gobject.io_add_watch(parent_pipe.fileno(),
1253
1644
                             gobject.IO_IN | gobject.IO_HUP,
1254
1645
                             functools.partial(self.handle_ipc,
1255
 
                                               reply_fd
1256
 
                                               =parent_pipe_fd))
1257
 
    def handle_ipc(self, source, condition, reply_fd=None,
1258
 
                   file_objects={}):
 
1646
                                               parent_pipe =
 
1647
                                               parent_pipe,
 
1648
                                               proc = proc))
 
1649
    
 
1650
    def handle_ipc(self, source, condition, parent_pipe=None,
 
1651
                   proc = None, client_object=None):
1259
1652
        condition_names = {
1260
 
            gobject.IO_IN: u"IN",   # There is data to read.
1261
 
            gobject.IO_OUT: u"OUT", # Data can be written (without
 
1653
            gobject.IO_IN: "IN",   # There is data to read.
 
1654
            gobject.IO_OUT: "OUT", # Data can be written (without
1262
1655
                                    # blocking).
1263
 
            gobject.IO_PRI: u"PRI", # There is urgent data to read.
1264
 
            gobject.IO_ERR: u"ERR", # Error condition.
1265
 
            gobject.IO_HUP: u"HUP"  # Hung up (the connection has been
 
1656
            gobject.IO_PRI: "PRI", # There is urgent data to read.
 
1657
            gobject.IO_ERR: "ERR", # Error condition.
 
1658
            gobject.IO_HUP: "HUP"  # Hung up (the connection has been
1266
1659
                                    # broken, usually for pipes and
1267
1660
                                    # sockets).
1268
1661
            }
1270
1663
                                       for cond, name in
1271
1664
                                       condition_names.iteritems()
1272
1665
                                       if cond & condition)
1273
 
        logger.debug(u"Handling IPC: FD = %d, condition = %s", source,
1274
 
                     conditions_string)
1275
 
        
1276
 
        # Turn the pipe file descriptors into Python file objects
1277
 
        if source not in file_objects:
1278
 
            file_objects[source] = os.fdopen(source, u"r", 1)
1279
 
        if reply_fd not in file_objects:
1280
 
            file_objects[reply_fd] = os.fdopen(reply_fd, u"w", 0)
1281
 
        
1282
 
        # Read a line from the file object
1283
 
        cmdline = file_objects[source].readline()
1284
 
        if not cmdline:             # Empty line means end of file
1285
 
            # close the IPC pipes
1286
 
            file_objects[source].close()
1287
 
            del file_objects[source]
1288
 
            file_objects[reply_fd].close()
1289
 
            del file_objects[reply_fd]
1290
 
            
1291
 
            # Stop calling this function
1292
 
            return False
1293
 
        
1294
 
        logger.debug(u"IPC command: %r", cmdline)
1295
 
        
1296
 
        # Parse and act on command
1297
 
        cmd, args = cmdline.rstrip(u"\r\n").split(None, 1)
1298
 
        
1299
 
        if cmd == u"NOTFOUND":
1300
 
            fpr, address = args.split(None, 1)
1301
 
            logger.warning(u"Client not found for fingerprint: %s, ad"
1302
 
                           u"dress: %s", fpr, address)
1303
 
            if self.use_dbus:
1304
 
                # Emit D-Bus signal
1305
 
                mandos_dbus_service.ClientNotFound(fpr, address)
1306
 
        elif cmd == u"DISABLED":
1307
 
            for client in self.clients:
1308
 
                if client.name == args:
1309
 
                    logger.warning(u"Client %s is disabled", args)
1310
 
                    if self.use_dbus:
1311
 
                        # Emit D-Bus signal
1312
 
                        client.Rejected()
1313
 
                    break
1314
 
            else:
1315
 
                logger.error(u"Unknown client %s is disabled", args)
1316
 
        elif cmd == u"SENDING":
1317
 
            for client in self.clients:
1318
 
                if client.name == args:
1319
 
                    logger.info(u"Sending secret to %s", client.name)
1320
 
                    client.checked_ok()
1321
 
                    if self.use_dbus:
1322
 
                        # Emit D-Bus signal
1323
 
                        client.GotSecret()
1324
 
                    break
1325
 
            else:
1326
 
                logger.error(u"Sending secret to unknown client %s",
1327
 
                             args)
1328
 
        elif cmd == u"GETATTR":
1329
 
            attr_name, fpr = args.split(None, 1)
1330
 
            for client in self.clients:
1331
 
                if client.fingerprint == fpr:
1332
 
                    attr_value = getattr(client, attr_name, None)
1333
 
                    logger.debug("IPC reply: %r", attr_value)
1334
 
                    pickle.dump(attr_value, file_objects[reply_fd])
1335
 
                    break
1336
 
            else:
1337
 
                logger.error(u"Client %s on address %s requesting "
1338
 
                             u"attribute %s not found", fpr, address,
1339
 
                             attr_name)
1340
 
                pickle.dump(None, file_objects[reply_fd])
1341
 
        else:
1342
 
            logger.error(u"Unknown IPC command: %r", cmdline)
1343
 
        
1344
 
        # Keep calling this function
 
1666
        # error, or the other end of multiprocessing.Pipe has closed
 
1667
        if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):
 
1668
            # Wait for other process to exit
 
1669
            proc.join()
 
1670
            return False
 
1671
        
 
1672
        # Read a request from the child
 
1673
        request = parent_pipe.recv()
 
1674
        command = request[0]
 
1675
        
 
1676
        if command == 'init':
 
1677
            fpr = request[1]
 
1678
            address = request[2]
 
1679
            
 
1680
            for c in self.clients:
 
1681
                if c.fingerprint == fpr:
 
1682
                    client = c
 
1683
                    break
 
1684
            else:
 
1685
                logger.info("Client not found for fingerprint: %s, ad"
 
1686
                            "dress: %s", fpr, address)
 
1687
                if self.use_dbus:
 
1688
                    # Emit D-Bus signal
 
1689
                    mandos_dbus_service.ClientNotFound(fpr,
 
1690
                                                       address[0])
 
1691
                parent_pipe.send(False)
 
1692
                return False
 
1693
            
 
1694
            gobject.io_add_watch(parent_pipe.fileno(),
 
1695
                                 gobject.IO_IN | gobject.IO_HUP,
 
1696
                                 functools.partial(self.handle_ipc,
 
1697
                                                   parent_pipe =
 
1698
                                                   parent_pipe,
 
1699
                                                   proc = proc,
 
1700
                                                   client_object =
 
1701
                                                   client))
 
1702
            parent_pipe.send(True)
 
1703
            # remove the old hook in favor of the new above hook on
 
1704
            # same fileno
 
1705
            return False
 
1706
        if command == 'funcall':
 
1707
            funcname = request[1]
 
1708
            args = request[2]
 
1709
            kwargs = request[3]
 
1710
            
 
1711
            parent_pipe.send(('data', getattr(client_object,
 
1712
                                              funcname)(*args,
 
1713
                                                         **kwargs)))
 
1714
        
 
1715
        if command == 'getattr':
 
1716
            attrname = request[1]
 
1717
            if callable(client_object.__getattribute__(attrname)):
 
1718
                parent_pipe.send(('function',))
 
1719
            else:
 
1720
                parent_pipe.send(('data', client_object
 
1721
                                  .__getattribute__(attrname)))
 
1722
        
 
1723
        if command == 'setattr':
 
1724
            attrname = request[1]
 
1725
            value = request[2]
 
1726
            setattr(client_object, attrname, value)
 
1727
        
1345
1728
        return True
1346
1729
 
1347
1730
 
1348
1731
def string_to_delta(interval):
1349
1732
    """Parse a string and return a datetime.timedelta
1350
1733
    
1351
 
    >>> string_to_delta(u'7d')
 
1734
    >>> string_to_delta('7d')
1352
1735
    datetime.timedelta(7)
1353
 
    >>> string_to_delta(u'60s')
 
1736
    >>> string_to_delta('60s')
1354
1737
    datetime.timedelta(0, 60)
1355
 
    >>> string_to_delta(u'60m')
 
1738
    >>> string_to_delta('60m')
1356
1739
    datetime.timedelta(0, 3600)
1357
 
    >>> string_to_delta(u'24h')
 
1740
    >>> string_to_delta('24h')
1358
1741
    datetime.timedelta(1)
1359
 
    >>> string_to_delta(u'1w')
 
1742
    >>> string_to_delta('1w')
1360
1743
    datetime.timedelta(7)
1361
 
    >>> string_to_delta(u'5m 30s')
 
1744
    >>> string_to_delta('5m 30s')
1362
1745
    datetime.timedelta(0, 330)
1363
1746
    """
1364
1747
    timevalue = datetime.timedelta(0)
1366
1749
        try:
1367
1750
            suffix = unicode(s[-1])
1368
1751
            value = int(s[:-1])
1369
 
            if suffix == u"d":
 
1752
            if suffix == "d":
1370
1753
                delta = datetime.timedelta(value)
1371
 
            elif suffix == u"s":
 
1754
            elif suffix == "s":
1372
1755
                delta = datetime.timedelta(0, value)
1373
 
            elif suffix == u"m":
 
1756
            elif suffix == "m":
1374
1757
                delta = datetime.timedelta(0, 0, 0, 0, value)
1375
 
            elif suffix == u"h":
 
1758
            elif suffix == "h":
1376
1759
                delta = datetime.timedelta(0, 0, 0, 0, 0, value)
1377
 
            elif suffix == u"w":
 
1760
            elif suffix == "w":
1378
1761
                delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
1379
1762
            else:
1380
 
                raise ValueError(u"Unknown suffix %r" % suffix)
1381
 
        except (ValueError, IndexError), e:
1382
 
            raise ValueError(e.message)
 
1763
                raise ValueError("Unknown suffix %r" % suffix)
 
1764
        except (ValueError, IndexError) as e:
 
1765
            raise ValueError(*(e.args))
1383
1766
        timevalue += delta
1384
1767
    return timevalue
1385
1768
 
1391
1774
    global if_nametoindex
1392
1775
    try:
1393
1776
        if_nametoindex = (ctypes.cdll.LoadLibrary
1394
 
                          (ctypes.util.find_library(u"c"))
 
1777
                          (ctypes.util.find_library("c"))
1395
1778
                          .if_nametoindex)
1396
1779
    except (OSError, AttributeError):
1397
 
        logger.warning(u"Doing if_nametoindex the hard way")
 
1780
        logger.warning("Doing if_nametoindex the hard way")
1398
1781
        def if_nametoindex(interface):
1399
1782
            "Get an interface index the hard way, i.e. using fcntl()"
1400
1783
            SIOCGIFINDEX = 0x8933  # From /usr/include/linux/sockios.h
1401
1784
            with contextlib.closing(socket.socket()) as s:
1402
1785
                ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
1403
 
                                    struct.pack(str(u"16s16x"),
 
1786
                                    struct.pack(str("16s16x"),
1404
1787
                                                interface))
1405
 
            interface_index = struct.unpack(str(u"I"),
 
1788
            interface_index = struct.unpack(str("I"),
1406
1789
                                            ifreq[16:20])[0]
1407
1790
            return interface_index
1408
1791
    return if_nametoindex(interface)
1416
1799
        sys.exit()
1417
1800
    os.setsid()
1418
1801
    if not nochdir:
1419
 
        os.chdir(u"/")
 
1802
        os.chdir("/")
1420
1803
    if os.fork():
1421
1804
        sys.exit()
1422
1805
    if not noclose:
1424
1807
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1425
1808
        if not stat.S_ISCHR(os.fstat(null).st_mode):
1426
1809
            raise OSError(errno.ENODEV,
1427
 
                          u"%s not a character device"
 
1810
                          "%s not a character device"
1428
1811
                          % os.path.devnull)
1429
1812
        os.dup2(null, sys.stdin.fileno())
1430
1813
        os.dup2(null, sys.stdout.fileno())
1438
1821
    ##################################################################
1439
1822
    # Parsing of options, both command line and config file
1440
1823
    
1441
 
    parser = optparse.OptionParser(version = "%%prog %s" % version)
1442
 
    parser.add_option("-i", u"--interface", type=u"string",
1443
 
                      metavar="IF", help=u"Bind to interface IF")
1444
 
    parser.add_option("-a", u"--address", type=u"string",
1445
 
                      help=u"Address to listen for requests on")
1446
 
    parser.add_option("-p", u"--port", type=u"int",
1447
 
                      help=u"Port number to receive requests on")
1448
 
    parser.add_option("--check", action=u"store_true",
1449
 
                      help=u"Run self-test")
1450
 
    parser.add_option("--debug", action=u"store_true",
1451
 
                      help=u"Debug mode; run in foreground and log to"
1452
 
                      u" terminal")
1453
 
    parser.add_option("--priority", type=u"string", help=u"GnuTLS"
1454
 
                      u" priority string (see GnuTLS documentation)")
1455
 
    parser.add_option("--servicename", type=u"string",
1456
 
                      metavar=u"NAME", help=u"Zeroconf service name")
1457
 
    parser.add_option("--configdir", type=u"string",
1458
 
                      default=u"/etc/mandos", metavar=u"DIR",
1459
 
                      help=u"Directory to search for configuration"
1460
 
                      u" files")
1461
 
    parser.add_option("--no-dbus", action=u"store_false",
1462
 
                      dest=u"use_dbus", help=u"Do not provide D-Bus"
1463
 
                      u" system bus interface")
1464
 
    parser.add_option("--no-ipv6", action=u"store_false",
1465
 
                      dest=u"use_ipv6", help=u"Do not use IPv6")
1466
 
    options = parser.parse_args()[0]
 
1824
    parser = argparse.ArgumentParser()
 
1825
    parser.add_argument("-v", "--version", action="version",
 
1826
                        version = "%%(prog)s %s" % version,
 
1827
                        help="show version number and exit")
 
1828
    parser.add_argument("-i", "--interface", metavar="IF",
 
1829
                        help="Bind to interface IF")
 
1830
    parser.add_argument("-a", "--address",
 
1831
                        help="Address to listen for requests on")
 
1832
    parser.add_argument("-p", "--port", type=int,
 
1833
                        help="Port number to receive requests on")
 
1834
    parser.add_argument("--check", action="store_true",
 
1835
                        help="Run self-test")
 
1836
    parser.add_argument("--debug", action="store_true",
 
1837
                        help="Debug mode; run in foreground and log"
 
1838
                        " to terminal")
 
1839
    parser.add_argument("--debuglevel", metavar="LEVEL",
 
1840
                        help="Debug level for stdout output")
 
1841
    parser.add_argument("--priority", help="GnuTLS"
 
1842
                        " priority string (see GnuTLS documentation)")
 
1843
    parser.add_argument("--servicename",
 
1844
                        metavar="NAME", help="Zeroconf service name")
 
1845
    parser.add_argument("--configdir",
 
1846
                        default="/etc/mandos", metavar="DIR",
 
1847
                        help="Directory to search for configuration"
 
1848
                        " files")
 
1849
    parser.add_argument("--no-dbus", action="store_false",
 
1850
                        dest="use_dbus", help="Do not provide D-Bus"
 
1851
                        " system bus interface")
 
1852
    parser.add_argument("--no-ipv6", action="store_false",
 
1853
                        dest="use_ipv6", help="Do not use IPv6")
 
1854
    options = parser.parse_args()
1467
1855
    
1468
1856
    if options.check:
1469
1857
        import doctest
1471
1859
        sys.exit()
1472
1860
    
1473
1861
    # Default values for config file for server-global settings
1474
 
    server_defaults = { u"interface": u"",
1475
 
                        u"address": u"",
1476
 
                        u"port": u"",
1477
 
                        u"debug": u"False",
1478
 
                        u"priority":
1479
 
                        u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
1480
 
                        u"servicename": u"Mandos",
1481
 
                        u"use_dbus": u"True",
1482
 
                        u"use_ipv6": u"True",
 
1862
    server_defaults = { "interface": "",
 
1863
                        "address": "",
 
1864
                        "port": "",
 
1865
                        "debug": "False",
 
1866
                        "priority":
 
1867
                        "SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
 
1868
                        "servicename": "Mandos",
 
1869
                        "use_dbus": "True",
 
1870
                        "use_ipv6": "True",
 
1871
                        "debuglevel": "",
1483
1872
                        }
1484
1873
    
1485
1874
    # Parse config file for server-global settings
1486
1875
    server_config = configparser.SafeConfigParser(server_defaults)
1487
1876
    del server_defaults
1488
1877
    server_config.read(os.path.join(options.configdir,
1489
 
                                    u"mandos.conf"))
 
1878
                                    "mandos.conf"))
1490
1879
    # Convert the SafeConfigParser object to a dict
1491
1880
    server_settings = server_config.defaults()
1492
1881
    # Use the appropriate methods on the non-string config options
1493
 
    for option in (u"debug", u"use_dbus", u"use_ipv6"):
1494
 
        server_settings[option] = server_config.getboolean(u"DEFAULT",
 
1882
    for option in ("debug", "use_dbus", "use_ipv6"):
 
1883
        server_settings[option] = server_config.getboolean("DEFAULT",
1495
1884
                                                           option)
1496
1885
    if server_settings["port"]:
1497
 
        server_settings["port"] = server_config.getint(u"DEFAULT",
1498
 
                                                       u"port")
 
1886
        server_settings["port"] = server_config.getint("DEFAULT",
 
1887
                                                       "port")
1499
1888
    del server_config
1500
1889
    
1501
1890
    # Override the settings from the config file with command line
1502
1891
    # options, if set.
1503
 
    for option in (u"interface", u"address", u"port", u"debug",
1504
 
                   u"priority", u"servicename", u"configdir",
1505
 
                   u"use_dbus", u"use_ipv6"):
 
1892
    for option in ("interface", "address", "port", "debug",
 
1893
                   "priority", "servicename", "configdir",
 
1894
                   "use_dbus", "use_ipv6", "debuglevel"):
1506
1895
        value = getattr(options, option)
1507
1896
        if value is not None:
1508
1897
            server_settings[option] = value
1516
1905
    ##################################################################
1517
1906
    
1518
1907
    # For convenience
1519
 
    debug = server_settings[u"debug"]
1520
 
    use_dbus = server_settings[u"use_dbus"]
1521
 
    use_ipv6 = server_settings[u"use_ipv6"]
1522
 
    
1523
 
    if not debug:
1524
 
        syslogger.setLevel(logging.WARNING)
1525
 
        console.setLevel(logging.WARNING)
1526
 
    
1527
 
    if server_settings[u"servicename"] != u"Mandos":
 
1908
    debug = server_settings["debug"]
 
1909
    debuglevel = server_settings["debuglevel"]
 
1910
    use_dbus = server_settings["use_dbus"]
 
1911
    use_ipv6 = server_settings["use_ipv6"]
 
1912
    
 
1913
    if server_settings["servicename"] != "Mandos":
1528
1914
        syslogger.setFormatter(logging.Formatter
1529
 
                               (u'Mandos (%s) [%%(process)d]:'
1530
 
                                u' %%(levelname)s: %%(message)s'
1531
 
                                % server_settings[u"servicename"]))
 
1915
                               ('Mandos (%s) [%%(process)d]:'
 
1916
                                ' %%(levelname)s: %%(message)s'
 
1917
                                % server_settings["servicename"]))
1532
1918
    
1533
1919
    # Parse config file with clients
1534
 
    client_defaults = { u"timeout": u"1h",
1535
 
                        u"interval": u"5m",
1536
 
                        u"checker": u"fping -q -- %%(host)s",
1537
 
                        u"host": u"",
 
1920
    client_defaults = { "timeout": "5m",
 
1921
                        "extended_timeout": "15m",
 
1922
                        "interval": "2m",
 
1923
                        "checker": "fping -q -- %%(host)s",
 
1924
                        "host": "",
 
1925
                        "approval_delay": "0s",
 
1926
                        "approval_duration": "1s",
1538
1927
                        }
1539
1928
    client_config = configparser.SafeConfigParser(client_defaults)
1540
 
    client_config.read(os.path.join(server_settings[u"configdir"],
1541
 
                                    u"clients.conf"))
 
1929
    client_config.read(os.path.join(server_settings["configdir"],
 
1930
                                    "clients.conf"))
1542
1931
    
1543
1932
    global mandos_dbus_service
1544
1933
    mandos_dbus_service = None
1545
1934
    
1546
 
    tcp_server = MandosServer((server_settings[u"address"],
1547
 
                               server_settings[u"port"]),
 
1935
    tcp_server = MandosServer((server_settings["address"],
 
1936
                               server_settings["port"]),
1548
1937
                              ClientHandler,
1549
 
                              interface=server_settings[u"interface"],
 
1938
                              interface=(server_settings["interface"]
 
1939
                                         or None),
1550
1940
                              use_ipv6=use_ipv6,
1551
1941
                              gnutls_priority=
1552
 
                              server_settings[u"priority"],
 
1942
                              server_settings["priority"],
1553
1943
                              use_dbus=use_dbus)
1554
 
    pidfilename = u"/var/run/mandos.pid"
1555
 
    try:
1556
 
        pidfile = open(pidfilename, u"w")
1557
 
    except IOError:
1558
 
        logger.error(u"Could not open file %r", pidfilename)
 
1944
    if not debug:
 
1945
        pidfilename = "/var/run/mandos.pid"
 
1946
        try:
 
1947
            pidfile = open(pidfilename, "w")
 
1948
        except IOError:
 
1949
            logger.error("Could not open file %r", pidfilename)
1559
1950
    
1560
1951
    try:
1561
 
        uid = pwd.getpwnam(u"_mandos").pw_uid
1562
 
        gid = pwd.getpwnam(u"_mandos").pw_gid
 
1952
        uid = pwd.getpwnam("_mandos").pw_uid
 
1953
        gid = pwd.getpwnam("_mandos").pw_gid
1563
1954
    except KeyError:
1564
1955
        try:
1565
 
            uid = pwd.getpwnam(u"mandos").pw_uid
1566
 
            gid = pwd.getpwnam(u"mandos").pw_gid
 
1956
            uid = pwd.getpwnam("mandos").pw_uid
 
1957
            gid = pwd.getpwnam("mandos").pw_gid
1567
1958
        except KeyError:
1568
1959
            try:
1569
 
                uid = pwd.getpwnam(u"nobody").pw_uid
1570
 
                gid = pwd.getpwnam(u"nobody").pw_gid
 
1960
                uid = pwd.getpwnam("nobody").pw_uid
 
1961
                gid = pwd.getpwnam("nobody").pw_gid
1571
1962
            except KeyError:
1572
1963
                uid = 65534
1573
1964
                gid = 65534
1574
1965
    try:
1575
1966
        os.setgid(gid)
1576
1967
        os.setuid(uid)
1577
 
    except OSError, error:
 
1968
    except OSError as error:
1578
1969
        if error[0] != errno.EPERM:
1579
1970
            raise error
1580
1971
    
1581
 
    # Enable all possible GnuTLS debugging
 
1972
    if not debug and not debuglevel:
 
1973
        syslogger.setLevel(logging.WARNING)
 
1974
        console.setLevel(logging.WARNING)
 
1975
    if debuglevel:
 
1976
        level = getattr(logging, debuglevel.upper())
 
1977
        syslogger.setLevel(level)
 
1978
        console.setLevel(level)
 
1979
    
1582
1980
    if debug:
 
1981
        # Enable all possible GnuTLS debugging
 
1982
        
1583
1983
        # "Use a log level over 10 to enable all debugging options."
1584
1984
        # - GnuTLS manual
1585
1985
        gnutls.library.functions.gnutls_global_set_log_level(11)
1586
1986
        
1587
1987
        @gnutls.library.types.gnutls_log_func
1588
1988
        def debug_gnutls(level, string):
1589
 
            logger.debug(u"GnuTLS: %s", string[:-1])
 
1989
            logger.debug("GnuTLS: %s", string[:-1])
1590
1990
        
1591
1991
        (gnutls.library.functions
1592
1992
         .gnutls_global_set_log_function(debug_gnutls))
 
1993
        
 
1994
        # Redirect stdin so all checkers get /dev/null
 
1995
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
 
1996
        os.dup2(null, sys.stdin.fileno())
 
1997
        if null > 2:
 
1998
            os.close(null)
 
1999
    else:
 
2000
        # No console logging
 
2001
        logger.removeHandler(console)
 
2002
    
 
2003
    # Need to fork before connecting to D-Bus
 
2004
    if not debug:
 
2005
        # Close all input and output, do double fork, etc.
 
2006
        daemon()
1593
2007
    
1594
2008
    global main_loop
1595
2009
    # From the Avahi example code
1599
2013
    # End of Avahi example code
1600
2014
    if use_dbus:
1601
2015
        try:
1602
 
            bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos",
 
2016
            bus_name = dbus.service.BusName("se.recompile.Mandos",
1603
2017
                                            bus, do_not_queue=True)
1604
 
        except dbus.exceptions.NameExistsException, e:
1605
 
            logger.error(unicode(e) + u", disabling D-Bus")
 
2018
            old_bus_name = (dbus.service.BusName
 
2019
                            ("se.bsnet.fukt.Mandos", bus,
 
2020
                             do_not_queue=True))
 
2021
        except dbus.exceptions.NameExistsException as e:
 
2022
            logger.error(unicode(e) + ", disabling D-Bus")
1606
2023
            use_dbus = False
1607
 
            server_settings[u"use_dbus"] = False
 
2024
            server_settings["use_dbus"] = False
1608
2025
            tcp_server.use_dbus = False
1609
2026
    protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
1610
 
    service = AvahiService(name = server_settings[u"servicename"],
1611
 
                           servicetype = u"_mandos._tcp",
 
2027
    service = AvahiService(name = server_settings["servicename"],
 
2028
                           servicetype = "_mandos._tcp",
1612
2029
                           protocol = protocol, bus = bus)
1613
2030
    if server_settings["interface"]:
1614
2031
        service.interface = (if_nametoindex
1615
 
                             (str(server_settings[u"interface"])))
 
2032
                             (str(server_settings["interface"])))
 
2033
    
 
2034
    global multiprocessing_manager
 
2035
    multiprocessing_manager = multiprocessing.Manager()
1616
2036
    
1617
2037
    client_class = Client
1618
2038
    if use_dbus:
1619
 
        client_class = functools.partial(ClientDBus, bus = bus)
 
2039
        client_class = functools.partial(ClientDBusTransitional,
 
2040
                                         bus = bus)
 
2041
    def client_config_items(config, section):
 
2042
        special_settings = {
 
2043
            "approved_by_default":
 
2044
                lambda: config.getboolean(section,
 
2045
                                          "approved_by_default"),
 
2046
            }
 
2047
        for name, value in config.items(section):
 
2048
            try:
 
2049
                yield (name, special_settings[name]())
 
2050
            except KeyError:
 
2051
                yield (name, value)
 
2052
    
1620
2053
    tcp_server.clients.update(set(
1621
2054
            client_class(name = section,
1622
 
                         config= dict(client_config.items(section)))
 
2055
                         config= dict(client_config_items(
 
2056
                        client_config, section)))
1623
2057
            for section in client_config.sections()))
1624
2058
    if not tcp_server.clients:
1625
 
        logger.warning(u"No clients defined")
1626
 
    
1627
 
    if debug:
1628
 
        # Redirect stdin so all checkers get /dev/null
1629
 
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1630
 
        os.dup2(null, sys.stdin.fileno())
1631
 
        if null > 2:
1632
 
            os.close(null)
1633
 
    else:
1634
 
        # No console logging
1635
 
        logger.removeHandler(console)
1636
 
        # Close all input and output, do double fork, etc.
1637
 
        daemon()
1638
 
    
1639
 
    try:
1640
 
        with pidfile:
1641
 
            pid = os.getpid()
1642
 
            pidfile.write(str(pid) + "\n")
1643
 
        del pidfile
1644
 
    except IOError:
1645
 
        logger.error(u"Could not write to file %r with PID %d",
1646
 
                     pidfilename, pid)
1647
 
    except NameError:
1648
 
        # "pidfile" was never created
1649
 
        pass
1650
 
    del pidfilename
1651
 
    
 
2059
        logger.warning("No clients defined")
 
2060
        
1652
2061
    if not debug:
 
2062
        try:
 
2063
            with pidfile:
 
2064
                pid = os.getpid()
 
2065
                pidfile.write(str(pid) + "\n".encode("utf-8"))
 
2066
            del pidfile
 
2067
        except IOError:
 
2068
            logger.error("Could not write to file %r with PID %d",
 
2069
                         pidfilename, pid)
 
2070
        except NameError:
 
2071
            # "pidfile" was never created
 
2072
            pass
 
2073
        del pidfilename
 
2074
        
1653
2075
        signal.signal(signal.SIGINT, signal.SIG_IGN)
 
2076
    
1654
2077
    signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
1655
2078
    signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
1656
2079
    
1658
2081
        class MandosDBusService(dbus.service.Object):
1659
2082
            """A D-Bus proxy object"""
1660
2083
            def __init__(self):
1661
 
                dbus.service.Object.__init__(self, bus, u"/")
1662
 
            _interface = u"se.bsnet.fukt.Mandos"
 
2084
                dbus.service.Object.__init__(self, bus, "/")
 
2085
            _interface = "se.recompile.Mandos"
1663
2086
            
1664
 
            @dbus.service.signal(_interface, signature=u"o")
 
2087
            @dbus.service.signal(_interface, signature="o")
1665
2088
            def ClientAdded(self, objpath):
1666
2089
                "D-Bus signal"
1667
2090
                pass
1668
2091
            
1669
 
            @dbus.service.signal(_interface, signature=u"ss")
 
2092
            @dbus.service.signal(_interface, signature="ss")
1670
2093
            def ClientNotFound(self, fingerprint, address):
1671
2094
                "D-Bus signal"
1672
2095
                pass
1673
2096
            
1674
 
            @dbus.service.signal(_interface, signature=u"os")
 
2097
            @dbus.service.signal(_interface, signature="os")
1675
2098
            def ClientRemoved(self, objpath, name):
1676
2099
                "D-Bus signal"
1677
2100
                pass
1678
2101
            
1679
 
            @dbus.service.method(_interface, out_signature=u"ao")
 
2102
            @dbus.service.method(_interface, out_signature="ao")
1680
2103
            def GetAllClients(self):
1681
2104
                "D-Bus method"
1682
2105
                return dbus.Array(c.dbus_object_path
1683
2106
                                  for c in tcp_server.clients)
1684
2107
            
1685
2108
            @dbus.service.method(_interface,
1686
 
                                 out_signature=u"a{oa{sv}}")
 
2109
                                 out_signature="a{oa{sv}}")
1687
2110
            def GetAllClientsWithProperties(self):
1688
2111
                "D-Bus method"
1689
2112
                return dbus.Dictionary(
1690
 
                    ((c.dbus_object_path, c.GetAll(u""))
 
2113
                    ((c.dbus_object_path, c.GetAll(""))
1691
2114
                     for c in tcp_server.clients),
1692
 
                    signature=u"oa{sv}")
 
2115
                    signature="oa{sv}")
1693
2116
            
1694
 
            @dbus.service.method(_interface, in_signature=u"o")
 
2117
            @dbus.service.method(_interface, in_signature="o")
1695
2118
            def RemoveClient(self, object_path):
1696
2119
                "D-Bus method"
1697
2120
                for c in tcp_server.clients:
1707
2130
            
1708
2131
            del _interface
1709
2132
        
1710
 
        mandos_dbus_service = MandosDBusService()
 
2133
        class MandosDBusServiceTransitional(MandosDBusService):
 
2134
            __metaclass__ = AlternateDBusNamesMetaclass
 
2135
        mandos_dbus_service = MandosDBusServiceTransitional()
1711
2136
    
1712
2137
    def cleanup():
1713
2138
        "Cleanup function; run on exit"
1714
2139
        service.cleanup()
1715
2140
        
 
2141
        multiprocessing.active_children()
1716
2142
        while tcp_server.clients:
1717
2143
            client = tcp_server.clients.pop()
1718
2144
            if use_dbus:
1722
2148
            client.disable(quiet=True)
1723
2149
            if use_dbus:
1724
2150
                # Emit D-Bus signal
1725
 
                mandos_dbus_service.ClientRemoved(client.dbus_object_path,
 
2151
                mandos_dbus_service.ClientRemoved(client
 
2152
                                                  .dbus_object_path,
1726
2153
                                                  client.name)
1727
2154
    
1728
2155
    atexit.register(cleanup)
1739
2166
    # Find out what port we got
1740
2167
    service.port = tcp_server.socket.getsockname()[1]
1741
2168
    if use_ipv6:
1742
 
        logger.info(u"Now listening on address %r, port %d,"
 
2169
        logger.info("Now listening on address %r, port %d,"
1743
2170
                    " flowinfo %d, scope_id %d"
1744
2171
                    % tcp_server.socket.getsockname())
1745
2172
    else:                       # IPv4
1746
 
        logger.info(u"Now listening on address %r, port %d"
 
2173
        logger.info("Now listening on address %r, port %d"
1747
2174
                    % tcp_server.socket.getsockname())
1748
2175
    
1749
2176
    #service.interface = tcp_server.socket.getsockname()[3]
1752
2179
        # From the Avahi example code
1753
2180
        try:
1754
2181
            service.activate()
1755
 
        except dbus.exceptions.DBusException, error:
1756
 
            logger.critical(u"DBusException: %s", error)
 
2182
        except dbus.exceptions.DBusException as error:
 
2183
            logger.critical("DBusException: %s", error)
1757
2184
            cleanup()
1758
2185
            sys.exit(1)
1759
2186
        # End of Avahi example code
1763
2190
                             (tcp_server.handle_request
1764
2191
                              (*args[2:], **kwargs) or True))
1765
2192
        
1766
 
        logger.debug(u"Starting main loop")
 
2193
        logger.debug("Starting main loop")
1767
2194
        main_loop.run()
1768
 
    except AvahiError, error:
1769
 
        logger.critical(u"AvahiError: %s", error)
 
2195
    except AvahiError as error:
 
2196
        logger.critical("AvahiError: %s", error)
1770
2197
        cleanup()
1771
2198
        sys.exit(1)
1772
2199
    except KeyboardInterrupt:
1773
2200
        if debug:
1774
 
            print >> sys.stderr
1775
 
        logger.debug(u"Server received KeyboardInterrupt")
1776
 
    logger.debug(u"Server exiting")
 
2201
            print("", file=sys.stderr)
 
2202
        logger.debug("Server received KeyboardInterrupt")
 
2203
    logger.debug("Server exiting")
1777
2204
    # Must run before the D-Bus bus name gets deregistered
1778
2205
    cleanup()
1779
2206
 
 
2207
 
1780
2208
if __name__ == '__main__':
1781
2209
    main()