/mandos/release

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/release

« back to all changes in this revision

Viewing changes to mandos

  • Committer: Teddy Hogeborn
  • Date: 2012-01-08 10:19:33 UTC
  • Revision ID: teddy@recompile.se-20120108101933-xbtodqgepxax8hn1
Tags: version-1.5.2-1
* Makefile (version): Changed to "1.5.2".
* NEWS (Version 1.5.2): New entry.
* debian/changelog (1.5.2-1): - '' -

Show diffs side-by-side

added added

removed removed

Lines of Context:
mandos
1
 
#!/usr/bin/python2.7
 
1
#!/usr/bin/python
2
2
# -*- mode: python; coding: utf-8 -*-
3
3
# 
4
4
# Mandos server - give out binary blobs to connecting clients.
11
11
# "AvahiService" class, and some lines in "main".
12
12
# 
13
13
# Everything else is
14
 
# Copyright © 2008-2015 Teddy Hogeborn
15
 
# Copyright © 2008-2015 Björn Påhlsson
 
14
# Copyright © 2008-2012 Teddy Hogeborn
 
15
# Copyright © 2008-2012 Björn Påhlsson
16
16
# 
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
34
34
from __future__ import (division, absolute_import, print_function,
35
35
                        unicode_literals)
36
36
 
37
 
from future_builtins import *
38
 
 
39
 
try:
40
 
    import SocketServer as socketserver
41
 
except ImportError:
42
 
    import socketserver
 
37
import SocketServer as socketserver
43
38
import socket
44
39
import argparse
45
40
import datetime
46
41
import errno
47
 
try:
48
 
    import ConfigParser as configparser
49
 
except ImportError:
50
 
    import configparser
 
42
import gnutls.crypto
 
43
import gnutls.connection
 
44
import gnutls.errors
 
45
import gnutls.library.functions
 
46
import gnutls.library.constants
 
47
import gnutls.library.types
 
48
import ConfigParser as configparser
51
49
import sys
52
50
import re
53
51
import os
62
60
import struct
63
61
import fcntl
64
62
import functools
65
 
try:
66
 
    import cPickle as pickle
67
 
except ImportError:
68
 
    import pickle
 
63
import cPickle as pickle
69
64
import multiprocessing
70
65
import types
71
66
import binascii
72
67
import tempfile
73
 
import itertools
74
 
import collections
75
 
import codecs
76
68
 
77
69
import dbus
78
70
import dbus.service
79
 
try:
80
 
    import gobject
81
 
except ImportError:
82
 
    from gi.repository import GObject as gobject
 
71
import gobject
83
72
import avahi
84
73
from dbus.mainloop.glib import DBusGMainLoop
85
74
import ctypes
86
75
import ctypes.util
87
76
import xml.dom.minidom
88
77
import inspect
 
78
import GnuPGInterface
89
79
 
90
80
try:
91
81
    SO_BINDTODEVICE = socket.SO_BINDTODEVICE
95
85
    except ImportError:
96
86
        SO_BINDTODEVICE = None
97
87
 
98
 
if sys.version_info.major == 2:
99
 
    str = unicode
100
 
 
101
 
version = "1.7.1"
 
88
version = "1.5.2"
102
89
stored_state_file = "clients.pickle"
103
90
 
104
91
logger = logging.getLogger()
105
 
syslogger = None
 
92
syslogger = (logging.handlers.SysLogHandler
 
93
             (facility = logging.handlers.SysLogHandler.LOG_DAEMON,
 
94
              address = str("/dev/log")))
106
95
 
107
96
try:
108
 
    if_nametoindex = ctypes.cdll.LoadLibrary(
109
 
        ctypes.util.find_library("c")).if_nametoindex
 
97
    if_nametoindex = (ctypes.cdll.LoadLibrary
 
98
                      (ctypes.util.find_library("c"))
 
99
                      .if_nametoindex)
110
100
except (OSError, AttributeError):
111
 
    
112
101
    def if_nametoindex(interface):
113
102
        "Get an interface index the hard way, i.e. using fcntl()"
114
103
        SIOCGIFINDEX = 0x8933  # From /usr/include/linux/sockios.h
115
104
        with contextlib.closing(socket.socket()) as s:
116
105
            ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
117
 
                                struct.pack(b"16s16x", interface))
118
 
        interface_index = struct.unpack("I", ifreq[16:20])[0]
 
106
                                struct.pack(str("16s16x"),
 
107
                                            interface))
 
108
        interface_index = struct.unpack(str("I"),
 
109
                                        ifreq[16:20])[0]
119
110
        return interface_index
120
111
 
121
112
 
122
113
def initlogger(debug, level=logging.WARNING):
123
114
    """init logger and add loglevel"""
124
115
    
125
 
    global syslogger
126
 
    syslogger = (logging.handlers.SysLogHandler(
127
 
        facility = logging.handlers.SysLogHandler.LOG_DAEMON,
128
 
        address = "/dev/log"))
129
116
    syslogger.setFormatter(logging.Formatter
130
117
                           ('Mandos [%(process)d]: %(levelname)s:'
131
118
                            ' %(message)s'))
148
135
 
149
136
class PGPEngine(object):
150
137
    """A simple class for OpenPGP symmetric encryption & decryption"""
151
 
    
152
138
    def __init__(self):
 
139
        self.gnupg = GnuPGInterface.GnuPG()
153
140
        self.tempdir = tempfile.mkdtemp(prefix="mandos-")
154
 
        self.gnupgargs = ['--batch',
155
 
                          '--home', self.tempdir,
156
 
                          '--force-mdc',
157
 
                          '--quiet',
158
 
                          '--no-use-agent']
 
141
        self.gnupg = GnuPGInterface.GnuPG()
 
142
        self.gnupg.options.meta_interactive = False
 
143
        self.gnupg.options.homedir = self.tempdir
 
144
        self.gnupg.options.extra_args.extend(['--force-mdc',
 
145
                                              '--quiet',
 
146
                                              '--no-use-agent'])
159
147
    
160
148
    def __enter__(self):
161
149
        return self
162
150
    
163
 
    def __exit__(self, exc_type, exc_value, traceback):
 
151
    def __exit__ (self, exc_type, exc_value, traceback):
164
152
        self._cleanup()
165
153
        return False
166
154
    
183
171
    def password_encode(self, password):
184
172
        # Passphrase can not be empty and can not contain newlines or
185
173
        # NUL bytes.  So we prefix it and hex encode it.
186
 
        encoded = b"mandos" + binascii.hexlify(password)
187
 
        if len(encoded) > 2048:
188
 
            # GnuPG can't handle long passwords, so encode differently
189
 
            encoded = (b"mandos" + password.replace(b"\\", b"\\\\")
190
 
                       .replace(b"\n", b"\\n")
191
 
                       .replace(b"\0", b"\\x00"))
192
 
        return encoded
 
174
        return b"mandos" + binascii.hexlify(password)
193
175
    
194
176
    def encrypt(self, data, password):
195
 
        passphrase = self.password_encode(password)
196
 
        with tempfile.NamedTemporaryFile(
197
 
                dir=self.tempdir) as passfile:
198
 
            passfile.write(passphrase)
199
 
            passfile.flush()
200
 
            proc = subprocess.Popen(['gpg', '--symmetric',
201
 
                                     '--passphrase-file',
202
 
                                     passfile.name]
203
 
                                    + self.gnupgargs,
204
 
                                    stdin = subprocess.PIPE,
205
 
                                    stdout = subprocess.PIPE,
206
 
                                    stderr = subprocess.PIPE)
207
 
            ciphertext, err = proc.communicate(input = data)
208
 
        if proc.returncode != 0:
209
 
            raise PGPError(err)
 
177
        self.gnupg.passphrase = self.password_encode(password)
 
178
        with open(os.devnull) as devnull:
 
179
            try:
 
180
                proc = self.gnupg.run(['--symmetric'],
 
181
                                      create_fhs=['stdin', 'stdout'],
 
182
                                      attach_fhs={'stderr': devnull})
 
183
                with contextlib.closing(proc.handles['stdin']) as f:
 
184
                    f.write(data)
 
185
                with contextlib.closing(proc.handles['stdout']) as f:
 
186
                    ciphertext = f.read()
 
187
                proc.wait()
 
188
            except IOError as e:
 
189
                raise PGPError(e)
 
190
        self.gnupg.passphrase = None
210
191
        return ciphertext
211
192
    
212
193
    def decrypt(self, data, password):
213
 
        passphrase = self.password_encode(password)
214
 
        with tempfile.NamedTemporaryFile(
215
 
                dir = self.tempdir) as passfile:
216
 
            passfile.write(passphrase)
217
 
            passfile.flush()
218
 
            proc = subprocess.Popen(['gpg', '--decrypt',
219
 
                                     '--passphrase-file',
220
 
                                     passfile.name]
221
 
                                    + self.gnupgargs,
222
 
                                    stdin = subprocess.PIPE,
223
 
                                    stdout = subprocess.PIPE,
224
 
                                    stderr = subprocess.PIPE)
225
 
            decrypted_plaintext, err = proc.communicate(input = data)
226
 
        if proc.returncode != 0:
227
 
            raise PGPError(err)
 
194
        self.gnupg.passphrase = self.password_encode(password)
 
195
        with open(os.devnull) as devnull:
 
196
            try:
 
197
                proc = self.gnupg.run(['--decrypt'],
 
198
                                      create_fhs=['stdin', 'stdout'],
 
199
                                      attach_fhs={'stderr': devnull})
 
200
                with contextlib.closing(proc.handles['stdin'] ) as f:
 
201
                    f.write(data)
 
202
                with contextlib.closing(proc.handles['stdout']) as f:
 
203
                    decrypted_plaintext = f.read()
 
204
                proc.wait()
 
205
            except IOError as e:
 
206
                raise PGPError(e)
 
207
        self.gnupg.passphrase = None
228
208
        return decrypted_plaintext
229
209
 
230
210
 
 
211
 
231
212
class AvahiError(Exception):
232
213
    def __init__(self, value, *args, **kwargs):
233
214
        self.value = value
234
 
        return super(AvahiError, self).__init__(value, *args,
235
 
                                                **kwargs)
236
 
 
 
215
        super(AvahiError, self).__init__(value, *args, **kwargs)
 
216
    def __unicode__(self):
 
217
        return unicode(repr(self.value))
237
218
 
238
219
class AvahiServiceError(AvahiError):
239
220
    pass
240
221
 
241
 
 
242
222
class AvahiGroupError(AvahiError):
243
223
    pass
244
224
 
251
231
               Used to optionally bind to the specified interface.
252
232
    name: string; Example: 'Mandos'
253
233
    type: string; Example: '_mandos._tcp'.
254
 
     See <https://www.iana.org/assignments/service-names-port-numbers>
 
234
                  See <http://www.dns-sd.org/ServiceTypes.html>
255
235
    port: integer; what port to announce
256
236
    TXT: list of strings; TXT record for the service
257
237
    domain: string; Domain to publish on, default to .local if empty.
263
243
    server: D-Bus Server
264
244
    bus: dbus.SystemBus()
265
245
    """
266
 
    
267
 
    def __init__(self,
268
 
                 interface = avahi.IF_UNSPEC,
269
 
                 name = None,
270
 
                 servicetype = None,
271
 
                 port = None,
272
 
                 TXT = None,
273
 
                 domain = "",
274
 
                 host = "",
275
 
                 max_renames = 32768,
276
 
                 protocol = avahi.PROTO_UNSPEC,
277
 
                 bus = None):
 
246
    def __init__(self, interface = avahi.IF_UNSPEC, name = None,
 
247
                 servicetype = None, port = None, TXT = None,
 
248
                 domain = "", host = "", max_renames = 32768,
 
249
                 protocol = avahi.PROTO_UNSPEC, bus = None):
278
250
        self.interface = interface
279
251
        self.name = name
280
252
        self.type = servicetype
289
261
        self.server = None
290
262
        self.bus = bus
291
263
        self.entry_group_state_changed_match = None
292
 
    
293
 
    def rename(self, remove=True):
 
264
    def rename(self):
294
265
        """Derived from the Avahi example code"""
295
266
        if self.rename_count >= self.max_renames:
296
267
            logger.critical("No suitable Zeroconf service name found"
297
268
                            " after %i retries, exiting.",
298
269
                            self.rename_count)
299
270
            raise AvahiServiceError("Too many renames")
300
 
        self.name = str(
301
 
            self.server.GetAlternativeServiceName(self.name))
302
 
        self.rename_count += 1
 
271
        self.name = unicode(self.server
 
272
                            .GetAlternativeServiceName(self.name))
303
273
        logger.info("Changing Zeroconf service name to %r ...",
304
274
                    self.name)
305
 
        if remove:
306
 
            self.remove()
 
275
        self.remove()
307
276
        try:
308
277
            self.add()
309
278
        except dbus.exceptions.DBusException as error:
310
 
            if (error.get_dbus_name()
311
 
                == "org.freedesktop.Avahi.CollisionError"):
312
 
                logger.info("Local Zeroconf service name collision.")
313
 
                return self.rename(remove=False)
314
 
            else:
315
 
                logger.critical("D-Bus Exception", exc_info=error)
316
 
                self.cleanup()
317
 
                os._exit(1)
318
 
    
 
279
            logger.critical("DBusException: %s", error)
 
280
            self.cleanup()
 
281
            os._exit(1)
 
282
        self.rename_count += 1
319
283
    def remove(self):
320
284
        """Derived from the Avahi example code"""
321
285
        if self.entry_group_state_changed_match is not None:
323
287
            self.entry_group_state_changed_match = None
324
288
        if self.group is not None:
325
289
            self.group.Reset()
326
 
    
327
290
    def add(self):
328
291
        """Derived from the Avahi example code"""
329
292
        self.remove()
346
309
            dbus.UInt16(self.port),
347
310
            avahi.string_array_to_txt_array(self.TXT))
348
311
        self.group.Commit()
349
 
    
350
312
    def entry_group_state_changed(self, state, error):
351
313
        """Derived from the Avahi example code"""
352
314
        logger.debug("Avahi entry group state change: %i", state)
358
320
            self.rename()
359
321
        elif state == avahi.ENTRY_GROUP_FAILURE:
360
322
            logger.critical("Avahi: Error in group state changed %s",
361
 
                            str(error))
362
 
            raise AvahiGroupError("State changed: {!s}".format(error))
363
 
    
 
323
                            unicode(error))
 
324
            raise AvahiGroupError("State changed: %s"
 
325
                                  % unicode(error))
364
326
    def cleanup(self):
365
327
        """Derived from the Avahi example code"""
366
328
        if self.group is not None:
371
333
                pass
372
334
            self.group = None
373
335
        self.remove()
374
 
    
375
336
    def server_state_changed(self, state, error=None):
376
337
        """Derived from the Avahi example code"""
377
338
        logger.debug("Avahi server state change: %i", state)
378
 
        bad_states = {
379
 
            avahi.SERVER_INVALID: "Zeroconf server invalid",
380
 
            avahi.SERVER_REGISTERING: None,
381
 
            avahi.SERVER_COLLISION: "Zeroconf server name collision",
382
 
            avahi.SERVER_FAILURE: "Zeroconf server failure",
383
 
        }
 
339
        bad_states = { avahi.SERVER_INVALID:
 
340
                           "Zeroconf server invalid",
 
341
                       avahi.SERVER_REGISTERING: None,
 
342
                       avahi.SERVER_COLLISION:
 
343
                           "Zeroconf server name collision",
 
344
                       avahi.SERVER_FAILURE:
 
345
                           "Zeroconf server failure" }
384
346
        if state in bad_states:
385
347
            if bad_states[state] is not None:
386
348
                if error is None:
389
351
                    logger.error(bad_states[state] + ": %r", error)
390
352
            self.cleanup()
391
353
        elif state == avahi.SERVER_RUNNING:
392
 
            try:
393
 
                self.add()
394
 
            except dbus.exceptions.DBusException as error:
395
 
                if (error.get_dbus_name()
396
 
                    == "org.freedesktop.Avahi.CollisionError"):
397
 
                    logger.info("Local Zeroconf service name"
398
 
                                " collision.")
399
 
                    return self.rename(remove=False)
400
 
                else:
401
 
                    logger.critical("D-Bus Exception", exc_info=error)
402
 
                    self.cleanup()
403
 
                    os._exit(1)
 
354
            self.add()
404
355
        else:
405
356
            if error is None:
406
357
                logger.debug("Unknown state: %r", state)
407
358
            else:
408
359
                logger.debug("Unknown state: %r: %r", state, error)
409
 
    
410
360
    def activate(self):
411
361
        """Derived from the Avahi example code"""
412
362
        if self.server is None:
416
366
                                    follow_name_owner_changes=True),
417
367
                avahi.DBUS_INTERFACE_SERVER)
418
368
        self.server.connect_to_signal("StateChanged",
419
 
                                      self.server_state_changed)
 
369
                                 self.server_state_changed)
420
370
        self.server_state_changed(self.server.GetState())
421
371
 
422
 
 
423
372
class AvahiServiceToSyslog(AvahiService):
424
 
    def rename(self, *args, **kwargs):
 
373
    def rename(self):
425
374
        """Add the new name to the syslog messages"""
426
 
        ret = AvahiService.rename(self, *args, **kwargs)
427
 
        syslogger.setFormatter(logging.Formatter(
428
 
            'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
429
 
            .format(self.name)))
 
375
        ret = AvahiService.rename(self)
 
376
        syslogger.setFormatter(logging.Formatter
 
377
                               ('Mandos (%s) [%%(process)d]:'
 
378
                                ' %%(levelname)s: %%(message)s'
 
379
                                % self.name))
430
380
        return ret
431
381
 
432
 
# Pretend that we have a GnuTLS module
433
 
class GnuTLS(object):
434
 
    """This isn't so much a class as it is a module-like namespace.
435
 
    It is instantiated once, and simulates having a GnuTLS module."""
436
 
    
437
 
    _library = ctypes.cdll.LoadLibrary(
438
 
        ctypes.util.find_library("gnutls"))
439
 
    _need_version = "3.3.0"
440
 
    def __init__(self):
441
 
        # Need to use class name "GnuTLS" here, since this method is
442
 
        # called before the assignment to the "gnutls" global variable
443
 
        # happens.
444
 
        if GnuTLS.check_version(self._need_version) is None:
445
 
            raise GnuTLS.Error("Needs GnuTLS {} or later"
446
 
                               .format(self._need_version))
447
 
    
448
 
    # Unless otherwise indicated, the constants and types below are
449
 
    # all from the gnutls/gnutls.h C header file.
450
 
    
451
 
    # Constants
452
 
    E_SUCCESS = 0
453
 
    CRT_OPENPGP = 2
454
 
    CLIENT = 2
455
 
    SHUT_RDWR = 0
456
 
    CRD_CERTIFICATE = 1
457
 
    E_NO_CERTIFICATE_FOUND = -49
458
 
    OPENPGP_FMT_RAW = 0         # gnutls/openpgp.h
459
 
    
460
 
    # Types
461
 
    class session_int(ctypes.Structure):
462
 
        _fields_ = []
463
 
    session_t = ctypes.POINTER(session_int)
464
 
    class certificate_credentials_st(ctypes.Structure):
465
 
        _fields_ = []
466
 
    certificate_credentials_t = ctypes.POINTER(
467
 
        certificate_credentials_st)
468
 
    certificate_type_t = ctypes.c_int
469
 
    class datum_t(ctypes.Structure):
470
 
        _fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
471
 
                    ('size', ctypes.c_uint)]
472
 
    class openpgp_crt_int(ctypes.Structure):
473
 
        _fields_ = []
474
 
    openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
475
 
    openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
476
 
    log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
477
 
    credentials_type_t = ctypes.c_int # 
478
 
    transport_ptr_t = ctypes.c_void_p
479
 
    close_request_t = ctypes.c_int
480
 
    
481
 
    # Exceptions
482
 
    class Error(Exception):
483
 
        # We need to use the class name "GnuTLS" here, since this
484
 
        # exception might be raised from within GnuTLS.__init__,
485
 
        # which is called before the assignment to the "gnutls"
486
 
        # global variable happens.
487
 
        def __init__(self, message = None, code = None, args=()):
488
 
            # Default usage is by a message string, but if a return
489
 
            # code is passed, convert it to a string with
490
 
            # gnutls.strerror()
491
 
            if message is None and code is not None:
492
 
                message = GnuTLS.strerror(code)
493
 
            return super(GnuTLS.Error, self).__init__(
494
 
                message, *args)
495
 
    
496
 
    class CertificateSecurityError(Error):
497
 
        pass
498
 
    
499
 
    # Classes
500
 
    class Credentials(object):
501
 
        def __init__(self):
502
 
            self._c_object = gnutls.certificate_credentials_t()
503
 
            gnutls.certificate_allocate_credentials(
504
 
                ctypes.byref(self._c_object))
505
 
            self.type = gnutls.CRD_CERTIFICATE
506
 
        
507
 
        def __del__(self):
508
 
            gnutls.certificate_free_credentials(self._c_object)
509
 
    
510
 
    class ClientSession(object):
511
 
        def __init__(self, socket, credentials = None):
512
 
            self._c_object = gnutls.session_t()
513
 
            gnutls.init(ctypes.byref(self._c_object), gnutls.CLIENT)
514
 
            gnutls.set_default_priority(self._c_object)
515
 
            gnutls.transport_set_ptr(self._c_object, socket.fileno())
516
 
            gnutls.handshake_set_private_extensions(self._c_object,
517
 
                                                    True)
518
 
            self.socket = socket
519
 
            if credentials is None:
520
 
                credentials = gnutls.Credentials()
521
 
            gnutls.credentials_set(self._c_object, credentials.type,
522
 
                                   ctypes.cast(credentials._c_object,
523
 
                                               ctypes.c_void_p))
524
 
            self.credentials = credentials
525
 
        
526
 
        def __del__(self):
527
 
            gnutls.deinit(self._c_object)
528
 
        
529
 
        def handshake(self):
530
 
            return gnutls.handshake(self._c_object)
531
 
        
532
 
        def send(self, data):
533
 
            data = bytes(data)
534
 
            if not data:
535
 
                return 0
536
 
            return gnutls.record_send(self._c_object, data, len(data))
537
 
        
538
 
        def bye(self):
539
 
            return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
540
 
    
541
 
    # Error handling function
542
 
    def _error_code(result):
543
 
        """A function to raise exceptions on errors, suitable
544
 
        for the 'restype' attribute on ctypes functions"""
545
 
        if result >= 0:
546
 
            return result
547
 
        if result == gnutls.E_NO_CERTIFICATE_FOUND:
548
 
            raise gnutls.CertificateSecurityError(code = result)
549
 
        raise gnutls.Error(code = result)
550
 
    
551
 
    # Unless otherwise indicated, the function declarations below are
552
 
    # all from the gnutls/gnutls.h C header file.
553
 
    
554
 
    # Functions
555
 
    priority_set_direct = _library.gnutls_priority_set_direct
556
 
    priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
557
 
                                    ctypes.POINTER(ctypes.c_char_p)]
558
 
    priority_set_direct.restype = _error_code
559
 
    
560
 
    init = _library.gnutls_init
561
 
    init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
562
 
    init.restype = _error_code
563
 
    
564
 
    set_default_priority = _library.gnutls_set_default_priority
565
 
    set_default_priority.argtypes = [session_t]
566
 
    set_default_priority.restype = _error_code
567
 
    
568
 
    record_send = _library.gnutls_record_send
569
 
    record_send.argtypes = [session_t, ctypes.c_void_p,
570
 
                            ctypes.c_size_t]
571
 
    record_send.restype = ctypes.c_ssize_t
572
 
    
573
 
    certificate_allocate_credentials = (
574
 
        _library.gnutls_certificate_allocate_credentials)
575
 
    certificate_allocate_credentials.argtypes = [
576
 
        ctypes.POINTER(certificate_credentials_t)]
577
 
    certificate_allocate_credentials.restype = _error_code
578
 
    
579
 
    certificate_free_credentials = (
580
 
        _library.gnutls_certificate_free_credentials)
581
 
    certificate_free_credentials.argtypes = [certificate_credentials_t]
582
 
    certificate_free_credentials.restype = None
583
 
    
584
 
    handshake_set_private_extensions = (
585
 
        _library.gnutls_handshake_set_private_extensions)
586
 
    handshake_set_private_extensions.argtypes = [session_t,
587
 
                                                 ctypes.c_int]
588
 
    handshake_set_private_extensions.restype = None
589
 
    
590
 
    credentials_set = _library.gnutls_credentials_set
591
 
    credentials_set.argtypes = [session_t, credentials_type_t,
592
 
                                ctypes.c_void_p]
593
 
    credentials_set.restype = _error_code
594
 
    
595
 
    strerror = _library.gnutls_strerror
596
 
    strerror.argtypes = [ctypes.c_int]
597
 
    strerror.restype = ctypes.c_char_p
598
 
    
599
 
    certificate_type_get = _library.gnutls_certificate_type_get
600
 
    certificate_type_get.argtypes = [session_t]
601
 
    certificate_type_get.restype = _error_code
602
 
    
603
 
    certificate_get_peers = _library.gnutls_certificate_get_peers
604
 
    certificate_get_peers.argtypes = [session_t,
605
 
                                      ctypes.POINTER(ctypes.c_uint)]
606
 
    certificate_get_peers.restype = ctypes.POINTER(datum_t)
607
 
    
608
 
    global_set_log_level = _library.gnutls_global_set_log_level
609
 
    global_set_log_level.argtypes = [ctypes.c_int]
610
 
    global_set_log_level.restype = None
611
 
    
612
 
    global_set_log_function = _library.gnutls_global_set_log_function
613
 
    global_set_log_function.argtypes = [log_func]
614
 
    global_set_log_function.restype = None
615
 
    
616
 
    deinit = _library.gnutls_deinit
617
 
    deinit.argtypes = [session_t]
618
 
    deinit.restype = None
619
 
    
620
 
    handshake = _library.gnutls_handshake
621
 
    handshake.argtypes = [session_t]
622
 
    handshake.restype = _error_code
623
 
    
624
 
    transport_set_ptr = _library.gnutls_transport_set_ptr
625
 
    transport_set_ptr.argtypes = [session_t, transport_ptr_t]
626
 
    transport_set_ptr.restype = None
627
 
    
628
 
    bye = _library.gnutls_bye
629
 
    bye.argtypes = [session_t, close_request_t]
630
 
    bye.restype = _error_code
631
 
    
632
 
    check_version = _library.gnutls_check_version
633
 
    check_version.argtypes = [ctypes.c_char_p]
634
 
    check_version.restype = ctypes.c_char_p
635
 
    
636
 
    # All the function declarations below are from gnutls/openpgp.h
637
 
    
638
 
    openpgp_crt_init = _library.gnutls_openpgp_crt_init
639
 
    openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
640
 
    openpgp_crt_init.restype = _error_code
641
 
    
642
 
    openpgp_crt_import = _library.gnutls_openpgp_crt_import
643
 
    openpgp_crt_import.argtypes = [openpgp_crt_t,
644
 
                                   ctypes.POINTER(datum_t),
645
 
                                   openpgp_crt_fmt_t]
646
 
    openpgp_crt_import.restype = _error_code
647
 
    
648
 
    openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
649
 
    openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
650
 
                                        ctypes.POINTER(ctypes.c_uint)]
651
 
    openpgp_crt_verify_self.restype = _error_code
652
 
    
653
 
    openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
654
 
    openpgp_crt_deinit.argtypes = [openpgp_crt_t]
655
 
    openpgp_crt_deinit.restype = None
656
 
    
657
 
    openpgp_crt_get_fingerprint = (
658
 
        _library.gnutls_openpgp_crt_get_fingerprint)
659
 
    openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
660
 
                                            ctypes.c_void_p,
661
 
                                            ctypes.POINTER(
662
 
                                                ctypes.c_size_t)]
663
 
    openpgp_crt_get_fingerprint.restype = _error_code
664
 
    
665
 
    # Remove non-public function
666
 
    del _error_code
667
 
# Create the global "gnutls" object, simulating a module
668
 
gnutls = GnuTLS()
669
 
 
670
 
def call_pipe(connection,       # : multiprocessing.Connection
671
 
              func, *args, **kwargs):
672
 
    """This function is meant to be called by multiprocessing.Process
673
 
    
674
 
    This function runs func(*args, **kwargs), and writes the resulting
675
 
    return value on the provided multiprocessing.Connection.
676
 
    """
677
 
    connection.send(func(*args, **kwargs))
678
 
    connection.close()
679
 
 
 
382
def timedelta_to_milliseconds(td):
 
383
    "Convert a datetime.timedelta() to milliseconds"
 
384
    return ((td.days * 24 * 60 * 60 * 1000)
 
385
            + (td.seconds * 1000)
 
386
            + (td.microseconds // 1000))
 
387
        
680
388
class Client(object):
681
389
    """A representation of a client host served by this server.
682
390
    
707
415
    last_checked_ok: datetime.datetime(); (UTC) or None
708
416
    last_checker_status: integer between 0 and 255 reflecting exit
709
417
                         status of last checker. -1 reflects crashed
710
 
                         checker, -2 means no checker completed yet.
711
 
    last_checker_signal: The signal which killed the last checker, if
712
 
                         last_checker_status is -1
 
418
                         checker, or None.
713
419
    last_enabled: datetime.datetime(); (UTC) or None
714
420
    name:       string; from the config file, used in log messages and
715
421
                        D-Bus identifiers
720
426
    runtime_expansions: Allowed attributes for runtime expansion.
721
427
    expires:    datetime.datetime(); time (UTC) when a client will be
722
428
                disabled, or None
723
 
    server_settings: The server_settings dict from main()
724
429
    """
725
430
    
726
431
    runtime_expansions = ("approval_delay", "approval_duration",
727
 
                          "created", "enabled", "expires",
728
 
                          "fingerprint", "host", "interval",
729
 
                          "last_approval_request", "last_checked_ok",
 
432
                          "created", "enabled", "fingerprint",
 
433
                          "host", "interval", "last_checked_ok",
730
434
                          "last_enabled", "name", "timeout")
731
 
    client_defaults = {
732
 
        "timeout": "PT5M",
733
 
        "extended_timeout": "PT15M",
734
 
        "interval": "PT2M",
735
 
        "checker": "fping -q -- %%(host)s",
736
 
        "host": "",
737
 
        "approval_delay": "PT0S",
738
 
        "approval_duration": "PT1S",
739
 
        "approved_by_default": "True",
740
 
        "enabled": "True",
741
 
    }
742
 
    
 
435
    client_defaults = { "timeout": "5m",
 
436
                        "extended_timeout": "15m",
 
437
                        "interval": "2m",
 
438
                        "checker": "fping -q -- %%(host)s",
 
439
                        "host": "",
 
440
                        "approval_delay": "0s",
 
441
                        "approval_duration": "1s",
 
442
                        "approved_by_default": "True",
 
443
                        "enabled": "True",
 
444
                        }
 
445
    
 
446
    def timeout_milliseconds(self):
 
447
        "Return the 'timeout' attribute in milliseconds"
 
448
        return timedelta_to_milliseconds(self.timeout)
 
449
    
 
450
    def extended_timeout_milliseconds(self):
 
451
        "Return the 'extended_timeout' attribute in milliseconds"
 
452
        return timedelta_to_milliseconds(self.extended_timeout)
 
453
    
 
454
    def interval_milliseconds(self):
 
455
        "Return the 'interval' attribute in milliseconds"
 
456
        return timedelta_to_milliseconds(self.interval)
 
457
    
 
458
    def approval_delay_milliseconds(self):
 
459
        return timedelta_to_milliseconds(self.approval_delay)
 
460
 
743
461
    @staticmethod
744
462
    def config_parser(config):
745
463
        """Construct a new dict of client settings of this form:
760
478
            client["enabled"] = config.getboolean(client_name,
761
479
                                                  "enabled")
762
480
            
763
 
            # Uppercase and remove spaces from fingerprint for later
764
 
            # comparison purposes with return value from the
765
 
            # fingerprint() function
766
481
            client["fingerprint"] = (section["fingerprint"].upper()
767
482
                                     .replace(" ", ""))
768
483
            if "secret" in section:
773
488
                          "rb") as secfile:
774
489
                    client["secret"] = secfile.read()
775
490
            else:
776
 
                raise TypeError("No secret or secfile for section {}"
777
 
                                .format(section))
 
491
                raise TypeError("No secret or secfile for section %s"
 
492
                                % section)
778
493
            client["timeout"] = string_to_delta(section["timeout"])
779
494
            client["extended_timeout"] = string_to_delta(
780
495
                section["extended_timeout"])
786
501
            client["checker_command"] = section["checker"]
787
502
            client["last_approval_request"] = None
788
503
            client["last_checked_ok"] = None
789
 
            client["last_checker_status"] = -2
 
504
            client["last_checker_status"] = None
790
505
        
791
506
        return settings
792
 
    
793
 
    def __init__(self, settings, name = None, server_settings=None):
 
507
        
 
508
        
 
509
    def __init__(self, settings, name = None):
 
510
        """Note: the 'checker' key in 'config' sets the
 
511
        'checker_command' attribute and *not* the 'checker'
 
512
        attribute."""
794
513
        self.name = name
795
 
        if server_settings is None:
796
 
            server_settings = {}
797
 
        self.server_settings = server_settings
798
514
        # adding all client settings
799
 
        for setting, value in settings.items():
 
515
        for setting, value in settings.iteritems():
800
516
            setattr(self, setting, value)
801
517
        
802
518
        if self.enabled:
808
524
        else:
809
525
            self.last_enabled = None
810
526
            self.expires = None
811
 
        
 
527
       
812
528
        logger.debug("Creating client %r", self.name)
 
529
        # Uppercase and remove spaces from fingerprint for later
 
530
        # comparison purposes with return value from the fingerprint()
 
531
        # function
813
532
        logger.debug("  Fingerprint: %s", self.fingerprint)
814
533
        self.created = settings.get("created",
815
534
                                    datetime.datetime.utcnow())
816
 
        
 
535
 
817
536
        # attributes specific for this server instance
818
537
        self.checker = None
819
538
        self.checker_initiator_tag = None
822
541
        self.current_checker_command = None
823
542
        self.approved = None
824
543
        self.approvals_pending = 0
825
 
        self.changedstate = multiprocessing_manager.Condition(
826
 
            multiprocessing_manager.Lock())
827
 
        self.client_structure = [attr
828
 
                                 for attr in self.__dict__.iterkeys()
 
544
        self.changedstate = (multiprocessing_manager
 
545
                             .Condition(multiprocessing_manager
 
546
                                        .Lock()))
 
547
        self.client_structure = [attr for attr in
 
548
                                 self.__dict__.iterkeys()
829
549
                                 if not attr.startswith("_")]
830
550
        self.client_structure.append("client_structure")
831
551
        
832
 
        for name, t in inspect.getmembers(
833
 
                type(self), lambda obj: isinstance(obj, property)):
 
552
        for name, t in inspect.getmembers(type(self),
 
553
                                          lambda obj:
 
554
                                              isinstance(obj,
 
555
                                                         property)):
834
556
            if not name.startswith("_"):
835
557
                self.client_structure.append(name)
836
558
    
844
566
        if getattr(self, "enabled", False):
845
567
            # Already enabled
846
568
            return
 
569
        self.send_changedstate()
847
570
        self.expires = datetime.datetime.utcnow() + self.timeout
848
571
        self.enabled = True
849
572
        self.last_enabled = datetime.datetime.utcnow()
850
573
        self.init_checker()
851
 
        self.send_changedstate()
852
574
    
853
575
    def disable(self, quiet=True):
854
576
        """Disable this client."""
855
577
        if not getattr(self, "enabled", False):
856
578
            return False
857
579
        if not quiet:
 
580
            self.send_changedstate()
 
581
        if not quiet:
858
582
            logger.info("Disabling client %s", self.name)
859
 
        if getattr(self, "disable_initiator_tag", None) is not None:
 
583
        if getattr(self, "disable_initiator_tag", False):
860
584
            gobject.source_remove(self.disable_initiator_tag)
861
585
            self.disable_initiator_tag = None
862
586
        self.expires = None
863
 
        if getattr(self, "checker_initiator_tag", None) is not None:
 
587
        if getattr(self, "checker_initiator_tag", False):
864
588
            gobject.source_remove(self.checker_initiator_tag)
865
589
            self.checker_initiator_tag = None
866
590
        self.stop_checker()
867
591
        self.enabled = False
868
 
        if not quiet:
869
 
            self.send_changedstate()
870
592
        # Do not run this again if called by a gobject.timeout_add
871
593
        return False
872
594
    
876
598
    def init_checker(self):
877
599
        # Schedule a new checker to be started an 'interval' from now,
878
600
        # and every interval from then on.
879
 
        if self.checker_initiator_tag is not None:
880
 
            gobject.source_remove(self.checker_initiator_tag)
881
 
        self.checker_initiator_tag = gobject.timeout_add(
882
 
            int(self.interval.total_seconds() * 1000),
883
 
            self.start_checker)
 
601
        self.checker_initiator_tag = (gobject.timeout_add
 
602
                                      (self.interval_milliseconds(),
 
603
                                       self.start_checker))
884
604
        # Schedule a disable() when 'timeout' has passed
885
 
        if self.disable_initiator_tag is not None:
886
 
            gobject.source_remove(self.disable_initiator_tag)
887
 
        self.disable_initiator_tag = gobject.timeout_add(
888
 
            int(self.timeout.total_seconds() * 1000), self.disable)
 
605
        self.disable_initiator_tag = (gobject.timeout_add
 
606
                                   (self.timeout_milliseconds(),
 
607
                                    self.disable))
889
608
        # Also start a new checker *right now*.
890
609
        self.start_checker()
891
610
    
892
 
    def checker_callback(self, source, condition, connection,
893
 
                         command):
 
611
    def checker_callback(self, pid, condition, command):
894
612
        """The checker has completed, so take appropriate actions."""
895
613
        self.checker_callback_tag = None
896
614
        self.checker = None
897
 
        # Read return code from connection (see call_pipe)
898
 
        returncode = connection.recv()
899
 
        connection.close()
900
 
        
901
 
        if returncode >= 0:
902
 
            self.last_checker_status = returncode
903
 
            self.last_checker_signal = None
 
615
        if os.WIFEXITED(condition):
 
616
            self.last_checker_status = os.WEXITSTATUS(condition)
904
617
            if self.last_checker_status == 0:
905
618
                logger.info("Checker for %(name)s succeeded",
906
619
                            vars(self))
907
620
                self.checked_ok()
908
621
            else:
909
 
                logger.info("Checker for %(name)s failed", vars(self))
 
622
                logger.info("Checker for %(name)s failed",
 
623
                            vars(self))
910
624
        else:
911
625
            self.last_checker_status = -1
912
 
            self.last_checker_signal = -returncode
913
626
            logger.warning("Checker for %(name)s crashed?",
914
627
                           vars(self))
915
 
        return False
916
 
    
917
 
    def checked_ok(self):
918
 
        """Assert that the client has been seen, alive and well."""
919
 
        self.last_checked_ok = datetime.datetime.utcnow()
920
 
        self.last_checker_status = 0
921
 
        self.last_checker_signal = None
922
 
        self.bump_timeout()
923
 
    
924
 
    def bump_timeout(self, timeout=None):
925
 
        """Bump up the timeout for this client."""
 
628
    
 
629
    def checked_ok(self, timeout=None):
 
630
        """Bump up the timeout for this client.
 
631
        
 
632
        This should only be called when the client has been seen,
 
633
        alive and well.
 
634
        """
926
635
        if timeout is None:
927
636
            timeout = self.timeout
 
637
        self.last_checked_ok = datetime.datetime.utcnow()
928
638
        if self.disable_initiator_tag is not None:
929
639
            gobject.source_remove(self.disable_initiator_tag)
930
 
            self.disable_initiator_tag = None
931
640
        if getattr(self, "enabled", False):
932
 
            self.disable_initiator_tag = gobject.timeout_add(
933
 
                int(timeout.total_seconds() * 1000), self.disable)
 
641
            self.disable_initiator_tag = (gobject.timeout_add
 
642
                                          (timedelta_to_milliseconds
 
643
                                           (timeout), self.disable))
934
644
            self.expires = datetime.datetime.utcnow() + timeout
935
645
    
936
646
    def need_approval(self):
942
652
        If a checker already exists, leave it running and do
943
653
        nothing."""
944
654
        # The reason for not killing a running checker is that if we
945
 
        # did that, and if a checker (for some reason) started running
946
 
        # slowly and taking more than 'interval' time, then the client
947
 
        # would inevitably timeout, since no checker would get a
948
 
        # chance to run to completion.  If we instead leave running
 
655
        # did that, then if a checker (for some reason) started
 
656
        # running slowly and taking more than 'interval' time, the
 
657
        # client would inevitably timeout, since no checker would get
 
658
        # a chance to run to completion.  If we instead leave running
949
659
        # checkers alone, the checker would have to take more time
950
660
        # than 'timeout' for the client to be disabled, which is as it
951
661
        # should be.
952
662
        
953
 
        if self.checker is not None and not self.checker.is_alive():
954
 
            logger.warning("Checker was not alive; joining")
955
 
            self.checker.join()
956
 
            self.checker = None
 
663
        # If a checker exists, make sure it is not a zombie
 
664
        try:
 
665
            pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
 
666
        except (AttributeError, OSError) as error:
 
667
            if (isinstance(error, OSError)
 
668
                and error.errno != errno.ECHILD):
 
669
                raise error
 
670
        else:
 
671
            if pid:
 
672
                logger.warning("Checker was a zombie")
 
673
                gobject.source_remove(self.checker_callback_tag)
 
674
                self.checker_callback(pid, status,
 
675
                                      self.current_checker_command)
957
676
        # Start a new checker if needed
958
677
        if self.checker is None:
959
 
            # Escape attributes for the shell
960
 
            escaped_attrs = {
961
 
                attr: re.escape(str(getattr(self, attr)))
962
 
                for attr in self.runtime_expansions }
963
678
            try:
964
 
                command = self.checker_command % escaped_attrs
965
 
            except TypeError as error:
966
 
                logger.error('Could not format string "%s"',
967
 
                             self.checker_command,
968
 
                             exc_info=error)
969
 
                return True     # Try again later
 
679
                # In case checker_command has exactly one % operator
 
680
                command = self.checker_command % self.host
 
681
            except TypeError:
 
682
                # Escape attributes for the shell
 
683
                escaped_attrs = dict(
 
684
                    (attr,
 
685
                     re.escape(unicode(str(getattr(self, attr, "")),
 
686
                                       errors=
 
687
                                       'replace')))
 
688
                    for attr in
 
689
                    self.runtime_expansions)
 
690
                
 
691
                try:
 
692
                    command = self.checker_command % escaped_attrs
 
693
                except TypeError as error:
 
694
                    logger.error('Could not format string "%s":'
 
695
                                 ' %s', self.checker_command, error)
 
696
                    return True # Try again later
970
697
            self.current_checker_command = command
971
 
            logger.info("Starting checker %r for %s", command,
972
 
                        self.name)
973
 
            # We don't need to redirect stdout and stderr, since
974
 
            # in normal mode, that is already done by daemon(),
975
 
            # and in debug mode we don't want to.  (Stdin is
976
 
            # always replaced by /dev/null.)
977
 
            # The exception is when not debugging but nevertheless
978
 
            # running in the foreground; use the previously
979
 
            # created wnull.
980
 
            popen_args = { "close_fds": True,
981
 
                           "shell": True,
982
 
                           "cwd": "/" }
983
 
            if (not self.server_settings["debug"]
984
 
                and self.server_settings["foreground"]):
985
 
                popen_args.update({"stdout": wnull,
986
 
                                   "stderr": wnull })
987
 
            pipe = multiprocessing.Pipe(duplex = False)
988
 
            self.checker = multiprocessing.Process(
989
 
                target = call_pipe,
990
 
                args = (pipe[1], subprocess.call, command),
991
 
                kwargs = popen_args)
992
 
            self.checker.start()
993
 
            self.checker_callback_tag = gobject.io_add_watch(
994
 
                pipe[0].fileno(), gobject.IO_IN,
995
 
                self.checker_callback, pipe[0], command)
 
698
            try:
 
699
                logger.info("Starting checker %r for %s",
 
700
                            command, self.name)
 
701
                # We don't need to redirect stdout and stderr, since
 
702
                # in normal mode, that is already done by daemon(),
 
703
                # and in debug mode we don't want to.  (Stdin is
 
704
                # always replaced by /dev/null.)
 
705
                self.checker = subprocess.Popen(command,
 
706
                                                close_fds=True,
 
707
                                                shell=True, cwd="/")
 
708
                self.checker_callback_tag = (gobject.child_watch_add
 
709
                                             (self.checker.pid,
 
710
                                              self.checker_callback,
 
711
                                              data=command))
 
712
                # The checker may have completed before the gobject
 
713
                # watch was added.  Check for this.
 
714
                pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
 
715
                if pid:
 
716
                    gobject.source_remove(self.checker_callback_tag)
 
717
                    self.checker_callback(pid, status, command)
 
718
            except OSError as error:
 
719
                logger.error("Failed to start subprocess: %s",
 
720
                             error)
996
721
        # Re-run this periodically if run by gobject.timeout_add
997
722
        return True
998
723
    
1004
729
        if getattr(self, "checker", None) is None:
1005
730
            return
1006
731
        logger.debug("Stopping checker for %(name)s", vars(self))
1007
 
        self.checker.terminate()
 
732
        try:
 
733
            os.kill(self.checker.pid, signal.SIGTERM)
 
734
            #time.sleep(0.5)
 
735
            #if self.checker.poll() is None:
 
736
            #    os.kill(self.checker.pid, signal.SIGKILL)
 
737
        except OSError as error:
 
738
            if error.errno != errno.ESRCH: # No such process
 
739
                raise
1008
740
        self.checker = None
1009
741
 
1010
742
 
1011
 
def dbus_service_property(dbus_interface,
1012
 
                          signature="v",
1013
 
                          access="readwrite",
1014
 
                          byte_arrays=False):
 
743
def dbus_service_property(dbus_interface, signature="v",
 
744
                          access="readwrite", byte_arrays=False):
1015
745
    """Decorators for marking methods of a DBusObjectWithProperties to
1016
746
    become properties on the D-Bus.
1017
747
    
1026
756
    # "Set" method, so we fail early here:
1027
757
    if byte_arrays and signature != "ay":
1028
758
        raise ValueError("Byte arrays not supported for non-'ay'"
1029
 
                         " signature {!r}".format(signature))
1030
 
    
 
759
                         " signature %r" % signature)
1031
760
    def decorator(func):
1032
761
        func._dbus_is_property = True
1033
762
        func._dbus_interface = dbus_interface
1038
767
            func._dbus_name = func._dbus_name[:-14]
1039
768
        func._dbus_get_args_options = {'byte_arrays': byte_arrays }
1040
769
        return func
1041
 
    
1042
 
    return decorator
1043
 
 
1044
 
 
1045
 
def dbus_interface_annotations(dbus_interface):
1046
 
    """Decorator for marking functions returning interface annotations
1047
 
    
1048
 
    Usage:
1049
 
    
1050
 
    @dbus_interface_annotations("org.example.Interface")
1051
 
    def _foo(self):  # Function name does not matter
1052
 
        return {"org.freedesktop.DBus.Deprecated": "true",
1053
 
                "org.freedesktop.DBus.Property.EmitsChangedSignal":
1054
 
                    "false"}
1055
 
    """
1056
 
    
1057
 
    def decorator(func):
1058
 
        func._dbus_is_interface = True
1059
 
        func._dbus_interface = dbus_interface
1060
 
        func._dbus_name = dbus_interface
1061
 
        return func
1062
 
    
1063
 
    return decorator
1064
 
 
1065
 
 
1066
 
def dbus_annotations(annotations):
1067
 
    """Decorator to annotate D-Bus methods, signals or properties
1068
 
    Usage:
1069
 
    
1070
 
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",
1071
 
                       "org.freedesktop.DBus.Property."
1072
 
                       "EmitsChangedSignal": "false"})
1073
 
    @dbus_service_property("org.example.Interface", signature="b",
1074
 
                           access="r")
1075
 
    def Property_dbus_property(self):
1076
 
        return dbus.Boolean(False)
1077
 
    
1078
 
    See also the DBusObjectWithAnnotations class.
1079
 
    """
1080
 
    
1081
 
    def decorator(func):
1082
 
        func._dbus_annotations = annotations
1083
 
        return func
1084
 
    
1085
770
    return decorator
1086
771
 
1087
772
 
1088
773
class DBusPropertyException(dbus.exceptions.DBusException):
1089
774
    """A base class for D-Bus property-related exceptions
1090
775
    """
1091
 
    pass
 
776
    def __unicode__(self):
 
777
        return unicode(str(self))
1092
778
 
1093
779
 
1094
780
class DBusPropertyAccessException(DBusPropertyException):
1103
789
    pass
1104
790
 
1105
791
 
1106
 
class DBusObjectWithAnnotations(dbus.service.Object):
1107
 
    """A D-Bus object with annotations.
1108
 
    
1109
 
    Classes inheriting from this can use the dbus_annotations
1110
 
    decorator to add annotations to methods or signals.
1111
 
    """
1112
 
    
1113
 
    @staticmethod
1114
 
    def _is_dbus_thing(thing):
1115
 
        """Returns a function testing if an attribute is a D-Bus thing
1116
 
        
1117
 
        If called like _is_dbus_thing("method") it returns a function
1118
 
        suitable for use as predicate to inspect.getmembers().
1119
 
        """
1120
 
        return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
1121
 
                                   False)
1122
 
    
1123
 
    def _get_all_dbus_things(self, thing):
1124
 
        """Returns a generator of (name, attribute) pairs
1125
 
        """
1126
 
        return ((getattr(athing.__get__(self), "_dbus_name", name),
1127
 
                 athing.__get__(self))
1128
 
                for cls in self.__class__.__mro__
1129
 
                for name, athing in
1130
 
                inspect.getmembers(cls, self._is_dbus_thing(thing)))
1131
 
    
1132
 
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1133
 
                         out_signature = "s",
1134
 
                         path_keyword = 'object_path',
1135
 
                         connection_keyword = 'connection')
1136
 
    def Introspect(self, object_path, connection):
1137
 
        """Overloading of standard D-Bus method.
1138
 
        
1139
 
        Inserts annotation tags on methods and signals.
1140
 
        """
1141
 
        xmlstring = dbus.service.Object.Introspect(self, object_path,
1142
 
                                                   connection)
1143
 
        try:
1144
 
            document = xml.dom.minidom.parseString(xmlstring)
1145
 
            
1146
 
            for if_tag in document.getElementsByTagName("interface"):
1147
 
                # Add annotation tags
1148
 
                for typ in ("method", "signal"):
1149
 
                    for tag in if_tag.getElementsByTagName(typ):
1150
 
                        annots = dict()
1151
 
                        for name, prop in (self.
1152
 
                                           _get_all_dbus_things(typ)):
1153
 
                            if (name == tag.getAttribute("name")
1154
 
                                and prop._dbus_interface
1155
 
                                == if_tag.getAttribute("name")):
1156
 
                                annots.update(getattr(
1157
 
                                    prop, "_dbus_annotations", {}))
1158
 
                        for name, value in annots.items():
1159
 
                            ann_tag = document.createElement(
1160
 
                                "annotation")
1161
 
                            ann_tag.setAttribute("name", name)
1162
 
                            ann_tag.setAttribute("value", value)
1163
 
                            tag.appendChild(ann_tag)
1164
 
                # Add interface annotation tags
1165
 
                for annotation, value in dict(
1166
 
                    itertools.chain.from_iterable(
1167
 
                        annotations().items()
1168
 
                        for name, annotations
1169
 
                        in self._get_all_dbus_things("interface")
1170
 
                        if name == if_tag.getAttribute("name")
1171
 
                        )).items():
1172
 
                    ann_tag = document.createElement("annotation")
1173
 
                    ann_tag.setAttribute("name", annotation)
1174
 
                    ann_tag.setAttribute("value", value)
1175
 
                    if_tag.appendChild(ann_tag)
1176
 
                # Fix argument name for the Introspect method itself
1177
 
                if (if_tag.getAttribute("name")
1178
 
                                == dbus.INTROSPECTABLE_IFACE):
1179
 
                    for cn in if_tag.getElementsByTagName("method"):
1180
 
                        if cn.getAttribute("name") == "Introspect":
1181
 
                            for arg in cn.getElementsByTagName("arg"):
1182
 
                                if (arg.getAttribute("direction")
1183
 
                                    == "out"):
1184
 
                                    arg.setAttribute("name",
1185
 
                                                     "xml_data")
1186
 
            xmlstring = document.toxml("utf-8")
1187
 
            document.unlink()
1188
 
        except (AttributeError, xml.dom.DOMException,
1189
 
                xml.parsers.expat.ExpatError) as error:
1190
 
            logger.error("Failed to override Introspection method",
1191
 
                         exc_info=error)
1192
 
        return xmlstring
1193
 
 
1194
 
 
1195
 
class DBusObjectWithProperties(DBusObjectWithAnnotations):
 
792
class DBusObjectWithProperties(dbus.service.Object):
1196
793
    """A D-Bus object with properties.
1197
794
    
1198
795
    Classes inheriting from this can use the dbus_service_property
1200
797
    standard Get(), Set(), and GetAll() methods on the D-Bus.
1201
798
    """
1202
799
    
 
800
    @staticmethod
 
801
    def _is_dbus_property(obj):
 
802
        return getattr(obj, "_dbus_is_property", False)
 
803
    
 
804
    def _get_all_dbus_properties(self):
 
805
        """Returns a generator of (name, attribute) pairs
 
806
        """
 
807
        return ((prop.__get__(self)._dbus_name, prop.__get__(self))
 
808
                for cls in self.__class__.__mro__
 
809
                for name, prop in
 
810
                inspect.getmembers(cls, self._is_dbus_property))
 
811
    
1203
812
    def _get_dbus_property(self, interface_name, property_name):
1204
813
        """Returns a bound method if one exists which is a D-Bus
1205
814
        property with the specified name and interface.
1206
815
        """
1207
 
        for cls in self.__class__.__mro__:
1208
 
            for name, value in inspect.getmembers(
1209
 
                    cls, self._is_dbus_thing("property")):
 
816
        for cls in  self.__class__.__mro__:
 
817
            for name, value in (inspect.getmembers
 
818
                                (cls, self._is_dbus_property)):
1210
819
                if (value._dbus_name == property_name
1211
820
                    and value._dbus_interface == interface_name):
1212
821
                    return value.__get__(self)
1213
822
        
1214
823
        # No such property
1215
 
        raise DBusPropertyNotFound("{}:{}.{}".format(
1216
 
            self.dbus_object_path, interface_name, property_name))
1217
 
    
1218
 
    @classmethod
1219
 
    def _get_all_interface_names(cls):
1220
 
        """Get a sequence of all interfaces supported by an object"""
1221
 
        return (name for name in set(getattr(getattr(x, attr),
1222
 
                                             "_dbus_interface", None)
1223
 
                                     for x in (inspect.getmro(cls))
1224
 
                                     for attr in dir(x))
1225
 
                if name is not None)
1226
 
    
1227
 
    @dbus.service.method(dbus.PROPERTIES_IFACE,
1228
 
                         in_signature="ss",
 
824
        raise DBusPropertyNotFound(self.dbus_object_path + ":"
 
825
                                   + interface_name + "."
 
826
                                   + property_name)
 
827
    
 
828
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
1229
829
                         out_signature="v")
1230
830
    def Get(self, interface_name, property_name):
1231
831
        """Standard D-Bus property Get() method, see D-Bus standard.
1249
849
            # The byte_arrays option is not supported yet on
1250
850
            # signatures other than "ay".
1251
851
            if prop._dbus_signature != "ay":
1252
 
                raise ValueError("Byte arrays not supported for non-"
1253
 
                                 "'ay' signature {!r}"
1254
 
                                 .format(prop._dbus_signature))
 
852
                raise ValueError
1255
853
            value = dbus.ByteArray(b''.join(chr(byte)
1256
854
                                            for byte in value))
1257
855
        prop(value)
1258
856
    
1259
 
    @dbus.service.method(dbus.PROPERTIES_IFACE,
1260
 
                         in_signature="s",
 
857
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
1261
858
                         out_signature="a{sv}")
1262
859
    def GetAll(self, interface_name):
1263
860
        """Standard D-Bus property GetAll() method, see D-Bus
1266
863
        Note: Will not include properties with access="write".
1267
864
        """
1268
865
        properties = {}
1269
 
        for name, prop in self._get_all_dbus_things("property"):
 
866
        for name, prop in self._get_all_dbus_properties():
1270
867
            if (interface_name
1271
868
                and interface_name != prop._dbus_interface):
1272
869
                # Interface non-empty but did not match
1278
875
            if not hasattr(value, "variant_level"):
1279
876
                properties[name] = value
1280
877
                continue
1281
 
            properties[name] = type(value)(
1282
 
                value, variant_level = value.variant_level + 1)
 
878
            properties[name] = type(value)(value, variant_level=
 
879
                                           value.variant_level+1)
1283
880
        return dbus.Dictionary(properties, signature="sv")
1284
881
    
1285
 
    @dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")
1286
 
    def PropertiesChanged(self, interface_name, changed_properties,
1287
 
                          invalidated_properties):
1288
 
        """Standard D-Bus PropertiesChanged() signal, see D-Bus
1289
 
        standard.
1290
 
        """
1291
 
        pass
1292
 
    
1293
882
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1294
883
                         out_signature="s",
1295
884
                         path_keyword='object_path',
1296
885
                         connection_keyword='connection')
1297
886
    def Introspect(self, object_path, connection):
1298
 
        """Overloading of standard D-Bus method.
1299
 
        
1300
 
        Inserts property tags and interface annotation tags.
 
887
        """Standard D-Bus method, overloaded to insert property tags.
1301
888
        """
1302
 
        xmlstring = DBusObjectWithAnnotations.Introspect(self,
1303
 
                                                         object_path,
1304
 
                                                         connection)
 
889
        xmlstring = dbus.service.Object.Introspect(self, object_path,
 
890
                                                   connection)
1305
891
        try:
1306
892
            document = xml.dom.minidom.parseString(xmlstring)
1307
 
            
1308
893
            def make_tag(document, name, prop):
1309
894
                e = document.createElement("property")
1310
895
                e.setAttribute("name", name)
1311
896
                e.setAttribute("type", prop._dbus_signature)
1312
897
                e.setAttribute("access", prop._dbus_access)
1313
898
                return e
1314
 
            
1315
899
            for if_tag in document.getElementsByTagName("interface"):
1316
 
                # Add property tags
1317
900
                for tag in (make_tag(document, name, prop)
1318
901
                            for name, prop
1319
 
                            in self._get_all_dbus_things("property")
 
902
                            in self._get_all_dbus_properties()
1320
903
                            if prop._dbus_interface
1321
904
                            == if_tag.getAttribute("name")):
1322
905
                    if_tag.appendChild(tag)
1323
 
                # Add annotation tags for properties
1324
 
                for tag in if_tag.getElementsByTagName("property"):
1325
 
                    annots = dict()
1326
 
                    for name, prop in self._get_all_dbus_things(
1327
 
                            "property"):
1328
 
                        if (name == tag.getAttribute("name")
1329
 
                            and prop._dbus_interface
1330
 
                            == if_tag.getAttribute("name")):
1331
 
                            annots.update(getattr(
1332
 
                                prop, "_dbus_annotations", {}))
1333
 
                    for name, value in annots.items():
1334
 
                        ann_tag = document.createElement(
1335
 
                            "annotation")
1336
 
                        ann_tag.setAttribute("name", name)
1337
 
                        ann_tag.setAttribute("value", value)
1338
 
                        tag.appendChild(ann_tag)
1339
906
                # Add the names to the return values for the
1340
907
                # "org.freedesktop.DBus.Properties" methods
1341
908
                if (if_tag.getAttribute("name")
1356
923
        except (AttributeError, xml.dom.DOMException,
1357
924
                xml.parsers.expat.ExpatError) as error:
1358
925
            logger.error("Failed to override Introspection method",
1359
 
                         exc_info=error)
1360
 
        return xmlstring
1361
 
 
1362
 
try:
1363
 
    dbus.OBJECT_MANAGER_IFACE
1364
 
except AttributeError:
1365
 
    dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
1366
 
 
1367
 
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
1368
 
    """A D-Bus object with an ObjectManager.
1369
 
    
1370
 
    Classes inheriting from this exposes the standard
1371
 
    GetManagedObjects call and the InterfacesAdded and
1372
 
    InterfacesRemoved signals on the standard
1373
 
    "org.freedesktop.DBus.ObjectManager" interface.
1374
 
    
1375
 
    Note: No signals are sent automatically; they must be sent
1376
 
    manually.
1377
 
    """
1378
 
    @dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
1379
 
                         out_signature = "a{oa{sa{sv}}}")
1380
 
    def GetManagedObjects(self):
1381
 
        """This function must be overridden"""
1382
 
        raise NotImplementedError()
1383
 
    
1384
 
    @dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
1385
 
                         signature = "oa{sa{sv}}")
1386
 
    def InterfacesAdded(self, object_path, interfaces_and_properties):
1387
 
        pass
1388
 
    
1389
 
    @dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature = "oas")
1390
 
    def InterfacesRemoved(self, object_path, interfaces):
1391
 
        pass
1392
 
    
1393
 
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1394
 
                         out_signature = "s",
1395
 
                         path_keyword = 'object_path',
1396
 
                         connection_keyword = 'connection')
1397
 
    def Introspect(self, object_path, connection):
1398
 
        """Overloading of standard D-Bus method.
1399
 
        
1400
 
        Override return argument name of GetManagedObjects to be
1401
 
        "objpath_interfaces_and_properties"
1402
 
        """
1403
 
        xmlstring = DBusObjectWithAnnotations.Introspect(self,
1404
 
                                                         object_path,
1405
 
                                                         connection)
1406
 
        try:
1407
 
            document = xml.dom.minidom.parseString(xmlstring)
1408
 
            
1409
 
            for if_tag in document.getElementsByTagName("interface"):
1410
 
                # Fix argument name for the GetManagedObjects method
1411
 
                if (if_tag.getAttribute("name")
1412
 
                                == dbus.OBJECT_MANAGER_IFACE):
1413
 
                    for cn in if_tag.getElementsByTagName("method"):
1414
 
                        if (cn.getAttribute("name")
1415
 
                            == "GetManagedObjects"):
1416
 
                            for arg in cn.getElementsByTagName("arg"):
1417
 
                                if (arg.getAttribute("direction")
1418
 
                                    == "out"):
1419
 
                                    arg.setAttribute(
1420
 
                                        "name",
1421
 
                                        "objpath_interfaces"
1422
 
                                        "_and_properties")
1423
 
            xmlstring = document.toxml("utf-8")
1424
 
            document.unlink()
1425
 
        except (AttributeError, xml.dom.DOMException,
1426
 
                xml.parsers.expat.ExpatError) as error:
1427
 
            logger.error("Failed to override Introspection method",
1428
 
                         exc_info = error)
1429
 
        return xmlstring
1430
 
 
1431
 
def datetime_to_dbus(dt, variant_level=0):
 
926
                         error)
 
927
        return xmlstring
 
928
 
 
929
 
 
930
def datetime_to_dbus (dt, variant_level=0):
1432
931
    """Convert a UTC datetime.datetime() to a D-Bus type."""
1433
932
    if dt is None:
1434
933
        return dbus.String("", variant_level = variant_level)
1435
 
    return dbus.String(dt.isoformat(), variant_level=variant_level)
1436
 
 
1437
 
 
1438
 
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
1439
 
    """A class decorator; applied to a subclass of
1440
 
    dbus.service.Object, it will add alternate D-Bus attributes with
1441
 
    interface names according to the "alt_interface_names" mapping.
1442
 
    Usage:
1443
 
    
1444
 
    @alternate_dbus_interfaces({"org.example.Interface":
1445
 
                                    "net.example.AlternateInterface"})
1446
 
    class SampleDBusObject(dbus.service.Object):
1447
 
        @dbus.service.method("org.example.Interface")
1448
 
        def SampleDBusMethod():
1449
 
            pass
1450
 
    
1451
 
    The above "SampleDBusMethod" on "SampleDBusObject" will be
1452
 
    reachable via two interfaces: "org.example.Interface" and
1453
 
    "net.example.AlternateInterface", the latter of which will have
1454
 
    its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
1455
 
    "true", unless "deprecate" is passed with a False value.
1456
 
    
1457
 
    This works for methods and signals, and also for D-Bus properties
1458
 
    (from DBusObjectWithProperties) and interfaces (from the
1459
 
    dbus_interface_annotations decorator).
 
934
    return dbus.String(dt.isoformat(),
 
935
                       variant_level=variant_level)
 
936
 
 
937
 
 
938
class AlternateDBusNamesMetaclass(DBusObjectWithProperties
 
939
                                  .__metaclass__):
 
940
    """Applied to an empty subclass of a D-Bus object, this metaclass
 
941
    will add additional D-Bus attributes matching a certain pattern.
1460
942
    """
1461
 
    
1462
 
    def wrapper(cls):
1463
 
        for orig_interface_name, alt_interface_name in (
1464
 
                alt_interface_names.items()):
1465
 
            attr = {}
1466
 
            interface_names = set()
1467
 
            # Go though all attributes of the class
1468
 
            for attrname, attribute in inspect.getmembers(cls):
 
943
    def __new__(mcs, name, bases, attr):
 
944
        # Go through all the base classes which could have D-Bus
 
945
        # methods, signals, or properties in them
 
946
        for base in (b for b in bases
 
947
                     if issubclass(b, dbus.service.Object)):
 
948
            # Go though all attributes of the base class
 
949
            for attrname, attribute in inspect.getmembers(base):
1469
950
                # Ignore non-D-Bus attributes, and D-Bus attributes
1470
951
                # with the wrong interface name
1471
952
                if (not hasattr(attribute, "_dbus_interface")
1472
 
                    or not attribute._dbus_interface.startswith(
1473
 
                        orig_interface_name)):
 
953
                    or not attribute._dbus_interface
 
954
                    .startswith("se.recompile.Mandos")):
1474
955
                    continue
1475
956
                # Create an alternate D-Bus interface name based on
1476
957
                # the current name
1477
 
                alt_interface = attribute._dbus_interface.replace(
1478
 
                    orig_interface_name, alt_interface_name)
1479
 
                interface_names.add(alt_interface)
 
958
                alt_interface = (attribute._dbus_interface
 
959
                                 .replace("se.recompile.Mandos",
 
960
                                          "se.bsnet.fukt.Mandos"))
1480
961
                # Is this a D-Bus signal?
1481
962
                if getattr(attribute, "_dbus_is_signal", False):
1482
 
                    if sys.version_info.major == 2:
1483
 
                        # Extract the original non-method undecorated
1484
 
                        # function by black magic
1485
 
                        nonmethod_func = (dict(
 
963
                    # Extract the original non-method function by
 
964
                    # black magic
 
965
                    nonmethod_func = (dict(
1486
966
                            zip(attribute.func_code.co_freevars,
1487
 
                                attribute.__closure__))
1488
 
                                          ["func"].cell_contents)
1489
 
                    else:
1490
 
                        nonmethod_func = attribute
 
967
                                attribute.__closure__))["func"]
 
968
                                      .cell_contents)
1491
969
                    # Create a new, but exactly alike, function
1492
970
                    # object, and decorate it to be a new D-Bus signal
1493
971
                    # with the alternate D-Bus interface name
1494
 
                    if sys.version_info.major == 2:
1495
 
                        new_function = types.FunctionType(
1496
 
                            nonmethod_func.func_code,
1497
 
                            nonmethod_func.func_globals,
1498
 
                            nonmethod_func.func_name,
1499
 
                            nonmethod_func.func_defaults,
1500
 
                            nonmethod_func.func_closure)
1501
 
                    else:
1502
 
                        new_function = types.FunctionType(
1503
 
                            nonmethod_func.__code__,
1504
 
                            nonmethod_func.__globals__,
1505
 
                            nonmethod_func.__name__,
1506
 
                            nonmethod_func.__defaults__,
1507
 
                            nonmethod_func.__closure__)
1508
 
                    new_function = (dbus.service.signal(
1509
 
                        alt_interface,
1510
 
                        attribute._dbus_signature)(new_function))
1511
 
                    # Copy annotations, if any
1512
 
                    try:
1513
 
                        new_function._dbus_annotations = dict(
1514
 
                            attribute._dbus_annotations)
1515
 
                    except AttributeError:
1516
 
                        pass
 
972
                    new_function = (dbus.service.signal
 
973
                                    (alt_interface,
 
974
                                     attribute._dbus_signature)
 
975
                                    (types.FunctionType(
 
976
                                nonmethod_func.func_code,
 
977
                                nonmethod_func.func_globals,
 
978
                                nonmethod_func.func_name,
 
979
                                nonmethod_func.func_defaults,
 
980
                                nonmethod_func.func_closure)))
1517
981
                    # Define a creator of a function to call both the
1518
 
                    # original and alternate functions, so both the
1519
 
                    # original and alternate signals gets sent when
1520
 
                    # the function is called
 
982
                    # old and new functions, so both the old and new
 
983
                    # signals gets sent when the function is called
1521
984
                    def fixscope(func1, func2):
1522
985
                        """This function is a scope container to pass
1523
986
                        func1 and func2 to the "call_both" function
1524
987
                        outside of its arguments"""
1525
 
                        
1526
 
                        @functools.wraps(func2)
1527
988
                        def call_both(*args, **kwargs):
1528
989
                            """This function will emit two D-Bus
1529
990
                            signals by calling func1 and func2"""
1530
991
                            func1(*args, **kwargs)
1531
992
                            func2(*args, **kwargs)
1532
 
                        # Make wrapper function look like a D-Bus signal
1533
 
                        for name, attr in inspect.getmembers(func2):
1534
 
                            if name.startswith("_dbus_"):
1535
 
                                setattr(call_both, name, attr)
1536
 
                        
1537
993
                        return call_both
1538
994
                    # Create the "call_both" function and add it to
1539
995
                    # the class
1540
 
                    attr[attrname] = fixscope(attribute, new_function)
 
996
                    attr[attrname] = fixscope(attribute,
 
997
                                              new_function)
1541
998
                # Is this a D-Bus method?
1542
999
                elif getattr(attribute, "_dbus_is_method", False):
1543
1000
                    # Create a new, but exactly alike, function
1544
1001
                    # object.  Decorate it to be a new D-Bus method
1545
1002
                    # with the alternate D-Bus interface name.  Add it
1546
1003
                    # to the class.
1547
 
                    attr[attrname] = (
1548
 
                        dbus.service.method(
1549
 
                            alt_interface,
1550
 
                            attribute._dbus_in_signature,
1551
 
                            attribute._dbus_out_signature)
1552
 
                        (types.FunctionType(attribute.func_code,
1553
 
                                            attribute.func_globals,
1554
 
                                            attribute.func_name,
1555
 
                                            attribute.func_defaults,
1556
 
                                            attribute.func_closure)))
1557
 
                    # Copy annotations, if any
1558
 
                    try:
1559
 
                        attr[attrname]._dbus_annotations = dict(
1560
 
                            attribute._dbus_annotations)
1561
 
                    except AttributeError:
1562
 
                        pass
 
1004
                    attr[attrname] = (dbus.service.method
 
1005
                                      (alt_interface,
 
1006
                                       attribute._dbus_in_signature,
 
1007
                                       attribute._dbus_out_signature)
 
1008
                                      (types.FunctionType
 
1009
                                       (attribute.func_code,
 
1010
                                        attribute.func_globals,
 
1011
                                        attribute.func_name,
 
1012
                                        attribute.func_defaults,
 
1013
                                        attribute.func_closure)))
1563
1014
                # Is this a D-Bus property?
1564
1015
                elif getattr(attribute, "_dbus_is_property", False):
1565
1016
                    # Create a new, but exactly alike, function
1566
1017
                    # object, and decorate it to be a new D-Bus
1567
1018
                    # property with the alternate D-Bus interface
1568
1019
                    # name.  Add it to the class.
1569
 
                    attr[attrname] = (dbus_service_property(
1570
 
                        alt_interface, attribute._dbus_signature,
1571
 
                        attribute._dbus_access,
1572
 
                        attribute._dbus_get_args_options
1573
 
                        ["byte_arrays"])
1574
 
                                      (types.FunctionType(
1575
 
                                          attribute.func_code,
1576
 
                                          attribute.func_globals,
1577
 
                                          attribute.func_name,
1578
 
                                          attribute.func_defaults,
1579
 
                                          attribute.func_closure)))
1580
 
                    # Copy annotations, if any
1581
 
                    try:
1582
 
                        attr[attrname]._dbus_annotations = dict(
1583
 
                            attribute._dbus_annotations)
1584
 
                    except AttributeError:
1585
 
                        pass
1586
 
                # Is this a D-Bus interface?
1587
 
                elif getattr(attribute, "_dbus_is_interface", False):
1588
 
                    # Create a new, but exactly alike, function
1589
 
                    # object.  Decorate it to be a new D-Bus interface
1590
 
                    # with the alternate D-Bus interface name.  Add it
1591
 
                    # to the class.
1592
 
                    attr[attrname] = (
1593
 
                        dbus_interface_annotations(alt_interface)
1594
 
                        (types.FunctionType(attribute.func_code,
1595
 
                                            attribute.func_globals,
1596
 
                                            attribute.func_name,
1597
 
                                            attribute.func_defaults,
1598
 
                                            attribute.func_closure)))
1599
 
            if deprecate:
1600
 
                # Deprecate all alternate interfaces
1601
 
                iname="_AlternateDBusNames_interface_annotation{}"
1602
 
                for interface_name in interface_names:
1603
 
                    
1604
 
                    @dbus_interface_annotations(interface_name)
1605
 
                    def func(self):
1606
 
                        return { "org.freedesktop.DBus.Deprecated":
1607
 
                                 "true" }
1608
 
                    # Find an unused name
1609
 
                    for aname in (iname.format(i)
1610
 
                                  for i in itertools.count()):
1611
 
                        if aname not in attr:
1612
 
                            attr[aname] = func
1613
 
                            break
1614
 
            if interface_names:
1615
 
                # Replace the class with a new subclass of it with
1616
 
                # methods, signals, etc. as created above.
1617
 
                cls = type(b"{}Alternate".format(cls.__name__),
1618
 
                           (cls, ), attr)
1619
 
        return cls
1620
 
    
1621
 
    return wrapper
1622
 
 
1623
 
 
1624
 
@alternate_dbus_interfaces({"se.recompile.Mandos":
1625
 
                            "se.bsnet.fukt.Mandos"})
 
1020
                    attr[attrname] = (dbus_service_property
 
1021
                                      (alt_interface,
 
1022
                                       attribute._dbus_signature,
 
1023
                                       attribute._dbus_access,
 
1024
                                       attribute
 
1025
                                       ._dbus_get_args_options
 
1026
                                       ["byte_arrays"])
 
1027
                                      (types.FunctionType
 
1028
                                       (attribute.func_code,
 
1029
                                        attribute.func_globals,
 
1030
                                        attribute.func_name,
 
1031
                                        attribute.func_defaults,
 
1032
                                        attribute.func_closure)))
 
1033
        return type.__new__(mcs, name, bases, attr)
 
1034
 
 
1035
 
1626
1036
class ClientDBus(Client, DBusObjectWithProperties):
1627
1037
    """A Client class using D-Bus
1628
1038
    
1632
1042
    """
1633
1043
    
1634
1044
    runtime_expansions = (Client.runtime_expansions
1635
 
                          + ("dbus_object_path", ))
1636
 
    
1637
 
    _interface = "se.recompile.Mandos.Client"
 
1045
                          + ("dbus_object_path",))
1638
1046
    
1639
1047
    # dbus.service.Object doesn't use super(), so we can't either.
1640
1048
    
1643
1051
        Client.__init__(self, *args, **kwargs)
1644
1052
        # Only now, when this client is initialized, can it show up on
1645
1053
        # the D-Bus
1646
 
        client_object_name = str(self.name).translate(
 
1054
        client_object_name = unicode(self.name).translate(
1647
1055
            {ord("."): ord("_"),
1648
1056
             ord("-"): ord("_")})
1649
 
        self.dbus_object_path = dbus.ObjectPath(
1650
 
            "/clients/" + client_object_name)
 
1057
        self.dbus_object_path = (dbus.ObjectPath
 
1058
                                 ("/clients/" + client_object_name))
1651
1059
        DBusObjectWithProperties.__init__(self, self.bus,
1652
1060
                                          self.dbus_object_path)
1653
 
    
1654
 
    def notifychangeproperty(transform_func, dbus_name,
1655
 
                             type_func=lambda x: x,
1656
 
                             variant_level=1,
1657
 
                             invalidate_only=False,
1658
 
                             _interface=_interface):
 
1061
        
 
1062
    def notifychangeproperty(transform_func,
 
1063
                             dbus_name, type_func=lambda x: x,
 
1064
                             variant_level=1):
1659
1065
        """ Modify a variable so that it's a property which announces
1660
1066
        its changes to DBus.
1661
1067
        
1666
1072
                   to the D-Bus.  Default: no transform
1667
1073
        variant_level: D-Bus variant level.  Default: 1
1668
1074
        """
1669
 
        attrname = "_{}".format(dbus_name)
1670
 
        
 
1075
        attrname = "_{0}".format(dbus_name)
1671
1076
        def setter(self, value):
1672
1077
            if hasattr(self, "dbus_object_path"):
1673
1078
                if (not hasattr(self, attrname) or
1674
1079
                    type_func(getattr(self, attrname, None))
1675
1080
                    != type_func(value)):
1676
 
                    if invalidate_only:
1677
 
                        self.PropertiesChanged(
1678
 
                            _interface, dbus.Dictionary(),
1679
 
                            dbus.Array((dbus_name, )))
1680
 
                    else:
1681
 
                        dbus_value = transform_func(
1682
 
                            type_func(value),
1683
 
                            variant_level = variant_level)
1684
 
                        self.PropertyChanged(dbus.String(dbus_name),
1685
 
                                             dbus_value)
1686
 
                        self.PropertiesChanged(
1687
 
                            _interface,
1688
 
                            dbus.Dictionary({ dbus.String(dbus_name):
1689
 
                                              dbus_value }),
1690
 
                            dbus.Array())
 
1081
                    dbus_value = transform_func(type_func(value),
 
1082
                                                variant_level
 
1083
                                                =variant_level)
 
1084
                    self.PropertyChanged(dbus.String(dbus_name),
 
1085
                                         dbus_value)
1691
1086
            setattr(self, attrname, value)
1692
1087
        
1693
1088
        return property(lambda self: getattr(self, attrname), setter)
1694
1089
    
 
1090
    
1695
1091
    expires = notifychangeproperty(datetime_to_dbus, "Expires")
1696
1092
    approvals_pending = notifychangeproperty(dbus.Boolean,
1697
1093
                                             "ApprovalPending",
1699
1095
    enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1700
1096
    last_enabled = notifychangeproperty(datetime_to_dbus,
1701
1097
                                        "LastEnabled")
1702
 
    checker = notifychangeproperty(
1703
 
        dbus.Boolean, "CheckerRunning",
1704
 
        type_func = lambda checker: checker is not None)
 
1098
    checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",
 
1099
                                   type_func = lambda checker:
 
1100
                                       checker is not None)
1705
1101
    last_checked_ok = notifychangeproperty(datetime_to_dbus,
1706
1102
                                           "LastCheckedOK")
1707
 
    last_checker_status = notifychangeproperty(dbus.Int16,
1708
 
                                               "LastCheckerStatus")
1709
1103
    last_approval_request = notifychangeproperty(
1710
1104
        datetime_to_dbus, "LastApprovalRequest")
1711
1105
    approved_by_default = notifychangeproperty(dbus.Boolean,
1712
1106
                                               "ApprovedByDefault")
1713
 
    approval_delay = notifychangeproperty(
1714
 
        dbus.UInt64, "ApprovalDelay",
1715
 
        type_func = lambda td: td.total_seconds() * 1000)
 
1107
    approval_delay = notifychangeproperty(dbus.UInt64,
 
1108
                                          "ApprovalDelay",
 
1109
                                          type_func =
 
1110
                                          timedelta_to_milliseconds)
1716
1111
    approval_duration = notifychangeproperty(
1717
1112
        dbus.UInt64, "ApprovalDuration",
1718
 
        type_func = lambda td: td.total_seconds() * 1000)
 
1113
        type_func = timedelta_to_milliseconds)
1719
1114
    host = notifychangeproperty(dbus.String, "Host")
1720
 
    timeout = notifychangeproperty(
1721
 
        dbus.UInt64, "Timeout",
1722
 
        type_func = lambda td: td.total_seconds() * 1000)
 
1115
    timeout = notifychangeproperty(dbus.UInt64, "Timeout",
 
1116
                                   type_func =
 
1117
                                   timedelta_to_milliseconds)
1723
1118
    extended_timeout = notifychangeproperty(
1724
1119
        dbus.UInt64, "ExtendedTimeout",
1725
 
        type_func = lambda td: td.total_seconds() * 1000)
1726
 
    interval = notifychangeproperty(
1727
 
        dbus.UInt64, "Interval",
1728
 
        type_func = lambda td: td.total_seconds() * 1000)
 
1120
        type_func = timedelta_to_milliseconds)
 
1121
    interval = notifychangeproperty(dbus.UInt64,
 
1122
                                    "Interval",
 
1123
                                    type_func =
 
1124
                                    timedelta_to_milliseconds)
1729
1125
    checker_command = notifychangeproperty(dbus.String, "Checker")
1730
 
    secret = notifychangeproperty(dbus.ByteArray, "Secret",
1731
 
                                  invalidate_only=True)
1732
1126
    
1733
1127
    del notifychangeproperty
1734
1128
    
1741
1135
            DBusObjectWithProperties.__del__(self, *args, **kwargs)
1742
1136
        Client.__del__(self, *args, **kwargs)
1743
1137
    
1744
 
    def checker_callback(self, source, condition,
1745
 
                         connection, command, *args, **kwargs):
1746
 
        ret = Client.checker_callback(self, source, condition,
1747
 
                                      connection, command, *args,
1748
 
                                      **kwargs)
1749
 
        exitstatus = self.last_checker_status
1750
 
        if exitstatus >= 0:
 
1138
    def checker_callback(self, pid, condition, command,
 
1139
                         *args, **kwargs):
 
1140
        self.checker_callback_tag = None
 
1141
        self.checker = None
 
1142
        if os.WIFEXITED(condition):
 
1143
            exitstatus = os.WEXITSTATUS(condition)
1751
1144
            # Emit D-Bus signal
1752
1145
            self.CheckerCompleted(dbus.Int16(exitstatus),
1753
 
                                  # This is specific to GNU libC
1754
 
                                  dbus.Int64(exitstatus << 8),
 
1146
                                  dbus.Int64(condition),
1755
1147
                                  dbus.String(command))
1756
1148
        else:
1757
1149
            # Emit D-Bus signal
1758
1150
            self.CheckerCompleted(dbus.Int16(-1),
1759
 
                                  dbus.Int64(
1760
 
                                      # This is specific to GNU libC
1761
 
                                      (exitstatus << 8)
1762
 
                                      | self.last_checker_signal),
 
1151
                                  dbus.Int64(condition),
1763
1152
                                  dbus.String(command))
1764
 
        return ret
 
1153
        
 
1154
        return Client.checker_callback(self, pid, condition, command,
 
1155
                                       *args, **kwargs)
1765
1156
    
1766
1157
    def start_checker(self, *args, **kwargs):
1767
 
        old_checker_pid = getattr(self.checker, "pid", None)
 
1158
        old_checker = self.checker
 
1159
        if self.checker is not None:
 
1160
            old_checker_pid = self.checker.pid
 
1161
        else:
 
1162
            old_checker_pid = None
1768
1163
        r = Client.start_checker(self, *args, **kwargs)
1769
1164
        # Only if new checker process was started
1770
1165
        if (self.checker is not None
1778
1173
        return False
1779
1174
    
1780
1175
    def approve(self, value=True):
 
1176
        self.send_changedstate()
1781
1177
        self.approved = value
1782
 
        gobject.timeout_add(int(self.approval_duration.total_seconds()
1783
 
                                * 1000), self._reset_approved)
1784
 
        self.send_changedstate()
 
1178
        gobject.timeout_add(timedelta_to_milliseconds
 
1179
                            (self.approval_duration),
 
1180
                            self._reset_approved)
 
1181
    
1785
1182
    
1786
1183
    ## D-Bus methods, signals & properties
1787
 
    
1788
 
    ## Interfaces
 
1184
    _interface = "se.recompile.Mandos.Client"
1789
1185
    
1790
1186
    ## Signals
1791
1187
    
1802
1198
        pass
1803
1199
    
1804
1200
    # PropertyChanged - signal
1805
 
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1806
1201
    @dbus.service.signal(_interface, signature="sv")
1807
1202
    def PropertyChanged(self, property, value):
1808
1203
        "D-Bus signal"
1842
1237
        self.checked_ok()
1843
1238
    
1844
1239
    # Enable - method
1845
 
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1846
1240
    @dbus.service.method(_interface)
1847
1241
    def Enable(self):
1848
1242
        "D-Bus method"
1849
1243
        self.enable()
1850
1244
    
1851
1245
    # StartChecker - method
1852
 
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1853
1246
    @dbus.service.method(_interface)
1854
1247
    def StartChecker(self):
1855
1248
        "D-Bus method"
1856
1249
        self.start_checker()
1857
1250
    
1858
1251
    # Disable - method
1859
 
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1860
1252
    @dbus.service.method(_interface)
1861
1253
    def Disable(self):
1862
1254
        "D-Bus method"
1863
1255
        self.disable()
1864
1256
    
1865
1257
    # StopChecker - method
1866
 
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1867
1258
    @dbus.service.method(_interface)
1868
1259
    def StopChecker(self):
1869
1260
        self.stop_checker()
1876
1267
        return dbus.Boolean(bool(self.approvals_pending))
1877
1268
    
1878
1269
    # ApprovedByDefault - property
1879
 
    @dbus_service_property(_interface,
1880
 
                           signature="b",
 
1270
    @dbus_service_property(_interface, signature="b",
1881
1271
                           access="readwrite")
1882
1272
    def ApprovedByDefault_dbus_property(self, value=None):
1883
1273
        if value is None:       # get
1885
1275
        self.approved_by_default = bool(value)
1886
1276
    
1887
1277
    # ApprovalDelay - property
1888
 
    @dbus_service_property(_interface,
1889
 
                           signature="t",
 
1278
    @dbus_service_property(_interface, signature="t",
1890
1279
                           access="readwrite")
1891
1280
    def ApprovalDelay_dbus_property(self, value=None):
1892
1281
        if value is None:       # get
1893
 
            return dbus.UInt64(self.approval_delay.total_seconds()
1894
 
                               * 1000)
 
1282
            return dbus.UInt64(self.approval_delay_milliseconds())
1895
1283
        self.approval_delay = datetime.timedelta(0, 0, 0, value)
1896
1284
    
1897
1285
    # ApprovalDuration - property
1898
 
    @dbus_service_property(_interface,
1899
 
                           signature="t",
 
1286
    @dbus_service_property(_interface, signature="t",
1900
1287
                           access="readwrite")
1901
1288
    def ApprovalDuration_dbus_property(self, value=None):
1902
1289
        if value is None:       # get
1903
 
            return dbus.UInt64(self.approval_duration.total_seconds()
1904
 
                               * 1000)
 
1290
            return dbus.UInt64(timedelta_to_milliseconds(
 
1291
                    self.approval_duration))
1905
1292
        self.approval_duration = datetime.timedelta(0, 0, 0, value)
1906
1293
    
1907
1294
    # Name - property
1908
 
    @dbus_annotations(
1909
 
        {"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1910
1295
    @dbus_service_property(_interface, signature="s", access="read")
1911
1296
    def Name_dbus_property(self):
1912
1297
        return dbus.String(self.name)
1913
1298
    
1914
1299
    # Fingerprint - property
1915
 
    @dbus_annotations(
1916
 
        {"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1917
1300
    @dbus_service_property(_interface, signature="s", access="read")
1918
1301
    def Fingerprint_dbus_property(self):
1919
1302
        return dbus.String(self.fingerprint)
1920
1303
    
1921
1304
    # Host - property
1922
 
    @dbus_service_property(_interface,
1923
 
                           signature="s",
 
1305
    @dbus_service_property(_interface, signature="s",
1924
1306
                           access="readwrite")
1925
1307
    def Host_dbus_property(self, value=None):
1926
1308
        if value is None:       # get
1927
1309
            return dbus.String(self.host)
1928
 
        self.host = str(value)
 
1310
        self.host = unicode(value)
1929
1311
    
1930
1312
    # Created - property
1931
 
    @dbus_annotations(
1932
 
        {"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1933
1313
    @dbus_service_property(_interface, signature="s", access="read")
1934
1314
    def Created_dbus_property(self):
1935
1315
        return datetime_to_dbus(self.created)
1940
1320
        return datetime_to_dbus(self.last_enabled)
1941
1321
    
1942
1322
    # Enabled - property
1943
 
    @dbus_service_property(_interface,
1944
 
                           signature="b",
 
1323
    @dbus_service_property(_interface, signature="b",
1945
1324
                           access="readwrite")
1946
1325
    def Enabled_dbus_property(self, value=None):
1947
1326
        if value is None:       # get
1952
1331
            self.disable()
1953
1332
    
1954
1333
    # LastCheckedOK - property
1955
 
    @dbus_service_property(_interface,
1956
 
                           signature="s",
 
1334
    @dbus_service_property(_interface, signature="s",
1957
1335
                           access="readwrite")
1958
1336
    def LastCheckedOK_dbus_property(self, value=None):
1959
1337
        if value is not None:
1961
1339
            return
1962
1340
        return datetime_to_dbus(self.last_checked_ok)
1963
1341
    
1964
 
    # LastCheckerStatus - property
1965
 
    @dbus_service_property(_interface, signature="n", access="read")
1966
 
    def LastCheckerStatus_dbus_property(self):
1967
 
        return dbus.Int16(self.last_checker_status)
1968
 
    
1969
1342
    # Expires - property
1970
1343
    @dbus_service_property(_interface, signature="s", access="read")
1971
1344
    def Expires_dbus_property(self):
1977
1350
        return datetime_to_dbus(self.last_approval_request)
1978
1351
    
1979
1352
    # Timeout - property
1980
 
    @dbus_service_property(_interface,
1981
 
                           signature="t",
 
1353
    @dbus_service_property(_interface, signature="t",
1982
1354
                           access="readwrite")
1983
1355
    def Timeout_dbus_property(self, value=None):
1984
1356
        if value is None:       # get
1985
 
            return dbus.UInt64(self.timeout.total_seconds() * 1000)
1986
 
        old_timeout = self.timeout
 
1357
            return dbus.UInt64(self.timeout_milliseconds())
1987
1358
        self.timeout = datetime.timedelta(0, 0, 0, value)
1988
 
        # Reschedule disabling
 
1359
        # Reschedule timeout
1989
1360
        if self.enabled:
1990
1361
            now = datetime.datetime.utcnow()
1991
 
            self.expires += self.timeout - old_timeout
1992
 
            if self.expires <= now:
 
1362
            time_to_die = timedelta_to_milliseconds(
 
1363
                (self.last_checked_ok + self.timeout) - now)
 
1364
            if time_to_die <= 0:
1993
1365
                # The timeout has passed
1994
1366
                self.disable()
1995
1367
            else:
 
1368
                self.expires = (now +
 
1369
                                datetime.timedelta(milliseconds =
 
1370
                                                   time_to_die))
1996
1371
                if (getattr(self, "disable_initiator_tag", None)
1997
1372
                    is None):
1998
1373
                    return
1999
1374
                gobject.source_remove(self.disable_initiator_tag)
2000
 
                self.disable_initiator_tag = gobject.timeout_add(
2001
 
                    int((self.expires - now).total_seconds() * 1000),
2002
 
                    self.disable)
 
1375
                self.disable_initiator_tag = (gobject.timeout_add
 
1376
                                              (time_to_die,
 
1377
                                               self.disable))
2003
1378
    
2004
1379
    # ExtendedTimeout - property
2005
 
    @dbus_service_property(_interface,
2006
 
                           signature="t",
 
1380
    @dbus_service_property(_interface, signature="t",
2007
1381
                           access="readwrite")
2008
1382
    def ExtendedTimeout_dbus_property(self, value=None):
2009
1383
        if value is None:       # get
2010
 
            return dbus.UInt64(self.extended_timeout.total_seconds()
2011
 
                               * 1000)
 
1384
            return dbus.UInt64(self.extended_timeout_milliseconds())
2012
1385
        self.extended_timeout = datetime.timedelta(0, 0, 0, value)
2013
1386
    
2014
1387
    # Interval - property
2015
 
    @dbus_service_property(_interface,
2016
 
                           signature="t",
 
1388
    @dbus_service_property(_interface, signature="t",
2017
1389
                           access="readwrite")
2018
1390
    def Interval_dbus_property(self, value=None):
2019
1391
        if value is None:       # get
2020
 
            return dbus.UInt64(self.interval.total_seconds() * 1000)
 
1392
            return dbus.UInt64(self.interval_milliseconds())
2021
1393
        self.interval = datetime.timedelta(0, 0, 0, value)
2022
1394
        if getattr(self, "checker_initiator_tag", None) is None:
2023
1395
            return
2024
1396
        if self.enabled:
2025
1397
            # Reschedule checker run
2026
1398
            gobject.source_remove(self.checker_initiator_tag)
2027
 
            self.checker_initiator_tag = gobject.timeout_add(
2028
 
                value, self.start_checker)
2029
 
            self.start_checker() # Start one now, too
 
1399
            self.checker_initiator_tag = (gobject.timeout_add
 
1400
                                          (value, self.start_checker))
 
1401
            self.start_checker()    # Start one now, too
2030
1402
    
2031
1403
    # Checker - property
2032
 
    @dbus_service_property(_interface,
2033
 
                           signature="s",
 
1404
    @dbus_service_property(_interface, signature="s",
2034
1405
                           access="readwrite")
2035
1406
    def Checker_dbus_property(self, value=None):
2036
1407
        if value is None:       # get
2037
1408
            return dbus.String(self.checker_command)
2038
 
        self.checker_command = str(value)
 
1409
        self.checker_command = unicode(value)
2039
1410
    
2040
1411
    # CheckerRunning - property
2041
 
    @dbus_service_property(_interface,
2042
 
                           signature="b",
 
1412
    @dbus_service_property(_interface, signature="b",
2043
1413
                           access="readwrite")
2044
1414
    def CheckerRunning_dbus_property(self, value=None):
2045
1415
        if value is None:       # get
2050
1420
            self.stop_checker()
2051
1421
    
2052
1422
    # ObjectPath - property
2053
 
    @dbus_annotations(
2054
 
        {"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",
2055
 
         "org.freedesktop.DBus.Deprecated": "true"})
2056
1423
    @dbus_service_property(_interface, signature="o", access="read")
2057
1424
    def ObjectPath_dbus_property(self):
2058
1425
        return self.dbus_object_path # is already a dbus.ObjectPath
2059
1426
    
2060
1427
    # Secret = property
2061
 
    @dbus_annotations(
2062
 
        {"org.freedesktop.DBus.Property.EmitsChangedSignal":
2063
 
         "invalidates"})
2064
 
    @dbus_service_property(_interface,
2065
 
                           signature="ay",
2066
 
                           access="write",
2067
 
                           byte_arrays=True)
 
1428
    @dbus_service_property(_interface, signature="ay",
 
1429
                           access="write", byte_arrays=True)
2068
1430
    def Secret_dbus_property(self, value):
2069
 
        self.secret = bytes(value)
 
1431
        self.secret = str(value)
2070
1432
    
2071
1433
    del _interface
2072
1434
 
2076
1438
        self._pipe = child_pipe
2077
1439
        self._pipe.send(('init', fpr, address))
2078
1440
        if not self._pipe.recv():
2079
 
            raise KeyError(fpr)
 
1441
            raise KeyError()
2080
1442
    
2081
1443
    def __getattribute__(self, name):
2082
1444
        if name == '_pipe':
2086
1448
        if data[0] == 'data':
2087
1449
            return data[1]
2088
1450
        if data[0] == 'function':
2089
 
            
2090
1451
            def func(*args, **kwargs):
2091
1452
                self._pipe.send(('funcall', name, args, kwargs))
2092
1453
                return self._pipe.recv()[1]
2093
 
            
2094
1454
            return func
2095
1455
    
2096
1456
    def __setattr__(self, name, value):
2099
1459
        self._pipe.send(('setattr', name, value))
2100
1460
 
2101
1461
 
 
1462
class ClientDBusTransitional(ClientDBus):
 
1463
    __metaclass__ = AlternateDBusNamesMetaclass
 
1464
 
 
1465
 
2102
1466
class ClientHandler(socketserver.BaseRequestHandler, object):
2103
1467
    """A class to handle client connections.
2104
1468
    
2108
1472
    def handle(self):
2109
1473
        with contextlib.closing(self.server.child_pipe) as child_pipe:
2110
1474
            logger.info("TCP connection from: %s",
2111
 
                        str(self.client_address))
 
1475
                        unicode(self.client_address))
2112
1476
            logger.debug("Pipe FD: %d",
2113
1477
                         self.server.child_pipe.fileno())
2114
1478
            
2115
 
            session = gnutls.ClientSession(self.request)
 
1479
            session = (gnutls.connection
 
1480
                       .ClientSession(self.request,
 
1481
                                      gnutls.connection
 
1482
                                      .X509Credentials()))
 
1483
            
 
1484
            # Note: gnutls.connection.X509Credentials is really a
 
1485
            # generic GnuTLS certificate credentials object so long as
 
1486
            # no X.509 keys are added to it.  Therefore, we can use it
 
1487
            # here despite using OpenPGP certificates.
2116
1488
            
2117
1489
            #priority = ':'.join(("NONE", "+VERS-TLS1.1",
2118
1490
            #                      "+AES-256-CBC", "+SHA1",
2122
1494
            priority = self.server.gnutls_priority
2123
1495
            if priority is None:
2124
1496
                priority = "NORMAL"
2125
 
            gnutls.priority_set_direct(session._c_object, priority,
2126
 
                                       None)
 
1497
            (gnutls.library.functions
 
1498
             .gnutls_priority_set_direct(session._c_object,
 
1499
                                         priority, None))
2127
1500
            
2128
1501
            # Start communication using the Mandos protocol
2129
1502
            # Get protocol number
2131
1504
            logger.debug("Protocol version: %r", line)
2132
1505
            try:
2133
1506
                if int(line.strip().split()[0]) > 1:
2134
 
                    raise RuntimeError(line)
 
1507
                    raise RuntimeError
2135
1508
            except (ValueError, IndexError, RuntimeError) as error:
2136
1509
                logger.error("Unknown protocol version: %s", error)
2137
1510
                return
2139
1512
            # Start GnuTLS connection
2140
1513
            try:
2141
1514
                session.handshake()
2142
 
            except gnutls.Error as error:
 
1515
            except gnutls.errors.GNUTLSError as error:
2143
1516
                logger.warning("Handshake failed: %s", error)
2144
1517
                # Do not run session.bye() here: the session is not
2145
1518
                # established.  Just abandon the request.
2149
1522
            approval_required = False
2150
1523
            try:
2151
1524
                try:
2152
 
                    fpr = self.fingerprint(
2153
 
                        self.peer_certificate(session))
2154
 
                except (TypeError, gnutls.Error) as error:
 
1525
                    fpr = self.fingerprint(self.peer_certificate
 
1526
                                           (session))
 
1527
                except (TypeError,
 
1528
                        gnutls.errors.GNUTLSError) as error:
2155
1529
                    logger.warning("Bad certificate: %s", error)
2156
1530
                    return
2157
1531
                logger.debug("Fingerprint: %s", fpr)
2170
1544
                while True:
2171
1545
                    if not client.enabled:
2172
1546
                        logger.info("Client %s is disabled",
2173
 
                                    client.name)
 
1547
                                       client.name)
2174
1548
                        if self.server.use_dbus:
2175
1549
                            # Emit D-Bus signal
2176
1550
                            client.Rejected("Disabled")
2185
1559
                        if self.server.use_dbus:
2186
1560
                            # Emit D-Bus signal
2187
1561
                            client.NeedApproval(
2188
 
                                client.approval_delay.total_seconds()
2189
 
                                * 1000, client.approved_by_default)
 
1562
                                client.approval_delay_milliseconds(),
 
1563
                                client.approved_by_default)
2190
1564
                    else:
2191
1565
                        logger.warning("Client %s was not approved",
2192
1566
                                       client.name)
2198
1572
                    #wait until timeout or approved
2199
1573
                    time = datetime.datetime.now()
2200
1574
                    client.changedstate.acquire()
2201
 
                    client.changedstate.wait(delay.total_seconds())
 
1575
                    (client.changedstate.wait
 
1576
                     (float(client.timedelta_to_milliseconds(delay)
 
1577
                            / 1000)))
2202
1578
                    client.changedstate.release()
2203
1579
                    time2 = datetime.datetime.now()
2204
1580
                    if (time2 - time) >= delay:
2219
1595
                while sent_size < len(client.secret):
2220
1596
                    try:
2221
1597
                        sent = session.send(client.secret[sent_size:])
2222
 
                    except gnutls.Error as error:
2223
 
                        logger.warning("gnutls send failed",
2224
 
                                       exc_info=error)
 
1598
                    except gnutls.errors.GNUTLSError as error:
 
1599
                        logger.warning("gnutls send failed")
2225
1600
                        return
2226
 
                    logger.debug("Sent: %d, remaining: %d", sent,
2227
 
                                 len(client.secret) - (sent_size
2228
 
                                                       + sent))
 
1601
                    logger.debug("Sent: %d, remaining: %d",
 
1602
                                 sent, len(client.secret)
 
1603
                                 - (sent_size + sent))
2229
1604
                    sent_size += sent
2230
1605
                
2231
1606
                logger.info("Sending secret to %s", client.name)
2232
1607
                # bump the timeout using extended_timeout
2233
 
                client.bump_timeout(client.extended_timeout)
 
1608
                client.checked_ok(client.extended_timeout)
2234
1609
                if self.server.use_dbus:
2235
1610
                    # Emit D-Bus signal
2236
1611
                    client.GotSecret()
2240
1615
                    client.approvals_pending -= 1
2241
1616
                try:
2242
1617
                    session.bye()
2243
 
                except gnutls.Error as error:
2244
 
                    logger.warning("GnuTLS bye failed",
2245
 
                                   exc_info=error)
 
1618
                except gnutls.errors.GNUTLSError as error:
 
1619
                    logger.warning("GnuTLS bye failed")
2246
1620
    
2247
1621
    @staticmethod
2248
1622
    def peer_certificate(session):
2249
1623
        "Return the peer's OpenPGP certificate as a bytestring"
2250
1624
        # If not an OpenPGP certificate...
2251
 
        if (gnutls.certificate_type_get(session._c_object)
2252
 
            != gnutls.CRT_OPENPGP):
2253
 
            # ...return invalid data
2254
 
            return b""
 
1625
        if (gnutls.library.functions
 
1626
            .gnutls_certificate_type_get(session._c_object)
 
1627
            != gnutls.library.constants.GNUTLS_CRT_OPENPGP):
 
1628
            # ...do the normal thing
 
1629
            return session.peer_certificate
2255
1630
        list_size = ctypes.c_uint(1)
2256
 
        cert_list = (gnutls.certificate_get_peers
 
1631
        cert_list = (gnutls.library.functions
 
1632
                     .gnutls_certificate_get_peers
2257
1633
                     (session._c_object, ctypes.byref(list_size)))
2258
1634
        if not bool(cert_list) and list_size.value != 0:
2259
 
            raise gnutls.Error("error getting peer certificate")
 
1635
            raise gnutls.errors.GNUTLSError("error getting peer"
 
1636
                                            " certificate")
2260
1637
        if list_size.value == 0:
2261
1638
            return None
2262
1639
        cert = cert_list[0]
2266
1643
    def fingerprint(openpgp):
2267
1644
        "Convert an OpenPGP bytestring to a hexdigit fingerprint"
2268
1645
        # New GnuTLS "datum" with the OpenPGP public key
2269
 
        datum = gnutls.datum_t(
2270
 
            ctypes.cast(ctypes.c_char_p(openpgp),
2271
 
                        ctypes.POINTER(ctypes.c_ubyte)),
2272
 
            ctypes.c_uint(len(openpgp)))
 
1646
        datum = (gnutls.library.types
 
1647
                 .gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
 
1648
                                             ctypes.POINTER
 
1649
                                             (ctypes.c_ubyte)),
 
1650
                                 ctypes.c_uint(len(openpgp))))
2273
1651
        # New empty GnuTLS certificate
2274
 
        crt = gnutls.openpgp_crt_t()
2275
 
        gnutls.openpgp_crt_init(ctypes.byref(crt))
 
1652
        crt = gnutls.library.types.gnutls_openpgp_crt_t()
 
1653
        (gnutls.library.functions
 
1654
         .gnutls_openpgp_crt_init(ctypes.byref(crt)))
2276
1655
        # Import the OpenPGP public key into the certificate
2277
 
        gnutls.openpgp_crt_import(crt, ctypes.byref(datum),
2278
 
                                  gnutls.OPENPGP_FMT_RAW)
 
1656
        (gnutls.library.functions
 
1657
         .gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
 
1658
                                    gnutls.library.constants
 
1659
                                    .GNUTLS_OPENPGP_FMT_RAW))
2279
1660
        # Verify the self signature in the key
2280
1661
        crtverify = ctypes.c_uint()
2281
 
        gnutls.openpgp_crt_verify_self(crt, 0,
2282
 
                                       ctypes.byref(crtverify))
 
1662
        (gnutls.library.functions
 
1663
         .gnutls_openpgp_crt_verify_self(crt, 0,
 
1664
                                         ctypes.byref(crtverify)))
2283
1665
        if crtverify.value != 0:
2284
 
            gnutls.openpgp_crt_deinit(crt)
2285
 
            raise gnutls.CertificateSecurityError("Verify failed")
 
1666
            gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
 
1667
            raise (gnutls.errors.CertificateSecurityError
 
1668
                   ("Verify failed"))
2286
1669
        # New buffer for the fingerprint
2287
1670
        buf = ctypes.create_string_buffer(20)
2288
1671
        buf_len = ctypes.c_size_t()
2289
1672
        # Get the fingerprint from the certificate into the buffer
2290
 
        gnutls.openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
2291
 
                                           ctypes.byref(buf_len))
 
1673
        (gnutls.library.functions
 
1674
         .gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
 
1675
                                             ctypes.byref(buf_len)))
2292
1676
        # Deinit the certificate
2293
 
        gnutls.openpgp_crt_deinit(crt)
 
1677
        gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
2294
1678
        # Convert the buffer to a Python bytestring
2295
1679
        fpr = ctypes.string_at(buf, buf_len.value)
2296
1680
        # Convert the bytestring to hexadecimal notation
2300
1684
 
2301
1685
class MultiprocessingMixIn(object):
2302
1686
    """Like socketserver.ThreadingMixIn, but with multiprocessing"""
2303
 
    
2304
1687
    def sub_process_main(self, request, address):
2305
1688
        try:
2306
1689
            self.finish_request(request, address)
2311
1694
    def process_request(self, request, address):
2312
1695
        """Start a new process to process the request."""
2313
1696
        proc = multiprocessing.Process(target = self.sub_process_main,
2314
 
                                       args = (request, address))
 
1697
                                       args = (request,
 
1698
                                               address))
2315
1699
        proc.start()
2316
1700
        return proc
2317
1701
 
2318
1702
 
2319
1703
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
2320
1704
    """ adds a pipe to the MixIn """
2321
 
    
2322
1705
    def process_request(self, request, client_address):
2323
1706
        """Overrides and wraps the original process_request().
2324
1707
        
2333
1716
    
2334
1717
    def add_pipe(self, parent_pipe, proc):
2335
1718
        """Dummy function; override as necessary"""
2336
 
        raise NotImplementedError()
 
1719
        raise NotImplementedError
2337
1720
 
2338
1721
 
2339
1722
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
2345
1728
        interface:      None or a network interface name (string)
2346
1729
        use_ipv6:       Boolean; to use IPv6 or not
2347
1730
    """
2348
 
    
2349
1731
    def __init__(self, server_address, RequestHandlerClass,
2350
 
                 interface=None,
2351
 
                 use_ipv6=True,
2352
 
                 socketfd=None):
2353
 
        """If socketfd is set, use that file descriptor instead of
2354
 
        creating a new one with socket.socket().
2355
 
        """
 
1732
                 interface=None, use_ipv6=True):
2356
1733
        self.interface = interface
2357
1734
        if use_ipv6:
2358
1735
            self.address_family = socket.AF_INET6
2359
 
        if socketfd is not None:
2360
 
            # Save the file descriptor
2361
 
            self.socketfd = socketfd
2362
 
            # Save the original socket.socket() function
2363
 
            self.socket_socket = socket.socket
2364
 
            # To implement --socket, we monkey patch socket.socket.
2365
 
            # 
2366
 
            # (When socketserver.TCPServer is a new-style class, we
2367
 
            # could make self.socket into a property instead of monkey
2368
 
            # patching socket.socket.)
2369
 
            # 
2370
 
            # Create a one-time-only replacement for socket.socket()
2371
 
            @functools.wraps(socket.socket)
2372
 
            def socket_wrapper(*args, **kwargs):
2373
 
                # Restore original function so subsequent calls are
2374
 
                # not affected.
2375
 
                socket.socket = self.socket_socket
2376
 
                del self.socket_socket
2377
 
                # This time only, return a new socket object from the
2378
 
                # saved file descriptor.
2379
 
                return socket.fromfd(self.socketfd, *args, **kwargs)
2380
 
            # Replace socket.socket() function with wrapper
2381
 
            socket.socket = socket_wrapper
2382
 
        # The socketserver.TCPServer.__init__ will call
2383
 
        # socket.socket(), which might be our replacement,
2384
 
        # socket_wrapper(), if socketfd was set.
2385
1736
        socketserver.TCPServer.__init__(self, server_address,
2386
1737
                                        RequestHandlerClass)
2387
 
    
2388
1738
    def server_bind(self):
2389
1739
        """This overrides the normal server_bind() function
2390
1740
        to bind to an interface if one was specified, and also NOT to
2396
1746
                             self.interface)
2397
1747
            else:
2398
1748
                try:
2399
 
                    self.socket.setsockopt(
2400
 
                        socket.SOL_SOCKET, SO_BINDTODEVICE,
2401
 
                        (self.interface + "\0").encode("utf-8"))
 
1749
                    self.socket.setsockopt(socket.SOL_SOCKET,
 
1750
                                           SO_BINDTODEVICE,
 
1751
                                           str(self.interface
 
1752
                                               + '\0'))
2402
1753
                except socket.error as error:
2403
 
                    if error.errno == errno.EPERM:
2404
 
                        logger.error("No permission to bind to"
2405
 
                                     " interface %s", self.interface)
2406
 
                    elif error.errno == errno.ENOPROTOOPT:
 
1754
                    if error[0] == errno.EPERM:
 
1755
                        logger.error("No permission to"
 
1756
                                     " bind to interface %s",
 
1757
                                     self.interface)
 
1758
                    elif error[0] == errno.ENOPROTOOPT:
2407
1759
                        logger.error("SO_BINDTODEVICE not available;"
2408
1760
                                     " cannot bind to interface %s",
2409
1761
                                     self.interface)
2410
 
                    elif error.errno == errno.ENODEV:
2411
 
                        logger.error("Interface %s does not exist,"
2412
 
                                     " cannot bind", self.interface)
2413
1762
                    else:
2414
1763
                        raise
2415
1764
        # Only bind(2) the socket if we really need to.
2418
1767
                if self.address_family == socket.AF_INET6:
2419
1768
                    any_address = "::" # in6addr_any
2420
1769
                else:
2421
 
                    any_address = "0.0.0.0" # INADDR_ANY
 
1770
                    any_address = socket.INADDR_ANY
2422
1771
                self.server_address = (any_address,
2423
1772
                                       self.server_address[1])
2424
1773
            elif not self.server_address[1]:
2425
 
                self.server_address = (self.server_address[0], 0)
 
1774
                self.server_address = (self.server_address[0],
 
1775
                                       0)
2426
1776
#                 if self.interface:
2427
1777
#                     self.server_address = (self.server_address[0],
2428
1778
#                                            0, # port
2442
1792
    
2443
1793
    Assumes a gobject.MainLoop event loop.
2444
1794
    """
2445
 
    
2446
1795
    def __init__(self, server_address, RequestHandlerClass,
2447
 
                 interface=None,
2448
 
                 use_ipv6=True,
2449
 
                 clients=None,
2450
 
                 gnutls_priority=None,
2451
 
                 use_dbus=True,
2452
 
                 socketfd=None):
 
1796
                 interface=None, use_ipv6=True, clients=None,
 
1797
                 gnutls_priority=None, use_dbus=True):
2453
1798
        self.enabled = False
2454
1799
        self.clients = clients
2455
1800
        if self.clients is None:
2459
1804
        IPv6_TCPServer.__init__(self, server_address,
2460
1805
                                RequestHandlerClass,
2461
1806
                                interface = interface,
2462
 
                                use_ipv6 = use_ipv6,
2463
 
                                socketfd = socketfd)
2464
 
    
 
1807
                                use_ipv6 = use_ipv6)
2465
1808
    def server_activate(self):
2466
1809
        if self.enabled:
2467
1810
            return socketserver.TCPServer.server_activate(self)
2471
1814
    
2472
1815
    def add_pipe(self, parent_pipe, proc):
2473
1816
        # Call "handle_ipc" for both data and EOF events
2474
 
        gobject.io_add_watch(
2475
 
            parent_pipe.fileno(),
2476
 
            gobject.IO_IN | gobject.IO_HUP,
2477
 
            functools.partial(self.handle_ipc,
2478
 
                              parent_pipe = parent_pipe,
2479
 
                              proc = proc))
 
1817
        gobject.io_add_watch(parent_pipe.fileno(),
 
1818
                             gobject.IO_IN | gobject.IO_HUP,
 
1819
                             functools.partial(self.handle_ipc,
 
1820
                                               parent_pipe =
 
1821
                                               parent_pipe,
 
1822
                                               proc = proc))
2480
1823
    
2481
 
    def handle_ipc(self, source, condition,
2482
 
                   parent_pipe=None,
2483
 
                   proc = None,
2484
 
                   client_object=None):
 
1824
    def handle_ipc(self, source, condition, parent_pipe=None,
 
1825
                   proc = None, client_object=None):
 
1826
        condition_names = {
 
1827
            gobject.IO_IN: "IN",   # There is data to read.
 
1828
            gobject.IO_OUT: "OUT", # Data can be written (without
 
1829
                                    # blocking).
 
1830
            gobject.IO_PRI: "PRI", # There is urgent data to read.
 
1831
            gobject.IO_ERR: "ERR", # Error condition.
 
1832
            gobject.IO_HUP: "HUP"  # Hung up (the connection has been
 
1833
                                    # broken, usually for pipes and
 
1834
                                    # sockets).
 
1835
            }
 
1836
        conditions_string = ' | '.join(name
 
1837
                                       for cond, name in
 
1838
                                       condition_names.iteritems()
 
1839
                                       if cond & condition)
2485
1840
        # error, or the other end of multiprocessing.Pipe has closed
2486
 
        if condition & (gobject.IO_ERR | gobject.IO_HUP):
 
1841
        if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):
2487
1842
            # Wait for other process to exit
2488
1843
            proc.join()
2489
1844
            return False
2510
1865
                parent_pipe.send(False)
2511
1866
                return False
2512
1867
            
2513
 
            gobject.io_add_watch(
2514
 
                parent_pipe.fileno(),
2515
 
                gobject.IO_IN | gobject.IO_HUP,
2516
 
                functools.partial(self.handle_ipc,
2517
 
                                  parent_pipe = parent_pipe,
2518
 
                                  proc = proc,
2519
 
                                  client_object = client))
 
1868
            gobject.io_add_watch(parent_pipe.fileno(),
 
1869
                                 gobject.IO_IN | gobject.IO_HUP,
 
1870
                                 functools.partial(self.handle_ipc,
 
1871
                                                   parent_pipe =
 
1872
                                                   parent_pipe,
 
1873
                                                   proc = proc,
 
1874
                                                   client_object =
 
1875
                                                   client))
2520
1876
            parent_pipe.send(True)
2521
1877
            # remove the old hook in favor of the new above hook on
2522
1878
            # same fileno
2528
1884
            
2529
1885
            parent_pipe.send(('data', getattr(client_object,
2530
1886
                                              funcname)(*args,
2531
 
                                                        **kwargs)))
 
1887
                                                         **kwargs)))
2532
1888
        
2533
1889
        if command == 'getattr':
2534
1890
            attrname = request[1]
2535
 
            if isinstance(client_object.__getattribute__(attrname),
2536
 
                          collections.Callable):
2537
 
                parent_pipe.send(('function', ))
 
1891
            if callable(client_object.__getattribute__(attrname)):
 
1892
                parent_pipe.send(('function',))
2538
1893
            else:
2539
 
                parent_pipe.send((
2540
 
                    'data', client_object.__getattribute__(attrname)))
 
1894
                parent_pipe.send(('data', client_object
 
1895
                                  .__getattribute__(attrname)))
2541
1896
        
2542
1897
        if command == 'setattr':
2543
1898
            attrname = request[1]
2547
1902
        return True
2548
1903
 
2549
1904
 
2550
 
def rfc3339_duration_to_delta(duration):
2551
 
    """Parse an RFC 3339 "duration" and return a datetime.timedelta
2552
 
    
2553
 
    >>> rfc3339_duration_to_delta("P7D")
2554
 
    datetime.timedelta(7)
2555
 
    >>> rfc3339_duration_to_delta("PT60S")
2556
 
    datetime.timedelta(0, 60)
2557
 
    >>> rfc3339_duration_to_delta("PT60M")
2558
 
    datetime.timedelta(0, 3600)
2559
 
    >>> rfc3339_duration_to_delta("PT24H")
2560
 
    datetime.timedelta(1)
2561
 
    >>> rfc3339_duration_to_delta("P1W")
2562
 
    datetime.timedelta(7)
2563
 
    >>> rfc3339_duration_to_delta("PT5M30S")
2564
 
    datetime.timedelta(0, 330)
2565
 
    >>> rfc3339_duration_to_delta("P1DT3M20S")
2566
 
    datetime.timedelta(1, 200)
2567
 
    """
2568
 
    
2569
 
    # Parsing an RFC 3339 duration with regular expressions is not
2570
 
    # possible - there would have to be multiple places for the same
2571
 
    # values, like seconds.  The current code, while more esoteric, is
2572
 
    # cleaner without depending on a parsing library.  If Python had a
2573
 
    # built-in library for parsing we would use it, but we'd like to
2574
 
    # avoid excessive use of external libraries.
2575
 
    
2576
 
    # New type for defining tokens, syntax, and semantics all-in-one
2577
 
    Token = collections.namedtuple("Token", (
2578
 
        "regexp",  # To match token; if "value" is not None, must have
2579
 
                   # a "group" containing digits
2580
 
        "value",   # datetime.timedelta or None
2581
 
        "followers"))           # Tokens valid after this token
2582
 
    # RFC 3339 "duration" tokens, syntax, and semantics; taken from
2583
 
    # the "duration" ABNF definition in RFC 3339, Appendix A.
2584
 
    token_end = Token(re.compile(r"$"), None, frozenset())
2585
 
    token_second = Token(re.compile(r"(\d+)S"),
2586
 
                         datetime.timedelta(seconds=1),
2587
 
                         frozenset((token_end, )))
2588
 
    token_minute = Token(re.compile(r"(\d+)M"),
2589
 
                         datetime.timedelta(minutes=1),
2590
 
                         frozenset((token_second, token_end)))
2591
 
    token_hour = Token(re.compile(r"(\d+)H"),
2592
 
                       datetime.timedelta(hours=1),
2593
 
                       frozenset((token_minute, token_end)))
2594
 
    token_time = Token(re.compile(r"T"),
2595
 
                       None,
2596
 
                       frozenset((token_hour, token_minute,
2597
 
                                  token_second)))
2598
 
    token_day = Token(re.compile(r"(\d+)D"),
2599
 
                      datetime.timedelta(days=1),
2600
 
                      frozenset((token_time, token_end)))
2601
 
    token_month = Token(re.compile(r"(\d+)M"),
2602
 
                        datetime.timedelta(weeks=4),
2603
 
                        frozenset((token_day, token_end)))
2604
 
    token_year = Token(re.compile(r"(\d+)Y"),
2605
 
                       datetime.timedelta(weeks=52),
2606
 
                       frozenset((token_month, token_end)))
2607
 
    token_week = Token(re.compile(r"(\d+)W"),
2608
 
                       datetime.timedelta(weeks=1),
2609
 
                       frozenset((token_end, )))
2610
 
    token_duration = Token(re.compile(r"P"), None,
2611
 
                           frozenset((token_year, token_month,
2612
 
                                      token_day, token_time,
2613
 
                                      token_week)))
2614
 
    # Define starting values
2615
 
    value = datetime.timedelta() # Value so far
2616
 
    found_token = None
2617
 
    followers = frozenset((token_duration, )) # Following valid tokens
2618
 
    s = duration                # String left to parse
2619
 
    # Loop until end token is found
2620
 
    while found_token is not token_end:
2621
 
        # Search for any currently valid tokens
2622
 
        for token in followers:
2623
 
            match = token.regexp.match(s)
2624
 
            if match is not None:
2625
 
                # Token found
2626
 
                if token.value is not None:
2627
 
                    # Value found, parse digits
2628
 
                    factor = int(match.group(1), 10)
2629
 
                    # Add to value so far
2630
 
                    value += factor * token.value
2631
 
                # Strip token from string
2632
 
                s = token.regexp.sub("", s, 1)
2633
 
                # Go to found token
2634
 
                found_token = token
2635
 
                # Set valid next tokens
2636
 
                followers = found_token.followers
2637
 
                break
2638
 
        else:
2639
 
            # No currently valid tokens were found
2640
 
            raise ValueError("Invalid RFC 3339 duration: {!r}"
2641
 
                             .format(duration))
2642
 
    # End token found
2643
 
    return value
2644
 
 
2645
 
 
2646
1905
def string_to_delta(interval):
2647
1906
    """Parse a string and return a datetime.timedelta
2648
1907
    
2659
1918
    >>> string_to_delta('5m 30s')
2660
1919
    datetime.timedelta(0, 330)
2661
1920
    """
2662
 
    
2663
 
    try:
2664
 
        return rfc3339_duration_to_delta(interval)
2665
 
    except ValueError:
2666
 
        pass
2667
 
    
2668
1921
    timevalue = datetime.timedelta(0)
2669
1922
    for s in interval.split():
2670
1923
        try:
2671
 
            suffix = s[-1]
 
1924
            suffix = unicode(s[-1])
2672
1925
            value = int(s[:-1])
2673
1926
            if suffix == "d":
2674
1927
                delta = datetime.timedelta(value)
2681
1934
            elif suffix == "w":
2682
1935
                delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
2683
1936
            else:
2684
 
                raise ValueError("Unknown suffix {!r}".format(suffix))
2685
 
        except IndexError as e:
 
1937
                raise ValueError("Unknown suffix %r" % suffix)
 
1938
        except (ValueError, IndexError) as e:
2686
1939
            raise ValueError(*(e.args))
2687
1940
        timevalue += delta
2688
1941
    return timevalue
2701
1954
        sys.exit()
2702
1955
    if not noclose:
2703
1956
        # Close all standard open file descriptors
2704
 
        null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
 
1957
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
2705
1958
        if not stat.S_ISCHR(os.fstat(null).st_mode):
2706
1959
            raise OSError(errno.ENODEV,
2707
 
                          "{} not a character device"
2708
 
                          .format(os.devnull))
 
1960
                          "%s not a character device"
 
1961
                          % os.path.devnull)
2709
1962
        os.dup2(null, sys.stdin.fileno())
2710
1963
        os.dup2(null, sys.stdout.fileno())
2711
1964
        os.dup2(null, sys.stderr.fileno())
2720
1973
    
2721
1974
    parser = argparse.ArgumentParser()
2722
1975
    parser.add_argument("-v", "--version", action="version",
2723
 
                        version = "%(prog)s {}".format(version),
 
1976
                        version = "%%(prog)s %s" % version,
2724
1977
                        help="show version number and exit")
2725
1978
    parser.add_argument("-i", "--interface", metavar="IF",
2726
1979
                        help="Bind to interface IF")
2732
1985
                        help="Run self-test")
2733
1986
    parser.add_argument("--debug", action="store_true",
2734
1987
                        help="Debug mode; run in foreground and log"
2735
 
                        " to terminal", default=None)
 
1988
                        " to terminal")
2736
1989
    parser.add_argument("--debuglevel", metavar="LEVEL",
2737
1990
                        help="Debug level for stdout output")
2738
1991
    parser.add_argument("--priority", help="GnuTLS"
2745
1998
                        " files")
2746
1999
    parser.add_argument("--no-dbus", action="store_false",
2747
2000
                        dest="use_dbus", help="Do not provide D-Bus"
2748
 
                        " system bus interface", default=None)
 
2001
                        " system bus interface")
2749
2002
    parser.add_argument("--no-ipv6", action="store_false",
2750
 
                        dest="use_ipv6", help="Do not use IPv6",
2751
 
                        default=None)
 
2003
                        dest="use_ipv6", help="Do not use IPv6")
2752
2004
    parser.add_argument("--no-restore", action="store_false",
2753
2005
                        dest="restore", help="Do not restore stored"
2754
 
                        " state", default=None)
2755
 
    parser.add_argument("--socket", type=int,
2756
 
                        help="Specify a file descriptor to a network"
2757
 
                        " socket to use instead of creating one")
 
2006
                        " state")
2758
2007
    parser.add_argument("--statedir", metavar="DIR",
2759
2008
                        help="Directory to save/restore state in")
2760
 
    parser.add_argument("--foreground", action="store_true",
2761
 
                        help="Run in foreground", default=None)
2762
 
    parser.add_argument("--no-zeroconf", action="store_false",
2763
 
                        dest="zeroconf", help="Do not use Zeroconf",
2764
 
                        default=None)
2765
2009
    
2766
2010
    options = parser.parse_args()
2767
2011
    
2768
2012
    if options.check:
2769
2013
        import doctest
2770
 
        fail_count, test_count = doctest.testmod()
2771
 
        sys.exit(os.EX_OK if fail_count == 0 else 1)
 
2014
        doctest.testmod()
 
2015
        sys.exit()
2772
2016
    
2773
2017
    # Default values for config file for server-global settings
2774
2018
    server_defaults = { "interface": "",
2776
2020
                        "port": "",
2777
2021
                        "debug": "False",
2778
2022
                        "priority":
2779
 
                        "SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2780
 
                        ":+SIGN-DSA-SHA256",
 
2023
                        "SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
2781
2024
                        "servicename": "Mandos",
2782
2025
                        "use_dbus": "True",
2783
2026
                        "use_ipv6": "True",
2784
2027
                        "debuglevel": "",
2785
2028
                        "restore": "True",
2786
 
                        "socket": "",
2787
 
                        "statedir": "/var/lib/mandos",
2788
 
                        "foreground": "False",
2789
 
                        "zeroconf": "True",
2790
 
                    }
 
2029
                        "statedir": "/var/lib/mandos"
 
2030
                        }
2791
2031
    
2792
2032
    # Parse config file for server-global settings
2793
2033
    server_config = configparser.SafeConfigParser(server_defaults)
2794
2034
    del server_defaults
2795
 
    server_config.read(os.path.join(options.configdir, "mandos.conf"))
 
2035
    server_config.read(os.path.join(options.configdir,
 
2036
                                    "mandos.conf"))
2796
2037
    # Convert the SafeConfigParser object to a dict
2797
2038
    server_settings = server_config.defaults()
2798
2039
    # Use the appropriate methods on the non-string config options
2799
 
    for option in ("debug", "use_dbus", "use_ipv6", "foreground"):
 
2040
    for option in ("debug", "use_dbus", "use_ipv6"):
2800
2041
        server_settings[option] = server_config.getboolean("DEFAULT",
2801
2042
                                                           option)
2802
2043
    if server_settings["port"]:
2803
2044
        server_settings["port"] = server_config.getint("DEFAULT",
2804
2045
                                                       "port")
2805
 
    if server_settings["socket"]:
2806
 
        server_settings["socket"] = server_config.getint("DEFAULT",
2807
 
                                                         "socket")
2808
 
        # Later, stdin will, and stdout and stderr might, be dup'ed
2809
 
        # over with an opened os.devnull.  But we don't want this to
2810
 
        # happen with a supplied network socket.
2811
 
        if 0 <= server_settings["socket"] <= 2:
2812
 
            server_settings["socket"] = os.dup(server_settings
2813
 
                                               ["socket"])
2814
2046
    del server_config
2815
2047
    
2816
2048
    # Override the settings from the config file with command line
2817
2049
    # options, if set.
2818
2050
    for option in ("interface", "address", "port", "debug",
2819
 
                   "priority", "servicename", "configdir", "use_dbus",
2820
 
                   "use_ipv6", "debuglevel", "restore", "statedir",
2821
 
                   "socket", "foreground", "zeroconf"):
 
2051
                   "priority", "servicename", "configdir",
 
2052
                   "use_dbus", "use_ipv6", "debuglevel", "restore",
 
2053
                   "statedir"):
2822
2054
        value = getattr(options, option)
2823
2055
        if value is not None:
2824
2056
            server_settings[option] = value
2825
2057
    del options
2826
2058
    # Force all strings to be unicode
2827
2059
    for option in server_settings.keys():
2828
 
        if isinstance(server_settings[option], bytes):
2829
 
            server_settings[option] = (server_settings[option]
2830
 
                                       .decode("utf-8"))
2831
 
    # Force all boolean options to be boolean
2832
 
    for option in ("debug", "use_dbus", "use_ipv6", "restore",
2833
 
                   "foreground", "zeroconf"):
2834
 
        server_settings[option] = bool(server_settings[option])
2835
 
    # Debug implies foreground
2836
 
    if server_settings["debug"]:
2837
 
        server_settings["foreground"] = True
 
2060
        if type(server_settings[option]) is str:
 
2061
            server_settings[option] = unicode(server_settings[option])
2838
2062
    # Now we have our good server settings in "server_settings"
2839
2063
    
2840
2064
    ##################################################################
2841
2065
    
2842
 
    if (not server_settings["zeroconf"]
2843
 
        and not (server_settings["port"]
2844
 
                 or server_settings["socket"] != "")):
2845
 
        parser.error("Needs port or socket to work without Zeroconf")
2846
 
    
2847
2066
    # For convenience
2848
2067
    debug = server_settings["debug"]
2849
2068
    debuglevel = server_settings["debuglevel"]
2851
2070
    use_ipv6 = server_settings["use_ipv6"]
2852
2071
    stored_state_path = os.path.join(server_settings["statedir"],
2853
2072
                                     stored_state_file)
2854
 
    foreground = server_settings["foreground"]
2855
 
    zeroconf = server_settings["zeroconf"]
2856
2073
    
2857
2074
    if debug:
2858
2075
        initlogger(debug, logging.DEBUG)
2864
2081
            initlogger(debug, level)
2865
2082
    
2866
2083
    if server_settings["servicename"] != "Mandos":
2867
 
        syslogger.setFormatter(
2868
 
            logging.Formatter('Mandos ({}) [%(process)d]:'
2869
 
                              ' %(levelname)s: %(message)s'.format(
2870
 
                                  server_settings["servicename"])))
 
2084
        syslogger.setFormatter(logging.Formatter
 
2085
                               ('Mandos (%s) [%%(process)d]:'
 
2086
                                ' %%(levelname)s: %%(message)s'
 
2087
                                % server_settings["servicename"]))
2871
2088
    
2872
2089
    # Parse config file with clients
2873
2090
    client_config = configparser.SafeConfigParser(Client
2878
2095
    global mandos_dbus_service
2879
2096
    mandos_dbus_service = None
2880
2097
    
2881
 
    socketfd = None
2882
 
    if server_settings["socket"] != "":
2883
 
        socketfd = server_settings["socket"]
2884
 
    tcp_server = MandosServer(
2885
 
        (server_settings["address"], server_settings["port"]),
2886
 
        ClientHandler,
2887
 
        interface=(server_settings["interface"] or None),
2888
 
        use_ipv6=use_ipv6,
2889
 
        gnutls_priority=server_settings["priority"],
2890
 
        use_dbus=use_dbus,
2891
 
        socketfd=socketfd)
2892
 
    if not foreground:
2893
 
        pidfilename = "/run/mandos.pid"
2894
 
        if not os.path.isdir("/run/."):
2895
 
            pidfilename = "/var/run/mandos.pid"
2896
 
        pidfile = None
 
2098
    tcp_server = MandosServer((server_settings["address"],
 
2099
                               server_settings["port"]),
 
2100
                              ClientHandler,
 
2101
                              interface=(server_settings["interface"]
 
2102
                                         or None),
 
2103
                              use_ipv6=use_ipv6,
 
2104
                              gnutls_priority=
 
2105
                              server_settings["priority"],
 
2106
                              use_dbus=use_dbus)
 
2107
    if not debug:
 
2108
        pidfilename = "/var/run/mandos.pid"
2897
2109
        try:
2898
 
            pidfile = codecs.open(pidfilename, "w", encoding="utf-8")
2899
 
        except IOError as e:
2900
 
            logger.error("Could not open file %r", pidfilename,
2901
 
                         exc_info=e)
 
2110
            pidfile = open(pidfilename, "w")
 
2111
        except IOError:
 
2112
            logger.error("Could not open file %r", pidfilename)
2902
2113
    
2903
 
    for name in ("_mandos", "mandos", "nobody"):
 
2114
    try:
 
2115
        uid = pwd.getpwnam("_mandos").pw_uid
 
2116
        gid = pwd.getpwnam("_mandos").pw_gid
 
2117
    except KeyError:
2904
2118
        try:
2905
 
            uid = pwd.getpwnam(name).pw_uid
2906
 
            gid = pwd.getpwnam(name).pw_gid
2907
 
            break
 
2119
            uid = pwd.getpwnam("mandos").pw_uid
 
2120
            gid = pwd.getpwnam("mandos").pw_gid
2908
2121
        except KeyError:
2909
 
            continue
2910
 
    else:
2911
 
        uid = 65534
2912
 
        gid = 65534
 
2122
            try:
 
2123
                uid = pwd.getpwnam("nobody").pw_uid
 
2124
                gid = pwd.getpwnam("nobody").pw_gid
 
2125
            except KeyError:
 
2126
                uid = 65534
 
2127
                gid = 65534
2913
2128
    try:
2914
2129
        os.setgid(gid)
2915
2130
        os.setuid(uid)
2916
2131
    except OSError as error:
2917
 
        if error.errno != errno.EPERM:
2918
 
            raise
 
2132
        if error[0] != errno.EPERM:
 
2133
            raise error
2919
2134
    
2920
2135
    if debug:
2921
2136
        # Enable all possible GnuTLS debugging
2922
2137
        
2923
2138
        # "Use a log level over 10 to enable all debugging options."
2924
2139
        # - GnuTLS manual
2925
 
        gnutls.global_set_log_level(11)
 
2140
        gnutls.library.functions.gnutls_global_set_log_level(11)
2926
2141
        
2927
 
        @gnutls.log_func
 
2142
        @gnutls.library.types.gnutls_log_func
2928
2143
        def debug_gnutls(level, string):
2929
2144
            logger.debug("GnuTLS: %s", string[:-1])
2930
2145
        
2931
 
        gnutls.global_set_log_function(debug_gnutls)
 
2146
        (gnutls.library.functions
 
2147
         .gnutls_global_set_log_function(debug_gnutls))
2932
2148
        
2933
2149
        # Redirect stdin so all checkers get /dev/null
2934
 
        null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
 
2150
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
2935
2151
        os.dup2(null, sys.stdin.fileno())
2936
2152
        if null > 2:
2937
2153
            os.close(null)
2938
2154
    
2939
2155
    # Need to fork before connecting to D-Bus
2940
 
    if not foreground:
 
2156
    if not debug:
2941
2157
        # Close all input and output, do double fork, etc.
2942
2158
        daemon()
2943
2159
    
2944
 
    # multiprocessing will use threads, so before we use gobject we
2945
 
    # need to inform gobject that threads will be used.
2946
2160
    gobject.threads_init()
2947
2161
    
2948
2162
    global main_loop
2949
2163
    # From the Avahi example code
2950
 
    DBusGMainLoop(set_as_default=True)
 
2164
    DBusGMainLoop(set_as_default=True )
2951
2165
    main_loop = gobject.MainLoop()
2952
2166
    bus = dbus.SystemBus()
2953
2167
    # End of Avahi example code
2954
2168
    if use_dbus:
2955
2169
        try:
2956
2170
            bus_name = dbus.service.BusName("se.recompile.Mandos",
2957
 
                                            bus,
2958
 
                                            do_not_queue=True)
2959
 
            old_bus_name = dbus.service.BusName(
2960
 
                "se.bsnet.fukt.Mandos", bus,
2961
 
                do_not_queue=True)
2962
 
        except dbus.exceptions.DBusException as e:
2963
 
            logger.error("Disabling D-Bus:", exc_info=e)
 
2171
                                            bus, do_not_queue=True)
 
2172
            old_bus_name = (dbus.service.BusName
 
2173
                            ("se.bsnet.fukt.Mandos", bus,
 
2174
                             do_not_queue=True))
 
2175
        except dbus.exceptions.NameExistsException as e:
 
2176
            logger.error(unicode(e) + ", disabling D-Bus")
2964
2177
            use_dbus = False
2965
2178
            server_settings["use_dbus"] = False
2966
2179
            tcp_server.use_dbus = False
2967
 
    if zeroconf:
2968
 
        protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2969
 
        service = AvahiServiceToSyslog(
2970
 
            name = server_settings["servicename"],
2971
 
            servicetype = "_mandos._tcp",
2972
 
            protocol = protocol,
2973
 
            bus = bus)
2974
 
        if server_settings["interface"]:
2975
 
            service.interface = if_nametoindex(
2976
 
                server_settings["interface"].encode("utf-8"))
 
2180
    protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
 
2181
    service = AvahiServiceToSyslog(name =
 
2182
                                   server_settings["servicename"],
 
2183
                                   servicetype = "_mandos._tcp",
 
2184
                                   protocol = protocol, bus = bus)
 
2185
    if server_settings["interface"]:
 
2186
        service.interface = (if_nametoindex
 
2187
                             (str(server_settings["interface"])))
2977
2188
    
2978
2189
    global multiprocessing_manager
2979
2190
    multiprocessing_manager = multiprocessing.Manager()
2980
2191
    
2981
2192
    client_class = Client
2982
2193
    if use_dbus:
2983
 
        client_class = functools.partial(ClientDBus, bus = bus)
 
2194
        client_class = functools.partial(ClientDBusTransitional,
 
2195
                                         bus = bus)
2984
2196
    
2985
2197
    client_settings = Client.config_parser(client_config)
2986
2198
    old_client_settings = {}
2987
2199
    clients_data = {}
2988
2200
    
2989
 
    # This is used to redirect stdout and stderr for checker processes
2990
 
    global wnull
2991
 
    wnull = open(os.devnull, "w") # A writable /dev/null
2992
 
    # Only used if server is running in foreground but not in debug
2993
 
    # mode
2994
 
    if debug or not foreground:
2995
 
        wnull.close()
2996
 
    
2997
2201
    # Get client data and settings from last running state.
2998
2202
    if server_settings["restore"]:
2999
2203
        try:
3000
2204
            with open(stored_state_path, "rb") as stored_state:
3001
 
                clients_data, old_client_settings = pickle.load(
3002
 
                    stored_state)
 
2205
                clients_data, old_client_settings = (pickle.load
 
2206
                                                     (stored_state))
3003
2207
            os.remove(stored_state_path)
3004
2208
        except IOError as e:
3005
 
            if e.errno == errno.ENOENT:
3006
 
                logger.warning("Could not load persistent state:"
3007
 
                               " {}".format(os.strerror(e.errno)))
3008
 
            else:
3009
 
                logger.critical("Could not load persistent state:",
3010
 
                                exc_info=e)
 
2209
            logger.warning("Could not load persistent state: {0}"
 
2210
                           .format(e))
 
2211
            if e.errno != errno.ENOENT:
3011
2212
                raise
3012
2213
        except EOFError as e:
3013
2214
            logger.warning("Could not load persistent state: "
3014
 
                           "EOFError:",
3015
 
                           exc_info=e)
 
2215
                           "EOFError: {0}".format(e))
3016
2216
    
3017
2217
    with PGPEngine() as pgp:
3018
 
        for client_name, client in clients_data.items():
3019
 
            # Skip removed clients
3020
 
            if client_name not in client_settings:
3021
 
                continue
3022
 
            
 
2218
        for client_name, client in clients_data.iteritems():
3023
2219
            # Decide which value to use after restoring saved state.
3024
2220
            # We have three different values: Old config file,
3025
2221
            # new config file, and saved state.
3030
2226
                    # For each value in new config, check if it
3031
2227
                    # differs from the old config value (Except for
3032
2228
                    # the "secret" attribute)
3033
 
                    if (name != "secret"
3034
 
                        and (value !=
3035
 
                             old_client_settings[client_name][name])):
 
2229
                    if (name != "secret" and
 
2230
                        value != old_client_settings[client_name]
 
2231
                        [name]):
3036
2232
                        client[name] = value
3037
2233
                except KeyError:
3038
2234
                    pass
3039
2235
            
3040
2236
            # Clients who has passed its expire date can still be
3041
 
            # enabled if its last checker was successful.  A Client
 
2237
            # enabled if its last checker was successful.  Clients
3042
2238
            # whose checker succeeded before we stored its state is
3043
2239
            # assumed to have successfully run all checkers during
3044
2240
            # downtime.
3046
2242
                if datetime.datetime.utcnow() >= client["expires"]:
3047
2243
                    if not client["last_checked_ok"]:
3048
2244
                        logger.warning(
3049
 
                            "disabling client {} - Client never "
3050
 
                            "performed a successful checker".format(
3051
 
                                client_name))
 
2245
                            "disabling client {0} - Client never "
 
2246
                            "performed a successful checker"
 
2247
                            .format(client_name))
3052
2248
                        client["enabled"] = False
3053
2249
                    elif client["last_checker_status"] != 0:
3054
2250
                        logger.warning(
3055
 
                            "disabling client {} - Client last"
3056
 
                            " checker failed with error code"
3057
 
                            " {}".format(
3058
 
                                client_name,
3059
 
                                client["last_checker_status"]))
 
2251
                            "disabling client {0} - Client "
 
2252
                            "last checker failed with error code {1}"
 
2253
                            .format(client_name,
 
2254
                                    client["last_checker_status"]))
3060
2255
                        client["enabled"] = False
3061
2256
                    else:
3062
 
                        client["expires"] = (
3063
 
                            datetime.datetime.utcnow()
3064
 
                            + client["timeout"])
 
2257
                        client["expires"] = (datetime.datetime
 
2258
                                             .utcnow()
 
2259
                                             + client["timeout"])
3065
2260
                        logger.debug("Last checker succeeded,"
3066
 
                                     " keeping {} enabled".format(
3067
 
                                         client_name))
 
2261
                                     " keeping {0} enabled"
 
2262
                                     .format(client_name))
3068
2263
            try:
3069
 
                client["secret"] = pgp.decrypt(
3070
 
                    client["encrypted_secret"],
3071
 
                    client_settings[client_name]["secret"])
 
2264
                client["secret"] = (
 
2265
                    pgp.decrypt(client["encrypted_secret"],
 
2266
                                client_settings[client_name]
 
2267
                                ["secret"]))
3072
2268
            except PGPError:
3073
2269
                # If decryption fails, we use secret from new settings
3074
 
                logger.debug("Failed to decrypt {} old secret".format(
3075
 
                    client_name))
3076
 
                client["secret"] = (client_settings[client_name]
3077
 
                                    ["secret"])
 
2270
                logger.debug("Failed to decrypt {0} old secret"
 
2271
                             .format(client_name))
 
2272
                client["secret"] = (
 
2273
                    client_settings[client_name]["secret"])
 
2274
 
3078
2275
    
3079
2276
    # Add/remove clients based on new changes made to config
3080
2277
    for client_name in (set(old_client_settings)
3083
2280
    for client_name in (set(client_settings)
3084
2281
                        - set(old_client_settings)):
3085
2282
        clients_data[client_name] = client_settings[client_name]
3086
 
    
 
2283
 
3087
2284
    # Create all client objects
3088
 
    for client_name, client in clients_data.items():
 
2285
    for client_name, client in clients_data.iteritems():
3089
2286
        tcp_server.clients[client_name] = client_class(
3090
 
            name = client_name,
3091
 
            settings = client,
3092
 
            server_settings = server_settings)
 
2287
            name = client_name, settings = client)
3093
2288
    
3094
2289
    if not tcp_server.clients:
3095
2290
        logger.warning("No clients defined")
3096
 
    
3097
 
    if not foreground:
3098
 
        if pidfile is not None:
3099
 
            pid = os.getpid()
3100
 
            try:
3101
 
                with pidfile:
3102
 
                    print(pid, file=pidfile)
3103
 
            except IOError:
3104
 
                logger.error("Could not write to file %r with PID %d",
3105
 
                             pidfilename, pid)
3106
 
        del pidfile
 
2291
        
 
2292
    if not debug:
 
2293
        try:
 
2294
            with pidfile:
 
2295
                pid = os.getpid()
 
2296
                pidfile.write(str(pid) + "\n".encode("utf-8"))
 
2297
            del pidfile
 
2298
        except IOError:
 
2299
            logger.error("Could not write to file %r with PID %d",
 
2300
                         pidfilename, pid)
 
2301
        except NameError:
 
2302
            # "pidfile" was never created
 
2303
            pass
3107
2304
        del pidfilename
 
2305
        signal.signal(signal.SIGINT, signal.SIG_IGN)
3108
2306
    
3109
2307
    signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
3110
2308
    signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
3111
2309
    
3112
2310
    if use_dbus:
3113
 
        
3114
 
        @alternate_dbus_interfaces(
3115
 
            { "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })
3116
 
        class MandosDBusService(DBusObjectWithObjectManager):
 
2311
        class MandosDBusService(dbus.service.Object):
3117
2312
            """A D-Bus proxy object"""
3118
 
            
3119
2313
            def __init__(self):
3120
2314
                dbus.service.Object.__init__(self, bus, "/")
3121
 
            
3122
2315
            _interface = "se.recompile.Mandos"
3123
2316
            
3124
2317
            @dbus.service.signal(_interface, signature="o")
3131
2324
                "D-Bus signal"
3132
2325
                pass
3133
2326
            
3134
 
            @dbus_annotations({"org.freedesktop.DBus.Deprecated":
3135
 
                               "true"})
3136
2327
            @dbus.service.signal(_interface, signature="os")
3137
2328
            def ClientRemoved(self, objpath, name):
3138
2329
                "D-Bus signal"
3139
2330
                pass
3140
2331
            
3141
 
            @dbus_annotations({"org.freedesktop.DBus.Deprecated":
3142
 
                               "true"})
3143
2332
            @dbus.service.method(_interface, out_signature="ao")
3144
2333
            def GetAllClients(self):
3145
2334
                "D-Bus method"
3146
 
                return dbus.Array(c.dbus_object_path for c in
 
2335
                return dbus.Array(c.dbus_object_path
 
2336
                                  for c in
3147
2337
                                  tcp_server.clients.itervalues())
3148
2338
            
3149
 
            @dbus_annotations({"org.freedesktop.DBus.Deprecated":
3150
 
                               "true"})
3151
2339
            @dbus.service.method(_interface,
3152
2340
                                 out_signature="a{oa{sv}}")
3153
2341
            def GetAllClientsWithProperties(self):
3154
2342
                "D-Bus method"
3155
2343
                return dbus.Dictionary(
3156
 
                    { c.dbus_object_path: c.GetAll(
3157
 
                        "se.recompile.Mandos.Client")
3158
 
                      for c in tcp_server.clients.itervalues() },
 
2344
                    ((c.dbus_object_path, c.GetAll(""))
 
2345
                     for c in tcp_server.clients.itervalues()),
3159
2346
                    signature="oa{sv}")
3160
2347
            
3161
2348
            @dbus.service.method(_interface, in_signature="o")
3165
2352
                    if c.dbus_object_path == object_path:
3166
2353
                        del tcp_server.clients[c.name]
3167
2354
                        c.remove_from_connection()
3168
 
                        # Don't signal the disabling
 
2355
                        # Don't signal anything except ClientRemoved
3169
2356
                        c.disable(quiet=True)
3170
 
                        # Emit D-Bus signal for removal
3171
 
                        self.client_removed_signal(c)
 
2357
                        # Emit D-Bus signal
 
2358
                        self.ClientRemoved(object_path, c.name)
3172
2359
                        return
3173
2360
                raise KeyError(object_path)
3174
2361
            
3175
2362
            del _interface
3176
 
            
3177
 
            @dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
3178
 
                                 out_signature = "a{oa{sa{sv}}}")
3179
 
            def GetManagedObjects(self):
3180
 
                """D-Bus method"""
3181
 
                return dbus.Dictionary(
3182
 
                    { client.dbus_object_path:
3183
 
                      dbus.Dictionary(
3184
 
                          { interface: client.GetAll(interface)
3185
 
                            for interface in
3186
 
                                 client._get_all_interface_names()})
3187
 
                      for client in tcp_server.clients.values()})
3188
 
            
3189
 
            def client_added_signal(self, client):
3190
 
                """Send the new standard signal and the old signal"""
3191
 
                if use_dbus:
3192
 
                    # New standard signal
3193
 
                    self.InterfacesAdded(
3194
 
                        client.dbus_object_path,
3195
 
                        dbus.Dictionary(
3196
 
                            { interface: client.GetAll(interface)
3197
 
                              for interface in
3198
 
                              client._get_all_interface_names()}))
3199
 
                    # Old signal
3200
 
                    self.ClientAdded(client.dbus_object_path)
3201
 
            
3202
 
            def client_removed_signal(self, client):
3203
 
                """Send the new standard signal and the old signal"""
3204
 
                if use_dbus:
3205
 
                    # New standard signal
3206
 
                    self.InterfacesRemoved(
3207
 
                        client.dbus_object_path,
3208
 
                        client._get_all_interface_names())
3209
 
                    # Old signal
3210
 
                    self.ClientRemoved(client.dbus_object_path,
3211
 
                                       client.name)
3212
2363
        
3213
 
        mandos_dbus_service = MandosDBusService()
 
2364
        class MandosDBusServiceTransitional(MandosDBusService):
 
2365
            __metaclass__ = AlternateDBusNamesMetaclass
 
2366
        mandos_dbus_service = MandosDBusServiceTransitional()
3214
2367
    
3215
2368
    def cleanup():
3216
2369
        "Cleanup function; run on exit"
3217
 
        if zeroconf:
3218
 
            service.cleanup()
 
2370
        service.cleanup()
3219
2371
        
3220
2372
        multiprocessing.active_children()
3221
 
        wnull.close()
3222
2373
        if not (tcp_server.clients or client_settings):
3223
2374
            return
3224
2375
        
3235
2386
                
3236
2387
                # A list of attributes that can not be pickled
3237
2388
                # + secret.
3238
 
                exclude = { "bus", "changedstate", "secret",
3239
 
                            "checker", "server_settings" }
3240
 
                for name, typ in inspect.getmembers(dbus.service
3241
 
                                                    .Object):
 
2389
                exclude = set(("bus", "changedstate", "secret",
 
2390
                               "checker"))
 
2391
                for name, typ in (inspect.getmembers
 
2392
                                  (dbus.service.Object)):
3242
2393
                    exclude.add(name)
3243
2394
                
3244
2395
                client_dict["encrypted_secret"] = (client
3251
2402
                del client_settings[client.name]["secret"]
3252
2403
        
3253
2404
        try:
3254
 
            with tempfile.NamedTemporaryFile(
3255
 
                    mode='wb',
3256
 
                    suffix=".pickle",
3257
 
                    prefix='clients-',
3258
 
                    dir=os.path.dirname(stored_state_path),
3259
 
                    delete=False) as stored_state:
 
2405
            tempfd, tempname = tempfile.mkstemp(suffix=".pickle",
 
2406
                                                prefix="clients-",
 
2407
                                                dir=os.path.dirname
 
2408
                                                (stored_state_path))
 
2409
            with os.fdopen(tempfd, "wb") as stored_state:
3260
2410
                pickle.dump((clients, client_settings), stored_state)
3261
 
                tempname = stored_state.name
3262
2411
            os.rename(tempname, stored_state_path)
3263
2412
        except (IOError, OSError) as e:
 
2413
            logger.warning("Could not save persistent state: {0}"
 
2414
                           .format(e))
3264
2415
            if not debug:
3265
2416
                try:
3266
2417
                    os.remove(tempname)
3267
2418
                except NameError:
3268
2419
                    pass
3269
 
            if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
3270
 
                logger.warning("Could not save persistent state: {}"
3271
 
                               .format(os.strerror(e.errno)))
3272
 
            else:
3273
 
                logger.warning("Could not save persistent state:",
3274
 
                               exc_info=e)
3275
 
                raise
 
2420
            if e.errno not in set((errno.ENOENT, errno.EACCES,
 
2421
                                   errno.EEXIST)):
 
2422
                raise e
3276
2423
        
3277
2424
        # Delete all clients, and settings from config
3278
2425
        while tcp_server.clients:
3279
2426
            name, client = tcp_server.clients.popitem()
3280
2427
            if use_dbus:
3281
2428
                client.remove_from_connection()
3282
 
            # Don't signal the disabling
 
2429
            # Don't signal anything except ClientRemoved
3283
2430
            client.disable(quiet=True)
3284
 
            # Emit D-Bus signal for removal
3285
2431
            if use_dbus:
3286
 
                mandos_dbus_service.client_removed_signal(client)
 
2432
                # Emit D-Bus signal
 
2433
                mandos_dbus_service.ClientRemoved(client
 
2434
                                                  .dbus_object_path,
 
2435
                                                  client.name)
3287
2436
        client_settings.clear()
3288
2437
    
3289
2438
    atexit.register(cleanup)
3290
2439
    
3291
2440
    for client in tcp_server.clients.itervalues():
3292
2441
        if use_dbus:
3293
 
            # Emit D-Bus signal for adding
3294
 
            mandos_dbus_service.client_added_signal(client)
 
2442
            # Emit D-Bus signal
 
2443
            mandos_dbus_service.ClientAdded(client.dbus_object_path)
3295
2444
        # Need to initiate checking of clients
3296
2445
        if client.enabled:
3297
2446
            client.init_checker()
3300
2449
    tcp_server.server_activate()
3301
2450
    
3302
2451
    # Find out what port we got
3303
 
    if zeroconf:
3304
 
        service.port = tcp_server.socket.getsockname()[1]
 
2452
    service.port = tcp_server.socket.getsockname()[1]
3305
2453
    if use_ipv6:
3306
2454
        logger.info("Now listening on address %r, port %d,"
3307
 
                    " flowinfo %d, scope_id %d",
3308
 
                    *tcp_server.socket.getsockname())
 
2455
                    " flowinfo %d, scope_id %d"
 
2456
                    % tcp_server.socket.getsockname())
3309
2457
    else:                       # IPv4
3310
 
        logger.info("Now listening on address %r, port %d",
3311
 
                    *tcp_server.socket.getsockname())
 
2458
        logger.info("Now listening on address %r, port %d"
 
2459
                    % tcp_server.socket.getsockname())
3312
2460
    
3313
2461
    #service.interface = tcp_server.socket.getsockname()[3]
3314
2462
    
3315
2463
    try:
3316
 
        if zeroconf:
3317
 
            # From the Avahi example code
3318
 
            try:
3319
 
                service.activate()
3320
 
            except dbus.exceptions.DBusException as error:
3321
 
                logger.critical("D-Bus Exception", exc_info=error)
3322
 
                cleanup()
3323
 
                sys.exit(1)
3324
 
            # End of Avahi example code
 
2464
        # From the Avahi example code
 
2465
        try:
 
2466
            service.activate()
 
2467
        except dbus.exceptions.DBusException as error:
 
2468
            logger.critical("DBusException: %s", error)
 
2469
            cleanup()
 
2470
            sys.exit(1)
 
2471
        # End of Avahi example code
3325
2472
        
3326
2473
        gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
3327
2474
                             lambda *args, **kwargs:
3331
2478
        logger.debug("Starting main loop")
3332
2479
        main_loop.run()
3333
2480
    except AvahiError as error:
3334
 
        logger.critical("Avahi Error", exc_info=error)
 
2481
        logger.critical("AvahiError: %s", error)
3335
2482
        cleanup()
3336
2483
        sys.exit(1)
3337
2484
    except KeyboardInterrupt:
3342
2489
    # Must run before the D-Bus bus name gets deregistered
3343
2490
    cleanup()
3344
2491
 
3345
 
 
3346
2492
if __name__ == '__main__':
3347
2493
    main()