/mandos/release

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/release

« back to all changes in this revision

Viewing changes to mandos

  • Committer: Teddy Hogeborn
  • Date: 2012-01-15 21:02:37 UTC
  • mfrom: (237.7.106 trunk)
  • Revision ID: teddy@recompile.se-20120115210237-6mcl2zuoxyn5smr5
Merge from trunk.

Show diffs side-by-side

added added

removed removed

Lines of Context:
11
11
# "AvahiService" class, and some lines in "main".
12
12
13
13
# Everything else is
14
 
# Copyright © 2008,2009 Teddy Hogeborn
15
 
# Copyright © 2008,2009 Björn Påhlsson
 
14
# Copyright © 2008-2012 Teddy Hogeborn
 
15
# Copyright © 2008-2012 Björn Påhlsson
16
16
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
28
28
# along with this program.  If not, see
29
29
# <http://www.gnu.org/licenses/>.
30
30
31
 
# Contact the authors at <mandos@fukt.bsnet.se>.
 
31
# Contact the authors at <mandos@recompile.se>.
32
32
33
33
 
34
 
from __future__ import division, with_statement, absolute_import
 
34
from __future__ import (division, absolute_import, print_function,
 
35
                        unicode_literals)
35
36
 
36
37
import SocketServer as socketserver
37
38
import socket
38
 
import optparse
 
39
import argparse
39
40
import datetime
40
41
import errno
41
42
import gnutls.crypto
55
56
import logging
56
57
import logging.handlers
57
58
import pwd
58
 
from contextlib import closing
 
59
import contextlib
59
60
import struct
60
61
import fcntl
61
62
import functools
 
63
import cPickle as pickle
 
64
import multiprocessing
 
65
import types
 
66
import binascii
 
67
import tempfile
62
68
 
63
69
import dbus
64
70
import dbus.service
67
73
from dbus.mainloop.glib import DBusGMainLoop
68
74
import ctypes
69
75
import ctypes.util
 
76
import xml.dom.minidom
 
77
import inspect
 
78
import GnuPGInterface
70
79
 
71
80
try:
72
81
    SO_BINDTODEVICE = socket.SO_BINDTODEVICE
76
85
    except ImportError:
77
86
        SO_BINDTODEVICE = None
78
87
 
79
 
 
80
 
version = "1.0.8"
81
 
 
82
 
logger = logging.Logger(u'mandos')
 
88
version = "1.5.2"
 
89
stored_state_file = "clients.pickle"
 
90
 
 
91
logger = logging.getLogger()
83
92
syslogger = (logging.handlers.SysLogHandler
84
93
             (facility = logging.handlers.SysLogHandler.LOG_DAEMON,
85
 
              address = "/dev/log"))
86
 
syslogger.setFormatter(logging.Formatter
87
 
                       (u'Mandos [%(process)d]: %(levelname)s:'
88
 
                        u' %(message)s'))
89
 
logger.addHandler(syslogger)
90
 
 
91
 
console = logging.StreamHandler()
92
 
console.setFormatter(logging.Formatter(u'%(name)s [%(process)d]:'
93
 
                                       u' %(levelname)s:'
94
 
                                       u' %(message)s'))
95
 
logger.addHandler(console)
 
94
              address = str("/dev/log")))
 
95
 
 
96
try:
 
97
    if_nametoindex = (ctypes.cdll.LoadLibrary
 
98
                      (ctypes.util.find_library("c"))
 
99
                      .if_nametoindex)
 
100
except (OSError, AttributeError):
 
101
    def if_nametoindex(interface):
 
102
        "Get an interface index the hard way, i.e. using fcntl()"
 
103
        SIOCGIFINDEX = 0x8933  # From /usr/include/linux/sockios.h
 
104
        with contextlib.closing(socket.socket()) as s:
 
105
            ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
 
106
                                struct.pack(str("16s16x"),
 
107
                                            interface))
 
108
        interface_index = struct.unpack(str("I"),
 
109
                                        ifreq[16:20])[0]
 
110
        return interface_index
 
111
 
 
112
 
 
113
def initlogger(debug, level=logging.WARNING):
 
114
    """init logger and add loglevel"""
 
115
    
 
116
    syslogger.setFormatter(logging.Formatter
 
117
                           ('Mandos [%(process)d]: %(levelname)s:'
 
118
                            ' %(message)s'))
 
119
    logger.addHandler(syslogger)
 
120
    
 
121
    if debug:
 
122
        console = logging.StreamHandler()
 
123
        console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
 
124
                                               ' [%(process)d]:'
 
125
                                               ' %(levelname)s:'
 
126
                                               ' %(message)s'))
 
127
        logger.addHandler(console)
 
128
    logger.setLevel(level)
 
129
 
 
130
 
 
131
class PGPError(Exception):
 
132
    """Exception if encryption/decryption fails"""
 
133
    pass
 
134
 
 
135
 
 
136
class PGPEngine(object):
 
137
    """A simple class for OpenPGP symmetric encryption & decryption"""
 
138
    def __init__(self):
 
139
        self.gnupg = GnuPGInterface.GnuPG()
 
140
        self.tempdir = tempfile.mkdtemp(prefix="mandos-")
 
141
        self.gnupg = GnuPGInterface.GnuPG()
 
142
        self.gnupg.options.meta_interactive = False
 
143
        self.gnupg.options.homedir = self.tempdir
 
144
        self.gnupg.options.extra_args.extend(['--force-mdc',
 
145
                                              '--quiet',
 
146
                                              '--no-use-agent'])
 
147
    
 
148
    def __enter__(self):
 
149
        return self
 
150
    
 
151
    def __exit__ (self, exc_type, exc_value, traceback):
 
152
        self._cleanup()
 
153
        return False
 
154
    
 
155
    def __del__(self):
 
156
        self._cleanup()
 
157
    
 
158
    def _cleanup(self):
 
159
        if self.tempdir is not None:
 
160
            # Delete contents of tempdir
 
161
            for root, dirs, files in os.walk(self.tempdir,
 
162
                                             topdown = False):
 
163
                for filename in files:
 
164
                    os.remove(os.path.join(root, filename))
 
165
                for dirname in dirs:
 
166
                    os.rmdir(os.path.join(root, dirname))
 
167
            # Remove tempdir
 
168
            os.rmdir(self.tempdir)
 
169
            self.tempdir = None
 
170
    
 
171
    def password_encode(self, password):
 
172
        # Passphrase can not be empty and can not contain newlines or
 
173
        # NUL bytes.  So we prefix it and hex encode it.
 
174
        return b"mandos" + binascii.hexlify(password)
 
175
    
 
176
    def encrypt(self, data, password):
 
177
        self.gnupg.passphrase = self.password_encode(password)
 
178
        with open(os.devnull) as devnull:
 
179
            try:
 
180
                proc = self.gnupg.run(['--symmetric'],
 
181
                                      create_fhs=['stdin', 'stdout'],
 
182
                                      attach_fhs={'stderr': devnull})
 
183
                with contextlib.closing(proc.handles['stdin']) as f:
 
184
                    f.write(data)
 
185
                with contextlib.closing(proc.handles['stdout']) as f:
 
186
                    ciphertext = f.read()
 
187
                proc.wait()
 
188
            except IOError as e:
 
189
                raise PGPError(e)
 
190
        self.gnupg.passphrase = None
 
191
        return ciphertext
 
192
    
 
193
    def decrypt(self, data, password):
 
194
        self.gnupg.passphrase = self.password_encode(password)
 
195
        with open(os.devnull) as devnull:
 
196
            try:
 
197
                proc = self.gnupg.run(['--decrypt'],
 
198
                                      create_fhs=['stdin', 'stdout'],
 
199
                                      attach_fhs={'stderr': devnull})
 
200
                with contextlib.closing(proc.handles['stdin'] ) as f:
 
201
                    f.write(data)
 
202
                with contextlib.closing(proc.handles['stdout']) as f:
 
203
                    decrypted_plaintext = f.read()
 
204
                proc.wait()
 
205
            except IOError as e:
 
206
                raise PGPError(e)
 
207
        self.gnupg.passphrase = None
 
208
        return decrypted_plaintext
 
209
 
 
210
 
96
211
 
97
212
class AvahiError(Exception):
98
213
    def __init__(self, value, *args, **kwargs):
114
229
    Attributes:
115
230
    interface: integer; avahi.IF_UNSPEC or an interface index.
116
231
               Used to optionally bind to the specified interface.
117
 
    name: string; Example: u'Mandos'
118
 
    type: string; Example: u'_mandos._tcp'.
 
232
    name: string; Example: 'Mandos'
 
233
    type: string; Example: '_mandos._tcp'.
119
234
                  See <http://www.dns-sd.org/ServiceTypes.html>
120
235
    port: integer; what port to announce
121
236
    TXT: list of strings; TXT record for the service
130
245
    """
131
246
    def __init__(self, interface = avahi.IF_UNSPEC, name = None,
132
247
                 servicetype = None, port = None, TXT = None,
133
 
                 domain = u"", host = u"", max_renames = 32768,
 
248
                 domain = "", host = "", max_renames = 32768,
134
249
                 protocol = avahi.PROTO_UNSPEC, bus = None):
135
250
        self.interface = interface
136
251
        self.name = name
145
260
        self.group = None       # our entry group
146
261
        self.server = None
147
262
        self.bus = bus
 
263
        self.entry_group_state_changed_match = None
148
264
    def rename(self):
149
265
        """Derived from the Avahi example code"""
150
266
        if self.rename_count >= self.max_renames:
151
 
            logger.critical(u"No suitable Zeroconf service name found"
152
 
                            u" after %i retries, exiting.",
 
267
            logger.critical("No suitable Zeroconf service name found"
 
268
                            " after %i retries, exiting.",
153
269
                            self.rename_count)
154
 
            raise AvahiServiceError(u"Too many renames")
155
 
        self.name = self.server.GetAlternativeServiceName(self.name)
156
 
        logger.info(u"Changing Zeroconf service name to %r ...",
157
 
                    unicode(self.name))
158
 
        syslogger.setFormatter(logging.Formatter
159
 
                               (u'Mandos (%s) [%%(process)d]:'
160
 
                                u' %%(levelname)s: %%(message)s'
161
 
                                % self.name))
 
270
            raise AvahiServiceError("Too many renames")
 
271
        self.name = unicode(self.server
 
272
                            .GetAlternativeServiceName(self.name))
 
273
        logger.info("Changing Zeroconf service name to %r ...",
 
274
                    self.name)
162
275
        self.remove()
163
 
        self.add()
 
276
        try:
 
277
            self.add()
 
278
        except dbus.exceptions.DBusException as error:
 
279
            logger.critical("DBusException: %s", error)
 
280
            self.cleanup()
 
281
            os._exit(1)
164
282
        self.rename_count += 1
165
283
    def remove(self):
166
284
        """Derived from the Avahi example code"""
 
285
        if self.entry_group_state_changed_match is not None:
 
286
            self.entry_group_state_changed_match.remove()
 
287
            self.entry_group_state_changed_match = None
167
288
        if self.group is not None:
168
289
            self.group.Reset()
169
290
    def add(self):
170
291
        """Derived from the Avahi example code"""
 
292
        self.remove()
171
293
        if self.group is None:
172
294
            self.group = dbus.Interface(
173
295
                self.bus.get_object(avahi.DBUS_NAME,
174
296
                                    self.server.EntryGroupNew()),
175
297
                avahi.DBUS_INTERFACE_ENTRY_GROUP)
176
 
            self.group.connect_to_signal('StateChanged',
177
 
                                         self.entry_group_state_changed)
178
 
        logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
 
298
        self.entry_group_state_changed_match = (
 
299
            self.group.connect_to_signal(
 
300
                'StateChanged', self.entry_group_state_changed))
 
301
        logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
179
302
                     self.name, self.type)
180
303
        self.group.AddService(
181
304
            self.interface,
188
311
        self.group.Commit()
189
312
    def entry_group_state_changed(self, state, error):
190
313
        """Derived from the Avahi example code"""
191
 
        logger.debug(u"Avahi state change: %i", state)
 
314
        logger.debug("Avahi entry group state change: %i", state)
192
315
        
193
316
        if state == avahi.ENTRY_GROUP_ESTABLISHED:
194
 
            logger.debug(u"Zeroconf service established.")
 
317
            logger.debug("Zeroconf service established.")
195
318
        elif state == avahi.ENTRY_GROUP_COLLISION:
196
 
            logger.warning(u"Zeroconf service name collision.")
 
319
            logger.info("Zeroconf service name collision.")
197
320
            self.rename()
198
321
        elif state == avahi.ENTRY_GROUP_FAILURE:
199
 
            logger.critical(u"Avahi: Error in group state changed %s",
 
322
            logger.critical("Avahi: Error in group state changed %s",
200
323
                            unicode(error))
201
 
            raise AvahiGroupError(u"State changed: %s"
 
324
            raise AvahiGroupError("State changed: %s"
202
325
                                  % unicode(error))
203
326
    def cleanup(self):
204
327
        """Derived from the Avahi example code"""
205
328
        if self.group is not None:
206
 
            self.group.Free()
 
329
            try:
 
330
                self.group.Free()
 
331
            except (dbus.exceptions.UnknownMethodException,
 
332
                    dbus.exceptions.DBusException):
 
333
                pass
207
334
            self.group = None
208
 
    def server_state_changed(self, state):
 
335
        self.remove()
 
336
    def server_state_changed(self, state, error=None):
209
337
        """Derived from the Avahi example code"""
210
 
        if state == avahi.SERVER_COLLISION:
211
 
            logger.error(u"Zeroconf server name collision")
212
 
            self.remove()
 
338
        logger.debug("Avahi server state change: %i", state)
 
339
        bad_states = { avahi.SERVER_INVALID:
 
340
                           "Zeroconf server invalid",
 
341
                       avahi.SERVER_REGISTERING: None,
 
342
                       avahi.SERVER_COLLISION:
 
343
                           "Zeroconf server name collision",
 
344
                       avahi.SERVER_FAILURE:
 
345
                           "Zeroconf server failure" }
 
346
        if state in bad_states:
 
347
            if bad_states[state] is not None:
 
348
                if error is None:
 
349
                    logger.error(bad_states[state])
 
350
                else:
 
351
                    logger.error(bad_states[state] + ": %r", error)
 
352
            self.cleanup()
213
353
        elif state == avahi.SERVER_RUNNING:
214
354
            self.add()
 
355
        else:
 
356
            if error is None:
 
357
                logger.debug("Unknown state: %r", state)
 
358
            else:
 
359
                logger.debug("Unknown state: %r: %r", state, error)
215
360
    def activate(self):
216
361
        """Derived from the Avahi example code"""
217
362
        if self.server is None:
218
363
            self.server = dbus.Interface(
219
364
                self.bus.get_object(avahi.DBUS_NAME,
220
 
                                    avahi.DBUS_PATH_SERVER),
 
365
                                    avahi.DBUS_PATH_SERVER,
 
366
                                    follow_name_owner_changes=True),
221
367
                avahi.DBUS_INTERFACE_SERVER)
222
 
        self.server.connect_to_signal(u"StateChanged",
 
368
        self.server.connect_to_signal("StateChanged",
223
369
                                 self.server_state_changed)
224
370
        self.server_state_changed(self.server.GetState())
225
371
 
 
372
class AvahiServiceToSyslog(AvahiService):
 
373
    def rename(self):
 
374
        """Add the new name to the syslog messages"""
 
375
        ret = AvahiService.rename(self)
 
376
        syslogger.setFormatter(logging.Formatter
 
377
                               ('Mandos (%s) [%%(process)d]:'
 
378
                                ' %%(levelname)s: %%(message)s'
 
379
                                % self.name))
 
380
        return ret
226
381
 
 
382
def timedelta_to_milliseconds(td):
 
383
    "Convert a datetime.timedelta() to milliseconds"
 
384
    return ((td.days * 24 * 60 * 60 * 1000)
 
385
            + (td.seconds * 1000)
 
386
            + (td.microseconds // 1000))
 
387
        
227
388
class Client(object):
228
389
    """A representation of a client host served by this server.
229
390
    
230
391
    Attributes:
231
 
    name:       string; from the config file, used in log messages and
232
 
                        D-Bus identifiers
233
 
    fingerprint: string (40 or 32 hexadecimal digits); used to
234
 
                 uniquely identify the client
235
 
    secret:     bytestring; sent verbatim (over TLS) to client
236
 
    host:       string; available for use by the checker command
237
 
    created:    datetime.datetime(); (UTC) object creation
238
 
    last_enabled: datetime.datetime(); (UTC)
239
 
    enabled:    bool()
240
 
    last_checked_ok: datetime.datetime(); (UTC) or None
241
 
    timeout:    datetime.timedelta(); How long from last_checked_ok
242
 
                                      until this client is invalid
243
 
    interval:   datetime.timedelta(); How often to start a new checker
244
 
    disable_hook:  If set, called by disable() as disable_hook(self)
 
392
    approved:   bool(); 'None' if not yet approved/disapproved
 
393
    approval_delay: datetime.timedelta(); Time to wait for approval
 
394
    approval_duration: datetime.timedelta(); Duration of one approval
245
395
    checker:    subprocess.Popen(); a running checker process used
246
396
                                    to see if the client lives.
247
397
                                    'None' if no process is running.
248
 
    checker_initiator_tag: a gobject event source tag, or None
249
 
    disable_initiator_tag:    - '' -
250
 
    checker_callback_tag:  - '' -
251
 
    checker_command: string; External command which is run to check if
252
 
                     client lives.  %() expansions are done at
 
398
    checker_callback_tag: a gobject event source tag, or None
 
399
    checker_command: string; External command which is run to check
 
400
                     if client lives.  %() expansions are done at
253
401
                     runtime with vars(self) as dict, so that for
254
402
                     instance %(name)s can be used in the command.
 
403
    checker_initiator_tag: a gobject event source tag, or None
 
404
    created:    datetime.datetime(); (UTC) object creation
 
405
    client_structure: Object describing what attributes a client has
 
406
                      and is used for storing the client at exit
255
407
    current_checker_command: string; current running checker_command
 
408
    disable_initiator_tag: a gobject event source tag, or None
 
409
    enabled:    bool()
 
410
    fingerprint: string (40 or 32 hexadecimal digits); used to
 
411
                 uniquely identify the client
 
412
    host:       string; available for use by the checker command
 
413
    interval:   datetime.timedelta(); How often to start a new checker
 
414
    last_approval_request: datetime.datetime(); (UTC) or None
 
415
    last_checked_ok: datetime.datetime(); (UTC) or None
 
416
    last_checker_status: integer between 0 and 255 reflecting exit
 
417
                         status of last checker. -1 reflects crashed
 
418
                         checker, -2 means no checker completed yet.
 
419
    last_enabled: datetime.datetime(); (UTC) or None
 
420
    name:       string; from the config file, used in log messages and
 
421
                        D-Bus identifiers
 
422
    secret:     bytestring; sent verbatim (over TLS) to client
 
423
    timeout:    datetime.timedelta(); How long from last_checked_ok
 
424
                                      until this client is disabled
 
425
    extended_timeout:   extra long timeout when secret has been sent
 
426
    runtime_expansions: Allowed attributes for runtime expansion.
 
427
    expires:    datetime.datetime(); time (UTC) when a client will be
 
428
                disabled, or None
256
429
    """
257
430
    
258
 
    @staticmethod
259
 
    def _datetime_to_milliseconds(dt):
260
 
        "Convert a datetime.datetime() to milliseconds"
261
 
        return ((dt.days * 24 * 60 * 60 * 1000)
262
 
                + (dt.seconds * 1000)
263
 
                + (dt.microseconds // 1000))
 
431
    runtime_expansions = ("approval_delay", "approval_duration",
 
432
                          "created", "enabled", "fingerprint",
 
433
                          "host", "interval", "last_checked_ok",
 
434
                          "last_enabled", "name", "timeout")
 
435
    client_defaults = { "timeout": "5m",
 
436
                        "extended_timeout": "15m",
 
437
                        "interval": "2m",
 
438
                        "checker": "fping -q -- %%(host)s",
 
439
                        "host": "",
 
440
                        "approval_delay": "0s",
 
441
                        "approval_duration": "1s",
 
442
                        "approved_by_default": "True",
 
443
                        "enabled": "True",
 
444
                        }
264
445
    
265
446
    def timeout_milliseconds(self):
266
447
        "Return the 'timeout' attribute in milliseconds"
267
 
        return self._datetime_to_milliseconds(self.timeout)
 
448
        return timedelta_to_milliseconds(self.timeout)
 
449
    
 
450
    def extended_timeout_milliseconds(self):
 
451
        "Return the 'extended_timeout' attribute in milliseconds"
 
452
        return timedelta_to_milliseconds(self.extended_timeout)
268
453
    
269
454
    def interval_milliseconds(self):
270
455
        "Return the 'interval' attribute in milliseconds"
271
 
        return self._datetime_to_milliseconds(self.interval)
 
456
        return timedelta_to_milliseconds(self.interval)
272
457
    
273
 
    def __init__(self, name = None, disable_hook=None, config=None):
 
458
    def approval_delay_milliseconds(self):
 
459
        return timedelta_to_milliseconds(self.approval_delay)
 
460
 
 
461
    @staticmethod
 
462
    def config_parser(config):
 
463
        """Construct a new dict of client settings of this form:
 
464
        { client_name: {setting_name: value, ...}, ...}
 
465
        with exceptions for any special settings as defined above.
 
466
        NOTE: Must be a pure function. Must return the same result
 
467
        value given the same arguments.
 
468
        """
 
469
        settings = {}
 
470
        for client_name in config.sections():
 
471
            section = dict(config.items(client_name))
 
472
            client = settings[client_name] = {}
 
473
            
 
474
            client["host"] = section["host"]
 
475
            # Reformat values from string types to Python types
 
476
            client["approved_by_default"] = config.getboolean(
 
477
                client_name, "approved_by_default")
 
478
            client["enabled"] = config.getboolean(client_name,
 
479
                                                  "enabled")
 
480
            
 
481
            client["fingerprint"] = (section["fingerprint"].upper()
 
482
                                     .replace(" ", ""))
 
483
            if "secret" in section:
 
484
                client["secret"] = section["secret"].decode("base64")
 
485
            elif "secfile" in section:
 
486
                with open(os.path.expanduser(os.path.expandvars
 
487
                                             (section["secfile"])),
 
488
                          "rb") as secfile:
 
489
                    client["secret"] = secfile.read()
 
490
            else:
 
491
                raise TypeError("No secret or secfile for section %s"
 
492
                                % section)
 
493
            client["timeout"] = string_to_delta(section["timeout"])
 
494
            client["extended_timeout"] = string_to_delta(
 
495
                section["extended_timeout"])
 
496
            client["interval"] = string_to_delta(section["interval"])
 
497
            client["approval_delay"] = string_to_delta(
 
498
                section["approval_delay"])
 
499
            client["approval_duration"] = string_to_delta(
 
500
                section["approval_duration"])
 
501
            client["checker_command"] = section["checker"]
 
502
            client["last_approval_request"] = None
 
503
            client["last_checked_ok"] = None
 
504
            client["last_checker_status"] = -2
 
505
        
 
506
        return settings
 
507
        
 
508
        
 
509
    def __init__(self, settings, name = None):
274
510
        """Note: the 'checker' key in 'config' sets the
275
511
        'checker_command' attribute and *not* the 'checker'
276
512
        attribute."""
277
513
        self.name = name
278
 
        if config is None:
279
 
            config = {}
280
 
        logger.debug(u"Creating client %r", self.name)
 
514
        # adding all client settings
 
515
        for setting, value in settings.iteritems():
 
516
            setattr(self, setting, value)
 
517
        
 
518
        if self.enabled:
 
519
            if not hasattr(self, "last_enabled"):
 
520
                self.last_enabled = datetime.datetime.utcnow()
 
521
            if not hasattr(self, "expires"):
 
522
                self.expires = (datetime.datetime.utcnow()
 
523
                                + self.timeout)
 
524
        else:
 
525
            self.last_enabled = None
 
526
            self.expires = None
 
527
       
 
528
        logger.debug("Creating client %r", self.name)
281
529
        # Uppercase and remove spaces from fingerprint for later
282
530
        # comparison purposes with return value from the fingerprint()
283
531
        # function
284
 
        self.fingerprint = (config[u"fingerprint"].upper()
285
 
                            .replace(u" ", u""))
286
 
        logger.debug(u"  Fingerprint: %s", self.fingerprint)
287
 
        if u"secret" in config:
288
 
            self.secret = config[u"secret"].decode(u"base64")
289
 
        elif u"secfile" in config:
290
 
            with closing(open(os.path.expanduser
291
 
                              (os.path.expandvars
292
 
                               (config[u"secfile"])))) as secfile:
293
 
                self.secret = secfile.read()
294
 
        else:
295
 
            raise TypeError(u"No secret or secfile for client %s"
296
 
                            % self.name)
297
 
        self.host = config.get(u"host", u"")
298
 
        self.created = datetime.datetime.utcnow()
299
 
        self.enabled = False
300
 
        self.last_enabled = None
301
 
        self.last_checked_ok = None
302
 
        self.timeout = string_to_delta(config[u"timeout"])
303
 
        self.interval = string_to_delta(config[u"interval"])
304
 
        self.disable_hook = disable_hook
 
532
        logger.debug("  Fingerprint: %s", self.fingerprint)
 
533
        self.created = settings.get("created",
 
534
                                    datetime.datetime.utcnow())
 
535
 
 
536
        # attributes specific for this server instance
305
537
        self.checker = None
306
538
        self.checker_initiator_tag = None
307
539
        self.disable_initiator_tag = None
308
540
        self.checker_callback_tag = None
309
 
        self.checker_command = config[u"checker"]
310
541
        self.current_checker_command = None
311
 
        self.last_connect = None
 
542
        self.approved = None
 
543
        self.approvals_pending = 0
 
544
        self.changedstate = (multiprocessing_manager
 
545
                             .Condition(multiprocessing_manager
 
546
                                        .Lock()))
 
547
        self.client_structure = [attr for attr in
 
548
                                 self.__dict__.iterkeys()
 
549
                                 if not attr.startswith("_")]
 
550
        self.client_structure.append("client_structure")
 
551
        
 
552
        for name, t in inspect.getmembers(type(self),
 
553
                                          lambda obj:
 
554
                                              isinstance(obj,
 
555
                                                         property)):
 
556
            if not name.startswith("_"):
 
557
                self.client_structure.append(name)
 
558
    
 
559
    # Send notice to process children that client state has changed
 
560
    def send_changedstate(self):
 
561
        with self.changedstate:
 
562
            self.changedstate.notify_all()
312
563
    
313
564
    def enable(self):
314
565
        """Start this client's checker and timeout hooks"""
 
566
        if getattr(self, "enabled", False):
 
567
            # Already enabled
 
568
            return
 
569
        self.send_changedstate()
 
570
        self.expires = datetime.datetime.utcnow() + self.timeout
 
571
        self.enabled = True
315
572
        self.last_enabled = datetime.datetime.utcnow()
 
573
        self.init_checker()
 
574
    
 
575
    def disable(self, quiet=True):
 
576
        """Disable this client."""
 
577
        if not getattr(self, "enabled", False):
 
578
            return False
 
579
        if not quiet:
 
580
            self.send_changedstate()
 
581
        if not quiet:
 
582
            logger.info("Disabling client %s", self.name)
 
583
        if getattr(self, "disable_initiator_tag", False):
 
584
            gobject.source_remove(self.disable_initiator_tag)
 
585
            self.disable_initiator_tag = None
 
586
        self.expires = None
 
587
        if getattr(self, "checker_initiator_tag", False):
 
588
            gobject.source_remove(self.checker_initiator_tag)
 
589
            self.checker_initiator_tag = None
 
590
        self.stop_checker()
 
591
        self.enabled = False
 
592
        # Do not run this again if called by a gobject.timeout_add
 
593
        return False
 
594
    
 
595
    def __del__(self):
 
596
        self.disable()
 
597
    
 
598
    def init_checker(self):
316
599
        # Schedule a new checker to be started an 'interval' from now,
317
600
        # and every interval from then on.
318
601
        self.checker_initiator_tag = (gobject.timeout_add
319
602
                                      (self.interval_milliseconds(),
320
603
                                       self.start_checker))
321
 
        # Also start a new checker *right now*.
322
 
        self.start_checker()
323
604
        # Schedule a disable() when 'timeout' has passed
324
605
        self.disable_initiator_tag = (gobject.timeout_add
325
606
                                   (self.timeout_milliseconds(),
326
607
                                    self.disable))
327
 
        self.enabled = True
328
 
    
329
 
    def disable(self):
330
 
        """Disable this client."""
331
 
        if not getattr(self, "enabled", False):
332
 
            return False
333
 
        logger.info(u"Disabling client %s", self.name)
334
 
        if getattr(self, u"disable_initiator_tag", False):
335
 
            gobject.source_remove(self.disable_initiator_tag)
336
 
            self.disable_initiator_tag = None
337
 
        if getattr(self, u"checker_initiator_tag", False):
338
 
            gobject.source_remove(self.checker_initiator_tag)
339
 
            self.checker_initiator_tag = None
340
 
        self.stop_checker()
341
 
        if self.disable_hook:
342
 
            self.disable_hook(self)
343
 
        self.enabled = False
344
 
        # Do not run this again if called by a gobject.timeout_add
345
 
        return False
346
 
    
347
 
    def __del__(self):
348
 
        self.disable_hook = None
349
 
        self.disable()
 
608
        # Also start a new checker *right now*.
 
609
        self.start_checker()
350
610
    
351
611
    def checker_callback(self, pid, condition, command):
352
612
        """The checker has completed, so take appropriate actions."""
353
613
        self.checker_callback_tag = None
354
614
        self.checker = None
355
615
        if os.WIFEXITED(condition):
356
 
            exitstatus = os.WEXITSTATUS(condition)
357
 
            if exitstatus == 0:
358
 
                logger.info(u"Checker for %(name)s succeeded",
 
616
            self.last_checker_status = os.WEXITSTATUS(condition)
 
617
            if self.last_checker_status == 0:
 
618
                logger.info("Checker for %(name)s succeeded",
359
619
                            vars(self))
360
620
                self.checked_ok()
361
621
            else:
362
 
                logger.info(u"Checker for %(name)s failed",
 
622
                logger.info("Checker for %(name)s failed",
363
623
                            vars(self))
364
624
        else:
365
 
            logger.warning(u"Checker for %(name)s crashed?",
 
625
            self.last_checker_status = -1
 
626
            logger.warning("Checker for %(name)s crashed?",
366
627
                           vars(self))
367
628
    
368
629
    def checked_ok(self):
369
 
        """Bump up the timeout for this client.
370
 
        
371
 
        This should only be called when the client has been seen,
372
 
        alive and well.
373
 
        """
 
630
        """Assert that the client has been seen, alive and well."""
374
631
        self.last_checked_ok = datetime.datetime.utcnow()
375
 
        gobject.source_remove(self.disable_initiator_tag)
376
 
        self.disable_initiator_tag = (gobject.timeout_add
377
 
                                      (self.timeout_milliseconds(),
378
 
                                       self.disable))
 
632
        self.last_checker_status = 0
 
633
        self.bump_timeout()
 
634
    
 
635
    def bump_timeout(self, timeout=None):
 
636
        """Bump up the timeout for this client."""
 
637
        if timeout is None:
 
638
            timeout = self.timeout
 
639
        if self.disable_initiator_tag is not None:
 
640
            gobject.source_remove(self.disable_initiator_tag)
 
641
        if getattr(self, "enabled", False):
 
642
            self.disable_initiator_tag = (gobject.timeout_add
 
643
                                          (timedelta_to_milliseconds
 
644
                                           (timeout), self.disable))
 
645
            self.expires = datetime.datetime.utcnow() + timeout
 
646
    
 
647
    def need_approval(self):
 
648
        self.last_approval_request = datetime.datetime.utcnow()
379
649
    
380
650
    def start_checker(self):
381
651
        """Start a new checker subprocess if one is not running.
388
658
        # client would inevitably timeout, since no checker would get
389
659
        # a chance to run to completion.  If we instead leave running
390
660
        # checkers alone, the checker would have to take more time
391
 
        # than 'timeout' for the client to be declared invalid, which
392
 
        # is as it should be.
 
661
        # than 'timeout' for the client to be disabled, which is as it
 
662
        # should be.
393
663
        
394
664
        # If a checker exists, make sure it is not a zombie
395
 
        if self.checker is not None:
 
665
        try:
396
666
            pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
 
667
        except (AttributeError, OSError) as error:
 
668
            if (isinstance(error, OSError)
 
669
                and error.errno != errno.ECHILD):
 
670
                raise error
 
671
        else:
397
672
            if pid:
398
 
                logger.warning(u"Checker was a zombie")
 
673
                logger.warning("Checker was a zombie")
399
674
                gobject.source_remove(self.checker_callback_tag)
400
675
                self.checker_callback(pid, status,
401
676
                                      self.current_checker_command)
406
681
                command = self.checker_command % self.host
407
682
            except TypeError:
408
683
                # Escape attributes for the shell
409
 
                escaped_attrs = dict((key,
410
 
                                      re.escape(unicode(str(val),
411
 
                                                        errors=
412
 
                                                        u'replace')))
413
 
                                     for key, val in
414
 
                                     vars(self).iteritems())
 
684
                escaped_attrs = dict(
 
685
                    (attr,
 
686
                     re.escape(unicode(str(getattr(self, attr, "")),
 
687
                                       errors=
 
688
                                       'replace')))
 
689
                    for attr in
 
690
                    self.runtime_expansions)
 
691
                
415
692
                try:
416
693
                    command = self.checker_command % escaped_attrs
417
 
                except TypeError, error:
418
 
                    logger.error(u'Could not format string "%s":'
419
 
                                 u' %s', self.checker_command, error)
 
694
                except TypeError as error:
 
695
                    logger.error('Could not format string "%s":'
 
696
                                 ' %s', self.checker_command, error)
420
697
                    return True # Try again later
421
698
            self.current_checker_command = command
422
699
            try:
423
 
                logger.info(u"Starting checker %r for %s",
 
700
                logger.info("Starting checker %r for %s",
424
701
                            command, self.name)
425
702
                # We don't need to redirect stdout and stderr, since
426
703
                # in normal mode, that is already done by daemon(),
428
705
                # always replaced by /dev/null.)
429
706
                self.checker = subprocess.Popen(command,
430
707
                                                close_fds=True,
431
 
                                                shell=True, cwd=u"/")
 
708
                                                shell=True, cwd="/")
432
709
                self.checker_callback_tag = (gobject.child_watch_add
433
710
                                             (self.checker.pid,
434
711
                                              self.checker_callback,
439
716
                if pid:
440
717
                    gobject.source_remove(self.checker_callback_tag)
441
718
                    self.checker_callback(pid, status, command)
442
 
            except OSError, error:
443
 
                logger.error(u"Failed to start subprocess: %s",
 
719
            except OSError as error:
 
720
                logger.error("Failed to start subprocess: %s",
444
721
                             error)
445
722
        # Re-run this periodically if run by gobject.timeout_add
446
723
        return True
450
727
        if self.checker_callback_tag:
451
728
            gobject.source_remove(self.checker_callback_tag)
452
729
            self.checker_callback_tag = None
453
 
        if getattr(self, u"checker", None) is None:
 
730
        if getattr(self, "checker", None) is None:
454
731
            return
455
 
        logger.debug(u"Stopping checker for %(name)s", vars(self))
 
732
        logger.debug("Stopping checker for %(name)s", vars(self))
456
733
        try:
457
734
            os.kill(self.checker.pid, signal.SIGTERM)
458
 
            #os.sleep(0.5)
 
735
            #time.sleep(0.5)
459
736
            #if self.checker.poll() is None:
460
737
            #    os.kill(self.checker.pid, signal.SIGKILL)
461
 
        except OSError, error:
 
738
        except OSError as error:
462
739
            if error.errno != errno.ESRCH: # No such process
463
740
                raise
464
741
        self.checker = None
465
 
    
466
 
    def still_valid(self):
467
 
        """Has the timeout not yet passed for this client?"""
468
 
        if not getattr(self, u"enabled", False):
469
 
            return False
470
 
        now = datetime.datetime.utcnow()
471
 
        if self.last_checked_ok is None:
472
 
            return now < (self.created + self.timeout)
473
 
        else:
474
 
            return now < (self.last_checked_ok + self.timeout)
475
 
 
476
 
 
477
 
class ClientDBus(Client, dbus.service.Object):
 
742
 
 
743
 
 
744
def dbus_service_property(dbus_interface, signature="v",
 
745
                          access="readwrite", byte_arrays=False):
 
746
    """Decorators for marking methods of a DBusObjectWithProperties to
 
747
    become properties on the D-Bus.
 
748
    
 
749
    The decorated method will be called with no arguments by "Get"
 
750
    and with one argument by "Set".
 
751
    
 
752
    The parameters, where they are supported, are the same as
 
753
    dbus.service.method, except there is only "signature", since the
 
754
    type from Get() and the type sent to Set() is the same.
 
755
    """
 
756
    # Encoding deeply encoded byte arrays is not supported yet by the
 
757
    # "Set" method, so we fail early here:
 
758
    if byte_arrays and signature != "ay":
 
759
        raise ValueError("Byte arrays not supported for non-'ay'"
 
760
                         " signature %r" % signature)
 
761
    def decorator(func):
 
762
        func._dbus_is_property = True
 
763
        func._dbus_interface = dbus_interface
 
764
        func._dbus_signature = signature
 
765
        func._dbus_access = access
 
766
        func._dbus_name = func.__name__
 
767
        if func._dbus_name.endswith("_dbus_property"):
 
768
            func._dbus_name = func._dbus_name[:-14]
 
769
        func._dbus_get_args_options = {'byte_arrays': byte_arrays }
 
770
        return func
 
771
    return decorator
 
772
 
 
773
 
 
774
class DBusPropertyException(dbus.exceptions.DBusException):
 
775
    """A base class for D-Bus property-related exceptions
 
776
    """
 
777
    def __unicode__(self):
 
778
        return unicode(str(self))
 
779
 
 
780
 
 
781
class DBusPropertyAccessException(DBusPropertyException):
 
782
    """A property's access permissions disallows an operation.
 
783
    """
 
784
    pass
 
785
 
 
786
 
 
787
class DBusPropertyNotFound(DBusPropertyException):
 
788
    """An attempt was made to access a non-existing property.
 
789
    """
 
790
    pass
 
791
 
 
792
 
 
793
class DBusObjectWithProperties(dbus.service.Object):
 
794
    """A D-Bus object with properties.
 
795
    
 
796
    Classes inheriting from this can use the dbus_service_property
 
797
    decorator to expose methods as D-Bus properties.  It exposes the
 
798
    standard Get(), Set(), and GetAll() methods on the D-Bus.
 
799
    """
 
800
    
 
801
    @staticmethod
 
802
    def _is_dbus_property(obj):
 
803
        return getattr(obj, "_dbus_is_property", False)
 
804
    
 
805
    def _get_all_dbus_properties(self):
 
806
        """Returns a generator of (name, attribute) pairs
 
807
        """
 
808
        return ((prop.__get__(self)._dbus_name, prop.__get__(self))
 
809
                for cls in self.__class__.__mro__
 
810
                for name, prop in
 
811
                inspect.getmembers(cls, self._is_dbus_property))
 
812
    
 
813
    def _get_dbus_property(self, interface_name, property_name):
 
814
        """Returns a bound method if one exists which is a D-Bus
 
815
        property with the specified name and interface.
 
816
        """
 
817
        for cls in  self.__class__.__mro__:
 
818
            for name, value in (inspect.getmembers
 
819
                                (cls, self._is_dbus_property)):
 
820
                if (value._dbus_name == property_name
 
821
                    and value._dbus_interface == interface_name):
 
822
                    return value.__get__(self)
 
823
        
 
824
        # No such property
 
825
        raise DBusPropertyNotFound(self.dbus_object_path + ":"
 
826
                                   + interface_name + "."
 
827
                                   + property_name)
 
828
    
 
829
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
 
830
                         out_signature="v")
 
831
    def Get(self, interface_name, property_name):
 
832
        """Standard D-Bus property Get() method, see D-Bus standard.
 
833
        """
 
834
        prop = self._get_dbus_property(interface_name, property_name)
 
835
        if prop._dbus_access == "write":
 
836
            raise DBusPropertyAccessException(property_name)
 
837
        value = prop()
 
838
        if not hasattr(value, "variant_level"):
 
839
            return value
 
840
        return type(value)(value, variant_level=value.variant_level+1)
 
841
    
 
842
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
 
843
    def Set(self, interface_name, property_name, value):
 
844
        """Standard D-Bus property Set() method, see D-Bus standard.
 
845
        """
 
846
        prop = self._get_dbus_property(interface_name, property_name)
 
847
        if prop._dbus_access == "read":
 
848
            raise DBusPropertyAccessException(property_name)
 
849
        if prop._dbus_get_args_options["byte_arrays"]:
 
850
            # The byte_arrays option is not supported yet on
 
851
            # signatures other than "ay".
 
852
            if prop._dbus_signature != "ay":
 
853
                raise ValueError
 
854
            value = dbus.ByteArray(b''.join(chr(byte)
 
855
                                            for byte in value))
 
856
        prop(value)
 
857
    
 
858
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
 
859
                         out_signature="a{sv}")
 
860
    def GetAll(self, interface_name):
 
861
        """Standard D-Bus property GetAll() method, see D-Bus
 
862
        standard.
 
863
        
 
864
        Note: Will not include properties with access="write".
 
865
        """
 
866
        properties = {}
 
867
        for name, prop in self._get_all_dbus_properties():
 
868
            if (interface_name
 
869
                and interface_name != prop._dbus_interface):
 
870
                # Interface non-empty but did not match
 
871
                continue
 
872
            # Ignore write-only properties
 
873
            if prop._dbus_access == "write":
 
874
                continue
 
875
            value = prop()
 
876
            if not hasattr(value, "variant_level"):
 
877
                properties[name] = value
 
878
                continue
 
879
            properties[name] = type(value)(value, variant_level=
 
880
                                           value.variant_level+1)
 
881
        return dbus.Dictionary(properties, signature="sv")
 
882
    
 
883
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
 
884
                         out_signature="s",
 
885
                         path_keyword='object_path',
 
886
                         connection_keyword='connection')
 
887
    def Introspect(self, object_path, connection):
 
888
        """Standard D-Bus method, overloaded to insert property tags.
 
889
        """
 
890
        xmlstring = dbus.service.Object.Introspect(self, object_path,
 
891
                                                   connection)
 
892
        try:
 
893
            document = xml.dom.minidom.parseString(xmlstring)
 
894
            def make_tag(document, name, prop):
 
895
                e = document.createElement("property")
 
896
                e.setAttribute("name", name)
 
897
                e.setAttribute("type", prop._dbus_signature)
 
898
                e.setAttribute("access", prop._dbus_access)
 
899
                return e
 
900
            for if_tag in document.getElementsByTagName("interface"):
 
901
                for tag in (make_tag(document, name, prop)
 
902
                            for name, prop
 
903
                            in self._get_all_dbus_properties()
 
904
                            if prop._dbus_interface
 
905
                            == if_tag.getAttribute("name")):
 
906
                    if_tag.appendChild(tag)
 
907
                # Add the names to the return values for the
 
908
                # "org.freedesktop.DBus.Properties" methods
 
909
                if (if_tag.getAttribute("name")
 
910
                    == "org.freedesktop.DBus.Properties"):
 
911
                    for cn in if_tag.getElementsByTagName("method"):
 
912
                        if cn.getAttribute("name") == "Get":
 
913
                            for arg in cn.getElementsByTagName("arg"):
 
914
                                if (arg.getAttribute("direction")
 
915
                                    == "out"):
 
916
                                    arg.setAttribute("name", "value")
 
917
                        elif cn.getAttribute("name") == "GetAll":
 
918
                            for arg in cn.getElementsByTagName("arg"):
 
919
                                if (arg.getAttribute("direction")
 
920
                                    == "out"):
 
921
                                    arg.setAttribute("name", "props")
 
922
            xmlstring = document.toxml("utf-8")
 
923
            document.unlink()
 
924
        except (AttributeError, xml.dom.DOMException,
 
925
                xml.parsers.expat.ExpatError) as error:
 
926
            logger.error("Failed to override Introspection method",
 
927
                         error)
 
928
        return xmlstring
 
929
 
 
930
 
 
931
def datetime_to_dbus (dt, variant_level=0):
 
932
    """Convert a UTC datetime.datetime() to a D-Bus type."""
 
933
    if dt is None:
 
934
        return dbus.String("", variant_level = variant_level)
 
935
    return dbus.String(dt.isoformat(),
 
936
                       variant_level=variant_level)
 
937
 
 
938
 
 
939
class AlternateDBusNamesMetaclass(DBusObjectWithProperties
 
940
                                  .__metaclass__):
 
941
    """Applied to an empty subclass of a D-Bus object, this metaclass
 
942
    will add additional D-Bus attributes matching a certain pattern.
 
943
    """
 
944
    def __new__(mcs, name, bases, attr):
 
945
        # Go through all the base classes which could have D-Bus
 
946
        # methods, signals, or properties in them
 
947
        for base in (b for b in bases
 
948
                     if issubclass(b, dbus.service.Object)):
 
949
            # Go though all attributes of the base class
 
950
            for attrname, attribute in inspect.getmembers(base):
 
951
                # Ignore non-D-Bus attributes, and D-Bus attributes
 
952
                # with the wrong interface name
 
953
                if (not hasattr(attribute, "_dbus_interface")
 
954
                    or not attribute._dbus_interface
 
955
                    .startswith("se.recompile.Mandos")):
 
956
                    continue
 
957
                # Create an alternate D-Bus interface name based on
 
958
                # the current name
 
959
                alt_interface = (attribute._dbus_interface
 
960
                                 .replace("se.recompile.Mandos",
 
961
                                          "se.bsnet.fukt.Mandos"))
 
962
                # Is this a D-Bus signal?
 
963
                if getattr(attribute, "_dbus_is_signal", False):
 
964
                    # Extract the original non-method function by
 
965
                    # black magic
 
966
                    nonmethod_func = (dict(
 
967
                            zip(attribute.func_code.co_freevars,
 
968
                                attribute.__closure__))["func"]
 
969
                                      .cell_contents)
 
970
                    # Create a new, but exactly alike, function
 
971
                    # object, and decorate it to be a new D-Bus signal
 
972
                    # with the alternate D-Bus interface name
 
973
                    new_function = (dbus.service.signal
 
974
                                    (alt_interface,
 
975
                                     attribute._dbus_signature)
 
976
                                    (types.FunctionType(
 
977
                                nonmethod_func.func_code,
 
978
                                nonmethod_func.func_globals,
 
979
                                nonmethod_func.func_name,
 
980
                                nonmethod_func.func_defaults,
 
981
                                nonmethod_func.func_closure)))
 
982
                    # Define a creator of a function to call both the
 
983
                    # old and new functions, so both the old and new
 
984
                    # signals gets sent when the function is called
 
985
                    def fixscope(func1, func2):
 
986
                        """This function is a scope container to pass
 
987
                        func1 and func2 to the "call_both" function
 
988
                        outside of its arguments"""
 
989
                        def call_both(*args, **kwargs):
 
990
                            """This function will emit two D-Bus
 
991
                            signals by calling func1 and func2"""
 
992
                            func1(*args, **kwargs)
 
993
                            func2(*args, **kwargs)
 
994
                        return call_both
 
995
                    # Create the "call_both" function and add it to
 
996
                    # the class
 
997
                    attr[attrname] = fixscope(attribute,
 
998
                                              new_function)
 
999
                # Is this a D-Bus method?
 
1000
                elif getattr(attribute, "_dbus_is_method", False):
 
1001
                    # Create a new, but exactly alike, function
 
1002
                    # object.  Decorate it to be a new D-Bus method
 
1003
                    # with the alternate D-Bus interface name.  Add it
 
1004
                    # to the class.
 
1005
                    attr[attrname] = (dbus.service.method
 
1006
                                      (alt_interface,
 
1007
                                       attribute._dbus_in_signature,
 
1008
                                       attribute._dbus_out_signature)
 
1009
                                      (types.FunctionType
 
1010
                                       (attribute.func_code,
 
1011
                                        attribute.func_globals,
 
1012
                                        attribute.func_name,
 
1013
                                        attribute.func_defaults,
 
1014
                                        attribute.func_closure)))
 
1015
                # Is this a D-Bus property?
 
1016
                elif getattr(attribute, "_dbus_is_property", False):
 
1017
                    # Create a new, but exactly alike, function
 
1018
                    # object, and decorate it to be a new D-Bus
 
1019
                    # property with the alternate D-Bus interface
 
1020
                    # name.  Add it to the class.
 
1021
                    attr[attrname] = (dbus_service_property
 
1022
                                      (alt_interface,
 
1023
                                       attribute._dbus_signature,
 
1024
                                       attribute._dbus_access,
 
1025
                                       attribute
 
1026
                                       ._dbus_get_args_options
 
1027
                                       ["byte_arrays"])
 
1028
                                      (types.FunctionType
 
1029
                                       (attribute.func_code,
 
1030
                                        attribute.func_globals,
 
1031
                                        attribute.func_name,
 
1032
                                        attribute.func_defaults,
 
1033
                                        attribute.func_closure)))
 
1034
        return type.__new__(mcs, name, bases, attr)
 
1035
 
 
1036
 
 
1037
class ClientDBus(Client, DBusObjectWithProperties):
478
1038
    """A Client class using D-Bus
479
1039
    
480
1040
    Attributes:
481
1041
    dbus_object_path: dbus.ObjectPath
482
1042
    bus: dbus.SystemBus()
483
1043
    """
 
1044
    
 
1045
    runtime_expansions = (Client.runtime_expansions
 
1046
                          + ("dbus_object_path",))
 
1047
    
484
1048
    # dbus.service.Object doesn't use super(), so we can't either.
485
1049
    
486
1050
    def __init__(self, bus = None, *args, **kwargs):
488
1052
        Client.__init__(self, *args, **kwargs)
489
1053
        # Only now, when this client is initialized, can it show up on
490
1054
        # the D-Bus
 
1055
        client_object_name = unicode(self.name).translate(
 
1056
            {ord("."): ord("_"),
 
1057
             ord("-"): ord("_")})
491
1058
        self.dbus_object_path = (dbus.ObjectPath
492
 
                                 (u"/clients/"
493
 
                                  + self.name.replace(u".", u"_")))
494
 
        dbus.service.Object.__init__(self, self.bus,
495
 
                                     self.dbus_object_path)
496
 
    
497
 
    @staticmethod
498
 
    def _datetime_to_dbus(dt, variant_level=0):
499
 
        """Convert a UTC datetime.datetime() to a D-Bus type."""
500
 
        return dbus.String(dt.isoformat(),
501
 
                           variant_level=variant_level)
502
 
    
503
 
    def enable(self):
504
 
        oldstate = getattr(self, u"enabled", False)
505
 
        r = Client.enable(self)
506
 
        if oldstate != self.enabled:
507
 
            # Emit D-Bus signals
508
 
            self.PropertyChanged(dbus.String(u"enabled"),
509
 
                                 dbus.Boolean(True, variant_level=1))
510
 
            self.PropertyChanged(
511
 
                dbus.String(u"last_enabled"),
512
 
                self._datetime_to_dbus(self.last_enabled,
513
 
                                       variant_level=1))
514
 
        return r
515
 
    
516
 
    def disable(self, signal = True):
517
 
        oldstate = getattr(self, u"enabled", False)
518
 
        r = Client.disable(self)
519
 
        if signal and oldstate != self.enabled:
520
 
            # Emit D-Bus signal
521
 
            self.PropertyChanged(dbus.String(u"enabled"),
522
 
                                 dbus.Boolean(False, variant_level=1))
523
 
        return r
 
1059
                                 ("/clients/" + client_object_name))
 
1060
        DBusObjectWithProperties.__init__(self, self.bus,
 
1061
                                          self.dbus_object_path)
 
1062
        
 
1063
    def notifychangeproperty(transform_func,
 
1064
                             dbus_name, type_func=lambda x: x,
 
1065
                             variant_level=1):
 
1066
        """ Modify a variable so that it's a property which announces
 
1067
        its changes to DBus.
 
1068
        
 
1069
        transform_fun: Function that takes a value and a variant_level
 
1070
                       and transforms it to a D-Bus type.
 
1071
        dbus_name: D-Bus name of the variable
 
1072
        type_func: Function that transform the value before sending it
 
1073
                   to the D-Bus.  Default: no transform
 
1074
        variant_level: D-Bus variant level.  Default: 1
 
1075
        """
 
1076
        attrname = "_{0}".format(dbus_name)
 
1077
        def setter(self, value):
 
1078
            if hasattr(self, "dbus_object_path"):
 
1079
                if (not hasattr(self, attrname) or
 
1080
                    type_func(getattr(self, attrname, None))
 
1081
                    != type_func(value)):
 
1082
                    dbus_value = transform_func(type_func(value),
 
1083
                                                variant_level
 
1084
                                                =variant_level)
 
1085
                    self.PropertyChanged(dbus.String(dbus_name),
 
1086
                                         dbus_value)
 
1087
            setattr(self, attrname, value)
 
1088
        
 
1089
        return property(lambda self: getattr(self, attrname), setter)
 
1090
    
 
1091
    
 
1092
    expires = notifychangeproperty(datetime_to_dbus, "Expires")
 
1093
    approvals_pending = notifychangeproperty(dbus.Boolean,
 
1094
                                             "ApprovalPending",
 
1095
                                             type_func = bool)
 
1096
    enabled = notifychangeproperty(dbus.Boolean, "Enabled")
 
1097
    last_enabled = notifychangeproperty(datetime_to_dbus,
 
1098
                                        "LastEnabled")
 
1099
    checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",
 
1100
                                   type_func = lambda checker:
 
1101
                                       checker is not None)
 
1102
    last_checked_ok = notifychangeproperty(datetime_to_dbus,
 
1103
                                           "LastCheckedOK")
 
1104
    last_checker_status = notifychangeproperty(dbus.Int16,
 
1105
                                               "LastCheckerStatus")
 
1106
    last_approval_request = notifychangeproperty(
 
1107
        datetime_to_dbus, "LastApprovalRequest")
 
1108
    approved_by_default = notifychangeproperty(dbus.Boolean,
 
1109
                                               "ApprovedByDefault")
 
1110
    approval_delay = notifychangeproperty(dbus.UInt64,
 
1111
                                          "ApprovalDelay",
 
1112
                                          type_func =
 
1113
                                          timedelta_to_milliseconds)
 
1114
    approval_duration = notifychangeproperty(
 
1115
        dbus.UInt64, "ApprovalDuration",
 
1116
        type_func = timedelta_to_milliseconds)
 
1117
    host = notifychangeproperty(dbus.String, "Host")
 
1118
    timeout = notifychangeproperty(dbus.UInt64, "Timeout",
 
1119
                                   type_func =
 
1120
                                   timedelta_to_milliseconds)
 
1121
    extended_timeout = notifychangeproperty(
 
1122
        dbus.UInt64, "ExtendedTimeout",
 
1123
        type_func = timedelta_to_milliseconds)
 
1124
    interval = notifychangeproperty(dbus.UInt64,
 
1125
                                    "Interval",
 
1126
                                    type_func =
 
1127
                                    timedelta_to_milliseconds)
 
1128
    checker_command = notifychangeproperty(dbus.String, "Checker")
 
1129
    
 
1130
    del notifychangeproperty
524
1131
    
525
1132
    def __del__(self, *args, **kwargs):
526
1133
        try:
527
1134
            self.remove_from_connection()
528
1135
        except LookupError:
529
1136
            pass
530
 
        if hasattr(dbus.service.Object, u"__del__"):
531
 
            dbus.service.Object.__del__(self, *args, **kwargs)
 
1137
        if hasattr(DBusObjectWithProperties, "__del__"):
 
1138
            DBusObjectWithProperties.__del__(self, *args, **kwargs)
532
1139
        Client.__del__(self, *args, **kwargs)
533
1140
    
534
1141
    def checker_callback(self, pid, condition, command,
535
1142
                         *args, **kwargs):
536
1143
        self.checker_callback_tag = None
537
1144
        self.checker = None
538
 
        # Emit D-Bus signal
539
 
        self.PropertyChanged(dbus.String(u"checker_running"),
540
 
                             dbus.Boolean(False, variant_level=1))
541
1145
        if os.WIFEXITED(condition):
542
1146
            exitstatus = os.WEXITSTATUS(condition)
543
1147
            # Emit D-Bus signal
553
1157
        return Client.checker_callback(self, pid, condition, command,
554
1158
                                       *args, **kwargs)
555
1159
    
556
 
    def checked_ok(self, *args, **kwargs):
557
 
        r = Client.checked_ok(self, *args, **kwargs)
558
 
        # Emit D-Bus signal
559
 
        self.PropertyChanged(
560
 
            dbus.String(u"last_checked_ok"),
561
 
            (self._datetime_to_dbus(self.last_checked_ok,
562
 
                                    variant_level=1)))
563
 
        return r
564
 
    
565
1160
    def start_checker(self, *args, **kwargs):
566
1161
        old_checker = self.checker
567
1162
        if self.checker is not None:
574
1169
            and old_checker_pid != self.checker.pid):
575
1170
            # Emit D-Bus signal
576
1171
            self.CheckerStarted(self.current_checker_command)
577
 
            self.PropertyChanged(
578
 
                dbus.String(u"checker_running"),
579
 
                dbus.Boolean(True, variant_level=1))
580
 
        return r
581
 
    
582
 
    def stop_checker(self, *args, **kwargs):
583
 
        old_checker = getattr(self, u"checker", None)
584
 
        r = Client.stop_checker(self, *args, **kwargs)
585
 
        if (old_checker is not None
586
 
            and getattr(self, u"checker", None) is None):
587
 
            self.PropertyChanged(dbus.String(u"checker_running"),
588
 
                                 dbus.Boolean(False, variant_level=1))
589
 
        return r
590
 
    
591
 
    ## D-Bus methods & signals
592
 
    _interface = u"se.bsnet.fukt.Mandos.Client"
593
 
    
594
 
    # CheckedOK - method
595
 
    @dbus.service.method(_interface)
596
 
    def CheckedOK(self):
597
 
        return self.checked_ok()
 
1172
        return r
 
1173
    
 
1174
    def _reset_approved(self):
 
1175
        self.approved = None
 
1176
        return False
 
1177
    
 
1178
    def approve(self, value=True):
 
1179
        self.send_changedstate()
 
1180
        self.approved = value
 
1181
        gobject.timeout_add(timedelta_to_milliseconds
 
1182
                            (self.approval_duration),
 
1183
                            self._reset_approved)
 
1184
    
 
1185
    
 
1186
    ## D-Bus methods, signals & properties
 
1187
    _interface = "se.recompile.Mandos.Client"
 
1188
    
 
1189
    ## Signals
598
1190
    
599
1191
    # CheckerCompleted - signal
600
 
    @dbus.service.signal(_interface, signature=u"nxs")
 
1192
    @dbus.service.signal(_interface, signature="nxs")
601
1193
    def CheckerCompleted(self, exitcode, waitstatus, command):
602
1194
        "D-Bus signal"
603
1195
        pass
604
1196
    
605
1197
    # CheckerStarted - signal
606
 
    @dbus.service.signal(_interface, signature=u"s")
 
1198
    @dbus.service.signal(_interface, signature="s")
607
1199
    def CheckerStarted(self, command):
608
1200
        "D-Bus signal"
609
1201
        pass
610
1202
    
611
 
    # GetAllProperties - method
612
 
    @dbus.service.method(_interface, out_signature=u"a{sv}")
613
 
    def GetAllProperties(self):
614
 
        "D-Bus method"
615
 
        return dbus.Dictionary({
616
 
                dbus.String(u"name"):
617
 
                    dbus.String(self.name, variant_level=1),
618
 
                dbus.String(u"fingerprint"):
619
 
                    dbus.String(self.fingerprint, variant_level=1),
620
 
                dbus.String(u"host"):
621
 
                    dbus.String(self.host, variant_level=1),
622
 
                dbus.String(u"created"):
623
 
                    self._datetime_to_dbus(self.created,
624
 
                                           variant_level=1),
625
 
                dbus.String(u"last_enabled"):
626
 
                    (self._datetime_to_dbus(self.last_enabled,
627
 
                                            variant_level=1)
628
 
                     if self.last_enabled is not None
629
 
                     else dbus.Boolean(False, variant_level=1)),
630
 
                dbus.String(u"enabled"):
631
 
                    dbus.Boolean(self.enabled, variant_level=1),
632
 
                dbus.String(u"last_checked_ok"):
633
 
                    (self._datetime_to_dbus(self.last_checked_ok,
634
 
                                            variant_level=1)
635
 
                     if self.last_checked_ok is not None
636
 
                     else dbus.Boolean (False, variant_level=1)),
637
 
                dbus.String(u"timeout"):
638
 
                    dbus.UInt64(self.timeout_milliseconds(),
639
 
                                variant_level=1),
640
 
                dbus.String(u"interval"):
641
 
                    dbus.UInt64(self.interval_milliseconds(),
642
 
                                variant_level=1),
643
 
                dbus.String(u"checker"):
644
 
                    dbus.String(self.checker_command,
645
 
                                variant_level=1),
646
 
                dbus.String(u"checker_running"):
647
 
                    dbus.Boolean(self.checker is not None,
648
 
                                 variant_level=1),
649
 
                dbus.String(u"object_path"):
650
 
                    dbus.ObjectPath(self.dbus_object_path,
651
 
                                    variant_level=1)
652
 
                }, signature=u"sv")
653
 
    
654
 
    # IsStillValid - method
655
 
    @dbus.service.method(_interface, out_signature=u"b")
656
 
    def IsStillValid(self):
657
 
        return self.still_valid()
658
 
    
659
1203
    # PropertyChanged - signal
660
 
    @dbus.service.signal(_interface, signature=u"sv")
 
1204
    @dbus.service.signal(_interface, signature="sv")
661
1205
    def PropertyChanged(self, property, value):
662
1206
        "D-Bus signal"
663
1207
        pass
664
1208
    
665
 
    # ReceivedSecret - signal
 
1209
    # GotSecret - signal
666
1210
    @dbus.service.signal(_interface)
667
 
    def ReceivedSecret(self):
668
 
        "D-Bus signal"
 
1211
    def GotSecret(self):
 
1212
        """D-Bus signal
 
1213
        Is sent after a successful transfer of secret from the Mandos
 
1214
        server to mandos-client
 
1215
        """
669
1216
        pass
670
1217
    
671
1218
    # Rejected - signal
672
 
    @dbus.service.signal(_interface)
673
 
    def Rejected(self):
 
1219
    @dbus.service.signal(_interface, signature="s")
 
1220
    def Rejected(self, reason):
674
1221
        "D-Bus signal"
675
1222
        pass
676
1223
    
677
 
    # SetChecker - method
678
 
    @dbus.service.method(_interface, in_signature=u"s")
679
 
    def SetChecker(self, checker):
680
 
        "D-Bus setter method"
681
 
        self.checker_command = checker
682
 
        # Emit D-Bus signal
683
 
        self.PropertyChanged(dbus.String(u"checker"),
684
 
                             dbus.String(self.checker_command,
685
 
                                         variant_level=1))
686
 
    
687
 
    # SetHost - method
688
 
    @dbus.service.method(_interface, in_signature=u"s")
689
 
    def SetHost(self, host):
690
 
        "D-Bus setter method"
691
 
        self.host = host
692
 
        # Emit D-Bus signal
693
 
        self.PropertyChanged(dbus.String(u"host"),
694
 
                             dbus.String(self.host, variant_level=1))
695
 
    
696
 
    # SetInterval - method
697
 
    @dbus.service.method(_interface, in_signature=u"t")
698
 
    def SetInterval(self, milliseconds):
699
 
        self.interval = datetime.timedelta(0, 0, 0, milliseconds)
700
 
        # Emit D-Bus signal
701
 
        self.PropertyChanged(dbus.String(u"interval"),
702
 
                             (dbus.UInt64(self.interval_milliseconds(),
703
 
                                          variant_level=1)))
704
 
    
705
 
    # SetSecret - method
706
 
    @dbus.service.method(_interface, in_signature=u"ay",
707
 
                         byte_arrays=True)
708
 
    def SetSecret(self, secret):
709
 
        "D-Bus setter method"
710
 
        self.secret = str(secret)
711
 
    
712
 
    # SetTimeout - method
713
 
    @dbus.service.method(_interface, in_signature=u"t")
714
 
    def SetTimeout(self, milliseconds):
715
 
        self.timeout = datetime.timedelta(0, 0, 0, milliseconds)
716
 
        # Emit D-Bus signal
717
 
        self.PropertyChanged(dbus.String(u"timeout"),
718
 
                             (dbus.UInt64(self.timeout_milliseconds(),
719
 
                                          variant_level=1)))
 
1224
    # NeedApproval - signal
 
1225
    @dbus.service.signal(_interface, signature="tb")
 
1226
    def NeedApproval(self, timeout, default):
 
1227
        "D-Bus signal"
 
1228
        return self.need_approval()
 
1229
    
 
1230
    ## Methods
 
1231
    
 
1232
    # Approve - method
 
1233
    @dbus.service.method(_interface, in_signature="b")
 
1234
    def Approve(self, value):
 
1235
        self.approve(value)
 
1236
    
 
1237
    # CheckedOK - method
 
1238
    @dbus.service.method(_interface)
 
1239
    def CheckedOK(self):
 
1240
        self.checked_ok()
720
1241
    
721
1242
    # Enable - method
722
1243
    @dbus.service.method(_interface)
741
1262
    def StopChecker(self):
742
1263
        self.stop_checker()
743
1264
    
 
1265
    ## Properties
 
1266
    
 
1267
    # ApprovalPending - property
 
1268
    @dbus_service_property(_interface, signature="b", access="read")
 
1269
    def ApprovalPending_dbus_property(self):
 
1270
        return dbus.Boolean(bool(self.approvals_pending))
 
1271
    
 
1272
    # ApprovedByDefault - property
 
1273
    @dbus_service_property(_interface, signature="b",
 
1274
                           access="readwrite")
 
1275
    def ApprovedByDefault_dbus_property(self, value=None):
 
1276
        if value is None:       # get
 
1277
            return dbus.Boolean(self.approved_by_default)
 
1278
        self.approved_by_default = bool(value)
 
1279
    
 
1280
    # ApprovalDelay - property
 
1281
    @dbus_service_property(_interface, signature="t",
 
1282
                           access="readwrite")
 
1283
    def ApprovalDelay_dbus_property(self, value=None):
 
1284
        if value is None:       # get
 
1285
            return dbus.UInt64(self.approval_delay_milliseconds())
 
1286
        self.approval_delay = datetime.timedelta(0, 0, 0, value)
 
1287
    
 
1288
    # ApprovalDuration - property
 
1289
    @dbus_service_property(_interface, signature="t",
 
1290
                           access="readwrite")
 
1291
    def ApprovalDuration_dbus_property(self, value=None):
 
1292
        if value is None:       # get
 
1293
            return dbus.UInt64(timedelta_to_milliseconds(
 
1294
                    self.approval_duration))
 
1295
        self.approval_duration = datetime.timedelta(0, 0, 0, value)
 
1296
    
 
1297
    # Name - property
 
1298
    @dbus_service_property(_interface, signature="s", access="read")
 
1299
    def Name_dbus_property(self):
 
1300
        return dbus.String(self.name)
 
1301
    
 
1302
    # Fingerprint - property
 
1303
    @dbus_service_property(_interface, signature="s", access="read")
 
1304
    def Fingerprint_dbus_property(self):
 
1305
        return dbus.String(self.fingerprint)
 
1306
    
 
1307
    # Host - property
 
1308
    @dbus_service_property(_interface, signature="s",
 
1309
                           access="readwrite")
 
1310
    def Host_dbus_property(self, value=None):
 
1311
        if value is None:       # get
 
1312
            return dbus.String(self.host)
 
1313
        self.host = unicode(value)
 
1314
    
 
1315
    # Created - property
 
1316
    @dbus_service_property(_interface, signature="s", access="read")
 
1317
    def Created_dbus_property(self):
 
1318
        return datetime_to_dbus(self.created)
 
1319
    
 
1320
    # LastEnabled - property
 
1321
    @dbus_service_property(_interface, signature="s", access="read")
 
1322
    def LastEnabled_dbus_property(self):
 
1323
        return datetime_to_dbus(self.last_enabled)
 
1324
    
 
1325
    # Enabled - property
 
1326
    @dbus_service_property(_interface, signature="b",
 
1327
                           access="readwrite")
 
1328
    def Enabled_dbus_property(self, value=None):
 
1329
        if value is None:       # get
 
1330
            return dbus.Boolean(self.enabled)
 
1331
        if value:
 
1332
            self.enable()
 
1333
        else:
 
1334
            self.disable()
 
1335
    
 
1336
    # LastCheckedOK - property
 
1337
    @dbus_service_property(_interface, signature="s",
 
1338
                           access="readwrite")
 
1339
    def LastCheckedOK_dbus_property(self, value=None):
 
1340
        if value is not None:
 
1341
            self.checked_ok()
 
1342
            return
 
1343
        return datetime_to_dbus(self.last_checked_ok)
 
1344
    
 
1345
    # LastCheckerStatus - property
 
1346
    @dbus_service_property(_interface, signature="n",
 
1347
                           access="read")
 
1348
    def LastCheckerStatus_dbus_property(self):
 
1349
        return dbus.Int16(self.last_checker_status)
 
1350
    
 
1351
    # Expires - property
 
1352
    @dbus_service_property(_interface, signature="s", access="read")
 
1353
    def Expires_dbus_property(self):
 
1354
        return datetime_to_dbus(self.expires)
 
1355
    
 
1356
    # LastApprovalRequest - property
 
1357
    @dbus_service_property(_interface, signature="s", access="read")
 
1358
    def LastApprovalRequest_dbus_property(self):
 
1359
        return datetime_to_dbus(self.last_approval_request)
 
1360
    
 
1361
    # Timeout - property
 
1362
    @dbus_service_property(_interface, signature="t",
 
1363
                           access="readwrite")
 
1364
    def Timeout_dbus_property(self, value=None):
 
1365
        if value is None:       # get
 
1366
            return dbus.UInt64(self.timeout_milliseconds())
 
1367
        self.timeout = datetime.timedelta(0, 0, 0, value)
 
1368
        # Reschedule timeout
 
1369
        if self.enabled:
 
1370
            now = datetime.datetime.utcnow()
 
1371
            time_to_die = timedelta_to_milliseconds(
 
1372
                (self.last_checked_ok + self.timeout) - now)
 
1373
            if time_to_die <= 0:
 
1374
                # The timeout has passed
 
1375
                self.disable()
 
1376
            else:
 
1377
                self.expires = (now +
 
1378
                                datetime.timedelta(milliseconds =
 
1379
                                                   time_to_die))
 
1380
                if (getattr(self, "disable_initiator_tag", None)
 
1381
                    is None):
 
1382
                    return
 
1383
                gobject.source_remove(self.disable_initiator_tag)
 
1384
                self.disable_initiator_tag = (gobject.timeout_add
 
1385
                                              (time_to_die,
 
1386
                                               self.disable))
 
1387
    
 
1388
    # ExtendedTimeout - property
 
1389
    @dbus_service_property(_interface, signature="t",
 
1390
                           access="readwrite")
 
1391
    def ExtendedTimeout_dbus_property(self, value=None):
 
1392
        if value is None:       # get
 
1393
            return dbus.UInt64(self.extended_timeout_milliseconds())
 
1394
        self.extended_timeout = datetime.timedelta(0, 0, 0, value)
 
1395
    
 
1396
    # Interval - property
 
1397
    @dbus_service_property(_interface, signature="t",
 
1398
                           access="readwrite")
 
1399
    def Interval_dbus_property(self, value=None):
 
1400
        if value is None:       # get
 
1401
            return dbus.UInt64(self.interval_milliseconds())
 
1402
        self.interval = datetime.timedelta(0, 0, 0, value)
 
1403
        if getattr(self, "checker_initiator_tag", None) is None:
 
1404
            return
 
1405
        if self.enabled:
 
1406
            # Reschedule checker run
 
1407
            gobject.source_remove(self.checker_initiator_tag)
 
1408
            self.checker_initiator_tag = (gobject.timeout_add
 
1409
                                          (value, self.start_checker))
 
1410
            self.start_checker()    # Start one now, too
 
1411
    
 
1412
    # Checker - property
 
1413
    @dbus_service_property(_interface, signature="s",
 
1414
                           access="readwrite")
 
1415
    def Checker_dbus_property(self, value=None):
 
1416
        if value is None:       # get
 
1417
            return dbus.String(self.checker_command)
 
1418
        self.checker_command = unicode(value)
 
1419
    
 
1420
    # CheckerRunning - property
 
1421
    @dbus_service_property(_interface, signature="b",
 
1422
                           access="readwrite")
 
1423
    def CheckerRunning_dbus_property(self, value=None):
 
1424
        if value is None:       # get
 
1425
            return dbus.Boolean(self.checker is not None)
 
1426
        if value:
 
1427
            self.start_checker()
 
1428
        else:
 
1429
            self.stop_checker()
 
1430
    
 
1431
    # ObjectPath - property
 
1432
    @dbus_service_property(_interface, signature="o", access="read")
 
1433
    def ObjectPath_dbus_property(self):
 
1434
        return self.dbus_object_path # is already a dbus.ObjectPath
 
1435
    
 
1436
    # Secret = property
 
1437
    @dbus_service_property(_interface, signature="ay",
 
1438
                           access="write", byte_arrays=True)
 
1439
    def Secret_dbus_property(self, value):
 
1440
        self.secret = str(value)
 
1441
    
744
1442
    del _interface
745
1443
 
746
1444
 
 
1445
class ProxyClient(object):
 
1446
    def __init__(self, child_pipe, fpr, address):
 
1447
        self._pipe = child_pipe
 
1448
        self._pipe.send(('init', fpr, address))
 
1449
        if not self._pipe.recv():
 
1450
            raise KeyError()
 
1451
    
 
1452
    def __getattribute__(self, name):
 
1453
        if name == '_pipe':
 
1454
            return super(ProxyClient, self).__getattribute__(name)
 
1455
        self._pipe.send(('getattr', name))
 
1456
        data = self._pipe.recv()
 
1457
        if data[0] == 'data':
 
1458
            return data[1]
 
1459
        if data[0] == 'function':
 
1460
            def func(*args, **kwargs):
 
1461
                self._pipe.send(('funcall', name, args, kwargs))
 
1462
                return self._pipe.recv()[1]
 
1463
            return func
 
1464
    
 
1465
    def __setattr__(self, name, value):
 
1466
        if name == '_pipe':
 
1467
            return super(ProxyClient, self).__setattr__(name, value)
 
1468
        self._pipe.send(('setattr', name, value))
 
1469
 
 
1470
 
 
1471
class ClientDBusTransitional(ClientDBus):
 
1472
    __metaclass__ = AlternateDBusNamesMetaclass
 
1473
 
 
1474
 
747
1475
class ClientHandler(socketserver.BaseRequestHandler, object):
748
1476
    """A class to handle client connections.
749
1477
    
751
1479
    Note: This will run in its own forked process."""
752
1480
    
753
1481
    def handle(self):
754
 
        logger.info(u"TCP connection from: %s",
755
 
                    unicode(self.client_address))
756
 
        logger.debug(u"IPC Pipe FD: %d", self.server.pipe[1])
757
 
        # Open IPC pipe to parent process
758
 
        with closing(os.fdopen(self.server.pipe[1], u"w", 1)) as ipc:
 
1482
        with contextlib.closing(self.server.child_pipe) as child_pipe:
 
1483
            logger.info("TCP connection from: %s",
 
1484
                        unicode(self.client_address))
 
1485
            logger.debug("Pipe FD: %d",
 
1486
                         self.server.child_pipe.fileno())
 
1487
            
759
1488
            session = (gnutls.connection
760
1489
                       .ClientSession(self.request,
761
1490
                                      gnutls.connection
762
1491
                                      .X509Credentials()))
763
1492
            
764
 
            line = self.request.makefile().readline()
765
 
            logger.debug(u"Protocol version: %r", line)
766
 
            try:
767
 
                if int(line.strip().split()[0]) > 1:
768
 
                    raise RuntimeError
769
 
            except (ValueError, IndexError, RuntimeError), error:
770
 
                logger.error(u"Unknown protocol version: %s", error)
771
 
                return
772
 
            
773
1493
            # Note: gnutls.connection.X509Credentials is really a
774
1494
            # generic GnuTLS certificate credentials object so long as
775
1495
            # no X.509 keys are added to it.  Therefore, we can use it
776
1496
            # here despite using OpenPGP certificates.
777
1497
            
778
 
            #priority = u':'.join((u"NONE", u"+VERS-TLS1.1",
779
 
            #                      u"+AES-256-CBC", u"+SHA1",
780
 
            #                      u"+COMP-NULL", u"+CTYPE-OPENPGP",
781
 
            #                      u"+DHE-DSS"))
 
1498
            #priority = ':'.join(("NONE", "+VERS-TLS1.1",
 
1499
            #                      "+AES-256-CBC", "+SHA1",
 
1500
            #                      "+COMP-NULL", "+CTYPE-OPENPGP",
 
1501
            #                      "+DHE-DSS"))
782
1502
            # Use a fallback default, since this MUST be set.
783
1503
            priority = self.server.gnutls_priority
784
1504
            if priority is None:
785
 
                priority = u"NORMAL"
 
1505
                priority = "NORMAL"
786
1506
            (gnutls.library.functions
787
1507
             .gnutls_priority_set_direct(session._c_object,
788
1508
                                         priority, None))
789
1509
            
 
1510
            # Start communication using the Mandos protocol
 
1511
            # Get protocol number
 
1512
            line = self.request.makefile().readline()
 
1513
            logger.debug("Protocol version: %r", line)
 
1514
            try:
 
1515
                if int(line.strip().split()[0]) > 1:
 
1516
                    raise RuntimeError
 
1517
            except (ValueError, IndexError, RuntimeError) as error:
 
1518
                logger.error("Unknown protocol version: %s", error)
 
1519
                return
 
1520
            
 
1521
            # Start GnuTLS connection
790
1522
            try:
791
1523
                session.handshake()
792
 
            except gnutls.errors.GNUTLSError, error:
793
 
                logger.warning(u"Handshake failed: %s", error)
 
1524
            except gnutls.errors.GNUTLSError as error:
 
1525
                logger.warning("Handshake failed: %s", error)
794
1526
                # Do not run session.bye() here: the session is not
795
1527
                # established.  Just abandon the request.
796
1528
                return
797
 
            logger.debug(u"Handshake succeeded")
 
1529
            logger.debug("Handshake succeeded")
 
1530
            
 
1531
            approval_required = False
798
1532
            try:
799
 
                fpr = self.fingerprint(self.peer_certificate(session))
800
 
            except (TypeError, gnutls.errors.GNUTLSError), error:
801
 
                logger.warning(u"Bad certificate: %s", error)
802
 
                session.bye()
803
 
                return
804
 
            logger.debug(u"Fingerprint: %s", fpr)
 
1533
                try:
 
1534
                    fpr = self.fingerprint(self.peer_certificate
 
1535
                                           (session))
 
1536
                except (TypeError,
 
1537
                        gnutls.errors.GNUTLSError) as error:
 
1538
                    logger.warning("Bad certificate: %s", error)
 
1539
                    return
 
1540
                logger.debug("Fingerprint: %s", fpr)
 
1541
                
 
1542
                try:
 
1543
                    client = ProxyClient(child_pipe, fpr,
 
1544
                                         self.client_address)
 
1545
                except KeyError:
 
1546
                    return
 
1547
                
 
1548
                if client.approval_delay:
 
1549
                    delay = client.approval_delay
 
1550
                    client.approvals_pending += 1
 
1551
                    approval_required = True
 
1552
                
 
1553
                while True:
 
1554
                    if not client.enabled:
 
1555
                        logger.info("Client %s is disabled",
 
1556
                                       client.name)
 
1557
                        if self.server.use_dbus:
 
1558
                            # Emit D-Bus signal
 
1559
                            client.Rejected("Disabled")
 
1560
                        return
 
1561
                    
 
1562
                    if client.approved or not client.approval_delay:
 
1563
                        #We are approved or approval is disabled
 
1564
                        break
 
1565
                    elif client.approved is None:
 
1566
                        logger.info("Client %s needs approval",
 
1567
                                    client.name)
 
1568
                        if self.server.use_dbus:
 
1569
                            # Emit D-Bus signal
 
1570
                            client.NeedApproval(
 
1571
                                client.approval_delay_milliseconds(),
 
1572
                                client.approved_by_default)
 
1573
                    else:
 
1574
                        logger.warning("Client %s was not approved",
 
1575
                                       client.name)
 
1576
                        if self.server.use_dbus:
 
1577
                            # Emit D-Bus signal
 
1578
                            client.Rejected("Denied")
 
1579
                        return
 
1580
                    
 
1581
                    #wait until timeout or approved
 
1582
                    time = datetime.datetime.now()
 
1583
                    client.changedstate.acquire()
 
1584
                    (client.changedstate.wait
 
1585
                     (float(client.timedelta_to_milliseconds(delay)
 
1586
                            / 1000)))
 
1587
                    client.changedstate.release()
 
1588
                    time2 = datetime.datetime.now()
 
1589
                    if (time2 - time) >= delay:
 
1590
                        if not client.approved_by_default:
 
1591
                            logger.warning("Client %s timed out while"
 
1592
                                           " waiting for approval",
 
1593
                                           client.name)
 
1594
                            if self.server.use_dbus:
 
1595
                                # Emit D-Bus signal
 
1596
                                client.Rejected("Approval timed out")
 
1597
                            return
 
1598
                        else:
 
1599
                            break
 
1600
                    else:
 
1601
                        delay -= time2 - time
 
1602
                
 
1603
                sent_size = 0
 
1604
                while sent_size < len(client.secret):
 
1605
                    try:
 
1606
                        sent = session.send(client.secret[sent_size:])
 
1607
                    except gnutls.errors.GNUTLSError as error:
 
1608
                        logger.warning("gnutls send failed")
 
1609
                        return
 
1610
                    logger.debug("Sent: %d, remaining: %d",
 
1611
                                 sent, len(client.secret)
 
1612
                                 - (sent_size + sent))
 
1613
                    sent_size += sent
 
1614
                
 
1615
                logger.info("Sending secret to %s", client.name)
 
1616
                # bump the timeout using extended_timeout
 
1617
                client.bump_timeout(client.extended_timeout)
 
1618
                if self.server.use_dbus:
 
1619
                    # Emit D-Bus signal
 
1620
                    client.GotSecret()
805
1621
            
806
 
            for c in self.server.clients:
807
 
                if c.fingerprint == fpr:
808
 
                    client = c
809
 
                    break
810
 
            else:
811
 
                ipc.write(u"NOTFOUND %s\n" % fpr)
812
 
                session.bye()
813
 
                return
814
 
            # Have to check if client.still_valid(), since it is
815
 
            # possible that the client timed out while establishing
816
 
            # the GnuTLS session.
817
 
            if not client.still_valid():
818
 
                ipc.write(u"INVALID %s\n" % client.name)
819
 
                session.bye()
820
 
                return
821
 
            ipc.write(u"SENDING %s\n" % client.name)
822
 
            sent_size = 0
823
 
            while sent_size < len(client.secret):
824
 
                sent = session.send(client.secret[sent_size:])
825
 
                logger.debug(u"Sent: %d, remaining: %d",
826
 
                             sent, len(client.secret)
827
 
                             - (sent_size + sent))
828
 
                sent_size += sent
829
 
            session.bye()
 
1622
            finally:
 
1623
                if approval_required:
 
1624
                    client.approvals_pending -= 1
 
1625
                try:
 
1626
                    session.bye()
 
1627
                except gnutls.errors.GNUTLSError as error:
 
1628
                    logger.warning("GnuTLS bye failed")
830
1629
    
831
1630
    @staticmethod
832
1631
    def peer_certificate(session):
842
1641
                     .gnutls_certificate_get_peers
843
1642
                     (session._c_object, ctypes.byref(list_size)))
844
1643
        if not bool(cert_list) and list_size.value != 0:
845
 
            raise gnutls.errors.GNUTLSError(u"error getting peer"
846
 
                                            u" certificate")
 
1644
            raise gnutls.errors.GNUTLSError("error getting peer"
 
1645
                                            " certificate")
847
1646
        if list_size.value == 0:
848
1647
            return None
849
1648
        cert = cert_list[0]
875
1674
        if crtverify.value != 0:
876
1675
            gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
877
1676
            raise (gnutls.errors.CertificateSecurityError
878
 
                   (u"Verify failed"))
 
1677
                   ("Verify failed"))
879
1678
        # New buffer for the fingerprint
880
1679
        buf = ctypes.create_string_buffer(20)
881
1680
        buf_len = ctypes.c_size_t()
888
1687
        # Convert the buffer to a Python bytestring
889
1688
        fpr = ctypes.string_at(buf, buf_len.value)
890
1689
        # Convert the bytestring to hexadecimal notation
891
 
        hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
 
1690
        hex_fpr = binascii.hexlify(fpr).upper()
892
1691
        return hex_fpr
893
1692
 
894
1693
 
895
 
class ForkingMixInWithPipe(socketserver.ForkingMixIn, object):
896
 
    """Like socketserver.ForkingMixIn, but also pass a pipe."""
 
1694
class MultiprocessingMixIn(object):
 
1695
    """Like socketserver.ThreadingMixIn, but with multiprocessing"""
 
1696
    def sub_process_main(self, request, address):
 
1697
        try:
 
1698
            self.finish_request(request, address)
 
1699
        except Exception:
 
1700
            self.handle_error(request, address)
 
1701
        self.close_request(request)
 
1702
    
 
1703
    def process_request(self, request, address):
 
1704
        """Start a new process to process the request."""
 
1705
        proc = multiprocessing.Process(target = self.sub_process_main,
 
1706
                                       args = (request,
 
1707
                                               address))
 
1708
        proc.start()
 
1709
        return proc
 
1710
 
 
1711
 
 
1712
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
 
1713
    """ adds a pipe to the MixIn """
897
1714
    def process_request(self, request, client_address):
898
1715
        """Overrides and wraps the original process_request().
899
1716
        
900
 
        This function creates a new pipe in self.pipe 
 
1717
        This function creates a new pipe in self.pipe
901
1718
        """
902
 
        self.pipe = os.pipe()
903
 
        super(ForkingMixInWithPipe,
904
 
              self).process_request(request, client_address)
905
 
        os.close(self.pipe[1])  # close write end
906
 
        self.add_pipe(self.pipe[0])
907
 
    def add_pipe(self, pipe):
 
1719
        parent_pipe, self.child_pipe = multiprocessing.Pipe()
 
1720
        
 
1721
        proc = MultiprocessingMixIn.process_request(self, request,
 
1722
                                                    client_address)
 
1723
        self.child_pipe.close()
 
1724
        self.add_pipe(parent_pipe, proc)
 
1725
    
 
1726
    def add_pipe(self, parent_pipe, proc):
908
1727
        """Dummy function; override as necessary"""
909
 
        os.close(pipe)
910
 
 
911
 
 
912
 
class IPv6_TCPServer(ForkingMixInWithPipe,
 
1728
        raise NotImplementedError
 
1729
 
 
1730
 
 
1731
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
913
1732
                     socketserver.TCPServer, object):
914
1733
    """IPv6-capable TCP server.  Accepts 'None' as address and/or port
915
1734
    
931
1750
        bind to an address or port if they were not specified."""
932
1751
        if self.interface is not None:
933
1752
            if SO_BINDTODEVICE is None:
934
 
                logger.error(u"SO_BINDTODEVICE does not exist;"
935
 
                             u" cannot bind to interface %s",
 
1753
                logger.error("SO_BINDTODEVICE does not exist;"
 
1754
                             " cannot bind to interface %s",
936
1755
                             self.interface)
937
1756
            else:
938
1757
                try:
939
1758
                    self.socket.setsockopt(socket.SOL_SOCKET,
940
1759
                                           SO_BINDTODEVICE,
941
1760
                                           str(self.interface
942
 
                                               + u'\0'))
943
 
                except socket.error, error:
 
1761
                                               + '\0'))
 
1762
                except socket.error as error:
944
1763
                    if error[0] == errno.EPERM:
945
 
                        logger.error(u"No permission to"
946
 
                                     u" bind to interface %s",
 
1764
                        logger.error("No permission to"
 
1765
                                     " bind to interface %s",
947
1766
                                     self.interface)
948
1767
                    elif error[0] == errno.ENOPROTOOPT:
949
 
                        logger.error(u"SO_BINDTODEVICE not available;"
950
 
                                     u" cannot bind to interface %s",
 
1768
                        logger.error("SO_BINDTODEVICE not available;"
 
1769
                                     " cannot bind to interface %s",
951
1770
                                     self.interface)
952
1771
                    else:
953
1772
                        raise
955
1774
        if self.server_address[0] or self.server_address[1]:
956
1775
            if not self.server_address[0]:
957
1776
                if self.address_family == socket.AF_INET6:
958
 
                    any_address = u"::" # in6addr_any
 
1777
                    any_address = "::" # in6addr_any
959
1778
                else:
960
1779
                    any_address = socket.INADDR_ANY
961
1780
                self.server_address = (any_address,
979
1798
        clients:        set of Client objects
980
1799
        gnutls_priority GnuTLS priority string
981
1800
        use_dbus:       Boolean; to emit D-Bus signals or not
982
 
        clients:        set of Client objects
983
 
        gnutls_priority GnuTLS priority string
984
 
        use_dbus:       Boolean; to emit D-Bus signals or not
985
1801
    
986
1802
    Assumes a gobject.MainLoop event loop.
987
1803
    """
990
1806
                 gnutls_priority=None, use_dbus=True):
991
1807
        self.enabled = False
992
1808
        self.clients = clients
 
1809
        if self.clients is None:
 
1810
            self.clients = {}
993
1811
        self.use_dbus = use_dbus
994
1812
        self.gnutls_priority = gnutls_priority
995
1813
        IPv6_TCPServer.__init__(self, server_address,
999
1817
    def server_activate(self):
1000
1818
        if self.enabled:
1001
1819
            return socketserver.TCPServer.server_activate(self)
 
1820
    
1002
1821
    def enable(self):
1003
1822
        self.enabled = True
1004
 
    def add_pipe(self, pipe):
 
1823
    
 
1824
    def add_pipe(self, parent_pipe, proc):
1005
1825
        # Call "handle_ipc" for both data and EOF events
1006
 
        gobject.io_add_watch(pipe, gobject.IO_IN | gobject.IO_HUP,
1007
 
                             self.handle_ipc)
1008
 
    def handle_ipc(self, source, condition, file_objects={}):
 
1826
        gobject.io_add_watch(parent_pipe.fileno(),
 
1827
                             gobject.IO_IN | gobject.IO_HUP,
 
1828
                             functools.partial(self.handle_ipc,
 
1829
                                               parent_pipe =
 
1830
                                               parent_pipe,
 
1831
                                               proc = proc))
 
1832
    
 
1833
    def handle_ipc(self, source, condition, parent_pipe=None,
 
1834
                   proc = None, client_object=None):
1009
1835
        condition_names = {
1010
 
            gobject.IO_IN: u"IN",   # There is data to read.
1011
 
            gobject.IO_OUT: u"OUT", # Data can be written (without
 
1836
            gobject.IO_IN: "IN",   # There is data to read.
 
1837
            gobject.IO_OUT: "OUT", # Data can be written (without
1012
1838
                                    # blocking).
1013
 
            gobject.IO_PRI: u"PRI", # There is urgent data to read.
1014
 
            gobject.IO_ERR: u"ERR", # Error condition.
1015
 
            gobject.IO_HUP: u"HUP"  # Hung up (the connection has been
 
1839
            gobject.IO_PRI: "PRI", # There is urgent data to read.
 
1840
            gobject.IO_ERR: "ERR", # Error condition.
 
1841
            gobject.IO_HUP: "HUP"  # Hung up (the connection has been
1016
1842
                                    # broken, usually for pipes and
1017
1843
                                    # sockets).
1018
1844
            }
1020
1846
                                       for cond, name in
1021
1847
                                       condition_names.iteritems()
1022
1848
                                       if cond & condition)
1023
 
        logger.debug(u"Handling IPC: FD = %d, condition = %s", source,
1024
 
                     conditions_string)
1025
 
        
1026
 
        # Turn the pipe file descriptor into a Python file object
1027
 
        if source not in file_objects:
1028
 
            file_objects[source] = os.fdopen(source, u"r", 1)
1029
 
        
1030
 
        # Read a line from the file object
1031
 
        cmdline = file_objects[source].readline()
1032
 
        if not cmdline:             # Empty line means end of file
1033
 
            # close the IPC pipe
1034
 
            file_objects[source].close()
1035
 
            del file_objects[source]
1036
 
            
1037
 
            # Stop calling this function
1038
 
            return False
1039
 
        
1040
 
        logger.debug(u"IPC command: %r", cmdline)
1041
 
        
1042
 
        # Parse and act on command
1043
 
        cmd, args = cmdline.rstrip(u"\r\n").split(None, 1)
1044
 
        
1045
 
        if cmd == u"NOTFOUND":
1046
 
            logger.warning(u"Client not found for fingerprint: %s",
1047
 
                           args)
1048
 
            if self.use_dbus:
1049
 
                # Emit D-Bus signal
1050
 
                mandos_dbus_service.ClientNotFound(args)
1051
 
        elif cmd == u"INVALID":
1052
 
            for client in self.clients:
1053
 
                if client.name == args:
1054
 
                    logger.warning(u"Client %s is invalid", args)
1055
 
                    if self.use_dbus:
1056
 
                        # Emit D-Bus signal
1057
 
                        client.Rejected()
1058
 
                    break
1059
 
            else:
1060
 
                logger.error(u"Unknown client %s is invalid", args)
1061
 
        elif cmd == u"SENDING":
1062
 
            for client in self.clients:
1063
 
                if client.name == args:
1064
 
                    logger.info(u"Sending secret to %s", client.name)
1065
 
                    client.checked_ok()
1066
 
                    if self.use_dbus:
1067
 
                        # Emit D-Bus signal
1068
 
                        client.ReceivedSecret()
1069
 
                    break
1070
 
            else:
1071
 
                logger.error(u"Sending secret to unknown client %s",
1072
 
                             args)
1073
 
        else:
1074
 
            logger.error(u"Unknown IPC command: %r", cmdline)
1075
 
        
1076
 
        # Keep calling this function
 
1849
        # error, or the other end of multiprocessing.Pipe has closed
 
1850
        if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):
 
1851
            # Wait for other process to exit
 
1852
            proc.join()
 
1853
            return False
 
1854
        
 
1855
        # Read a request from the child
 
1856
        request = parent_pipe.recv()
 
1857
        command = request[0]
 
1858
        
 
1859
        if command == 'init':
 
1860
            fpr = request[1]
 
1861
            address = request[2]
 
1862
            
 
1863
            for c in self.clients.itervalues():
 
1864
                if c.fingerprint == fpr:
 
1865
                    client = c
 
1866
                    break
 
1867
            else:
 
1868
                logger.info("Client not found for fingerprint: %s, ad"
 
1869
                            "dress: %s", fpr, address)
 
1870
                if self.use_dbus:
 
1871
                    # Emit D-Bus signal
 
1872
                    mandos_dbus_service.ClientNotFound(fpr,
 
1873
                                                       address[0])
 
1874
                parent_pipe.send(False)
 
1875
                return False
 
1876
            
 
1877
            gobject.io_add_watch(parent_pipe.fileno(),
 
1878
                                 gobject.IO_IN | gobject.IO_HUP,
 
1879
                                 functools.partial(self.handle_ipc,
 
1880
                                                   parent_pipe =
 
1881
                                                   parent_pipe,
 
1882
                                                   proc = proc,
 
1883
                                                   client_object =
 
1884
                                                   client))
 
1885
            parent_pipe.send(True)
 
1886
            # remove the old hook in favor of the new above hook on
 
1887
            # same fileno
 
1888
            return False
 
1889
        if command == 'funcall':
 
1890
            funcname = request[1]
 
1891
            args = request[2]
 
1892
            kwargs = request[3]
 
1893
            
 
1894
            parent_pipe.send(('data', getattr(client_object,
 
1895
                                              funcname)(*args,
 
1896
                                                         **kwargs)))
 
1897
        
 
1898
        if command == 'getattr':
 
1899
            attrname = request[1]
 
1900
            if callable(client_object.__getattribute__(attrname)):
 
1901
                parent_pipe.send(('function',))
 
1902
            else:
 
1903
                parent_pipe.send(('data', client_object
 
1904
                                  .__getattribute__(attrname)))
 
1905
        
 
1906
        if command == 'setattr':
 
1907
            attrname = request[1]
 
1908
            value = request[2]
 
1909
            setattr(client_object, attrname, value)
 
1910
        
1077
1911
        return True
1078
1912
 
1079
1913
 
1080
1914
def string_to_delta(interval):
1081
1915
    """Parse a string and return a datetime.timedelta
1082
1916
    
1083
 
    >>> string_to_delta(u'7d')
 
1917
    >>> string_to_delta('7d')
1084
1918
    datetime.timedelta(7)
1085
 
    >>> string_to_delta(u'60s')
 
1919
    >>> string_to_delta('60s')
1086
1920
    datetime.timedelta(0, 60)
1087
 
    >>> string_to_delta(u'60m')
 
1921
    >>> string_to_delta('60m')
1088
1922
    datetime.timedelta(0, 3600)
1089
 
    >>> string_to_delta(u'24h')
 
1923
    >>> string_to_delta('24h')
1090
1924
    datetime.timedelta(1)
1091
 
    >>> string_to_delta(u'1w')
 
1925
    >>> string_to_delta('1w')
1092
1926
    datetime.timedelta(7)
1093
 
    >>> string_to_delta(u'5m 30s')
 
1927
    >>> string_to_delta('5m 30s')
1094
1928
    datetime.timedelta(0, 330)
1095
1929
    """
1096
1930
    timevalue = datetime.timedelta(0)
1098
1932
        try:
1099
1933
            suffix = unicode(s[-1])
1100
1934
            value = int(s[:-1])
1101
 
            if suffix == u"d":
 
1935
            if suffix == "d":
1102
1936
                delta = datetime.timedelta(value)
1103
 
            elif suffix == u"s":
 
1937
            elif suffix == "s":
1104
1938
                delta = datetime.timedelta(0, value)
1105
 
            elif suffix == u"m":
 
1939
            elif suffix == "m":
1106
1940
                delta = datetime.timedelta(0, 0, 0, 0, value)
1107
 
            elif suffix == u"h":
 
1941
            elif suffix == "h":
1108
1942
                delta = datetime.timedelta(0, 0, 0, 0, 0, value)
1109
 
            elif suffix == u"w":
 
1943
            elif suffix == "w":
1110
1944
                delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
1111
1945
            else:
1112
 
                raise ValueError
1113
 
        except (ValueError, IndexError):
1114
 
            raise ValueError
 
1946
                raise ValueError("Unknown suffix %r" % suffix)
 
1947
        except (ValueError, IndexError) as e:
 
1948
            raise ValueError(*(e.args))
1115
1949
        timevalue += delta
1116
1950
    return timevalue
1117
1951
 
1118
1952
 
1119
 
def if_nametoindex(interface):
1120
 
    """Call the C function if_nametoindex(), or equivalent
1121
 
    
1122
 
    Note: This function cannot accept a unicode string."""
1123
 
    global if_nametoindex
1124
 
    try:
1125
 
        if_nametoindex = (ctypes.cdll.LoadLibrary
1126
 
                          (ctypes.util.find_library(u"c"))
1127
 
                          .if_nametoindex)
1128
 
    except (OSError, AttributeError):
1129
 
        logger.warning(u"Doing if_nametoindex the hard way")
1130
 
        def if_nametoindex(interface):
1131
 
            "Get an interface index the hard way, i.e. using fcntl()"
1132
 
            SIOCGIFINDEX = 0x8933  # From /usr/include/linux/sockios.h
1133
 
            with closing(socket.socket()) as s:
1134
 
                ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
1135
 
                                    struct.pack(str(u"16s16x"),
1136
 
                                                interface))
1137
 
            interface_index = struct.unpack(str(u"I"),
1138
 
                                            ifreq[16:20])[0]
1139
 
            return interface_index
1140
 
    return if_nametoindex(interface)
1141
 
 
1142
 
 
1143
1953
def daemon(nochdir = False, noclose = False):
1144
1954
    """See daemon(3).  Standard BSD Unix function.
1145
1955
    
1148
1958
        sys.exit()
1149
1959
    os.setsid()
1150
1960
    if not nochdir:
1151
 
        os.chdir(u"/")
 
1961
        os.chdir("/")
1152
1962
    if os.fork():
1153
1963
        sys.exit()
1154
1964
    if not noclose:
1156
1966
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1157
1967
        if not stat.S_ISCHR(os.fstat(null).st_mode):
1158
1968
            raise OSError(errno.ENODEV,
1159
 
                          u"/dev/null not a character device")
 
1969
                          "%s not a character device"
 
1970
                          % os.path.devnull)
1160
1971
        os.dup2(null, sys.stdin.fileno())
1161
1972
        os.dup2(null, sys.stdout.fileno())
1162
1973
        os.dup2(null, sys.stderr.fileno())
1166
1977
 
1167
1978
def main():
1168
1979
    
1169
 
    ######################################################################
 
1980
    ##################################################################
1170
1981
    # Parsing of options, both command line and config file
1171
1982
    
1172
 
    parser = optparse.OptionParser(version = "%%prog %s" % version)
1173
 
    parser.add_option("-i", u"--interface", type=u"string",
1174
 
                      metavar="IF", help=u"Bind to interface IF")
1175
 
    parser.add_option("-a", u"--address", type=u"string",
1176
 
                      help=u"Address to listen for requests on")
1177
 
    parser.add_option("-p", u"--port", type=u"int",
1178
 
                      help=u"Port number to receive requests on")
1179
 
    parser.add_option("--check", action=u"store_true",
1180
 
                      help=u"Run self-test")
1181
 
    parser.add_option("--debug", action=u"store_true",
1182
 
                      help=u"Debug mode; run in foreground and log to"
1183
 
                      u" terminal")
1184
 
    parser.add_option("--priority", type=u"string", help=u"GnuTLS"
1185
 
                      u" priority string (see GnuTLS documentation)")
1186
 
    parser.add_option("--servicename", type=u"string",
1187
 
                      metavar=u"NAME", help=u"Zeroconf service name")
1188
 
    parser.add_option("--configdir", type=u"string",
1189
 
                      default=u"/etc/mandos", metavar=u"DIR",
1190
 
                      help=u"Directory to search for configuration"
1191
 
                      u" files")
1192
 
    parser.add_option("--no-dbus", action=u"store_false",
1193
 
                      dest=u"use_dbus", help=u"Do not provide D-Bus"
1194
 
                      u" system bus interface")
1195
 
    parser.add_option("--no-ipv6", action=u"store_false",
1196
 
                      dest=u"use_ipv6", help=u"Do not use IPv6")
1197
 
    options = parser.parse_args()[0]
 
1983
    parser = argparse.ArgumentParser()
 
1984
    parser.add_argument("-v", "--version", action="version",
 
1985
                        version = "%%(prog)s %s" % version,
 
1986
                        help="show version number and exit")
 
1987
    parser.add_argument("-i", "--interface", metavar="IF",
 
1988
                        help="Bind to interface IF")
 
1989
    parser.add_argument("-a", "--address",
 
1990
                        help="Address to listen for requests on")
 
1991
    parser.add_argument("-p", "--port", type=int,
 
1992
                        help="Port number to receive requests on")
 
1993
    parser.add_argument("--check", action="store_true",
 
1994
                        help="Run self-test")
 
1995
    parser.add_argument("--debug", action="store_true",
 
1996
                        help="Debug mode; run in foreground and log"
 
1997
                        " to terminal")
 
1998
    parser.add_argument("--debuglevel", metavar="LEVEL",
 
1999
                        help="Debug level for stdout output")
 
2000
    parser.add_argument("--priority", help="GnuTLS"
 
2001
                        " priority string (see GnuTLS documentation)")
 
2002
    parser.add_argument("--servicename",
 
2003
                        metavar="NAME", help="Zeroconf service name")
 
2004
    parser.add_argument("--configdir",
 
2005
                        default="/etc/mandos", metavar="DIR",
 
2006
                        help="Directory to search for configuration"
 
2007
                        " files")
 
2008
    parser.add_argument("--no-dbus", action="store_false",
 
2009
                        dest="use_dbus", help="Do not provide D-Bus"
 
2010
                        " system bus interface")
 
2011
    parser.add_argument("--no-ipv6", action="store_false",
 
2012
                        dest="use_ipv6", help="Do not use IPv6")
 
2013
    parser.add_argument("--no-restore", action="store_false",
 
2014
                        dest="restore", help="Do not restore stored"
 
2015
                        " state")
 
2016
    parser.add_argument("--statedir", metavar="DIR",
 
2017
                        help="Directory to save/restore state in")
 
2018
    
 
2019
    options = parser.parse_args()
1198
2020
    
1199
2021
    if options.check:
1200
2022
        import doctest
1202
2024
        sys.exit()
1203
2025
    
1204
2026
    # Default values for config file for server-global settings
1205
 
    server_defaults = { u"interface": u"",
1206
 
                        u"address": u"",
1207
 
                        u"port": u"",
1208
 
                        u"debug": u"False",
1209
 
                        u"priority":
1210
 
                        u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
1211
 
                        u"servicename": u"Mandos",
1212
 
                        u"use_dbus": u"True",
1213
 
                        u"use_ipv6": u"True",
 
2027
    server_defaults = { "interface": "",
 
2028
                        "address": "",
 
2029
                        "port": "",
 
2030
                        "debug": "False",
 
2031
                        "priority":
 
2032
                        "SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
 
2033
                        "servicename": "Mandos",
 
2034
                        "use_dbus": "True",
 
2035
                        "use_ipv6": "True",
 
2036
                        "debuglevel": "",
 
2037
                        "restore": "True",
 
2038
                        "statedir": "/var/lib/mandos"
1214
2039
                        }
1215
2040
    
1216
2041
    # Parse config file for server-global settings
1217
2042
    server_config = configparser.SafeConfigParser(server_defaults)
1218
2043
    del server_defaults
1219
2044
    server_config.read(os.path.join(options.configdir,
1220
 
                                    u"mandos.conf"))
 
2045
                                    "mandos.conf"))
1221
2046
    # Convert the SafeConfigParser object to a dict
1222
2047
    server_settings = server_config.defaults()
1223
2048
    # Use the appropriate methods on the non-string config options
1224
 
    for option in (u"debug", u"use_dbus", u"use_ipv6"):
1225
 
        server_settings[option] = server_config.getboolean(u"DEFAULT",
 
2049
    for option in ("debug", "use_dbus", "use_ipv6"):
 
2050
        server_settings[option] = server_config.getboolean("DEFAULT",
1226
2051
                                                           option)
1227
2052
    if server_settings["port"]:
1228
 
        server_settings["port"] = server_config.getint(u"DEFAULT",
1229
 
                                                       u"port")
 
2053
        server_settings["port"] = server_config.getint("DEFAULT",
 
2054
                                                       "port")
1230
2055
    del server_config
1231
2056
    
1232
2057
    # Override the settings from the config file with command line
1233
2058
    # options, if set.
1234
 
    for option in (u"interface", u"address", u"port", u"debug",
1235
 
                   u"priority", u"servicename", u"configdir",
1236
 
                   u"use_dbus", u"use_ipv6"):
 
2059
    for option in ("interface", "address", "port", "debug",
 
2060
                   "priority", "servicename", "configdir",
 
2061
                   "use_dbus", "use_ipv6", "debuglevel", "restore",
 
2062
                   "statedir"):
1237
2063
        value = getattr(options, option)
1238
2064
        if value is not None:
1239
2065
            server_settings[option] = value
1247
2073
    ##################################################################
1248
2074
    
1249
2075
    # For convenience
1250
 
    debug = server_settings[u"debug"]
1251
 
    use_dbus = server_settings[u"use_dbus"]
1252
 
    use_ipv6 = server_settings[u"use_ipv6"]
1253
 
    
1254
 
    if not debug:
1255
 
        syslogger.setLevel(logging.WARNING)
1256
 
        console.setLevel(logging.WARNING)
1257
 
    
1258
 
    if server_settings[u"servicename"] != u"Mandos":
 
2076
    debug = server_settings["debug"]
 
2077
    debuglevel = server_settings["debuglevel"]
 
2078
    use_dbus = server_settings["use_dbus"]
 
2079
    use_ipv6 = server_settings["use_ipv6"]
 
2080
    stored_state_path = os.path.join(server_settings["statedir"],
 
2081
                                     stored_state_file)
 
2082
    
 
2083
    if debug:
 
2084
        initlogger(debug, logging.DEBUG)
 
2085
    else:
 
2086
        if not debuglevel:
 
2087
            initlogger(debug)
 
2088
        else:
 
2089
            level = getattr(logging, debuglevel.upper())
 
2090
            initlogger(debug, level)
 
2091
    
 
2092
    if server_settings["servicename"] != "Mandos":
1259
2093
        syslogger.setFormatter(logging.Formatter
1260
 
                               (u'Mandos (%s) [%%(process)d]:'
1261
 
                                u' %%(levelname)s: %%(message)s'
1262
 
                                % server_settings[u"servicename"]))
 
2094
                               ('Mandos (%s) [%%(process)d]:'
 
2095
                                ' %%(levelname)s: %%(message)s'
 
2096
                                % server_settings["servicename"]))
1263
2097
    
1264
2098
    # Parse config file with clients
1265
 
    client_defaults = { u"timeout": u"1h",
1266
 
                        u"interval": u"5m",
1267
 
                        u"checker": u"fping -q -- %%(host)s",
1268
 
                        u"host": u"",
1269
 
                        }
1270
 
    client_config = configparser.SafeConfigParser(client_defaults)
1271
 
    client_config.read(os.path.join(server_settings[u"configdir"],
1272
 
                                    u"clients.conf"))
 
2099
    client_config = configparser.SafeConfigParser(Client
 
2100
                                                  .client_defaults)
 
2101
    client_config.read(os.path.join(server_settings["configdir"],
 
2102
                                    "clients.conf"))
1273
2103
    
1274
2104
    global mandos_dbus_service
1275
2105
    mandos_dbus_service = None
1276
2106
    
1277
 
    clients = set()
1278
 
    tcp_server = MandosServer((server_settings[u"address"],
1279
 
                               server_settings[u"port"]),
 
2107
    tcp_server = MandosServer((server_settings["address"],
 
2108
                               server_settings["port"]),
1280
2109
                              ClientHandler,
1281
 
                              interface=server_settings[u"interface"],
 
2110
                              interface=(server_settings["interface"]
 
2111
                                         or None),
1282
2112
                              use_ipv6=use_ipv6,
1283
 
                              clients=clients,
1284
2113
                              gnutls_priority=
1285
 
                              server_settings[u"priority"],
 
2114
                              server_settings["priority"],
1286
2115
                              use_dbus=use_dbus)
1287
 
    pidfilename = u"/var/run/mandos.pid"
1288
 
    try:
1289
 
        pidfile = open(pidfilename, u"w")
1290
 
    except IOError:
1291
 
        logger.error(u"Could not open file %r", pidfilename)
 
2116
    if not debug:
 
2117
        pidfilename = "/var/run/mandos.pid"
 
2118
        try:
 
2119
            pidfile = open(pidfilename, "w")
 
2120
        except IOError:
 
2121
            logger.error("Could not open file %r", pidfilename)
1292
2122
    
1293
2123
    try:
1294
 
        uid = pwd.getpwnam(u"_mandos").pw_uid
1295
 
        gid = pwd.getpwnam(u"_mandos").pw_gid
 
2124
        uid = pwd.getpwnam("_mandos").pw_uid
 
2125
        gid = pwd.getpwnam("_mandos").pw_gid
1296
2126
    except KeyError:
1297
2127
        try:
1298
 
            uid = pwd.getpwnam(u"mandos").pw_uid
1299
 
            gid = pwd.getpwnam(u"mandos").pw_gid
 
2128
            uid = pwd.getpwnam("mandos").pw_uid
 
2129
            gid = pwd.getpwnam("mandos").pw_gid
1300
2130
        except KeyError:
1301
2131
            try:
1302
 
                uid = pwd.getpwnam(u"nobody").pw_uid
1303
 
                gid = pwd.getpwnam(u"nobody").pw_gid
 
2132
                uid = pwd.getpwnam("nobody").pw_uid
 
2133
                gid = pwd.getpwnam("nobody").pw_gid
1304
2134
            except KeyError:
1305
2135
                uid = 65534
1306
2136
                gid = 65534
1307
2137
    try:
1308
2138
        os.setgid(gid)
1309
2139
        os.setuid(uid)
1310
 
    except OSError, error:
 
2140
    except OSError as error:
1311
2141
        if error[0] != errno.EPERM:
1312
2142
            raise error
1313
2143
    
1314
 
    # Enable all possible GnuTLS debugging
1315
2144
    if debug:
 
2145
        # Enable all possible GnuTLS debugging
 
2146
        
1316
2147
        # "Use a log level over 10 to enable all debugging options."
1317
2148
        # - GnuTLS manual
1318
2149
        gnutls.library.functions.gnutls_global_set_log_level(11)
1319
2150
        
1320
2151
        @gnutls.library.types.gnutls_log_func
1321
2152
        def debug_gnutls(level, string):
1322
 
            logger.debug(u"GnuTLS: %s", string[:-1])
 
2153
            logger.debug("GnuTLS: %s", string[:-1])
1323
2154
        
1324
2155
        (gnutls.library.functions
1325
2156
         .gnutls_global_set_log_function(debug_gnutls))
 
2157
        
 
2158
        # Redirect stdin so all checkers get /dev/null
 
2159
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
 
2160
        os.dup2(null, sys.stdin.fileno())
 
2161
        if null > 2:
 
2162
            os.close(null)
 
2163
    
 
2164
    # Need to fork before connecting to D-Bus
 
2165
    if not debug:
 
2166
        # Close all input and output, do double fork, etc.
 
2167
        daemon()
 
2168
    
 
2169
    gobject.threads_init()
1326
2170
    
1327
2171
    global main_loop
1328
2172
    # From the Avahi example code
1331
2175
    bus = dbus.SystemBus()
1332
2176
    # End of Avahi example code
1333
2177
    if use_dbus:
1334
 
        bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos", bus)
 
2178
        try:
 
2179
            bus_name = dbus.service.BusName("se.recompile.Mandos",
 
2180
                                            bus, do_not_queue=True)
 
2181
            old_bus_name = (dbus.service.BusName
 
2182
                            ("se.bsnet.fukt.Mandos", bus,
 
2183
                             do_not_queue=True))
 
2184
        except dbus.exceptions.NameExistsException as e:
 
2185
            logger.error(unicode(e) + ", disabling D-Bus")
 
2186
            use_dbus = False
 
2187
            server_settings["use_dbus"] = False
 
2188
            tcp_server.use_dbus = False
1335
2189
    protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
1336
 
    service = AvahiService(name = server_settings[u"servicename"],
1337
 
                           servicetype = u"_mandos._tcp",
1338
 
                           protocol = protocol, bus = bus)
 
2190
    service = AvahiServiceToSyslog(name =
 
2191
                                   server_settings["servicename"],
 
2192
                                   servicetype = "_mandos._tcp",
 
2193
                                   protocol = protocol, bus = bus)
1339
2194
    if server_settings["interface"]:
1340
2195
        service.interface = (if_nametoindex
1341
 
                             (str(server_settings[u"interface"])))
 
2196
                             (str(server_settings["interface"])))
 
2197
    
 
2198
    global multiprocessing_manager
 
2199
    multiprocessing_manager = multiprocessing.Manager()
1342
2200
    
1343
2201
    client_class = Client
1344
2202
    if use_dbus:
1345
 
        client_class = functools.partial(ClientDBus, bus = bus)
1346
 
    clients.update(set(
1347
 
            client_class(name = section,
1348
 
                         config= dict(client_config.items(section)))
1349
 
            for section in client_config.sections()))
1350
 
    if not clients:
1351
 
        logger.warning(u"No clients defined")
1352
 
    
1353
 
    if debug:
1354
 
        # Redirect stdin so all checkers get /dev/null
1355
 
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1356
 
        os.dup2(null, sys.stdin.fileno())
1357
 
        if null > 2:
1358
 
            os.close(null)
1359
 
    else:
1360
 
        # No console logging
1361
 
        logger.removeHandler(console)
1362
 
        # Close all input and output, do double fork, etc.
1363
 
        daemon()
1364
 
    
1365
 
    try:
1366
 
        with closing(pidfile):
1367
 
            pid = os.getpid()
1368
 
            pidfile.write(str(pid) + "\n")
1369
 
        del pidfile
1370
 
    except IOError:
1371
 
        logger.error(u"Could not write to file %r with PID %d",
1372
 
                     pidfilename, pid)
1373
 
    except NameError:
1374
 
        # "pidfile" was never created
1375
 
        pass
1376
 
    del pidfilename
1377
 
    
1378
 
    def cleanup():
1379
 
        "Cleanup function; run on exit"
1380
 
        service.cleanup()
 
2203
        client_class = functools.partial(ClientDBusTransitional,
 
2204
                                         bus = bus)
 
2205
    
 
2206
    client_settings = Client.config_parser(client_config)
 
2207
    old_client_settings = {}
 
2208
    clients_data = {}
 
2209
    
 
2210
    # Get client data and settings from last running state.
 
2211
    if server_settings["restore"]:
 
2212
        try:
 
2213
            with open(stored_state_path, "rb") as stored_state:
 
2214
                clients_data, old_client_settings = (pickle.load
 
2215
                                                     (stored_state))
 
2216
            os.remove(stored_state_path)
 
2217
        except IOError as e:
 
2218
            logger.warning("Could not load persistent state: {0}"
 
2219
                           .format(e))
 
2220
            if e.errno != errno.ENOENT:
 
2221
                raise
 
2222
        except EOFError as e:
 
2223
            logger.warning("Could not load persistent state: "
 
2224
                           "EOFError: {0}".format(e))
 
2225
    
 
2226
    with PGPEngine() as pgp:
 
2227
        for client_name, client in clients_data.iteritems():
 
2228
            # Decide which value to use after restoring saved state.
 
2229
            # We have three different values: Old config file,
 
2230
            # new config file, and saved state.
 
2231
            # New config value takes precedence if it differs from old
 
2232
            # config value, otherwise use saved state.
 
2233
            for name, value in client_settings[client_name].items():
 
2234
                try:
 
2235
                    # For each value in new config, check if it
 
2236
                    # differs from the old config value (Except for
 
2237
                    # the "secret" attribute)
 
2238
                    if (name != "secret" and
 
2239
                        value != old_client_settings[client_name]
 
2240
                        [name]):
 
2241
                        client[name] = value
 
2242
                except KeyError:
 
2243
                    pass
 
2244
            
 
2245
            # Clients who has passed its expire date can still be
 
2246
            # enabled if its last checker was successful.  Clients
 
2247
            # whose checker succeeded before we stored its state is
 
2248
            # assumed to have successfully run all checkers during
 
2249
            # downtime.
 
2250
            if client["enabled"]:
 
2251
                if datetime.datetime.utcnow() >= client["expires"]:
 
2252
                    if not client["last_checked_ok"]:
 
2253
                        logger.warning(
 
2254
                            "disabling client {0} - Client never "
 
2255
                            "performed a successful checker"
 
2256
                            .format(client_name))
 
2257
                        client["enabled"] = False
 
2258
                    elif client["last_checker_status"] != 0:
 
2259
                        logger.warning(
 
2260
                            "disabling client {0} - Client "
 
2261
                            "last checker failed with error code {1}"
 
2262
                            .format(client_name,
 
2263
                                    client["last_checker_status"]))
 
2264
                        client["enabled"] = False
 
2265
                    else:
 
2266
                        client["expires"] = (datetime.datetime
 
2267
                                             .utcnow()
 
2268
                                             + client["timeout"])
 
2269
                        logger.debug("Last checker succeeded,"
 
2270
                                     " keeping {0} enabled"
 
2271
                                     .format(client_name))
 
2272
            try:
 
2273
                client["secret"] = (
 
2274
                    pgp.decrypt(client["encrypted_secret"],
 
2275
                                client_settings[client_name]
 
2276
                                ["secret"]))
 
2277
            except PGPError:
 
2278
                # If decryption fails, we use secret from new settings
 
2279
                logger.debug("Failed to decrypt {0} old secret"
 
2280
                             .format(client_name))
 
2281
                client["secret"] = (
 
2282
                    client_settings[client_name]["secret"])
 
2283
 
 
2284
    
 
2285
    # Add/remove clients based on new changes made to config
 
2286
    for client_name in (set(old_client_settings)
 
2287
                        - set(client_settings)):
 
2288
        del clients_data[client_name]
 
2289
    for client_name in (set(client_settings)
 
2290
                        - set(old_client_settings)):
 
2291
        clients_data[client_name] = client_settings[client_name]
 
2292
 
 
2293
    # Create all client objects
 
2294
    for client_name, client in clients_data.iteritems():
 
2295
        tcp_server.clients[client_name] = client_class(
 
2296
            name = client_name, settings = client)
 
2297
    
 
2298
    if not tcp_server.clients:
 
2299
        logger.warning("No clients defined")
1381
2300
        
1382
 
        while clients:
1383
 
            client = clients.pop()
1384
 
            client.disable_hook = None
1385
 
            client.disable()
1386
 
    
1387
 
    atexit.register(cleanup)
1388
 
    
1389
2301
    if not debug:
 
2302
        try:
 
2303
            with pidfile:
 
2304
                pid = os.getpid()
 
2305
                pidfile.write(str(pid) + "\n".encode("utf-8"))
 
2306
            del pidfile
 
2307
        except IOError:
 
2308
            logger.error("Could not write to file %r with PID %d",
 
2309
                         pidfilename, pid)
 
2310
        except NameError:
 
2311
            # "pidfile" was never created
 
2312
            pass
 
2313
        del pidfilename
1390
2314
        signal.signal(signal.SIGINT, signal.SIG_IGN)
 
2315
    
1391
2316
    signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
1392
2317
    signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
1393
2318
    
1395
2320
        class MandosDBusService(dbus.service.Object):
1396
2321
            """A D-Bus proxy object"""
1397
2322
            def __init__(self):
1398
 
                dbus.service.Object.__init__(self, bus, u"/")
1399
 
            _interface = u"se.bsnet.fukt.Mandos"
1400
 
            
1401
 
            @dbus.service.signal(_interface, signature=u"oa{sv}")
1402
 
            def ClientAdded(self, objpath, properties):
1403
 
                "D-Bus signal"
1404
 
                pass
1405
 
            
1406
 
            @dbus.service.signal(_interface, signature=u"s")
1407
 
            def ClientNotFound(self, fingerprint):
1408
 
                "D-Bus signal"
1409
 
                pass
1410
 
            
1411
 
            @dbus.service.signal(_interface, signature=u"os")
 
2323
                dbus.service.Object.__init__(self, bus, "/")
 
2324
            _interface = "se.recompile.Mandos"
 
2325
            
 
2326
            @dbus.service.signal(_interface, signature="o")
 
2327
            def ClientAdded(self, objpath):
 
2328
                "D-Bus signal"
 
2329
                pass
 
2330
            
 
2331
            @dbus.service.signal(_interface, signature="ss")
 
2332
            def ClientNotFound(self, fingerprint, address):
 
2333
                "D-Bus signal"
 
2334
                pass
 
2335
            
 
2336
            @dbus.service.signal(_interface, signature="os")
1412
2337
            def ClientRemoved(self, objpath, name):
1413
2338
                "D-Bus signal"
1414
2339
                pass
1415
2340
            
1416
 
            @dbus.service.method(_interface, out_signature=u"ao")
 
2341
            @dbus.service.method(_interface, out_signature="ao")
1417
2342
            def GetAllClients(self):
1418
2343
                "D-Bus method"
1419
 
                return dbus.Array(c.dbus_object_path for c in clients)
 
2344
                return dbus.Array(c.dbus_object_path
 
2345
                                  for c in
 
2346
                                  tcp_server.clients.itervalues())
1420
2347
            
1421
2348
            @dbus.service.method(_interface,
1422
 
                                 out_signature=u"a{oa{sv}}")
 
2349
                                 out_signature="a{oa{sv}}")
1423
2350
            def GetAllClientsWithProperties(self):
1424
2351
                "D-Bus method"
1425
2352
                return dbus.Dictionary(
1426
 
                    ((c.dbus_object_path, c.GetAllProperties())
1427
 
                     for c in clients),
1428
 
                    signature=u"oa{sv}")
 
2353
                    ((c.dbus_object_path, c.GetAll(""))
 
2354
                     for c in tcp_server.clients.itervalues()),
 
2355
                    signature="oa{sv}")
1429
2356
            
1430
 
            @dbus.service.method(_interface, in_signature=u"o")
 
2357
            @dbus.service.method(_interface, in_signature="o")
1431
2358
            def RemoveClient(self, object_path):
1432
2359
                "D-Bus method"
1433
 
                for c in clients:
 
2360
                for c in tcp_server.clients.itervalues():
1434
2361
                    if c.dbus_object_path == object_path:
1435
 
                        clients.remove(c)
 
2362
                        del tcp_server.clients[c.name]
1436
2363
                        c.remove_from_connection()
1437
2364
                        # Don't signal anything except ClientRemoved
1438
 
                        c.disable(signal=False)
 
2365
                        c.disable(quiet=True)
1439
2366
                        # Emit D-Bus signal
1440
2367
                        self.ClientRemoved(object_path, c.name)
1441
2368
                        return
1442
 
                raise KeyError
 
2369
                raise KeyError(object_path)
1443
2370
            
1444
2371
            del _interface
1445
2372
        
1446
 
        mandos_dbus_service = MandosDBusService()
1447
 
    
1448
 
    for client in clients:
 
2373
        class MandosDBusServiceTransitional(MandosDBusService):
 
2374
            __metaclass__ = AlternateDBusNamesMetaclass
 
2375
        mandos_dbus_service = MandosDBusServiceTransitional()
 
2376
    
 
2377
    def cleanup():
 
2378
        "Cleanup function; run on exit"
 
2379
        service.cleanup()
 
2380
        
 
2381
        multiprocessing.active_children()
 
2382
        if not (tcp_server.clients or client_settings):
 
2383
            return
 
2384
        
 
2385
        # Store client before exiting. Secrets are encrypted with key
 
2386
        # based on what config file has. If config file is
 
2387
        # removed/edited, old secret will thus be unrecovable.
 
2388
        clients = {}
 
2389
        with PGPEngine() as pgp:
 
2390
            for client in tcp_server.clients.itervalues():
 
2391
                key = client_settings[client.name]["secret"]
 
2392
                client.encrypted_secret = pgp.encrypt(client.secret,
 
2393
                                                      key)
 
2394
                client_dict = {}
 
2395
                
 
2396
                # A list of attributes that can not be pickled
 
2397
                # + secret.
 
2398
                exclude = set(("bus", "changedstate", "secret",
 
2399
                               "checker"))
 
2400
                for name, typ in (inspect.getmembers
 
2401
                                  (dbus.service.Object)):
 
2402
                    exclude.add(name)
 
2403
                
 
2404
                client_dict["encrypted_secret"] = (client
 
2405
                                                   .encrypted_secret)
 
2406
                for attr in client.client_structure:
 
2407
                    if attr not in exclude:
 
2408
                        client_dict[attr] = getattr(client, attr)
 
2409
                
 
2410
                clients[client.name] = client_dict
 
2411
                del client_settings[client.name]["secret"]
 
2412
        
 
2413
        try:
 
2414
            tempfd, tempname = tempfile.mkstemp(suffix=".pickle",
 
2415
                                                prefix="clients-",
 
2416
                                                dir=os.path.dirname
 
2417
                                                (stored_state_path))
 
2418
            with os.fdopen(tempfd, "wb") as stored_state:
 
2419
                pickle.dump((clients, client_settings), stored_state)
 
2420
            os.rename(tempname, stored_state_path)
 
2421
        except (IOError, OSError) as e:
 
2422
            logger.warning("Could not save persistent state: {0}"
 
2423
                           .format(e))
 
2424
            if not debug:
 
2425
                try:
 
2426
                    os.remove(tempname)
 
2427
                except NameError:
 
2428
                    pass
 
2429
            if e.errno not in set((errno.ENOENT, errno.EACCES,
 
2430
                                   errno.EEXIST)):
 
2431
                raise e
 
2432
        
 
2433
        # Delete all clients, and settings from config
 
2434
        while tcp_server.clients:
 
2435
            name, client = tcp_server.clients.popitem()
 
2436
            if use_dbus:
 
2437
                client.remove_from_connection()
 
2438
            # Don't signal anything except ClientRemoved
 
2439
            client.disable(quiet=True)
 
2440
            if use_dbus:
 
2441
                # Emit D-Bus signal
 
2442
                mandos_dbus_service.ClientRemoved(client
 
2443
                                                  .dbus_object_path,
 
2444
                                                  client.name)
 
2445
        client_settings.clear()
 
2446
    
 
2447
    atexit.register(cleanup)
 
2448
    
 
2449
    for client in tcp_server.clients.itervalues():
1449
2450
        if use_dbus:
1450
2451
            # Emit D-Bus signal
1451
 
            mandos_dbus_service.ClientAdded(client.dbus_object_path,
1452
 
                                            client.GetAllProperties())
1453
 
        client.enable()
 
2452
            mandos_dbus_service.ClientAdded(client.dbus_object_path)
 
2453
        # Need to initiate checking of clients
 
2454
        if client.enabled:
 
2455
            client.init_checker()
1454
2456
    
1455
2457
    tcp_server.enable()
1456
2458
    tcp_server.server_activate()
1458
2460
    # Find out what port we got
1459
2461
    service.port = tcp_server.socket.getsockname()[1]
1460
2462
    if use_ipv6:
1461
 
        logger.info(u"Now listening on address %r, port %d,"
 
2463
        logger.info("Now listening on address %r, port %d,"
1462
2464
                    " flowinfo %d, scope_id %d"
1463
2465
                    % tcp_server.socket.getsockname())
1464
2466
    else:                       # IPv4
1465
 
        logger.info(u"Now listening on address %r, port %d"
 
2467
        logger.info("Now listening on address %r, port %d"
1466
2468
                    % tcp_server.socket.getsockname())
1467
2469
    
1468
2470
    #service.interface = tcp_server.socket.getsockname()[3]
1471
2473
        # From the Avahi example code
1472
2474
        try:
1473
2475
            service.activate()
1474
 
        except dbus.exceptions.DBusException, error:
1475
 
            logger.critical(u"DBusException: %s", error)
 
2476
        except dbus.exceptions.DBusException as error:
 
2477
            logger.critical("DBusException: %s", error)
 
2478
            cleanup()
1476
2479
            sys.exit(1)
1477
2480
        # End of Avahi example code
1478
2481
        
1481
2484
                             (tcp_server.handle_request
1482
2485
                              (*args[2:], **kwargs) or True))
1483
2486
        
1484
 
        logger.debug(u"Starting main loop")
 
2487
        logger.debug("Starting main loop")
1485
2488
        main_loop.run()
1486
 
    except AvahiError, error:
1487
 
        logger.critical(u"AvahiError: %s", error)
 
2489
    except AvahiError as error:
 
2490
        logger.critical("AvahiError: %s", error)
 
2491
        cleanup()
1488
2492
        sys.exit(1)
1489
2493
    except KeyboardInterrupt:
1490
2494
        if debug:
1491
 
            print >> sys.stderr
1492
 
        logger.debug(u"Server received KeyboardInterrupt")
1493
 
    logger.debug(u"Server exiting")
 
2495
            print("", file=sys.stderr)
 
2496
        logger.debug("Server received KeyboardInterrupt")
 
2497
    logger.debug("Server exiting")
 
2498
    # Must run before the D-Bus bus name gets deregistered
 
2499
    cleanup()
1494
2500
 
1495
2501
if __name__ == '__main__':
1496
2502
    main()