/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk
1185 by Teddy Hogeborn
Add -I option to python 3 on the interpreter script ("shebang") line
1
#!/usr/bin/python3 -bI
1165 by Teddy Hogeborn
Server: Add scaffolding for tests
2
# -*- mode: python; after-save-hook: (lambda () (let ((command (if (fboundp 'file-local-name) (file-local-name (buffer-file-name)) (or (file-remote-p (buffer-file-name) 'localname) (buffer-file-name))))) (if (= (progn (if (get-buffer "*Test*") (kill-buffer "*Test*")) (process-file-shell-command (format "%s --check" (shell-quote-argument command)) nil "*Test*")) 0) (let ((w (get-buffer-window "*Test*"))) (if w (delete-window w))) (progn (with-current-buffer "*Test*" (compilation-mode)) (display-buffer "*Test*" '(display-buffer-in-side-window)))))); coding: utf-8 -*-
874 by Teddy Hogeborn
PEP8 compliance: mandos
3
#
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
4
# Mandos server - give out binary blobs to connecting clients.
874 by Teddy Hogeborn
PEP8 compliance: mandos
5
#
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
6
# This program is partly derived from an example program for an Avahi
7
# service publisher, downloaded from
8
# <http://avahi.org/wiki/PythonPublishExample>.  This includes the
336 by Teddy Hogeborn
Code cleanup.
9
# methods "add", "remove", "server_state_changed",
10
# "entry_group_state_changed", "cleanup", and "activate" in the
11
# "AvahiService" class, and some lines in "main".
874 by Teddy Hogeborn
PEP8 compliance: mandos
12
#
28 by Teddy Hogeborn
* server.conf: New file.
13
# Everything else is
969 by Teddy Hogeborn
Update copyright year to 2019
14
# Copyright © 2008-2019 Teddy Hogeborn
15
# Copyright © 2008-2019 Björn Påhlsson
874 by Teddy Hogeborn
PEP8 compliance: mandos
16
#
907 by Teddy Hogeborn
Alter copyright notices slightly. Actual license is unchanged!
17
# This file is part of Mandos.
18
#
19
# Mandos is free software: you can redistribute it and/or modify it
20
# under the terms of the GNU General Public License as published by
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
21
# the Free Software Foundation, either version 3 of the License, or
22
# (at your option) any later version.
23
#
907 by Teddy Hogeborn
Alter copyright notices slightly. Actual license is unchanged!
24
#     Mandos is distributed in the hope that it will be useful, but
25
#     WITHOUT ANY WARRANTY; without even the implied warranty of
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
26
#     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
27
#     GNU General Public License for more details.
874 by Teddy Hogeborn
PEP8 compliance: mandos
28
#
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
29
# You should have received a copy of the GNU General Public License
907 by Teddy Hogeborn
Alter copyright notices slightly. Actual license is unchanged!
30
# along with Mandos.  If not, see <http://www.gnu.org/licenses/>.
874 by Teddy Hogeborn
PEP8 compliance: mandos
31
#
505.1.2 by Teddy Hogeborn
Change "fukt.bsnet.se" to "recompile.se" throughout.
32
# Contact the authors at <mandos@recompile.se>.
874 by Teddy Hogeborn
PEP8 compliance: mandos
33
#
3 by Björn Påhlsson
Python based server
34
463.1.5 by teddy at bsnet
* mandos: Use unicode string literals.
35
from __future__ import (division, absolute_import, print_function,
36
                        unicode_literals)
10 by Teddy Hogeborn
* server.py: Bug fix: Do "from __future__ import division".
37
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
38
try:
39
    from future_builtins import *
40
except ImportError:
41
    pass
579 by Teddy Hogeborn
* mandos: Use all new builtins.
42
749 by Teddy Hogeborn
mandos: Some more minor changes to prepare for Python 3.
43
try:
44
    import SocketServer as socketserver
45
except ImportError:
46
    import socketserver
3 by Björn Påhlsson
Python based server
47
import socket
474 by teddy at bsnet
* mandos: Use the new argparse library instead of optparse.
48
import argparse
3 by Björn Påhlsson
Python based server
49
import datetime
50
import errno
749 by Teddy Hogeborn
mandos: Some more minor changes to prepare for Python 3.
51
try:
52
    import ConfigParser as configparser
53
except ImportError:
54
    import configparser
4 by Teddy Hogeborn
* server.py (Client.created, Client.next_check): New.
55
import sys
9 by Teddy Hogeborn
* client.cpp (main): Get t_old early since it is used on error exits.
56
import re
57
import os
58
import signal
10 by Teddy Hogeborn
* server.py: Bug fix: Do "from __future__ import division".
59
import subprocess
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
60
import atexit
61
import stat
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
62
import logging
63
import logging.handlers
163 by Teddy Hogeborn
* Makefile (PIDDIR, USER, GROUP): Removed.
64
import pwd
411 by Teddy Hogeborn
More consistent terminology: Clients are no longer "invalid" - they
65
import contextlib
333 by Teddy Hogeborn
Minor code cleanup; one minor bug fix.
66
import struct
67
import fcntl
337 by Teddy Hogeborn
Code cleanup. Move some global stuff into main.
68
import functools
749 by Teddy Hogeborn
mandos: Some more minor changes to prepare for Python 3.
69
try:
70
    import cPickle as pickle
71
except ImportError:
72
    import pickle
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
73
import multiprocessing
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
74
import types
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
75
import binascii
76
import tempfile
560.1.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
77
import itertools
609 by Teddy Hogeborn
* clients.conf: Convert all time intervals to new RFC 3339 syntax.
78
import collections
751 by Teddy Hogeborn
mandos: Use codecs.open() and print() for PID file.
79
import codecs
1165 by Teddy Hogeborn
Server: Add scaffolding for tests
80
import unittest
1200 by teddy at recompile
Server: Stagger checker runs when creating clients
81
import random
1204 by teddy at recompile
mandos: If possible, use shlex.quote() instead of re.escape()
82
import shlex
5 by Teddy Hogeborn
* server.py (server_metaclass): New.
83
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
84
import dbus
237.1.1 by Teddy Hogeborn
First steps of a D-Bus interface to the server.
85
import dbus.service
1139 by Teddy Hogeborn
Update Python 3 compatibility
86
import gi
830 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
87
from gi.repository import GLib
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
88
from dbus.mainloop.glib import DBusGMainLoop
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
89
import ctypes
215 by Teddy Hogeborn
* mandos: Remove unused "select" module. Import "ctypes.util".
90
import ctypes.util
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
91
import xml.dom.minidom
92
import inspect
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
93
1154 by Teddy Hogeborn
Simplification of Python 3 compatibility code
94
if sys.version_info.major == 2:
95
    __metaclass__ = type
1191 by teddy at recompile
Minor refactor of Python code: Move "str = unicode" to top
96
    str = unicode
1154 by Teddy Hogeborn
Simplification of Python 3 compatibility code
97
1202 by Teddy Hogeborn
Use collections.abc.Callable instead of collections.Callable
98
# Add collections.abc.Callable if it does not exist
99
try:
100
    collections.abc.Callable
101
except AttributeError:
102
    class abc:
103
        Callable = collections.Callable
104
    collections.abc = abc
105
    del abc
106
1204 by teddy at recompile
mandos: If possible, use shlex.quote() instead of re.escape()
107
# Add shlex.quote if it does not exist
108
try:
109
    shlex.quote
110
except AttributeError:
111
    shlex.quote = re.escape
112
1166 by Teddy Hogeborn
Server: Show Python warnings
113
# Show warnings by default
114
if not sys.warnoptions:
115
    import warnings
116
    warnings.simplefilter("default")
117
852 by Teddy Hogeborn
mandos: Bug fix for Python 2.7 and the "--interface" option
118
# Try to find the value of SO_BINDTODEVICE:
331 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
119
try:
852 by Teddy Hogeborn
mandos: Bug fix for Python 2.7 and the "--interface" option
120
    # This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and
121
    # newer, and it is also the most natural place for it:
331 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
122
    SO_BINDTODEVICE = socket.SO_BINDTODEVICE
123
except AttributeError:
124
    try:
852 by Teddy Hogeborn
mandos: Bug fix for Python 2.7 and the "--interface" option
125
        # This is where SO_BINDTODEVICE was up to and including Python
126
        # 2.6, and also 3.2:
331 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
127
        from IN import SO_BINDTODEVICE
128
    except ImportError:
852 by Teddy Hogeborn
mandos: Bug fix for Python 2.7 and the "--interface" option
129
        # In Python 2.7 it seems to have been removed entirely.
130
        # Try running the C preprocessor:
131
        try:
132
            cc = subprocess.Popen(["cc", "--language=c", "-E",
133
                                   "/dev/stdin"],
134
                                  stdin=subprocess.PIPE,
135
                                  stdout=subprocess.PIPE)
136
            stdout = cc.communicate(
137
                "#include <sys/socket.h>\nSO_BINDTODEVICE\n")[0]
138
            SO_BINDTODEVICE = int(stdout.splitlines()[-1])
139
        except (OSError, ValueError, IndexError):
140
            # No value found
141
            SO_BINDTODEVICE = None
331 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
142
1139 by Teddy Hogeborn
Update Python 3 compatibility
143
if sys.version_info < (3, 2):
144
    configparser.Configparser = configparser.SafeConfigParser
145
237.4.130 by teddy at recompile
Version 1.8.11-1
146
version = "1.8.11"
518.2.2 by Teddy Hogeborn
Directory with persistent state can now be changed with the "statedir"
147
stored_state_file = "clients.pickle"
13 by Björn Påhlsson
Added following support:
148
505.1.20 by Teddy Hogeborn
* Makefile (run-server): Remove obsolete warning.
149
logger = logging.getLogger()
1166 by Teddy Hogeborn
Server: Show Python warnings
150
logging.captureWarnings(True)   # Show warnings via the logging system
655 by Teddy Hogeborn
Allow self-tests to run without needing /dev/log.
151
syslogger = None
13 by Björn Påhlsson
Added following support:
152
518.1.5 by Björn Påhlsson
First run of python-lint. Fixed some *obviously* bad code and turned
153
try:
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
154
    if_nametoindex = ctypes.cdll.LoadLibrary(
155
        ctypes.util.find_library("c")).if_nametoindex
518.1.5 by Björn Påhlsson
First run of python-lint. Fixed some *obviously* bad code and turned
156
except (OSError, AttributeError):
874 by Teddy Hogeborn
PEP8 compliance: mandos
157
518.1.5 by Björn Påhlsson
First run of python-lint. Fixed some *obviously* bad code and turned
158
    def if_nametoindex(interface):
159
        "Get an interface index the hard way, i.e. using fcntl()"
160
        SIOCGIFINDEX = 0x8933  # From /usr/include/linux/sockios.h
161
        with contextlib.closing(socket.socket()) as s:
162
            ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
729 by Teddy Hogeborn
mandos: Stop using str() and remove unnecessary unicode() calls.
163
                                struct.pack(b"16s16x", interface))
164
        interface_index = struct.unpack("I", ifreq[16:20])[0]
518.1.5 by Björn Påhlsson
First run of python-lint. Fixed some *obviously* bad code and turned
165
        return interface_index
166
167
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
168
def copy_function(func):
169
    """Make a copy of a function"""
170
    if sys.version_info.major == 2:
171
        return types.FunctionType(func.func_code,
172
                                  func.func_globals,
173
                                  func.func_name,
174
                                  func.func_defaults,
175
                                  func.func_closure)
176
    else:
177
        return types.FunctionType(func.__code__,
178
                                  func.__globals__,
179
                                  func.__name__,
180
                                  func.__defaults__,
181
                                  func.__closure__)
182
183
530 by teddy at bsnet
* mandos (initlogger): Take new "debug" argument; all callers changed.
184
def initlogger(debug, level=logging.WARNING):
518.1.4 by Björn Påhlsson
restructured logger
185
    """init logger and add loglevel"""
874 by Teddy Hogeborn
PEP8 compliance: mandos
186
698 by Teddy Hogeborn
Fix mandos server "--servicename" option, broken since 1.6.4.
187
    global syslogger
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
188
    syslogger = (logging.handlers.SysLogHandler(
874 by Teddy Hogeborn
PEP8 compliance: mandos
189
        facility=logging.handlers.SysLogHandler.LOG_DAEMON,
190
        address="/dev/log"))
518.1.4 by Björn Påhlsson
restructured logger
191
    syslogger.setFormatter(logging.Formatter
192
                           ('Mandos [%(process)d]: %(levelname)s:'
193
                            ' %(message)s'))
194
    logger.addHandler(syslogger)
874 by Teddy Hogeborn
PEP8 compliance: mandos
195
530 by teddy at bsnet
* mandos (initlogger): Take new "debug" argument; all callers changed.
196
    if debug:
197
        console = logging.StreamHandler()
198
        console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
199
                                               ' [%(process)d]:'
200
                                               ' %(levelname)s:'
201
                                               ' %(message)s'))
202
        logger.addHandler(console)
518.1.4 by Björn Påhlsson
restructured logger
203
    logger.setLevel(level)
28 by Teddy Hogeborn
* server.conf: New file.
204
505.1.20 by Teddy Hogeborn
* Makefile (run-server): Remove obsolete warning.
205
518.1.9 by Björn Påhlsson
renamed variables
206
class PGPError(Exception):
207
    """Exception if encryption/decryption fails"""
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
208
    pass
209
210
1154 by Teddy Hogeborn
Simplification of Python 3 compatibility code
211
class PGPEngine:
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
212
    """A simple class for OpenPGP symmetric encryption & decryption"""
874 by Teddy Hogeborn
PEP8 compliance: mandos
213
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
214
    def __init__(self):
215
        self.tempdir = tempfile.mkdtemp(prefix="mandos-")
805 by Teddy Hogeborn
Use GnuPG 2 if available
216
        self.gpg = "gpg"
217
        try:
218
            output = subprocess.check_output(["gpgconf"])
219
            for line in output.splitlines():
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
220
                name, text, path = line.split(b":")
1173 by Teddy Hogeborn
Fix minor Python 3 bytes/str mixups
221
                if name == b"gpg":
805 by Teddy Hogeborn
Use GnuPG 2 if available
222
                    self.gpg = path
223
                    break
224
        except OSError as e:
225
            if e.errno != errno.ENOENT:
226
                raise
615 by Teddy Hogeborn
* mandos: Don't use the GnuPGInterface module.
227
        self.gnupgargs = ['--batch',
805 by Teddy Hogeborn
Use GnuPG 2 if available
228
                          '--homedir', self.tempdir,
615 by Teddy Hogeborn
* mandos: Don't use the GnuPGInterface module.
229
                          '--force-mdc',
849 by Teddy Hogeborn
mandos: Bug fix: Only use the --no-use-agent option for GPG 1
230
                          '--quiet']
231
        # Only GPG version 1 has the --no-use-agent option.
1173 by Teddy Hogeborn
Fix minor Python 3 bytes/str mixups
232
        if self.gpg == b"gpg" or self.gpg.endswith(b"/gpg"):
849 by Teddy Hogeborn
mandos: Bug fix: Only use the --no-use-agent option for GPG 1
233
            self.gnupgargs.append("--no-use-agent")
874 by Teddy Hogeborn
PEP8 compliance: mandos
234
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
235
    def __enter__(self):
236
        return self
874 by Teddy Hogeborn
PEP8 compliance: mandos
237
587 by Teddy Hogeborn
* Makefile (DOCBOOKTOMAN): Only run man --warnings if both "man" and
238
    def __exit__(self, exc_type, exc_value, traceback):
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
239
        self._cleanup()
240
        return False
874 by Teddy Hogeborn
PEP8 compliance: mandos
241
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
242
    def __del__(self):
243
        self._cleanup()
874 by Teddy Hogeborn
PEP8 compliance: mandos
244
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
245
    def _cleanup(self):
246
        if self.tempdir is not None:
247
            # Delete contents of tempdir
248
            for root, dirs, files in os.walk(self.tempdir,
874 by Teddy Hogeborn
PEP8 compliance: mandos
249
                                             topdown=False):
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
250
                for filename in files:
251
                    os.remove(os.path.join(root, filename))
252
                for dirname in dirs:
253
                    os.rmdir(os.path.join(root, dirname))
254
            # Remove tempdir
255
            os.rmdir(self.tempdir)
256
            self.tempdir = None
874 by Teddy Hogeborn
PEP8 compliance: mandos
257
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
258
    def password_encode(self, password):
259
        # Passphrase can not be empty and can not contain newlines or
260
        # NUL bytes.  So we prefix it and hex encode it.
630 by Teddy Hogeborn
* mandos (PGPEngine.password_encode): Bug fix: GnuPG can't handle
261
        encoded = b"mandos" + binascii.hexlify(password)
262
        if len(encoded) > 2048:
263
            # GnuPG can't handle long passwords, so encode differently
264
            encoded = (b"mandos" + password.replace(b"\\", b"\\\\")
265
                       .replace(b"\n", b"\\n")
266
                       .replace(b"\0", b"\\x00"))
267
        return encoded
874 by Teddy Hogeborn
PEP8 compliance: mandos
268
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
269
    def encrypt(self, data, password):
615 by Teddy Hogeborn
* mandos: Don't use the GnuPGInterface module.
270
        passphrase = self.password_encode(password)
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
271
        with tempfile.NamedTemporaryFile(
272
                dir=self.tempdir) as passfile:
615 by Teddy Hogeborn
* mandos: Don't use the GnuPGInterface module.
273
            passfile.write(passphrase)
274
            passfile.flush()
805 by Teddy Hogeborn
Use GnuPG 2 if available
275
            proc = subprocess.Popen([self.gpg, '--symmetric',
615 by Teddy Hogeborn
* mandos: Don't use the GnuPGInterface module.
276
                                     '--passphrase-file',
277
                                     passfile.name]
278
                                    + self.gnupgargs,
874 by Teddy Hogeborn
PEP8 compliance: mandos
279
                                    stdin=subprocess.PIPE,
280
                                    stdout=subprocess.PIPE,
281
                                    stderr=subprocess.PIPE)
282
            ciphertext, err = proc.communicate(input=data)
615 by Teddy Hogeborn
* mandos: Don't use the GnuPGInterface module.
283
        if proc.returncode != 0:
284
            raise PGPError(err)
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
285
        return ciphertext
874 by Teddy Hogeborn
PEP8 compliance: mandos
286
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
287
    def decrypt(self, data, password):
615 by Teddy Hogeborn
* mandos: Don't use the GnuPGInterface module.
288
        passphrase = self.password_encode(password)
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
289
        with tempfile.NamedTemporaryFile(
874 by Teddy Hogeborn
PEP8 compliance: mandos
290
                dir=self.tempdir) as passfile:
615 by Teddy Hogeborn
* mandos: Don't use the GnuPGInterface module.
291
            passfile.write(passphrase)
292
            passfile.flush()
805 by Teddy Hogeborn
Use GnuPG 2 if available
293
            proc = subprocess.Popen([self.gpg, '--decrypt',
615 by Teddy Hogeborn
* mandos: Don't use the GnuPGInterface module.
294
                                     '--passphrase-file',
295
                                     passfile.name]
296
                                    + self.gnupgargs,
874 by Teddy Hogeborn
PEP8 compliance: mandos
297
                                    stdin=subprocess.PIPE,
298
                                    stdout=subprocess.PIPE,
299
                                    stderr=subprocess.PIPE)
300
            decrypted_plaintext, err = proc.communicate(input=data)
615 by Teddy Hogeborn
* mandos: Don't use the GnuPGInterface module.
301
        if proc.returncode != 0:
302
            raise PGPError(err)
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
303
        return decrypted_plaintext
304
874 by Teddy Hogeborn
PEP8 compliance: mandos
305
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
306
# Pretend that we have an Avahi module
1154 by Teddy Hogeborn
Simplification of Python 3 compatibility code
307
class avahi:
1088 by Teddy Hogeborn
mandos: Refactor; use classes, not instances, as namespaces
308
    """This isn't so much a class as it is a module-like namespace."""
874 by Teddy Hogeborn
PEP8 compliance: mandos
309
    IF_UNSPEC = -1               # avahi-common/address.h
310
    PROTO_UNSPEC = -1            # avahi-common/address.h
311
    PROTO_INET = 0               # avahi-common/address.h
312
    PROTO_INET6 = 1              # avahi-common/address.h
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
313
    DBUS_NAME = "org.freedesktop.Avahi"
314
    DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"
315
    DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"
316
    DBUS_PATH_SERVER = "/"
874 by Teddy Hogeborn
PEP8 compliance: mandos
317
1088 by Teddy Hogeborn
mandos: Refactor; use classes, not instances, as namespaces
318
    @staticmethod
319
    def string_array_to_txt_array(t):
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
320
        return dbus.Array((dbus.ByteArray(s.encode("utf-8"))
321
                           for s in t), signature="ay")
874 by Teddy Hogeborn
PEP8 compliance: mandos
322
    ENTRY_GROUP_ESTABLISHED = 2  # avahi-common/defs.h
323
    ENTRY_GROUP_COLLISION = 3    # avahi-common/defs.h
324
    ENTRY_GROUP_FAILURE = 4      # avahi-common/defs.h
325
    SERVER_INVALID = 0           # avahi-common/defs.h
326
    SERVER_REGISTERING = 1       # avahi-common/defs.h
327
    SERVER_RUNNING = 2           # avahi-common/defs.h
328
    SERVER_COLLISION = 3         # avahi-common/defs.h
329
    SERVER_FAILURE = 4           # avahi-common/defs.h
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
330
874 by Teddy Hogeborn
PEP8 compliance: mandos
331
28 by Teddy Hogeborn
* server.conf: New file.
332
class AvahiError(Exception):
242 by Teddy Hogeborn
* mandos (AvahiError): Converted to use unicode. All users changed.
333
    def __init__(self, value, *args, **kwargs):
28 by Teddy Hogeborn
* server.conf: New file.
334
        self.value = value
729 by Teddy Hogeborn
mandos: Stop using str() and remove unnecessary unicode() calls.
335
        return super(AvahiError, self).__init__(value, *args,
336
                                                **kwargs)
28 by Teddy Hogeborn
* server.conf: New file.
337
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
338
28 by Teddy Hogeborn
* server.conf: New file.
339
class AvahiServiceError(AvahiError):
340
    pass
341
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
342
28 by Teddy Hogeborn
* server.conf: New file.
343
class AvahiGroupError(AvahiError):
344
    pass
345
346
1154 by Teddy Hogeborn
Simplification of Python 3 compatibility code
347
class AvahiService:
45 by Teddy Hogeborn
* server.py: Cosmetic changes.
348
    """An Avahi (Zeroconf) service.
874 by Teddy Hogeborn
PEP8 compliance: mandos
349
45 by Teddy Hogeborn
* server.py: Cosmetic changes.
350
    Attributes:
28 by Teddy Hogeborn
* server.conf: New file.
351
    interface: integer; avahi.IF_UNSPEC or an interface index.
352
               Used to optionally bind to the specified interface.
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
353
    name: string; Example: 'Mandos'
354
    type: string; Example: '_mandos._tcp'.
614 by Teddy Hogeborn
* mandos: Comment changes.
355
     See <https://www.iana.org/assignments/service-names-port-numbers>
45 by Teddy Hogeborn
* server.py: Cosmetic changes.
356
    port: integer; what port to announce
357
    TXT: list of strings; TXT record for the service
358
    domain: string; Domain to publish on, default to .local if empty.
359
    host: string; Host to publish records for, default is localhost
360
    max_renames: integer; maximum number of renames
361
    rename_count: integer; counter so we only rename after collisions
362
                  a sensible number of times
336 by Teddy Hogeborn
Code cleanup.
363
    group: D-Bus Entry Group
364
    server: D-Bus Server
338 by Teddy Hogeborn
* mandos: Minor doc string fixes.
365
    bus: dbus.SystemBus()
28 by Teddy Hogeborn
* server.conf: New file.
366
    """
874 by Teddy Hogeborn
PEP8 compliance: mandos
367
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
368
    def __init__(self,
874 by Teddy Hogeborn
PEP8 compliance: mandos
369
                 interface=avahi.IF_UNSPEC,
370
                 name=None,
371
                 servicetype=None,
372
                 port=None,
373
                 TXT=None,
374
                 domain="",
375
                 host="",
376
                 max_renames=32768,
377
                 protocol=avahi.PROTO_UNSPEC,
378
                 bus=None):
28 by Teddy Hogeborn
* server.conf: New file.
379
        self.interface = interface
380
        self.name = name
215 by Teddy Hogeborn
* mandos: Remove unused "select" module. Import "ctypes.util".
381
        self.type = servicetype
28 by Teddy Hogeborn
* server.conf: New file.
382
        self.port = port
237.1.2 by Teddy Hogeborn
Further steps towards a D-Bus server interface, plus minor syntax
383
        self.TXT = TXT if TXT is not None else []
28 by Teddy Hogeborn
* server.conf: New file.
384
        self.domain = domain
385
        self.host = host
386
        self.rename_count = 0
76 by Teddy Hogeborn
* plugins.d/password-request.c (init_gnutls_global): Renamed
387
        self.max_renames = max_renames
314 by Teddy Hogeborn
Support not using IPv6 in server:
388
        self.protocol = protocol
336 by Teddy Hogeborn
Code cleanup.
389
        self.group = None       # our entry group
390
        self.server = None
337 by Teddy Hogeborn
Code cleanup. Move some global stuff into main.
391
        self.bus = bus
482 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
392
        self.entry_group_state_changed_match = None
874 by Teddy Hogeborn
PEP8 compliance: mandos
393
738 by Teddy Hogeborn
Handle local Zeroconf service name collisions.
394
    def rename(self, remove=True):
28 by Teddy Hogeborn
* server.conf: New file.
395
        """Derived from the Avahi example code"""
396
        if self.rename_count >= self.max_renames:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
397
            logger.critical("No suitable Zeroconf service name found"
398
                            " after %i retries, exiting.",
215 by Teddy Hogeborn
* mandos: Remove unused "select" module. Import "ctypes.util".
399
                            self.rename_count)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
400
            raise AvahiServiceError("Too many renames")
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
401
        self.name = str(
402
            self.server.GetAlternativeServiceName(self.name))
738 by Teddy Hogeborn
Handle local Zeroconf service name collisions.
403
        self.rename_count += 1
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
404
        logger.info("Changing Zeroconf service name to %r ...",
24.1.155 by Björn Påhlsson
mandos server: Added debuglevel that adjust at what level information
405
                    self.name)
738 by Teddy Hogeborn
Handle local Zeroconf service name collisions.
406
        if remove:
407
            self.remove()
24.1.160 by Björn Påhlsson
fixed bug with local name collisions after a non-local name collision
408
        try:
409
            self.add()
482 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
410
        except dbus.exceptions.DBusException as error:
738 by Teddy Hogeborn
Handle local Zeroconf service name collisions.
411
            if (error.get_dbus_name()
412
                == "org.freedesktop.Avahi.CollisionError"):
413
                logger.info("Local Zeroconf service name collision.")
414
                return self.rename(remove=False)
415
            else:
416
                logger.critical("D-Bus Exception", exc_info=error)
417
                self.cleanup()
418
                os._exit(1)
874 by Teddy Hogeborn
PEP8 compliance: mandos
419
28 by Teddy Hogeborn
* server.conf: New file.
420
    def remove(self):
421
        """Derived from the Avahi example code"""
482 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
422
        if self.entry_group_state_changed_match is not None:
423
            self.entry_group_state_changed_match.remove()
424
            self.entry_group_state_changed_match = None
483 by Teddy Hogeborn
* mandos: Never call .Reset() on a defunct Avahi entry group.
425
        if self.group is not None:
426
            self.group.Reset()
874 by Teddy Hogeborn
PEP8 compliance: mandos
427
28 by Teddy Hogeborn
* server.conf: New file.
428
    def add(self):
429
        """Derived from the Avahi example code"""
482 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
430
        self.remove()
483 by Teddy Hogeborn
* mandos: Never call .Reset() on a defunct Avahi entry group.
431
        if self.group is None:
432
            self.group = dbus.Interface(
433
                self.bus.get_object(avahi.DBUS_NAME,
434
                                    self.server.EntryGroupNew()),
435
                avahi.DBUS_INTERFACE_ENTRY_GROUP)
482 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
436
        self.entry_group_state_changed_match = (
437
            self.group.connect_to_signal(
505.1.20 by Teddy Hogeborn
* Makefile (run-server): Remove obsolete warning.
438
                'StateChanged', self.entry_group_state_changed))
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
439
        logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
336 by Teddy Hogeborn
Code cleanup.
440
                     self.name, self.type)
441
        self.group.AddService(
442
            self.interface,
443
            self.protocol,
444
            dbus.UInt32(0),     # flags
445
            self.name, self.type,
446
            self.domain, self.host,
447
            dbus.UInt16(self.port),
448
            avahi.string_array_to_txt_array(self.TXT))
449
        self.group.Commit()
874 by Teddy Hogeborn
PEP8 compliance: mandos
450
336 by Teddy Hogeborn
Code cleanup.
451
    def entry_group_state_changed(self, state, error):
452
        """Derived from the Avahi example code"""
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
453
        logger.debug("Avahi entry group state change: %i", state)
874 by Teddy Hogeborn
PEP8 compliance: mandos
454
336 by Teddy Hogeborn
Code cleanup.
455
        if state == avahi.ENTRY_GROUP_ESTABLISHED:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
456
            logger.debug("Zeroconf service established.")
336 by Teddy Hogeborn
Code cleanup.
457
        elif state == avahi.ENTRY_GROUP_COLLISION:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
458
            logger.info("Zeroconf service name collision.")
336 by Teddy Hogeborn
Code cleanup.
459
            self.rename()
460
        elif state == avahi.ENTRY_GROUP_FAILURE:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
461
            logger.critical("Avahi: Error in group state changed %s",
730 by Teddy Hogeborn
mandos: Replace unicode() with str().
462
                            str(error))
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
463
            raise AvahiGroupError("State changed: {!s}".format(error))
874 by Teddy Hogeborn
PEP8 compliance: mandos
464
336 by Teddy Hogeborn
Code cleanup.
465
    def cleanup(self):
466
        """Derived from the Avahi example code"""
483 by Teddy Hogeborn
* mandos: Never call .Reset() on a defunct Avahi entry group.
467
        if self.group is not None:
468
            try:
469
                self.group.Free()
470
            except (dbus.exceptions.UnknownMethodException,
518.1.5 by Björn Påhlsson
First run of python-lint. Fixed some *obviously* bad code and turned
471
                    dbus.exceptions.DBusException):
483 by Teddy Hogeborn
* mandos: Never call .Reset() on a defunct Avahi entry group.
472
                pass
473
            self.group = None
482 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
474
        self.remove()
874 by Teddy Hogeborn
PEP8 compliance: mandos
475
482 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
476
    def server_state_changed(self, state, error=None):
336 by Teddy Hogeborn
Code cleanup.
477
        """Derived from the Avahi example code"""
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
478
        logger.debug("Avahi server state change: %i", state)
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
479
        bad_states = {
480
            avahi.SERVER_INVALID: "Zeroconf server invalid",
481
            avahi.SERVER_REGISTERING: None,
482
            avahi.SERVER_COLLISION: "Zeroconf server name collision",
483
            avahi.SERVER_FAILURE: "Zeroconf server failure",
484
        }
482 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
485
        if state in bad_states:
483 by Teddy Hogeborn
* mandos: Never call .Reset() on a defunct Avahi entry group.
486
            if bad_states[state] is not None:
487
                if error is None:
488
                    logger.error(bad_states[state])
489
                else:
490
                    logger.error(bad_states[state] + ": %r", error)
491
            self.cleanup()
336 by Teddy Hogeborn
Code cleanup.
492
        elif state == avahi.SERVER_RUNNING:
769 by Teddy Hogeborn
Handle local Zeroconf service name collisions on startup, too.
493
            try:
494
                self.add()
495
            except dbus.exceptions.DBusException as error:
496
                if (error.get_dbus_name()
497
                    == "org.freedesktop.Avahi.CollisionError"):
498
                    logger.info("Local Zeroconf service name"
499
                                " collision.")
500
                    return self.rename(remove=False)
501
                else:
502
                    logger.critical("D-Bus Exception", exc_info=error)
503
                    self.cleanup()
504
                    os._exit(1)
482 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
505
        else:
483 by Teddy Hogeborn
* mandos: Never call .Reset() on a defunct Avahi entry group.
506
            if error is None:
507
                logger.debug("Unknown state: %r", state)
508
            else:
509
                logger.debug("Unknown state: %r: %r", state, error)
874 by Teddy Hogeborn
PEP8 compliance: mandos
510
336 by Teddy Hogeborn
Code cleanup.
511
    def activate(self):
512
        """Derived from the Avahi example code"""
513
        if self.server is None:
514
            self.server = dbus.Interface(
337 by Teddy Hogeborn
Code cleanup. Move some global stuff into main.
515
                self.bus.get_object(avahi.DBUS_NAME,
482 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
516
                                    avahi.DBUS_PATH_SERVER,
517
                                    follow_name_owner_changes=True),
336 by Teddy Hogeborn
Code cleanup.
518
                avahi.DBUS_INTERFACE_SERVER)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
519
        self.server.connect_to_signal("StateChanged",
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
520
                                      self.server_state_changed)
336 by Teddy Hogeborn
Code cleanup.
521
        self.server_state_changed(self.server.GetState())
238 by Teddy Hogeborn
First version of a somewhat complete D-Bus server interface. Also
522
582 by Teddy Hogeborn
* mandos (IPv6_TCPServer.server_bind): Bug fix: handle non-existing
523
505.1.20 by Teddy Hogeborn
* Makefile (run-server): Remove obsolete warning.
524
class AvahiServiceToSyslog(AvahiService):
738 by Teddy Hogeborn
Handle local Zeroconf service name collisions.
525
    def rename(self, *args, **kwargs):
505.1.20 by Teddy Hogeborn
* Makefile (run-server): Remove obsolete warning.
526
        """Add the new name to the syslog messages"""
926 by Teddy Hogeborn
Server bug fix: Correct bad argument list
527
        ret = super(AvahiServiceToSyslog, self).rename(*args, **kwargs)
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
528
        syslogger.setFormatter(logging.Formatter(
529
            'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
530
            .format(self.name)))
505.1.20 by Teddy Hogeborn
* Makefile (run-server): Remove obsolete warning.
531
        return ret
238 by Teddy Hogeborn
First version of a somewhat complete D-Bus server interface. Also
532
874 by Teddy Hogeborn
PEP8 compliance: mandos
533
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
534
# Pretend that we have a GnuTLS module
1154 by Teddy Hogeborn
Simplification of Python 3 compatibility code
535
class gnutls:
1088 by Teddy Hogeborn
mandos: Refactor; use classes, not instances, as namespaces
536
    """This isn't so much a class as it is a module-like namespace."""
874 by Teddy Hogeborn
PEP8 compliance: mandos
537
875 by Teddy Hogeborn
Fix bug where mandos server could not find GnuTLS library
538
    library = ctypes.util.find_library("gnutls")
539
    if library is None:
540
        library = ctypes.util.find_library("gnutls-deb0")
541
    _library = ctypes.cdll.LoadLibrary(library)
542
    del library
874 by Teddy Hogeborn
PEP8 compliance: mandos
543
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
544
    # Unless otherwise indicated, the constants and types below are
545
    # all from the gnutls/gnutls.h C header file.
874 by Teddy Hogeborn
PEP8 compliance: mandos
546
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
547
    # Constants
548
    E_SUCCESS = 0
802 by Teddy Hogeborn
Handle GnuTLS errors and partial sends in gnutls "module".
549
    E_INTERRUPTED = -52
550
    E_AGAIN = -28
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
551
    CRT_OPENPGP = 2
962 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
552
    CRT_RAWPK = 3
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
553
    CLIENT = 2
554
    SHUT_RDWR = 0
555
    CRD_CERTIFICATE = 1
556
    E_NO_CERTIFICATE_FOUND = -49
962 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
557
    X509_FMT_DER = 0
558
    NO_TICKETS = 1<<10
559
    ENABLE_RAWPK = 1<<18
560
    CTYPE_PEERS = 3
561
    KEYID_USE_SHA256 = 1        # gnutls/x509.h
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
562
    OPENPGP_FMT_RAW = 0         # gnutls/openpgp.h
874 by Teddy Hogeborn
PEP8 compliance: mandos
563
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
564
    # Types
565
    class session_int(ctypes.Structure):
566
        _fields_ = []
567
    session_t = ctypes.POINTER(session_int)
874 by Teddy Hogeborn
PEP8 compliance: mandos
568
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
569
    class certificate_credentials_st(ctypes.Structure):
570
        _fields_ = []
571
    certificate_credentials_t = ctypes.POINTER(
572
        certificate_credentials_st)
573
    certificate_type_t = ctypes.c_int
874 by Teddy Hogeborn
PEP8 compliance: mandos
574
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
575
    class datum_t(ctypes.Structure):
576
        _fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
577
                    ('size', ctypes.c_uint)]
874 by Teddy Hogeborn
PEP8 compliance: mandos
578
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
579
    class openpgp_crt_int(ctypes.Structure):
580
        _fields_ = []
581
    openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
874 by Teddy Hogeborn
PEP8 compliance: mandos
582
    openpgp_crt_fmt_t = ctypes.c_int  # gnutls/openpgp.h
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
583
    log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
824 by Teddy Hogeborn
Remove empty comment
584
    credentials_type_t = ctypes.c_int
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
585
    transport_ptr_t = ctypes.c_void_p
586
    close_request_t = ctypes.c_int
874 by Teddy Hogeborn
PEP8 compliance: mandos
587
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
588
    # Exceptions
589
    class Error(Exception):
874 by Teddy Hogeborn
PEP8 compliance: mandos
590
        def __init__(self, message=None, code=None, args=()):
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
591
            # Default usage is by a message string, but if a return
592
            # code is passed, convert it to a string with
593
            # gnutls.strerror()
802 by Teddy Hogeborn
Handle GnuTLS errors and partial sends in gnutls "module".
594
            self.code = code
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
595
            if message is None and code is not None:
1088 by Teddy Hogeborn
mandos: Refactor; use classes, not instances, as namespaces
596
                message = gnutls.strerror(code)
597
            return super(gnutls.Error, self).__init__(
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
598
                message, *args)
874 by Teddy Hogeborn
PEP8 compliance: mandos
599
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
600
    class CertificateSecurityError(Error):
601
        pass
874 by Teddy Hogeborn
PEP8 compliance: mandos
602
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
603
    # Classes
1154 by Teddy Hogeborn
Simplification of Python 3 compatibility code
604
    class Credentials:
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
605
        def __init__(self):
606
            self._c_object = gnutls.certificate_credentials_t()
607
            gnutls.certificate_allocate_credentials(
608
                ctypes.byref(self._c_object))
609
            self.type = gnutls.CRD_CERTIFICATE
874 by Teddy Hogeborn
PEP8 compliance: mandos
610
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
611
        def __del__(self):
612
            gnutls.certificate_free_credentials(self._c_object)
874 by Teddy Hogeborn
PEP8 compliance: mandos
613
1154 by Teddy Hogeborn
Simplification of Python 3 compatibility code
614
    class ClientSession:
874 by Teddy Hogeborn
PEP8 compliance: mandos
615
        def __init__(self, socket, credentials=None):
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
616
            self._c_object = gnutls.session_t()
962 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
617
            gnutls_flags = gnutls.CLIENT
1130 by Teddy Hogeborn
Update Python 3 compatibility
618
            if gnutls.check_version(b"3.5.6"):
962 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
619
                gnutls_flags |= gnutls.NO_TICKETS
620
            if gnutls.has_rawpk:
621
                gnutls_flags |= gnutls.ENABLE_RAWPK
622
            gnutls.init(ctypes.byref(self._c_object), gnutls_flags)
623
            del gnutls_flags
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
624
            gnutls.set_default_priority(self._c_object)
625
            gnutls.transport_set_ptr(self._c_object, socket.fileno())
626
            gnutls.handshake_set_private_extensions(self._c_object,
627
                                                    True)
628
            self.socket = socket
629
            if credentials is None:
630
                credentials = gnutls.Credentials()
631
            gnutls.credentials_set(self._c_object, credentials.type,
632
                                   ctypes.cast(credentials._c_object,
633
                                               ctypes.c_void_p))
634
            self.credentials = credentials
874 by Teddy Hogeborn
PEP8 compliance: mandos
635
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
636
        def __del__(self):
637
            gnutls.deinit(self._c_object)
874 by Teddy Hogeborn
PEP8 compliance: mandos
638
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
639
        def handshake(self):
640
            return gnutls.handshake(self._c_object)
874 by Teddy Hogeborn
PEP8 compliance: mandos
641
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
642
        def send(self, data):
643
            data = bytes(data)
802 by Teddy Hogeborn
Handle GnuTLS errors and partial sends in gnutls "module".
644
            data_len = len(data)
645
            while data_len > 0:
646
                data_len -= gnutls.record_send(self._c_object,
647
                                               data[-data_len:],
648
                                               data_len)
874 by Teddy Hogeborn
PEP8 compliance: mandos
649
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
650
        def bye(self):
651
            return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
874 by Teddy Hogeborn
PEP8 compliance: mandos
652
802 by Teddy Hogeborn
Handle GnuTLS errors and partial sends in gnutls "module".
653
    # Error handling functions
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
654
    def _error_code(result):
655
        """A function to raise exceptions on errors, suitable
656
        for the 'restype' attribute on ctypes functions"""
657
        if result >= 0:
658
            return result
659
        if result == gnutls.E_NO_CERTIFICATE_FOUND:
874 by Teddy Hogeborn
PEP8 compliance: mandos
660
            raise gnutls.CertificateSecurityError(code=result)
661
        raise gnutls.Error(code=result)
662
802 by Teddy Hogeborn
Handle GnuTLS errors and partial sends in gnutls "module".
663
    def _retry_on_error(result, func, arguments):
664
        """A function to retry on some errors, suitable
665
        for the 'errcheck' attribute on ctypes functions"""
666
        while result < 0:
667
            if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
668
                return _error_code(result)
669
            result = func(*arguments)
670
        return result
874 by Teddy Hogeborn
PEP8 compliance: mandos
671
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
672
    # Unless otherwise indicated, the function declarations below are
673
    # all from the gnutls/gnutls.h C header file.
874 by Teddy Hogeborn
PEP8 compliance: mandos
674
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
675
    # Functions
676
    priority_set_direct = _library.gnutls_priority_set_direct
677
    priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
678
                                    ctypes.POINTER(ctypes.c_char_p)]
679
    priority_set_direct.restype = _error_code
874 by Teddy Hogeborn
PEP8 compliance: mandos
680
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
681
    init = _library.gnutls_init
682
    init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
683
    init.restype = _error_code
874 by Teddy Hogeborn
PEP8 compliance: mandos
684
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
685
    set_default_priority = _library.gnutls_set_default_priority
686
    set_default_priority.argtypes = [session_t]
687
    set_default_priority.restype = _error_code
874 by Teddy Hogeborn
PEP8 compliance: mandos
688
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
689
    record_send = _library.gnutls_record_send
690
    record_send.argtypes = [session_t, ctypes.c_void_p,
691
                            ctypes.c_size_t]
692
    record_send.restype = ctypes.c_ssize_t
802 by Teddy Hogeborn
Handle GnuTLS errors and partial sends in gnutls "module".
693
    record_send.errcheck = _retry_on_error
874 by Teddy Hogeborn
PEP8 compliance: mandos
694
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
695
    certificate_allocate_credentials = (
696
        _library.gnutls_certificate_allocate_credentials)
697
    certificate_allocate_credentials.argtypes = [
698
        ctypes.POINTER(certificate_credentials_t)]
699
    certificate_allocate_credentials.restype = _error_code
874 by Teddy Hogeborn
PEP8 compliance: mandos
700
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
701
    certificate_free_credentials = (
702
        _library.gnutls_certificate_free_credentials)
874 by Teddy Hogeborn
PEP8 compliance: mandos
703
    certificate_free_credentials.argtypes = [
704
        certificate_credentials_t]
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
705
    certificate_free_credentials.restype = None
874 by Teddy Hogeborn
PEP8 compliance: mandos
706
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
707
    handshake_set_private_extensions = (
708
        _library.gnutls_handshake_set_private_extensions)
709
    handshake_set_private_extensions.argtypes = [session_t,
710
                                                 ctypes.c_int]
711
    handshake_set_private_extensions.restype = None
874 by Teddy Hogeborn
PEP8 compliance: mandos
712
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
713
    credentials_set = _library.gnutls_credentials_set
714
    credentials_set.argtypes = [session_t, credentials_type_t,
715
                                ctypes.c_void_p]
716
    credentials_set.restype = _error_code
874 by Teddy Hogeborn
PEP8 compliance: mandos
717
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
718
    strerror = _library.gnutls_strerror
719
    strerror.argtypes = [ctypes.c_int]
720
    strerror.restype = ctypes.c_char_p
874 by Teddy Hogeborn
PEP8 compliance: mandos
721
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
722
    certificate_type_get = _library.gnutls_certificate_type_get
723
    certificate_type_get.argtypes = [session_t]
724
    certificate_type_get.restype = _error_code
874 by Teddy Hogeborn
PEP8 compliance: mandos
725
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
726
    certificate_get_peers = _library.gnutls_certificate_get_peers
727
    certificate_get_peers.argtypes = [session_t,
728
                                      ctypes.POINTER(ctypes.c_uint)]
729
    certificate_get_peers.restype = ctypes.POINTER(datum_t)
874 by Teddy Hogeborn
PEP8 compliance: mandos
730
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
731
    global_set_log_level = _library.gnutls_global_set_log_level
732
    global_set_log_level.argtypes = [ctypes.c_int]
733
    global_set_log_level.restype = None
874 by Teddy Hogeborn
PEP8 compliance: mandos
734
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
735
    global_set_log_function = _library.gnutls_global_set_log_function
736
    global_set_log_function.argtypes = [log_func]
737
    global_set_log_function.restype = None
874 by Teddy Hogeborn
PEP8 compliance: mandos
738
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
739
    deinit = _library.gnutls_deinit
740
    deinit.argtypes = [session_t]
741
    deinit.restype = None
874 by Teddy Hogeborn
PEP8 compliance: mandos
742
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
743
    handshake = _library.gnutls_handshake
744
    handshake.argtypes = [session_t]
745
    handshake.restype = _error_code
802 by Teddy Hogeborn
Handle GnuTLS errors and partial sends in gnutls "module".
746
    handshake.errcheck = _retry_on_error
874 by Teddy Hogeborn
PEP8 compliance: mandos
747
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
748
    transport_set_ptr = _library.gnutls_transport_set_ptr
749
    transport_set_ptr.argtypes = [session_t, transport_ptr_t]
750
    transport_set_ptr.restype = None
874 by Teddy Hogeborn
PEP8 compliance: mandos
751
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
752
    bye = _library.gnutls_bye
753
    bye.argtypes = [session_t, close_request_t]
754
    bye.restype = _error_code
802 by Teddy Hogeborn
Handle GnuTLS errors and partial sends in gnutls "module".
755
    bye.errcheck = _retry_on_error
874 by Teddy Hogeborn
PEP8 compliance: mandos
756
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
757
    check_version = _library.gnutls_check_version
758
    check_version.argtypes = [ctypes.c_char_p]
759
    check_version.restype = ctypes.c_char_p
874 by Teddy Hogeborn
PEP8 compliance: mandos
760
1088 by Teddy Hogeborn
mandos: Refactor; use classes, not instances, as namespaces
761
    _need_version = b"3.3.0"
762
    if check_version(_need_version) is None:
763
        raise self.Error("Needs GnuTLS {} or later"
764
                         .format(_need_version))
765
766
    _tls_rawpk_version = b"3.6.6"
962 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
767
    has_rawpk = bool(check_version(_tls_rawpk_version))
768
769
    if has_rawpk:
770
        # Types
771
        class pubkey_st(ctypes.Structure):
772
            _fields = []
773
        pubkey_t = ctypes.POINTER(pubkey_st)
774
775
        x509_crt_fmt_t = ctypes.c_int
776
777
        # All the function declarations below are from gnutls/abstract.h
778
        pubkey_init = _library.gnutls_pubkey_init
779
        pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]
780
        pubkey_init.restype = _error_code
781
782
        pubkey_import = _library.gnutls_pubkey_import
783
        pubkey_import.argtypes = [pubkey_t, ctypes.POINTER(datum_t),
784
                                  x509_crt_fmt_t]
785
        pubkey_import.restype = _error_code
786
787
        pubkey_get_key_id = _library.gnutls_pubkey_get_key_id
788
        pubkey_get_key_id.argtypes = [pubkey_t, ctypes.c_int,
789
                                      ctypes.POINTER(ctypes.c_ubyte),
790
                                      ctypes.POINTER(ctypes.c_size_t)]
791
        pubkey_get_key_id.restype = _error_code
792
793
        pubkey_deinit = _library.gnutls_pubkey_deinit
794
        pubkey_deinit.argtypes = [pubkey_t]
795
        pubkey_deinit.restype = None
796
    else:
797
        # All the function declarations below are from gnutls/openpgp.h
798
799
        openpgp_crt_init = _library.gnutls_openpgp_crt_init
800
        openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
801
        openpgp_crt_init.restype = _error_code
802
803
        openpgp_crt_import = _library.gnutls_openpgp_crt_import
804
        openpgp_crt_import.argtypes = [openpgp_crt_t,
805
                                       ctypes.POINTER(datum_t),
806
                                       openpgp_crt_fmt_t]
807
        openpgp_crt_import.restype = _error_code
808
809
        openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
810
        openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
811
                                            ctypes.POINTER(ctypes.c_uint)]
812
        openpgp_crt_verify_self.restype = _error_code
813
814
        openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
815
        openpgp_crt_deinit.argtypes = [openpgp_crt_t]
816
        openpgp_crt_deinit.restype = None
817
818
        openpgp_crt_get_fingerprint = (
819
            _library.gnutls_openpgp_crt_get_fingerprint)
820
        openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
821
                                                ctypes.c_void_p,
822
                                                ctypes.POINTER(
823
                                                    ctypes.c_size_t)]
824
        openpgp_crt_get_fingerprint.restype = _error_code
825
1130 by Teddy Hogeborn
Update Python 3 compatibility
826
    if check_version(b"3.6.4"):
962 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
827
        certificate_type_get2 = _library.gnutls_certificate_type_get2
828
        certificate_type_get2.argtypes = [session_t, ctypes.c_int]
829
        certificate_type_get2.restype = _error_code
874 by Teddy Hogeborn
PEP8 compliance: mandos
830
802 by Teddy Hogeborn
Handle GnuTLS errors and partial sends in gnutls "module".
831
    # Remove non-public functions
832
    del _error_code, _retry_on_error
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
833
874 by Teddy Hogeborn
PEP8 compliance: mandos
834
749.1.2 by Teddy Hogeborn
mandos (subprocess_call_pipe): Rename to "call_pipe" and take "func".
835
def call_pipe(connection,       # : multiprocessing.Connection
836
              func, *args, **kwargs):
749.1.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
837
    """This function is meant to be called by multiprocessing.Process
874 by Teddy Hogeborn
PEP8 compliance: mandos
838
749.1.2 by Teddy Hogeborn
mandos (subprocess_call_pipe): Rename to "call_pipe" and take "func".
839
    This function runs func(*args, **kwargs), and writes the resulting
840
    return value on the provided multiprocessing.Connection.
749.1.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
841
    """
749.1.2 by Teddy Hogeborn
mandos (subprocess_call_pipe): Rename to "call_pipe" and take "func".
842
    connection.send(func(*args, **kwargs))
749.1.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
843
    connection.close()
582 by Teddy Hogeborn
* mandos (IPv6_TCPServer.server_bind): Bug fix: handle non-existing
844
874 by Teddy Hogeborn
PEP8 compliance: mandos
845
1154 by Teddy Hogeborn
Simplification of Python 3 compatibility code
846
class Client:
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
847
    """A representation of a client host served by this server.
874 by Teddy Hogeborn
PEP8 compliance: mandos
848
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
849
    Attributes:
518.2.4 by Teddy Hogeborn
* mandos (_timedelta_to_milliseconds): Renamed to
850
    approved:   bool(); 'None' if not yet approved/disapproved
438 by Teddy Hogeborn
* mandos (Client.runtime_expansions): New attribute containing the
851
    approval_delay: datetime.timedelta(); Time to wait for approval
852
    approval_duration: datetime.timedelta(); Duration of one approval
1132 by Teddy Hogeborn
Server: Reap zombies created by multiprocessing.Process()
853
    checker: multiprocessing.Process(); a running checker process used
854
             to see if the client lives. 'None' if no process is
855
             running.
830 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
856
    checker_callback_tag: a GLib event source tag, or None
438 by Teddy Hogeborn
* mandos (Client.runtime_expansions): New attribute containing the
857
    checker_command: string; External command which is run to check
858
                     if client lives.  %() expansions are done at
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
859
                     runtime with vars(self) as dict, so that for
860
                     instance %(name)s can be used in the command.
830 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
861
    checker_initiator_tag: a GLib event source tag, or None
438 by Teddy Hogeborn
* mandos (Client.runtime_expansions): New attribute containing the
862
    created:    datetime.datetime(); (UTC) object creation
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
863
    client_structure: Object describing what attributes a client has
864
                      and is used for storing the client at exit
315 by Teddy Hogeborn
* mandos (Client.current_checker_command): New attribute.
865
    current_checker_command: string; current running checker_command
830 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
866
    disable_initiator_tag: a GLib event source tag, or None
438 by Teddy Hogeborn
* mandos (Client.runtime_expansions): New attribute containing the
867
    enabled:    bool()
868
    fingerprint: string (40 or 32 hexadecimal digits); used to
962 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
869
                 uniquely identify an OpenPGP client
870
    key_id: string (64 hexadecimal digits); used to uniquely identify
871
            a client using raw public keys
438 by Teddy Hogeborn
* mandos (Client.runtime_expansions): New attribute containing the
872
    host:       string; available for use by the checker command
873
    interval:   datetime.timedelta(); How often to start a new checker
442 by Teddy Hogeborn
* DBUS-API: Document new "LastApprovalRequest" client property.
874
    last_approval_request: datetime.datetime(); (UTC) or None
438 by Teddy Hogeborn
* mandos (Client.runtime_expansions): New attribute containing the
875
    last_checked_ok: datetime.datetime(); (UTC) or None
521 by teddy at bsnet
* debian/control (mandos/Depends): Added "python-crypto".
876
    last_checker_status: integer between 0 and 255 reflecting exit
518.1.7 by Teddy Hogeborn
* mandos: Break long lines and fix some more white space.
877
                         status of last checker. -1 reflects crashed
556 by Teddy Hogeborn
* DBUS-API (se.recompile.Mandos.Client.LastCheckerStatus): New
878
                         checker, -2 means no checker completed yet.
749.1.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
879
    last_checker_signal: The signal which killed the last checker, if
880
                         last_checker_status is -1
518.2.3 by Teddy Hogeborn
Make "enabled" a client config option.
881
    last_enabled: datetime.datetime(); (UTC) or None
438 by Teddy Hogeborn
* mandos (Client.runtime_expansions): New attribute containing the
882
    name:       string; from the config file, used in log messages and
883
                        D-Bus identifiers
884
    secret:     bytestring; sent verbatim (over TLS) to client
885
    timeout:    datetime.timedelta(); How long from last_checked_ok
886
                                      until this client is disabled
552 by teddy at recompile
* mandos: Consistent terminology; use the term "secret" for the
887
    extended_timeout:   extra long timeout when secret has been sent
438 by Teddy Hogeborn
* mandos (Client.runtime_expansions): New attribute containing the
888
    runtime_expansions: Allowed attributes for runtime expansion.
497 by Teddy Hogeborn
* DBUS-API: Document new "Expires" and "ExtendedTimeout" properties.
889
    expires:    datetime.datetime(); time (UTC) when a client will be
24.1.179 by Björn Påhlsson
New feature:
890
                disabled, or None
617 by Teddy Hogeborn
* mandos: Bug fix: Don't print output from checkers when running in
891
    server_settings: The server_settings dict from main()
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
892
    """
874 by Teddy Hogeborn
PEP8 compliance: mandos
893
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
894
    runtime_expansions = ("approval_delay", "approval_duration",
962 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
895
                          "created", "enabled", "expires", "key_id",
584 by Teddy Hogeborn
* mandos (Client.runtime_expansions): Add "expires" and (bug fix)
896
                          "fingerprint", "host", "interval",
897
                          "last_approval_request", "last_checked_ok",
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
898
                          "last_enabled", "name", "timeout")
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
899
    client_defaults = {
900
        "timeout": "PT5M",
901
        "extended_timeout": "PT15M",
902
        "interval": "PT2M",
903
        "checker": "fping -q -- %%(host)s",
904
        "host": "",
905
        "approval_delay": "PT0S",
906
        "approval_duration": "PT1S",
907
        "approved_by_default": "True",
908
        "enabled": "True",
909
    }
874 by Teddy Hogeborn
PEP8 compliance: mandos
910
518.1.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
911
    @staticmethod
912
    def config_parser(config):
542 by Björn Påhlsson
fixed bug with bad stored config state for expires and last_checked_ok.
913
        """Construct a new dict of client settings of this form:
518.1.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
914
        { client_name: {setting_name: value, ...}, ...}
542 by Björn Påhlsson
fixed bug with bad stored config state for expires and last_checked_ok.
915
        with exceptions for any special settings as defined above.
916
        NOTE: Must be a pure function. Must return the same result
917
        value given the same arguments.
918
        """
518.1.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
919
        settings = {}
920
        for client_name in config.sections():
921
            section = dict(config.items(client_name))
922
            client = settings[client_name] = {}
874 by Teddy Hogeborn
PEP8 compliance: mandos
923
518.1.15 by Björn Påhlsson
more refactoring in regards to how clients get created
924
            client["host"] = section["host"]
518.1.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
925
            # Reformat values from string types to Python types
926
            client["approved_by_default"] = config.getboolean(
927
                client_name, "approved_by_default")
543 by Teddy Hogeborn
* mandos: Break some long lines.
928
            client["enabled"] = config.getboolean(client_name,
929
                                                  "enabled")
874 by Teddy Hogeborn
PEP8 compliance: mandos
930
962 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
931
            # Uppercase and remove spaces from key_id and fingerprint
932
            # for later comparison purposes with return value from the
933
            # key_id() and fingerprint() functions
934
            client["key_id"] = (section.get("key_id", "").upper()
935
                                .replace(" ", ""))
518.1.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
936
            client["fingerprint"] = (section["fingerprint"].upper()
937
                                     .replace(" ", ""))
938
            if "secret" in section:
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
939
                client["secret"] = codecs.decode(section["secret"]
940
                                                 .encode("utf-8"),
941
                                                 "base64")
518.1.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
942
            elif "secfile" in section:
943
                with open(os.path.expanduser(os.path.expandvars
944
                                             (section["secfile"])),
945
                          "rb") as secfile:
946
                    client["secret"] = secfile.read()
947
            else:
723.1.5 by Teddy Hogeborn
Use the new auto-numbered "{}" syntax for the .format() string method.
948
                raise TypeError("No secret or secfile for section {}"
568 by Teddy Hogeborn
* mandos-monitor: Use new string format method.
949
                                .format(section))
518.1.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
950
            client["timeout"] = string_to_delta(section["timeout"])
951
            client["extended_timeout"] = string_to_delta(
952
                section["extended_timeout"])
953
            client["interval"] = string_to_delta(section["interval"])
954
            client["approval_delay"] = string_to_delta(
955
                section["approval_delay"])
956
            client["approval_duration"] = string_to_delta(
957
                section["approval_duration"])
518.1.15 by Björn Påhlsson
more refactoring in regards to how clients get created
958
            client["checker_command"] = section["checker"]
959
            client["last_approval_request"] = None
960
            client["last_checked_ok"] = None
556 by Teddy Hogeborn
* DBUS-API (se.recompile.Mandos.Client.LastCheckerStatus): New
961
            client["last_checker_status"] = -2
874 by Teddy Hogeborn
PEP8 compliance: mandos
962
518.1.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
963
        return settings
874 by Teddy Hogeborn
PEP8 compliance: mandos
964
965
    def __init__(self, settings, name=None, server_settings=None):
243 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
966
        self.name = name
617 by Teddy Hogeborn
* mandos: Bug fix: Don't print output from checkers when running in
967
        if server_settings is None:
968
            server_settings = {}
969
        self.server_settings = server_settings
518.1.15 by Björn Påhlsson
more refactoring in regards to how clients get created
970
        # adding all client settings
723.1.4 by Teddy Hogeborn
Use the .items() method instead of .iteritems().
971
        for setting, value in settings.items():
518.1.15 by Björn Påhlsson
more refactoring in regards to how clients get created
972
            setattr(self, setting, value)
874 by Teddy Hogeborn
PEP8 compliance: mandos
973
542 by Björn Påhlsson
fixed bug with bad stored config state for expires and last_checked_ok.
974
        if self.enabled:
975
            if not hasattr(self, "last_enabled"):
976
                self.last_enabled = datetime.datetime.utcnow()
977
            if not hasattr(self, "expires"):
978
                self.expires = (datetime.datetime.utcnow()
979
                                + self.timeout)
980
        else:
981
            self.last_enabled = None
982
            self.expires = None
874 by Teddy Hogeborn
PEP8 compliance: mandos
983
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
984
        logger.debug("Creating client %r", self.name)
962 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
985
        logger.debug("  Key ID: %s", self.key_id)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
986
        logger.debug("  Fingerprint: %s", self.fingerprint)
543 by Teddy Hogeborn
* mandos: Break some long lines.
987
        self.created = settings.get("created",
988
                                    datetime.datetime.utcnow())
874 by Teddy Hogeborn
PEP8 compliance: mandos
989
518.1.15 by Björn Påhlsson
more refactoring in regards to how clients get created
990
        # attributes specific for this server instance
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
991
        self.checker = None
992
        self.checker_initiator_tag = None
239 by Teddy Hogeborn
* mandos (_datetime_to_dbus_struct): Renamed to "_datetime_to_dbus";
993
        self.disable_initiator_tag = None
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
994
        self.checker_callback_tag = None
315 by Teddy Hogeborn
* mandos (Client.current_checker_command): New attribute.
995
        self.current_checker_command = None
518.2.4 by Teddy Hogeborn
* mandos (_timedelta_to_milliseconds): Renamed to
996
        self.approved = None
24.1.150 by Björn Påhlsson
* mandos: Added ClientDBus.approve_pending property. Exposed
997
        self.approvals_pending = 0
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
998
        self.changedstate = multiprocessing_manager.Condition(
999
            multiprocessing_manager.Lock())
1000
        self.client_structure = [attr
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
1001
                                 for attr in self.__dict__.keys()
521 by teddy at bsnet
* debian/control (mandos/Depends): Added "python-crypto".
1002
                                 if not attr.startswith("_")]
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
1003
        self.client_structure.append("client_structure")
874 by Teddy Hogeborn
PEP8 compliance: mandos
1004
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1005
        for name, t in inspect.getmembers(
1006
                type(self), lambda obj: isinstance(obj, property)):
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
1007
            if not name.startswith("_"):
1008
                self.client_structure.append(name)
874 by Teddy Hogeborn
PEP8 compliance: mandos
1009
520 by Björn Påhlsson
merge persistent state
1010
    # Send notice to process children that client state has changed
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1011
    def send_changedstate(self):
520 by Björn Påhlsson
merge persistent state
1012
        with self.changedstate:
1013
            self.changedstate.notify_all()
874 by Teddy Hogeborn
PEP8 compliance: mandos
1014
239 by Teddy Hogeborn
* mandos (_datetime_to_dbus_struct): Renamed to "_datetime_to_dbus";
1015
    def enable(self):
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
1016
        """Start this client's checker and timeout hooks"""
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1017
        if getattr(self, "enabled", False):
341 by Teddy Hogeborn
Code cleanup and one bug fix.
1018
            # Already enabled
1019
            return
24.1.179 by Björn Påhlsson
New feature:
1020
        self.expires = datetime.datetime.utcnow() + self.timeout
239 by Teddy Hogeborn
* mandos (_datetime_to_dbus_struct): Renamed to "_datetime_to_dbus";
1021
        self.enabled = True
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1022
        self.last_enabled = datetime.datetime.utcnow()
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
1023
        self.init_checker()
581 by Teddy Hogeborn
* mandos (Client.enable, Client.disable, ClientDBus.approve): Call
1024
        self.send_changedstate()
874 by Teddy Hogeborn
PEP8 compliance: mandos
1025
402 by Teddy Hogeborn
* mandos (Client.disable): Rename keyword argument "log" to "quiet",
1026
    def disable(self, quiet=True):
239 by Teddy Hogeborn
* mandos (_datetime_to_dbus_struct): Renamed to "_datetime_to_dbus";
1027
        """Disable this client."""
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1028
        if not getattr(self, "enabled", False):
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
1029
            return False
402 by Teddy Hogeborn
* mandos (Client.disable): Rename keyword argument "log" to "quiet",
1030
        if not quiet:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1031
            logger.info("Disabling client %s", self.name)
581 by Teddy Hogeborn
* mandos (Client.enable, Client.disable, ClientDBus.approve): Call
1032
        if getattr(self, "disable_initiator_tag", None) is not None:
830 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
1033
            GLib.source_remove(self.disable_initiator_tag)
239 by Teddy Hogeborn
* mandos (_datetime_to_dbus_struct): Renamed to "_datetime_to_dbus";
1034
            self.disable_initiator_tag = None
24.1.179 by Björn Påhlsson
New feature:
1035
        self.expires = None
581 by Teddy Hogeborn
* mandos (Client.enable, Client.disable, ClientDBus.approve): Call
1036
        if getattr(self, "checker_initiator_tag", None) is not None:
830 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
1037
            GLib.source_remove(self.checker_initiator_tag)
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
1038
            self.checker_initiator_tag = None
1039
        self.stop_checker()
239 by Teddy Hogeborn
* mandos (_datetime_to_dbus_struct): Renamed to "_datetime_to_dbus";
1040
        self.enabled = False
581 by Teddy Hogeborn
* mandos (Client.enable, Client.disable, ClientDBus.approve): Call
1041
        if not quiet:
1042
            self.send_changedstate()
830 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
1043
        # Do not run this again if called by a GLib.timeout_add
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
1044
        return False
874 by Teddy Hogeborn
PEP8 compliance: mandos
1045
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
1046
    def __del__(self):
239 by Teddy Hogeborn
* mandos (_datetime_to_dbus_struct): Renamed to "_datetime_to_dbus";
1047
        self.disable()
874 by Teddy Hogeborn
PEP8 compliance: mandos
1048
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
1049
    def init_checker(self):
1050
        # Schedule a new checker to be started an 'interval' from now,
1051
        # and every interval from then on.
581 by Teddy Hogeborn
* mandos (Client.enable, Client.disable, ClientDBus.approve): Call
1052
        if self.checker_initiator_tag is not None:
830 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
1053
            GLib.source_remove(self.checker_initiator_tag)
1054
        self.checker_initiator_tag = GLib.timeout_add(
1200 by teddy at recompile
Server: Stagger checker runs when creating clients
1055
            random.randrange(int(self.interval.total_seconds() * 1000
1056
                                 + 1)),
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1057
            self.start_checker)
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
1058
        # Schedule a disable() when 'timeout' has passed
581 by Teddy Hogeborn
* mandos (Client.enable, Client.disable, ClientDBus.approve): Call
1059
        if self.disable_initiator_tag is not None:
830 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
1060
            GLib.source_remove(self.disable_initiator_tag)
1061
        self.disable_initiator_tag = GLib.timeout_add(
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1062
            int(self.timeout.total_seconds() * 1000), self.disable)
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
1063
        # Also start a new checker *right now*.
1064
        self.start_checker()
874 by Teddy Hogeborn
PEP8 compliance: mandos
1065
756 by Teddy Hogeborn
Merge change to use multiprocessing module to run checkers.
1066
    def checker_callback(self, source, condition, connection,
1067
                         command):
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
1068
        """The checker has completed, so take appropriate actions."""
749.1.2 by Teddy Hogeborn
mandos (subprocess_call_pipe): Rename to "call_pipe" and take "func".
1069
        # Read return code from connection (see call_pipe)
749.1.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
1070
        returncode = connection.recv()
1071
        connection.close()
1176 by Teddy Hogeborn
mandos: Only join() still running checker processes
1072
        if self.checker is not None:
1073
            self.checker.join()
1132 by Teddy Hogeborn
Server: Reap zombies created by multiprocessing.Process()
1074
        self.checker_callback_tag = None
1075
        self.checker = None
874 by Teddy Hogeborn
PEP8 compliance: mandos
1076
749.1.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
1077
        if returncode >= 0:
1078
            self.last_checker_status = returncode
1079
            self.last_checker_signal = None
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
1080
            if self.last_checker_status == 0:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1081
                logger.info("Checker for %(name)s succeeded",
280 by Teddy Hogeborn
* mandos (Client.CheckerCompleted): Changed signature to "nxs"; return
1082
                            vars(self))
281 by Teddy Hogeborn
* mandos (Client.bump_timeout): Renamed to "checked_ok". All callers
1083
                self.checked_ok()
280 by Teddy Hogeborn
* mandos (Client.CheckerCompleted): Changed signature to "nxs"; return
1084
            else:
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1085
                logger.info("Checker for %(name)s failed", vars(self))
280 by Teddy Hogeborn
* mandos (Client.CheckerCompleted): Changed signature to "nxs"; return
1086
        else:
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
1087
            self.last_checker_status = -1
749.1.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
1088
            self.last_checker_signal = -returncode
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1089
            logger.warning("Checker for %(name)s crashed?",
13 by Björn Påhlsson
Added following support:
1090
                           vars(self))
749.1.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
1091
        return False
874 by Teddy Hogeborn
PEP8 compliance: mandos
1092
556 by Teddy Hogeborn
* DBUS-API (se.recompile.Mandos.Client.LastCheckerStatus): New
1093
    def checked_ok(self):
1094
        """Assert that the client has been seen, alive and well."""
1095
        self.last_checked_ok = datetime.datetime.utcnow()
1096
        self.last_checker_status = 0
749.1.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
1097
        self.last_checker_signal = None
556 by Teddy Hogeborn
* DBUS-API (se.recompile.Mandos.Client.LastCheckerStatus): New
1098
        self.bump_timeout()
874 by Teddy Hogeborn
PEP8 compliance: mandos
1099
556 by Teddy Hogeborn
* DBUS-API (se.recompile.Mandos.Client.LastCheckerStatus): New
1100
    def bump_timeout(self, timeout=None):
1101
        """Bump up the timeout for this client."""
24.1.179 by Björn Påhlsson
New feature:
1102
        if timeout is None:
1103
            timeout = self.timeout
505.1.17 by Teddy Hogeborn
* mandos (Client.checked_ok): Bug fix: Handle disabled client.
1104
        if self.disable_initiator_tag is not None:
830 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
1105
            GLib.source_remove(self.disable_initiator_tag)
581 by Teddy Hogeborn
* mandos (Client.enable, Client.disable, ClientDBus.approve): Call
1106
            self.disable_initiator_tag = None
505.1.17 by Teddy Hogeborn
* mandos (Client.checked_ok): Bug fix: Handle disabled client.
1107
        if getattr(self, "enabled", False):
830 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
1108
            self.disable_initiator_tag = GLib.timeout_add(
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1109
                int(timeout.total_seconds() * 1000), self.disable)
505.1.17 by Teddy Hogeborn
* mandos (Client.checked_ok): Bug fix: Handle disabled client.
1110
            self.expires = datetime.datetime.utcnow() + timeout
874 by Teddy Hogeborn
PEP8 compliance: mandos
1111
442 by Teddy Hogeborn
* DBUS-API: Document new "LastApprovalRequest" client property.
1112
    def need_approval(self):
1113
        self.last_approval_request = datetime.datetime.utcnow()
874 by Teddy Hogeborn
PEP8 compliance: mandos
1114
9 by Teddy Hogeborn
* client.cpp (main): Get t_old early since it is used on error exits.
1115
    def start_checker(self):
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
1116
        """Start a new checker subprocess if one is not running.
874 by Teddy Hogeborn
PEP8 compliance: mandos
1117
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
1118
        If a checker already exists, leave it running and do
1119
        nothing."""
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
1120
        # The reason for not killing a running checker is that if we
577 by Teddy Hogeborn
* mandos (Client.start_checker): Reworded comment.
1121
        # did that, and if a checker (for some reason) started running
1122
        # slowly and taking more than 'interval' time, then the client
1123
        # would inevitably timeout, since no checker would get a
1124
        # chance to run to completion.  If we instead leave running
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
1125
        # checkers alone, the checker would have to take more time
411 by Teddy Hogeborn
More consistent terminology: Clients are no longer "invalid" - they
1126
        # than 'timeout' for the client to be disabled, which is as it
1127
        # should be.
874 by Teddy Hogeborn
PEP8 compliance: mandos
1128
749.1.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
1129
        if self.checker is not None and not self.checker.is_alive():
1130
            logger.warning("Checker was not alive; joining")
1131
            self.checker.join()
1132
            self.checker = None
315 by Teddy Hogeborn
* mandos (Client.current_checker_command): New attribute.
1133
        # Start a new checker if needed
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
1134
        if self.checker is None:
583 by Teddy Hogeborn
* mandos (Client.start_checker): Remove undocumented support for "%%s"
1135
            # Escape attributes for the shell
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1136
            escaped_attrs = {
1204 by teddy at recompile
mandos: If possible, use shlex.quote() instead of re.escape()
1137
                attr: shlex.quote(str(getattr(self, attr)))
874 by Teddy Hogeborn
PEP8 compliance: mandos
1138
                for attr in self.runtime_expansions}
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
1139
            try:
583 by Teddy Hogeborn
* mandos (Client.start_checker): Remove undocumented support for "%%s"
1140
                command = self.checker_command % escaped_attrs
1141
            except TypeError as error:
1142
                logger.error('Could not format string "%s"',
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1143
                             self.checker_command,
1144
                             exc_info=error)
1145
                return True     # Try again later
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1146
            self.current_checker_command = command
749.1.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
1147
            logger.info("Starting checker %r for %s", command,
1148
                        self.name)
1149
            # We don't need to redirect stdout and stderr, since
1150
            # in normal mode, that is already done by daemon(),
1151
            # and in debug mode we don't want to.  (Stdin is
1152
            # always replaced by /dev/null.)
1153
            # The exception is when not debugging but nevertheless
1154
            # running in the foreground; use the previously
1155
            # created wnull.
874 by Teddy Hogeborn
PEP8 compliance: mandos
1156
            popen_args = {"close_fds": True,
1157
                          "shell": True,
1158
                          "cwd": "/"}
749.1.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
1159
            if (not self.server_settings["debug"]
1160
                and self.server_settings["foreground"]):
1161
                popen_args.update({"stdout": wnull,
874 by Teddy Hogeborn
PEP8 compliance: mandos
1162
                                   "stderr": wnull})
1163
            pipe = multiprocessing.Pipe(duplex=False)
749.1.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
1164
            self.checker = multiprocessing.Process(
874 by Teddy Hogeborn
PEP8 compliance: mandos
1165
                target=call_pipe,
1166
                args=(pipe[1], subprocess.call, command),
1167
                kwargs=popen_args)
749.1.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
1168
            self.checker.start()
830 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
1169
            self.checker_callback_tag = GLib.io_add_watch(
1168 by Teddy Hogeborn
Server: Fully use new GLib.io_add_watch() call signature
1170
                GLib.IOChannel.unix_new(pipe[0].fileno()),
1171
                GLib.PRIORITY_DEFAULT, GLib.IO_IN,
756 by Teddy Hogeborn
Merge change to use multiprocessing module to run checkers.
1172
                self.checker_callback, pipe[0], command)
830 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
1173
        # Re-run this periodically if run by GLib.timeout_add
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
1174
        return True
874 by Teddy Hogeborn
PEP8 compliance: mandos
1175
9 by Teddy Hogeborn
* client.cpp (main): Get t_old early since it is used on error exits.
1176
    def stop_checker(self):
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
1177
        """Force the checker process, if any, to stop."""
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
1178
        if self.checker_callback_tag:
830 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
1179
            GLib.source_remove(self.checker_callback_tag)
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
1180
            self.checker_callback_tag = None
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1181
        if getattr(self, "checker", None) is None:
9 by Teddy Hogeborn
* client.cpp (main): Get t_old early since it is used on error exits.
1182
            return
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1183
        logger.debug("Stopping checker for %(name)s", vars(self))
749.1.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
1184
        self.checker.terminate()
9 by Teddy Hogeborn
* client.cpp (main): Get t_old early since it is used on error exits.
1185
        self.checker = None
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
1186
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
1187
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1188
def dbus_service_property(dbus_interface,
1189
                          signature="v",
1190
                          access="readwrite",
1191
                          byte_arrays=False):
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1192
    """Decorators for marking methods of a DBusObjectWithProperties to
1193
    become properties on the D-Bus.
874 by Teddy Hogeborn
PEP8 compliance: mandos
1194
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1195
    The decorated method will be called with no arguments by "Get"
1196
    and with one argument by "Set".
874 by Teddy Hogeborn
PEP8 compliance: mandos
1197
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1198
    The parameters, where they are supported, are the same as
1199
    dbus.service.method, except there is only "signature", since the
1200
    type from Get() and the type sent to Set() is the same.
1201
    """
411 by Teddy Hogeborn
More consistent terminology: Clients are no longer "invalid" - they
1202
    # Encoding deeply encoded byte arrays is not supported yet by the
1203
    # "Set" method, so we fail early here:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1204
    if byte_arrays and signature != "ay":
1205
        raise ValueError("Byte arrays not supported for non-'ay'"
723.1.5 by Teddy Hogeborn
Use the new auto-numbered "{}" syntax for the .format() string method.
1206
                         " signature {!r}".format(signature))
874 by Teddy Hogeborn
PEP8 compliance: mandos
1207
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1208
    def decorator(func):
1209
        func._dbus_is_property = True
1210
        func._dbus_interface = dbus_interface
1211
        func._dbus_signature = signature
1212
        func._dbus_access = access
1213
        func._dbus_name = func.__name__
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1214
        if func._dbus_name.endswith("_dbus_property"):
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1215
            func._dbus_name = func._dbus_name[:-14]
874 by Teddy Hogeborn
PEP8 compliance: mandos
1216
        func._dbus_get_args_options = {'byte_arrays': byte_arrays}
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1217
        return func
874 by Teddy Hogeborn
PEP8 compliance: mandos
1218
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1219
    return decorator
1220
1221
560.1.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
1222
def dbus_interface_annotations(dbus_interface):
573 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
1223
    """Decorator for marking functions returning interface annotations
874 by Teddy Hogeborn
PEP8 compliance: mandos
1224
560.1.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
1225
    Usage:
874 by Teddy Hogeborn
PEP8 compliance: mandos
1226
560.1.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
1227
    @dbus_interface_annotations("org.example.Interface")
1228
    def _foo(self):  # Function name does not matter
1229
        return {"org.freedesktop.DBus.Deprecated": "true",
1230
                "org.freedesktop.DBus.Property.EmitsChangedSignal":
1231
                    "false"}
1232
    """
874 by Teddy Hogeborn
PEP8 compliance: mandos
1233
560.1.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
1234
    def decorator(func):
1235
        func._dbus_is_interface = True
1236
        func._dbus_interface = dbus_interface
1237
        func._dbus_name = dbus_interface
1238
        return func
874 by Teddy Hogeborn
PEP8 compliance: mandos
1239
560.1.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
1240
    return decorator
1241
1242
561.1.1 by Teddy Hogeborn
Add D-Bus annotations support to methods, signals and properties.
1243
def dbus_annotations(annotations):
1244
    """Decorator to annotate D-Bus methods, signals or properties
1245
    Usage:
874 by Teddy Hogeborn
PEP8 compliance: mandos
1246
732 by Teddy Hogeborn
Emit D-Bus "org.freedesktop.DBus.Properties.PropertiesChanged" signal.
1247
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",
1248
                       "org.freedesktop.DBus.Property."
1249
                       "EmitsChangedSignal": "false"})
561.1.1 by Teddy Hogeborn
Add D-Bus annotations support to methods, signals and properties.
1250
    @dbus_service_property("org.example.Interface", signature="b",
1251
                           access="r")
1252
    def Property_dbus_property(self):
1253
        return dbus.Boolean(False)
874 by Teddy Hogeborn
PEP8 compliance: mandos
1254
784 by Teddy Hogeborn
Refactor D-Bus annotation class out from D-Bus properties class.
1255
    See also the DBusObjectWithAnnotations class.
561.1.1 by Teddy Hogeborn
Add D-Bus annotations support to methods, signals and properties.
1256
    """
874 by Teddy Hogeborn
PEP8 compliance: mandos
1257
561.1.1 by Teddy Hogeborn
Add D-Bus annotations support to methods, signals and properties.
1258
    def decorator(func):
1259
        func._dbus_annotations = annotations
1260
        return func
874 by Teddy Hogeborn
PEP8 compliance: mandos
1261
561.1.1 by Teddy Hogeborn
Add D-Bus annotations support to methods, signals and properties.
1262
    return decorator
1263
1264
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1265
class DBusPropertyException(dbus.exceptions.DBusException):
1266
    """A base class for D-Bus property-related exceptions
1267
    """
729 by Teddy Hogeborn
mandos: Stop using str() and remove unnecessary unicode() calls.
1268
    pass
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1269
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1270
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1271
class DBusPropertyAccessException(DBusPropertyException):
1272
    """A property's access permissions disallows an operation.
1273
    """
1274
    pass
1275
1276
1277
class DBusPropertyNotFound(DBusPropertyException):
1278
    """An attempt was made to access a non-existing property.
1279
    """
1280
    pass
1281
1282
784 by Teddy Hogeborn
Refactor D-Bus annotation class out from D-Bus properties class.
1283
class DBusObjectWithAnnotations(dbus.service.Object):
1284
    """A D-Bus object with annotations.
874 by Teddy Hogeborn
PEP8 compliance: mandos
1285
784 by Teddy Hogeborn
Refactor D-Bus annotation class out from D-Bus properties class.
1286
    Classes inheriting from this can use the dbus_annotations
1287
    decorator to add annotations to methods or signals.
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1288
    """
874 by Teddy Hogeborn
PEP8 compliance: mandos
1289
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1290
    @staticmethod
560.1.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
1291
    def _is_dbus_thing(thing):
1292
        """Returns a function testing if an attribute is a D-Bus thing
874 by Teddy Hogeborn
PEP8 compliance: mandos
1293
560.1.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
1294
        If called like _is_dbus_thing("method") it returns a function
1295
        suitable for use as predicate to inspect.getmembers().
1296
        """
723.1.5 by Teddy Hogeborn
Use the new auto-numbered "{}" syntax for the .format() string method.
1297
        return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
560.1.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
1298
                                   False)
874 by Teddy Hogeborn
PEP8 compliance: mandos
1299
560.1.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
1300
    def _get_all_dbus_things(self, thing):
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1301
        """Returns a generator of (name, attribute) pairs
1302
        """
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1303
        return ((getattr(athing.__get__(self), "_dbus_name", name),
560.1.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
1304
                 athing.__get__(self))
24.1.186 by Björn Påhlsson
transitional stuff actually working
1305
                for cls in self.__class__.__mro__
560.1.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
1306
                for name, athing in
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1307
                inspect.getmembers(cls, self._is_dbus_thing(thing)))
874 by Teddy Hogeborn
PEP8 compliance: mandos
1308
784 by Teddy Hogeborn
Refactor D-Bus annotation class out from D-Bus properties class.
1309
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
874 by Teddy Hogeborn
PEP8 compliance: mandos
1310
                         out_signature="s",
1311
                         path_keyword='object_path',
1312
                         connection_keyword='connection')
784 by Teddy Hogeborn
Refactor D-Bus annotation class out from D-Bus properties class.
1313
    def Introspect(self, object_path, connection):
1314
        """Overloading of standard D-Bus method.
874 by Teddy Hogeborn
PEP8 compliance: mandos
1315
784 by Teddy Hogeborn
Refactor D-Bus annotation class out from D-Bus properties class.
1316
        Inserts annotation tags on methods and signals.
1317
        """
1318
        xmlstring = dbus.service.Object.Introspect(self, object_path,
1319
                                                   connection)
1320
        try:
1321
            document = xml.dom.minidom.parseString(xmlstring)
874 by Teddy Hogeborn
PEP8 compliance: mandos
1322
784 by Teddy Hogeborn
Refactor D-Bus annotation class out from D-Bus properties class.
1323
            for if_tag in document.getElementsByTagName("interface"):
1324
                # Add annotation tags
1325
                for typ in ("method", "signal"):
1326
                    for tag in if_tag.getElementsByTagName(typ):
1327
                        annots = dict()
1328
                        for name, prop in (self.
1329
                                           _get_all_dbus_things(typ)):
1330
                            if (name == tag.getAttribute("name")
1331
                                and prop._dbus_interface
1332
                                == if_tag.getAttribute("name")):
1333
                                annots.update(getattr(
1334
                                    prop, "_dbus_annotations", {}))
1335
                        for name, value in annots.items():
1336
                            ann_tag = document.createElement(
1337
                                "annotation")
1338
                            ann_tag.setAttribute("name", name)
1339
                            ann_tag.setAttribute("value", value)
1340
                            tag.appendChild(ann_tag)
1341
                # Add interface annotation tags
1342
                for annotation, value in dict(
1343
                    itertools.chain.from_iterable(
1344
                        annotations().items()
1345
                        for name, annotations
1346
                        in self._get_all_dbus_things("interface")
1347
                        if name == if_tag.getAttribute("name")
1348
                        )).items():
1349
                    ann_tag = document.createElement("annotation")
1350
                    ann_tag.setAttribute("name", annotation)
1351
                    ann_tag.setAttribute("value", value)
1352
                    if_tag.appendChild(ann_tag)
1353
                # Fix argument name for the Introspect method itself
1354
                if (if_tag.getAttribute("name")
874 by Teddy Hogeborn
PEP8 compliance: mandos
1355
                    == dbus.INTROSPECTABLE_IFACE):
784 by Teddy Hogeborn
Refactor D-Bus annotation class out from D-Bus properties class.
1356
                    for cn in if_tag.getElementsByTagName("method"):
1357
                        if cn.getAttribute("name") == "Introspect":
1358
                            for arg in cn.getElementsByTagName("arg"):
1359
                                if (arg.getAttribute("direction")
1360
                                    == "out"):
1361
                                    arg.setAttribute("name",
1362
                                                     "xml_data")
1363
            xmlstring = document.toxml("utf-8")
1364
            document.unlink()
1365
        except (AttributeError, xml.dom.DOMException,
1366
                xml.parsers.expat.ExpatError) as error:
1367
            logger.error("Failed to override Introspection method",
1368
                         exc_info=error)
1369
        return xmlstring
1370
1371
1372
class DBusObjectWithProperties(DBusObjectWithAnnotations):
1373
    """A D-Bus object with properties.
874 by Teddy Hogeborn
PEP8 compliance: mandos
1374
784 by Teddy Hogeborn
Refactor D-Bus annotation class out from D-Bus properties class.
1375
    Classes inheriting from this can use the dbus_service_property
1376
    decorator to expose methods as D-Bus properties.  It exposes the
1377
    standard Get(), Set(), and GetAll() methods on the D-Bus.
1378
    """
874 by Teddy Hogeborn
PEP8 compliance: mandos
1379
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1380
    def _get_dbus_property(self, interface_name, property_name):
1381
        """Returns a bound method if one exists which is a D-Bus
1382
        property with the specified name and interface.
1383
        """
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1384
        for cls in self.__class__.__mro__:
1385
            for name, value in inspect.getmembers(
1386
                    cls, self._is_dbus_thing("property")):
505.1.3 by Teddy Hogeborn
* mandos: Break long lines.
1387
                if (value._dbus_name == property_name
1388
                    and value._dbus_interface == interface_name):
24.1.186 by Björn Påhlsson
transitional stuff actually working
1389
                    return value.__get__(self)
874 by Teddy Hogeborn
PEP8 compliance: mandos
1390
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1391
        # No such property
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1392
        raise DBusPropertyNotFound("{}:{}.{}".format(
1393
            self.dbus_object_path, interface_name, property_name))
874 by Teddy Hogeborn
PEP8 compliance: mandos
1394
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
1395
    @classmethod
1396
    def _get_all_interface_names(cls):
1397
        """Get a sequence of all interfaces supported by an object"""
1398
        return (name for name in set(getattr(getattr(x, attr),
1399
                                             "_dbus_interface", None)
1400
                                     for x in (inspect.getmro(cls))
1401
                                     for attr in dir(x))
1402
                if name is not None)
874 by Teddy Hogeborn
PEP8 compliance: mandos
1403
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1404
    @dbus.service.method(dbus.PROPERTIES_IFACE,
1405
                         in_signature="ss",
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1406
                         out_signature="v")
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1407
    def Get(self, interface_name, property_name):
1408
        """Standard D-Bus property Get() method, see D-Bus standard.
1409
        """
1410
        prop = self._get_dbus_property(interface_name, property_name)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1411
        if prop._dbus_access == "write":
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1412
            raise DBusPropertyAccessException(property_name)
1413
        value = prop()
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1414
        if not hasattr(value, "variant_level"):
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1415
            return value
1416
        return type(value)(value, variant_level=value.variant_level+1)
874 by Teddy Hogeborn
PEP8 compliance: mandos
1417
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1418
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1419
    def Set(self, interface_name, property_name, value):
1420
        """Standard D-Bus property Set() method, see D-Bus standard.
1421
        """
1422
        prop = self._get_dbus_property(interface_name, property_name)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1423
        if prop._dbus_access == "read":
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1424
            raise DBusPropertyAccessException(property_name)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1425
        if prop._dbus_get_args_options["byte_arrays"]:
411 by Teddy Hogeborn
More consistent terminology: Clients are no longer "invalid" - they
1426
            # The byte_arrays option is not supported yet on
1427
            # signatures other than "ay".
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1428
            if prop._dbus_signature != "ay":
649 by Teddy Hogeborn
Minor code fix; raise only exception instances, not classes.
1429
                raise ValueError("Byte arrays not supported for non-"
723.1.5 by Teddy Hogeborn
Use the new auto-numbered "{}" syntax for the .format() string method.
1430
                                 "'ay' signature {!r}"
649 by Teddy Hogeborn
Minor code fix; raise only exception instances, not classes.
1431
                                 .format(prop._dbus_signature))
1190 by Teddy Hogeborn
Server: Fix bug when setting Secret property of clients via D-Bus
1432
            value = dbus.ByteArray(bytes(value))
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1433
        prop(value)
874 by Teddy Hogeborn
PEP8 compliance: mandos
1434
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1435
    @dbus.service.method(dbus.PROPERTIES_IFACE,
1436
                         in_signature="s",
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1437
                         out_signature="a{sv}")
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1438
    def GetAll(self, interface_name):
1439
        """Standard D-Bus property GetAll() method, see D-Bus
1440
        standard.
874 by Teddy Hogeborn
PEP8 compliance: mandos
1441
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1442
        Note: Will not include properties with access="write".
1443
        """
518.1.5 by Björn Påhlsson
First run of python-lint. Fixed some *obviously* bad code and turned
1444
        properties = {}
560.1.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
1445
        for name, prop in self._get_all_dbus_things("property"):
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1446
            if (interface_name
1447
                and interface_name != prop._dbus_interface):
1448
                # Interface non-empty but did not match
1449
                continue
1450
            # Ignore write-only properties
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1451
            if prop._dbus_access == "write":
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1452
                continue
1453
            value = prop()
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1454
            if not hasattr(value, "variant_level"):
518.1.5 by Björn Påhlsson
First run of python-lint. Fixed some *obviously* bad code and turned
1455
                properties[name] = value
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1456
                continue
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1457
            properties[name] = type(value)(
874 by Teddy Hogeborn
PEP8 compliance: mandos
1458
                value, variant_level=value.variant_level + 1)
518.1.5 by Björn Påhlsson
First run of python-lint. Fixed some *obviously* bad code and turned
1459
        return dbus.Dictionary(properties, signature="sv")
874 by Teddy Hogeborn
PEP8 compliance: mandos
1460
732 by Teddy Hogeborn
Emit D-Bus "org.freedesktop.DBus.Properties.PropertiesChanged" signal.
1461
    @dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")
1462
    def PropertiesChanged(self, interface_name, changed_properties,
1463
                          invalidated_properties):
1464
        """Standard D-Bus PropertiesChanged() signal, see D-Bus
1465
        standard.
1466
        """
1467
        pass
874 by Teddy Hogeborn
PEP8 compliance: mandos
1468
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1469
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1470
                         out_signature="s",
1471
                         path_keyword='object_path',
1472
                         connection_keyword='connection')
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1473
    def Introspect(self, object_path, connection):
560.1.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
1474
        """Overloading of standard D-Bus method.
874 by Teddy Hogeborn
PEP8 compliance: mandos
1475
560.1.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
1476
        Inserts property tags and interface annotation tags.
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1477
        """
784 by Teddy Hogeborn
Refactor D-Bus annotation class out from D-Bus properties class.
1478
        xmlstring = DBusObjectWithAnnotations.Introspect(self,
1479
                                                         object_path,
1480
                                                         connection)
387 by Teddy Hogeborn
* mandos (ClientDBus.ReceivedSecret): Renamed to "GotSecret". All
1481
        try:
1482
            document = xml.dom.minidom.parseString(xmlstring)
874 by Teddy Hogeborn
PEP8 compliance: mandos
1483
387 by Teddy Hogeborn
* mandos (ClientDBus.ReceivedSecret): Renamed to "GotSecret". All
1484
            def make_tag(document, name, prop):
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1485
                e = document.createElement("property")
1486
                e.setAttribute("name", name)
1487
                e.setAttribute("type", prop._dbus_signature)
1488
                e.setAttribute("access", prop._dbus_access)
387 by Teddy Hogeborn
* mandos (ClientDBus.ReceivedSecret): Renamed to "GotSecret". All
1489
                return e
874 by Teddy Hogeborn
PEP8 compliance: mandos
1490
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1491
            for if_tag in document.getElementsByTagName("interface"):
560.1.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
1492
                # Add property tags
387 by Teddy Hogeborn
* mandos (ClientDBus.ReceivedSecret): Renamed to "GotSecret". All
1493
                for tag in (make_tag(document, name, prop)
1494
                            for name, prop
560.1.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
1495
                            in self._get_all_dbus_things("property")
387 by Teddy Hogeborn
* mandos (ClientDBus.ReceivedSecret): Renamed to "GotSecret". All
1496
                            if prop._dbus_interface
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1497
                            == if_tag.getAttribute("name")):
387 by Teddy Hogeborn
* mandos (ClientDBus.ReceivedSecret): Renamed to "GotSecret". All
1498
                    if_tag.appendChild(tag)
784 by Teddy Hogeborn
Refactor D-Bus annotation class out from D-Bus properties class.
1499
                # Add annotation tags for properties
1500
                for tag in if_tag.getElementsByTagName("property"):
1501
                    annots = dict()
1502
                    for name, prop in self._get_all_dbus_things(
1503
                            "property"):
1504
                        if (name == tag.getAttribute("name")
1505
                            and prop._dbus_interface
1506
                            == if_tag.getAttribute("name")):
1507
                            annots.update(getattr(
1508
                                prop, "_dbus_annotations", {}))
1509
                    for name, value in annots.items():
1510
                        ann_tag = document.createElement(
1511
                            "annotation")
1512
                        ann_tag.setAttribute("name", name)
1513
                        ann_tag.setAttribute("value", value)
1514
                        tag.appendChild(ann_tag)
387 by Teddy Hogeborn
* mandos (ClientDBus.ReceivedSecret): Renamed to "GotSecret". All
1515
                # Add the names to the return values for the
1516
                # "org.freedesktop.DBus.Properties" methods
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1517
                if (if_tag.getAttribute("name")
1518
                    == "org.freedesktop.DBus.Properties"):
1519
                    for cn in if_tag.getElementsByTagName("method"):
1520
                        if cn.getAttribute("name") == "Get":
1521
                            for arg in cn.getElementsByTagName("arg"):
1522
                                if (arg.getAttribute("direction")
1523
                                    == "out"):
1524
                                    arg.setAttribute("name", "value")
1525
                        elif cn.getAttribute("name") == "GetAll":
1526
                            for arg in cn.getElementsByTagName("arg"):
1527
                                if (arg.getAttribute("direction")
1528
                                    == "out"):
1529
                                    arg.setAttribute("name", "props")
1530
            xmlstring = document.toxml("utf-8")
387 by Teddy Hogeborn
* mandos (ClientDBus.ReceivedSecret): Renamed to "GotSecret". All
1531
            document.unlink()
1532
        except (AttributeError, xml.dom.DOMException,
482 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
1533
                xml.parsers.expat.ExpatError) as error:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1534
            logger.error("Failed to override Introspection method",
565 by Teddy Hogeborn
* mandos (AvahiService.rename, Client.start_checker,
1535
                         exc_info=error)
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1536
        return xmlstring
1537
888 by Teddy Hogeborn
Add more PEP8 compliance (as per the "pycodestyle" tool).
1538
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
1539
try:
1540
    dbus.OBJECT_MANAGER_IFACE
1541
except AttributeError:
1542
    dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
1543
874 by Teddy Hogeborn
PEP8 compliance: mandos
1544
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
1545
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
1546
    """A D-Bus object with an ObjectManager.
874 by Teddy Hogeborn
PEP8 compliance: mandos
1547
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
1548
    Classes inheriting from this exposes the standard
1549
    GetManagedObjects call and the InterfacesAdded and
1550
    InterfacesRemoved signals on the standard
1551
    "org.freedesktop.DBus.ObjectManager" interface.
874 by Teddy Hogeborn
PEP8 compliance: mandos
1552
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
1553
    Note: No signals are sent automatically; they must be sent
1554
    manually.
1555
    """
1556
    @dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
874 by Teddy Hogeborn
PEP8 compliance: mandos
1557
                         out_signature="a{oa{sa{sv}}}")
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
1558
    def GetManagedObjects(self):
1559
        """This function must be overridden"""
1560
        raise NotImplementedError()
874 by Teddy Hogeborn
PEP8 compliance: mandos
1561
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
1562
    @dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
874 by Teddy Hogeborn
PEP8 compliance: mandos
1563
                         signature="oa{sa{sv}}")
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
1564
    def InterfacesAdded(self, object_path, interfaces_and_properties):
1565
        pass
874 by Teddy Hogeborn
PEP8 compliance: mandos
1566
1567
    @dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature="oas")
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
1568
    def InterfacesRemoved(self, object_path, interfaces):
1569
        pass
874 by Teddy Hogeborn
PEP8 compliance: mandos
1570
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
1571
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
874 by Teddy Hogeborn
PEP8 compliance: mandos
1572
                         out_signature="s",
1573
                         path_keyword='object_path',
1574
                         connection_keyword='connection')
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
1575
    def Introspect(self, object_path, connection):
1576
        """Overloading of standard D-Bus method.
874 by Teddy Hogeborn
PEP8 compliance: mandos
1577
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
1578
        Override return argument name of GetManagedObjects to be
1579
        "objpath_interfaces_and_properties"
1580
        """
786 by Teddy Hogeborn
Server Bug fix: Make D-Bus introspection work again.
1581
        xmlstring = DBusObjectWithAnnotations.Introspect(self,
1582
                                                         object_path,
1583
                                                         connection)
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
1584
        try:
1585
            document = xml.dom.minidom.parseString(xmlstring)
874 by Teddy Hogeborn
PEP8 compliance: mandos
1586
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
1587
            for if_tag in document.getElementsByTagName("interface"):
1588
                # Fix argument name for the GetManagedObjects method
1589
                if (if_tag.getAttribute("name")
874 by Teddy Hogeborn
PEP8 compliance: mandos
1590
                    == dbus.OBJECT_MANAGER_IFACE):
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
1591
                    for cn in if_tag.getElementsByTagName("method"):
1592
                        if (cn.getAttribute("name")
1593
                            == "GetManagedObjects"):
1594
                            for arg in cn.getElementsByTagName("arg"):
1595
                                if (arg.getAttribute("direction")
1596
                                    == "out"):
1597
                                    arg.setAttribute(
1598
                                        "name",
1599
                                        "objpath_interfaces"
1600
                                        "_and_properties")
1601
            xmlstring = document.toxml("utf-8")
1602
            document.unlink()
1603
        except (AttributeError, xml.dom.DOMException,
1604
                xml.parsers.expat.ExpatError) as error:
1605
            logger.error("Failed to override Introspection method",
874 by Teddy Hogeborn
PEP8 compliance: mandos
1606
                         exc_info=error)
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
1607
        return xmlstring
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1608
874 by Teddy Hogeborn
PEP8 compliance: mandos
1609
587 by Teddy Hogeborn
* Makefile (DOCBOOKTOMAN): Only run man --warnings if both "man" and
1610
def datetime_to_dbus(dt, variant_level=0):
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1611
    """Convert a UTC datetime.datetime() to a D-Bus type."""
1612
    if dt is None:
874 by Teddy Hogeborn
PEP8 compliance: mandos
1613
        return dbus.String("", variant_level=variant_level)
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1614
    return dbus.String(dt.isoformat(), variant_level=variant_level)
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1615
518.1.6 by Teddy Hogeborn
* mandos: Fix whitespace.
1616
575 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1617
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
1618
    """A class decorator; applied to a subclass of
1619
    dbus.service.Object, it will add alternate D-Bus attributes with
1620
    interface names according to the "alt_interface_names" mapping.
1621
    Usage:
874 by Teddy Hogeborn
PEP8 compliance: mandos
1622
587 by Teddy Hogeborn
* Makefile (DOCBOOKTOMAN): Only run man --warnings if both "man" and
1623
    @alternate_dbus_interfaces({"org.example.Interface":
1624
                                    "net.example.AlternateInterface"})
575 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1625
    class SampleDBusObject(dbus.service.Object):
1626
        @dbus.service.method("org.example.Interface")
1627
        def SampleDBusMethod():
1628
            pass
874 by Teddy Hogeborn
PEP8 compliance: mandos
1629
575 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1630
    The above "SampleDBusMethod" on "SampleDBusObject" will be
1631
    reachable via two interfaces: "org.example.Interface" and
1632
    "net.example.AlternateInterface", the latter of which will have
1633
    its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
1634
    "true", unless "deprecate" is passed with a False value.
874 by Teddy Hogeborn
PEP8 compliance: mandos
1635
575 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1636
    This works for methods and signals, and also for D-Bus properties
1637
    (from DBusObjectWithProperties) and interfaces (from the
1638
    dbus_interface_annotations decorator).
505.1.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1639
    """
874 by Teddy Hogeborn
PEP8 compliance: mandos
1640
575 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1641
    def wrapper(cls):
1642
        for orig_interface_name, alt_interface_name in (
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1643
                alt_interface_names.items()):
575 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1644
            attr = {}
1645
            interface_names = set()
1646
            # Go though all attributes of the class
1647
            for attrname, attribute in inspect.getmembers(cls):
505.1.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1648
                # Ignore non-D-Bus attributes, and D-Bus attributes
1649
                # with the wrong interface name
1650
                if (not hasattr(attribute, "_dbus_interface")
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1651
                    or not attribute._dbus_interface.startswith(
1652
                        orig_interface_name)):
505.1.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1653
                    continue
1654
                # Create an alternate D-Bus interface name based on
1655
                # the current name
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1656
                alt_interface = attribute._dbus_interface.replace(
1657
                    orig_interface_name, alt_interface_name)
575 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1658
                interface_names.add(alt_interface)
505.1.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1659
                # Is this a D-Bus signal?
1660
                if getattr(attribute, "_dbus_is_signal", False):
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
1661
                    # Extract the original non-method undecorated
1662
                    # function by black magic
756 by Teddy Hogeborn
Merge change to use multiprocessing module to run checkers.
1663
                    if sys.version_info.major == 2:
754 by Teddy Hogeborn
mandos: More Python 3 fixes.
1664
                        nonmethod_func = (dict(
1665
                            zip(attribute.func_code.co_freevars,
1666
                                attribute.__closure__))
1667
                                          ["func"].cell_contents)
1668
                    else:
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
1669
                        nonmethod_func = (dict(
1670
                            zip(attribute.__code__.co_freevars,
1671
                                attribute.__closure__))
1672
                                          ["func"].cell_contents)
505.1.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1673
                    # Create a new, but exactly alike, function
1674
                    # object, and decorate it to be a new D-Bus signal
1675
                    # with the alternate D-Bus interface name
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
1676
                    new_function = copy_function(nonmethod_func)
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1677
                    new_function = (dbus.service.signal(
754 by Teddy Hogeborn
mandos: More Python 3 fixes.
1678
                        alt_interface,
1679
                        attribute._dbus_signature)(new_function))
561.1.1 by Teddy Hogeborn
Add D-Bus annotations support to methods, signals and properties.
1680
                    # Copy annotations, if any
1681
                    try:
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1682
                        new_function._dbus_annotations = dict(
1683
                            attribute._dbus_annotations)
561.1.1 by Teddy Hogeborn
Add D-Bus annotations support to methods, signals and properties.
1684
                    except AttributeError:
1685
                        pass
874 by Teddy Hogeborn
PEP8 compliance: mandos
1686
505.1.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1687
                    # Define a creator of a function to call both the
575 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1688
                    # original and alternate functions, so both the
1689
                    # original and alternate signals gets sent when
1690
                    # the function is called
505.1.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1691
                    def fixscope(func1, func2):
1692
                        """This function is a scope container to pass
1693
                        func1 and func2 to the "call_both" function
1694
                        outside of its arguments"""
874 by Teddy Hogeborn
PEP8 compliance: mandos
1695
786 by Teddy Hogeborn
Server Bug fix: Make D-Bus introspection work again.
1696
                        @functools.wraps(func2)
505.1.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1697
                        def call_both(*args, **kwargs):
1698
                            """This function will emit two D-Bus
1699
                            signals by calling func1 and func2"""
1700
                            func1(*args, **kwargs)
1701
                            func2(*args, **kwargs)
874 by Teddy Hogeborn
PEP8 compliance: mandos
1702
                        # Make wrapper function look like a D-Bus
1703
                        # signal
786 by Teddy Hogeborn
Server Bug fix: Make D-Bus introspection work again.
1704
                        for name, attr in inspect.getmembers(func2):
1705
                            if name.startswith("_dbus_"):
1706
                                setattr(call_both, name, attr)
874 by Teddy Hogeborn
PEP8 compliance: mandos
1707
505.1.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1708
                        return call_both
1709
                    # Create the "call_both" function and add it to
1710
                    # the class
575 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1711
                    attr[attrname] = fixscope(attribute, new_function)
505.1.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1712
                # Is this a D-Bus method?
1713
                elif getattr(attribute, "_dbus_is_method", False):
1714
                    # Create a new, but exactly alike, function
1715
                    # object.  Decorate it to be a new D-Bus method
1716
                    # with the alternate D-Bus interface name.  Add it
1717
                    # to the class.
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1718
                    attr[attrname] = (
1719
                        dbus.service.method(
1720
                            alt_interface,
1721
                            attribute._dbus_in_signature,
1722
                            attribute._dbus_out_signature)
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
1723
                        (copy_function(attribute)))
561.1.1 by Teddy Hogeborn
Add D-Bus annotations support to methods, signals and properties.
1724
                    # Copy annotations, if any
1725
                    try:
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1726
                        attr[attrname]._dbus_annotations = dict(
1727
                            attribute._dbus_annotations)
561.1.1 by Teddy Hogeborn
Add D-Bus annotations support to methods, signals and properties.
1728
                    except AttributeError:
1729
                        pass
505.1.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1730
                # Is this a D-Bus property?
1731
                elif getattr(attribute, "_dbus_is_property", False):
1732
                    # Create a new, but exactly alike, function
1733
                    # object, and decorate it to be a new D-Bus
1734
                    # property with the alternate D-Bus interface
1735
                    # name.  Add it to the class.
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1736
                    attr[attrname] = (dbus_service_property(
1737
                        alt_interface, attribute._dbus_signature,
1738
                        attribute._dbus_access,
1739
                        attribute._dbus_get_args_options
1740
                        ["byte_arrays"])
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
1741
                                      (copy_function(attribute)))
561.1.1 by Teddy Hogeborn
Add D-Bus annotations support to methods, signals and properties.
1742
                    # Copy annotations, if any
1743
                    try:
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1744
                        attr[attrname]._dbus_annotations = dict(
1745
                            attribute._dbus_annotations)
561.1.1 by Teddy Hogeborn
Add D-Bus annotations support to methods, signals and properties.
1746
                    except AttributeError:
1747
                        pass
560.1.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
1748
                # Is this a D-Bus interface?
1749
                elif getattr(attribute, "_dbus_is_interface", False):
1750
                    # Create a new, but exactly alike, function
1751
                    # object.  Decorate it to be a new D-Bus interface
1752
                    # with the alternate D-Bus interface name.  Add it
1753
                    # to the class.
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1754
                    attr[attrname] = (
1755
                        dbus_interface_annotations(alt_interface)
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
1756
                        (copy_function(attribute)))
575 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1757
            if deprecate:
1758
                # Deprecate all alternate interfaces
874 by Teddy Hogeborn
PEP8 compliance: mandos
1759
                iname = "_AlternateDBusNames_interface_annotation{}"
575 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1760
                for interface_name in interface_names:
874 by Teddy Hogeborn
PEP8 compliance: mandos
1761
575 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1762
                    @dbus_interface_annotations(interface_name)
1763
                    def func(self):
874 by Teddy Hogeborn
PEP8 compliance: mandos
1764
                        return {"org.freedesktop.DBus.Deprecated":
1765
                                "true"}
575 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1766
                    # Find an unused name
1767
                    for aname in (iname.format(i)
1768
                                  for i in itertools.count()):
1769
                        if aname not in attr:
1770
                            attr[aname] = func
1771
                            break
1772
            if interface_names:
1773
                # Replace the class with a new subclass of it with
1774
                # methods, signals, etc. as created above.
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
1775
                if sys.version_info.major == 2:
1776
                    cls = type(b"{}Alternate".format(cls.__name__),
1777
                               (cls, ), attr)
1778
                else:
1779
                    cls = type("{}Alternate".format(cls.__name__),
1780
                               (cls, ), attr)
575 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1781
        return cls
874 by Teddy Hogeborn
PEP8 compliance: mandos
1782
575 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1783
    return wrapper
1784
1785
1786
@alternate_dbus_interfaces({"se.recompile.Mandos":
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1787
                            "se.bsnet.fukt.Mandos"})
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1788
class ClientDBus(Client, DBusObjectWithProperties):
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1789
    """A Client class using D-Bus
874 by Teddy Hogeborn
PEP8 compliance: mandos
1790
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1791
    Attributes:
338 by Teddy Hogeborn
* mandos: Minor doc string fixes.
1792
    dbus_object_path: dbus.ObjectPath
1793
    bus: dbus.SystemBus()
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1794
    """
874 by Teddy Hogeborn
PEP8 compliance: mandos
1795
438 by Teddy Hogeborn
* mandos (Client.runtime_expansions): New attribute containing the
1796
    runtime_expansions = (Client.runtime_expansions
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1797
                          + ("dbus_object_path", ))
874 by Teddy Hogeborn
PEP8 compliance: mandos
1798
732 by Teddy Hogeborn
Emit D-Bus "org.freedesktop.DBus.Properties.PropertiesChanged" signal.
1799
    _interface = "se.recompile.Mandos.Client"
874 by Teddy Hogeborn
PEP8 compliance: mandos
1800
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1801
    # dbus.service.Object doesn't use super(), so we can't either.
874 by Teddy Hogeborn
PEP8 compliance: mandos
1802
1803
    def __init__(self, bus=None, *args, **kwargs):
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
1804
        self.bus = bus
1805
        Client.__init__(self, *args, **kwargs)
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1806
        # Only now, when this client is initialized, can it show up on
1807
        # the D-Bus
730 by Teddy Hogeborn
mandos: Replace unicode() with str().
1808
        client_object_name = str(self.name).translate(
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1809
            {ord("."): ord("_"),
1810
             ord("-"): ord("_")})
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1811
        self.dbus_object_path = dbus.ObjectPath(
1812
            "/clients/" + client_object_name)
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1813
        DBusObjectWithProperties.__init__(self, self.bus,
1814
                                          self.dbus_object_path)
874 by Teddy Hogeborn
PEP8 compliance: mandos
1815
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1816
    def notifychangeproperty(transform_func, dbus_name,
1817
                             type_func=lambda x: x,
1818
                             variant_level=1,
1819
                             invalidate_only=False,
732 by Teddy Hogeborn
Emit D-Bus "org.freedesktop.DBus.Properties.PropertiesChanged" signal.
1820
                             _interface=_interface):
505.1.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1821
        """ Modify a variable so that it's a property which announces
1822
        its changes to DBus.
874 by Teddy Hogeborn
PEP8 compliance: mandos
1823
505.1.15 by Teddy Hogeborn
Bug fix: Make D-Bus properties settable again.
1824
        transform_fun: Function that takes a value and a variant_level
1825
                       and transforms it to a D-Bus type.
505.1.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1826
        dbus_name: D-Bus name of the variable
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1827
        type_func: Function that transform the value before sending it
505.1.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1828
                   to the D-Bus.  Default: no transform
1829
        variant_level: D-Bus variant level.  Default: 1
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1830
        """
723.1.5 by Teddy Hogeborn
Use the new auto-numbered "{}" syntax for the .format() string method.
1831
        attrname = "_{}".format(dbus_name)
874 by Teddy Hogeborn
PEP8 compliance: mandos
1832
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1833
        def setter(self, value):
1834
            if hasattr(self, "dbus_object_path"):
505.1.6 by Teddy Hogeborn
* mandos (ClientDBus.notifychangeproperty): Bug fix: Use instance
1835
                if (not hasattr(self, attrname) or
1836
                    type_func(getattr(self, attrname, None))
1837
                    != type_func(value)):
732 by Teddy Hogeborn
Emit D-Bus "org.freedesktop.DBus.Properties.PropertiesChanged" signal.
1838
                    if invalidate_only:
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1839
                        self.PropertiesChanged(
1840
                            _interface, dbus.Dictionary(),
1841
                            dbus.Array((dbus_name, )))
732 by Teddy Hogeborn
Emit D-Bus "org.freedesktop.DBus.Properties.PropertiesChanged" signal.
1842
                    else:
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1843
                        dbus_value = transform_func(
1844
                            type_func(value),
874 by Teddy Hogeborn
PEP8 compliance: mandos
1845
                            variant_level=variant_level)
732 by Teddy Hogeborn
Emit D-Bus "org.freedesktop.DBus.Properties.PropertiesChanged" signal.
1846
                        self.PropertyChanged(dbus.String(dbus_name),
1847
                                             dbus_value)
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1848
                        self.PropertiesChanged(
1849
                            _interface,
874 by Teddy Hogeborn
PEP8 compliance: mandos
1850
                            dbus.Dictionary({dbus.String(dbus_name):
1851
                                             dbus_value}),
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1852
                            dbus.Array())
505.1.6 by Teddy Hogeborn
* mandos (ClientDBus.notifychangeproperty): Bug fix: Use instance
1853
            setattr(self, attrname, value)
874 by Teddy Hogeborn
PEP8 compliance: mandos
1854
505.1.6 by Teddy Hogeborn
* mandos (ClientDBus.notifychangeproperty): Bug fix: Use instance
1855
        return property(lambda self: getattr(self, attrname), setter)
874 by Teddy Hogeborn
PEP8 compliance: mandos
1856
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1857
    expires = notifychangeproperty(datetime_to_dbus, "Expires")
1858
    approvals_pending = notifychangeproperty(dbus.Boolean,
1859
                                             "ApprovalPending",
874 by Teddy Hogeborn
PEP8 compliance: mandos
1860
                                             type_func=bool)
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1861
    enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1862
    last_enabled = notifychangeproperty(datetime_to_dbus,
1863
                                        "LastEnabled")
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1864
    checker = notifychangeproperty(
1865
        dbus.Boolean, "CheckerRunning",
874 by Teddy Hogeborn
PEP8 compliance: mandos
1866
        type_func=lambda checker: checker is not None)
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1867
    last_checked_ok = notifychangeproperty(datetime_to_dbus,
1868
                                           "LastCheckedOK")
556 by Teddy Hogeborn
* DBUS-API (se.recompile.Mandos.Client.LastCheckerStatus): New
1869
    last_checker_status = notifychangeproperty(dbus.Int16,
1870
                                               "LastCheckerStatus")
505.1.3 by Teddy Hogeborn
* mandos: Break long lines.
1871
    last_approval_request = notifychangeproperty(
1872
        datetime_to_dbus, "LastApprovalRequest")
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1873
    approved_by_default = notifychangeproperty(dbus.Boolean,
1874
                                               "ApprovedByDefault")
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1875
    approval_delay = notifychangeproperty(
1876
        dbus.UInt64, "ApprovalDelay",
874 by Teddy Hogeborn
PEP8 compliance: mandos
1877
        type_func=lambda td: td.total_seconds() * 1000)
505.1.3 by Teddy Hogeborn
* mandos: Break long lines.
1878
    approval_duration = notifychangeproperty(
518.2.9 by Teddy Hogeborn
* mandos (ClientDBus.approval_delay, ClientDBus.approval_duration,
1879
        dbus.UInt64, "ApprovalDuration",
874 by Teddy Hogeborn
PEP8 compliance: mandos
1880
        type_func=lambda td: td.total_seconds() * 1000)
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1881
    host = notifychangeproperty(dbus.String, "Host")
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1882
    timeout = notifychangeproperty(
1883
        dbus.UInt64, "Timeout",
874 by Teddy Hogeborn
PEP8 compliance: mandos
1884
        type_func=lambda td: td.total_seconds() * 1000)
505.1.3 by Teddy Hogeborn
* mandos: Break long lines.
1885
    extended_timeout = notifychangeproperty(
518.2.9 by Teddy Hogeborn
* mandos (ClientDBus.approval_delay, ClientDBus.approval_duration,
1886
        dbus.UInt64, "ExtendedTimeout",
874 by Teddy Hogeborn
PEP8 compliance: mandos
1887
        type_func=lambda td: td.total_seconds() * 1000)
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1888
    interval = notifychangeproperty(
1889
        dbus.UInt64, "Interval",
874 by Teddy Hogeborn
PEP8 compliance: mandos
1890
        type_func=lambda td: td.total_seconds() * 1000)
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1891
    checker_command = notifychangeproperty(dbus.String, "Checker")
732 by Teddy Hogeborn
Emit D-Bus "org.freedesktop.DBus.Properties.PropertiesChanged" signal.
1892
    secret = notifychangeproperty(dbus.ByteArray, "Secret",
1893
                                  invalidate_only=True)
874 by Teddy Hogeborn
PEP8 compliance: mandos
1894
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1895
    del notifychangeproperty
874 by Teddy Hogeborn
PEP8 compliance: mandos
1896
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1897
    def __del__(self, *args, **kwargs):
1898
        try:
1899
            self.remove_from_connection()
329 by Teddy Hogeborn
* mandos (ClientDBus.__del__): Bug fix: Correct mispasted code, and do
1900
        except LookupError:
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1901
            pass
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1902
        if hasattr(DBusObjectWithProperties, "__del__"):
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1903
            DBusObjectWithProperties.__del__(self, *args, **kwargs)
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1904
        Client.__del__(self, *args, **kwargs)
874 by Teddy Hogeborn
PEP8 compliance: mandos
1905
749.1.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
1906
    def checker_callback(self, source, condition,
756 by Teddy Hogeborn
Merge change to use multiprocessing module to run checkers.
1907
                         connection, command, *args, **kwargs):
749.1.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
1908
        ret = Client.checker_callback(self, source, condition,
756 by Teddy Hogeborn
Merge change to use multiprocessing module to run checkers.
1909
                                      connection, command, *args,
749.1.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
1910
                                      **kwargs)
1911
        exitstatus = self.last_checker_status
1912
        if exitstatus >= 0:
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1913
            # Emit D-Bus signal
1914
            self.CheckerCompleted(dbus.Int16(exitstatus),
783 by Teddy Hogeborn
Revert change to D-Bus API.
1915
                                  # This is specific to GNU libC
1916
                                  dbus.Int64(exitstatus << 8),
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1917
                                  dbus.String(command))
1918
        else:
1919
            # Emit D-Bus signal
1920
            self.CheckerCompleted(dbus.Int16(-1),
749.1.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
1921
                                  dbus.Int64(
783 by Teddy Hogeborn
Revert change to D-Bus API.
1922
                                      # This is specific to GNU libC
1923
                                      (exitstatus << 8)
1924
                                      | self.last_checker_signal),
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1925
                                  dbus.String(command))
749.1.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
1926
        return ret
874 by Teddy Hogeborn
PEP8 compliance: mandos
1927
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1928
    def start_checker(self, *args, **kwargs):
658 by Teddy Hogeborn
* mandos (ClientDBus.start_checker): Removed unused variable
1929
        old_checker_pid = getattr(self.checker, "pid", None)
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1930
        r = Client.start_checker(self, *args, **kwargs)
329 by Teddy Hogeborn
* mandos (ClientDBus.__del__): Bug fix: Correct mispasted code, and do
1931
        # Only if new checker process was started
1932
        if (self.checker is not None
1933
            and old_checker_pid != self.checker.pid):
1934
            # Emit D-Bus signal
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1935
            self.CheckerStarted(self.current_checker_command)
1936
        return r
874 by Teddy Hogeborn
PEP8 compliance: mandos
1937
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1938
    def _reset_approved(self):
518.2.4 by Teddy Hogeborn
* mandos (_timedelta_to_milliseconds): Renamed to
1939
        self.approved = None
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1940
        return False
874 by Teddy Hogeborn
PEP8 compliance: mandos
1941
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1942
    def approve(self, value=True):
518.2.4 by Teddy Hogeborn
* mandos (_timedelta_to_milliseconds): Renamed to
1943
        self.approved = value
830 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
1944
        GLib.timeout_add(int(self.approval_duration.total_seconds()
1945
                             * 1000), self._reset_approved)
581 by Teddy Hogeborn
* mandos (Client.enable, Client.disable, ClientDBus.approve): Call
1946
        self.send_changedstate()
874 by Teddy Hogeborn
PEP8 compliance: mandos
1947
1948
    #  D-Bus methods, signals & properties
1949
1950
    #  Interfaces
1951
1952
    #  Signals
1953
237.1.2 by Teddy Hogeborn
Further steps towards a D-Bus server interface, plus minor syntax
1954
    # CheckerCompleted - signal
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1955
    @dbus.service.signal(_interface, signature="nxs")
280 by Teddy Hogeborn
* mandos (Client.CheckerCompleted): Changed signature to "nxs"; return
1956
    def CheckerCompleted(self, exitcode, waitstatus, command):
237.1.2 by Teddy Hogeborn
Further steps towards a D-Bus server interface, plus minor syntax
1957
        "D-Bus signal"
1958
        pass
874 by Teddy Hogeborn
PEP8 compliance: mandos
1959
237.1.2 by Teddy Hogeborn
Further steps towards a D-Bus server interface, plus minor syntax
1960
    # CheckerStarted - signal
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1961
    @dbus.service.signal(_interface, signature="s")
237.1.2 by Teddy Hogeborn
Further steps towards a D-Bus server interface, plus minor syntax
1962
    def CheckerStarted(self, command):
1963
        "D-Bus signal"
1964
        pass
874 by Teddy Hogeborn
PEP8 compliance: mandos
1965
238 by Teddy Hogeborn
First version of a somewhat complete D-Bus server interface. Also
1966
    # PropertyChanged - signal
732 by Teddy Hogeborn
Emit D-Bus "org.freedesktop.DBus.Properties.PropertiesChanged" signal.
1967
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1968
    @dbus.service.signal(_interface, signature="sv")
238 by Teddy Hogeborn
First version of a somewhat complete D-Bus server interface. Also
1969
    def PropertyChanged(self, property, value):
1970
        "D-Bus signal"
1971
        pass
874 by Teddy Hogeborn
PEP8 compliance: mandos
1972
387 by Teddy Hogeborn
* mandos (ClientDBus.ReceivedSecret): Renamed to "GotSecret". All
1973
    # GotSecret - signal
327 by Teddy Hogeborn
Merge from pipe IPC branch.
1974
    @dbus.service.signal(_interface)
387 by Teddy Hogeborn
* mandos (ClientDBus.ReceivedSecret): Renamed to "GotSecret". All
1975
    def GotSecret(self):
24.1.155 by Björn Påhlsson
mandos server: Added debuglevel that adjust at what level information
1976
        """D-Bus signal
1977
        Is sent after a successful transfer of secret from the Mandos
1978
        server to mandos-client
1979
        """
24.2.4 by teddy at bsnet
* mandos (ClientDBus.approvals_pending): Changed to be a property
1980
        pass
874 by Teddy Hogeborn
PEP8 compliance: mandos
1981
327 by Teddy Hogeborn
Merge from pipe IPC branch.
1982
    # Rejected - signal
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1983
    @dbus.service.signal(_interface, signature="s")
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1984
    def Rejected(self, reason):
1985
        "D-Bus signal"
24.2.4 by teddy at bsnet
* mandos (ClientDBus.approvals_pending): Changed to be a property
1986
        pass
874 by Teddy Hogeborn
PEP8 compliance: mandos
1987
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1988
    # NeedApproval - signal
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1989
    @dbus.service.signal(_interface, signature="tb")
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1990
    def NeedApproval(self, timeout, default):
327 by Teddy Hogeborn
Merge from pipe IPC branch.
1991
        "D-Bus signal"
442 by Teddy Hogeborn
* DBUS-API: Document new "LastApprovalRequest" client property.
1992
        return self.need_approval()
874 by Teddy Hogeborn
PEP8 compliance: mandos
1993
1994
    #  Methods
1995
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1996
    # Approve - method
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1997
    @dbus.service.method(_interface, in_signature="b")
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1998
    def Approve(self, value):
1999
        self.approve(value)
874 by Teddy Hogeborn
PEP8 compliance: mandos
2000
24.1.147 by Björn Påhlsson
The IPC pipes are now file objects, not file descriptors:
2001
    # CheckedOK - method
2002
    @dbus.service.method(_interface)
2003
    def CheckedOK(self):
482 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
2004
        self.checked_ok()
874 by Teddy Hogeborn
PEP8 compliance: mandos
2005
381 by Teddy Hogeborn
Restore some poor D-Bus methods who got a bit hastily deleted. Enable
2006
    # Enable - method
781 by Teddy Hogeborn
Deprecate some D-Bus methods in favor of D-Bus properties.
2007
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
381 by Teddy Hogeborn
Restore some poor D-Bus methods who got a bit hastily deleted. Enable
2008
    @dbus.service.method(_interface)
2009
    def Enable(self):
2010
        "D-Bus method"
2011
        self.enable()
874 by Teddy Hogeborn
PEP8 compliance: mandos
2012
381 by Teddy Hogeborn
Restore some poor D-Bus methods who got a bit hastily deleted. Enable
2013
    # StartChecker - method
781 by Teddy Hogeborn
Deprecate some D-Bus methods in favor of D-Bus properties.
2014
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
381 by Teddy Hogeborn
Restore some poor D-Bus methods who got a bit hastily deleted. Enable
2015
    @dbus.service.method(_interface)
2016
    def StartChecker(self):
2017
        "D-Bus method"
2018
        self.start_checker()
874 by Teddy Hogeborn
PEP8 compliance: mandos
2019
381 by Teddy Hogeborn
Restore some poor D-Bus methods who got a bit hastily deleted. Enable
2020
    # Disable - method
781 by Teddy Hogeborn
Deprecate some D-Bus methods in favor of D-Bus properties.
2021
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
381 by Teddy Hogeborn
Restore some poor D-Bus methods who got a bit hastily deleted. Enable
2022
    @dbus.service.method(_interface)
2023
    def Disable(self):
2024
        "D-Bus method"
2025
        self.disable()
874 by Teddy Hogeborn
PEP8 compliance: mandos
2026
381 by Teddy Hogeborn
Restore some poor D-Bus methods who got a bit hastily deleted. Enable
2027
    # StopChecker - method
781 by Teddy Hogeborn
Deprecate some D-Bus methods in favor of D-Bus properties.
2028
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
381 by Teddy Hogeborn
Restore some poor D-Bus methods who got a bit hastily deleted. Enable
2029
    @dbus.service.method(_interface)
2030
    def StopChecker(self):
2031
        self.stop_checker()
874 by Teddy Hogeborn
PEP8 compliance: mandos
2032
2033
    #  Properties
2034
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2035
    # ApprovalPending - property
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2036
    @dbus_service_property(_interface, signature="b", access="read")
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2037
    def ApprovalPending_dbus_property(self):
24.2.4 by teddy at bsnet
* mandos (ClientDBus.approvals_pending): Changed to be a property
2038
        return dbus.Boolean(bool(self.approvals_pending))
874 by Teddy Hogeborn
PEP8 compliance: mandos
2039
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2040
    # ApprovedByDefault - property
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2041
    @dbus_service_property(_interface,
2042
                           signature="b",
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2043
                           access="readwrite")
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2044
    def ApprovedByDefault_dbus_property(self, value=None):
2045
        if value is None:       # get
2046
            return dbus.Boolean(self.approved_by_default)
2047
        self.approved_by_default = bool(value)
874 by Teddy Hogeborn
PEP8 compliance: mandos
2048
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2049
    # ApprovalDelay - property
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2050
    @dbus_service_property(_interface,
2051
                           signature="t",
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2052
                           access="readwrite")
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2053
    def ApprovalDelay_dbus_property(self, value=None):
2054
        if value is None:       # get
723.1.6 by Teddy Hogeborn
Use the new .total_seconds() method on datetime.timedelta objects.
2055
            return dbus.UInt64(self.approval_delay.total_seconds()
2056
                               * 1000)
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2057
        self.approval_delay = datetime.timedelta(0, 0, 0, value)
874 by Teddy Hogeborn
PEP8 compliance: mandos
2058
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2059
    # ApprovalDuration - property
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2060
    @dbus_service_property(_interface,
2061
                           signature="t",
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2062
                           access="readwrite")
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2063
    def ApprovalDuration_dbus_property(self, value=None):
2064
        if value is None:       # get
723.1.6 by Teddy Hogeborn
Use the new .total_seconds() method on datetime.timedelta objects.
2065
            return dbus.UInt64(self.approval_duration.total_seconds()
2066
                               * 1000)
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2067
        self.approval_duration = datetime.timedelta(0, 0, 0, value)
874 by Teddy Hogeborn
PEP8 compliance: mandos
2068
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2069
    # Name - property
780 by Teddy Hogeborn
Add D-Bus annotations on a few properties on the Client object.
2070
    @dbus_annotations(
2071
        {"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2072
    @dbus_service_property(_interface, signature="s", access="read")
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2073
    def Name_dbus_property(self):
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
2074
        return dbus.String(self.name)
874 by Teddy Hogeborn
PEP8 compliance: mandos
2075
962 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
2076
    # KeyID - property
2077
    @dbus_annotations(
2078
        {"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2079
    @dbus_service_property(_interface, signature="s", access="read")
2080
    def KeyID_dbus_property(self):
2081
        return dbus.String(self.key_id)
2082
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2083
    # Fingerprint - property
780 by Teddy Hogeborn
Add D-Bus annotations on a few properties on the Client object.
2084
    @dbus_annotations(
2085
        {"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2086
    @dbus_service_property(_interface, signature="s", access="read")
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2087
    def Fingerprint_dbus_property(self):
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
2088
        return dbus.String(self.fingerprint)
874 by Teddy Hogeborn
PEP8 compliance: mandos
2089
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2090
    # Host - property
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2091
    @dbus_service_property(_interface,
2092
                           signature="s",
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2093
                           access="readwrite")
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2094
    def Host_dbus_property(self, value=None):
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
2095
        if value is None:       # get
2096
            return dbus.String(self.host)
730 by Teddy Hogeborn
mandos: Replace unicode() with str().
2097
        self.host = str(value)
874 by Teddy Hogeborn
PEP8 compliance: mandos
2098
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2099
    # Created - property
780 by Teddy Hogeborn
Add D-Bus annotations on a few properties on the Client object.
2100
    @dbus_annotations(
2101
        {"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2102
    @dbus_service_property(_interface, signature="s", access="read")
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2103
    def Created_dbus_property(self):
518.2.3 by Teddy Hogeborn
Make "enabled" a client config option.
2104
        return datetime_to_dbus(self.created)
874 by Teddy Hogeborn
PEP8 compliance: mandos
2105
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2106
    # LastEnabled - property
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2107
    @dbus_service_property(_interface, signature="s", access="read")
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2108
    def LastEnabled_dbus_property(self):
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
2109
        return datetime_to_dbus(self.last_enabled)
874 by Teddy Hogeborn
PEP8 compliance: mandos
2110
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2111
    # Enabled - property
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2112
    @dbus_service_property(_interface,
2113
                           signature="b",
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2114
                           access="readwrite")
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2115
    def Enabled_dbus_property(self, value=None):
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
2116
        if value is None:       # get
2117
            return dbus.Boolean(self.enabled)
2118
        if value:
2119
            self.enable()
2120
        else:
2121
            self.disable()
874 by Teddy Hogeborn
PEP8 compliance: mandos
2122
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2123
    # LastCheckedOK - property
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2124
    @dbus_service_property(_interface,
2125
                           signature="s",
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2126
                           access="readwrite")
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2127
    def LastCheckedOK_dbus_property(self, value=None):
381 by Teddy Hogeborn
Restore some poor D-Bus methods who got a bit hastily deleted. Enable
2128
        if value is not None:
2129
            self.checked_ok()
2130
            return
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
2131
        return datetime_to_dbus(self.last_checked_ok)
874 by Teddy Hogeborn
PEP8 compliance: mandos
2132
556 by Teddy Hogeborn
* DBUS-API (se.recompile.Mandos.Client.LastCheckerStatus): New
2133
    # LastCheckerStatus - property
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2134
    @dbus_service_property(_interface, signature="n", access="read")
556 by Teddy Hogeborn
* DBUS-API (se.recompile.Mandos.Client.LastCheckerStatus): New
2135
    def LastCheckerStatus_dbus_property(self):
2136
        return dbus.Int16(self.last_checker_status)
874 by Teddy Hogeborn
PEP8 compliance: mandos
2137
24.1.179 by Björn Påhlsson
New feature:
2138
    # Expires - property
2139
    @dbus_service_property(_interface, signature="s", access="read")
2140
    def Expires_dbus_property(self):
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
2141
        return datetime_to_dbus(self.expires)
874 by Teddy Hogeborn
PEP8 compliance: mandos
2142
442 by Teddy Hogeborn
* DBUS-API: Document new "LastApprovalRequest" client property.
2143
    # LastApprovalRequest - property
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2144
    @dbus_service_property(_interface, signature="s", access="read")
442 by Teddy Hogeborn
* DBUS-API: Document new "LastApprovalRequest" client property.
2145
    def LastApprovalRequest_dbus_property(self):
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
2146
        return datetime_to_dbus(self.last_approval_request)
874 by Teddy Hogeborn
PEP8 compliance: mandos
2147
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2148
    # Timeout - property
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2149
    @dbus_service_property(_interface,
2150
                           signature="t",
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2151
                           access="readwrite")
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2152
    def Timeout_dbus_property(self, value=None):
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
2153
        if value is None:       # get
723.1.6 by Teddy Hogeborn
Use the new .total_seconds() method on datetime.timedelta objects.
2154
            return dbus.UInt64(self.timeout.total_seconds() * 1000)
581 by Teddy Hogeborn
* mandos (Client.enable, Client.disable, ClientDBus.approve): Call
2155
        old_timeout = self.timeout
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
2156
        self.timeout = datetime.timedelta(0, 0, 0, value)
581 by Teddy Hogeborn
* mandos (Client.enable, Client.disable, ClientDBus.approve): Call
2157
        # Reschedule disabling
543 by Teddy Hogeborn
* mandos: Break some long lines.
2158
        if self.enabled:
2159
            now = datetime.datetime.utcnow()
581 by Teddy Hogeborn
* mandos (Client.enable, Client.disable, ClientDBus.approve): Call
2160
            self.expires += self.timeout - old_timeout
2161
            if self.expires <= now:
543 by Teddy Hogeborn
* mandos: Break some long lines.
2162
                # The timeout has passed
2163
                self.disable()
2164
            else:
2165
                if (getattr(self, "disable_initiator_tag", None)
2166
                    is None):
2167
                    return
830 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
2168
                GLib.source_remove(self.disable_initiator_tag)
2169
                self.disable_initiator_tag = GLib.timeout_add(
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2170
                    int((self.expires - now).total_seconds() * 1000),
2171
                    self.disable)
874 by Teddy Hogeborn
PEP8 compliance: mandos
2172
24.1.179 by Björn Påhlsson
New feature:
2173
    # ExtendedTimeout - property
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2174
    @dbus_service_property(_interface,
2175
                           signature="t",
24.1.179 by Björn Påhlsson
New feature:
2176
                           access="readwrite")
2177
    def ExtendedTimeout_dbus_property(self, value=None):
2178
        if value is None:       # get
723.1.6 by Teddy Hogeborn
Use the new .total_seconds() method on datetime.timedelta objects.
2179
            return dbus.UInt64(self.extended_timeout.total_seconds()
2180
                               * 1000)
24.1.179 by Björn Påhlsson
New feature:
2181
        self.extended_timeout = datetime.timedelta(0, 0, 0, value)
874 by Teddy Hogeborn
PEP8 compliance: mandos
2182
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2183
    # Interval - property
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2184
    @dbus_service_property(_interface,
2185
                           signature="t",
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2186
                           access="readwrite")
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2187
    def Interval_dbus_property(self, value=None):
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
2188
        if value is None:       # get
723.1.6 by Teddy Hogeborn
Use the new .total_seconds() method on datetime.timedelta objects.
2189
            return dbus.UInt64(self.interval.total_seconds() * 1000)
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
2190
        self.interval = datetime.timedelta(0, 0, 0, value)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2191
        if getattr(self, "checker_initiator_tag", None) is None:
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
2192
            return
518.2.3 by Teddy Hogeborn
Make "enabled" a client config option.
2193
        if self.enabled:
2194
            # Reschedule checker run
830 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
2195
            GLib.source_remove(self.checker_initiator_tag)
2196
            self.checker_initiator_tag = GLib.timeout_add(
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2197
                value, self.start_checker)
874 by Teddy Hogeborn
PEP8 compliance: mandos
2198
            self.start_checker()  # Start one now, too
2199
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2200
    # Checker - property
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2201
    @dbus_service_property(_interface,
2202
                           signature="s",
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2203
                           access="readwrite")
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2204
    def Checker_dbus_property(self, value=None):
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
2205
        if value is None:       # get
2206
            return dbus.String(self.checker_command)
730 by Teddy Hogeborn
mandos: Replace unicode() with str().
2207
        self.checker_command = str(value)
874 by Teddy Hogeborn
PEP8 compliance: mandos
2208
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2209
    # CheckerRunning - property
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2210
    @dbus_service_property(_interface,
2211
                           signature="b",
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2212
                           access="readwrite")
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2213
    def CheckerRunning_dbus_property(self, value=None):
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
2214
        if value is None:       # get
2215
            return dbus.Boolean(self.checker is not None)
2216
        if value:
2217
            self.start_checker()
2218
        else:
2219
            self.stop_checker()
874 by Teddy Hogeborn
PEP8 compliance: mandos
2220
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2221
    # ObjectPath - property
780 by Teddy Hogeborn
Add D-Bus annotations on a few properties on the Client object.
2222
    @dbus_annotations(
782 by Teddy Hogeborn
Deprecate the D-Bus property "se.recompile.Mandos.Client.ObjectPath".
2223
        {"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",
2224
         "org.freedesktop.DBus.Deprecated": "true"})
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2225
    @dbus_service_property(_interface, signature="o", access="read")
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2226
    def ObjectPath_dbus_property(self):
874 by Teddy Hogeborn
PEP8 compliance: mandos
2227
        return self.dbus_object_path  # is already a dbus.ObjectPath
2228
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2229
    # Secret = property
780 by Teddy Hogeborn
Add D-Bus annotations on a few properties on the Client object.
2230
    @dbus_annotations(
2231
        {"org.freedesktop.DBus.Property.EmitsChangedSignal":
2232
         "invalidates"})
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2233
    @dbus_service_property(_interface,
2234
                           signature="ay",
2235
                           access="write",
2236
                           byte_arrays=True)
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2237
    def Secret_dbus_property(self, value):
729 by Teddy Hogeborn
mandos: Stop using str() and remove unnecessary unicode() calls.
2238
        self.secret = bytes(value)
874 by Teddy Hogeborn
PEP8 compliance: mandos
2239
237.1.2 by Teddy Hogeborn
Further steps towards a D-Bus server interface, plus minor syntax
2240
    del _interface
3 by Björn Påhlsson
Python based server
2241
2242
1154 by Teddy Hogeborn
Simplification of Python 3 compatibility code
2243
class ProxyClient:
962 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
2244
    def __init__(self, child_pipe, key_id, fpr, address):
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2245
        self._pipe = child_pipe
962 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
2246
        self._pipe.send(('init', key_id, fpr, address))
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2247
        if not self._pipe.recv():
962 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
2248
            raise KeyError(key_id or fpr)
874 by Teddy Hogeborn
PEP8 compliance: mandos
2249
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2250
    def __getattribute__(self, name):
518.2.4 by Teddy Hogeborn
* mandos (_timedelta_to_milliseconds): Renamed to
2251
        if name == '_pipe':
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2252
            return super(ProxyClient, self).__getattribute__(name)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2253
        self._pipe.send(('getattr', name))
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2254
        data = self._pipe.recv()
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2255
        if data[0] == 'data':
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2256
            return data[1]
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2257
        if data[0] == 'function':
874 by Teddy Hogeborn
PEP8 compliance: mandos
2258
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2259
            def func(*args, **kwargs):
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2260
                self._pipe.send(('funcall', name, args, kwargs))
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2261
                return self._pipe.recv()[1]
874 by Teddy Hogeborn
PEP8 compliance: mandos
2262
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2263
            return func
874 by Teddy Hogeborn
PEP8 compliance: mandos
2264
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2265
    def __setattr__(self, name, value):
518.2.4 by Teddy Hogeborn
* mandos (_timedelta_to_milliseconds): Renamed to
2266
        if name == '_pipe':
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2267
            return super(ProxyClient, self).__setattr__(name, value)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2268
        self._pipe.send(('setattr', name, value))
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2269
518.1.6 by Teddy Hogeborn
* mandos: Fix whitespace.
2270
335 by Teddy Hogeborn
* mandos: Import "SocketServer" as "socketserver" and "ConfigParser"
2271
class ClientHandler(socketserver.BaseRequestHandler, object):
331 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
2272
    """A class to handle client connections.
874 by Teddy Hogeborn
PEP8 compliance: mandos
2273
331 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
2274
    Instantiated once for each connection to handle it.
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
2275
    Note: This will run in its own forked process."""
874 by Teddy Hogeborn
PEP8 compliance: mandos
2276
3 by Björn Påhlsson
Python based server
2277
    def handle(self):
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2278
        with contextlib.closing(self.server.child_pipe) as child_pipe:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2279
            logger.info("TCP connection from: %s",
730 by Teddy Hogeborn
mandos: Replace unicode() with str().
2280
                        str(self.client_address))
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2281
            logger.debug("Pipe FD: %d",
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2282
                         self.server.child_pipe.fileno())
874 by Teddy Hogeborn
PEP8 compliance: mandos
2283
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
2284
            session = gnutls.ClientSession(self.request)
874 by Teddy Hogeborn
PEP8 compliance: mandos
2285
2286
            # priority = ':'.join(("NONE", "+VERS-TLS1.1",
2287
            #                       "+AES-256-CBC", "+SHA1",
2288
            #                       "+COMP-NULL", "+CTYPE-OPENPGP",
2289
            #                       "+DHE-DSS"))
288.1.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
2290
            # Use a fallback default, since this MUST be set.
331 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
2291
            priority = self.server.gnutls_priority
2292
            if priority is None:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2293
                priority = "NORMAL"
851 by Teddy Hogeborn
mandos: Minor bug fix for Python 3
2294
            gnutls.priority_set_direct(session._c_object,
2295
                                       priority.encode("utf-8"),
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
2296
                                       None)
874 by Teddy Hogeborn
PEP8 compliance: mandos
2297
416.1.2 by Teddy Hogeborn
* mandos (ClientHandler.handle): Set up the GnuTLS session object
2298
            # Start communication using the Mandos protocol
2299
            # Get protocol number
2300
            line = self.request.makefile().readline()
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2301
            logger.debug("Protocol version: %r", line)
416.1.2 by Teddy Hogeborn
* mandos (ClientHandler.handle): Set up the GnuTLS session object
2302
            try:
2303
                if int(line.strip().split()[0]) > 1:
642 by Teddy Hogeborn
Syntax fix; use "raise" better in Mandos server.
2304
                    raise RuntimeError(line)
482 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
2305
            except (ValueError, IndexError, RuntimeError) as error:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2306
                logger.error("Unknown protocol version: %s", error)
416.1.2 by Teddy Hogeborn
* mandos (ClientHandler.handle): Set up the GnuTLS session object
2307
                return
874 by Teddy Hogeborn
PEP8 compliance: mandos
2308
416.1.2 by Teddy Hogeborn
* mandos (ClientHandler.handle): Set up the GnuTLS session object
2309
            # Start GnuTLS connection
288.1.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
2310
            try:
2311
                session.handshake()
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
2312
            except gnutls.Error as error:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2313
                logger.warning("Handshake failed: %s", error)
288.1.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
2314
                # Do not run session.bye() here: the session is not
2315
                # established.  Just abandon the request.
2316
                return
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2317
            logger.debug("Handshake succeeded")
874 by Teddy Hogeborn
PEP8 compliance: mandos
2318
24.1.150 by Björn Påhlsson
* mandos: Added ClientDBus.approve_pending property. Exposed
2319
            approval_required = False
288.1.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
2320
            try:
962 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
2321
                if gnutls.has_rawpk:
1130 by Teddy Hogeborn
Update Python 3 compatibility
2322
                    fpr = b""
962 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
2323
                    try:
2324
                        key_id = self.key_id(
2325
                            self.peer_certificate(session))
2326
                    except (TypeError, gnutls.Error) as error:
2327
                        logger.warning("Bad certificate: %s", error)
2328
                        return
2329
                    logger.debug("Key ID: %s", key_id)
2330
2331
                else:
1130 by Teddy Hogeborn
Update Python 3 compatibility
2332
                    key_id = b""
962 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
2333
                    try:
2334
                        fpr = self.fingerprint(
2335
                            self.peer_certificate(session))
2336
                    except (TypeError, gnutls.Error) as error:
2337
                        logger.warning("Bad certificate: %s", error)
2338
                        return
2339
                    logger.debug("Fingerprint: %s", fpr)
2340
2341
                try:
2342
                    client = ProxyClient(child_pipe, key_id, fpr,
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2343
                                         self.client_address)
2344
                except KeyError:
411 by Teddy Hogeborn
More consistent terminology: Clients are no longer "invalid" - they
2345
                    return
874 by Teddy Hogeborn
PEP8 compliance: mandos
2346
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2347
                if client.approval_delay:
2348
                    delay = client.approval_delay
24.1.150 by Björn Påhlsson
* mandos: Added ClientDBus.approve_pending property. Exposed
2349
                    client.approvals_pending += 1
2350
                    approval_required = True
874 by Teddy Hogeborn
PEP8 compliance: mandos
2351
24.1.148 by Björn Påhlsson
half working on-demand password and approved code
2352
                while True:
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2353
                    if not client.enabled:
24.1.174 by Björn Påhlsson
* Makefile (CFLAGS): Added "-lrt" to include real time library.
2354
                        logger.info("Client %s is disabled",
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2355
                                    client.name)
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2356
                        if self.server.use_dbus:
2357
                            # Emit D-Bus signal
505.1.3 by Teddy Hogeborn
* mandos: Break long lines.
2358
                            client.Rejected("Disabled")
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2359
                        return
874 by Teddy Hogeborn
PEP8 compliance: mandos
2360
518.2.4 by Teddy Hogeborn
* mandos (_timedelta_to_milliseconds): Renamed to
2361
                    if client.approved or not client.approval_delay:
874 by Teddy Hogeborn
PEP8 compliance: mandos
2362
                        # We are approved or approval is disabled
24.1.150 by Björn Påhlsson
* mandos: Added ClientDBus.approve_pending property. Exposed
2363
                        break
518.2.4 by Teddy Hogeborn
* mandos (_timedelta_to_milliseconds): Renamed to
2364
                    elif client.approved is None:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2365
                        logger.info("Client %s needs approval",
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2366
                                    client.name)
2367
                        if self.server.use_dbus:
2368
                            # Emit D-Bus signal
2369
                            client.NeedApproval(
723.1.6 by Teddy Hogeborn
Use the new .total_seconds() method on datetime.timedelta objects.
2370
                                client.approval_delay.total_seconds()
2371
                                * 1000, client.approved_by_default)
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2372
                    else:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2373
                        logger.warning("Client %s was not approved",
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2374
                                       client.name)
2375
                        if self.server.use_dbus:
24.1.150 by Björn Påhlsson
* mandos: Added ClientDBus.approve_pending property. Exposed
2376
                            # Emit D-Bus signal
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2377
                            client.Rejected("Denied")
24.1.148 by Björn Påhlsson
half working on-demand password and approved code
2378
                        return
874 by Teddy Hogeborn
PEP8 compliance: mandos
2379
2380
                    # wait until timeout or approved
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2381
                    time = datetime.datetime.now()
2382
                    client.changedstate.acquire()
723.1.6 by Teddy Hogeborn
Use the new .total_seconds() method on datetime.timedelta objects.
2383
                    client.changedstate.wait(delay.total_seconds())
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2384
                    client.changedstate.release()
2385
                    time2 = datetime.datetime.now()
2386
                    if (time2 - time) >= delay:
2387
                        if not client.approved_by_default:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2388
                            logger.warning("Client %s timed out while"
2389
                                           " waiting for approval",
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2390
                                           client.name)
2391
                            if self.server.use_dbus:
2392
                                # Emit D-Bus signal
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2393
                                client.Rejected("Approval timed out")
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2394
                            return
2395
                        else:
2396
                            break
2397
                    else:
2398
                        delay -= time2 - time
874 by Teddy Hogeborn
PEP8 compliance: mandos
2399
802 by Teddy Hogeborn
Handle GnuTLS errors and partial sends in gnutls "module".
2400
                try:
2401
                    session.send(client.secret)
2402
                except gnutls.Error as error:
2403
                    logger.warning("gnutls send failed",
874 by Teddy Hogeborn
PEP8 compliance: mandos
2404
                                   exc_info=error)
802 by Teddy Hogeborn
Handle GnuTLS errors and partial sends in gnutls "module".
2405
                    return
874 by Teddy Hogeborn
PEP8 compliance: mandos
2406
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2407
                logger.info("Sending secret to %s", client.name)
505.1.13 by Teddy Hogeborn
Miscellaneous fixes prompted by lintian:
2408
                # bump the timeout using extended_timeout
556 by Teddy Hogeborn
* DBUS-API (se.recompile.Mandos.Client.LastCheckerStatus): New
2409
                client.bump_timeout(client.extended_timeout)
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2410
                if self.server.use_dbus:
2411
                    # Emit D-Bus signal
2412
                    client.GotSecret()
874 by Teddy Hogeborn
PEP8 compliance: mandos
2413
411 by Teddy Hogeborn
More consistent terminology: Clients are no longer "invalid" - they
2414
            finally:
24.1.150 by Björn Påhlsson
* mandos: Added ClientDBus.approve_pending property. Exposed
2415
                if approval_required:
2416
                    client.approvals_pending -= 1
24.1.155 by Björn Påhlsson
mandos server: Added debuglevel that adjust at what level information
2417
                try:
2418
                    session.bye()
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
2419
                except gnutls.Error as error:
574 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
2420
                    logger.warning("GnuTLS bye failed",
2421
                                   exc_info=error)
874 by Teddy Hogeborn
PEP8 compliance: mandos
2422
330 by Teddy Hogeborn
* mandos (peer_certificate, fingerprint): Moved into "TCP_handler"
2423
    @staticmethod
2424
    def peer_certificate(session):
962 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
2425
        "Return the peer's certificate as a bytestring"
2426
        try:
2427
            cert_type = gnutls.certificate_type_get2(session._c_object,
2428
                                                     gnutls.CTYPE_PEERS)
2429
        except AttributeError:
2430
            cert_type = gnutls.certificate_type_get(session._c_object)
2431
        if gnutls.has_rawpk:
2432
            valid_cert_types = frozenset((gnutls.CRT_RAWPK,))
2433
        else:
2434
            valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))
2435
        # If not a valid certificate type...
2436
        if cert_type not in valid_cert_types:
2437
            logger.info("Cert type %r not in %r", cert_type,
2438
                        valid_cert_types)
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
2439
            # ...return invalid data
2440
            return b""
330 by Teddy Hogeborn
* mandos (peer_certificate, fingerprint): Moved into "TCP_handler"
2441
        list_size = ctypes.c_uint(1)
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
2442
        cert_list = (gnutls.certificate_get_peers
330 by Teddy Hogeborn
* mandos (peer_certificate, fingerprint): Moved into "TCP_handler"
2443
                     (session._c_object, ctypes.byref(list_size)))
2444
        if not bool(cert_list) and list_size.value != 0:
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
2445
            raise gnutls.Error("error getting peer certificate")
330 by Teddy Hogeborn
* mandos (peer_certificate, fingerprint): Moved into "TCP_handler"
2446
        if list_size.value == 0:
2447
            return None
2448
        cert = cert_list[0]
2449
        return ctypes.string_at(cert.data, cert.size)
874 by Teddy Hogeborn
PEP8 compliance: mandos
2450
330 by Teddy Hogeborn
* mandos (peer_certificate, fingerprint): Moved into "TCP_handler"
2451
    @staticmethod
962 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
2452
    def key_id(certificate):
2453
        "Convert a certificate bytestring to a hexdigit key ID"
2454
        # New GnuTLS "datum" with the public key
2455
        datum = gnutls.datum_t(
2456
            ctypes.cast(ctypes.c_char_p(certificate),
2457
                        ctypes.POINTER(ctypes.c_ubyte)),
2458
            ctypes.c_uint(len(certificate)))
2459
        # XXX all these need to be created in the gnutls "module"
2460
        # New empty GnuTLS certificate
2461
        pubkey = gnutls.pubkey_t()
2462
        gnutls.pubkey_init(ctypes.byref(pubkey))
2463
        # Import the raw public key into the certificate
2464
        gnutls.pubkey_import(pubkey,
2465
                             ctypes.byref(datum),
2466
                             gnutls.X509_FMT_DER)
2467
        # New buffer for the key ID
2468
        buf = ctypes.create_string_buffer(32)
2469
        buf_len = ctypes.c_size_t(len(buf))
2470
        # Get the key ID from the raw public key into the buffer
2471
        gnutls.pubkey_get_key_id(pubkey,
2472
                                 gnutls.KEYID_USE_SHA256,
2473
                                 ctypes.cast(ctypes.byref(buf),
2474
                                             ctypes.POINTER(ctypes.c_ubyte)),
2475
                                 ctypes.byref(buf_len))
2476
        # Deinit the certificate
2477
        gnutls.pubkey_deinit(pubkey)
2478
2479
        # Convert the buffer to a Python bytestring
2480
        key_id = ctypes.string_at(buf, buf_len.value)
2481
        # Convert the bytestring to hexadecimal notation
2482
        hex_key_id = binascii.hexlify(key_id).upper()
2483
        return hex_key_id
2484
2485
    @staticmethod
330 by Teddy Hogeborn
* mandos (peer_certificate, fingerprint): Moved into "TCP_handler"
2486
    def fingerprint(openpgp):
2487
        "Convert an OpenPGP bytestring to a hexdigit fingerprint"
2488
        # New GnuTLS "datum" with the OpenPGP public key
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
2489
        datum = gnutls.datum_t(
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2490
            ctypes.cast(ctypes.c_char_p(openpgp),
2491
                        ctypes.POINTER(ctypes.c_ubyte)),
2492
            ctypes.c_uint(len(openpgp)))
330 by Teddy Hogeborn
* mandos (peer_certificate, fingerprint): Moved into "TCP_handler"
2493
        # New empty GnuTLS certificate
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
2494
        crt = gnutls.openpgp_crt_t()
2495
        gnutls.openpgp_crt_init(ctypes.byref(crt))
330 by Teddy Hogeborn
* mandos (peer_certificate, fingerprint): Moved into "TCP_handler"
2496
        # Import the OpenPGP public key into the certificate
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
2497
        gnutls.openpgp_crt_import(crt, ctypes.byref(datum),
2498
                                  gnutls.OPENPGP_FMT_RAW)
330 by Teddy Hogeborn
* mandos (peer_certificate, fingerprint): Moved into "TCP_handler"
2499
        # Verify the self signature in the key
2500
        crtverify = ctypes.c_uint()
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
2501
        gnutls.openpgp_crt_verify_self(crt, 0,
2502
                                       ctypes.byref(crtverify))
330 by Teddy Hogeborn
* mandos (peer_certificate, fingerprint): Moved into "TCP_handler"
2503
        if crtverify.value != 0:
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
2504
            gnutls.openpgp_crt_deinit(crt)
950 by Teddy Hogeborn
mandos: Better error message if self-signature verification fails
2505
            raise gnutls.CertificateSecurityError(code
2506
                                                  =crtverify.value)
330 by Teddy Hogeborn
* mandos (peer_certificate, fingerprint): Moved into "TCP_handler"
2507
        # New buffer for the fingerprint
2508
        buf = ctypes.create_string_buffer(20)
2509
        buf_len = ctypes.c_size_t()
2510
        # Get the fingerprint from the certificate into the buffer
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
2511
        gnutls.openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
2512
                                           ctypes.byref(buf_len))
330 by Teddy Hogeborn
* mandos (peer_certificate, fingerprint): Moved into "TCP_handler"
2513
        # Deinit the certificate
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
2514
        gnutls.openpgp_crt_deinit(crt)
330 by Teddy Hogeborn
* mandos (peer_certificate, fingerprint): Moved into "TCP_handler"
2515
        # Convert the buffer to a Python bytestring
2516
        fpr = ctypes.string_at(buf, buf_len.value)
2517
        # Convert the bytestring to hexadecimal notation
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
2518
        hex_fpr = binascii.hexlify(fpr).upper()
330 by Teddy Hogeborn
* mandos (peer_certificate, fingerprint): Moved into "TCP_handler"
2519
        return hex_fpr
288.1.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
2520
2521
1154 by Teddy Hogeborn
Simplification of Python 3 compatibility code
2522
class MultiprocessingMixIn:
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2523
    """Like socketserver.ThreadingMixIn, but with multiprocessing"""
874 by Teddy Hogeborn
PEP8 compliance: mandos
2524
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2525
    def sub_process_main(self, request, address):
2526
        try:
2527
            self.finish_request(request, address)
518.1.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
2528
        except Exception:
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2529
            self.handle_error(request, address)
2530
        self.close_request(request)
874 by Teddy Hogeborn
PEP8 compliance: mandos
2531
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2532
    def process_request(self, request, address):
2533
        """Start a new process to process the request."""
874 by Teddy Hogeborn
PEP8 compliance: mandos
2534
        proc = multiprocessing.Process(target=self.sub_process_main,
2535
                                       args=(request, address))
505.1.11 by Teddy Hogeborn
* mandos (Client.checked_ok): Set "expires" after setting timeout.
2536
        proc.start()
2537
        return proc
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2538
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
2539
1154 by Teddy Hogeborn
Simplification of Python 3 compatibility code
2540
class MultiprocessingMixInWithPipe(MultiprocessingMixIn):
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2541
    """ adds a pipe to the MixIn """
874 by Teddy Hogeborn
PEP8 compliance: mandos
2542
288.1.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
2543
    def process_request(self, request, client_address):
331 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
2544
        """Overrides and wraps the original process_request().
874 by Teddy Hogeborn
PEP8 compliance: mandos
2545
355 by Teddy Hogeborn
* mandos: White-space fixes only.
2546
        This function creates a new pipe in self.pipe
288.1.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
2547
        """
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2548
        parent_pipe, self.child_pipe = multiprocessing.Pipe()
874 by Teddy Hogeborn
PEP8 compliance: mandos
2549
505.1.11 by Teddy Hogeborn
* mandos (Client.checked_ok): Set "expires" after setting timeout.
2550
        proc = MultiprocessingMixIn.process_request(self, request,
2551
                                                    client_address)
24.1.152 by Björn Påhlsson
bug fixes that prevent problems when runing server as root
2552
        self.child_pipe.close()
505.1.11 by Teddy Hogeborn
* mandos (Client.checked_ok): Set "expires" after setting timeout.
2553
        self.add_pipe(parent_pipe, proc)
874 by Teddy Hogeborn
PEP8 compliance: mandos
2554
505.1.11 by Teddy Hogeborn
* mandos (Client.checked_ok): Set "expires" after setting timeout.
2555
    def add_pipe(self, parent_pipe, proc):
288.1.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
2556
        """Dummy function; override as necessary"""
642 by Teddy Hogeborn
Syntax fix; use "raise" better in Mandos server.
2557
        raise NotImplementedError()
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2558
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
2559
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2560
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
1154 by Teddy Hogeborn
Simplification of Python 3 compatibility code
2561
                     socketserver.TCPServer):
237.2.13 by Teddy Hogeborn
Merge from trunk. Notable changes:
2562
    """IPv6-capable TCP server.  Accepts 'None' as address and/or port
874 by Teddy Hogeborn
PEP8 compliance: mandos
2563
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
2564
    Attributes:
331 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
2565
        enabled:        Boolean; whether this server is activated yet
2566
        interface:      None or a network interface name (string)
2567
        use_ipv6:       Boolean; to use IPv6 or not
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
2568
    """
874 by Teddy Hogeborn
PEP8 compliance: mandos
2569
331 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
2570
    def __init__(self, server_address, RequestHandlerClass,
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2571
                 interface=None,
2572
                 use_ipv6=True,
2573
                 socketfd=None):
589.1.1 by Teddy Hogeborn
* mandos: Implement "--socket" option.
2574
        """If socketfd is set, use that file descriptor instead of
2575
        creating a new one with socket.socket().
2576
        """
331 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
2577
        self.interface = interface
2578
        if use_ipv6:
2579
            self.address_family = socket.AF_INET6
589.1.1 by Teddy Hogeborn
* mandos: Implement "--socket" option.
2580
        if socketfd is not None:
2581
            # Save the file descriptor
2582
            self.socketfd = socketfd
2583
            # Save the original socket.socket() function
2584
            self.socket_socket = socket.socket
874 by Teddy Hogeborn
PEP8 compliance: mandos
2585
589.1.1 by Teddy Hogeborn
* mandos: Implement "--socket" option.
2586
            # To implement --socket, we monkey patch socket.socket.
874 by Teddy Hogeborn
PEP8 compliance: mandos
2587
            #
589.1.1 by Teddy Hogeborn
* mandos: Implement "--socket" option.
2588
            # (When socketserver.TCPServer is a new-style class, we
2589
            # could make self.socket into a property instead of monkey
2590
            # patching socket.socket.)
874 by Teddy Hogeborn
PEP8 compliance: mandos
2591
            #
589.1.1 by Teddy Hogeborn
* mandos: Implement "--socket" option.
2592
            # Create a one-time-only replacement for socket.socket()
2593
            @functools.wraps(socket.socket)
2594
            def socket_wrapper(*args, **kwargs):
2595
                # Restore original function so subsequent calls are
2596
                # not affected.
2597
                socket.socket = self.socket_socket
2598
                del self.socket_socket
2599
                # This time only, return a new socket object from the
2600
                # saved file descriptor.
2601
                return socket.fromfd(self.socketfd, *args, **kwargs)
2602
            # Replace socket.socket() function with wrapper
2603
            socket.socket = socket_wrapper
2604
        # The socketserver.TCPServer.__init__ will call
2605
        # socket.socket(), which might be our replacement,
2606
        # socket_wrapper(), if socketfd was set.
335 by Teddy Hogeborn
* mandos: Import "SocketServer" as "socketserver" and "ConfigParser"
2607
        socketserver.TCPServer.__init__(self, server_address,
331 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
2608
                                        RequestHandlerClass)
874 by Teddy Hogeborn
PEP8 compliance: mandos
2609
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
2610
    def server_bind(self):
2611
        """This overrides the normal server_bind() function
2612
        to bind to an interface if one was specified, and also NOT to
2613
        bind to an address or port if they were not specified."""
858 by Teddy Hogeborn
Server: Fix bug with --interface flag when "cc" is not installed.
2614
        global SO_BINDTODEVICE
331 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
2615
        if self.interface is not None:
338 by Teddy Hogeborn
* mandos: Minor doc string fixes.
2616
            if SO_BINDTODEVICE is None:
852 by Teddy Hogeborn
mandos: Bug fix for Python 2.7 and the "--interface" option
2617
                # Fall back to a hard-coded value which seems to be
2618
                # common enough.
2619
                logger.warning("SO_BINDTODEVICE not found, trying 25")
2620
                SO_BINDTODEVICE = 25
2621
            try:
2622
                self.socket.setsockopt(
2623
                    socket.SOL_SOCKET, SO_BINDTODEVICE,
2624
                    (self.interface + "\0").encode("utf-8"))
2625
            except socket.error as error:
2626
                if error.errno == errno.EPERM:
2627
                    logger.error("No permission to bind to"
2628
                                 " interface %s", self.interface)
2629
                elif error.errno == errno.ENOPROTOOPT:
2630
                    logger.error("SO_BINDTODEVICE not available;"
2631
                                 " cannot bind to interface %s",
2632
                                 self.interface)
2633
                elif error.errno == errno.ENODEV:
2634
                    logger.error("Interface %s does not exist,"
2635
                                 " cannot bind", self.interface)
2636
                else:
2637
                    raise
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
2638
        # Only bind(2) the socket if we really need to.
2639
        if self.server_address[0] or self.server_address[1]:
1115 by Teddy Hogeborn
Server bug fix: Allow restarts when using port= option
2640
            if self.server_address[1]:
2641
                self.allow_reuse_address = True
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
2642
            if not self.server_address[0]:
314 by Teddy Hogeborn
Support not using IPv6 in server:
2643
                if self.address_family == socket.AF_INET6:
874 by Teddy Hogeborn
PEP8 compliance: mandos
2644
                    any_address = "::"  # in6addr_any
314 by Teddy Hogeborn
Support not using IPv6 in server:
2645
                else:
874 by Teddy Hogeborn
PEP8 compliance: mandos
2646
                    any_address = "0.0.0.0"  # INADDR_ANY
314 by Teddy Hogeborn
Support not using IPv6 in server:
2647
                self.server_address = (any_address,
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
2648
                                       self.server_address[1])
49 by Teddy Hogeborn
* mandos (IPv6_TCPServer.server_bind): Bug fix: allow port to be empty
2649
            elif not self.server_address[1]:
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2650
                self.server_address = (self.server_address[0], 0)
331 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
2651
#                 if self.interface:
49 by Teddy Hogeborn
* mandos (IPv6_TCPServer.server_bind): Bug fix: allow port to be empty
2652
#                     self.server_address = (self.server_address[0],
2653
#                                            0, # port
2654
#                                            0, # flowinfo
2655
#                                            if_nametoindex
331 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
2656
#                                            (self.interface))
335 by Teddy Hogeborn
* mandos: Import "SocketServer" as "socketserver" and "ConfigParser"
2657
            return socketserver.TCPServer.server_bind(self)
339 by Teddy Hogeborn
Code cleanup.
2658
2659
2660
class MandosServer(IPv6_TCPServer):
2661
    """Mandos server.
874 by Teddy Hogeborn
PEP8 compliance: mandos
2662
339 by Teddy Hogeborn
Code cleanup.
2663
    Attributes:
2664
        clients:        set of Client objects
2665
        gnutls_priority GnuTLS priority string
2666
        use_dbus:       Boolean; to emit D-Bus signals or not
874 by Teddy Hogeborn
PEP8 compliance: mandos
2667
830 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
2668
    Assumes a GLib.MainLoop event loop.
339 by Teddy Hogeborn
Code cleanup.
2669
    """
874 by Teddy Hogeborn
PEP8 compliance: mandos
2670
339 by Teddy Hogeborn
Code cleanup.
2671
    def __init__(self, server_address, RequestHandlerClass,
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2672
                 interface=None,
2673
                 use_ipv6=True,
2674
                 clients=None,
2675
                 gnutls_priority=None,
2676
                 use_dbus=True,
2677
                 socketfd=None):
339 by Teddy Hogeborn
Code cleanup.
2678
        self.enabled = False
2679
        self.clients = clients
341 by Teddy Hogeborn
Code cleanup and one bug fix.
2680
        if self.clients is None:
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
2681
            self.clients = {}
339 by Teddy Hogeborn
Code cleanup.
2682
        self.use_dbus = use_dbus
2683
        self.gnutls_priority = gnutls_priority
2684
        IPv6_TCPServer.__init__(self, server_address,
2685
                                RequestHandlerClass,
874 by Teddy Hogeborn
PEP8 compliance: mandos
2686
                                interface=interface,
2687
                                use_ipv6=use_ipv6,
2688
                                socketfd=socketfd)
2689
163 by Teddy Hogeborn
* Makefile (PIDDIR, USER, GROUP): Removed.
2690
    def server_activate(self):
2691
        if self.enabled:
335 by Teddy Hogeborn
* mandos: Import "SocketServer" as "socketserver" and "ConfigParser"
2692
            return socketserver.TCPServer.server_activate(self)
874 by Teddy Hogeborn
PEP8 compliance: mandos
2693
163 by Teddy Hogeborn
* Makefile (PIDDIR, USER, GROUP): Removed.
2694
    def enable(self):
2695
        self.enabled = True
874 by Teddy Hogeborn
PEP8 compliance: mandos
2696
505.1.11 by Teddy Hogeborn
* mandos (Client.checked_ok): Set "expires" after setting timeout.
2697
    def add_pipe(self, parent_pipe, proc):
340 by Teddy Hogeborn
Code cleanup.
2698
        # Call "handle_ipc" for both data and EOF events
830 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
2699
        GLib.io_add_watch(
1168 by Teddy Hogeborn
Server: Fully use new GLib.io_add_watch() call signature
2700
            GLib.IOChannel.unix_new(parent_pipe.fileno()),
2701
            GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2702
            functools.partial(self.handle_ipc,
874 by Teddy Hogeborn
PEP8 compliance: mandos
2703
                              parent_pipe=parent_pipe,
2704
                              proc=proc))
2705
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2706
    def handle_ipc(self, source, condition,
2707
                   parent_pipe=None,
874 by Teddy Hogeborn
PEP8 compliance: mandos
2708
                   proc=None,
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2709
                   client_object=None):
505.1.13 by Teddy Hogeborn
Miscellaneous fixes prompted by lintian:
2710
        # error, or the other end of multiprocessing.Pipe has closed
830 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
2711
        if condition & (GLib.IO_ERR | GLib.IO_HUP):
505.1.13 by Teddy Hogeborn
Miscellaneous fixes prompted by lintian:
2712
            # Wait for other process to exit
505.1.11 by Teddy Hogeborn
* mandos (Client.checked_ok): Set "expires" after setting timeout.
2713
            proc.join()
24.1.152 by Björn Påhlsson
bug fixes that prevent problems when runing server as root
2714
            return False
874 by Teddy Hogeborn
PEP8 compliance: mandos
2715
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2716
        # Read a request from the child
2717
        request = parent_pipe.recv()
2718
        command = request[0]
874 by Teddy Hogeborn
PEP8 compliance: mandos
2719
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2720
        if command == 'init':
962 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
2721
            key_id = request[1].decode("ascii")
2722
            fpr = request[2].decode("ascii")
2723
            address = request[3]
874 by Teddy Hogeborn
PEP8 compliance: mandos
2724
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
2725
            for c in self.clients.values():
971 by Teddy Hogeborn
Bug fix: Only create TLS key with certtool, and read correct key file
2726
                if key_id == "E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855":
2727
                    continue
962 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
2728
                if key_id and c.key_id == key_id:
2729
                    client = c
2730
                    break
2731
                if fpr and c.fingerprint == fpr:
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2732
                    client = c
2733
                    break
2734
            else:
962 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
2735
                logger.info("Client not found for key ID: %s, address"
2736
                            ": %s", key_id or fpr, address)
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2737
                if self.use_dbus:
2738
                    # Emit D-Bus signal
962 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
2739
                    mandos_dbus_service.ClientNotFound(key_id or fpr,
505.1.3 by Teddy Hogeborn
* mandos: Break long lines.
2740
                                                       address[0])
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2741
                parent_pipe.send(False)
2742
                return False
874 by Teddy Hogeborn
PEP8 compliance: mandos
2743
830 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
2744
            GLib.io_add_watch(
1168 by Teddy Hogeborn
Server: Fully use new GLib.io_add_watch() call signature
2745
                GLib.IOChannel.unix_new(parent_pipe.fileno()),
2746
                GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2747
                functools.partial(self.handle_ipc,
874 by Teddy Hogeborn
PEP8 compliance: mandos
2748
                                  parent_pipe=parent_pipe,
2749
                                  proc=proc,
2750
                                  client_object=client))
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2751
            parent_pipe.send(True)
505.1.3 by Teddy Hogeborn
* mandos: Break long lines.
2752
            # remove the old hook in favor of the new above hook on
2753
            # same fileno
288.1.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
2754
            return False
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2755
        if command == 'funcall':
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2756
            funcname = request[1]
2757
            args = request[2]
2758
            kwargs = request[3]
874 by Teddy Hogeborn
PEP8 compliance: mandos
2759
505.1.3 by Teddy Hogeborn
* mandos: Break long lines.
2760
            parent_pipe.send(('data', getattr(client_object,
2761
                                              funcname)(*args,
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2762
                                                        **kwargs)))
874 by Teddy Hogeborn
PEP8 compliance: mandos
2763
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2764
        if command == 'getattr':
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2765
            attrname = request[1]
755 by Teddy Hogeborn
mandos: More Python 3 fixes.
2766
            if isinstance(client_object.__getattribute__(attrname),
1202 by Teddy Hogeborn
Use collections.abc.Callable instead of collections.Callable
2767
                          collections.abc.Callable):
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2768
                parent_pipe.send(('function', ))
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2769
            else:
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2770
                parent_pipe.send((
2771
                    'data', client_object.__getattribute__(attrname)))
874 by Teddy Hogeborn
PEP8 compliance: mandos
2772
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2773
        if command == 'setattr':
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2774
            attrname = request[1]
2775
            value = request[2]
2776
            setattr(client_object, attrname, value)
874 by Teddy Hogeborn
PEP8 compliance: mandos
2777
288.1.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
2778
        return True
10 by Teddy Hogeborn
* server.py: Bug fix: Do "from __future__ import division".
2779
3 by Björn Påhlsson
Python based server
2780
609 by Teddy Hogeborn
* clients.conf: Convert all time intervals to new RFC 3339 syntax.
2781
def rfc3339_duration_to_delta(duration):
2782
    """Parse an RFC 3339 "duration" and return a datetime.timedelta
874 by Teddy Hogeborn
PEP8 compliance: mandos
2783
1170 by Teddy Hogeborn
Update Python 3 compatibility
2784
    >>> rfc3339_duration_to_delta("P7D") == datetime.timedelta(7)
2785
    True
2786
    >>> rfc3339_duration_to_delta("PT60S") == datetime.timedelta(0, 60)
2787
    True
2788
    >>> rfc3339_duration_to_delta("PT60M") == datetime.timedelta(0, 3600)
2789
    True
2790
    >>> rfc3339_duration_to_delta("PT24H") == datetime.timedelta(1)
2791
    True
2792
    >>> rfc3339_duration_to_delta("P1W") == datetime.timedelta(7)
2793
    True
2794
    >>> rfc3339_duration_to_delta("PT5M30S") == datetime.timedelta(0, 330)
2795
    True
2796
    >>> rfc3339_duration_to_delta("P1DT3M20S") == datetime.timedelta(1, 200)
2797
    True
609 by Teddy Hogeborn
* clients.conf: Convert all time intervals to new RFC 3339 syntax.
2798
    """
874 by Teddy Hogeborn
PEP8 compliance: mandos
2799
609 by Teddy Hogeborn
* clients.conf: Convert all time intervals to new RFC 3339 syntax.
2800
    # Parsing an RFC 3339 duration with regular expressions is not
2801
    # possible - there would have to be multiple places for the same
2802
    # values, like seconds.  The current code, while more esoteric, is
2803
    # cleaner without depending on a parsing library.  If Python had a
2804
    # built-in library for parsing we would use it, but we'd like to
2805
    # avoid excessive use of external libraries.
874 by Teddy Hogeborn
PEP8 compliance: mandos
2806
609 by Teddy Hogeborn
* clients.conf: Convert all time intervals to new RFC 3339 syntax.
2807
    # New type for defining tokens, syntax, and semantics all-in-one
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2808
    Token = collections.namedtuple("Token", (
2809
        "regexp",  # To match token; if "value" is not None, must have
2810
                   # a "group" containing digits
2811
        "value",   # datetime.timedelta or None
2812
        "followers"))           # Tokens valid after this token
609 by Teddy Hogeborn
* clients.conf: Convert all time intervals to new RFC 3339 syntax.
2813
    # RFC 3339 "duration" tokens, syntax, and semantics; taken from
2814
    # the "duration" ABNF definition in RFC 3339, Appendix A.
2815
    token_end = Token(re.compile(r"$"), None, frozenset())
2816
    token_second = Token(re.compile(r"(\d+)S"),
2817
                         datetime.timedelta(seconds=1),
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2818
                         frozenset((token_end, )))
609 by Teddy Hogeborn
* clients.conf: Convert all time intervals to new RFC 3339 syntax.
2819
    token_minute = Token(re.compile(r"(\d+)M"),
2820
                         datetime.timedelta(minutes=1),
2821
                         frozenset((token_second, token_end)))
2822
    token_hour = Token(re.compile(r"(\d+)H"),
2823
                       datetime.timedelta(hours=1),
2824
                       frozenset((token_minute, token_end)))
2825
    token_time = Token(re.compile(r"T"),
2826
                       None,
2827
                       frozenset((token_hour, token_minute,
2828
                                  token_second)))
2829
    token_day = Token(re.compile(r"(\d+)D"),
2830
                      datetime.timedelta(days=1),
2831
                      frozenset((token_time, token_end)))
2832
    token_month = Token(re.compile(r"(\d+)M"),
2833
                        datetime.timedelta(weeks=4),
2834
                        frozenset((token_day, token_end)))
2835
    token_year = Token(re.compile(r"(\d+)Y"),
2836
                       datetime.timedelta(weeks=52),
2837
                       frozenset((token_month, token_end)))
2838
    token_week = Token(re.compile(r"(\d+)W"),
2839
                       datetime.timedelta(weeks=1),
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2840
                       frozenset((token_end, )))
609 by Teddy Hogeborn
* clients.conf: Convert all time intervals to new RFC 3339 syntax.
2841
    token_duration = Token(re.compile(r"P"), None,
2842
                           frozenset((token_year, token_month,
2843
                                      token_day, token_time,
721 by Teddy Hogeborn
Fix two mutually cancelling bugs.
2844
                                      token_week)))
874 by Teddy Hogeborn
PEP8 compliance: mandos
2845
    # Define starting values:
2846
    # Value so far
2847
    value = datetime.timedelta()
609 by Teddy Hogeborn
* clients.conf: Convert all time intervals to new RFC 3339 syntax.
2848
    found_token = None
874 by Teddy Hogeborn
PEP8 compliance: mandos
2849
    # Following valid tokens
2850
    followers = frozenset((token_duration, ))
2851
    # String left to parse
2852
    s = duration
609 by Teddy Hogeborn
* clients.conf: Convert all time intervals to new RFC 3339 syntax.
2853
    # Loop until end token is found
2854
    while found_token is not token_end:
2855
        # Search for any currently valid tokens
2856
        for token in followers:
2857
            match = token.regexp.match(s)
2858
            if match is not None:
2859
                # Token found
2860
                if token.value is not None:
2861
                    # Value found, parse digits
2862
                    factor = int(match.group(1), 10)
2863
                    # Add to value so far
2864
                    value += factor * token.value
2865
                # Strip token from string
2866
                s = token.regexp.sub("", s, 1)
2867
                # Go to found token
2868
                found_token = token
2869
                # Set valid next tokens
2870
                followers = found_token.followers
2871
                break
2872
        else:
2873
            # No currently valid tokens were found
752 by Teddy Hogeborn
mandos: Generate better messages in exceptions.
2874
            raise ValueError("Invalid RFC 3339 duration: {!r}"
2875
                             .format(duration))
609 by Teddy Hogeborn
* clients.conf: Convert all time intervals to new RFC 3339 syntax.
2876
    # End token found
2877
    return value
2878
2879
4 by Teddy Hogeborn
* server.py (Client.created, Client.next_check): New.
2880
def string_to_delta(interval):
2881
    """Parse a string and return a datetime.timedelta
874 by Teddy Hogeborn
PEP8 compliance: mandos
2882
1170 by Teddy Hogeborn
Update Python 3 compatibility
2883
    >>> string_to_delta('7d') == datetime.timedelta(7)
2884
    True
2885
    >>> string_to_delta('60s') == datetime.timedelta(0, 60)
2886
    True
2887
    >>> string_to_delta('60m') == datetime.timedelta(0, 3600)
2888
    True
2889
    >>> string_to_delta('24h') == datetime.timedelta(1)
2890
    True
2891
    >>> string_to_delta('1w') == datetime.timedelta(7)
2892
    True
2893
    >>> string_to_delta('5m 30s') == datetime.timedelta(0, 330)
2894
    True
4 by Teddy Hogeborn
* server.py (Client.created, Client.next_check): New.
2895
    """
874 by Teddy Hogeborn
PEP8 compliance: mandos
2896
609 by Teddy Hogeborn
* clients.conf: Convert all time intervals to new RFC 3339 syntax.
2897
    try:
2898
        return rfc3339_duration_to_delta(interval)
2899
    except ValueError:
2900
        pass
874 by Teddy Hogeborn
PEP8 compliance: mandos
2901
93 by Teddy Hogeborn
* mandos (string_to_delta): Accept a whitespace-separated sequence of
2902
    timevalue = datetime.timedelta(0)
2903
    for s in interval.split():
2904
        try:
729 by Teddy Hogeborn
mandos: Stop using str() and remove unnecessary unicode() calls.
2905
            suffix = s[-1]
215 by Teddy Hogeborn
* mandos: Remove unused "select" module. Import "ctypes.util".
2906
            value = int(s[:-1])
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2907
            if suffix == "d":
93 by Teddy Hogeborn
* mandos (string_to_delta): Accept a whitespace-separated sequence of
2908
                delta = datetime.timedelta(value)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2909
            elif suffix == "s":
93 by Teddy Hogeborn
* mandos (string_to_delta): Accept a whitespace-separated sequence of
2910
                delta = datetime.timedelta(0, value)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2911
            elif suffix == "m":
93 by Teddy Hogeborn
* mandos (string_to_delta): Accept a whitespace-separated sequence of
2912
                delta = datetime.timedelta(0, 0, 0, 0, value)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2913
            elif suffix == "h":
93 by Teddy Hogeborn
* mandos (string_to_delta): Accept a whitespace-separated sequence of
2914
                delta = datetime.timedelta(0, 0, 0, 0, 0, value)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2915
            elif suffix == "w":
93 by Teddy Hogeborn
* mandos (string_to_delta): Accept a whitespace-separated sequence of
2916
                delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
2917
            else:
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2918
                raise ValueError("Unknown suffix {!r}".format(suffix))
642 by Teddy Hogeborn
Syntax fix; use "raise" better in Mandos server.
2919
        except IndexError as e:
464 by Teddy Hogeborn
* debian/mandos-client.postrm (purge): Bug fix: update initramfs also
2920
            raise ValueError(*(e.args))
93 by Teddy Hogeborn
* mandos (string_to_delta): Accept a whitespace-separated sequence of
2921
        timevalue += delta
2922
    return timevalue
4 by Teddy Hogeborn
* server.py (Client.created, Client.next_check): New.
2923
8 by Teddy Hogeborn
* Makefile (client_debug): Bug fix; add quotes and / to CERT_ROOT.
2924
874 by Teddy Hogeborn
PEP8 compliance: mandos
2925
def daemon(nochdir=False, noclose=False):
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
2926
    """See daemon(3).  Standard BSD Unix function.
874 by Teddy Hogeborn
PEP8 compliance: mandos
2927
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
2928
    This should really exist as os.daemon, but it doesn't (yet)."""
2929
    if os.fork():
2930
        sys.exit()
2931
    os.setsid()
2932
    if not nochdir:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2933
        os.chdir("/")
46 by Teddy Hogeborn
* network-protocol.txt: New.
2934
    if os.fork():
2935
        sys.exit()
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
2936
    if not noclose:
2937
        # Close all standard open file descriptors
560.1.1 by teddy at recompile
* mandos: Use os.devnull instead of os.path.devnull. Fix some white
2938
        null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
2939
        if not stat.S_ISCHR(os.fstat(null).st_mode):
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2940
            raise OSError(errno.ENODEV,
2941
                          "{} not a character device"
568 by Teddy Hogeborn
* mandos-monitor: Use new string format method.
2942
                          .format(os.devnull))
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
2943
        os.dup2(null, sys.stdin.fileno())
2944
        os.dup2(null, sys.stdout.fileno())
2945
        os.dup2(null, sys.stderr.fileno())
2946
        if null > 2:
2947
            os.close(null)
2948
2949
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
2950
def main():
874 by Teddy Hogeborn
PEP8 compliance: mandos
2951
379 by Teddy Hogeborn
* mandos: Fix line lengths.
2952
    ##################################################################
327 by Teddy Hogeborn
Merge from pipe IPC branch.
2953
    # Parsing of options, both command line and config file
874 by Teddy Hogeborn
PEP8 compliance: mandos
2954
474 by teddy at bsnet
* mandos: Use the new argparse library instead of optparse.
2955
    parser = argparse.ArgumentParser()
2956
    parser.add_argument("-v", "--version", action="version",
874 by Teddy Hogeborn
PEP8 compliance: mandos
2957
                        version="%(prog)s {}".format(version),
474 by teddy at bsnet
* mandos: Use the new argparse library instead of optparse.
2958
                        help="show version number and exit")
2959
    parser.add_argument("-i", "--interface", metavar="IF",
2960
                        help="Bind to interface IF")
2961
    parser.add_argument("-a", "--address",
2962
                        help="Address to listen for requests on")
2963
    parser.add_argument("-p", "--port", type=int,
2964
                        help="Port number to receive requests on")
2965
    parser.add_argument("--check", action="store_true",
2966
                        help="Run self-test")
2967
    parser.add_argument("--debug", action="store_true",
2968
                        help="Debug mode; run in foreground and log"
618 by Teddy Hogeborn
* mandos: Bug fix: Make boolean options work from the config file
2969
                        " to terminal", default=None)
474 by teddy at bsnet
* mandos: Use the new argparse library instead of optparse.
2970
    parser.add_argument("--debuglevel", metavar="LEVEL",
2971
                        help="Debug level for stdout output")
2972
    parser.add_argument("--priority", help="GnuTLS"
2973
                        " priority string (see GnuTLS documentation)")
2974
    parser.add_argument("--servicename",
2975
                        metavar="NAME", help="Zeroconf service name")
2976
    parser.add_argument("--configdir",
2977
                        default="/etc/mandos", metavar="DIR",
2978
                        help="Directory to search for configuration"
2979
                        " files")
2980
    parser.add_argument("--no-dbus", action="store_false",
2981
                        dest="use_dbus", help="Do not provide D-Bus"
618 by Teddy Hogeborn
* mandos: Bug fix: Make boolean options work from the config file
2982
                        " system bus interface", default=None)
474 by teddy at bsnet
* mandos: Use the new argparse library instead of optparse.
2983
    parser.add_argument("--no-ipv6", action="store_false",
618 by Teddy Hogeborn
* mandos: Bug fix: Make boolean options work from the config file
2984
                        dest="use_ipv6", help="Do not use IPv6",
2985
                        default=None)
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
2986
    parser.add_argument("--no-restore", action="store_false",
518.1.7 by Teddy Hogeborn
* mandos: Break long lines and fix some more white space.
2987
                        dest="restore", help="Do not restore stored"
618 by Teddy Hogeborn
* mandos: Bug fix: Make boolean options work from the config file
2988
                        " state", default=None)
589.1.1 by Teddy Hogeborn
* mandos: Implement "--socket" option.
2989
    parser.add_argument("--socket", type=int,
2990
                        help="Specify a file descriptor to a network"
2991
                        " socket to use instead of creating one")
518.2.2 by Teddy Hogeborn
Directory with persistent state can now be changed with the "statedir"
2992
    parser.add_argument("--statedir", metavar="DIR",
2993
                        help="Directory to save/restore state in")
606 by Teddy Hogeborn
* mandos: New "--foreground" option.
2994
    parser.add_argument("--foreground", action="store_true",
618 by Teddy Hogeborn
* mandos: Bug fix: Make boolean options work from the config file
2995
                        help="Run in foreground", default=None)
707 by Teddy Hogeborn
mandos: New "--no-zeroconf" option. Also make "--socket=0" work.
2996
    parser.add_argument("--no-zeroconf", action="store_false",
2997
                        dest="zeroconf", help="Do not use Zeroconf",
2998
                        default=None)
874 by Teddy Hogeborn
PEP8 compliance: mandos
2999
474 by teddy at bsnet
* mandos: Use the new argparse library instead of optparse.
3000
    options = parser.parse_args()
874 by Teddy Hogeborn
PEP8 compliance: mandos
3001
28 by Teddy Hogeborn
* server.conf: New file.
3002
    # Default values for config file for server-global settings
962 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
3003
    if gnutls.has_rawpk:
3004
        priority = ("SECURE128:!CTYPE-X.509:+CTYPE-RAWPK:!RSA"
3005
                    ":!VERS-ALL:+VERS-TLS1.3:%PROFILE_ULTRA")
3006
    else:
3007
        priority = ("SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
3008
                    ":+SIGN-DSA-SHA256")
874 by Teddy Hogeborn
PEP8 compliance: mandos
3009
    server_defaults = {"interface": "",
3010
                       "address": "",
3011
                       "port": "",
3012
                       "debug": "False",
962 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
3013
                       "priority": priority,
874 by Teddy Hogeborn
PEP8 compliance: mandos
3014
                       "servicename": "Mandos",
3015
                       "use_dbus": "True",
3016
                       "use_ipv6": "True",
3017
                       "debuglevel": "",
3018
                       "restore": "True",
3019
                       "socket": "",
3020
                       "statedir": "/var/lib/mandos",
3021
                       "foreground": "False",
3022
                       "zeroconf": "True",
3023
                       }
962 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
3024
    del priority
874 by Teddy Hogeborn
PEP8 compliance: mandos
3025
28 by Teddy Hogeborn
* server.conf: New file.
3026
    # Parse config file for server-global settings
1139 by Teddy Hogeborn
Update Python 3 compatibility
3027
    server_config = configparser.ConfigParser(server_defaults)
28 by Teddy Hogeborn
* server.conf: New file.
3028
    del server_defaults
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3029
    server_config.read(os.path.join(options.configdir, "mandos.conf"))
1139 by Teddy Hogeborn
Update Python 3 compatibility
3030
    # Convert the ConfigParser object to a dict
89 by Teddy Hogeborn
* Makefile: Bug fix: fixed creation of man pages for section 5 pages.
3031
    server_settings = server_config.defaults()
282 by Teddy Hogeborn
* mandos (main): Bug fix: use "getint" on the "port" config file
3032
    # Use the appropriate methods on the non-string config options
898 by Teddy Hogeborn
Server bug fix: Use the mandos.conf "zeroconf" and "restore" options
3033
    for option in ("debug", "use_dbus", "use_ipv6", "restore",
3034
                   "foreground", "zeroconf"):
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
3035
        server_settings[option] = server_config.getboolean("DEFAULT",
333 by Teddy Hogeborn
Minor code cleanup; one minor bug fix.
3036
                                                           option)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
3037
    if server_settings["port"]:
3038
        server_settings["port"] = server_config.getint("DEFAULT",
3039
                                                       "port")
589.1.1 by Teddy Hogeborn
* mandos: Implement "--socket" option.
3040
    if server_settings["socket"]:
3041
        server_settings["socket"] = server_config.getint("DEFAULT",
3042
                                                         "socket")
591 by Teddy Hogeborn
Merge "--socket" option for server.
3043
        # Later, stdin will, and stdout and stderr might, be dup'ed
589.1.1 by Teddy Hogeborn
* mandos: Implement "--socket" option.
3044
        # over with an opened os.devnull.  But we don't want this to
3045
        # happen with a supplied network socket.
3046
        if 0 <= server_settings["socket"] <= 2:
3047
            server_settings["socket"] = os.dup(server_settings
3048
                                               ["socket"])
28 by Teddy Hogeborn
* server.conf: New file.
3049
    del server_config
874 by Teddy Hogeborn
PEP8 compliance: mandos
3050
28 by Teddy Hogeborn
* server.conf: New file.
3051
    # Override the settings from the config file with command line
3052
    # options, if set.
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
3053
    for option in ("interface", "address", "port", "debug",
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3054
                   "priority", "servicename", "configdir", "use_dbus",
3055
                   "use_ipv6", "debuglevel", "restore", "statedir",
3056
                   "socket", "foreground", "zeroconf"):
28 by Teddy Hogeborn
* server.conf: New file.
3057
        value = getattr(options, option)
3058
        if value is not None:
3059
            server_settings[option] = value
3060
    del options
333 by Teddy Hogeborn
Minor code cleanup; one minor bug fix.
3061
    # Force all strings to be unicode
3062
    for option in server_settings.keys():
729 by Teddy Hogeborn
mandos: Stop using str() and remove unnecessary unicode() calls.
3063
        if isinstance(server_settings[option], bytes):
3064
            server_settings[option] = (server_settings[option]
3065
                                       .decode("utf-8"))
618 by Teddy Hogeborn
* mandos: Bug fix: Make boolean options work from the config file
3066
    # Force all boolean options to be boolean
3067
    for option in ("debug", "use_dbus", "use_ipv6", "restore",
707 by Teddy Hogeborn
mandos: New "--no-zeroconf" option. Also make "--socket=0" work.
3068
                   "foreground", "zeroconf"):
618 by Teddy Hogeborn
* mandos: Bug fix: Make boolean options work from the config file
3069
        server_settings[option] = bool(server_settings[option])
606 by Teddy Hogeborn
* mandos: New "--foreground" option.
3070
    # Debug implies foreground
3071
    if server_settings["debug"]:
3072
        server_settings["foreground"] = True
28 by Teddy Hogeborn
* server.conf: New file.
3073
    # Now we have our good server settings in "server_settings"
874 by Teddy Hogeborn
PEP8 compliance: mandos
3074
327 by Teddy Hogeborn
Merge from pipe IPC branch.
3075
    ##################################################################
874 by Teddy Hogeborn
PEP8 compliance: mandos
3076
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3077
    if (not server_settings["zeroconf"]
3078
        and not (server_settings["port"]
3079
                 or server_settings["socket"] != "")):
3080
        parser.error("Needs port or socket to work without Zeroconf")
874 by Teddy Hogeborn
PEP8 compliance: mandos
3081
243 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
3082
    # For convenience
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
3083
    debug = server_settings["debug"]
3084
    debuglevel = server_settings["debuglevel"]
3085
    use_dbus = server_settings["use_dbus"]
3086
    use_ipv6 = server_settings["use_ipv6"]
518.2.2 by Teddy Hogeborn
Directory with persistent state can now be changed with the "statedir"
3087
    stored_state_path = os.path.join(server_settings["statedir"],
3088
                                     stored_state_file)
606 by Teddy Hogeborn
* mandos: New "--foreground" option.
3089
    foreground = server_settings["foreground"]
707 by Teddy Hogeborn
mandos: New "--no-zeroconf" option. Also make "--socket=0" work.
3090
    zeroconf = server_settings["zeroconf"]
874 by Teddy Hogeborn
PEP8 compliance: mandos
3091
518.1.4 by Björn Påhlsson
restructured logger
3092
    if debug:
530 by teddy at bsnet
* mandos (initlogger): Take new "debug" argument; all callers changed.
3093
        initlogger(debug, logging.DEBUG)
518.1.4 by Björn Påhlsson
restructured logger
3094
    else:
3095
        if not debuglevel:
530 by teddy at bsnet
* mandos (initlogger): Take new "debug" argument; all callers changed.
3096
            initlogger(debug)
518.1.4 by Björn Påhlsson
restructured logger
3097
        else:
3098
            level = getattr(logging, debuglevel.upper())
530 by teddy at bsnet
* mandos (initlogger): Take new "debug" argument; all callers changed.
3099
            initlogger(debug, level)
874 by Teddy Hogeborn
PEP8 compliance: mandos
3100
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
3101
    if server_settings["servicename"] != "Mandos":
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3102
        syslogger.setFormatter(
3103
            logging.Formatter('Mandos ({}) [%(process)d]:'
3104
                              ' %(levelname)s: %(message)s'.format(
3105
                                  server_settings["servicename"])))
874 by Teddy Hogeborn
PEP8 compliance: mandos
3106
28 by Teddy Hogeborn
* server.conf: New file.
3107
    # Parse config file with clients
1139 by Teddy Hogeborn
Update Python 3 compatibility
3108
    client_config = configparser.ConfigParser(Client.client_defaults)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
3109
    client_config.read(os.path.join(server_settings["configdir"],
3110
                                    "clients.conf"))
874 by Teddy Hogeborn
PEP8 compliance: mandos
3111
327 by Teddy Hogeborn
Merge from pipe IPC branch.
3112
    global mandos_dbus_service
3113
    mandos_dbus_service = None
874 by Teddy Hogeborn
PEP8 compliance: mandos
3114
707 by Teddy Hogeborn
mandos: New "--no-zeroconf" option. Also make "--socket=0" work.
3115
    socketfd = None
3116
    if server_settings["socket"] != "":
3117
        socketfd = server_settings["socket"]
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3118
    tcp_server = MandosServer(
3119
        (server_settings["address"], server_settings["port"]),
3120
        ClientHandler,
3121
        interface=(server_settings["interface"] or None),
3122
        use_ipv6=use_ipv6,
3123
        gnutls_priority=server_settings["priority"],
3124
        use_dbus=use_dbus,
3125
        socketfd=socketfd)
606 by Teddy Hogeborn
* mandos: New "--foreground" option.
3126
    if not foreground:
626 by Teddy Hogeborn
* Makefile (CFLAGS, LDFLAGS): Keep default flags from environment.
3127
        pidfilename = "/run/mandos.pid"
636 by Teddy Hogeborn
Fall back to /var/run for pidfile if /run is not a directory.
3128
        if not os.path.isdir("/run/."):
3129
            pidfilename = "/var/run/mandos.pid"
606 by Teddy Hogeborn
* mandos: New "--foreground" option.
3130
        pidfile = None
439 by Teddy Hogeborn
* mandos: Do not write pid file if --debug is passed.
3131
        try:
751 by Teddy Hogeborn
mandos: Use codecs.open() and print() for PID file.
3132
            pidfile = codecs.open(pidfilename, "w", encoding="utf-8")
574 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
3133
        except IOError as e:
3134
            logger.error("Could not open file %r", pidfilename,
3135
                         exc_info=e)
874 by Teddy Hogeborn
PEP8 compliance: mandos
3136
816 by Teddy Hogeborn
Use "nogroup" as a fallback group, not "nobody".
3137
    for name, group in (("_mandos", "_mandos"),
3138
                        ("mandos", "mandos"),
3139
                        ("nobody", "nogroup")):
238 by Teddy Hogeborn
First version of a somewhat complete D-Bus server interface. Also
3140
        try:
566 by Teddy Hogeborn
* mandos (main): Simplify and shorten code selecting user and group ID
3141
            uid = pwd.getpwnam(name).pw_uid
816 by Teddy Hogeborn
Use "nogroup" as a fallback group, not "nobody".
3142
            gid = pwd.getpwnam(group).pw_gid
566 by Teddy Hogeborn
* mandos (main): Simplify and shorten code selecting user and group ID
3143
            break
238 by Teddy Hogeborn
First version of a somewhat complete D-Bus server interface. Also
3144
        except KeyError:
566 by Teddy Hogeborn
* mandos (main): Simplify and shorten code selecting user and group ID
3145
            continue
3146
    else:
3147
        uid = 65534
3148
        gid = 65534
163 by Teddy Hogeborn
* Makefile (PIDDIR, USER, GROUP): Removed.
3149
    try:
290 by Teddy Hogeborn
* mandos (main): Bug fix: Do setgid before setuid. Add verbose GnuTLS
3150
        os.setgid(gid)
163 by Teddy Hogeborn
* Makefile (PIDDIR, USER, GROUP): Removed.
3151
        os.setuid(uid)
825 by Teddy Hogeborn
Server bug fix: Include CAP_SETGID so it does not run as root
3152
        if debug:
3153
            logger.debug("Did setuid/setgid to {}:{}".format(uid,
3154
                                                             gid))
482 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
3155
    except OSError as error:
825 by Teddy Hogeborn
Server bug fix: Include CAP_SETGID so it does not run as root
3156
        logger.warning("Failed to setuid/setgid to {}:{}: {}"
3157
                       .format(uid, gid, os.strerror(error.errno)))
583 by Teddy Hogeborn
* mandos (Client.start_checker): Remove undocumented support for "%%s"
3158
        if error.errno != errno.EPERM:
642 by Teddy Hogeborn
Syntax fix; use "raise" better in Mandos server.
3159
            raise
874 by Teddy Hogeborn
PEP8 compliance: mandos
3160
290 by Teddy Hogeborn
* mandos (main): Bug fix: Do setgid before setuid. Add verbose GnuTLS
3161
    if debug:
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
3162
        # Enable all possible GnuTLS debugging
874 by Teddy Hogeborn
PEP8 compliance: mandos
3163
290 by Teddy Hogeborn
* mandos (main): Bug fix: Do setgid before setuid. Add verbose GnuTLS
3164
        # "Use a log level over 10 to enable all debugging options."
3165
        # - GnuTLS manual
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
3166
        gnutls.global_set_log_level(11)
874 by Teddy Hogeborn
PEP8 compliance: mandos
3167
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
3168
        @gnutls.log_func
290 by Teddy Hogeborn
* mandos (main): Bug fix: Do setgid before setuid. Add verbose GnuTLS
3169
        def debug_gnutls(level, string):
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
3170
            logger.debug("GnuTLS: %s", string[:-1])
874 by Teddy Hogeborn
PEP8 compliance: mandos
3171
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
3172
        gnutls.global_set_log_function(debug_gnutls)
874 by Teddy Hogeborn
PEP8 compliance: mandos
3173
24.1.155 by Björn Påhlsson
mandos server: Added debuglevel that adjust at what level information
3174
        # Redirect stdin so all checkers get /dev/null
560.1.1 by teddy at recompile
* mandos: Use os.devnull instead of os.path.devnull. Fix some white
3175
        null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
24.1.155 by Björn Påhlsson
mandos server: Added debuglevel that adjust at what level information
3176
        os.dup2(null, sys.stdin.fileno())
3177
        if null > 2:
3178
            os.close(null)
874 by Teddy Hogeborn
PEP8 compliance: mandos
3179
458 by teddy at bsnet
* mandos (main): Bug fix: Fork before connecting to D-Bus.
3180
    # Need to fork before connecting to D-Bus
606 by Teddy Hogeborn
* mandos: New "--foreground" option.
3181
    if not foreground:
458 by teddy at bsnet
* mandos (main): Bug fix: Fork before connecting to D-Bus.
3182
        # Close all input and output, do double fork, etc.
3183
        daemon()
874 by Teddy Hogeborn
PEP8 compliance: mandos
3184
1139 by Teddy Hogeborn
Update Python 3 compatibility
3185
    if gi.version_info < (3, 10, 2):
3186
        # multiprocessing will use threads, so before we use GLib we
3187
        # need to inform GLib that threads will be used.
3188
        GLib.threads_init()
874 by Teddy Hogeborn
PEP8 compliance: mandos
3189
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
3190
    global main_loop
3191
    # From the Avahi example code
560.1.1 by teddy at recompile
* mandos: Use os.devnull instead of os.path.devnull. Fix some white
3192
    DBusGMainLoop(set_as_default=True)
830 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
3193
    main_loop = GLib.MainLoop()
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
3194
    bus = dbus.SystemBus()
3195
    # End of Avahi example code
243 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
3196
    if use_dbus:
402 by Teddy Hogeborn
* mandos (Client.disable): Rename keyword argument "log" to "quiet",
3197
        try:
505 by Björn Påhlsson
The domain name has changed, so the D-Bus bus and interface names must
3198
            bus_name = dbus.service.BusName("se.recompile.Mandos",
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3199
                                            bus,
3200
                                            do_not_queue=True)
3201
            old_bus_name = dbus.service.BusName(
3202
                "se.bsnet.fukt.Mandos", bus,
3203
                do_not_queue=True)
750 by Teddy Hogeborn
mandos: Disable D-Bus if any DBusException is raised when connecting.
3204
        except dbus.exceptions.DBusException as e:
574 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
3205
            logger.error("Disabling D-Bus:", exc_info=e)
402 by Teddy Hogeborn
* mandos (Client.disable): Rename keyword argument "log" to "quiet",
3206
            use_dbus = False
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
3207
            server_settings["use_dbus"] = False
402 by Teddy Hogeborn
* mandos (Client.disable): Rename keyword argument "log" to "quiet",
3208
            tcp_server.use_dbus = False
707 by Teddy Hogeborn
mandos: New "--no-zeroconf" option. Also make "--socket=0" work.
3209
    if zeroconf:
3210
        protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3211
        service = AvahiServiceToSyslog(
874 by Teddy Hogeborn
PEP8 compliance: mandos
3212
            name=server_settings["servicename"],
3213
            servicetype="_mandos._tcp",
3214
            protocol=protocol,
3215
            bus=bus)
707 by Teddy Hogeborn
mandos: New "--no-zeroconf" option. Also make "--socket=0" work.
3216
        if server_settings["interface"]:
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3217
            service.interface = if_nametoindex(
3218
                server_settings["interface"].encode("utf-8"))
874 by Teddy Hogeborn
PEP8 compliance: mandos
3219
24.1.152 by Björn Påhlsson
bug fixes that prevent problems when runing server as root
3220
    global multiprocessing_manager
3221
    multiprocessing_manager = multiprocessing.Manager()
874 by Teddy Hogeborn
PEP8 compliance: mandos
3222
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
3223
    client_class = Client
3224
    if use_dbus:
874 by Teddy Hogeborn
PEP8 compliance: mandos
3225
        client_class = functools.partial(ClientDBus, bus=bus)
3226
518.1.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
3227
    client_settings = Client.config_parser(client_config)
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
3228
    old_client_settings = {}
518.1.15 by Björn Påhlsson
more refactoring in regards to how clients get created
3229
    clients_data = {}
874 by Teddy Hogeborn
PEP8 compliance: mandos
3230
617 by Teddy Hogeborn
* mandos: Bug fix: Don't print output from checkers when running in
3231
    # This is used to redirect stdout and stderr for checker processes
3232
    global wnull
874 by Teddy Hogeborn
PEP8 compliance: mandos
3233
    wnull = open(os.devnull, "w")  # A writable /dev/null
617 by Teddy Hogeborn
* mandos: Bug fix: Don't print output from checkers when running in
3234
    # Only used if server is running in foreground but not in debug
3235
    # mode
3236
    if debug or not foreground:
3237
        wnull.close()
874 by Teddy Hogeborn
PEP8 compliance: mandos
3238
518.1.7 by Teddy Hogeborn
* mandos: Break long lines and fix some more white space.
3239
    # Get client data and settings from last running state.
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
3240
    if server_settings["restore"]:
3241
        try:
3242
            with open(stored_state_path, "rb") as stored_state:
874 by Teddy Hogeborn
PEP8 compliance: mandos
3243
                if sys.version_info.major == 2:
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
3244
                    clients_data, old_client_settings = pickle.load(
3245
                        stored_state)
3246
                else:
3247
                    bytes_clients_data, bytes_old_client_settings = (
874 by Teddy Hogeborn
PEP8 compliance: mandos
3248
                        pickle.load(stored_state, encoding="bytes"))
3249
                    #   Fix bytes to strings
3250
                    #  clients_data
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
3251
                    # .keys()
874 by Teddy Hogeborn
PEP8 compliance: mandos
3252
                    clients_data = {(key.decode("utf-8")
3253
                                     if isinstance(key, bytes)
3254
                                     else key): value
3255
                                    for key, value in
3256
                                    bytes_clients_data.items()}
829 by Teddy Hogeborn
Server: Fix minor thing with Python 3 compatibility
3257
                    del bytes_clients_data
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
3258
                    for key in clients_data:
874 by Teddy Hogeborn
PEP8 compliance: mandos
3259
                        value = {(k.decode("utf-8")
3260
                                  if isinstance(k, bytes) else k): v
3261
                                 for k, v in
3262
                                 clients_data[key].items()}
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
3263
                        clients_data[key] = value
3264
                        # .client_structure
3265
                        value["client_structure"] = [
3266
                            (s.decode("utf-8")
3267
                             if isinstance(s, bytes)
3268
                             else s) for s in
874 by Teddy Hogeborn
PEP8 compliance: mandos
3269
                            value["client_structure"]]
1173 by Teddy Hogeborn
Fix minor Python 3 bytes/str mixups
3270
                        # .name, .host, and .checker_command
3271
                        for k in ("name", "host", "checker_command"):
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
3272
                            if isinstance(value[k], bytes):
3273
                                value[k] = value[k].decode("utf-8")
1130 by Teddy Hogeborn
Update Python 3 compatibility
3274
                        if "key_id" not in value:
962 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
3275
                            value["key_id"] = ""
1130 by Teddy Hogeborn
Update Python 3 compatibility
3276
                        elif "fingerprint" not in value:
962 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
3277
                            value["fingerprint"] = ""
874 by Teddy Hogeborn
PEP8 compliance: mandos
3278
                    #  old_client_settings
829 by Teddy Hogeborn
Server: Fix minor thing with Python 3 compatibility
3279
                    # .keys()
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
3280
                    old_client_settings = {
3281
                        (key.decode("utf-8")
3282
                         if isinstance(key, bytes)
3283
                         else key): value
3284
                        for key, value in
874 by Teddy Hogeborn
PEP8 compliance: mandos
3285
                        bytes_old_client_settings.items()}
829 by Teddy Hogeborn
Server: Fix minor thing with Python 3 compatibility
3286
                    del bytes_old_client_settings
1173 by Teddy Hogeborn
Fix minor Python 3 bytes/str mixups
3287
                    # .host and .checker_command
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
3288
                    for value in old_client_settings.values():
1173 by Teddy Hogeborn
Fix minor Python 3 bytes/str mixups
3289
                        for attribute in ("host", "checker_command"):
3290
                            if isinstance(value[attribute], bytes):
3291
                                value[attribute] = (value[attribute]
3292
                                                    .decode("utf-8"))
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
3293
            os.remove(stored_state_path)
3294
        except IOError as e:
574 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
3295
            if e.errno == errno.ENOENT:
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3296
                logger.warning("Could not load persistent state:"
3297
                               " {}".format(os.strerror(e.errno)))
574 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
3298
            else:
3299
                logger.critical("Could not load persistent state:",
3300
                                exc_info=e)
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
3301
                raise
505.1.23 by Teddy Hogeborn
* mandos (main): Handle EOFError when reading state file.
3302
        except EOFError as e:
3303
            logger.warning("Could not load persistent state: "
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3304
                           "EOFError:",
3305
                           exc_info=e)
874 by Teddy Hogeborn
PEP8 compliance: mandos
3306
518.1.9 by Björn Påhlsson
renamed variables
3307
    with PGPEngine() as pgp:
723.1.4 by Teddy Hogeborn
Use the .items() method instead of .iteritems().
3308
        for client_name, client in clients_data.items():
617 by Teddy Hogeborn
* mandos: Bug fix: Don't print output from checkers when running in
3309
            # Skip removed clients
3310
            if client_name not in client_settings:
3311
                continue
874 by Teddy Hogeborn
PEP8 compliance: mandos
3312
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
3313
            # Decide which value to use after restoring saved state.
3314
            # We have three different values: Old config file,
3315
            # new config file, and saved state.
3316
            # New config value takes precedence if it differs from old
3317
            # config value, otherwise use saved state.
3318
            for name, value in client_settings[client_name].items():
3319
                try:
3320
                    # For each value in new config, check if it
3321
                    # differs from the old config value (Except for
3322
                    # the "secret" attribute)
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3323
                    if (name != "secret"
3324
                        and (value !=
3325
                             old_client_settings[client_name][name])):
518.2.10 by Teddy Hogeborn
* mandos (main): Bug fix: Syntax fix when restoring settings.
3326
                        client[name] = value
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
3327
                except KeyError:
3328
                    pass
874 by Teddy Hogeborn
PEP8 compliance: mandos
3329
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
3330
            # Clients who has passed its expire date can still be
749.1.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
3331
            # enabled if its last checker was successful.  A Client
552 by teddy at recompile
* mandos: Consistent terminology; use the term "secret" for the
3332
            # whose checker succeeded before we stored its state is
3333
            # assumed to have successfully run all checkers during
3334
            # downtime.
518.2.8 by Teddy Hogeborn
* mandos (ClientDBus.Host_dbus_property,
3335
            if client["enabled"]:
518.1.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
3336
                if datetime.datetime.utcnow() >= client["expires"]:
3337
                    if not client["last_checked_ok"]:
3338
                        logger.warning(
723.1.5 by Teddy Hogeborn
Use the new auto-numbered "{}" syntax for the .format() string method.
3339
                            "disabling client {} - Client never "
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3340
                            "performed a successful checker".format(
3341
                                client_name))
518.1.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
3342
                        client["enabled"] = False
3343
                    elif client["last_checker_status"] != 0:
3344
                        logger.warning(
723.1.5 by Teddy Hogeborn
Use the new auto-numbered "{}" syntax for the .format() string method.
3345
                            "disabling client {} - Client last"
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3346
                            " checker failed with error code"
3347
                            " {}".format(
3348
                                client_name,
3349
                                client["last_checker_status"]))
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
3350
                        client["enabled"] = False
3351
                    else:
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3352
                        client["expires"] = (
3353
                            datetime.datetime.utcnow()
3354
                            + client["timeout"])
542 by Björn Påhlsson
fixed bug with bad stored config state for expires and last_checked_ok.
3355
                        logger.debug("Last checker succeeded,"
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3356
                                     " keeping {} enabled".format(
3357
                                         client_name))
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
3358
            try:
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3359
                client["secret"] = pgp.decrypt(
3360
                    client["encrypted_secret"],
3361
                    client_settings[client_name]["secret"])
518.1.9 by Björn Påhlsson
renamed variables
3362
            except PGPError:
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
3363
                # If decryption fails, we use secret from new settings
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3364
                logger.debug("Failed to decrypt {} old secret".format(
3365
                    client_name))
3366
                client["secret"] = (client_settings[client_name]
3367
                                    ["secret"])
874 by Teddy Hogeborn
PEP8 compliance: mandos
3368
518.1.15 by Björn Påhlsson
more refactoring in regards to how clients get created
3369
    # Add/remove clients based on new changes made to config
543 by Teddy Hogeborn
* mandos: Break some long lines.
3370
    for client_name in (set(old_client_settings)
3371
                        - set(client_settings)):
518.1.15 by Björn Påhlsson
more refactoring in regards to how clients get created
3372
        del clients_data[client_name]
543 by Teddy Hogeborn
* mandos: Break some long lines.
3373
    for client_name in (set(client_settings)
3374
                        - set(old_client_settings)):
518.1.15 by Björn Påhlsson
more refactoring in regards to how clients get created
3375
        clients_data[client_name] = client_settings[client_name]
874 by Teddy Hogeborn
PEP8 compliance: mandos
3376
552 by teddy at recompile
* mandos: Consistent terminology; use the term "secret" for the
3377
    # Create all client objects
723.1.4 by Teddy Hogeborn
Use the .items() method instead of .iteritems().
3378
    for client_name, client in clients_data.items():
518.1.15 by Björn Påhlsson
more refactoring in regards to how clients get created
3379
        tcp_server.clients[client_name] = client_class(
874 by Teddy Hogeborn
PEP8 compliance: mandos
3380
            name=client_name,
3381
            settings=client,
3382
            server_settings=server_settings)
3383
341 by Teddy Hogeborn
Code cleanup and one bug fix.
3384
    if not tcp_server.clients:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
3385
        logger.warning("No clients defined")
874 by Teddy Hogeborn
PEP8 compliance: mandos
3386
606 by Teddy Hogeborn
* mandos: New "--foreground" option.
3387
    if not foreground:
3388
        if pidfile is not None:
751 by Teddy Hogeborn
mandos: Use codecs.open() and print() for PID file.
3389
            pid = os.getpid()
606 by Teddy Hogeborn
* mandos: New "--foreground" option.
3390
            try:
3391
                with pidfile:
751 by Teddy Hogeborn
mandos: Use codecs.open() and print() for PID file.
3392
                    print(pid, file=pidfile)
606 by Teddy Hogeborn
* mandos: New "--foreground" option.
3393
            except IOError:
3394
                logger.error("Could not write to file %r with PID %d",
3395
                             pidfilename, pid)
3396
        del pidfile
439 by Teddy Hogeborn
* mandos: Do not write pid file if --debug is passed.
3397
        del pidfilename
874 by Teddy Hogeborn
PEP8 compliance: mandos
3398
831 by Teddy Hogeborn
Server: Fix bug where it did not exit timely on signals
3399
    for termsig in (signal.SIGHUP, signal.SIGTERM):
3400
        GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,
3401
                             lambda: main_loop.quit() and False)
874 by Teddy Hogeborn
PEP8 compliance: mandos
3402
243 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
3403
    if use_dbus:
874 by Teddy Hogeborn
PEP8 compliance: mandos
3404
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3405
        @alternate_dbus_interfaces(
874 by Teddy Hogeborn
PEP8 compliance: mandos
3406
            {"se.recompile.Mandos": "se.bsnet.fukt.Mandos"})
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
3407
        class MandosDBusService(DBusObjectWithObjectManager):
243 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
3408
            """A D-Bus proxy object"""
874 by Teddy Hogeborn
PEP8 compliance: mandos
3409
243 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
3410
            def __init__(self):
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
3411
                dbus.service.Object.__init__(self, bus, "/")
874 by Teddy Hogeborn
PEP8 compliance: mandos
3412
505.1.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
3413
            _interface = "se.recompile.Mandos"
874 by Teddy Hogeborn
PEP8 compliance: mandos
3414
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
3415
            @dbus.service.signal(_interface, signature="o")
411 by Teddy Hogeborn
More consistent terminology: Clients are no longer "invalid" - they
3416
            def ClientAdded(self, objpath):
243 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
3417
                "D-Bus signal"
3418
                pass
874 by Teddy Hogeborn
PEP8 compliance: mandos
3419
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
3420
            @dbus.service.signal(_interface, signature="ss")
962 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
3421
            def ClientNotFound(self, key_id, address):
327 by Teddy Hogeborn
Merge from pipe IPC branch.
3422
                "D-Bus signal"
3423
                pass
874 by Teddy Hogeborn
PEP8 compliance: mandos
3424
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
3425
            @dbus_annotations({"org.freedesktop.DBus.Deprecated":
3426
                               "true"})
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
3427
            @dbus.service.signal(_interface, signature="os")
278 by Teddy Hogeborn
* mandos (Client.GetAllProperties): Also send Client.dbus_object_path
3428
            def ClientRemoved(self, objpath, name):
243 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
3429
                "D-Bus signal"
3430
                pass
874 by Teddy Hogeborn
PEP8 compliance: mandos
3431
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
3432
            @dbus_annotations({"org.freedesktop.DBus.Deprecated":
3433
                               "true"})
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
3434
            @dbus.service.method(_interface, out_signature="ao")
243 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
3435
            def GetAllClients(self):
283 by Teddy Hogeborn
* mandos (peer_certificate): Handle NULL pointer from
3436
                "D-Bus method"
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3437
                return dbus.Array(c.dbus_object_path for c in
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
3438
                                  tcp_server.clients.values())
874 by Teddy Hogeborn
PEP8 compliance: mandos
3439
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
3440
            @dbus_annotations({"org.freedesktop.DBus.Deprecated":
3441
                               "true"})
333 by Teddy Hogeborn
Minor code cleanup; one minor bug fix.
3442
            @dbus.service.method(_interface,
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
3443
                                 out_signature="a{oa{sv}}")
243 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
3444
            def GetAllClientsWithProperties(self):
283 by Teddy Hogeborn
* mandos (peer_certificate): Handle NULL pointer from
3445
                "D-Bus method"
243 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
3446
                return dbus.Dictionary(
874 by Teddy Hogeborn
PEP8 compliance: mandos
3447
                    {c.dbus_object_path: c.GetAll(
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
3448
                        "se.recompile.Mandos.Client")
874 by Teddy Hogeborn
PEP8 compliance: mandos
3449
                     for c in tcp_server.clients.values()},
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
3450
                    signature="oa{sv}")
874 by Teddy Hogeborn
PEP8 compliance: mandos
3451
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
3452
            @dbus.service.method(_interface, in_signature="o")
243 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
3453
            def RemoveClient(self, object_path):
283 by Teddy Hogeborn
* mandos (peer_certificate): Handle NULL pointer from
3454
                "D-Bus method"
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
3455
                for c in tcp_server.clients.values():
243 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
3456
                    if c.dbus_object_path == object_path:
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
3457
                        del tcp_server.clients[c.name]
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
3458
                        c.remove_from_connection()
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
3459
                        # Don't signal the disabling
402 by Teddy Hogeborn
* mandos (Client.disable): Rename keyword argument "log" to "quiet",
3460
                        c.disable(quiet=True)
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
3461
                        # Emit D-Bus signal for removal
3462
                        self.client_removed_signal(c)
278 by Teddy Hogeborn
* mandos (Client.GetAllProperties): Also send Client.dbus_object_path
3463
                        return
400 by Teddy Hogeborn
* mandos (Client.enable): Bug fix: Start new immediate checker last to
3464
                raise KeyError(object_path)
874 by Teddy Hogeborn
PEP8 compliance: mandos
3465
243 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
3466
            del _interface
874 by Teddy Hogeborn
PEP8 compliance: mandos
3467
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
3468
            @dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
874 by Teddy Hogeborn
PEP8 compliance: mandos
3469
                                 out_signature="a{oa{sa{sv}}}")
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
3470
            def GetManagedObjects(self):
3471
                """D-Bus method"""
3472
                return dbus.Dictionary(
874 by Teddy Hogeborn
PEP8 compliance: mandos
3473
                    {client.dbus_object_path:
3474
                     dbus.Dictionary(
3475
                         {interface: client.GetAll(interface)
3476
                          for interface in
3477
                          client._get_all_interface_names()})
3478
                     for client in tcp_server.clients.values()})
3479
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
3480
            def client_added_signal(self, client):
3481
                """Send the new standard signal and the old signal"""
3482
                if use_dbus:
3483
                    # New standard signal
3484
                    self.InterfacesAdded(
3485
                        client.dbus_object_path,
3486
                        dbus.Dictionary(
874 by Teddy Hogeborn
PEP8 compliance: mandos
3487
                            {interface: client.GetAll(interface)
3488
                             for interface in
3489
                             client._get_all_interface_names()}))
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
3490
                    # Old signal
3491
                    self.ClientAdded(client.dbus_object_path)
874 by Teddy Hogeborn
PEP8 compliance: mandos
3492
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
3493
            def client_removed_signal(self, client):
3494
                """Send the new standard signal and the old signal"""
3495
                if use_dbus:
3496
                    # New standard signal
3497
                    self.InterfacesRemoved(
3498
                        client.dbus_object_path,
3499
                        client._get_all_interface_names())
3500
                    # Old signal
3501
                    self.ClientRemoved(client.dbus_object_path,
3502
                                       client.name)
874 by Teddy Hogeborn
PEP8 compliance: mandos
3503
575 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
3504
        mandos_dbus_service = MandosDBusService()
874 by Teddy Hogeborn
PEP8 compliance: mandos
3505
850 by Teddy Hogeborn
mandos: Bug fix: Do multiprocessing cleanup correctly on exit
3506
    # Save modules to variables to exempt the modules from being
3507
    # unloaded before the function registered with atexit() is run.
3508
    mp = multiprocessing
3509
    wn = wnull
874 by Teddy Hogeborn
PEP8 compliance: mandos
3510
400 by Teddy Hogeborn
* mandos (Client.enable): Bug fix: Start new immediate checker last to
3511
    def cleanup():
3512
        "Cleanup function; run on exit"
707 by Teddy Hogeborn
mandos: New "--no-zeroconf" option. Also make "--socket=0" work.
3513
        if zeroconf:
3514
            service.cleanup()
874 by Teddy Hogeborn
PEP8 compliance: mandos
3515
850 by Teddy Hogeborn
mandos: Bug fix: Do multiprocessing cleanup correctly on exit
3516
        mp.active_children()
3517
        wn.close()
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
3518
        if not (tcp_server.clients or client_settings):
3519
            return
874 by Teddy Hogeborn
PEP8 compliance: mandos
3520
521 by teddy at bsnet
* debian/control (mandos/Depends): Added "python-crypto".
3521
        # Store client before exiting. Secrets are encrypted with key
3522
        # based on what config file has. If config file is
3523
        # removed/edited, old secret will thus be unrecovable.
518.1.15 by Björn Påhlsson
more refactoring in regards to how clients get created
3524
        clients = {}
518.1.9 by Björn Påhlsson
renamed variables
3525
        with PGPEngine() as pgp:
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
3526
            for client in tcp_server.clients.values():
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
3527
                key = client_settings[client.name]["secret"]
518.1.9 by Björn Påhlsson
renamed variables
3528
                client.encrypted_secret = pgp.encrypt(client.secret,
3529
                                                      key)
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
3530
                client_dict = {}
874 by Teddy Hogeborn
PEP8 compliance: mandos
3531
518.1.15 by Björn Påhlsson
more refactoring in regards to how clients get created
3532
                # A list of attributes that can not be pickled
3533
                # + secret.
874 by Teddy Hogeborn
PEP8 compliance: mandos
3534
                exclude = {"bus", "changedstate", "secret",
3535
                           "checker", "server_settings"}
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3536
                for name, typ in inspect.getmembers(dbus.service
3537
                                                    .Object):
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
3538
                    exclude.add(name)
874 by Teddy Hogeborn
PEP8 compliance: mandos
3539
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
3540
                client_dict["encrypted_secret"] = (client
3541
                                                   .encrypted_secret)
3542
                for attr in client.client_structure:
3543
                    if attr not in exclude:
3544
                        client_dict[attr] = getattr(client, attr)
874 by Teddy Hogeborn
PEP8 compliance: mandos
3545
518.1.15 by Björn Påhlsson
more refactoring in regards to how clients get created
3546
                clients[client.name] = client_dict
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
3547
                del client_settings[client.name]["secret"]
874 by Teddy Hogeborn
PEP8 compliance: mandos
3548
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
3549
        try:
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3550
            with tempfile.NamedTemporaryFile(
3551
                    mode='wb',
3552
                    suffix=".pickle",
3553
                    prefix='clients-',
3554
                    dir=os.path.dirname(stored_state_path),
3555
                    delete=False) as stored_state:
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
3556
                pickle.dump((clients, client_settings), stored_state,
874 by Teddy Hogeborn
PEP8 compliance: mandos
3557
                            protocol=2)
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3558
                tempname = stored_state.name
505.1.26 by teddy at bsnet
* mandos (main/cleanup): Write new file, then rename. Use
3559
            os.rename(tempname, stored_state_path)
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
3560
        except (IOError, OSError) as e:
530 by teddy at bsnet
* mandos (initlogger): Take new "debug" argument; all callers changed.
3561
            if not debug:
3562
                try:
3563
                    os.remove(tempname)
3564
                except NameError:
3565
                    pass
574 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
3566
            if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
723.1.5 by Teddy Hogeborn
Use the new auto-numbered "{}" syntax for the .format() string method.
3567
                logger.warning("Could not save persistent state: {}"
574 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
3568
                               .format(os.strerror(e.errno)))
3569
            else:
3570
                logger.warning("Could not save persistent state:",
3571
                               exc_info=e)
642 by Teddy Hogeborn
Syntax fix; use "raise" better in Mandos server.
3572
                raise
874 by Teddy Hogeborn
PEP8 compliance: mandos
3573
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
3574
        # Delete all clients, and settings from config
400 by Teddy Hogeborn
* mandos (Client.enable): Bug fix: Start new immediate checker last to
3575
        while tcp_server.clients:
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
3576
            name, client = tcp_server.clients.popitem()
402 by Teddy Hogeborn
* mandos (Client.disable): Rename keyword argument "log" to "quiet",
3577
            if use_dbus:
3578
                client.remove_from_connection()
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
3579
            # Don't signal the disabling
402 by Teddy Hogeborn
* mandos (Client.disable): Rename keyword argument "log" to "quiet",
3580
            client.disable(quiet=True)
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
3581
            # Emit D-Bus signal for removal
796 by Teddy Hogeborn
On cleanup, Signal ClientRemoved only if using D-Bus.
3582
            if use_dbus:
3583
                mandos_dbus_service.client_removed_signal(client)
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
3584
        client_settings.clear()
874 by Teddy Hogeborn
PEP8 compliance: mandos
3585
400 by Teddy Hogeborn
* mandos (Client.enable): Bug fix: Start new immediate checker last to
3586
    atexit.register(cleanup)
874 by Teddy Hogeborn
PEP8 compliance: mandos
3587
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
3588
    for client in tcp_server.clients.values():
243 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
3589
        if use_dbus:
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
3590
            # Emit D-Bus signal for adding
3591
            mandos_dbus_service.client_added_signal(client)
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
3592
        # Need to initiate checking of clients
3593
        if client.enabled:
3594
            client.init_checker()
874 by Teddy Hogeborn
PEP8 compliance: mandos
3595
163 by Teddy Hogeborn
* Makefile (PIDDIR, USER, GROUP): Removed.
3596
    tcp_server.enable()
3597
    tcp_server.server_activate()
874 by Teddy Hogeborn
PEP8 compliance: mandos
3598
28 by Teddy Hogeborn
* server.conf: New file.
3599
    # Find out what port we got
707 by Teddy Hogeborn
mandos: New "--no-zeroconf" option. Also make "--socket=0" work.
3600
    if zeroconf:
3601
        service.port = tcp_server.socket.getsockname()[1]
314 by Teddy Hogeborn
Support not using IPv6 in server:
3602
    if use_ipv6:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
3603
        logger.info("Now listening on address %r, port %d,"
568 by Teddy Hogeborn
* mandos-monitor: Use new string format method.
3604
                    " flowinfo %d, scope_id %d",
3605
                    *tcp_server.socket.getsockname())
314 by Teddy Hogeborn
Support not using IPv6 in server:
3606
    else:                       # IPv4
568 by Teddy Hogeborn
* mandos-monitor: Use new string format method.
3607
        logger.info("Now listening on address %r, port %d",
3608
                    *tcp_server.socket.getsockname())
874 by Teddy Hogeborn
PEP8 compliance: mandos
3609
3610
    # service.interface = tcp_server.socket.getsockname()[3]
3611
28 by Teddy Hogeborn
* server.conf: New file.
3612
    try:
707 by Teddy Hogeborn
mandos: New "--no-zeroconf" option. Also make "--socket=0" work.
3613
        if zeroconf:
3614
            # From the Avahi example code
3615
            try:
3616
                service.activate()
3617
            except dbus.exceptions.DBusException as error:
3618
                logger.critical("D-Bus Exception", exc_info=error)
3619
                cleanup()
3620
                sys.exit(1)
3621
            # End of Avahi example code
874 by Teddy Hogeborn
PEP8 compliance: mandos
3622
1168 by Teddy Hogeborn
Server: Fully use new GLib.io_add_watch() call signature
3623
        GLib.io_add_watch(
3624
            GLib.IOChannel.unix_new(tcp_server.fileno()),
3625
            GLib.PRIORITY_DEFAULT, GLib.IO_IN,
3626
            lambda *args, **kwargs: (tcp_server.handle_request
3627
                                     (*args[2:], **kwargs) or True))
874 by Teddy Hogeborn
PEP8 compliance: mandos
3628
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
3629
        logger.debug("Starting main loop")
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
3630
        main_loop.run()
482 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
3631
    except AvahiError as error:
565 by Teddy Hogeborn
* mandos (AvahiService.rename, Client.start_checker,
3632
        logger.critical("Avahi Error", exc_info=error)
401 by Teddy Hogeborn
* README (FAQ): Fix typo.
3633
        cleanup()
28 by Teddy Hogeborn
* server.conf: New file.
3634
        sys.exit(1)
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
3635
    except KeyboardInterrupt:
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
3636
        if debug:
463.1.5 by teddy at bsnet
* mandos: Use unicode string literals.
3637
            print("", file=sys.stderr)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
3638
        logger.debug("Server received KeyboardInterrupt")
3639
    logger.debug("Server exiting")
401 by Teddy Hogeborn
* README (FAQ): Fix typo.
3640
    # Must run before the D-Bus bus name gets deregistered
3641
    cleanup()
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
3642
1165 by Teddy Hogeborn
Server: Add scaffolding for tests
3643

3644
def should_only_run_tests():
3645
    parser = argparse.ArgumentParser(add_help=False)
3646
    parser.add_argument("--check", action='store_true')
3647
    args, unknown_args = parser.parse_known_args()
3648
    run_tests = args.check
3649
    if run_tests:
3650
        # Remove --check argument from sys.argv
3651
        sys.argv[1:] = unknown_args
3652
    return run_tests
3653
3654
# Add all tests from doctest strings
3655
def load_tests(loader, tests, none):
3656
    import doctest
3657
    tests.addTests(doctest.DocTestSuite())
3658
    return tests
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3659
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
3660
if __name__ == '__main__':
1165 by Teddy Hogeborn
Server: Add scaffolding for tests
3661
    try:
3662
        if should_only_run_tests():
3663
            # Call using ./mandos --check [--verbose]
3664
            unittest.main()
3665
        else:
3666
            main()
3667
    finally:
3668
        logging.shutdown()