/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk
806 by Teddy Hogeborn
Fix Debian dependency bugs and lintian checks.
1
#!/usr/bin/python
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
2
# -*- mode: python; coding: utf-8 -*-
874 by Teddy Hogeborn
PEP8 compliance: mandos
3
#
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
4
# Mandos server - give out binary blobs to connecting clients.
874 by Teddy Hogeborn
PEP8 compliance: mandos
5
#
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
6
# This program is partly derived from an example program for an Avahi
7
# service publisher, downloaded from
8
# <http://avahi.org/wiki/PythonPublishExample>.  This includes the
336 by Teddy Hogeborn
Code cleanup.
9
# methods "add", "remove", "server_state_changed",
10
# "entry_group_state_changed", "cleanup", and "activate" in the
11
# "AvahiService" class, and some lines in "main".
874 by Teddy Hogeborn
PEP8 compliance: mandos
12
#
28 by Teddy Hogeborn
* server.conf: New file.
13
# Everything else is
969 by Teddy Hogeborn
Update copyright year to 2019
14
# Copyright © 2008-2019 Teddy Hogeborn
15
# Copyright © 2008-2019 Björn Påhlsson
874 by Teddy Hogeborn
PEP8 compliance: mandos
16
#
907 by Teddy Hogeborn
Alter copyright notices slightly. Actual license is unchanged!
17
# This file is part of Mandos.
18
#
19
# Mandos is free software: you can redistribute it and/or modify it
20
# under the terms of the GNU General Public License as published by
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
21
# the Free Software Foundation, either version 3 of the License, or
22
# (at your option) any later version.
23
#
907 by Teddy Hogeborn
Alter copyright notices slightly. Actual license is unchanged!
24
#     Mandos is distributed in the hope that it will be useful, but
25
#     WITHOUT ANY WARRANTY; without even the implied warranty of
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
26
#     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
27
#     GNU General Public License for more details.
874 by Teddy Hogeborn
PEP8 compliance: mandos
28
#
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
29
# You should have received a copy of the GNU General Public License
907 by Teddy Hogeborn
Alter copyright notices slightly. Actual license is unchanged!
30
# along with Mandos.  If not, see <http://www.gnu.org/licenses/>.
874 by Teddy Hogeborn
PEP8 compliance: mandos
31
#
505.1.2 by Teddy Hogeborn
Change "fukt.bsnet.se" to "recompile.se" throughout.
32
# Contact the authors at <mandos@recompile.se>.
874 by Teddy Hogeborn
PEP8 compliance: mandos
33
#
3 by Björn Påhlsson
Python based server
34
463.1.5 by teddy at bsnet
* mandos: Use unicode string literals.
35
from __future__ import (division, absolute_import, print_function,
36
                        unicode_literals)
10 by Teddy Hogeborn
* server.py: Bug fix: Do "from __future__ import division".
37
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
38
try:
39
    from future_builtins import *
40
except ImportError:
41
    pass
579 by Teddy Hogeborn
* mandos: Use all new builtins.
42
749 by Teddy Hogeborn
mandos: Some more minor changes to prepare for Python 3.
43
try:
44
    import SocketServer as socketserver
45
except ImportError:
46
    import socketserver
3 by Björn Påhlsson
Python based server
47
import socket
474 by teddy at bsnet
* mandos: Use the new argparse library instead of optparse.
48
import argparse
3 by Björn Påhlsson
Python based server
49
import datetime
50
import errno
749 by Teddy Hogeborn
mandos: Some more minor changes to prepare for Python 3.
51
try:
52
    import ConfigParser as configparser
53
except ImportError:
54
    import configparser
4 by Teddy Hogeborn
* server.py (Client.created, Client.next_check): New.
55
import sys
9 by Teddy Hogeborn
* client.cpp (main): Get t_old early since it is used on error exits.
56
import re
57
import os
58
import signal
10 by Teddy Hogeborn
* server.py: Bug fix: Do "from __future__ import division".
59
import subprocess
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
60
import atexit
61
import stat
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
62
import logging
63
import logging.handlers
163 by Teddy Hogeborn
* Makefile (PIDDIR, USER, GROUP): Removed.
64
import pwd
411 by Teddy Hogeborn
More consistent terminology: Clients are no longer "invalid" - they
65
import contextlib
333 by Teddy Hogeborn
Minor code cleanup; one minor bug fix.
66
import struct
67
import fcntl
337 by Teddy Hogeborn
Code cleanup. Move some global stuff into main.
68
import functools
749 by Teddy Hogeborn
mandos: Some more minor changes to prepare for Python 3.
69
try:
70
    import cPickle as pickle
71
except ImportError:
72
    import pickle
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
73
import multiprocessing
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
74
import types
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
75
import binascii
76
import tempfile
560.1.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
77
import itertools
609 by Teddy Hogeborn
* clients.conf: Convert all time intervals to new RFC 3339 syntax.
78
import collections
751 by Teddy Hogeborn
mandos: Use codecs.open() and print() for PID file.
79
import codecs
5 by Teddy Hogeborn
* server.py (server_metaclass): New.
80
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
81
import dbus
237.1.1 by Teddy Hogeborn
First steps of a D-Bus interface to the server.
82
import dbus.service
830 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
83
from gi.repository import GLib
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
84
from dbus.mainloop.glib import DBusGMainLoop
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
85
import ctypes
215 by Teddy Hogeborn
* mandos: Remove unused "select" module. Import "ctypes.util".
86
import ctypes.util
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
87
import xml.dom.minidom
88
import inspect
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
89
852 by Teddy Hogeborn
mandos: Bug fix for Python 2.7 and the "--interface" option
90
# Try to find the value of SO_BINDTODEVICE:
331 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
91
try:
852 by Teddy Hogeborn
mandos: Bug fix for Python 2.7 and the "--interface" option
92
    # This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and
93
    # newer, and it is also the most natural place for it:
331 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
94
    SO_BINDTODEVICE = socket.SO_BINDTODEVICE
95
except AttributeError:
96
    try:
852 by Teddy Hogeborn
mandos: Bug fix for Python 2.7 and the "--interface" option
97
        # This is where SO_BINDTODEVICE was up to and including Python
98
        # 2.6, and also 3.2:
331 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
99
        from IN import SO_BINDTODEVICE
100
    except ImportError:
852 by Teddy Hogeborn
mandos: Bug fix for Python 2.7 and the "--interface" option
101
        # In Python 2.7 it seems to have been removed entirely.
102
        # Try running the C preprocessor:
103
        try:
104
            cc = subprocess.Popen(["cc", "--language=c", "-E",
105
                                   "/dev/stdin"],
106
                                  stdin=subprocess.PIPE,
107
                                  stdout=subprocess.PIPE)
108
            stdout = cc.communicate(
109
                "#include <sys/socket.h>\nSO_BINDTODEVICE\n")[0]
110
            SO_BINDTODEVICE = int(stdout.splitlines()[-1])
111
        except (OSError, ValueError, IndexError):
112
            # No value found
113
            SO_BINDTODEVICE = None
331 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
114
730 by Teddy Hogeborn
mandos: Replace unicode() with str().
115
if sys.version_info.major == 2:
116
    str = unicode
117
237.4.114 by Teddy Hogeborn
* Makefile (version): Change to 1.8.4.
118
version = "1.8.4"
518.2.2 by Teddy Hogeborn
Directory with persistent state can now be changed with the "statedir"
119
stored_state_file = "clients.pickle"
13 by Björn Påhlsson
Added following support:
120
505.1.20 by Teddy Hogeborn
* Makefile (run-server): Remove obsolete warning.
121
logger = logging.getLogger()
655 by Teddy Hogeborn
Allow self-tests to run without needing /dev/log.
122
syslogger = None
13 by Björn Påhlsson
Added following support:
123
518.1.5 by Björn Påhlsson
First run of python-lint. Fixed some *obviously* bad code and turned
124
try:
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
125
    if_nametoindex = ctypes.cdll.LoadLibrary(
126
        ctypes.util.find_library("c")).if_nametoindex
518.1.5 by Björn Påhlsson
First run of python-lint. Fixed some *obviously* bad code and turned
127
except (OSError, AttributeError):
874 by Teddy Hogeborn
PEP8 compliance: mandos
128
518.1.5 by Björn Påhlsson
First run of python-lint. Fixed some *obviously* bad code and turned
129
    def if_nametoindex(interface):
130
        "Get an interface index the hard way, i.e. using fcntl()"
131
        SIOCGIFINDEX = 0x8933  # From /usr/include/linux/sockios.h
132
        with contextlib.closing(socket.socket()) as s:
133
            ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
729 by Teddy Hogeborn
mandos: Stop using str() and remove unnecessary unicode() calls.
134
                                struct.pack(b"16s16x", interface))
135
        interface_index = struct.unpack("I", ifreq[16:20])[0]
518.1.5 by Björn Påhlsson
First run of python-lint. Fixed some *obviously* bad code and turned
136
        return interface_index
137
138
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
139
def copy_function(func):
140
    """Make a copy of a function"""
141
    if sys.version_info.major == 2:
142
        return types.FunctionType(func.func_code,
143
                                  func.func_globals,
144
                                  func.func_name,
145
                                  func.func_defaults,
146
                                  func.func_closure)
147
    else:
148
        return types.FunctionType(func.__code__,
149
                                  func.__globals__,
150
                                  func.__name__,
151
                                  func.__defaults__,
152
                                  func.__closure__)
153
154
530 by teddy at bsnet
* mandos (initlogger): Take new "debug" argument; all callers changed.
155
def initlogger(debug, level=logging.WARNING):
518.1.4 by Björn Påhlsson
restructured logger
156
    """init logger and add loglevel"""
874 by Teddy Hogeborn
PEP8 compliance: mandos
157
698 by Teddy Hogeborn
Fix mandos server "--servicename" option, broken since 1.6.4.
158
    global syslogger
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
159
    syslogger = (logging.handlers.SysLogHandler(
874 by Teddy Hogeborn
PEP8 compliance: mandos
160
        facility=logging.handlers.SysLogHandler.LOG_DAEMON,
161
        address="/dev/log"))
518.1.4 by Björn Påhlsson
restructured logger
162
    syslogger.setFormatter(logging.Formatter
163
                           ('Mandos [%(process)d]: %(levelname)s:'
164
                            ' %(message)s'))
165
    logger.addHandler(syslogger)
874 by Teddy Hogeborn
PEP8 compliance: mandos
166
530 by teddy at bsnet
* mandos (initlogger): Take new "debug" argument; all callers changed.
167
    if debug:
168
        console = logging.StreamHandler()
169
        console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
170
                                               ' [%(process)d]:'
171
                                               ' %(levelname)s:'
172
                                               ' %(message)s'))
173
        logger.addHandler(console)
518.1.4 by Björn Påhlsson
restructured logger
174
    logger.setLevel(level)
28 by Teddy Hogeborn
* server.conf: New file.
175
505.1.20 by Teddy Hogeborn
* Makefile (run-server): Remove obsolete warning.
176
518.1.9 by Björn Påhlsson
renamed variables
177
class PGPError(Exception):
178
    """Exception if encryption/decryption fails"""
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
179
    pass
180
181
518.1.9 by Björn Påhlsson
renamed variables
182
class PGPEngine(object):
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
183
    """A simple class for OpenPGP symmetric encryption & decryption"""
874 by Teddy Hogeborn
PEP8 compliance: mandos
184
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
185
    def __init__(self):
186
        self.tempdir = tempfile.mkdtemp(prefix="mandos-")
805 by Teddy Hogeborn
Use GnuPG 2 if available
187
        self.gpg = "gpg"
188
        try:
189
            output = subprocess.check_output(["gpgconf"])
190
            for line in output.splitlines():
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
191
                name, text, path = line.split(b":")
805 by Teddy Hogeborn
Use GnuPG 2 if available
192
                if name == "gpg":
193
                    self.gpg = path
194
                    break
195
        except OSError as e:
196
            if e.errno != errno.ENOENT:
197
                raise
615 by Teddy Hogeborn
* mandos: Don't use the GnuPGInterface module.
198
        self.gnupgargs = ['--batch',
805 by Teddy Hogeborn
Use GnuPG 2 if available
199
                          '--homedir', self.tempdir,
615 by Teddy Hogeborn
* mandos: Don't use the GnuPGInterface module.
200
                          '--force-mdc',
849 by Teddy Hogeborn
mandos: Bug fix: Only use the --no-use-agent option for GPG 1
201
                          '--quiet']
202
        # Only GPG version 1 has the --no-use-agent option.
203
        if self.gpg == "gpg" or self.gpg.endswith("/gpg"):
204
            self.gnupgargs.append("--no-use-agent")
874 by Teddy Hogeborn
PEP8 compliance: mandos
205
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
206
    def __enter__(self):
207
        return self
874 by Teddy Hogeborn
PEP8 compliance: mandos
208
587 by Teddy Hogeborn
* Makefile (DOCBOOKTOMAN): Only run man --warnings if both "man" and
209
    def __exit__(self, exc_type, exc_value, traceback):
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
210
        self._cleanup()
211
        return False
874 by Teddy Hogeborn
PEP8 compliance: mandos
212
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
213
    def __del__(self):
214
        self._cleanup()
874 by Teddy Hogeborn
PEP8 compliance: mandos
215
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
216
    def _cleanup(self):
217
        if self.tempdir is not None:
218
            # Delete contents of tempdir
219
            for root, dirs, files in os.walk(self.tempdir,
874 by Teddy Hogeborn
PEP8 compliance: mandos
220
                                             topdown=False):
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
221
                for filename in files:
222
                    os.remove(os.path.join(root, filename))
223
                for dirname in dirs:
224
                    os.rmdir(os.path.join(root, dirname))
225
            # Remove tempdir
226
            os.rmdir(self.tempdir)
227
            self.tempdir = None
874 by Teddy Hogeborn
PEP8 compliance: mandos
228
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
229
    def password_encode(self, password):
230
        # Passphrase can not be empty and can not contain newlines or
231
        # NUL bytes.  So we prefix it and hex encode it.
630 by Teddy Hogeborn
* mandos (PGPEngine.password_encode): Bug fix: GnuPG can't handle
232
        encoded = b"mandos" + binascii.hexlify(password)
233
        if len(encoded) > 2048:
234
            # GnuPG can't handle long passwords, so encode differently
235
            encoded = (b"mandos" + password.replace(b"\\", b"\\\\")
236
                       .replace(b"\n", b"\\n")
237
                       .replace(b"\0", b"\\x00"))
238
        return encoded
874 by Teddy Hogeborn
PEP8 compliance: mandos
239
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
240
    def encrypt(self, data, password):
615 by Teddy Hogeborn
* mandos: Don't use the GnuPGInterface module.
241
        passphrase = self.password_encode(password)
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
242
        with tempfile.NamedTemporaryFile(
243
                dir=self.tempdir) as passfile:
615 by Teddy Hogeborn
* mandos: Don't use the GnuPGInterface module.
244
            passfile.write(passphrase)
245
            passfile.flush()
805 by Teddy Hogeborn
Use GnuPG 2 if available
246
            proc = subprocess.Popen([self.gpg, '--symmetric',
615 by Teddy Hogeborn
* mandos: Don't use the GnuPGInterface module.
247
                                     '--passphrase-file',
248
                                     passfile.name]
249
                                    + self.gnupgargs,
874 by Teddy Hogeborn
PEP8 compliance: mandos
250
                                    stdin=subprocess.PIPE,
251
                                    stdout=subprocess.PIPE,
252
                                    stderr=subprocess.PIPE)
253
            ciphertext, err = proc.communicate(input=data)
615 by Teddy Hogeborn
* mandos: Don't use the GnuPGInterface module.
254
        if proc.returncode != 0:
255
            raise PGPError(err)
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
256
        return ciphertext
874 by Teddy Hogeborn
PEP8 compliance: mandos
257
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
258
    def decrypt(self, data, password):
615 by Teddy Hogeborn
* mandos: Don't use the GnuPGInterface module.
259
        passphrase = self.password_encode(password)
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
260
        with tempfile.NamedTemporaryFile(
874 by Teddy Hogeborn
PEP8 compliance: mandos
261
                dir=self.tempdir) as passfile:
615 by Teddy Hogeborn
* mandos: Don't use the GnuPGInterface module.
262
            passfile.write(passphrase)
263
            passfile.flush()
805 by Teddy Hogeborn
Use GnuPG 2 if available
264
            proc = subprocess.Popen([self.gpg, '--decrypt',
615 by Teddy Hogeborn
* mandos: Don't use the GnuPGInterface module.
265
                                     '--passphrase-file',
266
                                     passfile.name]
267
                                    + self.gnupgargs,
874 by Teddy Hogeborn
PEP8 compliance: mandos
268
                                    stdin=subprocess.PIPE,
269
                                    stdout=subprocess.PIPE,
270
                                    stderr=subprocess.PIPE)
271
            decrypted_plaintext, err = proc.communicate(input=data)
615 by Teddy Hogeborn
* mandos: Don't use the GnuPGInterface module.
272
        if proc.returncode != 0:
273
            raise PGPError(err)
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
274
        return decrypted_plaintext
275
874 by Teddy Hogeborn
PEP8 compliance: mandos
276
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
277
# Pretend that we have an Avahi module
1088 by Teddy Hogeborn
mandos: Refactor; use classes, not instances, as namespaces
278
class avahi(object):
279
    """This isn't so much a class as it is a module-like namespace."""
874 by Teddy Hogeborn
PEP8 compliance: mandos
280
    IF_UNSPEC = -1               # avahi-common/address.h
281
    PROTO_UNSPEC = -1            # avahi-common/address.h
282
    PROTO_INET = 0               # avahi-common/address.h
283
    PROTO_INET6 = 1              # avahi-common/address.h
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
284
    DBUS_NAME = "org.freedesktop.Avahi"
285
    DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"
286
    DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"
287
    DBUS_PATH_SERVER = "/"
874 by Teddy Hogeborn
PEP8 compliance: mandos
288
1088 by Teddy Hogeborn
mandos: Refactor; use classes, not instances, as namespaces
289
    @staticmethod
290
    def string_array_to_txt_array(t):
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
291
        return dbus.Array((dbus.ByteArray(s.encode("utf-8"))
292
                           for s in t), signature="ay")
874 by Teddy Hogeborn
PEP8 compliance: mandos
293
    ENTRY_GROUP_ESTABLISHED = 2  # avahi-common/defs.h
294
    ENTRY_GROUP_COLLISION = 3    # avahi-common/defs.h
295
    ENTRY_GROUP_FAILURE = 4      # avahi-common/defs.h
296
    SERVER_INVALID = 0           # avahi-common/defs.h
297
    SERVER_REGISTERING = 1       # avahi-common/defs.h
298
    SERVER_RUNNING = 2           # avahi-common/defs.h
299
    SERVER_COLLISION = 3         # avahi-common/defs.h
300
    SERVER_FAILURE = 4           # avahi-common/defs.h
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
301
874 by Teddy Hogeborn
PEP8 compliance: mandos
302
28 by Teddy Hogeborn
* server.conf: New file.
303
class AvahiError(Exception):
242 by Teddy Hogeborn
* mandos (AvahiError): Converted to use unicode. All users changed.
304
    def __init__(self, value, *args, **kwargs):
28 by Teddy Hogeborn
* server.conf: New file.
305
        self.value = value
729 by Teddy Hogeborn
mandos: Stop using str() and remove unnecessary unicode() calls.
306
        return super(AvahiError, self).__init__(value, *args,
307
                                                **kwargs)
28 by Teddy Hogeborn
* server.conf: New file.
308
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
309
28 by Teddy Hogeborn
* server.conf: New file.
310
class AvahiServiceError(AvahiError):
311
    pass
312
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
313
28 by Teddy Hogeborn
* server.conf: New file.
314
class AvahiGroupError(AvahiError):
315
    pass
316
317
318
class AvahiService(object):
45 by Teddy Hogeborn
* server.py: Cosmetic changes.
319
    """An Avahi (Zeroconf) service.
874 by Teddy Hogeborn
PEP8 compliance: mandos
320
45 by Teddy Hogeborn
* server.py: Cosmetic changes.
321
    Attributes:
28 by Teddy Hogeborn
* server.conf: New file.
322
    interface: integer; avahi.IF_UNSPEC or an interface index.
323
               Used to optionally bind to the specified interface.
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
324
    name: string; Example: 'Mandos'
325
    type: string; Example: '_mandos._tcp'.
614 by Teddy Hogeborn
* mandos: Comment changes.
326
     See <https://www.iana.org/assignments/service-names-port-numbers>
45 by Teddy Hogeborn
* server.py: Cosmetic changes.
327
    port: integer; what port to announce
328
    TXT: list of strings; TXT record for the service
329
    domain: string; Domain to publish on, default to .local if empty.
330
    host: string; Host to publish records for, default is localhost
331
    max_renames: integer; maximum number of renames
332
    rename_count: integer; counter so we only rename after collisions
333
                  a sensible number of times
336 by Teddy Hogeborn
Code cleanup.
334
    group: D-Bus Entry Group
335
    server: D-Bus Server
338 by Teddy Hogeborn
* mandos: Minor doc string fixes.
336
    bus: dbus.SystemBus()
28 by Teddy Hogeborn
* server.conf: New file.
337
    """
874 by Teddy Hogeborn
PEP8 compliance: mandos
338
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
339
    def __init__(self,
874 by Teddy Hogeborn
PEP8 compliance: mandos
340
                 interface=avahi.IF_UNSPEC,
341
                 name=None,
342
                 servicetype=None,
343
                 port=None,
344
                 TXT=None,
345
                 domain="",
346
                 host="",
347
                 max_renames=32768,
348
                 protocol=avahi.PROTO_UNSPEC,
349
                 bus=None):
28 by Teddy Hogeborn
* server.conf: New file.
350
        self.interface = interface
351
        self.name = name
215 by Teddy Hogeborn
* mandos: Remove unused "select" module. Import "ctypes.util".
352
        self.type = servicetype
28 by Teddy Hogeborn
* server.conf: New file.
353
        self.port = port
237.1.2 by Teddy Hogeborn
Further steps towards a D-Bus server interface, plus minor syntax
354
        self.TXT = TXT if TXT is not None else []
28 by Teddy Hogeborn
* server.conf: New file.
355
        self.domain = domain
356
        self.host = host
357
        self.rename_count = 0
76 by Teddy Hogeborn
* plugins.d/password-request.c (init_gnutls_global): Renamed
358
        self.max_renames = max_renames
314 by Teddy Hogeborn
Support not using IPv6 in server:
359
        self.protocol = protocol
336 by Teddy Hogeborn
Code cleanup.
360
        self.group = None       # our entry group
361
        self.server = None
337 by Teddy Hogeborn
Code cleanup. Move some global stuff into main.
362
        self.bus = bus
482 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
363
        self.entry_group_state_changed_match = None
874 by Teddy Hogeborn
PEP8 compliance: mandos
364
738 by Teddy Hogeborn
Handle local Zeroconf service name collisions.
365
    def rename(self, remove=True):
28 by Teddy Hogeborn
* server.conf: New file.
366
        """Derived from the Avahi example code"""
367
        if self.rename_count >= self.max_renames:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
368
            logger.critical("No suitable Zeroconf service name found"
369
                            " after %i retries, exiting.",
215 by Teddy Hogeborn
* mandos: Remove unused "select" module. Import "ctypes.util".
370
                            self.rename_count)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
371
            raise AvahiServiceError("Too many renames")
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
372
        self.name = str(
373
            self.server.GetAlternativeServiceName(self.name))
738 by Teddy Hogeborn
Handle local Zeroconf service name collisions.
374
        self.rename_count += 1
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
375
        logger.info("Changing Zeroconf service name to %r ...",
24.1.155 by Björn Påhlsson
mandos server: Added debuglevel that adjust at what level information
376
                    self.name)
738 by Teddy Hogeborn
Handle local Zeroconf service name collisions.
377
        if remove:
378
            self.remove()
24.1.160 by Björn Påhlsson
fixed bug with local name collisions after a non-local name collision
379
        try:
380
            self.add()
482 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
381
        except dbus.exceptions.DBusException as error:
738 by Teddy Hogeborn
Handle local Zeroconf service name collisions.
382
            if (error.get_dbus_name()
383
                == "org.freedesktop.Avahi.CollisionError"):
384
                logger.info("Local Zeroconf service name collision.")
385
                return self.rename(remove=False)
386
            else:
387
                logger.critical("D-Bus Exception", exc_info=error)
388
                self.cleanup()
389
                os._exit(1)
874 by Teddy Hogeborn
PEP8 compliance: mandos
390
28 by Teddy Hogeborn
* server.conf: New file.
391
    def remove(self):
392
        """Derived from the Avahi example code"""
482 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
393
        if self.entry_group_state_changed_match is not None:
394
            self.entry_group_state_changed_match.remove()
395
            self.entry_group_state_changed_match = None
483 by Teddy Hogeborn
* mandos: Never call .Reset() on a defunct Avahi entry group.
396
        if self.group is not None:
397
            self.group.Reset()
874 by Teddy Hogeborn
PEP8 compliance: mandos
398
28 by Teddy Hogeborn
* server.conf: New file.
399
    def add(self):
400
        """Derived from the Avahi example code"""
482 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
401
        self.remove()
483 by Teddy Hogeborn
* mandos: Never call .Reset() on a defunct Avahi entry group.
402
        if self.group is None:
403
            self.group = dbus.Interface(
404
                self.bus.get_object(avahi.DBUS_NAME,
405
                                    self.server.EntryGroupNew()),
406
                avahi.DBUS_INTERFACE_ENTRY_GROUP)
482 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
407
        self.entry_group_state_changed_match = (
408
            self.group.connect_to_signal(
505.1.20 by Teddy Hogeborn
* Makefile (run-server): Remove obsolete warning.
409
                'StateChanged', self.entry_group_state_changed))
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
410
        logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
336 by Teddy Hogeborn
Code cleanup.
411
                     self.name, self.type)
412
        self.group.AddService(
413
            self.interface,
414
            self.protocol,
415
            dbus.UInt32(0),     # flags
416
            self.name, self.type,
417
            self.domain, self.host,
418
            dbus.UInt16(self.port),
419
            avahi.string_array_to_txt_array(self.TXT))
420
        self.group.Commit()
874 by Teddy Hogeborn
PEP8 compliance: mandos
421
336 by Teddy Hogeborn
Code cleanup.
422
    def entry_group_state_changed(self, state, error):
423
        """Derived from the Avahi example code"""
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
424
        logger.debug("Avahi entry group state change: %i", state)
874 by Teddy Hogeborn
PEP8 compliance: mandos
425
336 by Teddy Hogeborn
Code cleanup.
426
        if state == avahi.ENTRY_GROUP_ESTABLISHED:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
427
            logger.debug("Zeroconf service established.")
336 by Teddy Hogeborn
Code cleanup.
428
        elif state == avahi.ENTRY_GROUP_COLLISION:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
429
            logger.info("Zeroconf service name collision.")
336 by Teddy Hogeborn
Code cleanup.
430
            self.rename()
431
        elif state == avahi.ENTRY_GROUP_FAILURE:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
432
            logger.critical("Avahi: Error in group state changed %s",
730 by Teddy Hogeborn
mandos: Replace unicode() with str().
433
                            str(error))
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
434
            raise AvahiGroupError("State changed: {!s}".format(error))
874 by Teddy Hogeborn
PEP8 compliance: mandos
435
336 by Teddy Hogeborn
Code cleanup.
436
    def cleanup(self):
437
        """Derived from the Avahi example code"""
483 by Teddy Hogeborn
* mandos: Never call .Reset() on a defunct Avahi entry group.
438
        if self.group is not None:
439
            try:
440
                self.group.Free()
441
            except (dbus.exceptions.UnknownMethodException,
518.1.5 by Björn Påhlsson
First run of python-lint. Fixed some *obviously* bad code and turned
442
                    dbus.exceptions.DBusException):
483 by Teddy Hogeborn
* mandos: Never call .Reset() on a defunct Avahi entry group.
443
                pass
444
            self.group = None
482 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
445
        self.remove()
874 by Teddy Hogeborn
PEP8 compliance: mandos
446
482 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
447
    def server_state_changed(self, state, error=None):
336 by Teddy Hogeborn
Code cleanup.
448
        """Derived from the Avahi example code"""
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
449
        logger.debug("Avahi server state change: %i", state)
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
450
        bad_states = {
451
            avahi.SERVER_INVALID: "Zeroconf server invalid",
452
            avahi.SERVER_REGISTERING: None,
453
            avahi.SERVER_COLLISION: "Zeroconf server name collision",
454
            avahi.SERVER_FAILURE: "Zeroconf server failure",
455
        }
482 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
456
        if state in bad_states:
483 by Teddy Hogeborn
* mandos: Never call .Reset() on a defunct Avahi entry group.
457
            if bad_states[state] is not None:
458
                if error is None:
459
                    logger.error(bad_states[state])
460
                else:
461
                    logger.error(bad_states[state] + ": %r", error)
462
            self.cleanup()
336 by Teddy Hogeborn
Code cleanup.
463
        elif state == avahi.SERVER_RUNNING:
769 by Teddy Hogeborn
Handle local Zeroconf service name collisions on startup, too.
464
            try:
465
                self.add()
466
            except dbus.exceptions.DBusException as error:
467
                if (error.get_dbus_name()
468
                    == "org.freedesktop.Avahi.CollisionError"):
469
                    logger.info("Local Zeroconf service name"
470
                                " collision.")
471
                    return self.rename(remove=False)
472
                else:
473
                    logger.critical("D-Bus Exception", exc_info=error)
474
                    self.cleanup()
475
                    os._exit(1)
482 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
476
        else:
483 by Teddy Hogeborn
* mandos: Never call .Reset() on a defunct Avahi entry group.
477
            if error is None:
478
                logger.debug("Unknown state: %r", state)
479
            else:
480
                logger.debug("Unknown state: %r: %r", state, error)
874 by Teddy Hogeborn
PEP8 compliance: mandos
481
336 by Teddy Hogeborn
Code cleanup.
482
    def activate(self):
483
        """Derived from the Avahi example code"""
484
        if self.server is None:
485
            self.server = dbus.Interface(
337 by Teddy Hogeborn
Code cleanup. Move some global stuff into main.
486
                self.bus.get_object(avahi.DBUS_NAME,
482 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
487
                                    avahi.DBUS_PATH_SERVER,
488
                                    follow_name_owner_changes=True),
336 by Teddy Hogeborn
Code cleanup.
489
                avahi.DBUS_INTERFACE_SERVER)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
490
        self.server.connect_to_signal("StateChanged",
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
491
                                      self.server_state_changed)
336 by Teddy Hogeborn
Code cleanup.
492
        self.server_state_changed(self.server.GetState())
238 by Teddy Hogeborn
First version of a somewhat complete D-Bus server interface. Also
493
582 by Teddy Hogeborn
* mandos (IPv6_TCPServer.server_bind): Bug fix: handle non-existing
494
505.1.20 by Teddy Hogeborn
* Makefile (run-server): Remove obsolete warning.
495
class AvahiServiceToSyslog(AvahiService):
738 by Teddy Hogeborn
Handle local Zeroconf service name collisions.
496
    def rename(self, *args, **kwargs):
505.1.20 by Teddy Hogeborn
* Makefile (run-server): Remove obsolete warning.
497
        """Add the new name to the syslog messages"""
926 by Teddy Hogeborn
Server bug fix: Correct bad argument list
498
        ret = super(AvahiServiceToSyslog, self).rename(*args, **kwargs)
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
499
        syslogger.setFormatter(logging.Formatter(
500
            'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
501
            .format(self.name)))
505.1.20 by Teddy Hogeborn
* Makefile (run-server): Remove obsolete warning.
502
        return ret
238 by Teddy Hogeborn
First version of a somewhat complete D-Bus server interface. Also
503
874 by Teddy Hogeborn
PEP8 compliance: mandos
504
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
505
# Pretend that we have a GnuTLS module
1088 by Teddy Hogeborn
mandos: Refactor; use classes, not instances, as namespaces
506
class gnutls(object):
507
    """This isn't so much a class as it is a module-like namespace."""
874 by Teddy Hogeborn
PEP8 compliance: mandos
508
875 by Teddy Hogeborn
Fix bug where mandos server could not find GnuTLS library
509
    library = ctypes.util.find_library("gnutls")
510
    if library is None:
511
        library = ctypes.util.find_library("gnutls-deb0")
512
    _library = ctypes.cdll.LoadLibrary(library)
513
    del library
874 by Teddy Hogeborn
PEP8 compliance: mandos
514
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
515
    # Unless otherwise indicated, the constants and types below are
516
    # all from the gnutls/gnutls.h C header file.
874 by Teddy Hogeborn
PEP8 compliance: mandos
517
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
518
    # Constants
519
    E_SUCCESS = 0
802 by Teddy Hogeborn
Handle GnuTLS errors and partial sends in gnutls "module".
520
    E_INTERRUPTED = -52
521
    E_AGAIN = -28
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
522
    CRT_OPENPGP = 2
962 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
523
    CRT_RAWPK = 3
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
524
    CLIENT = 2
525
    SHUT_RDWR = 0
526
    CRD_CERTIFICATE = 1
527
    E_NO_CERTIFICATE_FOUND = -49
962 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
528
    X509_FMT_DER = 0
529
    NO_TICKETS = 1<<10
530
    ENABLE_RAWPK = 1<<18
531
    CTYPE_PEERS = 3
532
    KEYID_USE_SHA256 = 1        # gnutls/x509.h
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
533
    OPENPGP_FMT_RAW = 0         # gnutls/openpgp.h
874 by Teddy Hogeborn
PEP8 compliance: mandos
534
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
535
    # Types
536
    class session_int(ctypes.Structure):
537
        _fields_ = []
538
    session_t = ctypes.POINTER(session_int)
874 by Teddy Hogeborn
PEP8 compliance: mandos
539
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
540
    class certificate_credentials_st(ctypes.Structure):
541
        _fields_ = []
542
    certificate_credentials_t = ctypes.POINTER(
543
        certificate_credentials_st)
544
    certificate_type_t = ctypes.c_int
874 by Teddy Hogeborn
PEP8 compliance: mandos
545
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
546
    class datum_t(ctypes.Structure):
547
        _fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
548
                    ('size', ctypes.c_uint)]
874 by Teddy Hogeborn
PEP8 compliance: mandos
549
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
550
    class openpgp_crt_int(ctypes.Structure):
551
        _fields_ = []
552
    openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
874 by Teddy Hogeborn
PEP8 compliance: mandos
553
    openpgp_crt_fmt_t = ctypes.c_int  # gnutls/openpgp.h
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
554
    log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
824 by Teddy Hogeborn
Remove empty comment
555
    credentials_type_t = ctypes.c_int
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
556
    transport_ptr_t = ctypes.c_void_p
557
    close_request_t = ctypes.c_int
874 by Teddy Hogeborn
PEP8 compliance: mandos
558
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
559
    # Exceptions
560
    class Error(Exception):
874 by Teddy Hogeborn
PEP8 compliance: mandos
561
        def __init__(self, message=None, code=None, args=()):
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
562
            # Default usage is by a message string, but if a return
563
            # code is passed, convert it to a string with
564
            # gnutls.strerror()
802 by Teddy Hogeborn
Handle GnuTLS errors and partial sends in gnutls "module".
565
            self.code = code
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
566
            if message is None and code is not None:
1088 by Teddy Hogeborn
mandos: Refactor; use classes, not instances, as namespaces
567
                message = gnutls.strerror(code)
568
            return super(gnutls.Error, self).__init__(
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
569
                message, *args)
874 by Teddy Hogeborn
PEP8 compliance: mandos
570
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
571
    class CertificateSecurityError(Error):
572
        pass
874 by Teddy Hogeborn
PEP8 compliance: mandos
573
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
574
    # Classes
575
    class Credentials(object):
576
        def __init__(self):
577
            self._c_object = gnutls.certificate_credentials_t()
578
            gnutls.certificate_allocate_credentials(
579
                ctypes.byref(self._c_object))
580
            self.type = gnutls.CRD_CERTIFICATE
874 by Teddy Hogeborn
PEP8 compliance: mandos
581
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
582
        def __del__(self):
583
            gnutls.certificate_free_credentials(self._c_object)
874 by Teddy Hogeborn
PEP8 compliance: mandos
584
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
585
    class ClientSession(object):
874 by Teddy Hogeborn
PEP8 compliance: mandos
586
        def __init__(self, socket, credentials=None):
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
587
            self._c_object = gnutls.session_t()
962 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
588
            gnutls_flags = gnutls.CLIENT
589
            if gnutls.check_version("3.5.6"):
590
                gnutls_flags |= gnutls.NO_TICKETS
591
            if gnutls.has_rawpk:
592
                gnutls_flags |= gnutls.ENABLE_RAWPK
593
            gnutls.init(ctypes.byref(self._c_object), gnutls_flags)
594
            del gnutls_flags
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
595
            gnutls.set_default_priority(self._c_object)
596
            gnutls.transport_set_ptr(self._c_object, socket.fileno())
597
            gnutls.handshake_set_private_extensions(self._c_object,
598
                                                    True)
599
            self.socket = socket
600
            if credentials is None:
601
                credentials = gnutls.Credentials()
602
            gnutls.credentials_set(self._c_object, credentials.type,
603
                                   ctypes.cast(credentials._c_object,
604
                                               ctypes.c_void_p))
605
            self.credentials = credentials
874 by Teddy Hogeborn
PEP8 compliance: mandos
606
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
607
        def __del__(self):
608
            gnutls.deinit(self._c_object)
874 by Teddy Hogeborn
PEP8 compliance: mandos
609
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
610
        def handshake(self):
611
            return gnutls.handshake(self._c_object)
874 by Teddy Hogeborn
PEP8 compliance: mandos
612
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
613
        def send(self, data):
614
            data = bytes(data)
802 by Teddy Hogeborn
Handle GnuTLS errors and partial sends in gnutls "module".
615
            data_len = len(data)
616
            while data_len > 0:
617
                data_len -= gnutls.record_send(self._c_object,
618
                                               data[-data_len:],
619
                                               data_len)
874 by Teddy Hogeborn
PEP8 compliance: mandos
620
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
621
        def bye(self):
622
            return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
874 by Teddy Hogeborn
PEP8 compliance: mandos
623
802 by Teddy Hogeborn
Handle GnuTLS errors and partial sends in gnutls "module".
624
    # Error handling functions
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
625
    def _error_code(result):
626
        """A function to raise exceptions on errors, suitable
627
        for the 'restype' attribute on ctypes functions"""
628
        if result >= 0:
629
            return result
630
        if result == gnutls.E_NO_CERTIFICATE_FOUND:
874 by Teddy Hogeborn
PEP8 compliance: mandos
631
            raise gnutls.CertificateSecurityError(code=result)
632
        raise gnutls.Error(code=result)
633
802 by Teddy Hogeborn
Handle GnuTLS errors and partial sends in gnutls "module".
634
    def _retry_on_error(result, func, arguments):
635
        """A function to retry on some errors, suitable
636
        for the 'errcheck' attribute on ctypes functions"""
637
        while result < 0:
638
            if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
639
                return _error_code(result)
640
            result = func(*arguments)
641
        return result
874 by Teddy Hogeborn
PEP8 compliance: mandos
642
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
643
    # Unless otherwise indicated, the function declarations below are
644
    # all from the gnutls/gnutls.h C header file.
874 by Teddy Hogeborn
PEP8 compliance: mandos
645
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
646
    # Functions
647
    priority_set_direct = _library.gnutls_priority_set_direct
648
    priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
649
                                    ctypes.POINTER(ctypes.c_char_p)]
650
    priority_set_direct.restype = _error_code
874 by Teddy Hogeborn
PEP8 compliance: mandos
651
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
652
    init = _library.gnutls_init
653
    init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
654
    init.restype = _error_code
874 by Teddy Hogeborn
PEP8 compliance: mandos
655
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
656
    set_default_priority = _library.gnutls_set_default_priority
657
    set_default_priority.argtypes = [session_t]
658
    set_default_priority.restype = _error_code
874 by Teddy Hogeborn
PEP8 compliance: mandos
659
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
660
    record_send = _library.gnutls_record_send
661
    record_send.argtypes = [session_t, ctypes.c_void_p,
662
                            ctypes.c_size_t]
663
    record_send.restype = ctypes.c_ssize_t
802 by Teddy Hogeborn
Handle GnuTLS errors and partial sends in gnutls "module".
664
    record_send.errcheck = _retry_on_error
874 by Teddy Hogeborn
PEP8 compliance: mandos
665
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
666
    certificate_allocate_credentials = (
667
        _library.gnutls_certificate_allocate_credentials)
668
    certificate_allocate_credentials.argtypes = [
669
        ctypes.POINTER(certificate_credentials_t)]
670
    certificate_allocate_credentials.restype = _error_code
874 by Teddy Hogeborn
PEP8 compliance: mandos
671
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
672
    certificate_free_credentials = (
673
        _library.gnutls_certificate_free_credentials)
874 by Teddy Hogeborn
PEP8 compliance: mandos
674
    certificate_free_credentials.argtypes = [
675
        certificate_credentials_t]
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
676
    certificate_free_credentials.restype = None
874 by Teddy Hogeborn
PEP8 compliance: mandos
677
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
678
    handshake_set_private_extensions = (
679
        _library.gnutls_handshake_set_private_extensions)
680
    handshake_set_private_extensions.argtypes = [session_t,
681
                                                 ctypes.c_int]
682
    handshake_set_private_extensions.restype = None
874 by Teddy Hogeborn
PEP8 compliance: mandos
683
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
684
    credentials_set = _library.gnutls_credentials_set
685
    credentials_set.argtypes = [session_t, credentials_type_t,
686
                                ctypes.c_void_p]
687
    credentials_set.restype = _error_code
874 by Teddy Hogeborn
PEP8 compliance: mandos
688
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
689
    strerror = _library.gnutls_strerror
690
    strerror.argtypes = [ctypes.c_int]
691
    strerror.restype = ctypes.c_char_p
874 by Teddy Hogeborn
PEP8 compliance: mandos
692
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
693
    certificate_type_get = _library.gnutls_certificate_type_get
694
    certificate_type_get.argtypes = [session_t]
695
    certificate_type_get.restype = _error_code
874 by Teddy Hogeborn
PEP8 compliance: mandos
696
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
697
    certificate_get_peers = _library.gnutls_certificate_get_peers
698
    certificate_get_peers.argtypes = [session_t,
699
                                      ctypes.POINTER(ctypes.c_uint)]
700
    certificate_get_peers.restype = ctypes.POINTER(datum_t)
874 by Teddy Hogeborn
PEP8 compliance: mandos
701
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
702
    global_set_log_level = _library.gnutls_global_set_log_level
703
    global_set_log_level.argtypes = [ctypes.c_int]
704
    global_set_log_level.restype = None
874 by Teddy Hogeborn
PEP8 compliance: mandos
705
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
706
    global_set_log_function = _library.gnutls_global_set_log_function
707
    global_set_log_function.argtypes = [log_func]
708
    global_set_log_function.restype = None
874 by Teddy Hogeborn
PEP8 compliance: mandos
709
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
710
    deinit = _library.gnutls_deinit
711
    deinit.argtypes = [session_t]
712
    deinit.restype = None
874 by Teddy Hogeborn
PEP8 compliance: mandos
713
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
714
    handshake = _library.gnutls_handshake
715
    handshake.argtypes = [session_t]
716
    handshake.restype = _error_code
802 by Teddy Hogeborn
Handle GnuTLS errors and partial sends in gnutls "module".
717
    handshake.errcheck = _retry_on_error
874 by Teddy Hogeborn
PEP8 compliance: mandos
718
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
719
    transport_set_ptr = _library.gnutls_transport_set_ptr
720
    transport_set_ptr.argtypes = [session_t, transport_ptr_t]
721
    transport_set_ptr.restype = None
874 by Teddy Hogeborn
PEP8 compliance: mandos
722
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
723
    bye = _library.gnutls_bye
724
    bye.argtypes = [session_t, close_request_t]
725
    bye.restype = _error_code
802 by Teddy Hogeborn
Handle GnuTLS errors and partial sends in gnutls "module".
726
    bye.errcheck = _retry_on_error
874 by Teddy Hogeborn
PEP8 compliance: mandos
727
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
728
    check_version = _library.gnutls_check_version
729
    check_version.argtypes = [ctypes.c_char_p]
730
    check_version.restype = ctypes.c_char_p
874 by Teddy Hogeborn
PEP8 compliance: mandos
731
1088 by Teddy Hogeborn
mandos: Refactor; use classes, not instances, as namespaces
732
    _need_version = b"3.3.0"
733
    if check_version(_need_version) is None:
734
        raise self.Error("Needs GnuTLS {} or later"
735
                         .format(_need_version))
736
737
    _tls_rawpk_version = b"3.6.6"
962 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
738
    has_rawpk = bool(check_version(_tls_rawpk_version))
739
740
    if has_rawpk:
741
        # Types
742
        class pubkey_st(ctypes.Structure):
743
            _fields = []
744
        pubkey_t = ctypes.POINTER(pubkey_st)
745
746
        x509_crt_fmt_t = ctypes.c_int
747
748
        # All the function declarations below are from gnutls/abstract.h
749
        pubkey_init = _library.gnutls_pubkey_init
750
        pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]
751
        pubkey_init.restype = _error_code
752
753
        pubkey_import = _library.gnutls_pubkey_import
754
        pubkey_import.argtypes = [pubkey_t, ctypes.POINTER(datum_t),
755
                                  x509_crt_fmt_t]
756
        pubkey_import.restype = _error_code
757
758
        pubkey_get_key_id = _library.gnutls_pubkey_get_key_id
759
        pubkey_get_key_id.argtypes = [pubkey_t, ctypes.c_int,
760
                                      ctypes.POINTER(ctypes.c_ubyte),
761
                                      ctypes.POINTER(ctypes.c_size_t)]
762
        pubkey_get_key_id.restype = _error_code
763
764
        pubkey_deinit = _library.gnutls_pubkey_deinit
765
        pubkey_deinit.argtypes = [pubkey_t]
766
        pubkey_deinit.restype = None
767
    else:
768
        # All the function declarations below are from gnutls/openpgp.h
769
770
        openpgp_crt_init = _library.gnutls_openpgp_crt_init
771
        openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
772
        openpgp_crt_init.restype = _error_code
773
774
        openpgp_crt_import = _library.gnutls_openpgp_crt_import
775
        openpgp_crt_import.argtypes = [openpgp_crt_t,
776
                                       ctypes.POINTER(datum_t),
777
                                       openpgp_crt_fmt_t]
778
        openpgp_crt_import.restype = _error_code
779
780
        openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
781
        openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
782
                                            ctypes.POINTER(ctypes.c_uint)]
783
        openpgp_crt_verify_self.restype = _error_code
784
785
        openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
786
        openpgp_crt_deinit.argtypes = [openpgp_crt_t]
787
        openpgp_crt_deinit.restype = None
788
789
        openpgp_crt_get_fingerprint = (
790
            _library.gnutls_openpgp_crt_get_fingerprint)
791
        openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
792
                                                ctypes.c_void_p,
793
                                                ctypes.POINTER(
794
                                                    ctypes.c_size_t)]
795
        openpgp_crt_get_fingerprint.restype = _error_code
796
797
    if check_version("3.6.4"):
798
        certificate_type_get2 = _library.gnutls_certificate_type_get2
799
        certificate_type_get2.argtypes = [session_t, ctypes.c_int]
800
        certificate_type_get2.restype = _error_code
874 by Teddy Hogeborn
PEP8 compliance: mandos
801
802 by Teddy Hogeborn
Handle GnuTLS errors and partial sends in gnutls "module".
802
    # Remove non-public functions
803
    del _error_code, _retry_on_error
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
804
874 by Teddy Hogeborn
PEP8 compliance: mandos
805
749.1.2 by Teddy Hogeborn
mandos (subprocess_call_pipe): Rename to "call_pipe" and take "func".
806
def call_pipe(connection,       # : multiprocessing.Connection
807
              func, *args, **kwargs):
749.1.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
808
    """This function is meant to be called by multiprocessing.Process
874 by Teddy Hogeborn
PEP8 compliance: mandos
809
749.1.2 by Teddy Hogeborn
mandos (subprocess_call_pipe): Rename to "call_pipe" and take "func".
810
    This function runs func(*args, **kwargs), and writes the resulting
811
    return value on the provided multiprocessing.Connection.
749.1.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
812
    """
749.1.2 by Teddy Hogeborn
mandos (subprocess_call_pipe): Rename to "call_pipe" and take "func".
813
    connection.send(func(*args, **kwargs))
749.1.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
814
    connection.close()
582 by Teddy Hogeborn
* mandos (IPv6_TCPServer.server_bind): Bug fix: handle non-existing
815
874 by Teddy Hogeborn
PEP8 compliance: mandos
816
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
817
class Client(object):
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
818
    """A representation of a client host served by this server.
874 by Teddy Hogeborn
PEP8 compliance: mandos
819
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
820
    Attributes:
518.2.4 by Teddy Hogeborn
* mandos (_timedelta_to_milliseconds): Renamed to
821
    approved:   bool(); 'None' if not yet approved/disapproved
438 by Teddy Hogeborn
* mandos (Client.runtime_expansions): New attribute containing the
822
    approval_delay: datetime.timedelta(); Time to wait for approval
823
    approval_duration: datetime.timedelta(); Duration of one approval
238 by Teddy Hogeborn
First version of a somewhat complete D-Bus server interface. Also
824
    checker:    subprocess.Popen(); a running checker process used
825
                                    to see if the client lives.
826
                                    'None' if no process is running.
830 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
827
    checker_callback_tag: a GLib event source tag, or None
438 by Teddy Hogeborn
* mandos (Client.runtime_expansions): New attribute containing the
828
    checker_command: string; External command which is run to check
829
                     if client lives.  %() expansions are done at
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
830
                     runtime with vars(self) as dict, so that for
831
                     instance %(name)s can be used in the command.
830 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
832
    checker_initiator_tag: a GLib event source tag, or None
438 by Teddy Hogeborn
* mandos (Client.runtime_expansions): New attribute containing the
833
    created:    datetime.datetime(); (UTC) object creation
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
834
    client_structure: Object describing what attributes a client has
835
                      and is used for storing the client at exit
315 by Teddy Hogeborn
* mandos (Client.current_checker_command): New attribute.
836
    current_checker_command: string; current running checker_command
830 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
837
    disable_initiator_tag: a GLib event source tag, or None
438 by Teddy Hogeborn
* mandos (Client.runtime_expansions): New attribute containing the
838
    enabled:    bool()
839
    fingerprint: string (40 or 32 hexadecimal digits); used to
962 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
840
                 uniquely identify an OpenPGP client
841
    key_id: string (64 hexadecimal digits); used to uniquely identify
842
            a client using raw public keys
438 by Teddy Hogeborn
* mandos (Client.runtime_expansions): New attribute containing the
843
    host:       string; available for use by the checker command
844
    interval:   datetime.timedelta(); How often to start a new checker
442 by Teddy Hogeborn
* DBUS-API: Document new "LastApprovalRequest" client property.
845
    last_approval_request: datetime.datetime(); (UTC) or None
438 by Teddy Hogeborn
* mandos (Client.runtime_expansions): New attribute containing the
846
    last_checked_ok: datetime.datetime(); (UTC) or None
521 by teddy at bsnet
* debian/control (mandos/Depends): Added "python-crypto".
847
    last_checker_status: integer between 0 and 255 reflecting exit
518.1.7 by Teddy Hogeborn
* mandos: Break long lines and fix some more white space.
848
                         status of last checker. -1 reflects crashed
556 by Teddy Hogeborn
* DBUS-API (se.recompile.Mandos.Client.LastCheckerStatus): New
849
                         checker, -2 means no checker completed yet.
749.1.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
850
    last_checker_signal: The signal which killed the last checker, if
851
                         last_checker_status is -1
518.2.3 by Teddy Hogeborn
Make "enabled" a client config option.
852
    last_enabled: datetime.datetime(); (UTC) or None
438 by Teddy Hogeborn
* mandos (Client.runtime_expansions): New attribute containing the
853
    name:       string; from the config file, used in log messages and
854
                        D-Bus identifiers
855
    secret:     bytestring; sent verbatim (over TLS) to client
856
    timeout:    datetime.timedelta(); How long from last_checked_ok
857
                                      until this client is disabled
552 by teddy at recompile
* mandos: Consistent terminology; use the term "secret" for the
858
    extended_timeout:   extra long timeout when secret has been sent
438 by Teddy Hogeborn
* mandos (Client.runtime_expansions): New attribute containing the
859
    runtime_expansions: Allowed attributes for runtime expansion.
497 by Teddy Hogeborn
* DBUS-API: Document new "Expires" and "ExtendedTimeout" properties.
860
    expires:    datetime.datetime(); time (UTC) when a client will be
24.1.179 by Björn Påhlsson
New feature:
861
                disabled, or None
617 by Teddy Hogeborn
* mandos: Bug fix: Don't print output from checkers when running in
862
    server_settings: The server_settings dict from main()
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
863
    """
874 by Teddy Hogeborn
PEP8 compliance: mandos
864
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
865
    runtime_expansions = ("approval_delay", "approval_duration",
962 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
866
                          "created", "enabled", "expires", "key_id",
584 by Teddy Hogeborn
* mandos (Client.runtime_expansions): Add "expires" and (bug fix)
867
                          "fingerprint", "host", "interval",
868
                          "last_approval_request", "last_checked_ok",
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
869
                          "last_enabled", "name", "timeout")
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
870
    client_defaults = {
871
        "timeout": "PT5M",
872
        "extended_timeout": "PT15M",
873
        "interval": "PT2M",
874
        "checker": "fping -q -- %%(host)s",
875
        "host": "",
876
        "approval_delay": "PT0S",
877
        "approval_duration": "PT1S",
878
        "approved_by_default": "True",
879
        "enabled": "True",
880
    }
874 by Teddy Hogeborn
PEP8 compliance: mandos
881
518.1.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
882
    @staticmethod
883
    def config_parser(config):
542 by Björn Påhlsson
fixed bug with bad stored config state for expires and last_checked_ok.
884
        """Construct a new dict of client settings of this form:
518.1.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
885
        { client_name: {setting_name: value, ...}, ...}
542 by Björn Påhlsson
fixed bug with bad stored config state for expires and last_checked_ok.
886
        with exceptions for any special settings as defined above.
887
        NOTE: Must be a pure function. Must return the same result
888
        value given the same arguments.
889
        """
518.1.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
890
        settings = {}
891
        for client_name in config.sections():
892
            section = dict(config.items(client_name))
893
            client = settings[client_name] = {}
874 by Teddy Hogeborn
PEP8 compliance: mandos
894
518.1.15 by Björn Påhlsson
more refactoring in regards to how clients get created
895
            client["host"] = section["host"]
518.1.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
896
            # Reformat values from string types to Python types
897
            client["approved_by_default"] = config.getboolean(
898
                client_name, "approved_by_default")
543 by Teddy Hogeborn
* mandos: Break some long lines.
899
            client["enabled"] = config.getboolean(client_name,
900
                                                  "enabled")
874 by Teddy Hogeborn
PEP8 compliance: mandos
901
962 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
902
            # Uppercase and remove spaces from key_id and fingerprint
903
            # for later comparison purposes with return value from the
904
            # key_id() and fingerprint() functions
905
            client["key_id"] = (section.get("key_id", "").upper()
906
                                .replace(" ", ""))
518.1.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
907
            client["fingerprint"] = (section["fingerprint"].upper()
908
                                     .replace(" ", ""))
909
            if "secret" in section:
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
910
                client["secret"] = codecs.decode(section["secret"]
911
                                                 .encode("utf-8"),
912
                                                 "base64")
518.1.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
913
            elif "secfile" in section:
914
                with open(os.path.expanduser(os.path.expandvars
915
                                             (section["secfile"])),
916
                          "rb") as secfile:
917
                    client["secret"] = secfile.read()
918
            else:
723.1.5 by Teddy Hogeborn
Use the new auto-numbered "{}" syntax for the .format() string method.
919
                raise TypeError("No secret or secfile for section {}"
568 by Teddy Hogeborn
* mandos-monitor: Use new string format method.
920
                                .format(section))
518.1.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
921
            client["timeout"] = string_to_delta(section["timeout"])
922
            client["extended_timeout"] = string_to_delta(
923
                section["extended_timeout"])
924
            client["interval"] = string_to_delta(section["interval"])
925
            client["approval_delay"] = string_to_delta(
926
                section["approval_delay"])
927
            client["approval_duration"] = string_to_delta(
928
                section["approval_duration"])
518.1.15 by Björn Påhlsson
more refactoring in regards to how clients get created
929
            client["checker_command"] = section["checker"]
930
            client["last_approval_request"] = None
931
            client["last_checked_ok"] = None
556 by Teddy Hogeborn
* DBUS-API (se.recompile.Mandos.Client.LastCheckerStatus): New
932
            client["last_checker_status"] = -2
874 by Teddy Hogeborn
PEP8 compliance: mandos
933
518.1.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
934
        return settings
874 by Teddy Hogeborn
PEP8 compliance: mandos
935
936
    def __init__(self, settings, name=None, server_settings=None):
243 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
937
        self.name = name
617 by Teddy Hogeborn
* mandos: Bug fix: Don't print output from checkers when running in
938
        if server_settings is None:
939
            server_settings = {}
940
        self.server_settings = server_settings
518.1.15 by Björn Påhlsson
more refactoring in regards to how clients get created
941
        # adding all client settings
723.1.4 by Teddy Hogeborn
Use the .items() method instead of .iteritems().
942
        for setting, value in settings.items():
518.1.15 by Björn Påhlsson
more refactoring in regards to how clients get created
943
            setattr(self, setting, value)
874 by Teddy Hogeborn
PEP8 compliance: mandos
944
542 by Björn Påhlsson
fixed bug with bad stored config state for expires and last_checked_ok.
945
        if self.enabled:
946
            if not hasattr(self, "last_enabled"):
947
                self.last_enabled = datetime.datetime.utcnow()
948
            if not hasattr(self, "expires"):
949
                self.expires = (datetime.datetime.utcnow()
950
                                + self.timeout)
951
        else:
952
            self.last_enabled = None
953
            self.expires = None
874 by Teddy Hogeborn
PEP8 compliance: mandos
954
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
955
        logger.debug("Creating client %r", self.name)
962 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
956
        logger.debug("  Key ID: %s", self.key_id)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
957
        logger.debug("  Fingerprint: %s", self.fingerprint)
543 by Teddy Hogeborn
* mandos: Break some long lines.
958
        self.created = settings.get("created",
959
                                    datetime.datetime.utcnow())
874 by Teddy Hogeborn
PEP8 compliance: mandos
960
518.1.15 by Björn Påhlsson
more refactoring in regards to how clients get created
961
        # attributes specific for this server instance
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
962
        self.checker = None
963
        self.checker_initiator_tag = None
239 by Teddy Hogeborn
* mandos (_datetime_to_dbus_struct): Renamed to "_datetime_to_dbus";
964
        self.disable_initiator_tag = None
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
965
        self.checker_callback_tag = None
315 by Teddy Hogeborn
* mandos (Client.current_checker_command): New attribute.
966
        self.current_checker_command = None
518.2.4 by Teddy Hogeborn
* mandos (_timedelta_to_milliseconds): Renamed to
967
        self.approved = None
24.1.150 by Björn Påhlsson
* mandos: Added ClientDBus.approve_pending property. Exposed
968
        self.approvals_pending = 0
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
969
        self.changedstate = multiprocessing_manager.Condition(
970
            multiprocessing_manager.Lock())
971
        self.client_structure = [attr
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
972
                                 for attr in self.__dict__.keys()
521 by teddy at bsnet
* debian/control (mandos/Depends): Added "python-crypto".
973
                                 if not attr.startswith("_")]
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
974
        self.client_structure.append("client_structure")
874 by Teddy Hogeborn
PEP8 compliance: mandos
975
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
976
        for name, t in inspect.getmembers(
977
                type(self), lambda obj: isinstance(obj, property)):
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
978
            if not name.startswith("_"):
979
                self.client_structure.append(name)
874 by Teddy Hogeborn
PEP8 compliance: mandos
980
520 by Björn Påhlsson
merge persistent state
981
    # Send notice to process children that client state has changed
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
982
    def send_changedstate(self):
520 by Björn Påhlsson
merge persistent state
983
        with self.changedstate:
984
            self.changedstate.notify_all()
874 by Teddy Hogeborn
PEP8 compliance: mandos
985
239 by Teddy Hogeborn
* mandos (_datetime_to_dbus_struct): Renamed to "_datetime_to_dbus";
986
    def enable(self):
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
987
        """Start this client's checker and timeout hooks"""
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
988
        if getattr(self, "enabled", False):
341 by Teddy Hogeborn
Code cleanup and one bug fix.
989
            # Already enabled
990
            return
24.1.179 by Björn Påhlsson
New feature:
991
        self.expires = datetime.datetime.utcnow() + self.timeout
239 by Teddy Hogeborn
* mandos (_datetime_to_dbus_struct): Renamed to "_datetime_to_dbus";
992
        self.enabled = True
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
993
        self.last_enabled = datetime.datetime.utcnow()
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
994
        self.init_checker()
581 by Teddy Hogeborn
* mandos (Client.enable, Client.disable, ClientDBus.approve): Call
995
        self.send_changedstate()
874 by Teddy Hogeborn
PEP8 compliance: mandos
996
402 by Teddy Hogeborn
* mandos (Client.disable): Rename keyword argument "log" to "quiet",
997
    def disable(self, quiet=True):
239 by Teddy Hogeborn
* mandos (_datetime_to_dbus_struct): Renamed to "_datetime_to_dbus";
998
        """Disable this client."""
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
999
        if not getattr(self, "enabled", False):
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
1000
            return False
402 by Teddy Hogeborn
* mandos (Client.disable): Rename keyword argument "log" to "quiet",
1001
        if not quiet:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1002
            logger.info("Disabling client %s", self.name)
581 by Teddy Hogeborn
* mandos (Client.enable, Client.disable, ClientDBus.approve): Call
1003
        if getattr(self, "disable_initiator_tag", None) is not None:
830 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
1004
            GLib.source_remove(self.disable_initiator_tag)
239 by Teddy Hogeborn
* mandos (_datetime_to_dbus_struct): Renamed to "_datetime_to_dbus";
1005
            self.disable_initiator_tag = None
24.1.179 by Björn Påhlsson
New feature:
1006
        self.expires = None
581 by Teddy Hogeborn
* mandos (Client.enable, Client.disable, ClientDBus.approve): Call
1007
        if getattr(self, "checker_initiator_tag", None) is not None:
830 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
1008
            GLib.source_remove(self.checker_initiator_tag)
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
1009
            self.checker_initiator_tag = None
1010
        self.stop_checker()
239 by Teddy Hogeborn
* mandos (_datetime_to_dbus_struct): Renamed to "_datetime_to_dbus";
1011
        self.enabled = False
581 by Teddy Hogeborn
* mandos (Client.enable, Client.disable, ClientDBus.approve): Call
1012
        if not quiet:
1013
            self.send_changedstate()
830 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
1014
        # Do not run this again if called by a GLib.timeout_add
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
1015
        return False
874 by Teddy Hogeborn
PEP8 compliance: mandos
1016
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
1017
    def __del__(self):
239 by Teddy Hogeborn
* mandos (_datetime_to_dbus_struct): Renamed to "_datetime_to_dbus";
1018
        self.disable()
874 by Teddy Hogeborn
PEP8 compliance: mandos
1019
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
1020
    def init_checker(self):
1021
        # Schedule a new checker to be started an 'interval' from now,
1022
        # and every interval from then on.
581 by Teddy Hogeborn
* mandos (Client.enable, Client.disable, ClientDBus.approve): Call
1023
        if self.checker_initiator_tag is not None:
830 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
1024
            GLib.source_remove(self.checker_initiator_tag)
1025
        self.checker_initiator_tag = GLib.timeout_add(
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1026
            int(self.interval.total_seconds() * 1000),
1027
            self.start_checker)
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
1028
        # Schedule a disable() when 'timeout' has passed
581 by Teddy Hogeborn
* mandos (Client.enable, Client.disable, ClientDBus.approve): Call
1029
        if self.disable_initiator_tag is not None:
830 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
1030
            GLib.source_remove(self.disable_initiator_tag)
1031
        self.disable_initiator_tag = GLib.timeout_add(
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1032
            int(self.timeout.total_seconds() * 1000), self.disable)
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
1033
        # Also start a new checker *right now*.
1034
        self.start_checker()
874 by Teddy Hogeborn
PEP8 compliance: mandos
1035
756 by Teddy Hogeborn
Merge change to use multiprocessing module to run checkers.
1036
    def checker_callback(self, source, condition, connection,
1037
                         command):
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
1038
        """The checker has completed, so take appropriate actions."""
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
1039
        self.checker_callback_tag = None
1040
        self.checker = None
749.1.2 by Teddy Hogeborn
mandos (subprocess_call_pipe): Rename to "call_pipe" and take "func".
1041
        # Read return code from connection (see call_pipe)
749.1.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
1042
        returncode = connection.recv()
1043
        connection.close()
874 by Teddy Hogeborn
PEP8 compliance: mandos
1044
749.1.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
1045
        if returncode >= 0:
1046
            self.last_checker_status = returncode
1047
            self.last_checker_signal = None
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
1048
            if self.last_checker_status == 0:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1049
                logger.info("Checker for %(name)s succeeded",
280 by Teddy Hogeborn
* mandos (Client.CheckerCompleted): Changed signature to "nxs"; return
1050
                            vars(self))
281 by Teddy Hogeborn
* mandos (Client.bump_timeout): Renamed to "checked_ok". All callers
1051
                self.checked_ok()
280 by Teddy Hogeborn
* mandos (Client.CheckerCompleted): Changed signature to "nxs"; return
1052
            else:
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1053
                logger.info("Checker for %(name)s failed", vars(self))
280 by Teddy Hogeborn
* mandos (Client.CheckerCompleted): Changed signature to "nxs"; return
1054
        else:
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
1055
            self.last_checker_status = -1
749.1.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
1056
            self.last_checker_signal = -returncode
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1057
            logger.warning("Checker for %(name)s crashed?",
13 by Björn Påhlsson
Added following support:
1058
                           vars(self))
749.1.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
1059
        return False
874 by Teddy Hogeborn
PEP8 compliance: mandos
1060
556 by Teddy Hogeborn
* DBUS-API (se.recompile.Mandos.Client.LastCheckerStatus): New
1061
    def checked_ok(self):
1062
        """Assert that the client has been seen, alive and well."""
1063
        self.last_checked_ok = datetime.datetime.utcnow()
1064
        self.last_checker_status = 0
749.1.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
1065
        self.last_checker_signal = None
556 by Teddy Hogeborn
* DBUS-API (se.recompile.Mandos.Client.LastCheckerStatus): New
1066
        self.bump_timeout()
874 by Teddy Hogeborn
PEP8 compliance: mandos
1067
556 by Teddy Hogeborn
* DBUS-API (se.recompile.Mandos.Client.LastCheckerStatus): New
1068
    def bump_timeout(self, timeout=None):
1069
        """Bump up the timeout for this client."""
24.1.179 by Björn Påhlsson
New feature:
1070
        if timeout is None:
1071
            timeout = self.timeout
505.1.17 by Teddy Hogeborn
* mandos (Client.checked_ok): Bug fix: Handle disabled client.
1072
        if self.disable_initiator_tag is not None:
830 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
1073
            GLib.source_remove(self.disable_initiator_tag)
581 by Teddy Hogeborn
* mandos (Client.enable, Client.disable, ClientDBus.approve): Call
1074
            self.disable_initiator_tag = None
505.1.17 by Teddy Hogeborn
* mandos (Client.checked_ok): Bug fix: Handle disabled client.
1075
        if getattr(self, "enabled", False):
830 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
1076
            self.disable_initiator_tag = GLib.timeout_add(
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1077
                int(timeout.total_seconds() * 1000), self.disable)
505.1.17 by Teddy Hogeborn
* mandos (Client.checked_ok): Bug fix: Handle disabled client.
1078
            self.expires = datetime.datetime.utcnow() + timeout
874 by Teddy Hogeborn
PEP8 compliance: mandos
1079
442 by Teddy Hogeborn
* DBUS-API: Document new "LastApprovalRequest" client property.
1080
    def need_approval(self):
1081
        self.last_approval_request = datetime.datetime.utcnow()
874 by Teddy Hogeborn
PEP8 compliance: mandos
1082
9 by Teddy Hogeborn
* client.cpp (main): Get t_old early since it is used on error exits.
1083
    def start_checker(self):
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
1084
        """Start a new checker subprocess if one is not running.
874 by Teddy Hogeborn
PEP8 compliance: mandos
1085
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
1086
        If a checker already exists, leave it running and do
1087
        nothing."""
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
1088
        # The reason for not killing a running checker is that if we
577 by Teddy Hogeborn
* mandos (Client.start_checker): Reworded comment.
1089
        # did that, and if a checker (for some reason) started running
1090
        # slowly and taking more than 'interval' time, then the client
1091
        # would inevitably timeout, since no checker would get a
1092
        # chance to run to completion.  If we instead leave running
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
1093
        # checkers alone, the checker would have to take more time
411 by Teddy Hogeborn
More consistent terminology: Clients are no longer "invalid" - they
1094
        # than 'timeout' for the client to be disabled, which is as it
1095
        # should be.
874 by Teddy Hogeborn
PEP8 compliance: mandos
1096
749.1.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
1097
        if self.checker is not None and not self.checker.is_alive():
1098
            logger.warning("Checker was not alive; joining")
1099
            self.checker.join()
1100
            self.checker = None
315 by Teddy Hogeborn
* mandos (Client.current_checker_command): New attribute.
1101
        # Start a new checker if needed
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
1102
        if self.checker is None:
583 by Teddy Hogeborn
* mandos (Client.start_checker): Remove undocumented support for "%%s"
1103
            # Escape attributes for the shell
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1104
            escaped_attrs = {
1105
                attr: re.escape(str(getattr(self, attr)))
874 by Teddy Hogeborn
PEP8 compliance: mandos
1106
                for attr in self.runtime_expansions}
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
1107
            try:
583 by Teddy Hogeborn
* mandos (Client.start_checker): Remove undocumented support for "%%s"
1108
                command = self.checker_command % escaped_attrs
1109
            except TypeError as error:
1110
                logger.error('Could not format string "%s"',
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1111
                             self.checker_command,
1112
                             exc_info=error)
1113
                return True     # Try again later
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1114
            self.current_checker_command = command
749.1.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
1115
            logger.info("Starting checker %r for %s", command,
1116
                        self.name)
1117
            # We don't need to redirect stdout and stderr, since
1118
            # in normal mode, that is already done by daemon(),
1119
            # and in debug mode we don't want to.  (Stdin is
1120
            # always replaced by /dev/null.)
1121
            # The exception is when not debugging but nevertheless
1122
            # running in the foreground; use the previously
1123
            # created wnull.
874 by Teddy Hogeborn
PEP8 compliance: mandos
1124
            popen_args = {"close_fds": True,
1125
                          "shell": True,
1126
                          "cwd": "/"}
749.1.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
1127
            if (not self.server_settings["debug"]
1128
                and self.server_settings["foreground"]):
1129
                popen_args.update({"stdout": wnull,
874 by Teddy Hogeborn
PEP8 compliance: mandos
1130
                                   "stderr": wnull})
1131
            pipe = multiprocessing.Pipe(duplex=False)
749.1.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
1132
            self.checker = multiprocessing.Process(
874 by Teddy Hogeborn
PEP8 compliance: mandos
1133
                target=call_pipe,
1134
                args=(pipe[1], subprocess.call, command),
1135
                kwargs=popen_args)
749.1.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
1136
            self.checker.start()
830 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
1137
            self.checker_callback_tag = GLib.io_add_watch(
1138
                pipe[0].fileno(), GLib.IO_IN,
756 by Teddy Hogeborn
Merge change to use multiprocessing module to run checkers.
1139
                self.checker_callback, pipe[0], command)
830 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
1140
        # Re-run this periodically if run by GLib.timeout_add
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
1141
        return True
874 by Teddy Hogeborn
PEP8 compliance: mandos
1142
9 by Teddy Hogeborn
* client.cpp (main): Get t_old early since it is used on error exits.
1143
    def stop_checker(self):
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
1144
        """Force the checker process, if any, to stop."""
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
1145
        if self.checker_callback_tag:
830 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
1146
            GLib.source_remove(self.checker_callback_tag)
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
1147
            self.checker_callback_tag = None
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1148
        if getattr(self, "checker", None) is None:
9 by Teddy Hogeborn
* client.cpp (main): Get t_old early since it is used on error exits.
1149
            return
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1150
        logger.debug("Stopping checker for %(name)s", vars(self))
749.1.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
1151
        self.checker.terminate()
9 by Teddy Hogeborn
* client.cpp (main): Get t_old early since it is used on error exits.
1152
        self.checker = None
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
1153
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
1154
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1155
def dbus_service_property(dbus_interface,
1156
                          signature="v",
1157
                          access="readwrite",
1158
                          byte_arrays=False):
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1159
    """Decorators for marking methods of a DBusObjectWithProperties to
1160
    become properties on the D-Bus.
874 by Teddy Hogeborn
PEP8 compliance: mandos
1161
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1162
    The decorated method will be called with no arguments by "Get"
1163
    and with one argument by "Set".
874 by Teddy Hogeborn
PEP8 compliance: mandos
1164
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1165
    The parameters, where they are supported, are the same as
1166
    dbus.service.method, except there is only "signature", since the
1167
    type from Get() and the type sent to Set() is the same.
1168
    """
411 by Teddy Hogeborn
More consistent terminology: Clients are no longer "invalid" - they
1169
    # Encoding deeply encoded byte arrays is not supported yet by the
1170
    # "Set" method, so we fail early here:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1171
    if byte_arrays and signature != "ay":
1172
        raise ValueError("Byte arrays not supported for non-'ay'"
723.1.5 by Teddy Hogeborn
Use the new auto-numbered "{}" syntax for the .format() string method.
1173
                         " signature {!r}".format(signature))
874 by Teddy Hogeborn
PEP8 compliance: mandos
1174
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1175
    def decorator(func):
1176
        func._dbus_is_property = True
1177
        func._dbus_interface = dbus_interface
1178
        func._dbus_signature = signature
1179
        func._dbus_access = access
1180
        func._dbus_name = func.__name__
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1181
        if func._dbus_name.endswith("_dbus_property"):
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1182
            func._dbus_name = func._dbus_name[:-14]
874 by Teddy Hogeborn
PEP8 compliance: mandos
1183
        func._dbus_get_args_options = {'byte_arrays': byte_arrays}
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1184
        return func
874 by Teddy Hogeborn
PEP8 compliance: mandos
1185
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1186
    return decorator
1187
1188
560.1.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
1189
def dbus_interface_annotations(dbus_interface):
573 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
1190
    """Decorator for marking functions returning interface annotations
874 by Teddy Hogeborn
PEP8 compliance: mandos
1191
560.1.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
1192
    Usage:
874 by Teddy Hogeborn
PEP8 compliance: mandos
1193
560.1.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
1194
    @dbus_interface_annotations("org.example.Interface")
1195
    def _foo(self):  # Function name does not matter
1196
        return {"org.freedesktop.DBus.Deprecated": "true",
1197
                "org.freedesktop.DBus.Property.EmitsChangedSignal":
1198
                    "false"}
1199
    """
874 by Teddy Hogeborn
PEP8 compliance: mandos
1200
560.1.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
1201
    def decorator(func):
1202
        func._dbus_is_interface = True
1203
        func._dbus_interface = dbus_interface
1204
        func._dbus_name = dbus_interface
1205
        return func
874 by Teddy Hogeborn
PEP8 compliance: mandos
1206
560.1.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
1207
    return decorator
1208
1209
561.1.1 by Teddy Hogeborn
Add D-Bus annotations support to methods, signals and properties.
1210
def dbus_annotations(annotations):
1211
    """Decorator to annotate D-Bus methods, signals or properties
1212
    Usage:
874 by Teddy Hogeborn
PEP8 compliance: mandos
1213
732 by Teddy Hogeborn
Emit D-Bus "org.freedesktop.DBus.Properties.PropertiesChanged" signal.
1214
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",
1215
                       "org.freedesktop.DBus.Property."
1216
                       "EmitsChangedSignal": "false"})
561.1.1 by Teddy Hogeborn
Add D-Bus annotations support to methods, signals and properties.
1217
    @dbus_service_property("org.example.Interface", signature="b",
1218
                           access="r")
1219
    def Property_dbus_property(self):
1220
        return dbus.Boolean(False)
874 by Teddy Hogeborn
PEP8 compliance: mandos
1221
784 by Teddy Hogeborn
Refactor D-Bus annotation class out from D-Bus properties class.
1222
    See also the DBusObjectWithAnnotations class.
561.1.1 by Teddy Hogeborn
Add D-Bus annotations support to methods, signals and properties.
1223
    """
874 by Teddy Hogeborn
PEP8 compliance: mandos
1224
561.1.1 by Teddy Hogeborn
Add D-Bus annotations support to methods, signals and properties.
1225
    def decorator(func):
1226
        func._dbus_annotations = annotations
1227
        return func
874 by Teddy Hogeborn
PEP8 compliance: mandos
1228
561.1.1 by Teddy Hogeborn
Add D-Bus annotations support to methods, signals and properties.
1229
    return decorator
1230
1231
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1232
class DBusPropertyException(dbus.exceptions.DBusException):
1233
    """A base class for D-Bus property-related exceptions
1234
    """
729 by Teddy Hogeborn
mandos: Stop using str() and remove unnecessary unicode() calls.
1235
    pass
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1236
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1237
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1238
class DBusPropertyAccessException(DBusPropertyException):
1239
    """A property's access permissions disallows an operation.
1240
    """
1241
    pass
1242
1243
1244
class DBusPropertyNotFound(DBusPropertyException):
1245
    """An attempt was made to access a non-existing property.
1246
    """
1247
    pass
1248
1249
784 by Teddy Hogeborn
Refactor D-Bus annotation class out from D-Bus properties class.
1250
class DBusObjectWithAnnotations(dbus.service.Object):
1251
    """A D-Bus object with annotations.
874 by Teddy Hogeborn
PEP8 compliance: mandos
1252
784 by Teddy Hogeborn
Refactor D-Bus annotation class out from D-Bus properties class.
1253
    Classes inheriting from this can use the dbus_annotations
1254
    decorator to add annotations to methods or signals.
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1255
    """
874 by Teddy Hogeborn
PEP8 compliance: mandos
1256
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1257
    @staticmethod
560.1.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
1258
    def _is_dbus_thing(thing):
1259
        """Returns a function testing if an attribute is a D-Bus thing
874 by Teddy Hogeborn
PEP8 compliance: mandos
1260
560.1.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
1261
        If called like _is_dbus_thing("method") it returns a function
1262
        suitable for use as predicate to inspect.getmembers().
1263
        """
723.1.5 by Teddy Hogeborn
Use the new auto-numbered "{}" syntax for the .format() string method.
1264
        return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
560.1.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
1265
                                   False)
874 by Teddy Hogeborn
PEP8 compliance: mandos
1266
560.1.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
1267
    def _get_all_dbus_things(self, thing):
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1268
        """Returns a generator of (name, attribute) pairs
1269
        """
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1270
        return ((getattr(athing.__get__(self), "_dbus_name", name),
560.1.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
1271
                 athing.__get__(self))
24.1.186 by Björn Påhlsson
transitional stuff actually working
1272
                for cls in self.__class__.__mro__
560.1.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
1273
                for name, athing in
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1274
                inspect.getmembers(cls, self._is_dbus_thing(thing)))
874 by Teddy Hogeborn
PEP8 compliance: mandos
1275
784 by Teddy Hogeborn
Refactor D-Bus annotation class out from D-Bus properties class.
1276
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
874 by Teddy Hogeborn
PEP8 compliance: mandos
1277
                         out_signature="s",
1278
                         path_keyword='object_path',
1279
                         connection_keyword='connection')
784 by Teddy Hogeborn
Refactor D-Bus annotation class out from D-Bus properties class.
1280
    def Introspect(self, object_path, connection):
1281
        """Overloading of standard D-Bus method.
874 by Teddy Hogeborn
PEP8 compliance: mandos
1282
784 by Teddy Hogeborn
Refactor D-Bus annotation class out from D-Bus properties class.
1283
        Inserts annotation tags on methods and signals.
1284
        """
1285
        xmlstring = dbus.service.Object.Introspect(self, object_path,
1286
                                                   connection)
1287
        try:
1288
            document = xml.dom.minidom.parseString(xmlstring)
874 by Teddy Hogeborn
PEP8 compliance: mandos
1289
784 by Teddy Hogeborn
Refactor D-Bus annotation class out from D-Bus properties class.
1290
            for if_tag in document.getElementsByTagName("interface"):
1291
                # Add annotation tags
1292
                for typ in ("method", "signal"):
1293
                    for tag in if_tag.getElementsByTagName(typ):
1294
                        annots = dict()
1295
                        for name, prop in (self.
1296
                                           _get_all_dbus_things(typ)):
1297
                            if (name == tag.getAttribute("name")
1298
                                and prop._dbus_interface
1299
                                == if_tag.getAttribute("name")):
1300
                                annots.update(getattr(
1301
                                    prop, "_dbus_annotations", {}))
1302
                        for name, value in annots.items():
1303
                            ann_tag = document.createElement(
1304
                                "annotation")
1305
                            ann_tag.setAttribute("name", name)
1306
                            ann_tag.setAttribute("value", value)
1307
                            tag.appendChild(ann_tag)
1308
                # Add interface annotation tags
1309
                for annotation, value in dict(
1310
                    itertools.chain.from_iterable(
1311
                        annotations().items()
1312
                        for name, annotations
1313
                        in self._get_all_dbus_things("interface")
1314
                        if name == if_tag.getAttribute("name")
1315
                        )).items():
1316
                    ann_tag = document.createElement("annotation")
1317
                    ann_tag.setAttribute("name", annotation)
1318
                    ann_tag.setAttribute("value", value)
1319
                    if_tag.appendChild(ann_tag)
1320
                # Fix argument name for the Introspect method itself
1321
                if (if_tag.getAttribute("name")
874 by Teddy Hogeborn
PEP8 compliance: mandos
1322
                    == dbus.INTROSPECTABLE_IFACE):
784 by Teddy Hogeborn
Refactor D-Bus annotation class out from D-Bus properties class.
1323
                    for cn in if_tag.getElementsByTagName("method"):
1324
                        if cn.getAttribute("name") == "Introspect":
1325
                            for arg in cn.getElementsByTagName("arg"):
1326
                                if (arg.getAttribute("direction")
1327
                                    == "out"):
1328
                                    arg.setAttribute("name",
1329
                                                     "xml_data")
1330
            xmlstring = document.toxml("utf-8")
1331
            document.unlink()
1332
        except (AttributeError, xml.dom.DOMException,
1333
                xml.parsers.expat.ExpatError) as error:
1334
            logger.error("Failed to override Introspection method",
1335
                         exc_info=error)
1336
        return xmlstring
1337
1338
1339
class DBusObjectWithProperties(DBusObjectWithAnnotations):
1340
    """A D-Bus object with properties.
874 by Teddy Hogeborn
PEP8 compliance: mandos
1341
784 by Teddy Hogeborn
Refactor D-Bus annotation class out from D-Bus properties class.
1342
    Classes inheriting from this can use the dbus_service_property
1343
    decorator to expose methods as D-Bus properties.  It exposes the
1344
    standard Get(), Set(), and GetAll() methods on the D-Bus.
1345
    """
874 by Teddy Hogeborn
PEP8 compliance: mandos
1346
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1347
    def _get_dbus_property(self, interface_name, property_name):
1348
        """Returns a bound method if one exists which is a D-Bus
1349
        property with the specified name and interface.
1350
        """
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1351
        for cls in self.__class__.__mro__:
1352
            for name, value in inspect.getmembers(
1353
                    cls, self._is_dbus_thing("property")):
505.1.3 by Teddy Hogeborn
* mandos: Break long lines.
1354
                if (value._dbus_name == property_name
1355
                    and value._dbus_interface == interface_name):
24.1.186 by Björn Påhlsson
transitional stuff actually working
1356
                    return value.__get__(self)
874 by Teddy Hogeborn
PEP8 compliance: mandos
1357
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1358
        # No such property
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1359
        raise DBusPropertyNotFound("{}:{}.{}".format(
1360
            self.dbus_object_path, interface_name, property_name))
874 by Teddy Hogeborn
PEP8 compliance: mandos
1361
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
1362
    @classmethod
1363
    def _get_all_interface_names(cls):
1364
        """Get a sequence of all interfaces supported by an object"""
1365
        return (name for name in set(getattr(getattr(x, attr),
1366
                                             "_dbus_interface", None)
1367
                                     for x in (inspect.getmro(cls))
1368
                                     for attr in dir(x))
1369
                if name is not None)
874 by Teddy Hogeborn
PEP8 compliance: mandos
1370
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1371
    @dbus.service.method(dbus.PROPERTIES_IFACE,
1372
                         in_signature="ss",
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1373
                         out_signature="v")
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1374
    def Get(self, interface_name, property_name):
1375
        """Standard D-Bus property Get() method, see D-Bus standard.
1376
        """
1377
        prop = self._get_dbus_property(interface_name, property_name)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1378
        if prop._dbus_access == "write":
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1379
            raise DBusPropertyAccessException(property_name)
1380
        value = prop()
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1381
        if not hasattr(value, "variant_level"):
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1382
            return value
1383
        return type(value)(value, variant_level=value.variant_level+1)
874 by Teddy Hogeborn
PEP8 compliance: mandos
1384
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1385
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1386
    def Set(self, interface_name, property_name, value):
1387
        """Standard D-Bus property Set() method, see D-Bus standard.
1388
        """
1389
        prop = self._get_dbus_property(interface_name, property_name)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1390
        if prop._dbus_access == "read":
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1391
            raise DBusPropertyAccessException(property_name)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1392
        if prop._dbus_get_args_options["byte_arrays"]:
411 by Teddy Hogeborn
More consistent terminology: Clients are no longer "invalid" - they
1393
            # The byte_arrays option is not supported yet on
1394
            # signatures other than "ay".
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1395
            if prop._dbus_signature != "ay":
649 by Teddy Hogeborn
Minor code fix; raise only exception instances, not classes.
1396
                raise ValueError("Byte arrays not supported for non-"
723.1.5 by Teddy Hogeborn
Use the new auto-numbered "{}" syntax for the .format() string method.
1397
                                 "'ay' signature {!r}"
649 by Teddy Hogeborn
Minor code fix; raise only exception instances, not classes.
1398
                                 .format(prop._dbus_signature))
546 by Teddy Hogeborn
* debian/rules (binary-common): Exclude network-hooks.d from
1399
            value = dbus.ByteArray(b''.join(chr(byte)
1400
                                            for byte in value))
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1401
        prop(value)
874 by Teddy Hogeborn
PEP8 compliance: mandos
1402
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1403
    @dbus.service.method(dbus.PROPERTIES_IFACE,
1404
                         in_signature="s",
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1405
                         out_signature="a{sv}")
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1406
    def GetAll(self, interface_name):
1407
        """Standard D-Bus property GetAll() method, see D-Bus
1408
        standard.
874 by Teddy Hogeborn
PEP8 compliance: mandos
1409
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1410
        Note: Will not include properties with access="write".
1411
        """
518.1.5 by Björn Påhlsson
First run of python-lint. Fixed some *obviously* bad code and turned
1412
        properties = {}
560.1.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
1413
        for name, prop in self._get_all_dbus_things("property"):
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1414
            if (interface_name
1415
                and interface_name != prop._dbus_interface):
1416
                # Interface non-empty but did not match
1417
                continue
1418
            # Ignore write-only properties
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1419
            if prop._dbus_access == "write":
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1420
                continue
1421
            value = prop()
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1422
            if not hasattr(value, "variant_level"):
518.1.5 by Björn Påhlsson
First run of python-lint. Fixed some *obviously* bad code and turned
1423
                properties[name] = value
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1424
                continue
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1425
            properties[name] = type(value)(
874 by Teddy Hogeborn
PEP8 compliance: mandos
1426
                value, variant_level=value.variant_level + 1)
518.1.5 by Björn Påhlsson
First run of python-lint. Fixed some *obviously* bad code and turned
1427
        return dbus.Dictionary(properties, signature="sv")
874 by Teddy Hogeborn
PEP8 compliance: mandos
1428
732 by Teddy Hogeborn
Emit D-Bus "org.freedesktop.DBus.Properties.PropertiesChanged" signal.
1429
    @dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")
1430
    def PropertiesChanged(self, interface_name, changed_properties,
1431
                          invalidated_properties):
1432
        """Standard D-Bus PropertiesChanged() signal, see D-Bus
1433
        standard.
1434
        """
1435
        pass
874 by Teddy Hogeborn
PEP8 compliance: mandos
1436
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1437
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1438
                         out_signature="s",
1439
                         path_keyword='object_path',
1440
                         connection_keyword='connection')
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1441
    def Introspect(self, object_path, connection):
560.1.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
1442
        """Overloading of standard D-Bus method.
874 by Teddy Hogeborn
PEP8 compliance: mandos
1443
560.1.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
1444
        Inserts property tags and interface annotation tags.
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1445
        """
784 by Teddy Hogeborn
Refactor D-Bus annotation class out from D-Bus properties class.
1446
        xmlstring = DBusObjectWithAnnotations.Introspect(self,
1447
                                                         object_path,
1448
                                                         connection)
387 by Teddy Hogeborn
* mandos (ClientDBus.ReceivedSecret): Renamed to "GotSecret". All
1449
        try:
1450
            document = xml.dom.minidom.parseString(xmlstring)
874 by Teddy Hogeborn
PEP8 compliance: mandos
1451
387 by Teddy Hogeborn
* mandos (ClientDBus.ReceivedSecret): Renamed to "GotSecret". All
1452
            def make_tag(document, name, prop):
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1453
                e = document.createElement("property")
1454
                e.setAttribute("name", name)
1455
                e.setAttribute("type", prop._dbus_signature)
1456
                e.setAttribute("access", prop._dbus_access)
387 by Teddy Hogeborn
* mandos (ClientDBus.ReceivedSecret): Renamed to "GotSecret". All
1457
                return e
874 by Teddy Hogeborn
PEP8 compliance: mandos
1458
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1459
            for if_tag in document.getElementsByTagName("interface"):
560.1.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
1460
                # Add property tags
387 by Teddy Hogeborn
* mandos (ClientDBus.ReceivedSecret): Renamed to "GotSecret". All
1461
                for tag in (make_tag(document, name, prop)
1462
                            for name, prop
560.1.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
1463
                            in self._get_all_dbus_things("property")
387 by Teddy Hogeborn
* mandos (ClientDBus.ReceivedSecret): Renamed to "GotSecret". All
1464
                            if prop._dbus_interface
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1465
                            == if_tag.getAttribute("name")):
387 by Teddy Hogeborn
* mandos (ClientDBus.ReceivedSecret): Renamed to "GotSecret". All
1466
                    if_tag.appendChild(tag)
784 by Teddy Hogeborn
Refactor D-Bus annotation class out from D-Bus properties class.
1467
                # Add annotation tags for properties
1468
                for tag in if_tag.getElementsByTagName("property"):
1469
                    annots = dict()
1470
                    for name, prop in self._get_all_dbus_things(
1471
                            "property"):
1472
                        if (name == tag.getAttribute("name")
1473
                            and prop._dbus_interface
1474
                            == if_tag.getAttribute("name")):
1475
                            annots.update(getattr(
1476
                                prop, "_dbus_annotations", {}))
1477
                    for name, value in annots.items():
1478
                        ann_tag = document.createElement(
1479
                            "annotation")
1480
                        ann_tag.setAttribute("name", name)
1481
                        ann_tag.setAttribute("value", value)
1482
                        tag.appendChild(ann_tag)
387 by Teddy Hogeborn
* mandos (ClientDBus.ReceivedSecret): Renamed to "GotSecret". All
1483
                # Add the names to the return values for the
1484
                # "org.freedesktop.DBus.Properties" methods
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1485
                if (if_tag.getAttribute("name")
1486
                    == "org.freedesktop.DBus.Properties"):
1487
                    for cn in if_tag.getElementsByTagName("method"):
1488
                        if cn.getAttribute("name") == "Get":
1489
                            for arg in cn.getElementsByTagName("arg"):
1490
                                if (arg.getAttribute("direction")
1491
                                    == "out"):
1492
                                    arg.setAttribute("name", "value")
1493
                        elif cn.getAttribute("name") == "GetAll":
1494
                            for arg in cn.getElementsByTagName("arg"):
1495
                                if (arg.getAttribute("direction")
1496
                                    == "out"):
1497
                                    arg.setAttribute("name", "props")
1498
            xmlstring = document.toxml("utf-8")
387 by Teddy Hogeborn
* mandos (ClientDBus.ReceivedSecret): Renamed to "GotSecret". All
1499
            document.unlink()
1500
        except (AttributeError, xml.dom.DOMException,
482 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
1501
                xml.parsers.expat.ExpatError) as error:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1502
            logger.error("Failed to override Introspection method",
565 by Teddy Hogeborn
* mandos (AvahiService.rename, Client.start_checker,
1503
                         exc_info=error)
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1504
        return xmlstring
1505
888 by Teddy Hogeborn
Add more PEP8 compliance (as per the "pycodestyle" tool).
1506
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
1507
try:
1508
    dbus.OBJECT_MANAGER_IFACE
1509
except AttributeError:
1510
    dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
1511
874 by Teddy Hogeborn
PEP8 compliance: mandos
1512
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
1513
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
1514
    """A D-Bus object with an ObjectManager.
874 by Teddy Hogeborn
PEP8 compliance: mandos
1515
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
1516
    Classes inheriting from this exposes the standard
1517
    GetManagedObjects call and the InterfacesAdded and
1518
    InterfacesRemoved signals on the standard
1519
    "org.freedesktop.DBus.ObjectManager" interface.
874 by Teddy Hogeborn
PEP8 compliance: mandos
1520
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
1521
    Note: No signals are sent automatically; they must be sent
1522
    manually.
1523
    """
1524
    @dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
874 by Teddy Hogeborn
PEP8 compliance: mandos
1525
                         out_signature="a{oa{sa{sv}}}")
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
1526
    def GetManagedObjects(self):
1527
        """This function must be overridden"""
1528
        raise NotImplementedError()
874 by Teddy Hogeborn
PEP8 compliance: mandos
1529
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
1530
    @dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
874 by Teddy Hogeborn
PEP8 compliance: mandos
1531
                         signature="oa{sa{sv}}")
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
1532
    def InterfacesAdded(self, object_path, interfaces_and_properties):
1533
        pass
874 by Teddy Hogeborn
PEP8 compliance: mandos
1534
1535
    @dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature="oas")
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
1536
    def InterfacesRemoved(self, object_path, interfaces):
1537
        pass
874 by Teddy Hogeborn
PEP8 compliance: mandos
1538
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
1539
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
874 by Teddy Hogeborn
PEP8 compliance: mandos
1540
                         out_signature="s",
1541
                         path_keyword='object_path',
1542
                         connection_keyword='connection')
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
1543
    def Introspect(self, object_path, connection):
1544
        """Overloading of standard D-Bus method.
874 by Teddy Hogeborn
PEP8 compliance: mandos
1545
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
1546
        Override return argument name of GetManagedObjects to be
1547
        "objpath_interfaces_and_properties"
1548
        """
786 by Teddy Hogeborn
Server Bug fix: Make D-Bus introspection work again.
1549
        xmlstring = DBusObjectWithAnnotations.Introspect(self,
1550
                                                         object_path,
1551
                                                         connection)
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
1552
        try:
1553
            document = xml.dom.minidom.parseString(xmlstring)
874 by Teddy Hogeborn
PEP8 compliance: mandos
1554
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
1555
            for if_tag in document.getElementsByTagName("interface"):
1556
                # Fix argument name for the GetManagedObjects method
1557
                if (if_tag.getAttribute("name")
874 by Teddy Hogeborn
PEP8 compliance: mandos
1558
                    == dbus.OBJECT_MANAGER_IFACE):
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
1559
                    for cn in if_tag.getElementsByTagName("method"):
1560
                        if (cn.getAttribute("name")
1561
                            == "GetManagedObjects"):
1562
                            for arg in cn.getElementsByTagName("arg"):
1563
                                if (arg.getAttribute("direction")
1564
                                    == "out"):
1565
                                    arg.setAttribute(
1566
                                        "name",
1567
                                        "objpath_interfaces"
1568
                                        "_and_properties")
1569
            xmlstring = document.toxml("utf-8")
1570
            document.unlink()
1571
        except (AttributeError, xml.dom.DOMException,
1572
                xml.parsers.expat.ExpatError) as error:
1573
            logger.error("Failed to override Introspection method",
874 by Teddy Hogeborn
PEP8 compliance: mandos
1574
                         exc_info=error)
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
1575
        return xmlstring
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1576
874 by Teddy Hogeborn
PEP8 compliance: mandos
1577
587 by Teddy Hogeborn
* Makefile (DOCBOOKTOMAN): Only run man --warnings if both "man" and
1578
def datetime_to_dbus(dt, variant_level=0):
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1579
    """Convert a UTC datetime.datetime() to a D-Bus type."""
1580
    if dt is None:
874 by Teddy Hogeborn
PEP8 compliance: mandos
1581
        return dbus.String("", variant_level=variant_level)
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1582
    return dbus.String(dt.isoformat(), variant_level=variant_level)
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1583
518.1.6 by Teddy Hogeborn
* mandos: Fix whitespace.
1584
575 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1585
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
1586
    """A class decorator; applied to a subclass of
1587
    dbus.service.Object, it will add alternate D-Bus attributes with
1588
    interface names according to the "alt_interface_names" mapping.
1589
    Usage:
874 by Teddy Hogeborn
PEP8 compliance: mandos
1590
587 by Teddy Hogeborn
* Makefile (DOCBOOKTOMAN): Only run man --warnings if both "man" and
1591
    @alternate_dbus_interfaces({"org.example.Interface":
1592
                                    "net.example.AlternateInterface"})
575 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1593
    class SampleDBusObject(dbus.service.Object):
1594
        @dbus.service.method("org.example.Interface")
1595
        def SampleDBusMethod():
1596
            pass
874 by Teddy Hogeborn
PEP8 compliance: mandos
1597
575 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1598
    The above "SampleDBusMethod" on "SampleDBusObject" will be
1599
    reachable via two interfaces: "org.example.Interface" and
1600
    "net.example.AlternateInterface", the latter of which will have
1601
    its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
1602
    "true", unless "deprecate" is passed with a False value.
874 by Teddy Hogeborn
PEP8 compliance: mandos
1603
575 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1604
    This works for methods and signals, and also for D-Bus properties
1605
    (from DBusObjectWithProperties) and interfaces (from the
1606
    dbus_interface_annotations decorator).
505.1.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1607
    """
874 by Teddy Hogeborn
PEP8 compliance: mandos
1608
575 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1609
    def wrapper(cls):
1610
        for orig_interface_name, alt_interface_name in (
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1611
                alt_interface_names.items()):
575 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1612
            attr = {}
1613
            interface_names = set()
1614
            # Go though all attributes of the class
1615
            for attrname, attribute in inspect.getmembers(cls):
505.1.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1616
                # Ignore non-D-Bus attributes, and D-Bus attributes
1617
                # with the wrong interface name
1618
                if (not hasattr(attribute, "_dbus_interface")
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1619
                    or not attribute._dbus_interface.startswith(
1620
                        orig_interface_name)):
505.1.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1621
                    continue
1622
                # Create an alternate D-Bus interface name based on
1623
                # the current name
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1624
                alt_interface = attribute._dbus_interface.replace(
1625
                    orig_interface_name, alt_interface_name)
575 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1626
                interface_names.add(alt_interface)
505.1.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1627
                # Is this a D-Bus signal?
1628
                if getattr(attribute, "_dbus_is_signal", False):
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
1629
                    # Extract the original non-method undecorated
1630
                    # function by black magic
756 by Teddy Hogeborn
Merge change to use multiprocessing module to run checkers.
1631
                    if sys.version_info.major == 2:
754 by Teddy Hogeborn
mandos: More Python 3 fixes.
1632
                        nonmethod_func = (dict(
1633
                            zip(attribute.func_code.co_freevars,
1634
                                attribute.__closure__))
1635
                                          ["func"].cell_contents)
1636
                    else:
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
1637
                        nonmethod_func = (dict(
1638
                            zip(attribute.__code__.co_freevars,
1639
                                attribute.__closure__))
1640
                                          ["func"].cell_contents)
505.1.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1641
                    # Create a new, but exactly alike, function
1642
                    # object, and decorate it to be a new D-Bus signal
1643
                    # with the alternate D-Bus interface name
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
1644
                    new_function = copy_function(nonmethod_func)
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1645
                    new_function = (dbus.service.signal(
754 by Teddy Hogeborn
mandos: More Python 3 fixes.
1646
                        alt_interface,
1647
                        attribute._dbus_signature)(new_function))
561.1.1 by Teddy Hogeborn
Add D-Bus annotations support to methods, signals and properties.
1648
                    # Copy annotations, if any
1649
                    try:
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1650
                        new_function._dbus_annotations = dict(
1651
                            attribute._dbus_annotations)
561.1.1 by Teddy Hogeborn
Add D-Bus annotations support to methods, signals and properties.
1652
                    except AttributeError:
1653
                        pass
874 by Teddy Hogeborn
PEP8 compliance: mandos
1654
505.1.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1655
                    # Define a creator of a function to call both the
575 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1656
                    # original and alternate functions, so both the
1657
                    # original and alternate signals gets sent when
1658
                    # the function is called
505.1.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1659
                    def fixscope(func1, func2):
1660
                        """This function is a scope container to pass
1661
                        func1 and func2 to the "call_both" function
1662
                        outside of its arguments"""
874 by Teddy Hogeborn
PEP8 compliance: mandos
1663
786 by Teddy Hogeborn
Server Bug fix: Make D-Bus introspection work again.
1664
                        @functools.wraps(func2)
505.1.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1665
                        def call_both(*args, **kwargs):
1666
                            """This function will emit two D-Bus
1667
                            signals by calling func1 and func2"""
1668
                            func1(*args, **kwargs)
1669
                            func2(*args, **kwargs)
874 by Teddy Hogeborn
PEP8 compliance: mandos
1670
                        # Make wrapper function look like a D-Bus
1671
                        # signal
786 by Teddy Hogeborn
Server Bug fix: Make D-Bus introspection work again.
1672
                        for name, attr in inspect.getmembers(func2):
1673
                            if name.startswith("_dbus_"):
1674
                                setattr(call_both, name, attr)
874 by Teddy Hogeborn
PEP8 compliance: mandos
1675
505.1.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1676
                        return call_both
1677
                    # Create the "call_both" function and add it to
1678
                    # the class
575 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1679
                    attr[attrname] = fixscope(attribute, new_function)
505.1.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1680
                # Is this a D-Bus method?
1681
                elif getattr(attribute, "_dbus_is_method", False):
1682
                    # Create a new, but exactly alike, function
1683
                    # object.  Decorate it to be a new D-Bus method
1684
                    # with the alternate D-Bus interface name.  Add it
1685
                    # to the class.
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1686
                    attr[attrname] = (
1687
                        dbus.service.method(
1688
                            alt_interface,
1689
                            attribute._dbus_in_signature,
1690
                            attribute._dbus_out_signature)
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
1691
                        (copy_function(attribute)))
561.1.1 by Teddy Hogeborn
Add D-Bus annotations support to methods, signals and properties.
1692
                    # Copy annotations, if any
1693
                    try:
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1694
                        attr[attrname]._dbus_annotations = dict(
1695
                            attribute._dbus_annotations)
561.1.1 by Teddy Hogeborn
Add D-Bus annotations support to methods, signals and properties.
1696
                    except AttributeError:
1697
                        pass
505.1.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1698
                # Is this a D-Bus property?
1699
                elif getattr(attribute, "_dbus_is_property", False):
1700
                    # Create a new, but exactly alike, function
1701
                    # object, and decorate it to be a new D-Bus
1702
                    # property with the alternate D-Bus interface
1703
                    # name.  Add it to the class.
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1704
                    attr[attrname] = (dbus_service_property(
1705
                        alt_interface, attribute._dbus_signature,
1706
                        attribute._dbus_access,
1707
                        attribute._dbus_get_args_options
1708
                        ["byte_arrays"])
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
1709
                                      (copy_function(attribute)))
561.1.1 by Teddy Hogeborn
Add D-Bus annotations support to methods, signals and properties.
1710
                    # Copy annotations, if any
1711
                    try:
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1712
                        attr[attrname]._dbus_annotations = dict(
1713
                            attribute._dbus_annotations)
561.1.1 by Teddy Hogeborn
Add D-Bus annotations support to methods, signals and properties.
1714
                    except AttributeError:
1715
                        pass
560.1.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
1716
                # Is this a D-Bus interface?
1717
                elif getattr(attribute, "_dbus_is_interface", False):
1718
                    # Create a new, but exactly alike, function
1719
                    # object.  Decorate it to be a new D-Bus interface
1720
                    # with the alternate D-Bus interface name.  Add it
1721
                    # to the class.
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1722
                    attr[attrname] = (
1723
                        dbus_interface_annotations(alt_interface)
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
1724
                        (copy_function(attribute)))
575 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1725
            if deprecate:
1726
                # Deprecate all alternate interfaces
874 by Teddy Hogeborn
PEP8 compliance: mandos
1727
                iname = "_AlternateDBusNames_interface_annotation{}"
575 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1728
                for interface_name in interface_names:
874 by Teddy Hogeborn
PEP8 compliance: mandos
1729
575 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1730
                    @dbus_interface_annotations(interface_name)
1731
                    def func(self):
874 by Teddy Hogeborn
PEP8 compliance: mandos
1732
                        return {"org.freedesktop.DBus.Deprecated":
1733
                                "true"}
575 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1734
                    # Find an unused name
1735
                    for aname in (iname.format(i)
1736
                                  for i in itertools.count()):
1737
                        if aname not in attr:
1738
                            attr[aname] = func
1739
                            break
1740
            if interface_names:
1741
                # Replace the class with a new subclass of it with
1742
                # methods, signals, etc. as created above.
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
1743
                if sys.version_info.major == 2:
1744
                    cls = type(b"{}Alternate".format(cls.__name__),
1745
                               (cls, ), attr)
1746
                else:
1747
                    cls = type("{}Alternate".format(cls.__name__),
1748
                               (cls, ), attr)
575 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1749
        return cls
874 by Teddy Hogeborn
PEP8 compliance: mandos
1750
575 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1751
    return wrapper
1752
1753
1754
@alternate_dbus_interfaces({"se.recompile.Mandos":
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1755
                            "se.bsnet.fukt.Mandos"})
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1756
class ClientDBus(Client, DBusObjectWithProperties):
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1757
    """A Client class using D-Bus
874 by Teddy Hogeborn
PEP8 compliance: mandos
1758
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1759
    Attributes:
338 by Teddy Hogeborn
* mandos: Minor doc string fixes.
1760
    dbus_object_path: dbus.ObjectPath
1761
    bus: dbus.SystemBus()
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1762
    """
874 by Teddy Hogeborn
PEP8 compliance: mandos
1763
438 by Teddy Hogeborn
* mandos (Client.runtime_expansions): New attribute containing the
1764
    runtime_expansions = (Client.runtime_expansions
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1765
                          + ("dbus_object_path", ))
874 by Teddy Hogeborn
PEP8 compliance: mandos
1766
732 by Teddy Hogeborn
Emit D-Bus "org.freedesktop.DBus.Properties.PropertiesChanged" signal.
1767
    _interface = "se.recompile.Mandos.Client"
874 by Teddy Hogeborn
PEP8 compliance: mandos
1768
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1769
    # dbus.service.Object doesn't use super(), so we can't either.
874 by Teddy Hogeborn
PEP8 compliance: mandos
1770
1771
    def __init__(self, bus=None, *args, **kwargs):
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
1772
        self.bus = bus
1773
        Client.__init__(self, *args, **kwargs)
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1774
        # Only now, when this client is initialized, can it show up on
1775
        # the D-Bus
730 by Teddy Hogeborn
mandos: Replace unicode() with str().
1776
        client_object_name = str(self.name).translate(
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1777
            {ord("."): ord("_"),
1778
             ord("-"): ord("_")})
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1779
        self.dbus_object_path = dbus.ObjectPath(
1780
            "/clients/" + client_object_name)
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1781
        DBusObjectWithProperties.__init__(self, self.bus,
1782
                                          self.dbus_object_path)
874 by Teddy Hogeborn
PEP8 compliance: mandos
1783
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1784
    def notifychangeproperty(transform_func, dbus_name,
1785
                             type_func=lambda x: x,
1786
                             variant_level=1,
1787
                             invalidate_only=False,
732 by Teddy Hogeborn
Emit D-Bus "org.freedesktop.DBus.Properties.PropertiesChanged" signal.
1788
                             _interface=_interface):
505.1.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1789
        """ Modify a variable so that it's a property which announces
1790
        its changes to DBus.
874 by Teddy Hogeborn
PEP8 compliance: mandos
1791
505.1.15 by Teddy Hogeborn
Bug fix: Make D-Bus properties settable again.
1792
        transform_fun: Function that takes a value and a variant_level
1793
                       and transforms it to a D-Bus type.
505.1.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1794
        dbus_name: D-Bus name of the variable
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1795
        type_func: Function that transform the value before sending it
505.1.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1796
                   to the D-Bus.  Default: no transform
1797
        variant_level: D-Bus variant level.  Default: 1
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1798
        """
723.1.5 by Teddy Hogeborn
Use the new auto-numbered "{}" syntax for the .format() string method.
1799
        attrname = "_{}".format(dbus_name)
874 by Teddy Hogeborn
PEP8 compliance: mandos
1800
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1801
        def setter(self, value):
1802
            if hasattr(self, "dbus_object_path"):
505.1.6 by Teddy Hogeborn
* mandos (ClientDBus.notifychangeproperty): Bug fix: Use instance
1803
                if (not hasattr(self, attrname) or
1804
                    type_func(getattr(self, attrname, None))
1805
                    != type_func(value)):
732 by Teddy Hogeborn
Emit D-Bus "org.freedesktop.DBus.Properties.PropertiesChanged" signal.
1806
                    if invalidate_only:
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1807
                        self.PropertiesChanged(
1808
                            _interface, dbus.Dictionary(),
1809
                            dbus.Array((dbus_name, )))
732 by Teddy Hogeborn
Emit D-Bus "org.freedesktop.DBus.Properties.PropertiesChanged" signal.
1810
                    else:
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1811
                        dbus_value = transform_func(
1812
                            type_func(value),
874 by Teddy Hogeborn
PEP8 compliance: mandos
1813
                            variant_level=variant_level)
732 by Teddy Hogeborn
Emit D-Bus "org.freedesktop.DBus.Properties.PropertiesChanged" signal.
1814
                        self.PropertyChanged(dbus.String(dbus_name),
1815
                                             dbus_value)
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1816
                        self.PropertiesChanged(
1817
                            _interface,
874 by Teddy Hogeborn
PEP8 compliance: mandos
1818
                            dbus.Dictionary({dbus.String(dbus_name):
1819
                                             dbus_value}),
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1820
                            dbus.Array())
505.1.6 by Teddy Hogeborn
* mandos (ClientDBus.notifychangeproperty): Bug fix: Use instance
1821
            setattr(self, attrname, value)
874 by Teddy Hogeborn
PEP8 compliance: mandos
1822
505.1.6 by Teddy Hogeborn
* mandos (ClientDBus.notifychangeproperty): Bug fix: Use instance
1823
        return property(lambda self: getattr(self, attrname), setter)
874 by Teddy Hogeborn
PEP8 compliance: mandos
1824
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1825
    expires = notifychangeproperty(datetime_to_dbus, "Expires")
1826
    approvals_pending = notifychangeproperty(dbus.Boolean,
1827
                                             "ApprovalPending",
874 by Teddy Hogeborn
PEP8 compliance: mandos
1828
                                             type_func=bool)
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1829
    enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1830
    last_enabled = notifychangeproperty(datetime_to_dbus,
1831
                                        "LastEnabled")
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1832
    checker = notifychangeproperty(
1833
        dbus.Boolean, "CheckerRunning",
874 by Teddy Hogeborn
PEP8 compliance: mandos
1834
        type_func=lambda checker: checker is not None)
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1835
    last_checked_ok = notifychangeproperty(datetime_to_dbus,
1836
                                           "LastCheckedOK")
556 by Teddy Hogeborn
* DBUS-API (se.recompile.Mandos.Client.LastCheckerStatus): New
1837
    last_checker_status = notifychangeproperty(dbus.Int16,
1838
                                               "LastCheckerStatus")
505.1.3 by Teddy Hogeborn
* mandos: Break long lines.
1839
    last_approval_request = notifychangeproperty(
1840
        datetime_to_dbus, "LastApprovalRequest")
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1841
    approved_by_default = notifychangeproperty(dbus.Boolean,
1842
                                               "ApprovedByDefault")
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1843
    approval_delay = notifychangeproperty(
1844
        dbus.UInt64, "ApprovalDelay",
874 by Teddy Hogeborn
PEP8 compliance: mandos
1845
        type_func=lambda td: td.total_seconds() * 1000)
505.1.3 by Teddy Hogeborn
* mandos: Break long lines.
1846
    approval_duration = notifychangeproperty(
518.2.9 by Teddy Hogeborn
* mandos (ClientDBus.approval_delay, ClientDBus.approval_duration,
1847
        dbus.UInt64, "ApprovalDuration",
874 by Teddy Hogeborn
PEP8 compliance: mandos
1848
        type_func=lambda td: td.total_seconds() * 1000)
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1849
    host = notifychangeproperty(dbus.String, "Host")
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1850
    timeout = notifychangeproperty(
1851
        dbus.UInt64, "Timeout",
874 by Teddy Hogeborn
PEP8 compliance: mandos
1852
        type_func=lambda td: td.total_seconds() * 1000)
505.1.3 by Teddy Hogeborn
* mandos: Break long lines.
1853
    extended_timeout = notifychangeproperty(
518.2.9 by Teddy Hogeborn
* mandos (ClientDBus.approval_delay, ClientDBus.approval_duration,
1854
        dbus.UInt64, "ExtendedTimeout",
874 by Teddy Hogeborn
PEP8 compliance: mandos
1855
        type_func=lambda td: td.total_seconds() * 1000)
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1856
    interval = notifychangeproperty(
1857
        dbus.UInt64, "Interval",
874 by Teddy Hogeborn
PEP8 compliance: mandos
1858
        type_func=lambda td: td.total_seconds() * 1000)
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1859
    checker_command = notifychangeproperty(dbus.String, "Checker")
732 by Teddy Hogeborn
Emit D-Bus "org.freedesktop.DBus.Properties.PropertiesChanged" signal.
1860
    secret = notifychangeproperty(dbus.ByteArray, "Secret",
1861
                                  invalidate_only=True)
874 by Teddy Hogeborn
PEP8 compliance: mandos
1862
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1863
    del notifychangeproperty
874 by Teddy Hogeborn
PEP8 compliance: mandos
1864
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1865
    def __del__(self, *args, **kwargs):
1866
        try:
1867
            self.remove_from_connection()
329 by Teddy Hogeborn
* mandos (ClientDBus.__del__): Bug fix: Correct mispasted code, and do
1868
        except LookupError:
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1869
            pass
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1870
        if hasattr(DBusObjectWithProperties, "__del__"):
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1871
            DBusObjectWithProperties.__del__(self, *args, **kwargs)
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1872
        Client.__del__(self, *args, **kwargs)
874 by Teddy Hogeborn
PEP8 compliance: mandos
1873
749.1.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
1874
    def checker_callback(self, source, condition,
756 by Teddy Hogeborn
Merge change to use multiprocessing module to run checkers.
1875
                         connection, command, *args, **kwargs):
749.1.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
1876
        ret = Client.checker_callback(self, source, condition,
756 by Teddy Hogeborn
Merge change to use multiprocessing module to run checkers.
1877
                                      connection, command, *args,
749.1.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
1878
                                      **kwargs)
1879
        exitstatus = self.last_checker_status
1880
        if exitstatus >= 0:
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1881
            # Emit D-Bus signal
1882
            self.CheckerCompleted(dbus.Int16(exitstatus),
783 by Teddy Hogeborn
Revert change to D-Bus API.
1883
                                  # This is specific to GNU libC
1884
                                  dbus.Int64(exitstatus << 8),
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1885
                                  dbus.String(command))
1886
        else:
1887
            # Emit D-Bus signal
1888
            self.CheckerCompleted(dbus.Int16(-1),
749.1.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
1889
                                  dbus.Int64(
783 by Teddy Hogeborn
Revert change to D-Bus API.
1890
                                      # This is specific to GNU libC
1891
                                      (exitstatus << 8)
1892
                                      | self.last_checker_signal),
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1893
                                  dbus.String(command))
749.1.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
1894
        return ret
874 by Teddy Hogeborn
PEP8 compliance: mandos
1895
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1896
    def start_checker(self, *args, **kwargs):
658 by Teddy Hogeborn
* mandos (ClientDBus.start_checker): Removed unused variable
1897
        old_checker_pid = getattr(self.checker, "pid", None)
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1898
        r = Client.start_checker(self, *args, **kwargs)
329 by Teddy Hogeborn
* mandos (ClientDBus.__del__): Bug fix: Correct mispasted code, and do
1899
        # Only if new checker process was started
1900
        if (self.checker is not None
1901
            and old_checker_pid != self.checker.pid):
1902
            # Emit D-Bus signal
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1903
            self.CheckerStarted(self.current_checker_command)
1904
        return r
874 by Teddy Hogeborn
PEP8 compliance: mandos
1905
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1906
    def _reset_approved(self):
518.2.4 by Teddy Hogeborn
* mandos (_timedelta_to_milliseconds): Renamed to
1907
        self.approved = None
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1908
        return False
874 by Teddy Hogeborn
PEP8 compliance: mandos
1909
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1910
    def approve(self, value=True):
518.2.4 by Teddy Hogeborn
* mandos (_timedelta_to_milliseconds): Renamed to
1911
        self.approved = value
830 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
1912
        GLib.timeout_add(int(self.approval_duration.total_seconds()
1913
                             * 1000), self._reset_approved)
581 by Teddy Hogeborn
* mandos (Client.enable, Client.disable, ClientDBus.approve): Call
1914
        self.send_changedstate()
874 by Teddy Hogeborn
PEP8 compliance: mandos
1915
1916
    #  D-Bus methods, signals & properties
1917
1918
    #  Interfaces
1919
1920
    #  Signals
1921
237.1.2 by Teddy Hogeborn
Further steps towards a D-Bus server interface, plus minor syntax
1922
    # CheckerCompleted - signal
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1923
    @dbus.service.signal(_interface, signature="nxs")
280 by Teddy Hogeborn
* mandos (Client.CheckerCompleted): Changed signature to "nxs"; return
1924
    def CheckerCompleted(self, exitcode, waitstatus, command):
237.1.2 by Teddy Hogeborn
Further steps towards a D-Bus server interface, plus minor syntax
1925
        "D-Bus signal"
1926
        pass
874 by Teddy Hogeborn
PEP8 compliance: mandos
1927
237.1.2 by Teddy Hogeborn
Further steps towards a D-Bus server interface, plus minor syntax
1928
    # CheckerStarted - signal
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1929
    @dbus.service.signal(_interface, signature="s")
237.1.2 by Teddy Hogeborn
Further steps towards a D-Bus server interface, plus minor syntax
1930
    def CheckerStarted(self, command):
1931
        "D-Bus signal"
1932
        pass
874 by Teddy Hogeborn
PEP8 compliance: mandos
1933
238 by Teddy Hogeborn
First version of a somewhat complete D-Bus server interface. Also
1934
    # PropertyChanged - signal
732 by Teddy Hogeborn
Emit D-Bus "org.freedesktop.DBus.Properties.PropertiesChanged" signal.
1935
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1936
    @dbus.service.signal(_interface, signature="sv")
238 by Teddy Hogeborn
First version of a somewhat complete D-Bus server interface. Also
1937
    def PropertyChanged(self, property, value):
1938
        "D-Bus signal"
1939
        pass
874 by Teddy Hogeborn
PEP8 compliance: mandos
1940
387 by Teddy Hogeborn
* mandos (ClientDBus.ReceivedSecret): Renamed to "GotSecret". All
1941
    # GotSecret - signal
327 by Teddy Hogeborn
Merge from pipe IPC branch.
1942
    @dbus.service.signal(_interface)
387 by Teddy Hogeborn
* mandos (ClientDBus.ReceivedSecret): Renamed to "GotSecret". All
1943
    def GotSecret(self):
24.1.155 by Björn Påhlsson
mandos server: Added debuglevel that adjust at what level information
1944
        """D-Bus signal
1945
        Is sent after a successful transfer of secret from the Mandos
1946
        server to mandos-client
1947
        """
24.2.4 by teddy at bsnet
* mandos (ClientDBus.approvals_pending): Changed to be a property
1948
        pass
874 by Teddy Hogeborn
PEP8 compliance: mandos
1949
327 by Teddy Hogeborn
Merge from pipe IPC branch.
1950
    # Rejected - signal
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1951
    @dbus.service.signal(_interface, signature="s")
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1952
    def Rejected(self, reason):
1953
        "D-Bus signal"
24.2.4 by teddy at bsnet
* mandos (ClientDBus.approvals_pending): Changed to be a property
1954
        pass
874 by Teddy Hogeborn
PEP8 compliance: mandos
1955
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1956
    # NeedApproval - signal
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1957
    @dbus.service.signal(_interface, signature="tb")
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1958
    def NeedApproval(self, timeout, default):
327 by Teddy Hogeborn
Merge from pipe IPC branch.
1959
        "D-Bus signal"
442 by Teddy Hogeborn
* DBUS-API: Document new "LastApprovalRequest" client property.
1960
        return self.need_approval()
874 by Teddy Hogeborn
PEP8 compliance: mandos
1961
1962
    #  Methods
1963
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1964
    # Approve - method
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1965
    @dbus.service.method(_interface, in_signature="b")
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1966
    def Approve(self, value):
1967
        self.approve(value)
874 by Teddy Hogeborn
PEP8 compliance: mandos
1968
24.1.147 by Björn Påhlsson
The IPC pipes are now file objects, not file descriptors:
1969
    # CheckedOK - method
1970
    @dbus.service.method(_interface)
1971
    def CheckedOK(self):
482 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
1972
        self.checked_ok()
874 by Teddy Hogeborn
PEP8 compliance: mandos
1973
381 by Teddy Hogeborn
Restore some poor D-Bus methods who got a bit hastily deleted. Enable
1974
    # Enable - method
781 by Teddy Hogeborn
Deprecate some D-Bus methods in favor of D-Bus properties.
1975
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
381 by Teddy Hogeborn
Restore some poor D-Bus methods who got a bit hastily deleted. Enable
1976
    @dbus.service.method(_interface)
1977
    def Enable(self):
1978
        "D-Bus method"
1979
        self.enable()
874 by Teddy Hogeborn
PEP8 compliance: mandos
1980
381 by Teddy Hogeborn
Restore some poor D-Bus methods who got a bit hastily deleted. Enable
1981
    # StartChecker - method
781 by Teddy Hogeborn
Deprecate some D-Bus methods in favor of D-Bus properties.
1982
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
381 by Teddy Hogeborn
Restore some poor D-Bus methods who got a bit hastily deleted. Enable
1983
    @dbus.service.method(_interface)
1984
    def StartChecker(self):
1985
        "D-Bus method"
1986
        self.start_checker()
874 by Teddy Hogeborn
PEP8 compliance: mandos
1987
381 by Teddy Hogeborn
Restore some poor D-Bus methods who got a bit hastily deleted. Enable
1988
    # Disable - method
781 by Teddy Hogeborn
Deprecate some D-Bus methods in favor of D-Bus properties.
1989
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
381 by Teddy Hogeborn
Restore some poor D-Bus methods who got a bit hastily deleted. Enable
1990
    @dbus.service.method(_interface)
1991
    def Disable(self):
1992
        "D-Bus method"
1993
        self.disable()
874 by Teddy Hogeborn
PEP8 compliance: mandos
1994
381 by Teddy Hogeborn
Restore some poor D-Bus methods who got a bit hastily deleted. Enable
1995
    # StopChecker - method
781 by Teddy Hogeborn
Deprecate some D-Bus methods in favor of D-Bus properties.
1996
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
381 by Teddy Hogeborn
Restore some poor D-Bus methods who got a bit hastily deleted. Enable
1997
    @dbus.service.method(_interface)
1998
    def StopChecker(self):
1999
        self.stop_checker()
874 by Teddy Hogeborn
PEP8 compliance: mandos
2000
2001
    #  Properties
2002
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2003
    # ApprovalPending - property
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2004
    @dbus_service_property(_interface, signature="b", access="read")
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2005
    def ApprovalPending_dbus_property(self):
24.2.4 by teddy at bsnet
* mandos (ClientDBus.approvals_pending): Changed to be a property
2006
        return dbus.Boolean(bool(self.approvals_pending))
874 by Teddy Hogeborn
PEP8 compliance: mandos
2007
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2008
    # ApprovedByDefault - property
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2009
    @dbus_service_property(_interface,
2010
                           signature="b",
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2011
                           access="readwrite")
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2012
    def ApprovedByDefault_dbus_property(self, value=None):
2013
        if value is None:       # get
2014
            return dbus.Boolean(self.approved_by_default)
2015
        self.approved_by_default = bool(value)
874 by Teddy Hogeborn
PEP8 compliance: mandos
2016
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2017
    # ApprovalDelay - property
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2018
    @dbus_service_property(_interface,
2019
                           signature="t",
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2020
                           access="readwrite")
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2021
    def ApprovalDelay_dbus_property(self, value=None):
2022
        if value is None:       # get
723.1.6 by Teddy Hogeborn
Use the new .total_seconds() method on datetime.timedelta objects.
2023
            return dbus.UInt64(self.approval_delay.total_seconds()
2024
                               * 1000)
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2025
        self.approval_delay = datetime.timedelta(0, 0, 0, value)
874 by Teddy Hogeborn
PEP8 compliance: mandos
2026
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2027
    # ApprovalDuration - property
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2028
    @dbus_service_property(_interface,
2029
                           signature="t",
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2030
                           access="readwrite")
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2031
    def ApprovalDuration_dbus_property(self, value=None):
2032
        if value is None:       # get
723.1.6 by Teddy Hogeborn
Use the new .total_seconds() method on datetime.timedelta objects.
2033
            return dbus.UInt64(self.approval_duration.total_seconds()
2034
                               * 1000)
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2035
        self.approval_duration = datetime.timedelta(0, 0, 0, value)
874 by Teddy Hogeborn
PEP8 compliance: mandos
2036
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2037
    # Name - property
780 by Teddy Hogeborn
Add D-Bus annotations on a few properties on the Client object.
2038
    @dbus_annotations(
2039
        {"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2040
    @dbus_service_property(_interface, signature="s", access="read")
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2041
    def Name_dbus_property(self):
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
2042
        return dbus.String(self.name)
874 by Teddy Hogeborn
PEP8 compliance: mandos
2043
962 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
2044
    # KeyID - property
2045
    @dbus_annotations(
2046
        {"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2047
    @dbus_service_property(_interface, signature="s", access="read")
2048
    def KeyID_dbus_property(self):
2049
        return dbus.String(self.key_id)
2050
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2051
    # Fingerprint - property
780 by Teddy Hogeborn
Add D-Bus annotations on a few properties on the Client object.
2052
    @dbus_annotations(
2053
        {"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2054
    @dbus_service_property(_interface, signature="s", access="read")
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2055
    def Fingerprint_dbus_property(self):
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
2056
        return dbus.String(self.fingerprint)
874 by Teddy Hogeborn
PEP8 compliance: mandos
2057
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2058
    # Host - property
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2059
    @dbus_service_property(_interface,
2060
                           signature="s",
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2061
                           access="readwrite")
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2062
    def Host_dbus_property(self, value=None):
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
2063
        if value is None:       # get
2064
            return dbus.String(self.host)
730 by Teddy Hogeborn
mandos: Replace unicode() with str().
2065
        self.host = str(value)
874 by Teddy Hogeborn
PEP8 compliance: mandos
2066
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2067
    # Created - property
780 by Teddy Hogeborn
Add D-Bus annotations on a few properties on the Client object.
2068
    @dbus_annotations(
2069
        {"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2070
    @dbus_service_property(_interface, signature="s", access="read")
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2071
    def Created_dbus_property(self):
518.2.3 by Teddy Hogeborn
Make "enabled" a client config option.
2072
        return datetime_to_dbus(self.created)
874 by Teddy Hogeborn
PEP8 compliance: mandos
2073
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2074
    # LastEnabled - property
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2075
    @dbus_service_property(_interface, signature="s", access="read")
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2076
    def LastEnabled_dbus_property(self):
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
2077
        return datetime_to_dbus(self.last_enabled)
874 by Teddy Hogeborn
PEP8 compliance: mandos
2078
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2079
    # Enabled - property
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2080
    @dbus_service_property(_interface,
2081
                           signature="b",
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2082
                           access="readwrite")
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2083
    def Enabled_dbus_property(self, value=None):
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
2084
        if value is None:       # get
2085
            return dbus.Boolean(self.enabled)
2086
        if value:
2087
            self.enable()
2088
        else:
2089
            self.disable()
874 by Teddy Hogeborn
PEP8 compliance: mandos
2090
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2091
    # LastCheckedOK - property
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2092
    @dbus_service_property(_interface,
2093
                           signature="s",
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2094
                           access="readwrite")
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2095
    def LastCheckedOK_dbus_property(self, value=None):
381 by Teddy Hogeborn
Restore some poor D-Bus methods who got a bit hastily deleted. Enable
2096
        if value is not None:
2097
            self.checked_ok()
2098
            return
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
2099
        return datetime_to_dbus(self.last_checked_ok)
874 by Teddy Hogeborn
PEP8 compliance: mandos
2100
556 by Teddy Hogeborn
* DBUS-API (se.recompile.Mandos.Client.LastCheckerStatus): New
2101
    # LastCheckerStatus - property
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2102
    @dbus_service_property(_interface, signature="n", access="read")
556 by Teddy Hogeborn
* DBUS-API (se.recompile.Mandos.Client.LastCheckerStatus): New
2103
    def LastCheckerStatus_dbus_property(self):
2104
        return dbus.Int16(self.last_checker_status)
874 by Teddy Hogeborn
PEP8 compliance: mandos
2105
24.1.179 by Björn Påhlsson
New feature:
2106
    # Expires - property
2107
    @dbus_service_property(_interface, signature="s", access="read")
2108
    def Expires_dbus_property(self):
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
2109
        return datetime_to_dbus(self.expires)
874 by Teddy Hogeborn
PEP8 compliance: mandos
2110
442 by Teddy Hogeborn
* DBUS-API: Document new "LastApprovalRequest" client property.
2111
    # LastApprovalRequest - property
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2112
    @dbus_service_property(_interface, signature="s", access="read")
442 by Teddy Hogeborn
* DBUS-API: Document new "LastApprovalRequest" client property.
2113
    def LastApprovalRequest_dbus_property(self):
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
2114
        return datetime_to_dbus(self.last_approval_request)
874 by Teddy Hogeborn
PEP8 compliance: mandos
2115
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2116
    # Timeout - property
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2117
    @dbus_service_property(_interface,
2118
                           signature="t",
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2119
                           access="readwrite")
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2120
    def Timeout_dbus_property(self, value=None):
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
2121
        if value is None:       # get
723.1.6 by Teddy Hogeborn
Use the new .total_seconds() method on datetime.timedelta objects.
2122
            return dbus.UInt64(self.timeout.total_seconds() * 1000)
581 by Teddy Hogeborn
* mandos (Client.enable, Client.disable, ClientDBus.approve): Call
2123
        old_timeout = self.timeout
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
2124
        self.timeout = datetime.timedelta(0, 0, 0, value)
581 by Teddy Hogeborn
* mandos (Client.enable, Client.disable, ClientDBus.approve): Call
2125
        # Reschedule disabling
543 by Teddy Hogeborn
* mandos: Break some long lines.
2126
        if self.enabled:
2127
            now = datetime.datetime.utcnow()
581 by Teddy Hogeborn
* mandos (Client.enable, Client.disable, ClientDBus.approve): Call
2128
            self.expires += self.timeout - old_timeout
2129
            if self.expires <= now:
543 by Teddy Hogeborn
* mandos: Break some long lines.
2130
                # The timeout has passed
2131
                self.disable()
2132
            else:
2133
                if (getattr(self, "disable_initiator_tag", None)
2134
                    is None):
2135
                    return
830 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
2136
                GLib.source_remove(self.disable_initiator_tag)
2137
                self.disable_initiator_tag = GLib.timeout_add(
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2138
                    int((self.expires - now).total_seconds() * 1000),
2139
                    self.disable)
874 by Teddy Hogeborn
PEP8 compliance: mandos
2140
24.1.179 by Björn Påhlsson
New feature:
2141
    # ExtendedTimeout - property
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2142
    @dbus_service_property(_interface,
2143
                           signature="t",
24.1.179 by Björn Påhlsson
New feature:
2144
                           access="readwrite")
2145
    def ExtendedTimeout_dbus_property(self, value=None):
2146
        if value is None:       # get
723.1.6 by Teddy Hogeborn
Use the new .total_seconds() method on datetime.timedelta objects.
2147
            return dbus.UInt64(self.extended_timeout.total_seconds()
2148
                               * 1000)
24.1.179 by Björn Påhlsson
New feature:
2149
        self.extended_timeout = datetime.timedelta(0, 0, 0, value)
874 by Teddy Hogeborn
PEP8 compliance: mandos
2150
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2151
    # Interval - property
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2152
    @dbus_service_property(_interface,
2153
                           signature="t",
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2154
                           access="readwrite")
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2155
    def Interval_dbus_property(self, value=None):
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
2156
        if value is None:       # get
723.1.6 by Teddy Hogeborn
Use the new .total_seconds() method on datetime.timedelta objects.
2157
            return dbus.UInt64(self.interval.total_seconds() * 1000)
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
2158
        self.interval = datetime.timedelta(0, 0, 0, value)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2159
        if getattr(self, "checker_initiator_tag", None) is None:
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
2160
            return
518.2.3 by Teddy Hogeborn
Make "enabled" a client config option.
2161
        if self.enabled:
2162
            # Reschedule checker run
830 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
2163
            GLib.source_remove(self.checker_initiator_tag)
2164
            self.checker_initiator_tag = GLib.timeout_add(
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2165
                value, self.start_checker)
874 by Teddy Hogeborn
PEP8 compliance: mandos
2166
            self.start_checker()  # Start one now, too
2167
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2168
    # Checker - property
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2169
    @dbus_service_property(_interface,
2170
                           signature="s",
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2171
                           access="readwrite")
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2172
    def Checker_dbus_property(self, value=None):
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
2173
        if value is None:       # get
2174
            return dbus.String(self.checker_command)
730 by Teddy Hogeborn
mandos: Replace unicode() with str().
2175
        self.checker_command = str(value)
874 by Teddy Hogeborn
PEP8 compliance: mandos
2176
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2177
    # CheckerRunning - property
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2178
    @dbus_service_property(_interface,
2179
                           signature="b",
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2180
                           access="readwrite")
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2181
    def CheckerRunning_dbus_property(self, value=None):
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
2182
        if value is None:       # get
2183
            return dbus.Boolean(self.checker is not None)
2184
        if value:
2185
            self.start_checker()
2186
        else:
2187
            self.stop_checker()
874 by Teddy Hogeborn
PEP8 compliance: mandos
2188
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2189
    # ObjectPath - property
780 by Teddy Hogeborn
Add D-Bus annotations on a few properties on the Client object.
2190
    @dbus_annotations(
782 by Teddy Hogeborn
Deprecate the D-Bus property "se.recompile.Mandos.Client.ObjectPath".
2191
        {"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",
2192
         "org.freedesktop.DBus.Deprecated": "true"})
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2193
    @dbus_service_property(_interface, signature="o", access="read")
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2194
    def ObjectPath_dbus_property(self):
874 by Teddy Hogeborn
PEP8 compliance: mandos
2195
        return self.dbus_object_path  # is already a dbus.ObjectPath
2196
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2197
    # Secret = property
780 by Teddy Hogeborn
Add D-Bus annotations on a few properties on the Client object.
2198
    @dbus_annotations(
2199
        {"org.freedesktop.DBus.Property.EmitsChangedSignal":
2200
         "invalidates"})
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2201
    @dbus_service_property(_interface,
2202
                           signature="ay",
2203
                           access="write",
2204
                           byte_arrays=True)
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2205
    def Secret_dbus_property(self, value):
729 by Teddy Hogeborn
mandos: Stop using str() and remove unnecessary unicode() calls.
2206
        self.secret = bytes(value)
874 by Teddy Hogeborn
PEP8 compliance: mandos
2207
237.1.2 by Teddy Hogeborn
Further steps towards a D-Bus server interface, plus minor syntax
2208
    del _interface
3 by Björn Påhlsson
Python based server
2209
2210
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2211
class ProxyClient(object):
962 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
2212
    def __init__(self, child_pipe, key_id, fpr, address):
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2213
        self._pipe = child_pipe
962 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
2214
        self._pipe.send(('init', key_id, fpr, address))
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2215
        if not self._pipe.recv():
962 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
2216
            raise KeyError(key_id or fpr)
874 by Teddy Hogeborn
PEP8 compliance: mandos
2217
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2218
    def __getattribute__(self, name):
518.2.4 by Teddy Hogeborn
* mandos (_timedelta_to_milliseconds): Renamed to
2219
        if name == '_pipe':
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2220
            return super(ProxyClient, self).__getattribute__(name)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2221
        self._pipe.send(('getattr', name))
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2222
        data = self._pipe.recv()
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2223
        if data[0] == 'data':
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2224
            return data[1]
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2225
        if data[0] == 'function':
874 by Teddy Hogeborn
PEP8 compliance: mandos
2226
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2227
            def func(*args, **kwargs):
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2228
                self._pipe.send(('funcall', name, args, kwargs))
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2229
                return self._pipe.recv()[1]
874 by Teddy Hogeborn
PEP8 compliance: mandos
2230
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2231
            return func
874 by Teddy Hogeborn
PEP8 compliance: mandos
2232
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2233
    def __setattr__(self, name, value):
518.2.4 by Teddy Hogeborn
* mandos (_timedelta_to_milliseconds): Renamed to
2234
        if name == '_pipe':
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2235
            return super(ProxyClient, self).__setattr__(name, value)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2236
        self._pipe.send(('setattr', name, value))
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2237
518.1.6 by Teddy Hogeborn
* mandos: Fix whitespace.
2238
335 by Teddy Hogeborn
* mandos: Import "SocketServer" as "socketserver" and "ConfigParser"
2239
class ClientHandler(socketserver.BaseRequestHandler, object):
331 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
2240
    """A class to handle client connections.
874 by Teddy Hogeborn
PEP8 compliance: mandos
2241
331 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
2242
    Instantiated once for each connection to handle it.
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
2243
    Note: This will run in its own forked process."""
874 by Teddy Hogeborn
PEP8 compliance: mandos
2244
3 by Björn Påhlsson
Python based server
2245
    def handle(self):
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2246
        with contextlib.closing(self.server.child_pipe) as child_pipe:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2247
            logger.info("TCP connection from: %s",
730 by Teddy Hogeborn
mandos: Replace unicode() with str().
2248
                        str(self.client_address))
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2249
            logger.debug("Pipe FD: %d",
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2250
                         self.server.child_pipe.fileno())
874 by Teddy Hogeborn
PEP8 compliance: mandos
2251
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
2252
            session = gnutls.ClientSession(self.request)
874 by Teddy Hogeborn
PEP8 compliance: mandos
2253
2254
            # priority = ':'.join(("NONE", "+VERS-TLS1.1",
2255
            #                       "+AES-256-CBC", "+SHA1",
2256
            #                       "+COMP-NULL", "+CTYPE-OPENPGP",
2257
            #                       "+DHE-DSS"))
288.1.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
2258
            # Use a fallback default, since this MUST be set.
331 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
2259
            priority = self.server.gnutls_priority
2260
            if priority is None:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2261
                priority = "NORMAL"
851 by Teddy Hogeborn
mandos: Minor bug fix for Python 3
2262
            gnutls.priority_set_direct(session._c_object,
2263
                                       priority.encode("utf-8"),
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
2264
                                       None)
874 by Teddy Hogeborn
PEP8 compliance: mandos
2265
416.1.2 by Teddy Hogeborn
* mandos (ClientHandler.handle): Set up the GnuTLS session object
2266
            # Start communication using the Mandos protocol
2267
            # Get protocol number
2268
            line = self.request.makefile().readline()
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2269
            logger.debug("Protocol version: %r", line)
416.1.2 by Teddy Hogeborn
* mandos (ClientHandler.handle): Set up the GnuTLS session object
2270
            try:
2271
                if int(line.strip().split()[0]) > 1:
642 by Teddy Hogeborn
Syntax fix; use "raise" better in Mandos server.
2272
                    raise RuntimeError(line)
482 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
2273
            except (ValueError, IndexError, RuntimeError) as error:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2274
                logger.error("Unknown protocol version: %s", error)
416.1.2 by Teddy Hogeborn
* mandos (ClientHandler.handle): Set up the GnuTLS session object
2275
                return
874 by Teddy Hogeborn
PEP8 compliance: mandos
2276
416.1.2 by Teddy Hogeborn
* mandos (ClientHandler.handle): Set up the GnuTLS session object
2277
            # Start GnuTLS connection
288.1.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
2278
            try:
2279
                session.handshake()
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
2280
            except gnutls.Error as error:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2281
                logger.warning("Handshake failed: %s", error)
288.1.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
2282
                # Do not run session.bye() here: the session is not
2283
                # established.  Just abandon the request.
2284
                return
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2285
            logger.debug("Handshake succeeded")
874 by Teddy Hogeborn
PEP8 compliance: mandos
2286
24.1.150 by Björn Påhlsson
* mandos: Added ClientDBus.approve_pending property. Exposed
2287
            approval_required = False
288.1.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
2288
            try:
962 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
2289
                if gnutls.has_rawpk:
2290
                    fpr = ""
2291
                    try:
2292
                        key_id = self.key_id(
2293
                            self.peer_certificate(session))
2294
                    except (TypeError, gnutls.Error) as error:
2295
                        logger.warning("Bad certificate: %s", error)
2296
                        return
2297
                    logger.debug("Key ID: %s", key_id)
2298
2299
                else:
2300
                    key_id = ""
2301
                    try:
2302
                        fpr = self.fingerprint(
2303
                            self.peer_certificate(session))
2304
                    except (TypeError, gnutls.Error) as error:
2305
                        logger.warning("Bad certificate: %s", error)
2306
                        return
2307
                    logger.debug("Fingerprint: %s", fpr)
2308
2309
                try:
2310
                    client = ProxyClient(child_pipe, key_id, fpr,
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2311
                                         self.client_address)
2312
                except KeyError:
411 by Teddy Hogeborn
More consistent terminology: Clients are no longer "invalid" - they
2313
                    return
874 by Teddy Hogeborn
PEP8 compliance: mandos
2314
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2315
                if client.approval_delay:
2316
                    delay = client.approval_delay
24.1.150 by Björn Påhlsson
* mandos: Added ClientDBus.approve_pending property. Exposed
2317
                    client.approvals_pending += 1
2318
                    approval_required = True
874 by Teddy Hogeborn
PEP8 compliance: mandos
2319
24.1.148 by Björn Påhlsson
half working on-demand password and approved code
2320
                while True:
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2321
                    if not client.enabled:
24.1.174 by Björn Påhlsson
* Makefile (CFLAGS): Added "-lrt" to include real time library.
2322
                        logger.info("Client %s is disabled",
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2323
                                    client.name)
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2324
                        if self.server.use_dbus:
2325
                            # Emit D-Bus signal
505.1.3 by Teddy Hogeborn
* mandos: Break long lines.
2326
                            client.Rejected("Disabled")
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2327
                        return
874 by Teddy Hogeborn
PEP8 compliance: mandos
2328
518.2.4 by Teddy Hogeborn
* mandos (_timedelta_to_milliseconds): Renamed to
2329
                    if client.approved or not client.approval_delay:
874 by Teddy Hogeborn
PEP8 compliance: mandos
2330
                        # We are approved or approval is disabled
24.1.150 by Björn Påhlsson
* mandos: Added ClientDBus.approve_pending property. Exposed
2331
                        break
518.2.4 by Teddy Hogeborn
* mandos (_timedelta_to_milliseconds): Renamed to
2332
                    elif client.approved is None:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2333
                        logger.info("Client %s needs approval",
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2334
                                    client.name)
2335
                        if self.server.use_dbus:
2336
                            # Emit D-Bus signal
2337
                            client.NeedApproval(
723.1.6 by Teddy Hogeborn
Use the new .total_seconds() method on datetime.timedelta objects.
2338
                                client.approval_delay.total_seconds()
2339
                                * 1000, client.approved_by_default)
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2340
                    else:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2341
                        logger.warning("Client %s was not approved",
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2342
                                       client.name)
2343
                        if self.server.use_dbus:
24.1.150 by Björn Påhlsson
* mandos: Added ClientDBus.approve_pending property. Exposed
2344
                            # Emit D-Bus signal
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2345
                            client.Rejected("Denied")
24.1.148 by Björn Påhlsson
half working on-demand password and approved code
2346
                        return
874 by Teddy Hogeborn
PEP8 compliance: mandos
2347
2348
                    # wait until timeout or approved
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2349
                    time = datetime.datetime.now()
2350
                    client.changedstate.acquire()
723.1.6 by Teddy Hogeborn
Use the new .total_seconds() method on datetime.timedelta objects.
2351
                    client.changedstate.wait(delay.total_seconds())
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2352
                    client.changedstate.release()
2353
                    time2 = datetime.datetime.now()
2354
                    if (time2 - time) >= delay:
2355
                        if not client.approved_by_default:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2356
                            logger.warning("Client %s timed out while"
2357
                                           " waiting for approval",
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2358
                                           client.name)
2359
                            if self.server.use_dbus:
2360
                                # Emit D-Bus signal
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2361
                                client.Rejected("Approval timed out")
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2362
                            return
2363
                        else:
2364
                            break
2365
                    else:
2366
                        delay -= time2 - time
874 by Teddy Hogeborn
PEP8 compliance: mandos
2367
802 by Teddy Hogeborn
Handle GnuTLS errors and partial sends in gnutls "module".
2368
                try:
2369
                    session.send(client.secret)
2370
                except gnutls.Error as error:
2371
                    logger.warning("gnutls send failed",
874 by Teddy Hogeborn
PEP8 compliance: mandos
2372
                                   exc_info=error)
802 by Teddy Hogeborn
Handle GnuTLS errors and partial sends in gnutls "module".
2373
                    return
874 by Teddy Hogeborn
PEP8 compliance: mandos
2374
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2375
                logger.info("Sending secret to %s", client.name)
505.1.13 by Teddy Hogeborn
Miscellaneous fixes prompted by lintian:
2376
                # bump the timeout using extended_timeout
556 by Teddy Hogeborn
* DBUS-API (se.recompile.Mandos.Client.LastCheckerStatus): New
2377
                client.bump_timeout(client.extended_timeout)
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2378
                if self.server.use_dbus:
2379
                    # Emit D-Bus signal
2380
                    client.GotSecret()
874 by Teddy Hogeborn
PEP8 compliance: mandos
2381
411 by Teddy Hogeborn
More consistent terminology: Clients are no longer "invalid" - they
2382
            finally:
24.1.150 by Björn Påhlsson
* mandos: Added ClientDBus.approve_pending property. Exposed
2383
                if approval_required:
2384
                    client.approvals_pending -= 1
24.1.155 by Björn Påhlsson
mandos server: Added debuglevel that adjust at what level information
2385
                try:
2386
                    session.bye()
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
2387
                except gnutls.Error as error:
574 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
2388
                    logger.warning("GnuTLS bye failed",
2389
                                   exc_info=error)
874 by Teddy Hogeborn
PEP8 compliance: mandos
2390
330 by Teddy Hogeborn
* mandos (peer_certificate, fingerprint): Moved into "TCP_handler"
2391
    @staticmethod
2392
    def peer_certificate(session):
962 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
2393
        "Return the peer's certificate as a bytestring"
2394
        try:
2395
            cert_type = gnutls.certificate_type_get2(session._c_object,
2396
                                                     gnutls.CTYPE_PEERS)
2397
        except AttributeError:
2398
            cert_type = gnutls.certificate_type_get(session._c_object)
2399
        if gnutls.has_rawpk:
2400
            valid_cert_types = frozenset((gnutls.CRT_RAWPK,))
2401
        else:
2402
            valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))
2403
        # If not a valid certificate type...
2404
        if cert_type not in valid_cert_types:
2405
            logger.info("Cert type %r not in %r", cert_type,
2406
                        valid_cert_types)
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
2407
            # ...return invalid data
2408
            return b""
330 by Teddy Hogeborn
* mandos (peer_certificate, fingerprint): Moved into "TCP_handler"
2409
        list_size = ctypes.c_uint(1)
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
2410
        cert_list = (gnutls.certificate_get_peers
330 by Teddy Hogeborn
* mandos (peer_certificate, fingerprint): Moved into "TCP_handler"
2411
                     (session._c_object, ctypes.byref(list_size)))
2412
        if not bool(cert_list) and list_size.value != 0:
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
2413
            raise gnutls.Error("error getting peer certificate")
330 by Teddy Hogeborn
* mandos (peer_certificate, fingerprint): Moved into "TCP_handler"
2414
        if list_size.value == 0:
2415
            return None
2416
        cert = cert_list[0]
2417
        return ctypes.string_at(cert.data, cert.size)
874 by Teddy Hogeborn
PEP8 compliance: mandos
2418
330 by Teddy Hogeborn
* mandos (peer_certificate, fingerprint): Moved into "TCP_handler"
2419
    @staticmethod
962 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
2420
    def key_id(certificate):
2421
        "Convert a certificate bytestring to a hexdigit key ID"
2422
        # New GnuTLS "datum" with the public key
2423
        datum = gnutls.datum_t(
2424
            ctypes.cast(ctypes.c_char_p(certificate),
2425
                        ctypes.POINTER(ctypes.c_ubyte)),
2426
            ctypes.c_uint(len(certificate)))
2427
        # XXX all these need to be created in the gnutls "module"
2428
        # New empty GnuTLS certificate
2429
        pubkey = gnutls.pubkey_t()
2430
        gnutls.pubkey_init(ctypes.byref(pubkey))
2431
        # Import the raw public key into the certificate
2432
        gnutls.pubkey_import(pubkey,
2433
                             ctypes.byref(datum),
2434
                             gnutls.X509_FMT_DER)
2435
        # New buffer for the key ID
2436
        buf = ctypes.create_string_buffer(32)
2437
        buf_len = ctypes.c_size_t(len(buf))
2438
        # Get the key ID from the raw public key into the buffer
2439
        gnutls.pubkey_get_key_id(pubkey,
2440
                                 gnutls.KEYID_USE_SHA256,
2441
                                 ctypes.cast(ctypes.byref(buf),
2442
                                             ctypes.POINTER(ctypes.c_ubyte)),
2443
                                 ctypes.byref(buf_len))
2444
        # Deinit the certificate
2445
        gnutls.pubkey_deinit(pubkey)
2446
2447
        # Convert the buffer to a Python bytestring
2448
        key_id = ctypes.string_at(buf, buf_len.value)
2449
        # Convert the bytestring to hexadecimal notation
2450
        hex_key_id = binascii.hexlify(key_id).upper()
2451
        return hex_key_id
2452
2453
    @staticmethod
330 by Teddy Hogeborn
* mandos (peer_certificate, fingerprint): Moved into "TCP_handler"
2454
    def fingerprint(openpgp):
2455
        "Convert an OpenPGP bytestring to a hexdigit fingerprint"
2456
        # New GnuTLS "datum" with the OpenPGP public key
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
2457
        datum = gnutls.datum_t(
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2458
            ctypes.cast(ctypes.c_char_p(openpgp),
2459
                        ctypes.POINTER(ctypes.c_ubyte)),
2460
            ctypes.c_uint(len(openpgp)))
330 by Teddy Hogeborn
* mandos (peer_certificate, fingerprint): Moved into "TCP_handler"
2461
        # New empty GnuTLS certificate
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
2462
        crt = gnutls.openpgp_crt_t()
2463
        gnutls.openpgp_crt_init(ctypes.byref(crt))
330 by Teddy Hogeborn
* mandos (peer_certificate, fingerprint): Moved into "TCP_handler"
2464
        # Import the OpenPGP public key into the certificate
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
2465
        gnutls.openpgp_crt_import(crt, ctypes.byref(datum),
2466
                                  gnutls.OPENPGP_FMT_RAW)
330 by Teddy Hogeborn
* mandos (peer_certificate, fingerprint): Moved into "TCP_handler"
2467
        # Verify the self signature in the key
2468
        crtverify = ctypes.c_uint()
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
2469
        gnutls.openpgp_crt_verify_self(crt, 0,
2470
                                       ctypes.byref(crtverify))
330 by Teddy Hogeborn
* mandos (peer_certificate, fingerprint): Moved into "TCP_handler"
2471
        if crtverify.value != 0:
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
2472
            gnutls.openpgp_crt_deinit(crt)
950 by Teddy Hogeborn
mandos: Better error message if self-signature verification fails
2473
            raise gnutls.CertificateSecurityError(code
2474
                                                  =crtverify.value)
330 by Teddy Hogeborn
* mandos (peer_certificate, fingerprint): Moved into "TCP_handler"
2475
        # New buffer for the fingerprint
2476
        buf = ctypes.create_string_buffer(20)
2477
        buf_len = ctypes.c_size_t()
2478
        # Get the fingerprint from the certificate into the buffer
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
2479
        gnutls.openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
2480
                                           ctypes.byref(buf_len))
330 by Teddy Hogeborn
* mandos (peer_certificate, fingerprint): Moved into "TCP_handler"
2481
        # Deinit the certificate
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
2482
        gnutls.openpgp_crt_deinit(crt)
330 by Teddy Hogeborn
* mandos (peer_certificate, fingerprint): Moved into "TCP_handler"
2483
        # Convert the buffer to a Python bytestring
2484
        fpr = ctypes.string_at(buf, buf_len.value)
2485
        # Convert the bytestring to hexadecimal notation
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
2486
        hex_fpr = binascii.hexlify(fpr).upper()
330 by Teddy Hogeborn
* mandos (peer_certificate, fingerprint): Moved into "TCP_handler"
2487
        return hex_fpr
288.1.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
2488
2489
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2490
class MultiprocessingMixIn(object):
2491
    """Like socketserver.ThreadingMixIn, but with multiprocessing"""
874 by Teddy Hogeborn
PEP8 compliance: mandos
2492
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2493
    def sub_process_main(self, request, address):
2494
        try:
2495
            self.finish_request(request, address)
518.1.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
2496
        except Exception:
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2497
            self.handle_error(request, address)
2498
        self.close_request(request)
874 by Teddy Hogeborn
PEP8 compliance: mandos
2499
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2500
    def process_request(self, request, address):
2501
        """Start a new process to process the request."""
874 by Teddy Hogeborn
PEP8 compliance: mandos
2502
        proc = multiprocessing.Process(target=self.sub_process_main,
2503
                                       args=(request, address))
505.1.11 by Teddy Hogeborn
* mandos (Client.checked_ok): Set "expires" after setting timeout.
2504
        proc.start()
2505
        return proc
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2506
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
2507
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2508
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
2509
    """ adds a pipe to the MixIn """
874 by Teddy Hogeborn
PEP8 compliance: mandos
2510
288.1.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
2511
    def process_request(self, request, client_address):
331 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
2512
        """Overrides and wraps the original process_request().
874 by Teddy Hogeborn
PEP8 compliance: mandos
2513
355 by Teddy Hogeborn
* mandos: White-space fixes only.
2514
        This function creates a new pipe in self.pipe
288.1.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
2515
        """
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2516
        parent_pipe, self.child_pipe = multiprocessing.Pipe()
874 by Teddy Hogeborn
PEP8 compliance: mandos
2517
505.1.11 by Teddy Hogeborn
* mandos (Client.checked_ok): Set "expires" after setting timeout.
2518
        proc = MultiprocessingMixIn.process_request(self, request,
2519
                                                    client_address)
24.1.152 by Björn Påhlsson
bug fixes that prevent problems when runing server as root
2520
        self.child_pipe.close()
505.1.11 by Teddy Hogeborn
* mandos (Client.checked_ok): Set "expires" after setting timeout.
2521
        self.add_pipe(parent_pipe, proc)
874 by Teddy Hogeborn
PEP8 compliance: mandos
2522
505.1.11 by Teddy Hogeborn
* mandos (Client.checked_ok): Set "expires" after setting timeout.
2523
    def add_pipe(self, parent_pipe, proc):
288.1.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
2524
        """Dummy function; override as necessary"""
642 by Teddy Hogeborn
Syntax fix; use "raise" better in Mandos server.
2525
        raise NotImplementedError()
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2526
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
2527
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2528
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
335 by Teddy Hogeborn
* mandos: Import "SocketServer" as "socketserver" and "ConfigParser"
2529
                     socketserver.TCPServer, object):
237.2.13 by Teddy Hogeborn
Merge from trunk. Notable changes:
2530
    """IPv6-capable TCP server.  Accepts 'None' as address and/or port
874 by Teddy Hogeborn
PEP8 compliance: mandos
2531
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
2532
    Attributes:
331 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
2533
        enabled:        Boolean; whether this server is activated yet
2534
        interface:      None or a network interface name (string)
2535
        use_ipv6:       Boolean; to use IPv6 or not
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
2536
    """
874 by Teddy Hogeborn
PEP8 compliance: mandos
2537
331 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
2538
    def __init__(self, server_address, RequestHandlerClass,
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2539
                 interface=None,
2540
                 use_ipv6=True,
2541
                 socketfd=None):
589.1.1 by Teddy Hogeborn
* mandos: Implement "--socket" option.
2542
        """If socketfd is set, use that file descriptor instead of
2543
        creating a new one with socket.socket().
2544
        """
331 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
2545
        self.interface = interface
2546
        if use_ipv6:
2547
            self.address_family = socket.AF_INET6
589.1.1 by Teddy Hogeborn
* mandos: Implement "--socket" option.
2548
        if socketfd is not None:
2549
            # Save the file descriptor
2550
            self.socketfd = socketfd
2551
            # Save the original socket.socket() function
2552
            self.socket_socket = socket.socket
874 by Teddy Hogeborn
PEP8 compliance: mandos
2553
589.1.1 by Teddy Hogeborn
* mandos: Implement "--socket" option.
2554
            # To implement --socket, we monkey patch socket.socket.
874 by Teddy Hogeborn
PEP8 compliance: mandos
2555
            #
589.1.1 by Teddy Hogeborn
* mandos: Implement "--socket" option.
2556
            # (When socketserver.TCPServer is a new-style class, we
2557
            # could make self.socket into a property instead of monkey
2558
            # patching socket.socket.)
874 by Teddy Hogeborn
PEP8 compliance: mandos
2559
            #
589.1.1 by Teddy Hogeborn
* mandos: Implement "--socket" option.
2560
            # Create a one-time-only replacement for socket.socket()
2561
            @functools.wraps(socket.socket)
2562
            def socket_wrapper(*args, **kwargs):
2563
                # Restore original function so subsequent calls are
2564
                # not affected.
2565
                socket.socket = self.socket_socket
2566
                del self.socket_socket
2567
                # This time only, return a new socket object from the
2568
                # saved file descriptor.
2569
                return socket.fromfd(self.socketfd, *args, **kwargs)
2570
            # Replace socket.socket() function with wrapper
2571
            socket.socket = socket_wrapper
2572
        # The socketserver.TCPServer.__init__ will call
2573
        # socket.socket(), which might be our replacement,
2574
        # socket_wrapper(), if socketfd was set.
335 by Teddy Hogeborn
* mandos: Import "SocketServer" as "socketserver" and "ConfigParser"
2575
        socketserver.TCPServer.__init__(self, server_address,
331 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
2576
                                        RequestHandlerClass)
874 by Teddy Hogeborn
PEP8 compliance: mandos
2577
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
2578
    def server_bind(self):
2579
        """This overrides the normal server_bind() function
2580
        to bind to an interface if one was specified, and also NOT to
2581
        bind to an address or port if they were not specified."""
858 by Teddy Hogeborn
Server: Fix bug with --interface flag when "cc" is not installed.
2582
        global SO_BINDTODEVICE
331 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
2583
        if self.interface is not None:
338 by Teddy Hogeborn
* mandos: Minor doc string fixes.
2584
            if SO_BINDTODEVICE is None:
852 by Teddy Hogeborn
mandos: Bug fix for Python 2.7 and the "--interface" option
2585
                # Fall back to a hard-coded value which seems to be
2586
                # common enough.
2587
                logger.warning("SO_BINDTODEVICE not found, trying 25")
2588
                SO_BINDTODEVICE = 25
2589
            try:
2590
                self.socket.setsockopt(
2591
                    socket.SOL_SOCKET, SO_BINDTODEVICE,
2592
                    (self.interface + "\0").encode("utf-8"))
2593
            except socket.error as error:
2594
                if error.errno == errno.EPERM:
2595
                    logger.error("No permission to bind to"
2596
                                 " interface %s", self.interface)
2597
                elif error.errno == errno.ENOPROTOOPT:
2598
                    logger.error("SO_BINDTODEVICE not available;"
2599
                                 " cannot bind to interface %s",
2600
                                 self.interface)
2601
                elif error.errno == errno.ENODEV:
2602
                    logger.error("Interface %s does not exist,"
2603
                                 " cannot bind", self.interface)
2604
                else:
2605
                    raise
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
2606
        # Only bind(2) the socket if we really need to.
2607
        if self.server_address[0] or self.server_address[1]:
2608
            if not self.server_address[0]:
314 by Teddy Hogeborn
Support not using IPv6 in server:
2609
                if self.address_family == socket.AF_INET6:
874 by Teddy Hogeborn
PEP8 compliance: mandos
2610
                    any_address = "::"  # in6addr_any
314 by Teddy Hogeborn
Support not using IPv6 in server:
2611
                else:
874 by Teddy Hogeborn
PEP8 compliance: mandos
2612
                    any_address = "0.0.0.0"  # INADDR_ANY
314 by Teddy Hogeborn
Support not using IPv6 in server:
2613
                self.server_address = (any_address,
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
2614
                                       self.server_address[1])
49 by Teddy Hogeborn
* mandos (IPv6_TCPServer.server_bind): Bug fix: allow port to be empty
2615
            elif not self.server_address[1]:
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2616
                self.server_address = (self.server_address[0], 0)
331 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
2617
#                 if self.interface:
49 by Teddy Hogeborn
* mandos (IPv6_TCPServer.server_bind): Bug fix: allow port to be empty
2618
#                     self.server_address = (self.server_address[0],
2619
#                                            0, # port
2620
#                                            0, # flowinfo
2621
#                                            if_nametoindex
331 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
2622
#                                            (self.interface))
335 by Teddy Hogeborn
* mandos: Import "SocketServer" as "socketserver" and "ConfigParser"
2623
            return socketserver.TCPServer.server_bind(self)
339 by Teddy Hogeborn
Code cleanup.
2624
2625
2626
class MandosServer(IPv6_TCPServer):
2627
    """Mandos server.
874 by Teddy Hogeborn
PEP8 compliance: mandos
2628
339 by Teddy Hogeborn
Code cleanup.
2629
    Attributes:
2630
        clients:        set of Client objects
2631
        gnutls_priority GnuTLS priority string
2632
        use_dbus:       Boolean; to emit D-Bus signals or not
874 by Teddy Hogeborn
PEP8 compliance: mandos
2633
830 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
2634
    Assumes a GLib.MainLoop event loop.
339 by Teddy Hogeborn
Code cleanup.
2635
    """
874 by Teddy Hogeborn
PEP8 compliance: mandos
2636
339 by Teddy Hogeborn
Code cleanup.
2637
    def __init__(self, server_address, RequestHandlerClass,
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2638
                 interface=None,
2639
                 use_ipv6=True,
2640
                 clients=None,
2641
                 gnutls_priority=None,
2642
                 use_dbus=True,
2643
                 socketfd=None):
339 by Teddy Hogeborn
Code cleanup.
2644
        self.enabled = False
2645
        self.clients = clients
341 by Teddy Hogeborn
Code cleanup and one bug fix.
2646
        if self.clients is None:
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
2647
            self.clients = {}
339 by Teddy Hogeborn
Code cleanup.
2648
        self.use_dbus = use_dbus
2649
        self.gnutls_priority = gnutls_priority
2650
        IPv6_TCPServer.__init__(self, server_address,
2651
                                RequestHandlerClass,
874 by Teddy Hogeborn
PEP8 compliance: mandos
2652
                                interface=interface,
2653
                                use_ipv6=use_ipv6,
2654
                                socketfd=socketfd)
2655
163 by Teddy Hogeborn
* Makefile (PIDDIR, USER, GROUP): Removed.
2656
    def server_activate(self):
2657
        if self.enabled:
335 by Teddy Hogeborn
* mandos: Import "SocketServer" as "socketserver" and "ConfigParser"
2658
            return socketserver.TCPServer.server_activate(self)
874 by Teddy Hogeborn
PEP8 compliance: mandos
2659
163 by Teddy Hogeborn
* Makefile (PIDDIR, USER, GROUP): Removed.
2660
    def enable(self):
2661
        self.enabled = True
874 by Teddy Hogeborn
PEP8 compliance: mandos
2662
505.1.11 by Teddy Hogeborn
* mandos (Client.checked_ok): Set "expires" after setting timeout.
2663
    def add_pipe(self, parent_pipe, proc):
340 by Teddy Hogeborn
Code cleanup.
2664
        # Call "handle_ipc" for both data and EOF events
830 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
2665
        GLib.io_add_watch(
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2666
            parent_pipe.fileno(),
830 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
2667
            GLib.IO_IN | GLib.IO_HUP,
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2668
            functools.partial(self.handle_ipc,
874 by Teddy Hogeborn
PEP8 compliance: mandos
2669
                              parent_pipe=parent_pipe,
2670
                              proc=proc))
2671
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2672
    def handle_ipc(self, source, condition,
2673
                   parent_pipe=None,
874 by Teddy Hogeborn
PEP8 compliance: mandos
2674
                   proc=None,
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2675
                   client_object=None):
505.1.13 by Teddy Hogeborn
Miscellaneous fixes prompted by lintian:
2676
        # error, or the other end of multiprocessing.Pipe has closed
830 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
2677
        if condition & (GLib.IO_ERR | GLib.IO_HUP):
505.1.13 by Teddy Hogeborn
Miscellaneous fixes prompted by lintian:
2678
            # Wait for other process to exit
505.1.11 by Teddy Hogeborn
* mandos (Client.checked_ok): Set "expires" after setting timeout.
2679
            proc.join()
24.1.152 by Björn Påhlsson
bug fixes that prevent problems when runing server as root
2680
            return False
874 by Teddy Hogeborn
PEP8 compliance: mandos
2681
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2682
        # Read a request from the child
2683
        request = parent_pipe.recv()
2684
        command = request[0]
874 by Teddy Hogeborn
PEP8 compliance: mandos
2685
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2686
        if command == 'init':
962 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
2687
            key_id = request[1].decode("ascii")
2688
            fpr = request[2].decode("ascii")
2689
            address = request[3]
874 by Teddy Hogeborn
PEP8 compliance: mandos
2690
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
2691
            for c in self.clients.values():
971 by Teddy Hogeborn
Bug fix: Only create TLS key with certtool, and read correct key file
2692
                if key_id == "E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855":
2693
                    continue
962 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
2694
                if key_id and c.key_id == key_id:
2695
                    client = c
2696
                    break
2697
                if fpr and c.fingerprint == fpr:
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2698
                    client = c
2699
                    break
2700
            else:
962 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
2701
                logger.info("Client not found for key ID: %s, address"
2702
                            ": %s", key_id or fpr, address)
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2703
                if self.use_dbus:
2704
                    # Emit D-Bus signal
962 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
2705
                    mandos_dbus_service.ClientNotFound(key_id or fpr,
505.1.3 by Teddy Hogeborn
* mandos: Break long lines.
2706
                                                       address[0])
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2707
                parent_pipe.send(False)
2708
                return False
874 by Teddy Hogeborn
PEP8 compliance: mandos
2709
830 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
2710
            GLib.io_add_watch(
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2711
                parent_pipe.fileno(),
830 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
2712
                GLib.IO_IN | GLib.IO_HUP,
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2713
                functools.partial(self.handle_ipc,
874 by Teddy Hogeborn
PEP8 compliance: mandos
2714
                                  parent_pipe=parent_pipe,
2715
                                  proc=proc,
2716
                                  client_object=client))
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2717
            parent_pipe.send(True)
505.1.3 by Teddy Hogeborn
* mandos: Break long lines.
2718
            # remove the old hook in favor of the new above hook on
2719
            # same fileno
288.1.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
2720
            return False
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2721
        if command == 'funcall':
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2722
            funcname = request[1]
2723
            args = request[2]
2724
            kwargs = request[3]
874 by Teddy Hogeborn
PEP8 compliance: mandos
2725
505.1.3 by Teddy Hogeborn
* mandos: Break long lines.
2726
            parent_pipe.send(('data', getattr(client_object,
2727
                                              funcname)(*args,
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2728
                                                        **kwargs)))
874 by Teddy Hogeborn
PEP8 compliance: mandos
2729
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2730
        if command == 'getattr':
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2731
            attrname = request[1]
755 by Teddy Hogeborn
mandos: More Python 3 fixes.
2732
            if isinstance(client_object.__getattribute__(attrname),
2733
                          collections.Callable):
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2734
                parent_pipe.send(('function', ))
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2735
            else:
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2736
                parent_pipe.send((
2737
                    'data', client_object.__getattribute__(attrname)))
874 by Teddy Hogeborn
PEP8 compliance: mandos
2738
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2739
        if command == 'setattr':
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2740
            attrname = request[1]
2741
            value = request[2]
2742
            setattr(client_object, attrname, value)
874 by Teddy Hogeborn
PEP8 compliance: mandos
2743
288.1.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
2744
        return True
10 by Teddy Hogeborn
* server.py: Bug fix: Do "from __future__ import division".
2745
3 by Björn Påhlsson
Python based server
2746
609 by Teddy Hogeborn
* clients.conf: Convert all time intervals to new RFC 3339 syntax.
2747
def rfc3339_duration_to_delta(duration):
2748
    """Parse an RFC 3339 "duration" and return a datetime.timedelta
874 by Teddy Hogeborn
PEP8 compliance: mandos
2749
609 by Teddy Hogeborn
* clients.conf: Convert all time intervals to new RFC 3339 syntax.
2750
    >>> rfc3339_duration_to_delta("P7D")
2751
    datetime.timedelta(7)
2752
    >>> rfc3339_duration_to_delta("PT60S")
2753
    datetime.timedelta(0, 60)
2754
    >>> rfc3339_duration_to_delta("PT60M")
2755
    datetime.timedelta(0, 3600)
2756
    >>> rfc3339_duration_to_delta("PT24H")
2757
    datetime.timedelta(1)
2758
    >>> rfc3339_duration_to_delta("P1W")
2759
    datetime.timedelta(7)
2760
    >>> rfc3339_duration_to_delta("PT5M30S")
2761
    datetime.timedelta(0, 330)
2762
    >>> rfc3339_duration_to_delta("P1DT3M20S")
2763
    datetime.timedelta(1, 200)
2764
    """
874 by Teddy Hogeborn
PEP8 compliance: mandos
2765
609 by Teddy Hogeborn
* clients.conf: Convert all time intervals to new RFC 3339 syntax.
2766
    # Parsing an RFC 3339 duration with regular expressions is not
2767
    # possible - there would have to be multiple places for the same
2768
    # values, like seconds.  The current code, while more esoteric, is
2769
    # cleaner without depending on a parsing library.  If Python had a
2770
    # built-in library for parsing we would use it, but we'd like to
2771
    # avoid excessive use of external libraries.
874 by Teddy Hogeborn
PEP8 compliance: mandos
2772
609 by Teddy Hogeborn
* clients.conf: Convert all time intervals to new RFC 3339 syntax.
2773
    # New type for defining tokens, syntax, and semantics all-in-one
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2774
    Token = collections.namedtuple("Token", (
2775
        "regexp",  # To match token; if "value" is not None, must have
2776
                   # a "group" containing digits
2777
        "value",   # datetime.timedelta or None
2778
        "followers"))           # Tokens valid after this token
609 by Teddy Hogeborn
* clients.conf: Convert all time intervals to new RFC 3339 syntax.
2779
    # RFC 3339 "duration" tokens, syntax, and semantics; taken from
2780
    # the "duration" ABNF definition in RFC 3339, Appendix A.
2781
    token_end = Token(re.compile(r"$"), None, frozenset())
2782
    token_second = Token(re.compile(r"(\d+)S"),
2783
                         datetime.timedelta(seconds=1),
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2784
                         frozenset((token_end, )))
609 by Teddy Hogeborn
* clients.conf: Convert all time intervals to new RFC 3339 syntax.
2785
    token_minute = Token(re.compile(r"(\d+)M"),
2786
                         datetime.timedelta(minutes=1),
2787
                         frozenset((token_second, token_end)))
2788
    token_hour = Token(re.compile(r"(\d+)H"),
2789
                       datetime.timedelta(hours=1),
2790
                       frozenset((token_minute, token_end)))
2791
    token_time = Token(re.compile(r"T"),
2792
                       None,
2793
                       frozenset((token_hour, token_minute,
2794
                                  token_second)))
2795
    token_day = Token(re.compile(r"(\d+)D"),
2796
                      datetime.timedelta(days=1),
2797
                      frozenset((token_time, token_end)))
2798
    token_month = Token(re.compile(r"(\d+)M"),
2799
                        datetime.timedelta(weeks=4),
2800
                        frozenset((token_day, token_end)))
2801
    token_year = Token(re.compile(r"(\d+)Y"),
2802
                       datetime.timedelta(weeks=52),
2803
                       frozenset((token_month, token_end)))
2804
    token_week = Token(re.compile(r"(\d+)W"),
2805
                       datetime.timedelta(weeks=1),
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2806
                       frozenset((token_end, )))
609 by Teddy Hogeborn
* clients.conf: Convert all time intervals to new RFC 3339 syntax.
2807
    token_duration = Token(re.compile(r"P"), None,
2808
                           frozenset((token_year, token_month,
2809
                                      token_day, token_time,
721 by Teddy Hogeborn
Fix two mutually cancelling bugs.
2810
                                      token_week)))
874 by Teddy Hogeborn
PEP8 compliance: mandos
2811
    # Define starting values:
2812
    # Value so far
2813
    value = datetime.timedelta()
609 by Teddy Hogeborn
* clients.conf: Convert all time intervals to new RFC 3339 syntax.
2814
    found_token = None
874 by Teddy Hogeborn
PEP8 compliance: mandos
2815
    # Following valid tokens
2816
    followers = frozenset((token_duration, ))
2817
    # String left to parse
2818
    s = duration
609 by Teddy Hogeborn
* clients.conf: Convert all time intervals to new RFC 3339 syntax.
2819
    # Loop until end token is found
2820
    while found_token is not token_end:
2821
        # Search for any currently valid tokens
2822
        for token in followers:
2823
            match = token.regexp.match(s)
2824
            if match is not None:
2825
                # Token found
2826
                if token.value is not None:
2827
                    # Value found, parse digits
2828
                    factor = int(match.group(1), 10)
2829
                    # Add to value so far
2830
                    value += factor * token.value
2831
                # Strip token from string
2832
                s = token.regexp.sub("", s, 1)
2833
                # Go to found token
2834
                found_token = token
2835
                # Set valid next tokens
2836
                followers = found_token.followers
2837
                break
2838
        else:
2839
            # No currently valid tokens were found
752 by Teddy Hogeborn
mandos: Generate better messages in exceptions.
2840
            raise ValueError("Invalid RFC 3339 duration: {!r}"
2841
                             .format(duration))
609 by Teddy Hogeborn
* clients.conf: Convert all time intervals to new RFC 3339 syntax.
2842
    # End token found
2843
    return value
2844
2845
4 by Teddy Hogeborn
* server.py (Client.created, Client.next_check): New.
2846
def string_to_delta(interval):
2847
    """Parse a string and return a datetime.timedelta
874 by Teddy Hogeborn
PEP8 compliance: mandos
2848
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2849
    >>> string_to_delta('7d')
4 by Teddy Hogeborn
* server.py (Client.created, Client.next_check): New.
2850
    datetime.timedelta(7)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2851
    >>> string_to_delta('60s')
4 by Teddy Hogeborn
* server.py (Client.created, Client.next_check): New.
2852
    datetime.timedelta(0, 60)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2853
    >>> string_to_delta('60m')
4 by Teddy Hogeborn
* server.py (Client.created, Client.next_check): New.
2854
    datetime.timedelta(0, 3600)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2855
    >>> string_to_delta('24h')
4 by Teddy Hogeborn
* server.py (Client.created, Client.next_check): New.
2856
    datetime.timedelta(1)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2857
    >>> string_to_delta('1w')
4 by Teddy Hogeborn
* server.py (Client.created, Client.next_check): New.
2858
    datetime.timedelta(7)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2859
    >>> string_to_delta('5m 30s')
93 by Teddy Hogeborn
* mandos (string_to_delta): Accept a whitespace-separated sequence of
2860
    datetime.timedelta(0, 330)
4 by Teddy Hogeborn
* server.py (Client.created, Client.next_check): New.
2861
    """
874 by Teddy Hogeborn
PEP8 compliance: mandos
2862
609 by Teddy Hogeborn
* clients.conf: Convert all time intervals to new RFC 3339 syntax.
2863
    try:
2864
        return rfc3339_duration_to_delta(interval)
2865
    except ValueError:
2866
        pass
874 by Teddy Hogeborn
PEP8 compliance: mandos
2867
93 by Teddy Hogeborn
* mandos (string_to_delta): Accept a whitespace-separated sequence of
2868
    timevalue = datetime.timedelta(0)
2869
    for s in interval.split():
2870
        try:
729 by Teddy Hogeborn
mandos: Stop using str() and remove unnecessary unicode() calls.
2871
            suffix = s[-1]
215 by Teddy Hogeborn
* mandos: Remove unused "select" module. Import "ctypes.util".
2872
            value = int(s[:-1])
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2873
            if suffix == "d":
93 by Teddy Hogeborn
* mandos (string_to_delta): Accept a whitespace-separated sequence of
2874
                delta = datetime.timedelta(value)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2875
            elif suffix == "s":
93 by Teddy Hogeborn
* mandos (string_to_delta): Accept a whitespace-separated sequence of
2876
                delta = datetime.timedelta(0, value)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2877
            elif suffix == "m":
93 by Teddy Hogeborn
* mandos (string_to_delta): Accept a whitespace-separated sequence of
2878
                delta = datetime.timedelta(0, 0, 0, 0, value)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2879
            elif suffix == "h":
93 by Teddy Hogeborn
* mandos (string_to_delta): Accept a whitespace-separated sequence of
2880
                delta = datetime.timedelta(0, 0, 0, 0, 0, value)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2881
            elif suffix == "w":
93 by Teddy Hogeborn
* mandos (string_to_delta): Accept a whitespace-separated sequence of
2882
                delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
2883
            else:
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2884
                raise ValueError("Unknown suffix {!r}".format(suffix))
642 by Teddy Hogeborn
Syntax fix; use "raise" better in Mandos server.
2885
        except IndexError as e:
464 by Teddy Hogeborn
* debian/mandos-client.postrm (purge): Bug fix: update initramfs also
2886
            raise ValueError(*(e.args))
93 by Teddy Hogeborn
* mandos (string_to_delta): Accept a whitespace-separated sequence of
2887
        timevalue += delta
2888
    return timevalue
4 by Teddy Hogeborn
* server.py (Client.created, Client.next_check): New.
2889
8 by Teddy Hogeborn
* Makefile (client_debug): Bug fix; add quotes and / to CERT_ROOT.
2890
874 by Teddy Hogeborn
PEP8 compliance: mandos
2891
def daemon(nochdir=False, noclose=False):
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
2892
    """See daemon(3).  Standard BSD Unix function.
874 by Teddy Hogeborn
PEP8 compliance: mandos
2893
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
2894
    This should really exist as os.daemon, but it doesn't (yet)."""
2895
    if os.fork():
2896
        sys.exit()
2897
    os.setsid()
2898
    if not nochdir:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2899
        os.chdir("/")
46 by Teddy Hogeborn
* network-protocol.txt: New.
2900
    if os.fork():
2901
        sys.exit()
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
2902
    if not noclose:
2903
        # Close all standard open file descriptors
560.1.1 by teddy at recompile
* mandos: Use os.devnull instead of os.path.devnull. Fix some white
2904
        null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
2905
        if not stat.S_ISCHR(os.fstat(null).st_mode):
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2906
            raise OSError(errno.ENODEV,
2907
                          "{} not a character device"
568 by Teddy Hogeborn
* mandos-monitor: Use new string format method.
2908
                          .format(os.devnull))
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
2909
        os.dup2(null, sys.stdin.fileno())
2910
        os.dup2(null, sys.stdout.fileno())
2911
        os.dup2(null, sys.stderr.fileno())
2912
        if null > 2:
2913
            os.close(null)
2914
2915
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
2916
def main():
874 by Teddy Hogeborn
PEP8 compliance: mandos
2917
379 by Teddy Hogeborn
* mandos: Fix line lengths.
2918
    ##################################################################
327 by Teddy Hogeborn
Merge from pipe IPC branch.
2919
    # Parsing of options, both command line and config file
874 by Teddy Hogeborn
PEP8 compliance: mandos
2920
474 by teddy at bsnet
* mandos: Use the new argparse library instead of optparse.
2921
    parser = argparse.ArgumentParser()
2922
    parser.add_argument("-v", "--version", action="version",
874 by Teddy Hogeborn
PEP8 compliance: mandos
2923
                        version="%(prog)s {}".format(version),
474 by teddy at bsnet
* mandos: Use the new argparse library instead of optparse.
2924
                        help="show version number and exit")
2925
    parser.add_argument("-i", "--interface", metavar="IF",
2926
                        help="Bind to interface IF")
2927
    parser.add_argument("-a", "--address",
2928
                        help="Address to listen for requests on")
2929
    parser.add_argument("-p", "--port", type=int,
2930
                        help="Port number to receive requests on")
2931
    parser.add_argument("--check", action="store_true",
2932
                        help="Run self-test")
2933
    parser.add_argument("--debug", action="store_true",
2934
                        help="Debug mode; run in foreground and log"
618 by Teddy Hogeborn
* mandos: Bug fix: Make boolean options work from the config file
2935
                        " to terminal", default=None)
474 by teddy at bsnet
* mandos: Use the new argparse library instead of optparse.
2936
    parser.add_argument("--debuglevel", metavar="LEVEL",
2937
                        help="Debug level for stdout output")
2938
    parser.add_argument("--priority", help="GnuTLS"
2939
                        " priority string (see GnuTLS documentation)")
2940
    parser.add_argument("--servicename",
2941
                        metavar="NAME", help="Zeroconf service name")
2942
    parser.add_argument("--configdir",
2943
                        default="/etc/mandos", metavar="DIR",
2944
                        help="Directory to search for configuration"
2945
                        " files")
2946
    parser.add_argument("--no-dbus", action="store_false",
2947
                        dest="use_dbus", help="Do not provide D-Bus"
618 by Teddy Hogeborn
* mandos: Bug fix: Make boolean options work from the config file
2948
                        " system bus interface", default=None)
474 by teddy at bsnet
* mandos: Use the new argparse library instead of optparse.
2949
    parser.add_argument("--no-ipv6", action="store_false",
618 by Teddy Hogeborn
* mandos: Bug fix: Make boolean options work from the config file
2950
                        dest="use_ipv6", help="Do not use IPv6",
2951
                        default=None)
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
2952
    parser.add_argument("--no-restore", action="store_false",
518.1.7 by Teddy Hogeborn
* mandos: Break long lines and fix some more white space.
2953
                        dest="restore", help="Do not restore stored"
618 by Teddy Hogeborn
* mandos: Bug fix: Make boolean options work from the config file
2954
                        " state", default=None)
589.1.1 by Teddy Hogeborn
* mandos: Implement "--socket" option.
2955
    parser.add_argument("--socket", type=int,
2956
                        help="Specify a file descriptor to a network"
2957
                        " socket to use instead of creating one")
518.2.2 by Teddy Hogeborn
Directory with persistent state can now be changed with the "statedir"
2958
    parser.add_argument("--statedir", metavar="DIR",
2959
                        help="Directory to save/restore state in")
606 by Teddy Hogeborn
* mandos: New "--foreground" option.
2960
    parser.add_argument("--foreground", action="store_true",
618 by Teddy Hogeborn
* mandos: Bug fix: Make boolean options work from the config file
2961
                        help="Run in foreground", default=None)
707 by Teddy Hogeborn
mandos: New "--no-zeroconf" option. Also make "--socket=0" work.
2962
    parser.add_argument("--no-zeroconf", action="store_false",
2963
                        dest="zeroconf", help="Do not use Zeroconf",
2964
                        default=None)
874 by Teddy Hogeborn
PEP8 compliance: mandos
2965
474 by teddy at bsnet
* mandos: Use the new argparse library instead of optparse.
2966
    options = parser.parse_args()
874 by Teddy Hogeborn
PEP8 compliance: mandos
2967
4 by Teddy Hogeborn
* server.py (Client.created, Client.next_check): New.
2968
    if options.check:
2969
        import doctest
654 by Teddy Hogeborn
Fix running of self-tests.
2970
        fail_count, test_count = doctest.testmod()
2971
        sys.exit(os.EX_OK if fail_count == 0 else 1)
874 by Teddy Hogeborn
PEP8 compliance: mandos
2972
28 by Teddy Hogeborn
* server.conf: New file.
2973
    # Default values for config file for server-global settings
962 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
2974
    if gnutls.has_rawpk:
2975
        priority = ("SECURE128:!CTYPE-X.509:+CTYPE-RAWPK:!RSA"
2976
                    ":!VERS-ALL:+VERS-TLS1.3:%PROFILE_ULTRA")
2977
    else:
2978
        priority = ("SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2979
                    ":+SIGN-DSA-SHA256")
874 by Teddy Hogeborn
PEP8 compliance: mandos
2980
    server_defaults = {"interface": "",
2981
                       "address": "",
2982
                       "port": "",
2983
                       "debug": "False",
962 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
2984
                       "priority": priority,
874 by Teddy Hogeborn
PEP8 compliance: mandos
2985
                       "servicename": "Mandos",
2986
                       "use_dbus": "True",
2987
                       "use_ipv6": "True",
2988
                       "debuglevel": "",
2989
                       "restore": "True",
2990
                       "socket": "",
2991
                       "statedir": "/var/lib/mandos",
2992
                       "foreground": "False",
2993
                       "zeroconf": "True",
2994
                       }
962 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
2995
    del priority
874 by Teddy Hogeborn
PEP8 compliance: mandos
2996
28 by Teddy Hogeborn
* server.conf: New file.
2997
    # Parse config file for server-global settings
335 by Teddy Hogeborn
* mandos: Import "SocketServer" as "socketserver" and "ConfigParser"
2998
    server_config = configparser.SafeConfigParser(server_defaults)
28 by Teddy Hogeborn
* server.conf: New file.
2999
    del server_defaults
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3000
    server_config.read(os.path.join(options.configdir, "mandos.conf"))
28 by Teddy Hogeborn
* server.conf: New file.
3001
    # Convert the SafeConfigParser object to a dict
89 by Teddy Hogeborn
* Makefile: Bug fix: fixed creation of man pages for section 5 pages.
3002
    server_settings = server_config.defaults()
282 by Teddy Hogeborn
* mandos (main): Bug fix: use "getint" on the "port" config file
3003
    # Use the appropriate methods on the non-string config options
898 by Teddy Hogeborn
Server bug fix: Use the mandos.conf "zeroconf" and "restore" options
3004
    for option in ("debug", "use_dbus", "use_ipv6", "restore",
3005
                   "foreground", "zeroconf"):
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
3006
        server_settings[option] = server_config.getboolean("DEFAULT",
333 by Teddy Hogeborn
Minor code cleanup; one minor bug fix.
3007
                                                           option)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
3008
    if server_settings["port"]:
3009
        server_settings["port"] = server_config.getint("DEFAULT",
3010
                                                       "port")
589.1.1 by Teddy Hogeborn
* mandos: Implement "--socket" option.
3011
    if server_settings["socket"]:
3012
        server_settings["socket"] = server_config.getint("DEFAULT",
3013
                                                         "socket")
591 by Teddy Hogeborn
Merge "--socket" option for server.
3014
        # Later, stdin will, and stdout and stderr might, be dup'ed
589.1.1 by Teddy Hogeborn
* mandos: Implement "--socket" option.
3015
        # over with an opened os.devnull.  But we don't want this to
3016
        # happen with a supplied network socket.
3017
        if 0 <= server_settings["socket"] <= 2:
3018
            server_settings["socket"] = os.dup(server_settings
3019
                                               ["socket"])
28 by Teddy Hogeborn
* server.conf: New file.
3020
    del server_config
874 by Teddy Hogeborn
PEP8 compliance: mandos
3021
28 by Teddy Hogeborn
* server.conf: New file.
3022
    # Override the settings from the config file with command line
3023
    # options, if set.
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
3024
    for option in ("interface", "address", "port", "debug",
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3025
                   "priority", "servicename", "configdir", "use_dbus",
3026
                   "use_ipv6", "debuglevel", "restore", "statedir",
3027
                   "socket", "foreground", "zeroconf"):
28 by Teddy Hogeborn
* server.conf: New file.
3028
        value = getattr(options, option)
3029
        if value is not None:
3030
            server_settings[option] = value
3031
    del options
333 by Teddy Hogeborn
Minor code cleanup; one minor bug fix.
3032
    # Force all strings to be unicode
3033
    for option in server_settings.keys():
729 by Teddy Hogeborn
mandos: Stop using str() and remove unnecessary unicode() calls.
3034
        if isinstance(server_settings[option], bytes):
3035
            server_settings[option] = (server_settings[option]
3036
                                       .decode("utf-8"))
618 by Teddy Hogeborn
* mandos: Bug fix: Make boolean options work from the config file
3037
    # Force all boolean options to be boolean
3038
    for option in ("debug", "use_dbus", "use_ipv6", "restore",
707 by Teddy Hogeborn
mandos: New "--no-zeroconf" option. Also make "--socket=0" work.
3039
                   "foreground", "zeroconf"):
618 by Teddy Hogeborn
* mandos: Bug fix: Make boolean options work from the config file
3040
        server_settings[option] = bool(server_settings[option])
606 by Teddy Hogeborn
* mandos: New "--foreground" option.
3041
    # Debug implies foreground
3042
    if server_settings["debug"]:
3043
        server_settings["foreground"] = True
28 by Teddy Hogeborn
* server.conf: New file.
3044
    # Now we have our good server settings in "server_settings"
874 by Teddy Hogeborn
PEP8 compliance: mandos
3045
327 by Teddy Hogeborn
Merge from pipe IPC branch.
3046
    ##################################################################
874 by Teddy Hogeborn
PEP8 compliance: mandos
3047
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3048
    if (not server_settings["zeroconf"]
3049
        and not (server_settings["port"]
3050
                 or server_settings["socket"] != "")):
3051
        parser.error("Needs port or socket to work without Zeroconf")
874 by Teddy Hogeborn
PEP8 compliance: mandos
3052
243 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
3053
    # For convenience
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
3054
    debug = server_settings["debug"]
3055
    debuglevel = server_settings["debuglevel"]
3056
    use_dbus = server_settings["use_dbus"]
3057
    use_ipv6 = server_settings["use_ipv6"]
518.2.2 by Teddy Hogeborn
Directory with persistent state can now be changed with the "statedir"
3058
    stored_state_path = os.path.join(server_settings["statedir"],
3059
                                     stored_state_file)
606 by Teddy Hogeborn
* mandos: New "--foreground" option.
3060
    foreground = server_settings["foreground"]
707 by Teddy Hogeborn
mandos: New "--no-zeroconf" option. Also make "--socket=0" work.
3061
    zeroconf = server_settings["zeroconf"]
874 by Teddy Hogeborn
PEP8 compliance: mandos
3062
518.1.4 by Björn Påhlsson
restructured logger
3063
    if debug:
530 by teddy at bsnet
* mandos (initlogger): Take new "debug" argument; all callers changed.
3064
        initlogger(debug, logging.DEBUG)
518.1.4 by Björn Påhlsson
restructured logger
3065
    else:
3066
        if not debuglevel:
530 by teddy at bsnet
* mandos (initlogger): Take new "debug" argument; all callers changed.
3067
            initlogger(debug)
518.1.4 by Björn Påhlsson
restructured logger
3068
        else:
3069
            level = getattr(logging, debuglevel.upper())
530 by teddy at bsnet
* mandos (initlogger): Take new "debug" argument; all callers changed.
3070
            initlogger(debug, level)
874 by Teddy Hogeborn
PEP8 compliance: mandos
3071
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
3072
    if server_settings["servicename"] != "Mandos":
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3073
        syslogger.setFormatter(
3074
            logging.Formatter('Mandos ({}) [%(process)d]:'
3075
                              ' %(levelname)s: %(message)s'.format(
3076
                                  server_settings["servicename"])))
874 by Teddy Hogeborn
PEP8 compliance: mandos
3077
28 by Teddy Hogeborn
* server.conf: New file.
3078
    # Parse config file with clients
543 by Teddy Hogeborn
* mandos: Break some long lines.
3079
    client_config = configparser.SafeConfigParser(Client
3080
                                                  .client_defaults)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
3081
    client_config.read(os.path.join(server_settings["configdir"],
3082
                                    "clients.conf"))
874 by Teddy Hogeborn
PEP8 compliance: mandos
3083
327 by Teddy Hogeborn
Merge from pipe IPC branch.
3084
    global mandos_dbus_service
3085
    mandos_dbus_service = None
874 by Teddy Hogeborn
PEP8 compliance: mandos
3086
707 by Teddy Hogeborn
mandos: New "--no-zeroconf" option. Also make "--socket=0" work.
3087
    socketfd = None
3088
    if server_settings["socket"] != "":
3089
        socketfd = server_settings["socket"]
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3090
    tcp_server = MandosServer(
3091
        (server_settings["address"], server_settings["port"]),
3092
        ClientHandler,
3093
        interface=(server_settings["interface"] or None),
3094
        use_ipv6=use_ipv6,
3095
        gnutls_priority=server_settings["priority"],
3096
        use_dbus=use_dbus,
3097
        socketfd=socketfd)
606 by Teddy Hogeborn
* mandos: New "--foreground" option.
3098
    if not foreground:
626 by Teddy Hogeborn
* Makefile (CFLAGS, LDFLAGS): Keep default flags from environment.
3099
        pidfilename = "/run/mandos.pid"
636 by Teddy Hogeborn
Fall back to /var/run for pidfile if /run is not a directory.
3100
        if not os.path.isdir("/run/."):
3101
            pidfilename = "/var/run/mandos.pid"
606 by Teddy Hogeborn
* mandos: New "--foreground" option.
3102
        pidfile = None
439 by Teddy Hogeborn
* mandos: Do not write pid file if --debug is passed.
3103
        try:
751 by Teddy Hogeborn
mandos: Use codecs.open() and print() for PID file.
3104
            pidfile = codecs.open(pidfilename, "w", encoding="utf-8")
574 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
3105
        except IOError as e:
3106
            logger.error("Could not open file %r", pidfilename,
3107
                         exc_info=e)
874 by Teddy Hogeborn
PEP8 compliance: mandos
3108
816 by Teddy Hogeborn
Use "nogroup" as a fallback group, not "nobody".
3109
    for name, group in (("_mandos", "_mandos"),
3110
                        ("mandos", "mandos"),
3111
                        ("nobody", "nogroup")):
238 by Teddy Hogeborn
First version of a somewhat complete D-Bus server interface. Also
3112
        try:
566 by Teddy Hogeborn
* mandos (main): Simplify and shorten code selecting user and group ID
3113
            uid = pwd.getpwnam(name).pw_uid
816 by Teddy Hogeborn
Use "nogroup" as a fallback group, not "nobody".
3114
            gid = pwd.getpwnam(group).pw_gid
566 by Teddy Hogeborn
* mandos (main): Simplify and shorten code selecting user and group ID
3115
            break
238 by Teddy Hogeborn
First version of a somewhat complete D-Bus server interface. Also
3116
        except KeyError:
566 by Teddy Hogeborn
* mandos (main): Simplify and shorten code selecting user and group ID
3117
            continue
3118
    else:
3119
        uid = 65534
3120
        gid = 65534
163 by Teddy Hogeborn
* Makefile (PIDDIR, USER, GROUP): Removed.
3121
    try:
290 by Teddy Hogeborn
* mandos (main): Bug fix: Do setgid before setuid. Add verbose GnuTLS
3122
        os.setgid(gid)
163 by Teddy Hogeborn
* Makefile (PIDDIR, USER, GROUP): Removed.
3123
        os.setuid(uid)
825 by Teddy Hogeborn
Server bug fix: Include CAP_SETGID so it does not run as root
3124
        if debug:
3125
            logger.debug("Did setuid/setgid to {}:{}".format(uid,
3126
                                                             gid))
482 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
3127
    except OSError as error:
825 by Teddy Hogeborn
Server bug fix: Include CAP_SETGID so it does not run as root
3128
        logger.warning("Failed to setuid/setgid to {}:{}: {}"
3129
                       .format(uid, gid, os.strerror(error.errno)))
583 by Teddy Hogeborn
* mandos (Client.start_checker): Remove undocumented support for "%%s"
3130
        if error.errno != errno.EPERM:
642 by Teddy Hogeborn
Syntax fix; use "raise" better in Mandos server.
3131
            raise
874 by Teddy Hogeborn
PEP8 compliance: mandos
3132
290 by Teddy Hogeborn
* mandos (main): Bug fix: Do setgid before setuid. Add verbose GnuTLS
3133
    if debug:
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
3134
        # Enable all possible GnuTLS debugging
874 by Teddy Hogeborn
PEP8 compliance: mandos
3135
290 by Teddy Hogeborn
* mandos (main): Bug fix: Do setgid before setuid. Add verbose GnuTLS
3136
        # "Use a log level over 10 to enable all debugging options."
3137
        # - GnuTLS manual
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
3138
        gnutls.global_set_log_level(11)
874 by Teddy Hogeborn
PEP8 compliance: mandos
3139
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
3140
        @gnutls.log_func
290 by Teddy Hogeborn
* mandos (main): Bug fix: Do setgid before setuid. Add verbose GnuTLS
3141
        def debug_gnutls(level, string):
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
3142
            logger.debug("GnuTLS: %s", string[:-1])
874 by Teddy Hogeborn
PEP8 compliance: mandos
3143
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
3144
        gnutls.global_set_log_function(debug_gnutls)
874 by Teddy Hogeborn
PEP8 compliance: mandos
3145
24.1.155 by Björn Påhlsson
mandos server: Added debuglevel that adjust at what level information
3146
        # Redirect stdin so all checkers get /dev/null
560.1.1 by teddy at recompile
* mandos: Use os.devnull instead of os.path.devnull. Fix some white
3147
        null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
24.1.155 by Björn Påhlsson
mandos server: Added debuglevel that adjust at what level information
3148
        os.dup2(null, sys.stdin.fileno())
3149
        if null > 2:
3150
            os.close(null)
874 by Teddy Hogeborn
PEP8 compliance: mandos
3151
458 by teddy at bsnet
* mandos (main): Bug fix: Fork before connecting to D-Bus.
3152
    # Need to fork before connecting to D-Bus
606 by Teddy Hogeborn
* mandos: New "--foreground" option.
3153
    if not foreground:
458 by teddy at bsnet
* mandos (main): Bug fix: Fork before connecting to D-Bus.
3154
        # Close all input and output, do double fork, etc.
3155
        daemon()
874 by Teddy Hogeborn
PEP8 compliance: mandos
3156
830 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
3157
    # multiprocessing will use threads, so before we use GLib we need
3158
    # to inform GLib that threads will be used.
3159
    GLib.threads_init()
874 by Teddy Hogeborn
PEP8 compliance: mandos
3160
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
3161
    global main_loop
3162
    # From the Avahi example code
560.1.1 by teddy at recompile
* mandos: Use os.devnull instead of os.path.devnull. Fix some white
3163
    DBusGMainLoop(set_as_default=True)
830 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
3164
    main_loop = GLib.MainLoop()
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
3165
    bus = dbus.SystemBus()
3166
    # End of Avahi example code
243 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
3167
    if use_dbus:
402 by Teddy Hogeborn
* mandos (Client.disable): Rename keyword argument "log" to "quiet",
3168
        try:
505 by Björn Påhlsson
The domain name has changed, so the D-Bus bus and interface names must
3169
            bus_name = dbus.service.BusName("se.recompile.Mandos",
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3170
                                            bus,
3171
                                            do_not_queue=True)
3172
            old_bus_name = dbus.service.BusName(
3173
                "se.bsnet.fukt.Mandos", bus,
3174
                do_not_queue=True)
750 by Teddy Hogeborn
mandos: Disable D-Bus if any DBusException is raised when connecting.
3175
        except dbus.exceptions.DBusException as e:
574 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
3176
            logger.error("Disabling D-Bus:", exc_info=e)
402 by Teddy Hogeborn
* mandos (Client.disable): Rename keyword argument "log" to "quiet",
3177
            use_dbus = False
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
3178
            server_settings["use_dbus"] = False
402 by Teddy Hogeborn
* mandos (Client.disable): Rename keyword argument "log" to "quiet",
3179
            tcp_server.use_dbus = False
707 by Teddy Hogeborn
mandos: New "--no-zeroconf" option. Also make "--socket=0" work.
3180
    if zeroconf:
3181
        protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3182
        service = AvahiServiceToSyslog(
874 by Teddy Hogeborn
PEP8 compliance: mandos
3183
            name=server_settings["servicename"],
3184
            servicetype="_mandos._tcp",
3185
            protocol=protocol,
3186
            bus=bus)
707 by Teddy Hogeborn
mandos: New "--no-zeroconf" option. Also make "--socket=0" work.
3187
        if server_settings["interface"]:
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3188
            service.interface = if_nametoindex(
3189
                server_settings["interface"].encode("utf-8"))
874 by Teddy Hogeborn
PEP8 compliance: mandos
3190
24.1.152 by Björn Påhlsson
bug fixes that prevent problems when runing server as root
3191
    global multiprocessing_manager
3192
    multiprocessing_manager = multiprocessing.Manager()
874 by Teddy Hogeborn
PEP8 compliance: mandos
3193
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
3194
    client_class = Client
3195
    if use_dbus:
874 by Teddy Hogeborn
PEP8 compliance: mandos
3196
        client_class = functools.partial(ClientDBus, bus=bus)
3197
518.1.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
3198
    client_settings = Client.config_parser(client_config)
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
3199
    old_client_settings = {}
518.1.15 by Björn Påhlsson
more refactoring in regards to how clients get created
3200
    clients_data = {}
874 by Teddy Hogeborn
PEP8 compliance: mandos
3201
617 by Teddy Hogeborn
* mandos: Bug fix: Don't print output from checkers when running in
3202
    # This is used to redirect stdout and stderr for checker processes
3203
    global wnull
874 by Teddy Hogeborn
PEP8 compliance: mandos
3204
    wnull = open(os.devnull, "w")  # A writable /dev/null
617 by Teddy Hogeborn
* mandos: Bug fix: Don't print output from checkers when running in
3205
    # Only used if server is running in foreground but not in debug
3206
    # mode
3207
    if debug or not foreground:
3208
        wnull.close()
874 by Teddy Hogeborn
PEP8 compliance: mandos
3209
518.1.7 by Teddy Hogeborn
* mandos: Break long lines and fix some more white space.
3210
    # Get client data and settings from last running state.
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
3211
    if server_settings["restore"]:
3212
        try:
3213
            with open(stored_state_path, "rb") as stored_state:
874 by Teddy Hogeborn
PEP8 compliance: mandos
3214
                if sys.version_info.major == 2:
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
3215
                    clients_data, old_client_settings = pickle.load(
3216
                        stored_state)
3217
                else:
3218
                    bytes_clients_data, bytes_old_client_settings = (
874 by Teddy Hogeborn
PEP8 compliance: mandos
3219
                        pickle.load(stored_state, encoding="bytes"))
3220
                    #   Fix bytes to strings
3221
                    #  clients_data
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
3222
                    # .keys()
874 by Teddy Hogeborn
PEP8 compliance: mandos
3223
                    clients_data = {(key.decode("utf-8")
3224
                                     if isinstance(key, bytes)
3225
                                     else key): value
3226
                                    for key, value in
3227
                                    bytes_clients_data.items()}
829 by Teddy Hogeborn
Server: Fix minor thing with Python 3 compatibility
3228
                    del bytes_clients_data
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
3229
                    for key in clients_data:
874 by Teddy Hogeborn
PEP8 compliance: mandos
3230
                        value = {(k.decode("utf-8")
3231
                                  if isinstance(k, bytes) else k): v
3232
                                 for k, v in
3233
                                 clients_data[key].items()}
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
3234
                        clients_data[key] = value
3235
                        # .client_structure
3236
                        value["client_structure"] = [
3237
                            (s.decode("utf-8")
3238
                             if isinstance(s, bytes)
3239
                             else s) for s in
874 by Teddy Hogeborn
PEP8 compliance: mandos
3240
                            value["client_structure"]]
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
3241
                        # .name & .host
3242
                        for k in ("name", "host"):
3243
                            if isinstance(value[k], bytes):
3244
                                value[k] = value[k].decode("utf-8")
962 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
3245
                        if not value.has_key("key_id"):
3246
                            value["key_id"] = ""
3247
                        elif not value.has_key("fingerprint"):
3248
                            value["fingerprint"] = ""
874 by Teddy Hogeborn
PEP8 compliance: mandos
3249
                    #  old_client_settings
829 by Teddy Hogeborn
Server: Fix minor thing with Python 3 compatibility
3250
                    # .keys()
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
3251
                    old_client_settings = {
3252
                        (key.decode("utf-8")
3253
                         if isinstance(key, bytes)
3254
                         else key): value
3255
                        for key, value in
874 by Teddy Hogeborn
PEP8 compliance: mandos
3256
                        bytes_old_client_settings.items()}
829 by Teddy Hogeborn
Server: Fix minor thing with Python 3 compatibility
3257
                    del bytes_old_client_settings
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
3258
                    # .host
3259
                    for value in old_client_settings.values():
829 by Teddy Hogeborn
Server: Fix minor thing with Python 3 compatibility
3260
                        if isinstance(value["host"], bytes):
3261
                            value["host"] = (value["host"]
3262
                                             .decode("utf-8"))
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
3263
            os.remove(stored_state_path)
3264
        except IOError as e:
574 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
3265
            if e.errno == errno.ENOENT:
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3266
                logger.warning("Could not load persistent state:"
3267
                               " {}".format(os.strerror(e.errno)))
574 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
3268
            else:
3269
                logger.critical("Could not load persistent state:",
3270
                                exc_info=e)
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
3271
                raise
505.1.23 by Teddy Hogeborn
* mandos (main): Handle EOFError when reading state file.
3272
        except EOFError as e:
3273
            logger.warning("Could not load persistent state: "
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3274
                           "EOFError:",
3275
                           exc_info=e)
874 by Teddy Hogeborn
PEP8 compliance: mandos
3276
518.1.9 by Björn Påhlsson
renamed variables
3277
    with PGPEngine() as pgp:
723.1.4 by Teddy Hogeborn
Use the .items() method instead of .iteritems().
3278
        for client_name, client in clients_data.items():
617 by Teddy Hogeborn
* mandos: Bug fix: Don't print output from checkers when running in
3279
            # Skip removed clients
3280
            if client_name not in client_settings:
3281
                continue
874 by Teddy Hogeborn
PEP8 compliance: mandos
3282
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
3283
            # Decide which value to use after restoring saved state.
3284
            # We have three different values: Old config file,
3285
            # new config file, and saved state.
3286
            # New config value takes precedence if it differs from old
3287
            # config value, otherwise use saved state.
3288
            for name, value in client_settings[client_name].items():
3289
                try:
3290
                    # For each value in new config, check if it
3291
                    # differs from the old config value (Except for
3292
                    # the "secret" attribute)
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3293
                    if (name != "secret"
3294
                        and (value !=
3295
                             old_client_settings[client_name][name])):
518.2.10 by Teddy Hogeborn
* mandos (main): Bug fix: Syntax fix when restoring settings.
3296
                        client[name] = value
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
3297
                except KeyError:
3298
                    pass
874 by Teddy Hogeborn
PEP8 compliance: mandos
3299
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
3300
            # Clients who has passed its expire date can still be
749.1.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
3301
            # enabled if its last checker was successful.  A Client
552 by teddy at recompile
* mandos: Consistent terminology; use the term "secret" for the
3302
            # whose checker succeeded before we stored its state is
3303
            # assumed to have successfully run all checkers during
3304
            # downtime.
518.2.8 by Teddy Hogeborn
* mandos (ClientDBus.Host_dbus_property,
3305
            if client["enabled"]:
518.1.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
3306
                if datetime.datetime.utcnow() >= client["expires"]:
3307
                    if not client["last_checked_ok"]:
3308
                        logger.warning(
723.1.5 by Teddy Hogeborn
Use the new auto-numbered "{}" syntax for the .format() string method.
3309
                            "disabling client {} - Client never "
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3310
                            "performed a successful checker".format(
3311
                                client_name))
518.1.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
3312
                        client["enabled"] = False
3313
                    elif client["last_checker_status"] != 0:
3314
                        logger.warning(
723.1.5 by Teddy Hogeborn
Use the new auto-numbered "{}" syntax for the .format() string method.
3315
                            "disabling client {} - Client last"
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3316
                            " checker failed with error code"
3317
                            " {}".format(
3318
                                client_name,
3319
                                client["last_checker_status"]))
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
3320
                        client["enabled"] = False
3321
                    else:
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3322
                        client["expires"] = (
3323
                            datetime.datetime.utcnow()
3324
                            + client["timeout"])
542 by Björn Påhlsson
fixed bug with bad stored config state for expires and last_checked_ok.
3325
                        logger.debug("Last checker succeeded,"
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3326
                                     " keeping {} enabled".format(
3327
                                         client_name))
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
3328
            try:
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3329
                client["secret"] = pgp.decrypt(
3330
                    client["encrypted_secret"],
3331
                    client_settings[client_name]["secret"])
518.1.9 by Björn Påhlsson
renamed variables
3332
            except PGPError:
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
3333
                # If decryption fails, we use secret from new settings
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3334
                logger.debug("Failed to decrypt {} old secret".format(
3335
                    client_name))
3336
                client["secret"] = (client_settings[client_name]
3337
                                    ["secret"])
874 by Teddy Hogeborn
PEP8 compliance: mandos
3338
518.1.15 by Björn Påhlsson
more refactoring in regards to how clients get created
3339
    # Add/remove clients based on new changes made to config
543 by Teddy Hogeborn
* mandos: Break some long lines.
3340
    for client_name in (set(old_client_settings)
3341
                        - set(client_settings)):
518.1.15 by Björn Påhlsson
more refactoring in regards to how clients get created
3342
        del clients_data[client_name]
543 by Teddy Hogeborn
* mandos: Break some long lines.
3343
    for client_name in (set(client_settings)
3344
                        - set(old_client_settings)):
518.1.15 by Björn Påhlsson
more refactoring in regards to how clients get created
3345
        clients_data[client_name] = client_settings[client_name]
874 by Teddy Hogeborn
PEP8 compliance: mandos
3346
552 by teddy at recompile
* mandos: Consistent terminology; use the term "secret" for the
3347
    # Create all client objects
723.1.4 by Teddy Hogeborn
Use the .items() method instead of .iteritems().
3348
    for client_name, client in clients_data.items():
518.1.15 by Björn Påhlsson
more refactoring in regards to how clients get created
3349
        tcp_server.clients[client_name] = client_class(
874 by Teddy Hogeborn
PEP8 compliance: mandos
3350
            name=client_name,
3351
            settings=client,
3352
            server_settings=server_settings)
3353
341 by Teddy Hogeborn
Code cleanup and one bug fix.
3354
    if not tcp_server.clients:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
3355
        logger.warning("No clients defined")
874 by Teddy Hogeborn
PEP8 compliance: mandos
3356
606 by Teddy Hogeborn
* mandos: New "--foreground" option.
3357
    if not foreground:
3358
        if pidfile is not None:
751 by Teddy Hogeborn
mandos: Use codecs.open() and print() for PID file.
3359
            pid = os.getpid()
606 by Teddy Hogeborn
* mandos: New "--foreground" option.
3360
            try:
3361
                with pidfile:
751 by Teddy Hogeborn
mandos: Use codecs.open() and print() for PID file.
3362
                    print(pid, file=pidfile)
606 by Teddy Hogeborn
* mandos: New "--foreground" option.
3363
            except IOError:
3364
                logger.error("Could not write to file %r with PID %d",
3365
                             pidfilename, pid)
3366
        del pidfile
439 by Teddy Hogeborn
* mandos: Do not write pid file if --debug is passed.
3367
        del pidfilename
874 by Teddy Hogeborn
PEP8 compliance: mandos
3368
831 by Teddy Hogeborn
Server: Fix bug where it did not exit timely on signals
3369
    for termsig in (signal.SIGHUP, signal.SIGTERM):
3370
        GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,
3371
                             lambda: main_loop.quit() and False)
874 by Teddy Hogeborn
PEP8 compliance: mandos
3372
243 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
3373
    if use_dbus:
874 by Teddy Hogeborn
PEP8 compliance: mandos
3374
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3375
        @alternate_dbus_interfaces(
874 by Teddy Hogeborn
PEP8 compliance: mandos
3376
            {"se.recompile.Mandos": "se.bsnet.fukt.Mandos"})
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
3377
        class MandosDBusService(DBusObjectWithObjectManager):
243 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
3378
            """A D-Bus proxy object"""
874 by Teddy Hogeborn
PEP8 compliance: mandos
3379
243 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
3380
            def __init__(self):
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
3381
                dbus.service.Object.__init__(self, bus, "/")
874 by Teddy Hogeborn
PEP8 compliance: mandos
3382
505.1.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
3383
            _interface = "se.recompile.Mandos"
874 by Teddy Hogeborn
PEP8 compliance: mandos
3384
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
3385
            @dbus.service.signal(_interface, signature="o")
411 by Teddy Hogeborn
More consistent terminology: Clients are no longer "invalid" - they
3386
            def ClientAdded(self, objpath):
243 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
3387
                "D-Bus signal"
3388
                pass
874 by Teddy Hogeborn
PEP8 compliance: mandos
3389
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
3390
            @dbus.service.signal(_interface, signature="ss")
962 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
3391
            def ClientNotFound(self, key_id, address):
327 by Teddy Hogeborn
Merge from pipe IPC branch.
3392
                "D-Bus signal"
3393
                pass
874 by Teddy Hogeborn
PEP8 compliance: mandos
3394
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
3395
            @dbus_annotations({"org.freedesktop.DBus.Deprecated":
3396
                               "true"})
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
3397
            @dbus.service.signal(_interface, signature="os")
278 by Teddy Hogeborn
* mandos (Client.GetAllProperties): Also send Client.dbus_object_path
3398
            def ClientRemoved(self, objpath, name):
243 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
3399
                "D-Bus signal"
3400
                pass
874 by Teddy Hogeborn
PEP8 compliance: mandos
3401
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
3402
            @dbus_annotations({"org.freedesktop.DBus.Deprecated":
3403
                               "true"})
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
3404
            @dbus.service.method(_interface, out_signature="ao")
243 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
3405
            def GetAllClients(self):
283 by Teddy Hogeborn
* mandos (peer_certificate): Handle NULL pointer from
3406
                "D-Bus method"
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3407
                return dbus.Array(c.dbus_object_path for c in
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
3408
                                  tcp_server.clients.values())
874 by Teddy Hogeborn
PEP8 compliance: mandos
3409
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
3410
            @dbus_annotations({"org.freedesktop.DBus.Deprecated":
3411
                               "true"})
333 by Teddy Hogeborn
Minor code cleanup; one minor bug fix.
3412
            @dbus.service.method(_interface,
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
3413
                                 out_signature="a{oa{sv}}")
243 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
3414
            def GetAllClientsWithProperties(self):
283 by Teddy Hogeborn
* mandos (peer_certificate): Handle NULL pointer from
3415
                "D-Bus method"
243 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
3416
                return dbus.Dictionary(
874 by Teddy Hogeborn
PEP8 compliance: mandos
3417
                    {c.dbus_object_path: c.GetAll(
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
3418
                        "se.recompile.Mandos.Client")
874 by Teddy Hogeborn
PEP8 compliance: mandos
3419
                     for c in tcp_server.clients.values()},
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
3420
                    signature="oa{sv}")
874 by Teddy Hogeborn
PEP8 compliance: mandos
3421
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
3422
            @dbus.service.method(_interface, in_signature="o")
243 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
3423
            def RemoveClient(self, object_path):
283 by Teddy Hogeborn
* mandos (peer_certificate): Handle NULL pointer from
3424
                "D-Bus method"
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
3425
                for c in tcp_server.clients.values():
243 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
3426
                    if c.dbus_object_path == object_path:
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
3427
                        del tcp_server.clients[c.name]
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
3428
                        c.remove_from_connection()
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
3429
                        # Don't signal the disabling
402 by Teddy Hogeborn
* mandos (Client.disable): Rename keyword argument "log" to "quiet",
3430
                        c.disable(quiet=True)
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
3431
                        # Emit D-Bus signal for removal
3432
                        self.client_removed_signal(c)
278 by Teddy Hogeborn
* mandos (Client.GetAllProperties): Also send Client.dbus_object_path
3433
                        return
400 by Teddy Hogeborn
* mandos (Client.enable): Bug fix: Start new immediate checker last to
3434
                raise KeyError(object_path)
874 by Teddy Hogeborn
PEP8 compliance: mandos
3435
243 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
3436
            del _interface
874 by Teddy Hogeborn
PEP8 compliance: mandos
3437
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
3438
            @dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
874 by Teddy Hogeborn
PEP8 compliance: mandos
3439
                                 out_signature="a{oa{sa{sv}}}")
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
3440
            def GetManagedObjects(self):
3441
                """D-Bus method"""
3442
                return dbus.Dictionary(
874 by Teddy Hogeborn
PEP8 compliance: mandos
3443
                    {client.dbus_object_path:
3444
                     dbus.Dictionary(
3445
                         {interface: client.GetAll(interface)
3446
                          for interface in
3447
                          client._get_all_interface_names()})
3448
                     for client in tcp_server.clients.values()})
3449
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
3450
            def client_added_signal(self, client):
3451
                """Send the new standard signal and the old signal"""
3452
                if use_dbus:
3453
                    # New standard signal
3454
                    self.InterfacesAdded(
3455
                        client.dbus_object_path,
3456
                        dbus.Dictionary(
874 by Teddy Hogeborn
PEP8 compliance: mandos
3457
                            {interface: client.GetAll(interface)
3458
                             for interface in
3459
                             client._get_all_interface_names()}))
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
3460
                    # Old signal
3461
                    self.ClientAdded(client.dbus_object_path)
874 by Teddy Hogeborn
PEP8 compliance: mandos
3462
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
3463
            def client_removed_signal(self, client):
3464
                """Send the new standard signal and the old signal"""
3465
                if use_dbus:
3466
                    # New standard signal
3467
                    self.InterfacesRemoved(
3468
                        client.dbus_object_path,
3469
                        client._get_all_interface_names())
3470
                    # Old signal
3471
                    self.ClientRemoved(client.dbus_object_path,
3472
                                       client.name)
874 by Teddy Hogeborn
PEP8 compliance: mandos
3473
575 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
3474
        mandos_dbus_service = MandosDBusService()
874 by Teddy Hogeborn
PEP8 compliance: mandos
3475
850 by Teddy Hogeborn
mandos: Bug fix: Do multiprocessing cleanup correctly on exit
3476
    # Save modules to variables to exempt the modules from being
3477
    # unloaded before the function registered with atexit() is run.
3478
    mp = multiprocessing
3479
    wn = wnull
874 by Teddy Hogeborn
PEP8 compliance: mandos
3480
400 by Teddy Hogeborn
* mandos (Client.enable): Bug fix: Start new immediate checker last to
3481
    def cleanup():
3482
        "Cleanup function; run on exit"
707 by Teddy Hogeborn
mandos: New "--no-zeroconf" option. Also make "--socket=0" work.
3483
        if zeroconf:
3484
            service.cleanup()
874 by Teddy Hogeborn
PEP8 compliance: mandos
3485
850 by Teddy Hogeborn
mandos: Bug fix: Do multiprocessing cleanup correctly on exit
3486
        mp.active_children()
3487
        wn.close()
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
3488
        if not (tcp_server.clients or client_settings):
3489
            return
874 by Teddy Hogeborn
PEP8 compliance: mandos
3490
521 by teddy at bsnet
* debian/control (mandos/Depends): Added "python-crypto".
3491
        # Store client before exiting. Secrets are encrypted with key
3492
        # based on what config file has. If config file is
3493
        # removed/edited, old secret will thus be unrecovable.
518.1.15 by Björn Påhlsson
more refactoring in regards to how clients get created
3494
        clients = {}
518.1.9 by Björn Påhlsson
renamed variables
3495
        with PGPEngine() as pgp:
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
3496
            for client in tcp_server.clients.values():
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
3497
                key = client_settings[client.name]["secret"]
518.1.9 by Björn Påhlsson
renamed variables
3498
                client.encrypted_secret = pgp.encrypt(client.secret,
3499
                                                      key)
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
3500
                client_dict = {}
874 by Teddy Hogeborn
PEP8 compliance: mandos
3501
518.1.15 by Björn Påhlsson
more refactoring in regards to how clients get created
3502
                # A list of attributes that can not be pickled
3503
                # + secret.
874 by Teddy Hogeborn
PEP8 compliance: mandos
3504
                exclude = {"bus", "changedstate", "secret",
3505
                           "checker", "server_settings"}
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3506
                for name, typ in inspect.getmembers(dbus.service
3507
                                                    .Object):
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
3508
                    exclude.add(name)
874 by Teddy Hogeborn
PEP8 compliance: mandos
3509
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
3510
                client_dict["encrypted_secret"] = (client
3511
                                                   .encrypted_secret)
3512
                for attr in client.client_structure:
3513
                    if attr not in exclude:
3514
                        client_dict[attr] = getattr(client, attr)
874 by Teddy Hogeborn
PEP8 compliance: mandos
3515
518.1.15 by Björn Påhlsson
more refactoring in regards to how clients get created
3516
                clients[client.name] = client_dict
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
3517
                del client_settings[client.name]["secret"]
874 by Teddy Hogeborn
PEP8 compliance: mandos
3518
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
3519
        try:
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3520
            with tempfile.NamedTemporaryFile(
3521
                    mode='wb',
3522
                    suffix=".pickle",
3523
                    prefix='clients-',
3524
                    dir=os.path.dirname(stored_state_path),
3525
                    delete=False) as stored_state:
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
3526
                pickle.dump((clients, client_settings), stored_state,
874 by Teddy Hogeborn
PEP8 compliance: mandos
3527
                            protocol=2)
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3528
                tempname = stored_state.name
505.1.26 by teddy at bsnet
* mandos (main/cleanup): Write new file, then rename. Use
3529
            os.rename(tempname, stored_state_path)
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
3530
        except (IOError, OSError) as e:
530 by teddy at bsnet
* mandos (initlogger): Take new "debug" argument; all callers changed.
3531
            if not debug:
3532
                try:
3533
                    os.remove(tempname)
3534
                except NameError:
3535
                    pass
574 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
3536
            if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
723.1.5 by Teddy Hogeborn
Use the new auto-numbered "{}" syntax for the .format() string method.
3537
                logger.warning("Could not save persistent state: {}"
574 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
3538
                               .format(os.strerror(e.errno)))
3539
            else:
3540
                logger.warning("Could not save persistent state:",
3541
                               exc_info=e)
642 by Teddy Hogeborn
Syntax fix; use "raise" better in Mandos server.
3542
                raise
874 by Teddy Hogeborn
PEP8 compliance: mandos
3543
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
3544
        # Delete all clients, and settings from config
400 by Teddy Hogeborn
* mandos (Client.enable): Bug fix: Start new immediate checker last to
3545
        while tcp_server.clients:
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
3546
            name, client = tcp_server.clients.popitem()
402 by Teddy Hogeborn
* mandos (Client.disable): Rename keyword argument "log" to "quiet",
3547
            if use_dbus:
3548
                client.remove_from_connection()
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
3549
            # Don't signal the disabling
402 by Teddy Hogeborn
* mandos (Client.disable): Rename keyword argument "log" to "quiet",
3550
            client.disable(quiet=True)
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
3551
            # Emit D-Bus signal for removal
796 by Teddy Hogeborn
On cleanup, Signal ClientRemoved only if using D-Bus.
3552
            if use_dbus:
3553
                mandos_dbus_service.client_removed_signal(client)
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
3554
        client_settings.clear()
874 by Teddy Hogeborn
PEP8 compliance: mandos
3555
400 by Teddy Hogeborn
* mandos (Client.enable): Bug fix: Start new immediate checker last to
3556
    atexit.register(cleanup)
874 by Teddy Hogeborn
PEP8 compliance: mandos
3557
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
3558
    for client in tcp_server.clients.values():
243 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
3559
        if use_dbus:
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
3560
            # Emit D-Bus signal for adding
3561
            mandos_dbus_service.client_added_signal(client)
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
3562
        # Need to initiate checking of clients
3563
        if client.enabled:
3564
            client.init_checker()
874 by Teddy Hogeborn
PEP8 compliance: mandos
3565
163 by Teddy Hogeborn
* Makefile (PIDDIR, USER, GROUP): Removed.
3566
    tcp_server.enable()
3567
    tcp_server.server_activate()
874 by Teddy Hogeborn
PEP8 compliance: mandos
3568
28 by Teddy Hogeborn
* server.conf: New file.
3569
    # Find out what port we got
707 by Teddy Hogeborn
mandos: New "--no-zeroconf" option. Also make "--socket=0" work.
3570
    if zeroconf:
3571
        service.port = tcp_server.socket.getsockname()[1]
314 by Teddy Hogeborn
Support not using IPv6 in server:
3572
    if use_ipv6:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
3573
        logger.info("Now listening on address %r, port %d,"
568 by Teddy Hogeborn
* mandos-monitor: Use new string format method.
3574
                    " flowinfo %d, scope_id %d",
3575
                    *tcp_server.socket.getsockname())
314 by Teddy Hogeborn
Support not using IPv6 in server:
3576
    else:                       # IPv4
568 by Teddy Hogeborn
* mandos-monitor: Use new string format method.
3577
        logger.info("Now listening on address %r, port %d",
3578
                    *tcp_server.socket.getsockname())
874 by Teddy Hogeborn
PEP8 compliance: mandos
3579
3580
    # service.interface = tcp_server.socket.getsockname()[3]
3581
28 by Teddy Hogeborn
* server.conf: New file.
3582
    try:
707 by Teddy Hogeborn
mandos: New "--no-zeroconf" option. Also make "--socket=0" work.
3583
        if zeroconf:
3584
            # From the Avahi example code
3585
            try:
3586
                service.activate()
3587
            except dbus.exceptions.DBusException as error:
3588
                logger.critical("D-Bus Exception", exc_info=error)
3589
                cleanup()
3590
                sys.exit(1)
3591
            # End of Avahi example code
874 by Teddy Hogeborn
PEP8 compliance: mandos
3592
830 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
3593
        GLib.io_add_watch(tcp_server.fileno(), GLib.IO_IN,
3594
                          lambda *args, **kwargs:
3595
                          (tcp_server.handle_request
3596
                           (*args[2:], **kwargs) or True))
874 by Teddy Hogeborn
PEP8 compliance: mandos
3597
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
3598
        logger.debug("Starting main loop")
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
3599
        main_loop.run()
482 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
3600
    except AvahiError as error:
565 by Teddy Hogeborn
* mandos (AvahiService.rename, Client.start_checker,
3601
        logger.critical("Avahi Error", exc_info=error)
401 by Teddy Hogeborn
* README (FAQ): Fix typo.
3602
        cleanup()
28 by Teddy Hogeborn
* server.conf: New file.
3603
        sys.exit(1)
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
3604
    except KeyboardInterrupt:
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
3605
        if debug:
463.1.5 by teddy at bsnet
* mandos: Use unicode string literals.
3606
            print("", file=sys.stderr)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
3607
        logger.debug("Server received KeyboardInterrupt")
3608
    logger.debug("Server exiting")
401 by Teddy Hogeborn
* README (FAQ): Fix typo.
3609
    # Must run before the D-Bus bus name gets deregistered
3610
    cleanup()
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
3611
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3612
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
3613
if __name__ == '__main__':
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
3614
    main()