/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk
723.1.1 by Teddy Hogeborn
Require Python 2.7.
1
#!/usr/bin/python2.7
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
2
# -*- mode: python; coding: utf-8 -*-
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
3
# 
4
# Mandos server - give out binary blobs to connecting clients.
5
# 
6
# This program is partly derived from an example program for an Avahi
7
# service publisher, downloaded from
8
# <http://avahi.org/wiki/PythonPublishExample>.  This includes the
336 by Teddy Hogeborn
Code cleanup.
9
# methods "add", "remove", "server_state_changed",
10
# "entry_group_state_changed", "cleanup", and "activate" in the
11
# "AvahiService" class, and some lines in "main".
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
12
# 
28 by Teddy Hogeborn
* server.conf: New file.
13
# Everything else is
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
14
# Copyright © 2008-2015 Teddy Hogeborn
15
# Copyright © 2008-2015 Björn Påhlsson
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
16
# 
17
# This program is free software: you can redistribute it and/or modify
18
# it under the terms of the GNU General Public License as published by
19
# the Free Software Foundation, either version 3 of the License, or
20
# (at your option) any later version.
21
#
22
#     This program is distributed in the hope that it will be useful,
23
#     but WITHOUT ANY WARRANTY; without even the implied warranty of
24
#     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
25
#     GNU General Public License for more details.
26
# 
27
# You should have received a copy of the GNU General Public License
109 by Teddy Hogeborn
* .bzrignore: New.
28
# along with this program.  If not, see
29
# <http://www.gnu.org/licenses/>.
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
30
# 
505.1.2 by Teddy Hogeborn
Change "fukt.bsnet.se" to "recompile.se" throughout.
31
# Contact the authors at <mandos@recompile.se>.
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
32
# 
3 by Björn Påhlsson
Python based server
33
463.1.5 by teddy at bsnet
* mandos: Use unicode string literals.
34
from __future__ import (division, absolute_import, print_function,
35
                        unicode_literals)
10 by Teddy Hogeborn
* server.py: Bug fix: Do "from __future__ import division".
36
579 by Teddy Hogeborn
* mandos: Use all new builtins.
37
from future_builtins import *
38
749 by Teddy Hogeborn
mandos: Some more minor changes to prepare for Python 3.
39
try:
40
    import SocketServer as socketserver
41
except ImportError:
42
    import socketserver
3 by Björn Påhlsson
Python based server
43
import socket
474 by teddy at bsnet
* mandos: Use the new argparse library instead of optparse.
44
import argparse
3 by Björn Påhlsson
Python based server
45
import datetime
46
import errno
47
import gnutls.crypto
48
import gnutls.connection
49
import gnutls.errors
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
50
import gnutls.library.functions
51
import gnutls.library.constants
52
import gnutls.library.types
749 by Teddy Hogeborn
mandos: Some more minor changes to prepare for Python 3.
53
try:
54
    import ConfigParser as configparser
55
except ImportError:
56
    import configparser
4 by Teddy Hogeborn
* server.py (Client.created, Client.next_check): New.
57
import sys
9 by Teddy Hogeborn
* client.cpp (main): Get t_old early since it is used on error exits.
58
import re
59
import os
60
import signal
10 by Teddy Hogeborn
* server.py: Bug fix: Do "from __future__ import division".
61
import subprocess
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
62
import atexit
63
import stat
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
64
import logging
65
import logging.handlers
163 by Teddy Hogeborn
* Makefile (PIDDIR, USER, GROUP): Removed.
66
import pwd
411 by Teddy Hogeborn
More consistent terminology: Clients are no longer "invalid" - they
67
import contextlib
333 by Teddy Hogeborn
Minor code cleanup; one minor bug fix.
68
import struct
69
import fcntl
337 by Teddy Hogeborn
Code cleanup. Move some global stuff into main.
70
import functools
749 by Teddy Hogeborn
mandos: Some more minor changes to prepare for Python 3.
71
try:
72
    import cPickle as pickle
73
except ImportError:
74
    import pickle
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
75
import multiprocessing
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
76
import types
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
77
import binascii
78
import tempfile
560.1.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
79
import itertools
609 by Teddy Hogeborn
* clients.conf: Convert all time intervals to new RFC 3339 syntax.
80
import collections
5 by Teddy Hogeborn
* server.py (server_metaclass): New.
81
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
82
import dbus
237.1.1 by Teddy Hogeborn
First steps of a D-Bus interface to the server.
83
import dbus.service
749 by Teddy Hogeborn
mandos: Some more minor changes to prepare for Python 3.
84
try:
85
    import gobject
86
except ImportError:
87
    from gi.repository import GObject as gobject
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
88
import avahi
89
from dbus.mainloop.glib import DBusGMainLoop
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
90
import ctypes
215 by Teddy Hogeborn
* mandos: Remove unused "select" module. Import "ctypes.util".
91
import ctypes.util
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
92
import xml.dom.minidom
93
import inspect
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
94
331 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
95
try:
96
    SO_BINDTODEVICE = socket.SO_BINDTODEVICE
97
except AttributeError:
98
    try:
99
        from IN import SO_BINDTODEVICE
100
    except ImportError:
338 by Teddy Hogeborn
* mandos: Minor doc string fixes.
101
        SO_BINDTODEVICE = None
331 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
102
730 by Teddy Hogeborn
mandos: Replace unicode() with str().
103
if sys.version_info.major == 2:
104
    str = unicode
105
237.4.55 by Teddy Hogeborn
* Makefile (version): Changed to "1.6.9".
106
version = "1.6.9"
518.2.2 by Teddy Hogeborn
Directory with persistent state can now be changed with the "statedir"
107
stored_state_file = "clients.pickle"
13 by Björn Påhlsson
Added following support:
108
505.1.20 by Teddy Hogeborn
* Makefile (run-server): Remove obsolete warning.
109
logger = logging.getLogger()
655 by Teddy Hogeborn
Allow self-tests to run without needing /dev/log.
110
syslogger = None
13 by Björn Påhlsson
Added following support:
111
518.1.5 by Björn Påhlsson
First run of python-lint. Fixed some *obviously* bad code and turned
112
try:
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
113
    if_nametoindex = ctypes.cdll.LoadLibrary(
114
        ctypes.util.find_library("c")).if_nametoindex
518.1.5 by Björn Påhlsson
First run of python-lint. Fixed some *obviously* bad code and turned
115
except (OSError, AttributeError):
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
116
    
518.1.5 by Björn Påhlsson
First run of python-lint. Fixed some *obviously* bad code and turned
117
    def if_nametoindex(interface):
118
        "Get an interface index the hard way, i.e. using fcntl()"
119
        SIOCGIFINDEX = 0x8933  # From /usr/include/linux/sockios.h
120
        with contextlib.closing(socket.socket()) as s:
121
            ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
729 by Teddy Hogeborn
mandos: Stop using str() and remove unnecessary unicode() calls.
122
                                struct.pack(b"16s16x", interface))
123
        interface_index = struct.unpack("I", ifreq[16:20])[0]
518.1.5 by Björn Påhlsson
First run of python-lint. Fixed some *obviously* bad code and turned
124
        return interface_index
125
126
530 by teddy at bsnet
* mandos (initlogger): Take new "debug" argument; all callers changed.
127
def initlogger(debug, level=logging.WARNING):
518.1.4 by Björn Påhlsson
restructured logger
128
    """init logger and add loglevel"""
129
    
698 by Teddy Hogeborn
Fix mandos server "--servicename" option, broken since 1.6.4.
130
    global syslogger
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
131
    syslogger = (logging.handlers.SysLogHandler(
132
        facility = logging.handlers.SysLogHandler.LOG_DAEMON,
133
        address = "/dev/log"))
518.1.4 by Björn Påhlsson
restructured logger
134
    syslogger.setFormatter(logging.Formatter
135
                           ('Mandos [%(process)d]: %(levelname)s:'
136
                            ' %(message)s'))
137
    logger.addHandler(syslogger)
138
    
530 by teddy at bsnet
* mandos (initlogger): Take new "debug" argument; all callers changed.
139
    if debug:
140
        console = logging.StreamHandler()
141
        console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
142
                                               ' [%(process)d]:'
143
                                               ' %(levelname)s:'
144
                                               ' %(message)s'))
145
        logger.addHandler(console)
518.1.4 by Björn Påhlsson
restructured logger
146
    logger.setLevel(level)
28 by Teddy Hogeborn
* server.conf: New file.
147
505.1.20 by Teddy Hogeborn
* Makefile (run-server): Remove obsolete warning.
148
518.1.9 by Björn Påhlsson
renamed variables
149
class PGPError(Exception):
150
    """Exception if encryption/decryption fails"""
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
151
    pass
152
153
518.1.9 by Björn Påhlsson
renamed variables
154
class PGPEngine(object):
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
155
    """A simple class for OpenPGP symmetric encryption & decryption"""
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
156
    
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
157
    def __init__(self):
158
        self.tempdir = tempfile.mkdtemp(prefix="mandos-")
615 by Teddy Hogeborn
* mandos: Don't use the GnuPGInterface module.
159
        self.gnupgargs = ['--batch',
160
                          '--home', self.tempdir,
161
                          '--force-mdc',
162
                          '--quiet',
163
                          '--no-use-agent']
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
164
    
165
    def __enter__(self):
166
        return self
167
    
587 by Teddy Hogeborn
* Makefile (DOCBOOKTOMAN): Only run man --warnings if both "man" and
168
    def __exit__(self, exc_type, exc_value, traceback):
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
169
        self._cleanup()
170
        return False
171
    
172
    def __del__(self):
173
        self._cleanup()
174
    
175
    def _cleanup(self):
176
        if self.tempdir is not None:
177
            # Delete contents of tempdir
178
            for root, dirs, files in os.walk(self.tempdir,
179
                                             topdown = False):
180
                for filename in files:
181
                    os.remove(os.path.join(root, filename))
182
                for dirname in dirs:
183
                    os.rmdir(os.path.join(root, dirname))
184
            # Remove tempdir
185
            os.rmdir(self.tempdir)
186
            self.tempdir = None
187
    
188
    def password_encode(self, password):
189
        # Passphrase can not be empty and can not contain newlines or
190
        # NUL bytes.  So we prefix it and hex encode it.
630 by Teddy Hogeborn
* mandos (PGPEngine.password_encode): Bug fix: GnuPG can't handle
191
        encoded = b"mandos" + binascii.hexlify(password)
192
        if len(encoded) > 2048:
193
            # GnuPG can't handle long passwords, so encode differently
194
            encoded = (b"mandos" + password.replace(b"\\", b"\\\\")
195
                       .replace(b"\n", b"\\n")
196
                       .replace(b"\0", b"\\x00"))
197
        return encoded
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
198
    
199
    def encrypt(self, data, password):
615 by Teddy Hogeborn
* mandos: Don't use the GnuPGInterface module.
200
        passphrase = self.password_encode(password)
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
201
        with tempfile.NamedTemporaryFile(
202
                dir=self.tempdir) as passfile:
615 by Teddy Hogeborn
* mandos: Don't use the GnuPGInterface module.
203
            passfile.write(passphrase)
204
            passfile.flush()
205
            proc = subprocess.Popen(['gpg', '--symmetric',
206
                                     '--passphrase-file',
207
                                     passfile.name]
208
                                    + self.gnupgargs,
209
                                    stdin = subprocess.PIPE,
210
                                    stdout = subprocess.PIPE,
211
                                    stderr = subprocess.PIPE)
212
            ciphertext, err = proc.communicate(input = data)
213
        if proc.returncode != 0:
214
            raise PGPError(err)
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
215
        return ciphertext
216
    
217
    def decrypt(self, data, password):
615 by Teddy Hogeborn
* mandos: Don't use the GnuPGInterface module.
218
        passphrase = self.password_encode(password)
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
219
        with tempfile.NamedTemporaryFile(
220
                dir = self.tempdir) as passfile:
615 by Teddy Hogeborn
* mandos: Don't use the GnuPGInterface module.
221
            passfile.write(passphrase)
222
            passfile.flush()
223
            proc = subprocess.Popen(['gpg', '--decrypt',
224
                                     '--passphrase-file',
225
                                     passfile.name]
226
                                    + self.gnupgargs,
227
                                    stdin = subprocess.PIPE,
228
                                    stdout = subprocess.PIPE,
229
                                    stderr = subprocess.PIPE)
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
230
            decrypted_plaintext, err = proc.communicate(input = data)
615 by Teddy Hogeborn
* mandos: Don't use the GnuPGInterface module.
231
        if proc.returncode != 0:
232
            raise PGPError(err)
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
233
        return decrypted_plaintext
234
235
28 by Teddy Hogeborn
* server.conf: New file.
236
class AvahiError(Exception):
242 by Teddy Hogeborn
* mandos (AvahiError): Converted to use unicode. All users changed.
237
    def __init__(self, value, *args, **kwargs):
28 by Teddy Hogeborn
* server.conf: New file.
238
        self.value = value
729 by Teddy Hogeborn
mandos: Stop using str() and remove unnecessary unicode() calls.
239
        return super(AvahiError, self).__init__(value, *args,
240
                                                **kwargs)
28 by Teddy Hogeborn
* server.conf: New file.
241
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
242
28 by Teddy Hogeborn
* server.conf: New file.
243
class AvahiServiceError(AvahiError):
244
    pass
245
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
246
28 by Teddy Hogeborn
* server.conf: New file.
247
class AvahiGroupError(AvahiError):
248
    pass
249
250
251
class AvahiService(object):
45 by Teddy Hogeborn
* server.py: Cosmetic changes.
252
    """An Avahi (Zeroconf) service.
331 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
253
    
45 by Teddy Hogeborn
* server.py: Cosmetic changes.
254
    Attributes:
28 by Teddy Hogeborn
* server.conf: New file.
255
    interface: integer; avahi.IF_UNSPEC or an interface index.
256
               Used to optionally bind to the specified interface.
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
257
    name: string; Example: 'Mandos'
258
    type: string; Example: '_mandos._tcp'.
614 by Teddy Hogeborn
* mandos: Comment changes.
259
     See <https://www.iana.org/assignments/service-names-port-numbers>
45 by Teddy Hogeborn
* server.py: Cosmetic changes.
260
    port: integer; what port to announce
261
    TXT: list of strings; TXT record for the service
262
    domain: string; Domain to publish on, default to .local if empty.
263
    host: string; Host to publish records for, default is localhost
264
    max_renames: integer; maximum number of renames
265
    rename_count: integer; counter so we only rename after collisions
266
                  a sensible number of times
336 by Teddy Hogeborn
Code cleanup.
267
    group: D-Bus Entry Group
268
    server: D-Bus Server
338 by Teddy Hogeborn
* mandos: Minor doc string fixes.
269
    bus: dbus.SystemBus()
28 by Teddy Hogeborn
* server.conf: New file.
270
    """
573 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
271
    
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
272
    def __init__(self,
273
                 interface = avahi.IF_UNSPEC,
274
                 name = None,
275
                 servicetype = None,
276
                 port = None,
277
                 TXT = None,
278
                 domain = "",
279
                 host = "",
280
                 max_renames = 32768,
281
                 protocol = avahi.PROTO_UNSPEC,
282
                 bus = None):
28 by Teddy Hogeborn
* server.conf: New file.
283
        self.interface = interface
284
        self.name = name
215 by Teddy Hogeborn
* mandos: Remove unused "select" module. Import "ctypes.util".
285
        self.type = servicetype
28 by Teddy Hogeborn
* server.conf: New file.
286
        self.port = port
237.1.2 by Teddy Hogeborn
Further steps towards a D-Bus server interface, plus minor syntax
287
        self.TXT = TXT if TXT is not None else []
28 by Teddy Hogeborn
* server.conf: New file.
288
        self.domain = domain
289
        self.host = host
290
        self.rename_count = 0
76 by Teddy Hogeborn
* plugins.d/password-request.c (init_gnutls_global): Renamed
291
        self.max_renames = max_renames
314 by Teddy Hogeborn
Support not using IPv6 in server:
292
        self.protocol = protocol
336 by Teddy Hogeborn
Code cleanup.
293
        self.group = None       # our entry group
294
        self.server = None
337 by Teddy Hogeborn
Code cleanup. Move some global stuff into main.
295
        self.bus = bus
482 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
296
        self.entry_group_state_changed_match = None
573 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
297
    
738 by Teddy Hogeborn
Handle local Zeroconf service name collisions.
298
    def rename(self, remove=True):
28 by Teddy Hogeborn
* server.conf: New file.
299
        """Derived from the Avahi example code"""
300
        if self.rename_count >= self.max_renames:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
301
            logger.critical("No suitable Zeroconf service name found"
302
                            " after %i retries, exiting.",
215 by Teddy Hogeborn
* mandos: Remove unused "select" module. Import "ctypes.util".
303
                            self.rename_count)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
304
            raise AvahiServiceError("Too many renames")
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
305
        self.name = str(
306
            self.server.GetAlternativeServiceName(self.name))
738 by Teddy Hogeborn
Handle local Zeroconf service name collisions.
307
        self.rename_count += 1
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
308
        logger.info("Changing Zeroconf service name to %r ...",
24.1.155 by Björn Påhlsson
mandos server: Added debuglevel that adjust at what level information
309
                    self.name)
738 by Teddy Hogeborn
Handle local Zeroconf service name collisions.
310
        if remove:
311
            self.remove()
24.1.160 by Björn Påhlsson
fixed bug with local name collisions after a non-local name collision
312
        try:
313
            self.add()
482 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
314
        except dbus.exceptions.DBusException as error:
738 by Teddy Hogeborn
Handle local Zeroconf service name collisions.
315
            if (error.get_dbus_name()
316
                == "org.freedesktop.Avahi.CollisionError"):
317
                logger.info("Local Zeroconf service name collision.")
318
                return self.rename(remove=False)
319
            else:
320
                logger.critical("D-Bus Exception", exc_info=error)
321
                self.cleanup()
322
                os._exit(1)
573 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
323
    
28 by Teddy Hogeborn
* server.conf: New file.
324
    def remove(self):
325
        """Derived from the Avahi example code"""
482 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
326
        if self.entry_group_state_changed_match is not None:
327
            self.entry_group_state_changed_match.remove()
328
            self.entry_group_state_changed_match = None
483 by Teddy Hogeborn
* mandos: Never call .Reset() on a defunct Avahi entry group.
329
        if self.group is not None:
330
            self.group.Reset()
573 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
331
    
28 by Teddy Hogeborn
* server.conf: New file.
332
    def add(self):
333
        """Derived from the Avahi example code"""
482 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
334
        self.remove()
483 by Teddy Hogeborn
* mandos: Never call .Reset() on a defunct Avahi entry group.
335
        if self.group is None:
336
            self.group = dbus.Interface(
337
                self.bus.get_object(avahi.DBUS_NAME,
338
                                    self.server.EntryGroupNew()),
339
                avahi.DBUS_INTERFACE_ENTRY_GROUP)
482 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
340
        self.entry_group_state_changed_match = (
341
            self.group.connect_to_signal(
505.1.20 by Teddy Hogeborn
* Makefile (run-server): Remove obsolete warning.
342
                'StateChanged', self.entry_group_state_changed))
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
343
        logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
336 by Teddy Hogeborn
Code cleanup.
344
                     self.name, self.type)
345
        self.group.AddService(
346
            self.interface,
347
            self.protocol,
348
            dbus.UInt32(0),     # flags
349
            self.name, self.type,
350
            self.domain, self.host,
351
            dbus.UInt16(self.port),
352
            avahi.string_array_to_txt_array(self.TXT))
353
        self.group.Commit()
573 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
354
    
336 by Teddy Hogeborn
Code cleanup.
355
    def entry_group_state_changed(self, state, error):
356
        """Derived from the Avahi example code"""
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
357
        logger.debug("Avahi entry group state change: %i", state)
336 by Teddy Hogeborn
Code cleanup.
358
        
359
        if state == avahi.ENTRY_GROUP_ESTABLISHED:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
360
            logger.debug("Zeroconf service established.")
336 by Teddy Hogeborn
Code cleanup.
361
        elif state == avahi.ENTRY_GROUP_COLLISION:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
362
            logger.info("Zeroconf service name collision.")
336 by Teddy Hogeborn
Code cleanup.
363
            self.rename()
364
        elif state == avahi.ENTRY_GROUP_FAILURE:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
365
            logger.critical("Avahi: Error in group state changed %s",
730 by Teddy Hogeborn
mandos: Replace unicode() with str().
366
                            str(error))
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
367
            raise AvahiGroupError("State changed: {!s}".format(error))
573 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
368
    
336 by Teddy Hogeborn
Code cleanup.
369
    def cleanup(self):
370
        """Derived from the Avahi example code"""
483 by Teddy Hogeborn
* mandos: Never call .Reset() on a defunct Avahi entry group.
371
        if self.group is not None:
372
            try:
373
                self.group.Free()
374
            except (dbus.exceptions.UnknownMethodException,
518.1.5 by Björn Påhlsson
First run of python-lint. Fixed some *obviously* bad code and turned
375
                    dbus.exceptions.DBusException):
483 by Teddy Hogeborn
* mandos: Never call .Reset() on a defunct Avahi entry group.
376
                pass
377
            self.group = None
482 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
378
        self.remove()
573 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
379
    
482 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
380
    def server_state_changed(self, state, error=None):
336 by Teddy Hogeborn
Code cleanup.
381
        """Derived from the Avahi example code"""
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
382
        logger.debug("Avahi server state change: %i", state)
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
383
        bad_states = {
384
            avahi.SERVER_INVALID: "Zeroconf server invalid",
385
            avahi.SERVER_REGISTERING: None,
386
            avahi.SERVER_COLLISION: "Zeroconf server name collision",
387
            avahi.SERVER_FAILURE: "Zeroconf server failure",
388
        }
482 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
389
        if state in bad_states:
483 by Teddy Hogeborn
* mandos: Never call .Reset() on a defunct Avahi entry group.
390
            if bad_states[state] is not None:
391
                if error is None:
392
                    logger.error(bad_states[state])
393
                else:
394
                    logger.error(bad_states[state] + ": %r", error)
395
            self.cleanup()
336 by Teddy Hogeborn
Code cleanup.
396
        elif state == avahi.SERVER_RUNNING:
397
            self.add()
482 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
398
        else:
483 by Teddy Hogeborn
* mandos: Never call .Reset() on a defunct Avahi entry group.
399
            if error is None:
400
                logger.debug("Unknown state: %r", state)
401
            else:
402
                logger.debug("Unknown state: %r: %r", state, error)
573 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
403
    
336 by Teddy Hogeborn
Code cleanup.
404
    def activate(self):
405
        """Derived from the Avahi example code"""
406
        if self.server is None:
407
            self.server = dbus.Interface(
337 by Teddy Hogeborn
Code cleanup. Move some global stuff into main.
408
                self.bus.get_object(avahi.DBUS_NAME,
482 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
409
                                    avahi.DBUS_PATH_SERVER,
410
                                    follow_name_owner_changes=True),
336 by Teddy Hogeborn
Code cleanup.
411
                avahi.DBUS_INTERFACE_SERVER)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
412
        self.server.connect_to_signal("StateChanged",
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
413
                                      self.server_state_changed)
336 by Teddy Hogeborn
Code cleanup.
414
        self.server_state_changed(self.server.GetState())
238 by Teddy Hogeborn
First version of a somewhat complete D-Bus server interface. Also
415
582 by Teddy Hogeborn
* mandos (IPv6_TCPServer.server_bind): Bug fix: handle non-existing
416
505.1.20 by Teddy Hogeborn
* Makefile (run-server): Remove obsolete warning.
417
class AvahiServiceToSyslog(AvahiService):
738 by Teddy Hogeborn
Handle local Zeroconf service name collisions.
418
    def rename(self, *args, **kwargs):
505.1.20 by Teddy Hogeborn
* Makefile (run-server): Remove obsolete warning.
419
        """Add the new name to the syslog messages"""
738 by Teddy Hogeborn
Handle local Zeroconf service name collisions.
420
        ret = AvahiService.rename(self, *args, **kwargs)
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
421
        syslogger.setFormatter(logging.Formatter(
422
            'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
423
            .format(self.name)))
505.1.20 by Teddy Hogeborn
* Makefile (run-server): Remove obsolete warning.
424
        return ret
238 by Teddy Hogeborn
First version of a somewhat complete D-Bus server interface. Also
425
749.1.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
426
def subprocess_call_pipe(connection, # : multiprocessing.Connection
427
                         *args, **kwargs):
428
    """This function is meant to be called by multiprocessing.Process
429
    
430
    This function runs a synchronous subprocess.call(), and writes the
431
    resulting return code on the provided multiprocessing.Connection.
432
    """
433
    connection.send(subprocess.call(*args, **kwargs))
434
    connection.close()
582 by Teddy Hogeborn
* mandos (IPv6_TCPServer.server_bind): Bug fix: handle non-existing
435
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
436
class Client(object):
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
437
    """A representation of a client host served by this server.
331 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
438
    
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
439
    Attributes:
518.2.4 by Teddy Hogeborn
* mandos (_timedelta_to_milliseconds): Renamed to
440
    approved:   bool(); 'None' if not yet approved/disapproved
438 by Teddy Hogeborn
* mandos (Client.runtime_expansions): New attribute containing the
441
    approval_delay: datetime.timedelta(); Time to wait for approval
442
    approval_duration: datetime.timedelta(); Duration of one approval
238 by Teddy Hogeborn
First version of a somewhat complete D-Bus server interface. Also
443
    checker:    subprocess.Popen(); a running checker process used
444
                                    to see if the client lives.
445
                                    'None' if no process is running.
442 by Teddy Hogeborn
* DBUS-API: Document new "LastApprovalRequest" client property.
446
    checker_callback_tag: a gobject event source tag, or None
438 by Teddy Hogeborn
* mandos (Client.runtime_expansions): New attribute containing the
447
    checker_command: string; External command which is run to check
448
                     if client lives.  %() expansions are done at
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
449
                     runtime with vars(self) as dict, so that for
450
                     instance %(name)s can be used in the command.
438 by Teddy Hogeborn
* mandos (Client.runtime_expansions): New attribute containing the
451
    checker_initiator_tag: a gobject event source tag, or None
452
    created:    datetime.datetime(); (UTC) object creation
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
453
    client_structure: Object describing what attributes a client has
454
                      and is used for storing the client at exit
315 by Teddy Hogeborn
* mandos (Client.current_checker_command): New attribute.
455
    current_checker_command: string; current running checker_command
442 by Teddy Hogeborn
* DBUS-API: Document new "LastApprovalRequest" client property.
456
    disable_initiator_tag: a gobject event source tag, or None
438 by Teddy Hogeborn
* mandos (Client.runtime_expansions): New attribute containing the
457
    enabled:    bool()
458
    fingerprint: string (40 or 32 hexadecimal digits); used to
459
                 uniquely identify the client
460
    host:       string; available for use by the checker command
461
    interval:   datetime.timedelta(); How often to start a new checker
442 by Teddy Hogeborn
* DBUS-API: Document new "LastApprovalRequest" client property.
462
    last_approval_request: datetime.datetime(); (UTC) or None
438 by Teddy Hogeborn
* mandos (Client.runtime_expansions): New attribute containing the
463
    last_checked_ok: datetime.datetime(); (UTC) or None
521 by teddy at bsnet
* debian/control (mandos/Depends): Added "python-crypto".
464
    last_checker_status: integer between 0 and 255 reflecting exit
518.1.7 by Teddy Hogeborn
* mandos: Break long lines and fix some more white space.
465
                         status of last checker. -1 reflects crashed
556 by Teddy Hogeborn
* DBUS-API (se.recompile.Mandos.Client.LastCheckerStatus): New
466
                         checker, -2 means no checker completed yet.
749.1.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
467
    last_checker_signal: The signal which killed the last checker, if
468
                         last_checker_status is -1
518.2.3 by Teddy Hogeborn
Make "enabled" a client config option.
469
    last_enabled: datetime.datetime(); (UTC) or None
438 by Teddy Hogeborn
* mandos (Client.runtime_expansions): New attribute containing the
470
    name:       string; from the config file, used in log messages and
471
                        D-Bus identifiers
472
    secret:     bytestring; sent verbatim (over TLS) to client
473
    timeout:    datetime.timedelta(); How long from last_checked_ok
474
                                      until this client is disabled
552 by teddy at recompile
* mandos: Consistent terminology; use the term "secret" for the
475
    extended_timeout:   extra long timeout when secret has been sent
438 by Teddy Hogeborn
* mandos (Client.runtime_expansions): New attribute containing the
476
    runtime_expansions: Allowed attributes for runtime expansion.
497 by Teddy Hogeborn
* DBUS-API: Document new "Expires" and "ExtendedTimeout" properties.
477
    expires:    datetime.datetime(); time (UTC) when a client will be
24.1.179 by Björn Påhlsson
New feature:
478
                disabled, or None
617 by Teddy Hogeborn
* mandos: Bug fix: Don't print output from checkers when running in
479
    server_settings: The server_settings dict from main()
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
480
    """
333 by Teddy Hogeborn
Minor code cleanup; one minor bug fix.
481
    
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
482
    runtime_expansions = ("approval_delay", "approval_duration",
584 by Teddy Hogeborn
* mandos (Client.runtime_expansions): Add "expires" and (bug fix)
483
                          "created", "enabled", "expires",
484
                          "fingerprint", "host", "interval",
485
                          "last_approval_request", "last_checked_ok",
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
486
                          "last_enabled", "name", "timeout")
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
487
    client_defaults = {
488
        "timeout": "PT5M",
489
        "extended_timeout": "PT15M",
490
        "interval": "PT2M",
491
        "checker": "fping -q -- %%(host)s",
492
        "host": "",
493
        "approval_delay": "PT0S",
494
        "approval_duration": "PT1S",
495
        "approved_by_default": "True",
496
        "enabled": "True",
497
    }
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
498
    
518.1.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
499
    @staticmethod
500
    def config_parser(config):
542 by Björn Påhlsson
fixed bug with bad stored config state for expires and last_checked_ok.
501
        """Construct a new dict of client settings of this form:
518.1.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
502
        { client_name: {setting_name: value, ...}, ...}
542 by Björn Påhlsson
fixed bug with bad stored config state for expires and last_checked_ok.
503
        with exceptions for any special settings as defined above.
504
        NOTE: Must be a pure function. Must return the same result
505
        value given the same arguments.
506
        """
518.1.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
507
        settings = {}
508
        for client_name in config.sections():
509
            section = dict(config.items(client_name))
510
            client = settings[client_name] = {}
511
            
518.1.15 by Björn Påhlsson
more refactoring in regards to how clients get created
512
            client["host"] = section["host"]
518.1.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
513
            # Reformat values from string types to Python types
514
            client["approved_by_default"] = config.getboolean(
515
                client_name, "approved_by_default")
543 by Teddy Hogeborn
* mandos: Break some long lines.
516
            client["enabled"] = config.getboolean(client_name,
517
                                                  "enabled")
518.1.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
518
            
739 by Teddy Hogeborn
mandos (Client.config_parser): Move comment to correct place.
519
            # Uppercase and remove spaces from fingerprint for later
520
            # comparison purposes with return value from the
521
            # fingerprint() function
518.1.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
522
            client["fingerprint"] = (section["fingerprint"].upper()
523
                                     .replace(" ", ""))
524
            if "secret" in section:
525
                client["secret"] = section["secret"].decode("base64")
526
            elif "secfile" in section:
527
                with open(os.path.expanduser(os.path.expandvars
528
                                             (section["secfile"])),
529
                          "rb") as secfile:
530
                    client["secret"] = secfile.read()
531
            else:
723.1.5 by Teddy Hogeborn
Use the new auto-numbered "{}" syntax for the .format() string method.
532
                raise TypeError("No secret or secfile for section {}"
568 by Teddy Hogeborn
* mandos-monitor: Use new string format method.
533
                                .format(section))
518.1.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
534
            client["timeout"] = string_to_delta(section["timeout"])
535
            client["extended_timeout"] = string_to_delta(
536
                section["extended_timeout"])
537
            client["interval"] = string_to_delta(section["interval"])
538
            client["approval_delay"] = string_to_delta(
539
                section["approval_delay"])
540
            client["approval_duration"] = string_to_delta(
541
                section["approval_duration"])
518.1.15 by Björn Påhlsson
more refactoring in regards to how clients get created
542
            client["checker_command"] = section["checker"]
543
            client["last_approval_request"] = None
544
            client["last_checked_ok"] = None
556 by Teddy Hogeborn
* DBUS-API (se.recompile.Mandos.Client.LastCheckerStatus): New
545
            client["last_checker_status"] = -2
542 by Björn Påhlsson
fixed bug with bad stored config state for expires and last_checked_ok.
546
        
518.1.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
547
        return settings
573 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
548
    
617 by Teddy Hogeborn
* mandos: Bug fix: Don't print output from checkers when running in
549
    def __init__(self, settings, name = None, server_settings=None):
243 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
550
        self.name = name
617 by Teddy Hogeborn
* mandos: Bug fix: Don't print output from checkers when running in
551
        if server_settings is None:
552
            server_settings = {}
553
        self.server_settings = server_settings
518.1.15 by Björn Påhlsson
more refactoring in regards to how clients get created
554
        # adding all client settings
723.1.4 by Teddy Hogeborn
Use the .items() method instead of .iteritems().
555
        for setting, value in settings.items():
518.1.15 by Björn Påhlsson
more refactoring in regards to how clients get created
556
            setattr(self, setting, value)
557
        
542 by Björn Påhlsson
fixed bug with bad stored config state for expires and last_checked_ok.
558
        if self.enabled:
559
            if not hasattr(self, "last_enabled"):
560
                self.last_enabled = datetime.datetime.utcnow()
561
            if not hasattr(self, "expires"):
562
                self.expires = (datetime.datetime.utcnow()
563
                                + self.timeout)
564
        else:
565
            self.last_enabled = None
566
            self.expires = None
573 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
567
        
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
568
        logger.debug("Creating client %r", self.name)
569
        logger.debug("  Fingerprint: %s", self.fingerprint)
543 by Teddy Hogeborn
* mandos: Break some long lines.
570
        self.created = settings.get("created",
571
                                    datetime.datetime.utcnow())
573 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
572
        
518.1.15 by Björn Påhlsson
more refactoring in regards to how clients get created
573
        # attributes specific for this server instance
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
574
        self.checker = None
575
        self.checker_initiator_tag = None
239 by Teddy Hogeborn
* mandos (_datetime_to_dbus_struct): Renamed to "_datetime_to_dbus";
576
        self.disable_initiator_tag = None
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
577
        self.checker_callback_tag = None
315 by Teddy Hogeborn
* mandos (Client.current_checker_command): New attribute.
578
        self.current_checker_command = None
518.2.4 by Teddy Hogeborn
* mandos (_timedelta_to_milliseconds): Renamed to
579
        self.approved = None
24.1.150 by Björn Påhlsson
* mandos: Added ClientDBus.approve_pending property. Exposed
580
        self.approvals_pending = 0
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
581
        self.changedstate = multiprocessing_manager.Condition(
582
            multiprocessing_manager.Lock())
583
        self.client_structure = [attr
584
                                 for attr in self.__dict__.iterkeys()
521 by teddy at bsnet
* debian/control (mandos/Depends): Added "python-crypto".
585
                                 if not attr.startswith("_")]
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
586
        self.client_structure.append("client_structure")
518.1.6 by Teddy Hogeborn
* mandos: Fix whitespace.
587
        
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
588
        for name, t in inspect.getmembers(
589
                type(self), lambda obj: isinstance(obj, property)):
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
590
            if not name.startswith("_"):
591
                self.client_structure.append(name)
592
    
520 by Björn Påhlsson
merge persistent state
593
    # Send notice to process children that client state has changed
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
594
    def send_changedstate(self):
520 by Björn Påhlsson
merge persistent state
595
        with self.changedstate:
596
            self.changedstate.notify_all()
505.1.3 by Teddy Hogeborn
* mandos: Break long lines.
597
    
239 by Teddy Hogeborn
* mandos (_datetime_to_dbus_struct): Renamed to "_datetime_to_dbus";
598
    def enable(self):
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
599
        """Start this client's checker and timeout hooks"""
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
600
        if getattr(self, "enabled", False):
341 by Teddy Hogeborn
Code cleanup and one bug fix.
601
            # Already enabled
602
            return
24.1.179 by Björn Påhlsson
New feature:
603
        self.expires = datetime.datetime.utcnow() + self.timeout
239 by Teddy Hogeborn
* mandos (_datetime_to_dbus_struct): Renamed to "_datetime_to_dbus";
604
        self.enabled = True
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
605
        self.last_enabled = datetime.datetime.utcnow()
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
606
        self.init_checker()
581 by Teddy Hogeborn
* mandos (Client.enable, Client.disable, ClientDBus.approve): Call
607
        self.send_changedstate()
237.1.1 by Teddy Hogeborn
First steps of a D-Bus interface to the server.
608
    
402 by Teddy Hogeborn
* mandos (Client.disable): Rename keyword argument "log" to "quiet",
609
    def disable(self, quiet=True):
239 by Teddy Hogeborn
* mandos (_datetime_to_dbus_struct): Renamed to "_datetime_to_dbus";
610
        """Disable this client."""
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
611
        if not getattr(self, "enabled", False):
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
612
            return False
402 by Teddy Hogeborn
* mandos (Client.disable): Rename keyword argument "log" to "quiet",
613
        if not quiet:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
614
            logger.info("Disabling client %s", self.name)
581 by Teddy Hogeborn
* mandos (Client.enable, Client.disable, ClientDBus.approve): Call
615
        if getattr(self, "disable_initiator_tag", None) is not None:
239 by Teddy Hogeborn
* mandos (_datetime_to_dbus_struct): Renamed to "_datetime_to_dbus";
616
            gobject.source_remove(self.disable_initiator_tag)
617
            self.disable_initiator_tag = None
24.1.179 by Björn Påhlsson
New feature:
618
        self.expires = None
581 by Teddy Hogeborn
* mandos (Client.enable, Client.disable, ClientDBus.approve): Call
619
        if getattr(self, "checker_initiator_tag", None) is not None:
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
620
            gobject.source_remove(self.checker_initiator_tag)
621
            self.checker_initiator_tag = None
622
        self.stop_checker()
239 by Teddy Hogeborn
* mandos (_datetime_to_dbus_struct): Renamed to "_datetime_to_dbus";
623
        self.enabled = False
581 by Teddy Hogeborn
* mandos (Client.enable, Client.disable, ClientDBus.approve): Call
624
        if not quiet:
625
            self.send_changedstate()
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
626
        # Do not run this again if called by a gobject.timeout_add
627
        return False
237.1.1 by Teddy Hogeborn
First steps of a D-Bus interface to the server.
628
    
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
629
    def __del__(self):
239 by Teddy Hogeborn
* mandos (_datetime_to_dbus_struct): Renamed to "_datetime_to_dbus";
630
        self.disable()
518.1.6 by Teddy Hogeborn
* mandos: Fix whitespace.
631
    
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
632
    def init_checker(self):
633
        # Schedule a new checker to be started an 'interval' from now,
634
        # and every interval from then on.
581 by Teddy Hogeborn
* mandos (Client.enable, Client.disable, ClientDBus.approve): Call
635
        if self.checker_initiator_tag is not None:
636
            gobject.source_remove(self.checker_initiator_tag)
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
637
        self.checker_initiator_tag = gobject.timeout_add(
638
            int(self.interval.total_seconds() * 1000),
639
            self.start_checker)
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
640
        # Schedule a disable() when 'timeout' has passed
581 by Teddy Hogeborn
* mandos (Client.enable, Client.disable, ClientDBus.approve): Call
641
        if self.disable_initiator_tag is not None:
642
            gobject.source_remove(self.disable_initiator_tag)
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
643
        self.disable_initiator_tag = gobject.timeout_add(
644
            int(self.timeout.total_seconds() * 1000), self.disable)
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
645
        # Also start a new checker *right now*.
646
        self.start_checker()
518.1.6 by Teddy Hogeborn
* mandos: Fix whitespace.
647
    
749.1.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
648
    def checker_callback(self, source, condition,
649
                         (connection, command)):
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
650
        """The checker has completed, so take appropriate actions."""
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
651
        self.checker_callback_tag = None
652
        self.checker = None
749.1.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
653
        # Read return code from connection (see subprocess_call_pipe)
654
        returncode = connection.recv()
655
        connection.close()
656
        
657
        if returncode >= 0:
658
            self.last_checker_status = returncode
659
            self.last_checker_signal = None
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
660
            if self.last_checker_status == 0:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
661
                logger.info("Checker for %(name)s succeeded",
280 by Teddy Hogeborn
* mandos (Client.CheckerCompleted): Changed signature to "nxs"; return
662
                            vars(self))
281 by Teddy Hogeborn
* mandos (Client.bump_timeout): Renamed to "checked_ok". All callers
663
                self.checked_ok()
280 by Teddy Hogeborn
* mandos (Client.CheckerCompleted): Changed signature to "nxs"; return
664
            else:
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
665
                logger.info("Checker for %(name)s failed", vars(self))
280 by Teddy Hogeborn
* mandos (Client.CheckerCompleted): Changed signature to "nxs"; return
666
        else:
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
667
            self.last_checker_status = -1
749.1.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
668
            self.last_checker_signal = -returncode
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
669
            logger.warning("Checker for %(name)s crashed?",
13 by Björn Påhlsson
Added following support:
670
                           vars(self))
749.1.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
671
        return False
237.1.1 by Teddy Hogeborn
First steps of a D-Bus interface to the server.
672
    
556 by Teddy Hogeborn
* DBUS-API (se.recompile.Mandos.Client.LastCheckerStatus): New
673
    def checked_ok(self):
674
        """Assert that the client has been seen, alive and well."""
675
        self.last_checked_ok = datetime.datetime.utcnow()
676
        self.last_checker_status = 0
749.1.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
677
        self.last_checker_signal = None
556 by Teddy Hogeborn
* DBUS-API (se.recompile.Mandos.Client.LastCheckerStatus): New
678
        self.bump_timeout()
679
    
680
    def bump_timeout(self, timeout=None):
681
        """Bump up the timeout for this client."""
24.1.179 by Björn Påhlsson
New feature:
682
        if timeout is None:
683
            timeout = self.timeout
505.1.17 by Teddy Hogeborn
* mandos (Client.checked_ok): Bug fix: Handle disabled client.
684
        if self.disable_initiator_tag is not None:
685
            gobject.source_remove(self.disable_initiator_tag)
581 by Teddy Hogeborn
* mandos (Client.enable, Client.disable, ClientDBus.approve): Call
686
            self.disable_initiator_tag = None
505.1.17 by Teddy Hogeborn
* mandos (Client.checked_ok): Bug fix: Handle disabled client.
687
        if getattr(self, "enabled", False):
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
688
            self.disable_initiator_tag = gobject.timeout_add(
689
                int(timeout.total_seconds() * 1000), self.disable)
505.1.17 by Teddy Hogeborn
* mandos (Client.checked_ok): Bug fix: Handle disabled client.
690
            self.expires = datetime.datetime.utcnow() + timeout
237.1.1 by Teddy Hogeborn
First steps of a D-Bus interface to the server.
691
    
442 by Teddy Hogeborn
* DBUS-API: Document new "LastApprovalRequest" client property.
692
    def need_approval(self):
693
        self.last_approval_request = datetime.datetime.utcnow()
694
    
9 by Teddy Hogeborn
* client.cpp (main): Get t_old early since it is used on error exits.
695
    def start_checker(self):
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
696
        """Start a new checker subprocess if one is not running.
331 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
697
        
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
698
        If a checker already exists, leave it running and do
699
        nothing."""
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
700
        # The reason for not killing a running checker is that if we
577 by Teddy Hogeborn
* mandos (Client.start_checker): Reworded comment.
701
        # did that, and if a checker (for some reason) started running
702
        # slowly and taking more than 'interval' time, then the client
703
        # would inevitably timeout, since no checker would get a
704
        # chance to run to completion.  If we instead leave running
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
705
        # checkers alone, the checker would have to take more time
411 by Teddy Hogeborn
More consistent terminology: Clients are no longer "invalid" - they
706
        # than 'timeout' for the client to be disabled, which is as it
707
        # should be.
315 by Teddy Hogeborn
* mandos (Client.current_checker_command): New attribute.
708
        
749.1.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
709
        if self.checker is not None and not self.checker.is_alive():
710
            logger.warning("Checker was not alive; joining")
711
            self.checker.join()
712
            self.checker = None
315 by Teddy Hogeborn
* mandos (Client.current_checker_command): New attribute.
713
        # Start a new checker if needed
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
714
        if self.checker is None:
583 by Teddy Hogeborn
* mandos (Client.start_checker): Remove undocumented support for "%%s"
715
            # Escape attributes for the shell
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
716
            escaped_attrs = {
717
                attr: re.escape(str(getattr(self, attr)))
718
                for attr in self.runtime_expansions }
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
719
            try:
583 by Teddy Hogeborn
* mandos (Client.start_checker): Remove undocumented support for "%%s"
720
                command = self.checker_command % escaped_attrs
721
            except TypeError as error:
722
                logger.error('Could not format string "%s"',
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
723
                             self.checker_command,
724
                             exc_info=error)
725
                return True     # Try again later
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
726
            self.current_checker_command = command
749.1.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
727
            logger.info("Starting checker %r for %s", command,
728
                        self.name)
729
            # We don't need to redirect stdout and stderr, since
730
            # in normal mode, that is already done by daemon(),
731
            # and in debug mode we don't want to.  (Stdin is
732
            # always replaced by /dev/null.)
733
            # The exception is when not debugging but nevertheless
734
            # running in the foreground; use the previously
735
            # created wnull.
736
            popen_args = { "close_fds": True,
737
                           "shell": True,
738
                           "cwd": "/" }
739
            if (not self.server_settings["debug"]
740
                and self.server_settings["foreground"]):
741
                popen_args.update({"stdout": wnull,
742
                                   "stderr": wnull })
743
            pipe = multiprocessing.Pipe(duplex=False)
744
            self.checker = multiprocessing.Process(
745
                target=subprocess_call_pipe, args=(pipe[1], command),
746
                kwargs=popen_args)
747
            self.checker.start()
748
            self.checker_callback_tag = gobject.io_add_watch(
749
                pipe[0].fileno(), gobject.IO_IN,
750
                self.checker_callback, (pipe[0], command))
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
751
        # Re-run this periodically if run by gobject.timeout_add
752
        return True
237.1.1 by Teddy Hogeborn
First steps of a D-Bus interface to the server.
753
    
9 by Teddy Hogeborn
* client.cpp (main): Get t_old early since it is used on error exits.
754
    def stop_checker(self):
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
755
        """Force the checker process, if any, to stop."""
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
756
        if self.checker_callback_tag:
757
            gobject.source_remove(self.checker_callback_tag)
758
            self.checker_callback_tag = None
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
759
        if getattr(self, "checker", None) is None:
9 by Teddy Hogeborn
* client.cpp (main): Get t_old early since it is used on error exits.
760
            return
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
761
        logger.debug("Stopping checker for %(name)s", vars(self))
749.1.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
762
        self.checker.terminate()
9 by Teddy Hogeborn
* client.cpp (main): Get t_old early since it is used on error exits.
763
        self.checker = None
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
764
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
765
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
766
def dbus_service_property(dbus_interface,
767
                          signature="v",
768
                          access="readwrite",
769
                          byte_arrays=False):
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
770
    """Decorators for marking methods of a DBusObjectWithProperties to
771
    become properties on the D-Bus.
772
    
773
    The decorated method will be called with no arguments by "Get"
774
    and with one argument by "Set".
775
    
776
    The parameters, where they are supported, are the same as
777
    dbus.service.method, except there is only "signature", since the
778
    type from Get() and the type sent to Set() is the same.
779
    """
411 by Teddy Hogeborn
More consistent terminology: Clients are no longer "invalid" - they
780
    # Encoding deeply encoded byte arrays is not supported yet by the
781
    # "Set" method, so we fail early here:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
782
    if byte_arrays and signature != "ay":
783
        raise ValueError("Byte arrays not supported for non-'ay'"
723.1.5 by Teddy Hogeborn
Use the new auto-numbered "{}" syntax for the .format() string method.
784
                         " signature {!r}".format(signature))
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
785
    
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
786
    def decorator(func):
787
        func._dbus_is_property = True
788
        func._dbus_interface = dbus_interface
789
        func._dbus_signature = signature
790
        func._dbus_access = access
791
        func._dbus_name = func.__name__
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
792
        if func._dbus_name.endswith("_dbus_property"):
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
793
            func._dbus_name = func._dbus_name[:-14]
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
794
        func._dbus_get_args_options = {'byte_arrays': byte_arrays }
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
795
        return func
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
796
    
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
797
    return decorator
798
799
560.1.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
800
def dbus_interface_annotations(dbus_interface):
573 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
801
    """Decorator for marking functions returning interface annotations
560.1.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
802
    
803
    Usage:
804
    
805
    @dbus_interface_annotations("org.example.Interface")
806
    def _foo(self):  # Function name does not matter
807
        return {"org.freedesktop.DBus.Deprecated": "true",
808
                "org.freedesktop.DBus.Property.EmitsChangedSignal":
809
                    "false"}
810
    """
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
811
    
560.1.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
812
    def decorator(func):
813
        func._dbus_is_interface = True
814
        func._dbus_interface = dbus_interface
815
        func._dbus_name = dbus_interface
816
        return func
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
817
    
560.1.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
818
    return decorator
819
820
561.1.1 by Teddy Hogeborn
Add D-Bus annotations support to methods, signals and properties.
821
def dbus_annotations(annotations):
822
    """Decorator to annotate D-Bus methods, signals or properties
823
    Usage:
824
    
732 by Teddy Hogeborn
Emit D-Bus "org.freedesktop.DBus.Properties.PropertiesChanged" signal.
825
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",
826
                       "org.freedesktop.DBus.Property."
827
                       "EmitsChangedSignal": "false"})
561.1.1 by Teddy Hogeborn
Add D-Bus annotations support to methods, signals and properties.
828
    @dbus_service_property("org.example.Interface", signature="b",
829
                           access="r")
830
    def Property_dbus_property(self):
831
        return dbus.Boolean(False)
832
    """
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
833
    
561.1.1 by Teddy Hogeborn
Add D-Bus annotations support to methods, signals and properties.
834
    def decorator(func):
835
        func._dbus_annotations = annotations
836
        return func
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
837
    
561.1.1 by Teddy Hogeborn
Add D-Bus annotations support to methods, signals and properties.
838
    return decorator
839
840
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
841
class DBusPropertyException(dbus.exceptions.DBusException):
842
    """A base class for D-Bus property-related exceptions
843
    """
729 by Teddy Hogeborn
mandos: Stop using str() and remove unnecessary unicode() calls.
844
    pass
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
845
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
846
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
847
class DBusPropertyAccessException(DBusPropertyException):
848
    """A property's access permissions disallows an operation.
849
    """
850
    pass
851
852
853
class DBusPropertyNotFound(DBusPropertyException):
854
    """An attempt was made to access a non-existing property.
855
    """
856
    pass
857
858
859
class DBusObjectWithProperties(dbus.service.Object):
860
    """A D-Bus object with properties.
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
861
    
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
862
    Classes inheriting from this can use the dbus_service_property
863
    decorator to expose methods as D-Bus properties.  It exposes the
864
    standard Get(), Set(), and GetAll() methods on the D-Bus.
865
    """
866
    
867
    @staticmethod
560.1.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
868
    def _is_dbus_thing(thing):
869
        """Returns a function testing if an attribute is a D-Bus thing
870
        
871
        If called like _is_dbus_thing("method") it returns a function
872
        suitable for use as predicate to inspect.getmembers().
873
        """
723.1.5 by Teddy Hogeborn
Use the new auto-numbered "{}" syntax for the .format() string method.
874
        return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
560.1.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
875
                                   False)
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
876
    
560.1.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
877
    def _get_all_dbus_things(self, thing):
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
878
        """Returns a generator of (name, attribute) pairs
879
        """
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
880
        return ((getattr(athing.__get__(self), "_dbus_name", name),
560.1.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
881
                 athing.__get__(self))
24.1.186 by Björn Påhlsson
transitional stuff actually working
882
                for cls in self.__class__.__mro__
560.1.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
883
                for name, athing in
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
884
                inspect.getmembers(cls, self._is_dbus_thing(thing)))
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
885
    
886
    def _get_dbus_property(self, interface_name, property_name):
887
        """Returns a bound method if one exists which is a D-Bus
888
        property with the specified name and interface.
889
        """
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
890
        for cls in self.__class__.__mro__:
891
            for name, value in inspect.getmembers(
892
                    cls, self._is_dbus_thing("property")):
505.1.3 by Teddy Hogeborn
* mandos: Break long lines.
893
                if (value._dbus_name == property_name
894
                    and value._dbus_interface == interface_name):
24.1.186 by Björn Påhlsson
transitional stuff actually working
895
                    return value.__get__(self)
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
896
        
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
897
        # No such property
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
898
        raise DBusPropertyNotFound("{}:{}.{}".format(
899
            self.dbus_object_path, interface_name, property_name))
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
900
    
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
901
    @dbus.service.method(dbus.PROPERTIES_IFACE,
902
                         in_signature="ss",
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
903
                         out_signature="v")
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
904
    def Get(self, interface_name, property_name):
905
        """Standard D-Bus property Get() method, see D-Bus standard.
906
        """
907
        prop = self._get_dbus_property(interface_name, property_name)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
908
        if prop._dbus_access == "write":
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
909
            raise DBusPropertyAccessException(property_name)
910
        value = prop()
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
911
        if not hasattr(value, "variant_level"):
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
912
            return value
913
        return type(value)(value, variant_level=value.variant_level+1)
914
    
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
915
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
916
    def Set(self, interface_name, property_name, value):
917
        """Standard D-Bus property Set() method, see D-Bus standard.
918
        """
919
        prop = self._get_dbus_property(interface_name, property_name)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
920
        if prop._dbus_access == "read":
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
921
            raise DBusPropertyAccessException(property_name)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
922
        if prop._dbus_get_args_options["byte_arrays"]:
411 by Teddy Hogeborn
More consistent terminology: Clients are no longer "invalid" - they
923
            # The byte_arrays option is not supported yet on
924
            # signatures other than "ay".
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
925
            if prop._dbus_signature != "ay":
649 by Teddy Hogeborn
Minor code fix; raise only exception instances, not classes.
926
                raise ValueError("Byte arrays not supported for non-"
723.1.5 by Teddy Hogeborn
Use the new auto-numbered "{}" syntax for the .format() string method.
927
                                 "'ay' signature {!r}"
649 by Teddy Hogeborn
Minor code fix; raise only exception instances, not classes.
928
                                 .format(prop._dbus_signature))
546 by Teddy Hogeborn
* debian/rules (binary-common): Exclude network-hooks.d from
929
            value = dbus.ByteArray(b''.join(chr(byte)
930
                                            for byte in value))
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
931
        prop(value)
932
    
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
933
    @dbus.service.method(dbus.PROPERTIES_IFACE,
934
                         in_signature="s",
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
935
                         out_signature="a{sv}")
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
936
    def GetAll(self, interface_name):
937
        """Standard D-Bus property GetAll() method, see D-Bus
938
        standard.
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
939
        
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
940
        Note: Will not include properties with access="write".
941
        """
518.1.5 by Björn Påhlsson
First run of python-lint. Fixed some *obviously* bad code and turned
942
        properties = {}
560.1.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
943
        for name, prop in self._get_all_dbus_things("property"):
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
944
            if (interface_name
945
                and interface_name != prop._dbus_interface):
946
                # Interface non-empty but did not match
947
                continue
948
            # Ignore write-only properties
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
949
            if prop._dbus_access == "write":
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
950
                continue
951
            value = prop()
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
952
            if not hasattr(value, "variant_level"):
518.1.5 by Björn Påhlsson
First run of python-lint. Fixed some *obviously* bad code and turned
953
                properties[name] = value
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
954
                continue
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
955
            properties[name] = type(value)(
956
                value, variant_level = value.variant_level + 1)
518.1.5 by Björn Påhlsson
First run of python-lint. Fixed some *obviously* bad code and turned
957
        return dbus.Dictionary(properties, signature="sv")
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
958
    
732 by Teddy Hogeborn
Emit D-Bus "org.freedesktop.DBus.Properties.PropertiesChanged" signal.
959
    @dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")
960
    def PropertiesChanged(self, interface_name, changed_properties,
961
                          invalidated_properties):
962
        """Standard D-Bus PropertiesChanged() signal, see D-Bus
963
        standard.
964
        """
965
        pass
966
    
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
967
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
968
                         out_signature="s",
969
                         path_keyword='object_path',
970
                         connection_keyword='connection')
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
971
    def Introspect(self, object_path, connection):
560.1.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
972
        """Overloading of standard D-Bus method.
973
        
974
        Inserts property tags and interface annotation tags.
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
975
        """
976
        xmlstring = dbus.service.Object.Introspect(self, object_path,
386 by Teddy Hogeborn
* mandos (DBusObjectWithProperties.Introspect): Add the name
977
                                                   connection)
387 by Teddy Hogeborn
* mandos (ClientDBus.ReceivedSecret): Renamed to "GotSecret". All
978
        try:
979
            document = xml.dom.minidom.parseString(xmlstring)
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
980
            
387 by Teddy Hogeborn
* mandos (ClientDBus.ReceivedSecret): Renamed to "GotSecret". All
981
            def make_tag(document, name, prop):
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
982
                e = document.createElement("property")
983
                e.setAttribute("name", name)
984
                e.setAttribute("type", prop._dbus_signature)
985
                e.setAttribute("access", prop._dbus_access)
387 by Teddy Hogeborn
* mandos (ClientDBus.ReceivedSecret): Renamed to "GotSecret". All
986
                return e
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
987
            
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
988
            for if_tag in document.getElementsByTagName("interface"):
560.1.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
989
                # Add property tags
387 by Teddy Hogeborn
* mandos (ClientDBus.ReceivedSecret): Renamed to "GotSecret". All
990
                for tag in (make_tag(document, name, prop)
991
                            for name, prop
560.1.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
992
                            in self._get_all_dbus_things("property")
387 by Teddy Hogeborn
* mandos (ClientDBus.ReceivedSecret): Renamed to "GotSecret". All
993
                            if prop._dbus_interface
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
994
                            == if_tag.getAttribute("name")):
387 by Teddy Hogeborn
* mandos (ClientDBus.ReceivedSecret): Renamed to "GotSecret". All
995
                    if_tag.appendChild(tag)
561.1.1 by Teddy Hogeborn
Add D-Bus annotations support to methods, signals and properties.
996
                # Add annotation tags
997
                for typ in ("method", "signal", "property"):
998
                    for tag in if_tag.getElementsByTagName(typ):
999
                        annots = dict()
1000
                        for name, prop in (self.
1001
                                           _get_all_dbus_things(typ)):
1002
                            if (name == tag.getAttribute("name")
1003
                                and prop._dbus_interface
1004
                                == if_tag.getAttribute("name")):
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1005
                                annots.update(getattr(
1006
                                    prop, "_dbus_annotations", {}))
723.1.4 by Teddy Hogeborn
Use the .items() method instead of .iteritems().
1007
                        for name, value in annots.items():
561.1.1 by Teddy Hogeborn
Add D-Bus annotations support to methods, signals and properties.
1008
                            ann_tag = document.createElement(
1009
                                "annotation")
1010
                            ann_tag.setAttribute("name", name)
1011
                            ann_tag.setAttribute("value", value)
1012
                            tag.appendChild(ann_tag)
560.1.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
1013
                # Add interface annotation tags
1014
                for annotation, value in dict(
576 by Teddy Hogeborn
* mandos (DBusObjectWithProperties.Introspect): Use
1015
                    itertools.chain.from_iterable(
723.1.4 by Teddy Hogeborn
Use the .items() method instead of .iteritems().
1016
                        annotations().items()
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1017
                        for name, annotations
1018
                        in self._get_all_dbus_things("interface")
576 by Teddy Hogeborn
* mandos (DBusObjectWithProperties.Introspect): Use
1019
                        if name == if_tag.getAttribute("name")
723.1.4 by Teddy Hogeborn
Use the .items() method instead of .iteritems().
1020
                        )).items():
561.1.1 by Teddy Hogeborn
Add D-Bus annotations support to methods, signals and properties.
1021
                    ann_tag = document.createElement("annotation")
1022
                    ann_tag.setAttribute("name", annotation)
1023
                    ann_tag.setAttribute("value", value)
1024
                    if_tag.appendChild(ann_tag)
387 by Teddy Hogeborn
* mandos (ClientDBus.ReceivedSecret): Renamed to "GotSecret". All
1025
                # Add the names to the return values for the
1026
                # "org.freedesktop.DBus.Properties" methods
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1027
                if (if_tag.getAttribute("name")
1028
                    == "org.freedesktop.DBus.Properties"):
1029
                    for cn in if_tag.getElementsByTagName("method"):
1030
                        if cn.getAttribute("name") == "Get":
1031
                            for arg in cn.getElementsByTagName("arg"):
1032
                                if (arg.getAttribute("direction")
1033
                                    == "out"):
1034
                                    arg.setAttribute("name", "value")
1035
                        elif cn.getAttribute("name") == "GetAll":
1036
                            for arg in cn.getElementsByTagName("arg"):
1037
                                if (arg.getAttribute("direction")
1038
                                    == "out"):
1039
                                    arg.setAttribute("name", "props")
1040
            xmlstring = document.toxml("utf-8")
387 by Teddy Hogeborn
* mandos (ClientDBus.ReceivedSecret): Renamed to "GotSecret". All
1041
            document.unlink()
1042
        except (AttributeError, xml.dom.DOMException,
482 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
1043
                xml.parsers.expat.ExpatError) as error:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1044
            logger.error("Failed to override Introspection method",
565 by Teddy Hogeborn
* mandos (AvahiService.rename, Client.start_checker,
1045
                         exc_info=error)
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1046
        return xmlstring
1047
1048
587 by Teddy Hogeborn
* Makefile (DOCBOOKTOMAN): Only run man --warnings if both "man" and
1049
def datetime_to_dbus(dt, variant_level=0):
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1050
    """Convert a UTC datetime.datetime() to a D-Bus type."""
1051
    if dt is None:
1052
        return dbus.String("", variant_level = variant_level)
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1053
    return dbus.String(dt.isoformat(), variant_level=variant_level)
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1054
518.1.6 by Teddy Hogeborn
* mandos: Fix whitespace.
1055
575 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1056
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
1057
    """A class decorator; applied to a subclass of
1058
    dbus.service.Object, it will add alternate D-Bus attributes with
1059
    interface names according to the "alt_interface_names" mapping.
1060
    Usage:
1061
    
587 by Teddy Hogeborn
* Makefile (DOCBOOKTOMAN): Only run man --warnings if both "man" and
1062
    @alternate_dbus_interfaces({"org.example.Interface":
1063
                                    "net.example.AlternateInterface"})
575 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1064
    class SampleDBusObject(dbus.service.Object):
1065
        @dbus.service.method("org.example.Interface")
1066
        def SampleDBusMethod():
1067
            pass
1068
    
1069
    The above "SampleDBusMethod" on "SampleDBusObject" will be
1070
    reachable via two interfaces: "org.example.Interface" and
1071
    "net.example.AlternateInterface", the latter of which will have
1072
    its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
1073
    "true", unless "deprecate" is passed with a False value.
1074
    
1075
    This works for methods and signals, and also for D-Bus properties
1076
    (from DBusObjectWithProperties) and interfaces (from the
1077
    dbus_interface_annotations decorator).
505.1.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1078
    """
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1079
    
575 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1080
    def wrapper(cls):
1081
        for orig_interface_name, alt_interface_name in (
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1082
                alt_interface_names.items()):
575 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1083
            attr = {}
1084
            interface_names = set()
1085
            # Go though all attributes of the class
1086
            for attrname, attribute in inspect.getmembers(cls):
505.1.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1087
                # Ignore non-D-Bus attributes, and D-Bus attributes
1088
                # with the wrong interface name
1089
                if (not hasattr(attribute, "_dbus_interface")
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1090
                    or not attribute._dbus_interface.startswith(
1091
                        orig_interface_name)):
505.1.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1092
                    continue
1093
                # Create an alternate D-Bus interface name based on
1094
                # the current name
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1095
                alt_interface = attribute._dbus_interface.replace(
1096
                    orig_interface_name, alt_interface_name)
575 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1097
                interface_names.add(alt_interface)
505.1.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1098
                # Is this a D-Bus signal?
1099
                if getattr(attribute, "_dbus_is_signal", False):
614 by Teddy Hogeborn
* mandos: Comment changes.
1100
                    # Extract the original non-method undecorated
1101
                    # function by black magic
505.1.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1102
                    nonmethod_func = (dict(
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1103
                        zip(attribute.func_code.co_freevars,
1104
                            attribute.__closure__))
1105
                                      ["func"].cell_contents)
505.1.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1106
                    # Create a new, but exactly alike, function
1107
                    # object, and decorate it to be a new D-Bus signal
1108
                    # with the alternate D-Bus interface name
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1109
                    new_function = (dbus.service.signal(
1110
                        alt_interface, attribute._dbus_signature)
505.1.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1111
                                    (types.FunctionType(
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1112
                                        nonmethod_func.func_code,
1113
                                        nonmethod_func.func_globals,
1114
                                        nonmethod_func.func_name,
1115
                                        nonmethod_func.func_defaults,
1116
                                        nonmethod_func.func_closure)))
561.1.1 by Teddy Hogeborn
Add D-Bus annotations support to methods, signals and properties.
1117
                    # Copy annotations, if any
1118
                    try:
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1119
                        new_function._dbus_annotations = dict(
1120
                            attribute._dbus_annotations)
561.1.1 by Teddy Hogeborn
Add D-Bus annotations support to methods, signals and properties.
1121
                    except AttributeError:
1122
                        pass
505.1.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1123
                    # Define a creator of a function to call both the
575 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1124
                    # original and alternate functions, so both the
1125
                    # original and alternate signals gets sent when
1126
                    # the function is called
505.1.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1127
                    def fixscope(func1, func2):
1128
                        """This function is a scope container to pass
1129
                        func1 and func2 to the "call_both" function
1130
                        outside of its arguments"""
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1131
                        
505.1.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1132
                        def call_both(*args, **kwargs):
1133
                            """This function will emit two D-Bus
1134
                            signals by calling func1 and func2"""
1135
                            func1(*args, **kwargs)
1136
                            func2(*args, **kwargs)
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1137
                        
505.1.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1138
                        return call_both
1139
                    # Create the "call_both" function and add it to
1140
                    # the class
575 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1141
                    attr[attrname] = fixscope(attribute, new_function)
505.1.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1142
                # Is this a D-Bus method?
1143
                elif getattr(attribute, "_dbus_is_method", False):
1144
                    # Create a new, but exactly alike, function
1145
                    # object.  Decorate it to be a new D-Bus method
1146
                    # with the alternate D-Bus interface name.  Add it
1147
                    # to the class.
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1148
                    attr[attrname] = (
1149
                        dbus.service.method(
1150
                            alt_interface,
1151
                            attribute._dbus_in_signature,
1152
                            attribute._dbus_out_signature)
1153
                        (types.FunctionType(attribute.func_code,
1154
                                            attribute.func_globals,
1155
                                            attribute.func_name,
1156
                                            attribute.func_defaults,
1157
                                            attribute.func_closure)))
561.1.1 by Teddy Hogeborn
Add D-Bus annotations support to methods, signals and properties.
1158
                    # Copy annotations, if any
1159
                    try:
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1160
                        attr[attrname]._dbus_annotations = dict(
1161
                            attribute._dbus_annotations)
561.1.1 by Teddy Hogeborn
Add D-Bus annotations support to methods, signals and properties.
1162
                    except AttributeError:
1163
                        pass
505.1.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1164
                # Is this a D-Bus property?
1165
                elif getattr(attribute, "_dbus_is_property", False):
1166
                    # Create a new, but exactly alike, function
1167
                    # object, and decorate it to be a new D-Bus
1168
                    # property with the alternate D-Bus interface
1169
                    # name.  Add it to the class.
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1170
                    attr[attrname] = (dbus_service_property(
1171
                        alt_interface, attribute._dbus_signature,
1172
                        attribute._dbus_access,
1173
                        attribute._dbus_get_args_options
1174
                        ["byte_arrays"])
1175
                                      (types.FunctionType(
1176
                                          attribute.func_code,
1177
                                          attribute.func_globals,
1178
                                          attribute.func_name,
1179
                                          attribute.func_defaults,
1180
                                          attribute.func_closure)))
561.1.1 by Teddy Hogeborn
Add D-Bus annotations support to methods, signals and properties.
1181
                    # Copy annotations, if any
1182
                    try:
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1183
                        attr[attrname]._dbus_annotations = dict(
1184
                            attribute._dbus_annotations)
561.1.1 by Teddy Hogeborn
Add D-Bus annotations support to methods, signals and properties.
1185
                    except AttributeError:
1186
                        pass
560.1.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
1187
                # Is this a D-Bus interface?
1188
                elif getattr(attribute, "_dbus_is_interface", False):
1189
                    # Create a new, but exactly alike, function
1190
                    # object.  Decorate it to be a new D-Bus interface
1191
                    # with the alternate D-Bus interface name.  Add it
1192
                    # to the class.
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1193
                    attr[attrname] = (
1194
                        dbus_interface_annotations(alt_interface)
1195
                        (types.FunctionType(attribute.func_code,
1196
                                            attribute.func_globals,
1197
                                            attribute.func_name,
1198
                                            attribute.func_defaults,
1199
                                            attribute.func_closure)))
575 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1200
            if deprecate:
1201
                # Deprecate all alternate interfaces
723.1.5 by Teddy Hogeborn
Use the new auto-numbered "{}" syntax for the .format() string method.
1202
                iname="_AlternateDBusNames_interface_annotation{}"
575 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1203
                for interface_name in interface_names:
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1204
                    
575 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1205
                    @dbus_interface_annotations(interface_name)
1206
                    def func(self):
1207
                        return { "org.freedesktop.DBus.Deprecated":
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1208
                                 "true" }
575 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1209
                    # Find an unused name
1210
                    for aname in (iname.format(i)
1211
                                  for i in itertools.count()):
1212
                        if aname not in attr:
1213
                            attr[aname] = func
1214
                            break
1215
            if interface_names:
1216
                # Replace the class with a new subclass of it with
1217
                # methods, signals, etc. as created above.
723.1.5 by Teddy Hogeborn
Use the new auto-numbered "{}" syntax for the .format() string method.
1218
                cls = type(b"{}Alternate".format(cls.__name__),
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1219
                           (cls, ), attr)
575 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1220
        return cls
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1221
    
575 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1222
    return wrapper
1223
1224
1225
@alternate_dbus_interfaces({"se.recompile.Mandos":
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1226
                            "se.bsnet.fukt.Mandos"})
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1227
class ClientDBus(Client, DBusObjectWithProperties):
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1228
    """A Client class using D-Bus
331 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
1229
    
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1230
    Attributes:
338 by Teddy Hogeborn
* mandos: Minor doc string fixes.
1231
    dbus_object_path: dbus.ObjectPath
1232
    bus: dbus.SystemBus()
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1233
    """
438 by Teddy Hogeborn
* mandos (Client.runtime_expansions): New attribute containing the
1234
    
1235
    runtime_expansions = (Client.runtime_expansions
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1236
                          + ("dbus_object_path", ))
438 by Teddy Hogeborn
* mandos (Client.runtime_expansions): New attribute containing the
1237
    
732 by Teddy Hogeborn
Emit D-Bus "org.freedesktop.DBus.Properties.PropertiesChanged" signal.
1238
    _interface = "se.recompile.Mandos.Client"
1239
    
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1240
    # dbus.service.Object doesn't use super(), so we can't either.
1241
    
337 by Teddy Hogeborn
Code cleanup. Move some global stuff into main.
1242
    def __init__(self, bus = None, *args, **kwargs):
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
1243
        self.bus = bus
1244
        Client.__init__(self, *args, **kwargs)
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1245
        # Only now, when this client is initialized, can it show up on
1246
        # the D-Bus
730 by Teddy Hogeborn
mandos: Replace unicode() with str().
1247
        client_object_name = str(self.name).translate(
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1248
            {ord("."): ord("_"),
1249
             ord("-"): ord("_")})
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1250
        self.dbus_object_path = dbus.ObjectPath(
1251
            "/clients/" + client_object_name)
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1252
        DBusObjectWithProperties.__init__(self, self.bus,
1253
                                          self.dbus_object_path)
573 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
1254
    
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1255
    def notifychangeproperty(transform_func, dbus_name,
1256
                             type_func=lambda x: x,
1257
                             variant_level=1,
1258
                             invalidate_only=False,
732 by Teddy Hogeborn
Emit D-Bus "org.freedesktop.DBus.Properties.PropertiesChanged" signal.
1259
                             _interface=_interface):
505.1.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1260
        """ Modify a variable so that it's a property which announces
1261
        its changes to DBus.
518.1.6 by Teddy Hogeborn
* mandos: Fix whitespace.
1262
        
505.1.15 by Teddy Hogeborn
Bug fix: Make D-Bus properties settable again.
1263
        transform_fun: Function that takes a value and a variant_level
1264
                       and transforms it to a D-Bus type.
505.1.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1265
        dbus_name: D-Bus name of the variable
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1266
        type_func: Function that transform the value before sending it
505.1.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1267
                   to the D-Bus.  Default: no transform
1268
        variant_level: D-Bus variant level.  Default: 1
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1269
        """
723.1.5 by Teddy Hogeborn
Use the new auto-numbered "{}" syntax for the .format() string method.
1270
        attrname = "_{}".format(dbus_name)
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1271
        
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1272
        def setter(self, value):
1273
            if hasattr(self, "dbus_object_path"):
505.1.6 by Teddy Hogeborn
* mandos (ClientDBus.notifychangeproperty): Bug fix: Use instance
1274
                if (not hasattr(self, attrname) or
1275
                    type_func(getattr(self, attrname, None))
1276
                    != type_func(value)):
732 by Teddy Hogeborn
Emit D-Bus "org.freedesktop.DBus.Properties.PropertiesChanged" signal.
1277
                    if invalidate_only:
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1278
                        self.PropertiesChanged(
1279
                            _interface, dbus.Dictionary(),
1280
                            dbus.Array((dbus_name, )))
732 by Teddy Hogeborn
Emit D-Bus "org.freedesktop.DBus.Properties.PropertiesChanged" signal.
1281
                    else:
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1282
                        dbus_value = transform_func(
1283
                            type_func(value),
1284
                            variant_level = variant_level)
732 by Teddy Hogeborn
Emit D-Bus "org.freedesktop.DBus.Properties.PropertiesChanged" signal.
1285
                        self.PropertyChanged(dbus.String(dbus_name),
1286
                                             dbus_value)
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1287
                        self.PropertiesChanged(
1288
                            _interface,
1289
                            dbus.Dictionary({ dbus.String(dbus_name):
1290
                                              dbus_value }),
1291
                            dbus.Array())
505.1.6 by Teddy Hogeborn
* mandos (ClientDBus.notifychangeproperty): Bug fix: Use instance
1292
            setattr(self, attrname, value)
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
1293
        
505.1.6 by Teddy Hogeborn
* mandos (ClientDBus.notifychangeproperty): Bug fix: Use instance
1294
        return property(lambda self: getattr(self, attrname), setter)
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
1295
    
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1296
    expires = notifychangeproperty(datetime_to_dbus, "Expires")
1297
    approvals_pending = notifychangeproperty(dbus.Boolean,
1298
                                             "ApprovalPending",
1299
                                             type_func = bool)
1300
    enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1301
    last_enabled = notifychangeproperty(datetime_to_dbus,
1302
                                        "LastEnabled")
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1303
    checker = notifychangeproperty(
1304
        dbus.Boolean, "CheckerRunning",
1305
        type_func = lambda checker: checker is not None)
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1306
    last_checked_ok = notifychangeproperty(datetime_to_dbus,
1307
                                           "LastCheckedOK")
556 by Teddy Hogeborn
* DBUS-API (se.recompile.Mandos.Client.LastCheckerStatus): New
1308
    last_checker_status = notifychangeproperty(dbus.Int16,
1309
                                               "LastCheckerStatus")
505.1.3 by Teddy Hogeborn
* mandos: Break long lines.
1310
    last_approval_request = notifychangeproperty(
1311
        datetime_to_dbus, "LastApprovalRequest")
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1312
    approved_by_default = notifychangeproperty(dbus.Boolean,
1313
                                               "ApprovedByDefault")
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1314
    approval_delay = notifychangeproperty(
1315
        dbus.UInt64, "ApprovalDelay",
1316
        type_func = lambda td: td.total_seconds() * 1000)
505.1.3 by Teddy Hogeborn
* mandos: Break long lines.
1317
    approval_duration = notifychangeproperty(
518.2.9 by Teddy Hogeborn
* mandos (ClientDBus.approval_delay, ClientDBus.approval_duration,
1318
        dbus.UInt64, "ApprovalDuration",
723.1.6 by Teddy Hogeborn
Use the new .total_seconds() method on datetime.timedelta objects.
1319
        type_func = lambda td: td.total_seconds() * 1000)
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1320
    host = notifychangeproperty(dbus.String, "Host")
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1321
    timeout = notifychangeproperty(
1322
        dbus.UInt64, "Timeout",
1323
        type_func = lambda td: td.total_seconds() * 1000)
505.1.3 by Teddy Hogeborn
* mandos: Break long lines.
1324
    extended_timeout = notifychangeproperty(
518.2.9 by Teddy Hogeborn
* mandos (ClientDBus.approval_delay, ClientDBus.approval_duration,
1325
        dbus.UInt64, "ExtendedTimeout",
723.1.6 by Teddy Hogeborn
Use the new .total_seconds() method on datetime.timedelta objects.
1326
        type_func = lambda td: td.total_seconds() * 1000)
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1327
    interval = notifychangeproperty(
1328
        dbus.UInt64, "Interval",
1329
        type_func = lambda td: td.total_seconds() * 1000)
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1330
    checker_command = notifychangeproperty(dbus.String, "Checker")
732 by Teddy Hogeborn
Emit D-Bus "org.freedesktop.DBus.Properties.PropertiesChanged" signal.
1331
    secret = notifychangeproperty(dbus.ByteArray, "Secret",
1332
                                  invalidate_only=True)
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1333
    
1334
    del notifychangeproperty
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1335
    
1336
    def __del__(self, *args, **kwargs):
1337
        try:
1338
            self.remove_from_connection()
329 by Teddy Hogeborn
* mandos (ClientDBus.__del__): Bug fix: Correct mispasted code, and do
1339
        except LookupError:
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1340
            pass
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1341
        if hasattr(DBusObjectWithProperties, "__del__"):
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1342
            DBusObjectWithProperties.__del__(self, *args, **kwargs)
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1343
        Client.__del__(self, *args, **kwargs)
1344
    
749.1.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
1345
    def checker_callback(self, source, condition,
1346
                         (connection, command), *args, **kwargs):
1347
        ret = Client.checker_callback(self, source, condition,
1348
                                      (connection, command), *args,
1349
                                      **kwargs)
1350
        exitstatus = self.last_checker_status
1351
        if exitstatus >= 0:
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1352
            # Emit D-Bus signal
1353
            self.CheckerCompleted(dbus.Int16(exitstatus),
749.1.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
1354
                                  dbus.Int64(0),
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1355
                                  dbus.String(command))
1356
        else:
1357
            # Emit D-Bus signal
1358
            self.CheckerCompleted(dbus.Int16(-1),
749.1.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
1359
                                  dbus.Int64(
1360
                                      self.last_checker_signal),
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1361
                                  dbus.String(command))
749.1.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
1362
        return ret
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
1363
    
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1364
    def start_checker(self, *args, **kwargs):
658 by Teddy Hogeborn
* mandos (ClientDBus.start_checker): Removed unused variable
1365
        old_checker_pid = getattr(self.checker, "pid", None)
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1366
        r = Client.start_checker(self, *args, **kwargs)
329 by Teddy Hogeborn
* mandos (ClientDBus.__del__): Bug fix: Correct mispasted code, and do
1367
        # Only if new checker process was started
1368
        if (self.checker is not None
1369
            and old_checker_pid != self.checker.pid):
1370
            # Emit D-Bus signal
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1371
            self.CheckerStarted(self.current_checker_command)
1372
        return r
1373
    
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1374
    def _reset_approved(self):
518.2.4 by Teddy Hogeborn
* mandos (_timedelta_to_milliseconds): Renamed to
1375
        self.approved = None
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1376
        return False
1377
    
1378
    def approve(self, value=True):
518.2.4 by Teddy Hogeborn
* mandos (_timedelta_to_milliseconds): Renamed to
1379
        self.approved = value
723.1.6 by Teddy Hogeborn
Use the new .total_seconds() method on datetime.timedelta objects.
1380
        gobject.timeout_add(int(self.approval_duration.total_seconds()
1381
                                * 1000), self._reset_approved)
581 by Teddy Hogeborn
* mandos (Client.enable, Client.disable, ClientDBus.approve): Call
1382
        self.send_changedstate()
24.2.1 by teddy at bsnet
* debian/control (mandos/Depends): Added "python-urwid".
1383
    
24.1.147 by Björn Påhlsson
The IPC pipes are now file objects, not file descriptors:
1384
    ## D-Bus methods, signals & properties
237.1.2 by Teddy Hogeborn
Further steps towards a D-Bus server interface, plus minor syntax
1385
    
560.1.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
1386
    ## Interfaces
1387
    
24.1.147 by Björn Påhlsson
The IPC pipes are now file objects, not file descriptors:
1388
    ## Signals
381 by Teddy Hogeborn
Restore some poor D-Bus methods who got a bit hastily deleted. Enable
1389
    
237.1.2 by Teddy Hogeborn
Further steps towards a D-Bus server interface, plus minor syntax
1390
    # CheckerCompleted - signal
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1391
    @dbus.service.signal(_interface, signature="nxs")
280 by Teddy Hogeborn
* mandos (Client.CheckerCompleted): Changed signature to "nxs"; return
1392
    def CheckerCompleted(self, exitcode, waitstatus, command):
237.1.2 by Teddy Hogeborn
Further steps towards a D-Bus server interface, plus minor syntax
1393
        "D-Bus signal"
1394
        pass
1395
    
1396
    # CheckerStarted - signal
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1397
    @dbus.service.signal(_interface, signature="s")
237.1.2 by Teddy Hogeborn
Further steps towards a D-Bus server interface, plus minor syntax
1398
    def CheckerStarted(self, command):
1399
        "D-Bus signal"
1400
        pass
1401
    
238 by Teddy Hogeborn
First version of a somewhat complete D-Bus server interface. Also
1402
    # PropertyChanged - signal
732 by Teddy Hogeborn
Emit D-Bus "org.freedesktop.DBus.Properties.PropertiesChanged" signal.
1403
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1404
    @dbus.service.signal(_interface, signature="sv")
238 by Teddy Hogeborn
First version of a somewhat complete D-Bus server interface. Also
1405
    def PropertyChanged(self, property, value):
1406
        "D-Bus signal"
1407
        pass
237.1.2 by Teddy Hogeborn
Further steps towards a D-Bus server interface, plus minor syntax
1408
    
387 by Teddy Hogeborn
* mandos (ClientDBus.ReceivedSecret): Renamed to "GotSecret". All
1409
    # GotSecret - signal
327 by Teddy Hogeborn
Merge from pipe IPC branch.
1410
    @dbus.service.signal(_interface)
387 by Teddy Hogeborn
* mandos (ClientDBus.ReceivedSecret): Renamed to "GotSecret". All
1411
    def GotSecret(self):
24.1.155 by Björn Påhlsson
mandos server: Added debuglevel that adjust at what level information
1412
        """D-Bus signal
1413
        Is sent after a successful transfer of secret from the Mandos
1414
        server to mandos-client
1415
        """
24.2.4 by teddy at bsnet
* mandos (ClientDBus.approvals_pending): Changed to be a property
1416
        pass
327 by Teddy Hogeborn
Merge from pipe IPC branch.
1417
    
1418
    # Rejected - signal
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1419
    @dbus.service.signal(_interface, signature="s")
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1420
    def Rejected(self, reason):
1421
        "D-Bus signal"
24.2.4 by teddy at bsnet
* mandos (ClientDBus.approvals_pending): Changed to be a property
1422
        pass
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1423
    
1424
    # NeedApproval - signal
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1425
    @dbus.service.signal(_interface, signature="tb")
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1426
    def NeedApproval(self, timeout, default):
327 by Teddy Hogeborn
Merge from pipe IPC branch.
1427
        "D-Bus signal"
442 by Teddy Hogeborn
* DBUS-API: Document new "LastApprovalRequest" client property.
1428
        return self.need_approval()
327 by Teddy Hogeborn
Merge from pipe IPC branch.
1429
    
24.1.147 by Björn Påhlsson
The IPC pipes are now file objects, not file descriptors:
1430
    ## Methods
442 by Teddy Hogeborn
* DBUS-API: Document new "LastApprovalRequest" client property.
1431
    
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1432
    # Approve - method
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1433
    @dbus.service.method(_interface, in_signature="b")
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1434
    def Approve(self, value):
1435
        self.approve(value)
442 by Teddy Hogeborn
* DBUS-API: Document new "LastApprovalRequest" client property.
1436
    
24.1.147 by Björn Påhlsson
The IPC pipes are now file objects, not file descriptors:
1437
    # CheckedOK - method
1438
    @dbus.service.method(_interface)
1439
    def CheckedOK(self):
482 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
1440
        self.checked_ok()
24.1.147 by Björn Påhlsson
The IPC pipes are now file objects, not file descriptors:
1441
    
381 by Teddy Hogeborn
Restore some poor D-Bus methods who got a bit hastily deleted. Enable
1442
    # Enable - method
1443
    @dbus.service.method(_interface)
1444
    def Enable(self):
1445
        "D-Bus method"
1446
        self.enable()
1447
    
1448
    # StartChecker - method
1449
    @dbus.service.method(_interface)
1450
    def StartChecker(self):
1451
        "D-Bus method"
1452
        self.start_checker()
1453
    
1454
    # Disable - method
1455
    @dbus.service.method(_interface)
1456
    def Disable(self):
1457
        "D-Bus method"
1458
        self.disable()
1459
    
1460
    # StopChecker - method
1461
    @dbus.service.method(_interface)
1462
    def StopChecker(self):
1463
        self.stop_checker()
1464
    
24.1.147 by Björn Påhlsson
The IPC pipes are now file objects, not file descriptors:
1465
    ## Properties
1466
    
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1467
    # ApprovalPending - property
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1468
    @dbus_service_property(_interface, signature="b", access="read")
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1469
    def ApprovalPending_dbus_property(self):
24.2.4 by teddy at bsnet
* mandos (ClientDBus.approvals_pending): Changed to be a property
1470
        return dbus.Boolean(bool(self.approvals_pending))
24.1.150 by Björn Påhlsson
* mandos: Added ClientDBus.approve_pending property. Exposed
1471
    
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1472
    # ApprovedByDefault - property
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1473
    @dbus_service_property(_interface,
1474
                           signature="b",
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1475
                           access="readwrite")
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1476
    def ApprovedByDefault_dbus_property(self, value=None):
1477
        if value is None:       # get
1478
            return dbus.Boolean(self.approved_by_default)
1479
        self.approved_by_default = bool(value)
1480
    
1481
    # ApprovalDelay - property
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1482
    @dbus_service_property(_interface,
1483
                           signature="t",
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1484
                           access="readwrite")
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1485
    def ApprovalDelay_dbus_property(self, value=None):
1486
        if value is None:       # get
723.1.6 by Teddy Hogeborn
Use the new .total_seconds() method on datetime.timedelta objects.
1487
            return dbus.UInt64(self.approval_delay.total_seconds()
1488
                               * 1000)
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1489
        self.approval_delay = datetime.timedelta(0, 0, 0, value)
1490
    
1491
    # ApprovalDuration - property
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1492
    @dbus_service_property(_interface,
1493
                           signature="t",
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1494
                           access="readwrite")
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1495
    def ApprovalDuration_dbus_property(self, value=None):
1496
        if value is None:       # get
723.1.6 by Teddy Hogeborn
Use the new .total_seconds() method on datetime.timedelta objects.
1497
            return dbus.UInt64(self.approval_duration.total_seconds()
1498
                               * 1000)
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1499
        self.approval_duration = datetime.timedelta(0, 0, 0, value)
1500
    
1501
    # Name - property
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1502
    @dbus_service_property(_interface, signature="s", access="read")
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1503
    def Name_dbus_property(self):
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1504
        return dbus.String(self.name)
1505
    
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1506
    # Fingerprint - property
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1507
    @dbus_service_property(_interface, signature="s", access="read")
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1508
    def Fingerprint_dbus_property(self):
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1509
        return dbus.String(self.fingerprint)
1510
    
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1511
    # Host - property
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1512
    @dbus_service_property(_interface,
1513
                           signature="s",
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1514
                           access="readwrite")
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1515
    def Host_dbus_property(self, value=None):
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1516
        if value is None:       # get
1517
            return dbus.String(self.host)
730 by Teddy Hogeborn
mandos: Replace unicode() with str().
1518
        self.host = str(value)
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1519
    
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1520
    # Created - property
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1521
    @dbus_service_property(_interface, signature="s", access="read")
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1522
    def Created_dbus_property(self):
518.2.3 by Teddy Hogeborn
Make "enabled" a client config option.
1523
        return datetime_to_dbus(self.created)
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1524
    
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1525
    # LastEnabled - property
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1526
    @dbus_service_property(_interface, signature="s", access="read")
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1527
    def LastEnabled_dbus_property(self):
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1528
        return datetime_to_dbus(self.last_enabled)
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1529
    
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1530
    # Enabled - property
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1531
    @dbus_service_property(_interface,
1532
                           signature="b",
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1533
                           access="readwrite")
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1534
    def Enabled_dbus_property(self, value=None):
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1535
        if value is None:       # get
1536
            return dbus.Boolean(self.enabled)
1537
        if value:
1538
            self.enable()
1539
        else:
1540
            self.disable()
1541
    
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1542
    # LastCheckedOK - property
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1543
    @dbus_service_property(_interface,
1544
                           signature="s",
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1545
                           access="readwrite")
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1546
    def LastCheckedOK_dbus_property(self, value=None):
381 by Teddy Hogeborn
Restore some poor D-Bus methods who got a bit hastily deleted. Enable
1547
        if value is not None:
1548
            self.checked_ok()
1549
            return
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1550
        return datetime_to_dbus(self.last_checked_ok)
24.1.179 by Björn Påhlsson
New feature:
1551
    
556 by Teddy Hogeborn
* DBUS-API (se.recompile.Mandos.Client.LastCheckerStatus): New
1552
    # LastCheckerStatus - property
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1553
    @dbus_service_property(_interface, signature="n", access="read")
556 by Teddy Hogeborn
* DBUS-API (se.recompile.Mandos.Client.LastCheckerStatus): New
1554
    def LastCheckerStatus_dbus_property(self):
1555
        return dbus.Int16(self.last_checker_status)
1556
    
24.1.179 by Björn Påhlsson
New feature:
1557
    # Expires - property
1558
    @dbus_service_property(_interface, signature="s", access="read")
1559
    def Expires_dbus_property(self):
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1560
        return datetime_to_dbus(self.expires)
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1561
    
442 by Teddy Hogeborn
* DBUS-API: Document new "LastApprovalRequest" client property.
1562
    # LastApprovalRequest - property
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1563
    @dbus_service_property(_interface, signature="s", access="read")
442 by Teddy Hogeborn
* DBUS-API: Document new "LastApprovalRequest" client property.
1564
    def LastApprovalRequest_dbus_property(self):
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1565
        return datetime_to_dbus(self.last_approval_request)
442 by Teddy Hogeborn
* DBUS-API: Document new "LastApprovalRequest" client property.
1566
    
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1567
    # Timeout - property
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1568
    @dbus_service_property(_interface,
1569
                           signature="t",
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1570
                           access="readwrite")
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1571
    def Timeout_dbus_property(self, value=None):
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1572
        if value is None:       # get
723.1.6 by Teddy Hogeborn
Use the new .total_seconds() method on datetime.timedelta objects.
1573
            return dbus.UInt64(self.timeout.total_seconds() * 1000)
581 by Teddy Hogeborn
* mandos (Client.enable, Client.disable, ClientDBus.approve): Call
1574
        old_timeout = self.timeout
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1575
        self.timeout = datetime.timedelta(0, 0, 0, value)
581 by Teddy Hogeborn
* mandos (Client.enable, Client.disable, ClientDBus.approve): Call
1576
        # Reschedule disabling
543 by Teddy Hogeborn
* mandos: Break some long lines.
1577
        if self.enabled:
1578
            now = datetime.datetime.utcnow()
581 by Teddy Hogeborn
* mandos (Client.enable, Client.disable, ClientDBus.approve): Call
1579
            self.expires += self.timeout - old_timeout
1580
            if self.expires <= now:
543 by Teddy Hogeborn
* mandos: Break some long lines.
1581
                # The timeout has passed
1582
                self.disable()
1583
            else:
1584
                if (getattr(self, "disable_initiator_tag", None)
1585
                    is None):
1586
                    return
1587
                gobject.source_remove(self.disable_initiator_tag)
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1588
                self.disable_initiator_tag = gobject.timeout_add(
1589
                    int((self.expires - now).total_seconds() * 1000),
1590
                    self.disable)
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
1591
    
24.1.179 by Björn Påhlsson
New feature:
1592
    # ExtendedTimeout - property
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1593
    @dbus_service_property(_interface,
1594
                           signature="t",
24.1.179 by Björn Påhlsson
New feature:
1595
                           access="readwrite")
1596
    def ExtendedTimeout_dbus_property(self, value=None):
1597
        if value is None:       # get
723.1.6 by Teddy Hogeborn
Use the new .total_seconds() method on datetime.timedelta objects.
1598
            return dbus.UInt64(self.extended_timeout.total_seconds()
1599
                               * 1000)
24.1.179 by Björn Påhlsson
New feature:
1600
        self.extended_timeout = datetime.timedelta(0, 0, 0, value)
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
1601
    
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1602
    # Interval - property
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1603
    @dbus_service_property(_interface,
1604
                           signature="t",
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1605
                           access="readwrite")
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1606
    def Interval_dbus_property(self, value=None):
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1607
        if value is None:       # get
723.1.6 by Teddy Hogeborn
Use the new .total_seconds() method on datetime.timedelta objects.
1608
            return dbus.UInt64(self.interval.total_seconds() * 1000)
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1609
        self.interval = datetime.timedelta(0, 0, 0, value)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1610
        if getattr(self, "checker_initiator_tag", None) is None:
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1611
            return
518.2.3 by Teddy Hogeborn
Make "enabled" a client config option.
1612
        if self.enabled:
1613
            # Reschedule checker run
1614
            gobject.source_remove(self.checker_initiator_tag)
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1615
            self.checker_initiator_tag = gobject.timeout_add(
1616
                value, self.start_checker)
1617
            self.start_checker() # Start one now, too
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
1618
    
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1619
    # Checker - property
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1620
    @dbus_service_property(_interface,
1621
                           signature="s",
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1622
                           access="readwrite")
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1623
    def Checker_dbus_property(self, value=None):
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1624
        if value is None:       # get
1625
            return dbus.String(self.checker_command)
730 by Teddy Hogeborn
mandos: Replace unicode() with str().
1626
        self.checker_command = str(value)
237.1.2 by Teddy Hogeborn
Further steps towards a D-Bus server interface, plus minor syntax
1627
    
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1628
    # CheckerRunning - property
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1629
    @dbus_service_property(_interface,
1630
                           signature="b",
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1631
                           access="readwrite")
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1632
    def CheckerRunning_dbus_property(self, value=None):
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1633
        if value is None:       # get
1634
            return dbus.Boolean(self.checker is not None)
1635
        if value:
1636
            self.start_checker()
1637
        else:
1638
            self.stop_checker()
1639
    
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1640
    # ObjectPath - property
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1641
    @dbus_service_property(_interface, signature="o", access="read")
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1642
    def ObjectPath_dbus_property(self):
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1643
        return self.dbus_object_path # is already a dbus.ObjectPath
1644
    
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1645
    # Secret = property
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1646
    @dbus_service_property(_interface,
1647
                           signature="ay",
1648
                           access="write",
1649
                           byte_arrays=True)
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1650
    def Secret_dbus_property(self, value):
729 by Teddy Hogeborn
mandos: Stop using str() and remove unnecessary unicode() calls.
1651
        self.secret = bytes(value)
237.1.2 by Teddy Hogeborn
Further steps towards a D-Bus server interface, plus minor syntax
1652
    
1653
    del _interface
3 by Björn Påhlsson
Python based server
1654
1655
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1656
class ProxyClient(object):
1657
    def __init__(self, child_pipe, fpr, address):
1658
        self._pipe = child_pipe
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1659
        self._pipe.send(('init', fpr, address))
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1660
        if not self._pipe.recv():
1661
            raise KeyError()
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
1662
    
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1663
    def __getattribute__(self, name):
518.2.4 by Teddy Hogeborn
* mandos (_timedelta_to_milliseconds): Renamed to
1664
        if name == '_pipe':
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1665
            return super(ProxyClient, self).__getattribute__(name)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1666
        self._pipe.send(('getattr', name))
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1667
        data = self._pipe.recv()
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1668
        if data[0] == 'data':
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1669
            return data[1]
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1670
        if data[0] == 'function':
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1671
            
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1672
            def func(*args, **kwargs):
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1673
                self._pipe.send(('funcall', name, args, kwargs))
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1674
                return self._pipe.recv()[1]
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1675
            
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1676
            return func
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
1677
    
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1678
    def __setattr__(self, name, value):
518.2.4 by Teddy Hogeborn
* mandos (_timedelta_to_milliseconds): Renamed to
1679
        if name == '_pipe':
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1680
            return super(ProxyClient, self).__setattr__(name, value)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1681
        self._pipe.send(('setattr', name, value))
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1682
518.1.6 by Teddy Hogeborn
* mandos: Fix whitespace.
1683
335 by Teddy Hogeborn
* mandos: Import "SocketServer" as "socketserver" and "ConfigParser"
1684
class ClientHandler(socketserver.BaseRequestHandler, object):
331 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
1685
    """A class to handle client connections.
1686
    
1687
    Instantiated once for each connection to handle it.
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
1688
    Note: This will run in its own forked process."""
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
1689
    
3 by Björn Påhlsson
Python based server
1690
    def handle(self):
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1691
        with contextlib.closing(self.server.child_pipe) as child_pipe:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1692
            logger.info("TCP connection from: %s",
730 by Teddy Hogeborn
mandos: Replace unicode() with str().
1693
                        str(self.client_address))
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1694
            logger.debug("Pipe FD: %d",
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1695
                         self.server.child_pipe.fileno())
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
1696
            
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1697
            session = gnutls.connection.ClientSession(
1698
                self.request, gnutls.connection .X509Credentials())
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
1699
            
288.1.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
1700
            # Note: gnutls.connection.X509Credentials is really a
1701
            # generic GnuTLS certificate credentials object so long as
1702
            # no X.509 keys are added to it.  Therefore, we can use it
1703
            # here despite using OpenPGP certificates.
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
1704
            
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1705
            #priority = ':'.join(("NONE", "+VERS-TLS1.1",
1706
            #                      "+AES-256-CBC", "+SHA1",
1707
            #                      "+COMP-NULL", "+CTYPE-OPENPGP",
1708
            #                      "+DHE-DSS"))
288.1.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
1709
            # Use a fallback default, since this MUST be set.
331 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
1710
            priority = self.server.gnutls_priority
1711
            if priority is None:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1712
                priority = "NORMAL"
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1713
            gnutls.library.functions.gnutls_priority_set_direct(
1714
                session._c_object, priority, None)
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
1715
            
416.1.2 by Teddy Hogeborn
* mandos (ClientHandler.handle): Set up the GnuTLS session object
1716
            # Start communication using the Mandos protocol
1717
            # Get protocol number
1718
            line = self.request.makefile().readline()
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1719
            logger.debug("Protocol version: %r", line)
416.1.2 by Teddy Hogeborn
* mandos (ClientHandler.handle): Set up the GnuTLS session object
1720
            try:
1721
                if int(line.strip().split()[0]) > 1:
642 by Teddy Hogeborn
Syntax fix; use "raise" better in Mandos server.
1722
                    raise RuntimeError(line)
482 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
1723
            except (ValueError, IndexError, RuntimeError) as error:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1724
                logger.error("Unknown protocol version: %s", error)
416.1.2 by Teddy Hogeborn
* mandos (ClientHandler.handle): Set up the GnuTLS session object
1725
                return
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
1726
            
416.1.2 by Teddy Hogeborn
* mandos (ClientHandler.handle): Set up the GnuTLS session object
1727
            # Start GnuTLS connection
288.1.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
1728
            try:
1729
                session.handshake()
482 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
1730
            except gnutls.errors.GNUTLSError as error:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1731
                logger.warning("Handshake failed: %s", error)
288.1.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
1732
                # Do not run session.bye() here: the session is not
1733
                # established.  Just abandon the request.
1734
                return
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1735
            logger.debug("Handshake succeeded")
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
1736
            
24.1.150 by Björn Påhlsson
* mandos: Added ClientDBus.approve_pending property. Exposed
1737
            approval_required = False
288.1.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
1738
            try:
411 by Teddy Hogeborn
More consistent terminology: Clients are no longer "invalid" - they
1739
                try:
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1740
                    fpr = self.fingerprint(
1741
                        self.peer_certificate(session))
482 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
1742
                except (TypeError,
1743
                        gnutls.errors.GNUTLSError) as error:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1744
                    logger.warning("Bad certificate: %s", error)
411 by Teddy Hogeborn
More consistent terminology: Clients are no longer "invalid" - they
1745
                    return
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1746
                logger.debug("Fingerprint: %s", fpr)
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
1747
                
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1748
                try:
1749
                    client = ProxyClient(child_pipe, fpr,
1750
                                         self.client_address)
1751
                except KeyError:
411 by Teddy Hogeborn
More consistent terminology: Clients are no longer "invalid" - they
1752
                    return
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1753
                
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1754
                if client.approval_delay:
1755
                    delay = client.approval_delay
24.1.150 by Björn Påhlsson
* mandos: Added ClientDBus.approve_pending property. Exposed
1756
                    client.approvals_pending += 1
1757
                    approval_required = True
1758
                
24.1.148 by Björn Påhlsson
half working on-demand password and approved code
1759
                while True:
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1760
                    if not client.enabled:
24.1.174 by Björn Påhlsson
* Makefile (CFLAGS): Added "-lrt" to include real time library.
1761
                        logger.info("Client %s is disabled",
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1762
                                    client.name)
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1763
                        if self.server.use_dbus:
1764
                            # Emit D-Bus signal
505.1.3 by Teddy Hogeborn
* mandos: Break long lines.
1765
                            client.Rejected("Disabled")
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1766
                        return
24.1.150 by Björn Påhlsson
* mandos: Added ClientDBus.approve_pending property. Exposed
1767
                    
518.2.4 by Teddy Hogeborn
* mandos (_timedelta_to_milliseconds): Renamed to
1768
                    if client.approved or not client.approval_delay:
24.1.150 by Björn Påhlsson
* mandos: Added ClientDBus.approve_pending property. Exposed
1769
                        #We are approved or approval is disabled
1770
                        break
518.2.4 by Teddy Hogeborn
* mandos (_timedelta_to_milliseconds): Renamed to
1771
                    elif client.approved is None:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1772
                        logger.info("Client %s needs approval",
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1773
                                    client.name)
1774
                        if self.server.use_dbus:
1775
                            # Emit D-Bus signal
1776
                            client.NeedApproval(
723.1.6 by Teddy Hogeborn
Use the new .total_seconds() method on datetime.timedelta objects.
1777
                                client.approval_delay.total_seconds()
1778
                                * 1000, client.approved_by_default)
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1779
                    else:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1780
                        logger.warning("Client %s was not approved",
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1781
                                       client.name)
1782
                        if self.server.use_dbus:
24.1.150 by Björn Påhlsson
* mandos: Added ClientDBus.approve_pending property. Exposed
1783
                            # Emit D-Bus signal
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1784
                            client.Rejected("Denied")
24.1.148 by Björn Påhlsson
half working on-demand password and approved code
1785
                        return
1786
                    
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1787
                    #wait until timeout or approved
1788
                    time = datetime.datetime.now()
1789
                    client.changedstate.acquire()
723.1.6 by Teddy Hogeborn
Use the new .total_seconds() method on datetime.timedelta objects.
1790
                    client.changedstate.wait(delay.total_seconds())
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1791
                    client.changedstate.release()
1792
                    time2 = datetime.datetime.now()
1793
                    if (time2 - time) >= delay:
1794
                        if not client.approved_by_default:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1795
                            logger.warning("Client %s timed out while"
1796
                                           " waiting for approval",
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1797
                                           client.name)
1798
                            if self.server.use_dbus:
1799
                                # Emit D-Bus signal
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1800
                                client.Rejected("Approval timed out")
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1801
                            return
1802
                        else:
1803
                            break
1804
                    else:
1805
                        delay -= time2 - time
1806
                
411 by Teddy Hogeborn
More consistent terminology: Clients are no longer "invalid" - they
1807
                sent_size = 0
1808
                while sent_size < len(client.secret):
24.1.155 by Björn Påhlsson
mandos server: Added debuglevel that adjust at what level information
1809
                    try:
1810
                        sent = session.send(client.secret[sent_size:])
482 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
1811
                    except gnutls.errors.GNUTLSError as error:
574 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
1812
                        logger.warning("gnutls send failed",
1813
                                       exc_info=error)
24.1.155 by Björn Påhlsson
mandos server: Added debuglevel that adjust at what level information
1814
                        return
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1815
                    logger.debug("Sent: %d, remaining: %d", sent,
1816
                                 len(client.secret) - (sent_size
1817
                                                       + sent))
411 by Teddy Hogeborn
More consistent terminology: Clients are no longer "invalid" - they
1818
                    sent_size += sent
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
1819
                
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1820
                logger.info("Sending secret to %s", client.name)
505.1.13 by Teddy Hogeborn
Miscellaneous fixes prompted by lintian:
1821
                # bump the timeout using extended_timeout
556 by Teddy Hogeborn
* DBUS-API (se.recompile.Mandos.Client.LastCheckerStatus): New
1822
                client.bump_timeout(client.extended_timeout)
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1823
                if self.server.use_dbus:
1824
                    # Emit D-Bus signal
1825
                    client.GotSecret()
24.1.150 by Björn Påhlsson
* mandos: Added ClientDBus.approve_pending property. Exposed
1826
            
411 by Teddy Hogeborn
More consistent terminology: Clients are no longer "invalid" - they
1827
            finally:
24.1.150 by Björn Påhlsson
* mandos: Added ClientDBus.approve_pending property. Exposed
1828
                if approval_required:
1829
                    client.approvals_pending -= 1
24.1.155 by Björn Påhlsson
mandos server: Added debuglevel that adjust at what level information
1830
                try:
1831
                    session.bye()
482 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
1832
                except gnutls.errors.GNUTLSError as error:
574 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
1833
                    logger.warning("GnuTLS bye failed",
1834
                                   exc_info=error)
330 by Teddy Hogeborn
* mandos (peer_certificate, fingerprint): Moved into "TCP_handler"
1835
    
1836
    @staticmethod
1837
    def peer_certificate(session):
1838
        "Return the peer's OpenPGP certificate as a bytestring"
1839
        # If not an OpenPGP certificate...
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1840
        if (gnutls.library.functions.gnutls_certificate_type_get(
1841
                session._c_object)
330 by Teddy Hogeborn
* mandos (peer_certificate, fingerprint): Moved into "TCP_handler"
1842
            != gnutls.library.constants.GNUTLS_CRT_OPENPGP):
1843
            # ...do the normal thing
1844
            return session.peer_certificate
1845
        list_size = ctypes.c_uint(1)
1846
        cert_list = (gnutls.library.functions
1847
                     .gnutls_certificate_get_peers
1848
                     (session._c_object, ctypes.byref(list_size)))
1849
        if not bool(cert_list) and list_size.value != 0:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1850
            raise gnutls.errors.GNUTLSError("error getting peer"
1851
                                            " certificate")
330 by Teddy Hogeborn
* mandos (peer_certificate, fingerprint): Moved into "TCP_handler"
1852
        if list_size.value == 0:
1853
            return None
1854
        cert = cert_list[0]
1855
        return ctypes.string_at(cert.data, cert.size)
1856
    
1857
    @staticmethod
1858
    def fingerprint(openpgp):
1859
        "Convert an OpenPGP bytestring to a hexdigit fingerprint"
1860
        # New GnuTLS "datum" with the OpenPGP public key
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1861
        datum = gnutls.library.types.gnutls_datum_t(
1862
            ctypes.cast(ctypes.c_char_p(openpgp),
1863
                        ctypes.POINTER(ctypes.c_ubyte)),
1864
            ctypes.c_uint(len(openpgp)))
330 by Teddy Hogeborn
* mandos (peer_certificate, fingerprint): Moved into "TCP_handler"
1865
        # New empty GnuTLS certificate
1866
        crt = gnutls.library.types.gnutls_openpgp_crt_t()
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1867
        gnutls.library.functions.gnutls_openpgp_crt_init(
1868
            ctypes.byref(crt))
330 by Teddy Hogeborn
* mandos (peer_certificate, fingerprint): Moved into "TCP_handler"
1869
        # Import the OpenPGP public key into the certificate
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1870
        gnutls.library.functions.gnutls_openpgp_crt_import(
1871
            crt, ctypes.byref(datum),
1872
            gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
330 by Teddy Hogeborn
* mandos (peer_certificate, fingerprint): Moved into "TCP_handler"
1873
        # Verify the self signature in the key
1874
        crtverify = ctypes.c_uint()
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1875
        gnutls.library.functions.gnutls_openpgp_crt_verify_self(
1876
            crt, 0, ctypes.byref(crtverify))
330 by Teddy Hogeborn
* mandos (peer_certificate, fingerprint): Moved into "TCP_handler"
1877
        if crtverify.value != 0:
1878
            gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1879
            raise gnutls.errors.CertificateSecurityError(
1880
                "Verify failed")
330 by Teddy Hogeborn
* mandos (peer_certificate, fingerprint): Moved into "TCP_handler"
1881
        # New buffer for the fingerprint
1882
        buf = ctypes.create_string_buffer(20)
1883
        buf_len = ctypes.c_size_t()
1884
        # Get the fingerprint from the certificate into the buffer
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1885
        gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint(
1886
            crt, ctypes.byref(buf), ctypes.byref(buf_len))
330 by Teddy Hogeborn
* mandos (peer_certificate, fingerprint): Moved into "TCP_handler"
1887
        # Deinit the certificate
1888
        gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1889
        # Convert the buffer to a Python bytestring
1890
        fpr = ctypes.string_at(buf, buf_len.value)
1891
        # Convert the bytestring to hexadecimal notation
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
1892
        hex_fpr = binascii.hexlify(fpr).upper()
330 by Teddy Hogeborn
* mandos (peer_certificate, fingerprint): Moved into "TCP_handler"
1893
        return hex_fpr
288.1.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
1894
1895
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1896
class MultiprocessingMixIn(object):
1897
    """Like socketserver.ThreadingMixIn, but with multiprocessing"""
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1898
    
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1899
    def sub_process_main(self, request, address):
1900
        try:
1901
            self.finish_request(request, address)
518.1.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
1902
        except Exception:
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1903
            self.handle_error(request, address)
1904
        self.close_request(request)
505.1.11 by Teddy Hogeborn
* mandos (Client.checked_ok): Set "expires" after setting timeout.
1905
    
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1906
    def process_request(self, request, address):
1907
        """Start a new process to process the request."""
505.1.11 by Teddy Hogeborn
* mandos (Client.checked_ok): Set "expires" after setting timeout.
1908
        proc = multiprocessing.Process(target = self.sub_process_main,
579 by Teddy Hogeborn
* mandos: Use all new builtins.
1909
                                       args = (request, address))
505.1.11 by Teddy Hogeborn
* mandos (Client.checked_ok): Set "expires" after setting timeout.
1910
        proc.start()
1911
        return proc
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1912
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
1913
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1914
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
1915
    """ adds a pipe to the MixIn """
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1916
    
288.1.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
1917
    def process_request(self, request, client_address):
331 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
1918
        """Overrides and wraps the original process_request().
1919
        
355 by Teddy Hogeborn
* mandos: White-space fixes only.
1920
        This function creates a new pipe in self.pipe
288.1.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
1921
        """
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1922
        parent_pipe, self.child_pipe = multiprocessing.Pipe()
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
1923
        
505.1.11 by Teddy Hogeborn
* mandos (Client.checked_ok): Set "expires" after setting timeout.
1924
        proc = MultiprocessingMixIn.process_request(self, request,
1925
                                                    client_address)
24.1.152 by Björn Påhlsson
bug fixes that prevent problems when runing server as root
1926
        self.child_pipe.close()
505.1.11 by Teddy Hogeborn
* mandos (Client.checked_ok): Set "expires" after setting timeout.
1927
        self.add_pipe(parent_pipe, proc)
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
1928
    
505.1.11 by Teddy Hogeborn
* mandos (Client.checked_ok): Set "expires" after setting timeout.
1929
    def add_pipe(self, parent_pipe, proc):
288.1.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
1930
        """Dummy function; override as necessary"""
642 by Teddy Hogeborn
Syntax fix; use "raise" better in Mandos server.
1931
        raise NotImplementedError()
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1932
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
1933
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1934
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
335 by Teddy Hogeborn
* mandos: Import "SocketServer" as "socketserver" and "ConfigParser"
1935
                     socketserver.TCPServer, object):
237.2.13 by Teddy Hogeborn
Merge from trunk. Notable changes:
1936
    """IPv6-capable TCP server.  Accepts 'None' as address and/or port
331 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
1937
    
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
1938
    Attributes:
331 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
1939
        enabled:        Boolean; whether this server is activated yet
1940
        interface:      None or a network interface name (string)
1941
        use_ipv6:       Boolean; to use IPv6 or not
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
1942
    """
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1943
    
331 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
1944
    def __init__(self, server_address, RequestHandlerClass,
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1945
                 interface=None,
1946
                 use_ipv6=True,
1947
                 socketfd=None):
589.1.1 by Teddy Hogeborn
* mandos: Implement "--socket" option.
1948
        """If socketfd is set, use that file descriptor instead of
1949
        creating a new one with socket.socket().
1950
        """
331 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
1951
        self.interface = interface
1952
        if use_ipv6:
1953
            self.address_family = socket.AF_INET6
589.1.1 by Teddy Hogeborn
* mandos: Implement "--socket" option.
1954
        if socketfd is not None:
1955
            # Save the file descriptor
1956
            self.socketfd = socketfd
1957
            # Save the original socket.socket() function
1958
            self.socket_socket = socket.socket
1959
            # To implement --socket, we monkey patch socket.socket.
1960
            # 
1961
            # (When socketserver.TCPServer is a new-style class, we
1962
            # could make self.socket into a property instead of monkey
1963
            # patching socket.socket.)
1964
            # 
1965
            # Create a one-time-only replacement for socket.socket()
1966
            @functools.wraps(socket.socket)
1967
            def socket_wrapper(*args, **kwargs):
1968
                # Restore original function so subsequent calls are
1969
                # not affected.
1970
                socket.socket = self.socket_socket
1971
                del self.socket_socket
1972
                # This time only, return a new socket object from the
1973
                # saved file descriptor.
1974
                return socket.fromfd(self.socketfd, *args, **kwargs)
1975
            # Replace socket.socket() function with wrapper
1976
            socket.socket = socket_wrapper
1977
        # The socketserver.TCPServer.__init__ will call
1978
        # socket.socket(), which might be our replacement,
1979
        # socket_wrapper(), if socketfd was set.
335 by Teddy Hogeborn
* mandos: Import "SocketServer" as "socketserver" and "ConfigParser"
1980
        socketserver.TCPServer.__init__(self, server_address,
331 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
1981
                                        RequestHandlerClass)
589.1.1 by Teddy Hogeborn
* mandos: Implement "--socket" option.
1982
    
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
1983
    def server_bind(self):
1984
        """This overrides the normal server_bind() function
1985
        to bind to an interface if one was specified, and also NOT to
1986
        bind to an address or port if they were not specified."""
331 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
1987
        if self.interface is not None:
338 by Teddy Hogeborn
* mandos: Minor doc string fixes.
1988
            if SO_BINDTODEVICE is None:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1989
                logger.error("SO_BINDTODEVICE does not exist;"
1990
                             " cannot bind to interface %s",
338 by Teddy Hogeborn
* mandos: Minor doc string fixes.
1991
                             self.interface)
1992
            else:
1993
                try:
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1994
                    self.socket.setsockopt(
1995
                        socket.SOL_SOCKET, SO_BINDTODEVICE,
1996
                        (self.interface + "\0").encode("utf-8"))
482 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
1997
                except socket.error as error:
582 by Teddy Hogeborn
* mandos (IPv6_TCPServer.server_bind): Bug fix: handle non-existing
1998
                    if error.errno == errno.EPERM:
606 by Teddy Hogeborn
* mandos: New "--foreground" option.
1999
                        logger.error("No permission to bind to"
2000
                                     " interface %s", self.interface)
582 by Teddy Hogeborn
* mandos (IPv6_TCPServer.server_bind): Bug fix: handle non-existing
2001
                    elif error.errno == errno.ENOPROTOOPT:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2002
                        logger.error("SO_BINDTODEVICE not available;"
2003
                                     " cannot bind to interface %s",
338 by Teddy Hogeborn
* mandos: Minor doc string fixes.
2004
                                     self.interface)
582 by Teddy Hogeborn
* mandos (IPv6_TCPServer.server_bind): Bug fix: handle non-existing
2005
                    elif error.errno == errno.ENODEV:
606 by Teddy Hogeborn
* mandos: New "--foreground" option.
2006
                        logger.error("Interface %s does not exist,"
2007
                                     " cannot bind", self.interface)
338 by Teddy Hogeborn
* mandos: Minor doc string fixes.
2008
                    else:
2009
                        raise
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
2010
        # Only bind(2) the socket if we really need to.
2011
        if self.server_address[0] or self.server_address[1]:
2012
            if not self.server_address[0]:
314 by Teddy Hogeborn
Support not using IPv6 in server:
2013
                if self.address_family == socket.AF_INET6:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2014
                    any_address = "::" # in6addr_any
314 by Teddy Hogeborn
Support not using IPv6 in server:
2015
                else:
618 by Teddy Hogeborn
* mandos: Bug fix: Make boolean options work from the config file
2016
                    any_address = "0.0.0.0" # INADDR_ANY
314 by Teddy Hogeborn
Support not using IPv6 in server:
2017
                self.server_address = (any_address,
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
2018
                                       self.server_address[1])
49 by Teddy Hogeborn
* mandos (IPv6_TCPServer.server_bind): Bug fix: allow port to be empty
2019
            elif not self.server_address[1]:
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2020
                self.server_address = (self.server_address[0], 0)
331 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
2021
#                 if self.interface:
49 by Teddy Hogeborn
* mandos (IPv6_TCPServer.server_bind): Bug fix: allow port to be empty
2022
#                     self.server_address = (self.server_address[0],
2023
#                                            0, # port
2024
#                                            0, # flowinfo
2025
#                                            if_nametoindex
331 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
2026
#                                            (self.interface))
335 by Teddy Hogeborn
* mandos: Import "SocketServer" as "socketserver" and "ConfigParser"
2027
            return socketserver.TCPServer.server_bind(self)
339 by Teddy Hogeborn
Code cleanup.
2028
2029
2030
class MandosServer(IPv6_TCPServer):
2031
    """Mandos server.
2032
    
2033
    Attributes:
2034
        clients:        set of Client objects
2035
        gnutls_priority GnuTLS priority string
2036
        use_dbus:       Boolean; to emit D-Bus signals or not
340 by Teddy Hogeborn
Code cleanup.
2037
    
2038
    Assumes a gobject.MainLoop event loop.
339 by Teddy Hogeborn
Code cleanup.
2039
    """
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2040
    
339 by Teddy Hogeborn
Code cleanup.
2041
    def __init__(self, server_address, RequestHandlerClass,
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2042
                 interface=None,
2043
                 use_ipv6=True,
2044
                 clients=None,
2045
                 gnutls_priority=None,
2046
                 use_dbus=True,
2047
                 socketfd=None):
339 by Teddy Hogeborn
Code cleanup.
2048
        self.enabled = False
2049
        self.clients = clients
341 by Teddy Hogeborn
Code cleanup and one bug fix.
2050
        if self.clients is None:
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
2051
            self.clients = {}
339 by Teddy Hogeborn
Code cleanup.
2052
        self.use_dbus = use_dbus
2053
        self.gnutls_priority = gnutls_priority
2054
        IPv6_TCPServer.__init__(self, server_address,
2055
                                RequestHandlerClass,
2056
                                interface = interface,
589.1.1 by Teddy Hogeborn
* mandos: Implement "--socket" option.
2057
                                use_ipv6 = use_ipv6,
2058
                                socketfd = socketfd)
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2059
    
163 by Teddy Hogeborn
* Makefile (PIDDIR, USER, GROUP): Removed.
2060
    def server_activate(self):
2061
        if self.enabled:
335 by Teddy Hogeborn
* mandos: Import "SocketServer" as "socketserver" and "ConfigParser"
2062
            return socketserver.TCPServer.server_activate(self)
505.1.11 by Teddy Hogeborn
* mandos (Client.checked_ok): Set "expires" after setting timeout.
2063
    
163 by Teddy Hogeborn
* Makefile (PIDDIR, USER, GROUP): Removed.
2064
    def enable(self):
2065
        self.enabled = True
505.1.11 by Teddy Hogeborn
* mandos (Client.checked_ok): Set "expires" after setting timeout.
2066
    
2067
    def add_pipe(self, parent_pipe, proc):
340 by Teddy Hogeborn
Code cleanup.
2068
        # Call "handle_ipc" for both data and EOF events
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2069
        gobject.io_add_watch(
2070
            parent_pipe.fileno(),
2071
            gobject.IO_IN | gobject.IO_HUP,
2072
            functools.partial(self.handle_ipc,
2073
                              parent_pipe = parent_pipe,
2074
                              proc = proc))
505.1.9 by Teddy Hogeborn
Whitespace
2075
    
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2076
    def handle_ipc(self, source, condition,
2077
                   parent_pipe=None,
2078
                   proc = None,
2079
                   client_object=None):
505.1.13 by Teddy Hogeborn
Miscellaneous fixes prompted by lintian:
2080
        # error, or the other end of multiprocessing.Pipe has closed
577 by Teddy Hogeborn
* mandos (Client.start_checker): Reworded comment.
2081
        if condition & (gobject.IO_ERR | gobject.IO_HUP):
505.1.13 by Teddy Hogeborn
Miscellaneous fixes prompted by lintian:
2082
            # Wait for other process to exit
505.1.11 by Teddy Hogeborn
* mandos (Client.checked_ok): Set "expires" after setting timeout.
2083
            proc.join()
24.1.152 by Björn Påhlsson
bug fixes that prevent problems when runing server as root
2084
            return False
288.1.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
2085
        
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2086
        # Read a request from the child
2087
        request = parent_pipe.recv()
2088
        command = request[0]
2089
        
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2090
        if command == 'init':
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2091
            fpr = request[1]
2092
            address = request[2]
2093
            
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
2094
            for c in self.clients.itervalues():
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2095
                if c.fingerprint == fpr:
2096
                    client = c
2097
                    break
2098
            else:
24.1.174 by Björn Påhlsson
* Makefile (CFLAGS): Added "-lrt" to include real time library.
2099
                logger.info("Client not found for fingerprint: %s, ad"
2100
                            "dress: %s", fpr, address)
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2101
                if self.use_dbus:
2102
                    # Emit D-Bus signal
505.1.3 by Teddy Hogeborn
* mandos: Break long lines.
2103
                    mandos_dbus_service.ClientNotFound(fpr,
2104
                                                       address[0])
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2105
                parent_pipe.send(False)
2106
                return False
2107
            
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2108
            gobject.io_add_watch(
2109
                parent_pipe.fileno(),
2110
                gobject.IO_IN | gobject.IO_HUP,
2111
                functools.partial(self.handle_ipc,
2112
                                  parent_pipe = parent_pipe,
2113
                                  proc = proc,
2114
                                  client_object = client))
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2115
            parent_pipe.send(True)
505.1.3 by Teddy Hogeborn
* mandos: Break long lines.
2116
            # remove the old hook in favor of the new above hook on
2117
            # same fileno
288.1.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
2118
            return False
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2119
        if command == 'funcall':
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2120
            funcname = request[1]
2121
            args = request[2]
2122
            kwargs = request[3]
2123
            
505.1.3 by Teddy Hogeborn
* mandos: Break long lines.
2124
            parent_pipe.send(('data', getattr(client_object,
2125
                                              funcname)(*args,
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2126
                                                        **kwargs)))
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
2127
        
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2128
        if command == 'getattr':
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2129
            attrname = request[1]
2130
            if callable(client_object.__getattribute__(attrname)):
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2131
                parent_pipe.send(('function', ))
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2132
            else:
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2133
                parent_pipe.send((
2134
                    'data', client_object.__getattribute__(attrname)))
24.2.4 by teddy at bsnet
* mandos (ClientDBus.approvals_pending): Changed to be a property
2135
        
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2136
        if command == 'setattr':
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2137
            attrname = request[1]
2138
            value = request[2]
2139
            setattr(client_object, attrname, value)
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
2140
        
288.1.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
2141
        return True
10 by Teddy Hogeborn
* server.py: Bug fix: Do "from __future__ import division".
2142
3 by Björn Påhlsson
Python based server
2143
609 by Teddy Hogeborn
* clients.conf: Convert all time intervals to new RFC 3339 syntax.
2144
def rfc3339_duration_to_delta(duration):
2145
    """Parse an RFC 3339 "duration" and return a datetime.timedelta
2146
    
2147
    >>> rfc3339_duration_to_delta("P7D")
2148
    datetime.timedelta(7)
2149
    >>> rfc3339_duration_to_delta("PT60S")
2150
    datetime.timedelta(0, 60)
2151
    >>> rfc3339_duration_to_delta("PT60M")
2152
    datetime.timedelta(0, 3600)
2153
    >>> rfc3339_duration_to_delta("PT24H")
2154
    datetime.timedelta(1)
2155
    >>> rfc3339_duration_to_delta("P1W")
2156
    datetime.timedelta(7)
2157
    >>> rfc3339_duration_to_delta("PT5M30S")
2158
    datetime.timedelta(0, 330)
2159
    >>> rfc3339_duration_to_delta("P1DT3M20S")
2160
    datetime.timedelta(1, 200)
2161
    """
2162
    
2163
    # Parsing an RFC 3339 duration with regular expressions is not
2164
    # possible - there would have to be multiple places for the same
2165
    # values, like seconds.  The current code, while more esoteric, is
2166
    # cleaner without depending on a parsing library.  If Python had a
2167
    # built-in library for parsing we would use it, but we'd like to
2168
    # avoid excessive use of external libraries.
2169
    
2170
    # New type for defining tokens, syntax, and semantics all-in-one
2171
    Token = collections.namedtuple("Token",
2172
                                   ("regexp", # To match token; if
2173
                                              # "value" is not None,
2174
                                              # must have a "group"
2175
                                              # containing digits
2176
                                    "value",  # datetime.timedelta or
2177
                                              # None
2178
                                    "followers")) # Tokens valid after
2179
                                                  # this token
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2180
    Token = collections.namedtuple("Token", (
2181
        "regexp",  # To match token; if "value" is not None, must have
2182
                   # a "group" containing digits
2183
        "value",   # datetime.timedelta or None
2184
        "followers"))           # Tokens valid after this token
609 by Teddy Hogeborn
* clients.conf: Convert all time intervals to new RFC 3339 syntax.
2185
    # RFC 3339 "duration" tokens, syntax, and semantics; taken from
2186
    # the "duration" ABNF definition in RFC 3339, Appendix A.
2187
    token_end = Token(re.compile(r"$"), None, frozenset())
2188
    token_second = Token(re.compile(r"(\d+)S"),
2189
                         datetime.timedelta(seconds=1),
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2190
                         frozenset((token_end, )))
609 by Teddy Hogeborn
* clients.conf: Convert all time intervals to new RFC 3339 syntax.
2191
    token_minute = Token(re.compile(r"(\d+)M"),
2192
                         datetime.timedelta(minutes=1),
2193
                         frozenset((token_second, token_end)))
2194
    token_hour = Token(re.compile(r"(\d+)H"),
2195
                       datetime.timedelta(hours=1),
2196
                       frozenset((token_minute, token_end)))
2197
    token_time = Token(re.compile(r"T"),
2198
                       None,
2199
                       frozenset((token_hour, token_minute,
2200
                                  token_second)))
2201
    token_day = Token(re.compile(r"(\d+)D"),
2202
                      datetime.timedelta(days=1),
2203
                      frozenset((token_time, token_end)))
2204
    token_month = Token(re.compile(r"(\d+)M"),
2205
                        datetime.timedelta(weeks=4),
2206
                        frozenset((token_day, token_end)))
2207
    token_year = Token(re.compile(r"(\d+)Y"),
2208
                       datetime.timedelta(weeks=52),
2209
                       frozenset((token_month, token_end)))
2210
    token_week = Token(re.compile(r"(\d+)W"),
2211
                       datetime.timedelta(weeks=1),
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2212
                       frozenset((token_end, )))
609 by Teddy Hogeborn
* clients.conf: Convert all time intervals to new RFC 3339 syntax.
2213
    token_duration = Token(re.compile(r"P"), None,
2214
                           frozenset((token_year, token_month,
2215
                                      token_day, token_time,
721 by Teddy Hogeborn
Fix two mutually cancelling bugs.
2216
                                      token_week)))
609 by Teddy Hogeborn
* clients.conf: Convert all time intervals to new RFC 3339 syntax.
2217
    # Define starting values
2218
    value = datetime.timedelta() # Value so far
2219
    found_token = None
721 by Teddy Hogeborn
Fix two mutually cancelling bugs.
2220
    followers = frozenset((token_duration,)) # Following valid tokens
609 by Teddy Hogeborn
* clients.conf: Convert all time intervals to new RFC 3339 syntax.
2221
    s = duration                # String left to parse
2222
    # Loop until end token is found
2223
    while found_token is not token_end:
2224
        # Search for any currently valid tokens
2225
        for token in followers:
2226
            match = token.regexp.match(s)
2227
            if match is not None:
2228
                # Token found
2229
                if token.value is not None:
2230
                    # Value found, parse digits
2231
                    factor = int(match.group(1), 10)
2232
                    # Add to value so far
2233
                    value += factor * token.value
2234
                # Strip token from string
2235
                s = token.regexp.sub("", s, 1)
2236
                # Go to found token
2237
                found_token = token
2238
                # Set valid next tokens
2239
                followers = found_token.followers
2240
                break
2241
        else:
2242
            # No currently valid tokens were found
2243
            raise ValueError("Invalid RFC 3339 duration")
2244
    # End token found
2245
    return value
2246
2247
4 by Teddy Hogeborn
* server.py (Client.created, Client.next_check): New.
2248
def string_to_delta(interval):
2249
    """Parse a string and return a datetime.timedelta
290 by Teddy Hogeborn
* mandos (main): Bug fix: Do setgid before setuid. Add verbose GnuTLS
2250
    
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2251
    >>> string_to_delta('7d')
4 by Teddy Hogeborn
* server.py (Client.created, Client.next_check): New.
2252
    datetime.timedelta(7)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2253
    >>> string_to_delta('60s')
4 by Teddy Hogeborn
* server.py (Client.created, Client.next_check): New.
2254
    datetime.timedelta(0, 60)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2255
    >>> string_to_delta('60m')
4 by Teddy Hogeborn
* server.py (Client.created, Client.next_check): New.
2256
    datetime.timedelta(0, 3600)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2257
    >>> string_to_delta('24h')
4 by Teddy Hogeborn
* server.py (Client.created, Client.next_check): New.
2258
    datetime.timedelta(1)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2259
    >>> string_to_delta('1w')
4 by Teddy Hogeborn
* server.py (Client.created, Client.next_check): New.
2260
    datetime.timedelta(7)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2261
    >>> string_to_delta('5m 30s')
93 by Teddy Hogeborn
* mandos (string_to_delta): Accept a whitespace-separated sequence of
2262
    datetime.timedelta(0, 330)
4 by Teddy Hogeborn
* server.py (Client.created, Client.next_check): New.
2263
    """
609 by Teddy Hogeborn
* clients.conf: Convert all time intervals to new RFC 3339 syntax.
2264
    
2265
    try:
2266
        return rfc3339_duration_to_delta(interval)
2267
    except ValueError:
2268
        pass
2269
    
93 by Teddy Hogeborn
* mandos (string_to_delta): Accept a whitespace-separated sequence of
2270
    timevalue = datetime.timedelta(0)
2271
    for s in interval.split():
2272
        try:
729 by Teddy Hogeborn
mandos: Stop using str() and remove unnecessary unicode() calls.
2273
            suffix = s[-1]
215 by Teddy Hogeborn
* mandos: Remove unused "select" module. Import "ctypes.util".
2274
            value = int(s[:-1])
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2275
            if suffix == "d":
93 by Teddy Hogeborn
* mandos (string_to_delta): Accept a whitespace-separated sequence of
2276
                delta = datetime.timedelta(value)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2277
            elif suffix == "s":
93 by Teddy Hogeborn
* mandos (string_to_delta): Accept a whitespace-separated sequence of
2278
                delta = datetime.timedelta(0, value)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2279
            elif suffix == "m":
93 by Teddy Hogeborn
* mandos (string_to_delta): Accept a whitespace-separated sequence of
2280
                delta = datetime.timedelta(0, 0, 0, 0, value)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2281
            elif suffix == "h":
93 by Teddy Hogeborn
* mandos (string_to_delta): Accept a whitespace-separated sequence of
2282
                delta = datetime.timedelta(0, 0, 0, 0, 0, value)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2283
            elif suffix == "w":
93 by Teddy Hogeborn
* mandos (string_to_delta): Accept a whitespace-separated sequence of
2284
                delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
2285
            else:
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2286
                raise ValueError("Unknown suffix {!r}".format(suffix))
642 by Teddy Hogeborn
Syntax fix; use "raise" better in Mandos server.
2287
        except IndexError as e:
464 by Teddy Hogeborn
* debian/mandos-client.postrm (purge): Bug fix: update initramfs also
2288
            raise ValueError(*(e.args))
93 by Teddy Hogeborn
* mandos (string_to_delta): Accept a whitespace-separated sequence of
2289
        timevalue += delta
2290
    return timevalue
4 by Teddy Hogeborn
* server.py (Client.created, Client.next_check): New.
2291
8 by Teddy Hogeborn
* Makefile (client_debug): Bug fix; add quotes and / to CERT_ROOT.
2292
47 by Teddy Hogeborn
* plugbasedclient.c: Renamed to "mandos-client.c". All users changed.
2293
def daemon(nochdir = False, noclose = False):
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
2294
    """See daemon(3).  Standard BSD Unix function.
331 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
2295
    
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
2296
    This should really exist as os.daemon, but it doesn't (yet)."""
2297
    if os.fork():
2298
        sys.exit()
2299
    os.setsid()
2300
    if not nochdir:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2301
        os.chdir("/")
46 by Teddy Hogeborn
* network-protocol.txt: New.
2302
    if os.fork():
2303
        sys.exit()
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
2304
    if not noclose:
2305
        # Close all standard open file descriptors
560.1.1 by teddy at recompile
* mandos: Use os.devnull instead of os.path.devnull. Fix some white
2306
        null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
2307
        if not stat.S_ISCHR(os.fstat(null).st_mode):
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2308
            raise OSError(errno.ENODEV,
2309
                          "{} not a character device"
568 by Teddy Hogeborn
* mandos-monitor: Use new string format method.
2310
                          .format(os.devnull))
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
2311
        os.dup2(null, sys.stdin.fileno())
2312
        os.dup2(null, sys.stdout.fileno())
2313
        os.dup2(null, sys.stderr.fileno())
2314
        if null > 2:
2315
            os.close(null)
2316
2317
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
2318
def main():
327 by Teddy Hogeborn
Merge from pipe IPC branch.
2319
    
379 by Teddy Hogeborn
* mandos: Fix line lengths.
2320
    ##################################################################
327 by Teddy Hogeborn
Merge from pipe IPC branch.
2321
    # Parsing of options, both command line and config file
2322
    
474 by teddy at bsnet
* mandos: Use the new argparse library instead of optparse.
2323
    parser = argparse.ArgumentParser()
2324
    parser.add_argument("-v", "--version", action="version",
723.1.5 by Teddy Hogeborn
Use the new auto-numbered "{}" syntax for the .format() string method.
2325
                        version = "%(prog)s {}".format(version),
474 by teddy at bsnet
* mandos: Use the new argparse library instead of optparse.
2326
                        help="show version number and exit")
2327
    parser.add_argument("-i", "--interface", metavar="IF",
2328
                        help="Bind to interface IF")
2329
    parser.add_argument("-a", "--address",
2330
                        help="Address to listen for requests on")
2331
    parser.add_argument("-p", "--port", type=int,
2332
                        help="Port number to receive requests on")
2333
    parser.add_argument("--check", action="store_true",
2334
                        help="Run self-test")
2335
    parser.add_argument("--debug", action="store_true",
2336
                        help="Debug mode; run in foreground and log"
618 by Teddy Hogeborn
* mandos: Bug fix: Make boolean options work from the config file
2337
                        " to terminal", default=None)
474 by teddy at bsnet
* mandos: Use the new argparse library instead of optparse.
2338
    parser.add_argument("--debuglevel", metavar="LEVEL",
2339
                        help="Debug level for stdout output")
2340
    parser.add_argument("--priority", help="GnuTLS"
2341
                        " priority string (see GnuTLS documentation)")
2342
    parser.add_argument("--servicename",
2343
                        metavar="NAME", help="Zeroconf service name")
2344
    parser.add_argument("--configdir",
2345
                        default="/etc/mandos", metavar="DIR",
2346
                        help="Directory to search for configuration"
2347
                        " files")
2348
    parser.add_argument("--no-dbus", action="store_false",
2349
                        dest="use_dbus", help="Do not provide D-Bus"
618 by Teddy Hogeborn
* mandos: Bug fix: Make boolean options work from the config file
2350
                        " system bus interface", default=None)
474 by teddy at bsnet
* mandos: Use the new argparse library instead of optparse.
2351
    parser.add_argument("--no-ipv6", action="store_false",
618 by Teddy Hogeborn
* mandos: Bug fix: Make boolean options work from the config file
2352
                        dest="use_ipv6", help="Do not use IPv6",
2353
                        default=None)
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
2354
    parser.add_argument("--no-restore", action="store_false",
518.1.7 by Teddy Hogeborn
* mandos: Break long lines and fix some more white space.
2355
                        dest="restore", help="Do not restore stored"
618 by Teddy Hogeborn
* mandos: Bug fix: Make boolean options work from the config file
2356
                        " state", default=None)
589.1.1 by Teddy Hogeborn
* mandos: Implement "--socket" option.
2357
    parser.add_argument("--socket", type=int,
2358
                        help="Specify a file descriptor to a network"
2359
                        " socket to use instead of creating one")
518.2.2 by Teddy Hogeborn
Directory with persistent state can now be changed with the "statedir"
2360
    parser.add_argument("--statedir", metavar="DIR",
2361
                        help="Directory to save/restore state in")
606 by Teddy Hogeborn
* mandos: New "--foreground" option.
2362
    parser.add_argument("--foreground", action="store_true",
618 by Teddy Hogeborn
* mandos: Bug fix: Make boolean options work from the config file
2363
                        help="Run in foreground", default=None)
707 by Teddy Hogeborn
mandos: New "--no-zeroconf" option. Also make "--socket=0" work.
2364
    parser.add_argument("--no-zeroconf", action="store_false",
2365
                        dest="zeroconf", help="Do not use Zeroconf",
2366
                        default=None)
518.1.6 by Teddy Hogeborn
* mandos: Fix whitespace.
2367
    
474 by teddy at bsnet
* mandos: Use the new argparse library instead of optparse.
2368
    options = parser.parse_args()
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
2369
    
4 by Teddy Hogeborn
* server.py (Client.created, Client.next_check): New.
2370
    if options.check:
2371
        import doctest
654 by Teddy Hogeborn
Fix running of self-tests.
2372
        fail_count, test_count = doctest.testmod()
2373
        sys.exit(os.EX_OK if fail_count == 0 else 1)
3 by Björn Påhlsson
Python based server
2374
    
28 by Teddy Hogeborn
* server.conf: New file.
2375
    # Default values for config file for server-global settings
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2376
    server_defaults = { "interface": "",
2377
                        "address": "",
2378
                        "port": "",
2379
                        "debug": "False",
2380
                        "priority":
742 by Teddy Hogeborn
Add ":!RSA" to GnuTLS priority string, to disallow non-DHE kx.
2381
                        "SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2382
                        ":+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2383
                        "servicename": "Mandos",
2384
                        "use_dbus": "True",
2385
                        "use_ipv6": "True",
2386
                        "debuglevel": "",
518.2.2 by Teddy Hogeborn
Directory with persistent state can now be changed with the "statedir"
2387
                        "restore": "True",
589.1.1 by Teddy Hogeborn
* mandos: Implement "--socket" option.
2388
                        "socket": "",
606 by Teddy Hogeborn
* mandos: New "--foreground" option.
2389
                        "statedir": "/var/lib/mandos",
2390
                        "foreground": "False",
707 by Teddy Hogeborn
mandos: New "--no-zeroconf" option. Also make "--socket=0" work.
2391
                        "zeroconf": "True",
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2392
                    }
28 by Teddy Hogeborn
* server.conf: New file.
2393
    
2394
    # Parse config file for server-global settings
335 by Teddy Hogeborn
* mandos: Import "SocketServer" as "socketserver" and "ConfigParser"
2395
    server_config = configparser.SafeConfigParser(server_defaults)
28 by Teddy Hogeborn
* server.conf: New file.
2396
    del server_defaults
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2397
    server_config.read(os.path.join(options.configdir, "mandos.conf"))
28 by Teddy Hogeborn
* server.conf: New file.
2398
    # Convert the SafeConfigParser object to a dict
89 by Teddy Hogeborn
* Makefile: Bug fix: fixed creation of man pages for section 5 pages.
2399
    server_settings = server_config.defaults()
282 by Teddy Hogeborn
* mandos (main): Bug fix: use "getint" on the "port" config file
2400
    # Use the appropriate methods on the non-string config options
606 by Teddy Hogeborn
* mandos: New "--foreground" option.
2401
    for option in ("debug", "use_dbus", "use_ipv6", "foreground"):
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2402
        server_settings[option] = server_config.getboolean("DEFAULT",
333 by Teddy Hogeborn
Minor code cleanup; one minor bug fix.
2403
                                                           option)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2404
    if server_settings["port"]:
2405
        server_settings["port"] = server_config.getint("DEFAULT",
2406
                                                       "port")
589.1.1 by Teddy Hogeborn
* mandos: Implement "--socket" option.
2407
    if server_settings["socket"]:
2408
        server_settings["socket"] = server_config.getint("DEFAULT",
2409
                                                         "socket")
591 by Teddy Hogeborn
Merge "--socket" option for server.
2410
        # Later, stdin will, and stdout and stderr might, be dup'ed
589.1.1 by Teddy Hogeborn
* mandos: Implement "--socket" option.
2411
        # over with an opened os.devnull.  But we don't want this to
2412
        # happen with a supplied network socket.
2413
        if 0 <= server_settings["socket"] <= 2:
2414
            server_settings["socket"] = os.dup(server_settings
2415
                                               ["socket"])
28 by Teddy Hogeborn
* server.conf: New file.
2416
    del server_config
2417
    
2418
    # Override the settings from the config file with command line
2419
    # options, if set.
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2420
    for option in ("interface", "address", "port", "debug",
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2421
                   "priority", "servicename", "configdir", "use_dbus",
2422
                   "use_ipv6", "debuglevel", "restore", "statedir",
2423
                   "socket", "foreground", "zeroconf"):
28 by Teddy Hogeborn
* server.conf: New file.
2424
        value = getattr(options, option)
2425
        if value is not None:
2426
            server_settings[option] = value
2427
    del options
333 by Teddy Hogeborn
Minor code cleanup; one minor bug fix.
2428
    # Force all strings to be unicode
2429
    for option in server_settings.keys():
729 by Teddy Hogeborn
mandos: Stop using str() and remove unnecessary unicode() calls.
2430
        if isinstance(server_settings[option], bytes):
2431
            server_settings[option] = (server_settings[option]
2432
                                       .decode("utf-8"))
618 by Teddy Hogeborn
* mandos: Bug fix: Make boolean options work from the config file
2433
    # Force all boolean options to be boolean
2434
    for option in ("debug", "use_dbus", "use_ipv6", "restore",
707 by Teddy Hogeborn
mandos: New "--no-zeroconf" option. Also make "--socket=0" work.
2435
                   "foreground", "zeroconf"):
618 by Teddy Hogeborn
* mandos: Bug fix: Make boolean options work from the config file
2436
        server_settings[option] = bool(server_settings[option])
606 by Teddy Hogeborn
* mandos: New "--foreground" option.
2437
    # Debug implies foreground
2438
    if server_settings["debug"]:
2439
        server_settings["foreground"] = True
28 by Teddy Hogeborn
* server.conf: New file.
2440
    # Now we have our good server settings in "server_settings"
2441
    
327 by Teddy Hogeborn
Merge from pipe IPC branch.
2442
    ##################################################################
2443
    
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2444
    if (not server_settings["zeroconf"]
2445
        and not (server_settings["port"]
2446
                 or server_settings["socket"] != "")):
2447
        parser.error("Needs port or socket to work without Zeroconf")
707 by Teddy Hogeborn
mandos: New "--no-zeroconf" option. Also make "--socket=0" work.
2448
    
243 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
2449
    # For convenience
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2450
    debug = server_settings["debug"]
2451
    debuglevel = server_settings["debuglevel"]
2452
    use_dbus = server_settings["use_dbus"]
2453
    use_ipv6 = server_settings["use_ipv6"]
518.2.2 by Teddy Hogeborn
Directory with persistent state can now be changed with the "statedir"
2454
    stored_state_path = os.path.join(server_settings["statedir"],
2455
                                     stored_state_file)
606 by Teddy Hogeborn
* mandos: New "--foreground" option.
2456
    foreground = server_settings["foreground"]
707 by Teddy Hogeborn
mandos: New "--no-zeroconf" option. Also make "--socket=0" work.
2457
    zeroconf = server_settings["zeroconf"]
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
2458
    
518.1.4 by Björn Påhlsson
restructured logger
2459
    if debug:
530 by teddy at bsnet
* mandos (initlogger): Take new "debug" argument; all callers changed.
2460
        initlogger(debug, logging.DEBUG)
518.1.4 by Björn Påhlsson
restructured logger
2461
    else:
2462
        if not debuglevel:
530 by teddy at bsnet
* mandos (initlogger): Take new "debug" argument; all callers changed.
2463
            initlogger(debug)
518.1.4 by Björn Påhlsson
restructured logger
2464
        else:
2465
            level = getattr(logging, debuglevel.upper())
530 by teddy at bsnet
* mandos (initlogger): Take new "debug" argument; all callers changed.
2466
            initlogger(debug, level)
518.1.4 by Björn Påhlsson
restructured logger
2467
    
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2468
    if server_settings["servicename"] != "Mandos":
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2469
        syslogger.setFormatter(
2470
            logging.Formatter('Mandos ({}) [%(process)d]:'
2471
                              ' %(levelname)s: %(message)s'.format(
2472
                                  server_settings["servicename"])))
52 by Teddy Hogeborn
* mandos: Make syslog use "/dev/log" instead of UDP to localhost.
2473
    
28 by Teddy Hogeborn
* server.conf: New file.
2474
    # Parse config file with clients
543 by Teddy Hogeborn
* mandos: Break some long lines.
2475
    client_config = configparser.SafeConfigParser(Client
2476
                                                  .client_defaults)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2477
    client_config.read(os.path.join(server_settings["configdir"],
2478
                                    "clients.conf"))
333 by Teddy Hogeborn
Minor code cleanup; one minor bug fix.
2479
    
327 by Teddy Hogeborn
Merge from pipe IPC branch.
2480
    global mandos_dbus_service
2481
    mandos_dbus_service = None
28 by Teddy Hogeborn
* server.conf: New file.
2482
    
707 by Teddy Hogeborn
mandos: New "--no-zeroconf" option. Also make "--socket=0" work.
2483
    socketfd = None
2484
    if server_settings["socket"] != "":
2485
        socketfd = server_settings["socket"]
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2486
    tcp_server = MandosServer(
2487
        (server_settings["address"], server_settings["port"]),
2488
        ClientHandler,
2489
        interface=(server_settings["interface"] or None),
2490
        use_ipv6=use_ipv6,
2491
        gnutls_priority=server_settings["priority"],
2492
        use_dbus=use_dbus,
2493
        socketfd=socketfd)
606 by Teddy Hogeborn
* mandos: New "--foreground" option.
2494
    if not foreground:
626 by Teddy Hogeborn
* Makefile (CFLAGS, LDFLAGS): Keep default flags from environment.
2495
        pidfilename = "/run/mandos.pid"
636 by Teddy Hogeborn
Fall back to /var/run for pidfile if /run is not a directory.
2496
        if not os.path.isdir("/run/."):
2497
            pidfilename = "/var/run/mandos.pid"
606 by Teddy Hogeborn
* mandos: New "--foreground" option.
2498
        pidfile = None
439 by Teddy Hogeborn
* mandos: Do not write pid file if --debug is passed.
2499
        try:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2500
            pidfile = open(pidfilename, "w")
574 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
2501
        except IOError as e:
2502
            logger.error("Could not open file %r", pidfilename,
2503
                         exc_info=e)
164 by Teddy Hogeborn
* mandos: Open the PID file before daemonizing, but write to it
2504
    
566 by Teddy Hogeborn
* mandos (main): Simplify and shorten code selecting user and group ID
2505
    for name in ("_mandos", "mandos", "nobody"):
238 by Teddy Hogeborn
First version of a somewhat complete D-Bus server interface. Also
2506
        try:
566 by Teddy Hogeborn
* mandos (main): Simplify and shorten code selecting user and group ID
2507
            uid = pwd.getpwnam(name).pw_uid
2508
            gid = pwd.getpwnam(name).pw_gid
2509
            break
238 by Teddy Hogeborn
First version of a somewhat complete D-Bus server interface. Also
2510
        except KeyError:
566 by Teddy Hogeborn
* mandos (main): Simplify and shorten code selecting user and group ID
2511
            continue
2512
    else:
2513
        uid = 65534
2514
        gid = 65534
163 by Teddy Hogeborn
* Makefile (PIDDIR, USER, GROUP): Removed.
2515
    try:
290 by Teddy Hogeborn
* mandos (main): Bug fix: Do setgid before setuid. Add verbose GnuTLS
2516
        os.setgid(gid)
163 by Teddy Hogeborn
* Makefile (PIDDIR, USER, GROUP): Removed.
2517
        os.setuid(uid)
482 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
2518
    except OSError as error:
583 by Teddy Hogeborn
* mandos (Client.start_checker): Remove undocumented support for "%%s"
2519
        if error.errno != errno.EPERM:
642 by Teddy Hogeborn
Syntax fix; use "raise" better in Mandos server.
2520
            raise
164 by Teddy Hogeborn
* mandos: Open the PID file before daemonizing, but write to it
2521
    
290 by Teddy Hogeborn
* mandos (main): Bug fix: Do setgid before setuid. Add verbose GnuTLS
2522
    if debug:
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2523
        # Enable all possible GnuTLS debugging
2524
        
290 by Teddy Hogeborn
* mandos (main): Bug fix: Do setgid before setuid. Add verbose GnuTLS
2525
        # "Use a log level over 10 to enable all debugging options."
2526
        # - GnuTLS manual
2527
        gnutls.library.functions.gnutls_global_set_log_level(11)
2528
        
2529
        @gnutls.library.types.gnutls_log_func
2530
        def debug_gnutls(level, string):
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2531
            logger.debug("GnuTLS: %s", string[:-1])
290 by Teddy Hogeborn
* mandos (main): Bug fix: Do setgid before setuid. Add verbose GnuTLS
2532
        
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2533
        gnutls.library.functions.gnutls_global_set_log_function(
2534
            debug_gnutls)
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2535
        
24.1.155 by Björn Påhlsson
mandos server: Added debuglevel that adjust at what level information
2536
        # Redirect stdin so all checkers get /dev/null
560.1.1 by teddy at recompile
* mandos: Use os.devnull instead of os.path.devnull. Fix some white
2537
        null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
24.1.155 by Björn Påhlsson
mandos server: Added debuglevel that adjust at what level information
2538
        os.dup2(null, sys.stdin.fileno())
2539
        if null > 2:
2540
            os.close(null)
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2541
    
458 by teddy at bsnet
* mandos (main): Bug fix: Fork before connecting to D-Bus.
2542
    # Need to fork before connecting to D-Bus
606 by Teddy Hogeborn
* mandos: New "--foreground" option.
2543
    if not foreground:
458 by teddy at bsnet
* mandos (main): Bug fix: Fork before connecting to D-Bus.
2544
        # Close all input and output, do double fork, etc.
2545
        daemon()
290 by Teddy Hogeborn
* mandos (main): Bug fix: Do setgid before setuid. Add verbose GnuTLS
2546
    
590 by Teddy Hogeborn
* mandos: Change comment.
2547
    # multiprocessing will use threads, so before we use gobject we
2548
    # need to inform gobject that threads will be used.
518.2.11 by Teddy Hogeborn
* mandos (main): Tell gobject we're (or, rather, multiprocessing is)
2549
    gobject.threads_init()
2550
    
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
2551
    global main_loop
2552
    # From the Avahi example code
560.1.1 by teddy at recompile
* mandos: Use os.devnull instead of os.path.devnull. Fix some white
2553
    DBusGMainLoop(set_as_default=True)
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
2554
    main_loop = gobject.MainLoop()
2555
    bus = dbus.SystemBus()
2556
    # End of Avahi example code
243 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
2557
    if use_dbus:
402 by Teddy Hogeborn
* mandos (Client.disable): Rename keyword argument "log" to "quiet",
2558
        try:
505 by Björn Påhlsson
The domain name has changed, so the D-Bus bus and interface names must
2559
            bus_name = dbus.service.BusName("se.recompile.Mandos",
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2560
                                            bus,
2561
                                            do_not_queue=True)
2562
            old_bus_name = dbus.service.BusName(
2563
                "se.bsnet.fukt.Mandos", bus,
2564
                do_not_queue=True)
482 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
2565
        except dbus.exceptions.NameExistsException as e:
574 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
2566
            logger.error("Disabling D-Bus:", exc_info=e)
402 by Teddy Hogeborn
* mandos (Client.disable): Rename keyword argument "log" to "quiet",
2567
            use_dbus = False
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2568
            server_settings["use_dbus"] = False
402 by Teddy Hogeborn
* mandos (Client.disable): Rename keyword argument "log" to "quiet",
2569
            tcp_server.use_dbus = False
707 by Teddy Hogeborn
mandos: New "--no-zeroconf" option. Also make "--socket=0" work.
2570
    if zeroconf:
2571
        protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2572
        service = AvahiServiceToSyslog(
2573
            name = server_settings["servicename"],
2574
            servicetype = "_mandos._tcp",
2575
            protocol = protocol,
2576
            bus = bus)
707 by Teddy Hogeborn
mandos: New "--no-zeroconf" option. Also make "--socket=0" work.
2577
        if server_settings["interface"]:
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2578
            service.interface = if_nametoindex(
2579
                server_settings["interface"].encode("utf-8"))
458 by teddy at bsnet
* mandos (main): Bug fix: Fork before connecting to D-Bus.
2580
    
24.1.152 by Björn Påhlsson
bug fixes that prevent problems when runing server as root
2581
    global multiprocessing_manager
2582
    multiprocessing_manager = multiprocessing.Manager()
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
2583
    
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
2584
    client_class = Client
2585
    if use_dbus:
575 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
2586
        client_class = functools.partial(ClientDBus, bus = bus)
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
2587
    
518.1.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
2588
    client_settings = Client.config_parser(client_config)
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
2589
    old_client_settings = {}
518.1.15 by Björn Påhlsson
more refactoring in regards to how clients get created
2590
    clients_data = {}
518.1.6 by Teddy Hogeborn
* mandos: Fix whitespace.
2591
    
617 by Teddy Hogeborn
* mandos: Bug fix: Don't print output from checkers when running in
2592
    # This is used to redirect stdout and stderr for checker processes
2593
    global wnull
2594
    wnull = open(os.devnull, "w") # A writable /dev/null
2595
    # Only used if server is running in foreground but not in debug
2596
    # mode
2597
    if debug or not foreground:
2598
        wnull.close()
2599
    
518.1.7 by Teddy Hogeborn
* mandos: Break long lines and fix some more white space.
2600
    # Get client data and settings from last running state.
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
2601
    if server_settings["restore"]:
2602
        try:
2603
            with open(stored_state_path, "rb") as stored_state:
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2604
                clients_data, old_client_settings = pickle.load(
2605
                    stored_state)
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
2606
            os.remove(stored_state_path)
2607
        except IOError as e:
574 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
2608
            if e.errno == errno.ENOENT:
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2609
                logger.warning("Could not load persistent state:"
2610
                               " {}".format(os.strerror(e.errno)))
574 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
2611
            else:
2612
                logger.critical("Could not load persistent state:",
2613
                                exc_info=e)
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
2614
                raise
505.1.23 by Teddy Hogeborn
* mandos (main): Handle EOFError when reading state file.
2615
        except EOFError as e:
2616
            logger.warning("Could not load persistent state: "
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2617
                           "EOFError:",
2618
                           exc_info=e)
518.1.6 by Teddy Hogeborn
* mandos: Fix whitespace.
2619
    
518.1.9 by Björn Påhlsson
renamed variables
2620
    with PGPEngine() as pgp:
723.1.4 by Teddy Hogeborn
Use the .items() method instead of .iteritems().
2621
        for client_name, client in clients_data.items():
617 by Teddy Hogeborn
* mandos: Bug fix: Don't print output from checkers when running in
2622
            # Skip removed clients
2623
            if client_name not in client_settings:
2624
                continue
2625
            
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
2626
            # Decide which value to use after restoring saved state.
2627
            # We have three different values: Old config file,
2628
            # new config file, and saved state.
2629
            # New config value takes precedence if it differs from old
2630
            # config value, otherwise use saved state.
2631
            for name, value in client_settings[client_name].items():
2632
                try:
2633
                    # For each value in new config, check if it
2634
                    # differs from the old config value (Except for
2635
                    # the "secret" attribute)
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2636
                    if (name != "secret"
2637
                        and (value !=
2638
                             old_client_settings[client_name][name])):
518.2.10 by Teddy Hogeborn
* mandos (main): Bug fix: Syntax fix when restoring settings.
2639
                        client[name] = value
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
2640
                except KeyError:
2641
                    pass
2642
            
2643
            # Clients who has passed its expire date can still be
749.1.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
2644
            # enabled if its last checker was successful.  A Client
552 by teddy at recompile
* mandos: Consistent terminology; use the term "secret" for the
2645
            # whose checker succeeded before we stored its state is
2646
            # assumed to have successfully run all checkers during
2647
            # downtime.
518.2.8 by Teddy Hogeborn
* mandos (ClientDBus.Host_dbus_property,
2648
            if client["enabled"]:
518.1.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
2649
                if datetime.datetime.utcnow() >= client["expires"]:
2650
                    if not client["last_checked_ok"]:
2651
                        logger.warning(
723.1.5 by Teddy Hogeborn
Use the new auto-numbered "{}" syntax for the .format() string method.
2652
                            "disabling client {} - Client never "
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2653
                            "performed a successful checker".format(
2654
                                client_name))
518.1.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
2655
                        client["enabled"] = False
2656
                    elif client["last_checker_status"] != 0:
2657
                        logger.warning(
723.1.5 by Teddy Hogeborn
Use the new auto-numbered "{}" syntax for the .format() string method.
2658
                            "disabling client {} - Client last"
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2659
                            " checker failed with error code"
2660
                            " {}".format(
2661
                                client_name,
2662
                                client["last_checker_status"]))
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
2663
                        client["enabled"] = False
2664
                    else:
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2665
                        client["expires"] = (
2666
                            datetime.datetime.utcnow()
2667
                            + client["timeout"])
542 by Björn Påhlsson
fixed bug with bad stored config state for expires and last_checked_ok.
2668
                        logger.debug("Last checker succeeded,"
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2669
                                     " keeping {} enabled".format(
2670
                                         client_name))
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2671
            try:
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2672
                client["secret"] = pgp.decrypt(
2673
                    client["encrypted_secret"],
2674
                    client_settings[client_name]["secret"])
518.1.9 by Björn Påhlsson
renamed variables
2675
            except PGPError:
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
2676
                # If decryption fails, we use secret from new settings
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2677
                logger.debug("Failed to decrypt {} old secret".format(
2678
                    client_name))
2679
                client["secret"] = (client_settings[client_name]
2680
                                    ["secret"])
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
2681
    
518.1.15 by Björn Påhlsson
more refactoring in regards to how clients get created
2682
    # Add/remove clients based on new changes made to config
543 by Teddy Hogeborn
* mandos: Break some long lines.
2683
    for client_name in (set(old_client_settings)
2684
                        - set(client_settings)):
518.1.15 by Björn Påhlsson
more refactoring in regards to how clients get created
2685
        del clients_data[client_name]
543 by Teddy Hogeborn
* mandos: Break some long lines.
2686
    for client_name in (set(client_settings)
2687
                        - set(old_client_settings)):
518.1.15 by Björn Påhlsson
more refactoring in regards to how clients get created
2688
        clients_data[client_name] = client_settings[client_name]
573 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
2689
    
552 by teddy at recompile
* mandos: Consistent terminology; use the term "secret" for the
2690
    # Create all client objects
723.1.4 by Teddy Hogeborn
Use the .items() method instead of .iteritems().
2691
    for client_name, client in clients_data.items():
518.1.15 by Björn Påhlsson
more refactoring in regards to how clients get created
2692
        tcp_server.clients[client_name] = client_class(
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2693
            name = client_name,
2694
            settings = client,
617 by Teddy Hogeborn
* mandos: Bug fix: Don't print output from checkers when running in
2695
            server_settings = server_settings)
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2696
    
341 by Teddy Hogeborn
Code cleanup and one bug fix.
2697
    if not tcp_server.clients:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2698
        logger.warning("No clients defined")
573 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
2699
    
606 by Teddy Hogeborn
* mandos: New "--foreground" option.
2700
    if not foreground:
2701
        if pidfile is not None:
2702
            try:
2703
                with pidfile:
2704
                    pid = os.getpid()
729 by Teddy Hogeborn
mandos: Stop using str() and remove unnecessary unicode() calls.
2705
                    pidfile.write("{}\n".format(pid).encode("utf-8"))
606 by Teddy Hogeborn
* mandos: New "--foreground" option.
2706
            except IOError:
2707
                logger.error("Could not write to file %r with PID %d",
2708
                             pidfilename, pid)
2709
        del pidfile
439 by Teddy Hogeborn
* mandos: Do not write pid file if --debug is passed.
2710
        del pidfilename
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
2711
    
28 by Teddy Hogeborn
* server.conf: New file.
2712
    signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2713
    signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
2714
    
243 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
2715
    if use_dbus:
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2716
        
2717
        @alternate_dbus_interfaces(
2718
            { "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })
560.1.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
2719
        class MandosDBusService(DBusObjectWithProperties):
243 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
2720
            """A D-Bus proxy object"""
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2721
            
243 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
2722
            def __init__(self):
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2723
                dbus.service.Object.__init__(self, bus, "/")
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2724
            
505.1.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
2725
            _interface = "se.recompile.Mandos"
278 by Teddy Hogeborn
* mandos (Client.GetAllProperties): Also send Client.dbus_object_path
2726
            
560.1.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
2727
            @dbus_interface_annotations(_interface)
2728
            def _foo(self):
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2729
                return {
2730
                    "org.freedesktop.DBus.Property.EmitsChangedSignal":
2731
                    "false" }
560.1.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
2732
            
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2733
            @dbus.service.signal(_interface, signature="o")
411 by Teddy Hogeborn
More consistent terminology: Clients are no longer "invalid" - they
2734
            def ClientAdded(self, objpath):
243 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
2735
                "D-Bus signal"
2736
                pass
278 by Teddy Hogeborn
* mandos (Client.GetAllProperties): Also send Client.dbus_object_path
2737
            
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2738
            @dbus.service.signal(_interface, signature="ss")
409 by Teddy Hogeborn
* mandos (MandosServer.handle_ipc): Better log message.
2739
            def ClientNotFound(self, fingerprint, address):
327 by Teddy Hogeborn
Merge from pipe IPC branch.
2740
                "D-Bus signal"
2741
                pass
2742
            
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2743
            @dbus.service.signal(_interface, signature="os")
278 by Teddy Hogeborn
* mandos (Client.GetAllProperties): Also send Client.dbus_object_path
2744
            def ClientRemoved(self, objpath, name):
243 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
2745
                "D-Bus signal"
2746
                pass
278 by Teddy Hogeborn
* mandos (Client.GetAllProperties): Also send Client.dbus_object_path
2747
            
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2748
            @dbus.service.method(_interface, out_signature="ao")
243 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
2749
            def GetAllClients(self):
283 by Teddy Hogeborn
* mandos (peer_certificate): Handle NULL pointer from
2750
                "D-Bus method"
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2751
                return dbus.Array(c.dbus_object_path for c in
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
2752
                                  tcp_server.clients.itervalues())
278 by Teddy Hogeborn
* mandos (Client.GetAllProperties): Also send Client.dbus_object_path
2753
            
333 by Teddy Hogeborn
Minor code cleanup; one minor bug fix.
2754
            @dbus.service.method(_interface,
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2755
                                 out_signature="a{oa{sv}}")
243 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
2756
            def GetAllClientsWithProperties(self):
283 by Teddy Hogeborn
* mandos (peer_certificate): Handle NULL pointer from
2757
                "D-Bus method"
243 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
2758
                return dbus.Dictionary(
732 by Teddy Hogeborn
Emit D-Bus "org.freedesktop.DBus.Properties.PropertiesChanged" signal.
2759
                    { c.dbus_object_path: c.GetAll("")
2760
                      for c in tcp_server.clients.itervalues() },
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2761
                    signature="oa{sv}")
278 by Teddy Hogeborn
* mandos (Client.GetAllProperties): Also send Client.dbus_object_path
2762
            
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2763
            @dbus.service.method(_interface, in_signature="o")
243 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
2764
            def RemoveClient(self, object_path):
283 by Teddy Hogeborn
* mandos (peer_certificate): Handle NULL pointer from
2765
                "D-Bus method"
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
2766
                for c in tcp_server.clients.itervalues():
243 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
2767
                    if c.dbus_object_path == object_path:
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
2768
                        del tcp_server.clients[c.name]
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
2769
                        c.remove_from_connection()
243 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
2770
                        # Don't signal anything except ClientRemoved
402 by Teddy Hogeborn
* mandos (Client.disable): Rename keyword argument "log" to "quiet",
2771
                        c.disable(quiet=True)
243 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
2772
                        # Emit D-Bus signal
278 by Teddy Hogeborn
* mandos (Client.GetAllProperties): Also send Client.dbus_object_path
2773
                        self.ClientRemoved(object_path, c.name)
2774
                        return
400 by Teddy Hogeborn
* mandos (Client.enable): Bug fix: Start new immediate checker last to
2775
                raise KeyError(object_path)
278 by Teddy Hogeborn
* mandos (Client.GetAllProperties): Also send Client.dbus_object_path
2776
            
243 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
2777
            del _interface
278 by Teddy Hogeborn
* mandos (Client.GetAllProperties): Also send Client.dbus_object_path
2778
        
575 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
2779
        mandos_dbus_service = MandosDBusService()
238 by Teddy Hogeborn
First version of a somewhat complete D-Bus server interface. Also
2780
    
400 by Teddy Hogeborn
* mandos (Client.enable): Bug fix: Start new immediate checker last to
2781
    def cleanup():
2782
        "Cleanup function; run on exit"
707 by Teddy Hogeborn
mandos: New "--no-zeroconf" option. Also make "--socket=0" work.
2783
        if zeroconf:
2784
            service.cleanup()
400 by Teddy Hogeborn
* mandos (Client.enable): Bug fix: Start new immediate checker last to
2785
        
505.1.11 by Teddy Hogeborn
* mandos (Client.checked_ok): Set "expires" after setting timeout.
2786
        multiprocessing.active_children()
617 by Teddy Hogeborn
* mandos: Bug fix: Don't print output from checkers when running in
2787
        wnull.close()
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
2788
        if not (tcp_server.clients or client_settings):
2789
            return
518.1.6 by Teddy Hogeborn
* mandos: Fix whitespace.
2790
        
521 by teddy at bsnet
* debian/control (mandos/Depends): Added "python-crypto".
2791
        # Store client before exiting. Secrets are encrypted with key
2792
        # based on what config file has. If config file is
2793
        # removed/edited, old secret will thus be unrecovable.
518.1.15 by Björn Påhlsson
more refactoring in regards to how clients get created
2794
        clients = {}
518.1.9 by Björn Påhlsson
renamed variables
2795
        with PGPEngine() as pgp:
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
2796
            for client in tcp_server.clients.itervalues():
2797
                key = client_settings[client.name]["secret"]
518.1.9 by Björn Påhlsson
renamed variables
2798
                client.encrypted_secret = pgp.encrypt(client.secret,
2799
                                                      key)
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
2800
                client_dict = {}
2801
                
518.1.15 by Björn Påhlsson
more refactoring in regards to how clients get created
2802
                # A list of attributes that can not be pickled
2803
                # + secret.
723.1.2 by Teddy Hogeborn
Use set literals.
2804
                exclude = { "bus", "changedstate", "secret",
2805
                            "checker", "server_settings" }
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2806
                for name, typ in inspect.getmembers(dbus.service
2807
                                                    .Object):
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
2808
                    exclude.add(name)
2809
                
2810
                client_dict["encrypted_secret"] = (client
2811
                                                   .encrypted_secret)
2812
                for attr in client.client_structure:
2813
                    if attr not in exclude:
2814
                        client_dict[attr] = getattr(client, attr)
2815
                
518.1.15 by Björn Påhlsson
more refactoring in regards to how clients get created
2816
                clients[client.name] = client_dict
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
2817
                del client_settings[client.name]["secret"]
2818
        
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
2819
        try:
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2820
            with tempfile.NamedTemporaryFile(
2821
                    mode='wb',
2822
                    suffix=".pickle",
2823
                    prefix='clients-',
2824
                    dir=os.path.dirname(stored_state_path),
2825
                    delete=False) as stored_state:
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
2826
                pickle.dump((clients, client_settings), stored_state)
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2827
                tempname = stored_state.name
505.1.26 by teddy at bsnet
* mandos (main/cleanup): Write new file, then rename. Use
2828
            os.rename(tempname, stored_state_path)
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
2829
        except (IOError, OSError) as e:
530 by teddy at bsnet
* mandos (initlogger): Take new "debug" argument; all callers changed.
2830
            if not debug:
2831
                try:
2832
                    os.remove(tempname)
2833
                except NameError:
2834
                    pass
574 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
2835
            if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
723.1.5 by Teddy Hogeborn
Use the new auto-numbered "{}" syntax for the .format() string method.
2836
                logger.warning("Could not save persistent state: {}"
574 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
2837
                               .format(os.strerror(e.errno)))
2838
            else:
2839
                logger.warning("Could not save persistent state:",
2840
                               exc_info=e)
642 by Teddy Hogeborn
Syntax fix; use "raise" better in Mandos server.
2841
                raise
518.1.6 by Teddy Hogeborn
* mandos: Fix whitespace.
2842
        
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
2843
        # Delete all clients, and settings from config
400 by Teddy Hogeborn
* mandos (Client.enable): Bug fix: Start new immediate checker last to
2844
        while tcp_server.clients:
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
2845
            name, client = tcp_server.clients.popitem()
402 by Teddy Hogeborn
* mandos (Client.disable): Rename keyword argument "log" to "quiet",
2846
            if use_dbus:
2847
                client.remove_from_connection()
400 by Teddy Hogeborn
* mandos (Client.enable): Bug fix: Start new immediate checker last to
2848
            # Don't signal anything except ClientRemoved
402 by Teddy Hogeborn
* mandos (Client.disable): Rename keyword argument "log" to "quiet",
2849
            client.disable(quiet=True)
400 by Teddy Hogeborn
* mandos (Client.enable): Bug fix: Start new immediate checker last to
2850
            if use_dbus:
2851
                # Emit D-Bus signal
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2852
                mandos_dbus_service.ClientRemoved(
2853
                    client.dbus_object_path, client.name)
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
2854
        client_settings.clear()
400 by Teddy Hogeborn
* mandos (Client.enable): Bug fix: Start new immediate checker last to
2855
    
2856
    atexit.register(cleanup)
2857
    
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
2858
    for client in tcp_server.clients.itervalues():
243 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
2859
        if use_dbus:
2860
            # Emit D-Bus signal
411 by Teddy Hogeborn
More consistent terminology: Clients are no longer "invalid" - they
2861
            mandos_dbus_service.ClientAdded(client.dbus_object_path)
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
2862
        # Need to initiate checking of clients
2863
        if client.enabled:
2864
            client.init_checker()
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
2865
    
163 by Teddy Hogeborn
* Makefile (PIDDIR, USER, GROUP): Removed.
2866
    tcp_server.enable()
2867
    tcp_server.server_activate()
2868
    
28 by Teddy Hogeborn
* server.conf: New file.
2869
    # Find out what port we got
707 by Teddy Hogeborn
mandos: New "--no-zeroconf" option. Also make "--socket=0" work.
2870
    if zeroconf:
2871
        service.port = tcp_server.socket.getsockname()[1]
314 by Teddy Hogeborn
Support not using IPv6 in server:
2872
    if use_ipv6:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2873
        logger.info("Now listening on address %r, port %d,"
568 by Teddy Hogeborn
* mandos-monitor: Use new string format method.
2874
                    " flowinfo %d, scope_id %d",
2875
                    *tcp_server.socket.getsockname())
314 by Teddy Hogeborn
Support not using IPv6 in server:
2876
    else:                       # IPv4
568 by Teddy Hogeborn
* mandos-monitor: Use new string format method.
2877
        logger.info("Now listening on address %r, port %d",
2878
                    *tcp_server.socket.getsockname())
28 by Teddy Hogeborn
* server.conf: New file.
2879
    
29 by Teddy Hogeborn
* plugins.d/mandosclient.c (start_mandos_communication): Changed
2880
    #service.interface = tcp_server.socket.getsockname()[3]
28 by Teddy Hogeborn
* server.conf: New file.
2881
    
2882
    try:
707 by Teddy Hogeborn
mandos: New "--no-zeroconf" option. Also make "--socket=0" work.
2883
        if zeroconf:
2884
            # From the Avahi example code
2885
            try:
2886
                service.activate()
2887
            except dbus.exceptions.DBusException as error:
2888
                logger.critical("D-Bus Exception", exc_info=error)
2889
                cleanup()
2890
                sys.exit(1)
2891
            # End of Avahi example code
28 by Teddy Hogeborn
* server.conf: New file.
2892
        
2893
        gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
2894
                             lambda *args, **kwargs:
237.1.2 by Teddy Hogeborn
Further steps towards a D-Bus server interface, plus minor syntax
2895
                             (tcp_server.handle_request
2896
                              (*args[2:], **kwargs) or True))
28 by Teddy Hogeborn
* server.conf: New file.
2897
        
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2898
        logger.debug("Starting main loop")
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
2899
        main_loop.run()
482 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
2900
    except AvahiError as error:
565 by Teddy Hogeborn
* mandos (AvahiService.rename, Client.start_checker,
2901
        logger.critical("Avahi Error", exc_info=error)
401 by Teddy Hogeborn
* README (FAQ): Fix typo.
2902
        cleanup()
28 by Teddy Hogeborn
* server.conf: New file.
2903
        sys.exit(1)
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
2904
    except KeyboardInterrupt:
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
2905
        if debug:
463.1.5 by teddy at bsnet
* mandos: Use unicode string literals.
2906
            print("", file=sys.stderr)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2907
        logger.debug("Server received KeyboardInterrupt")
2908
    logger.debug("Server exiting")
401 by Teddy Hogeborn
* README (FAQ): Fix typo.
2909
    # Must run before the D-Bus bus name gets deregistered
2910
    cleanup()
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
2911
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2912
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2913
if __name__ == '__main__':
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
2914
    main()