/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk
806 by Teddy Hogeborn
Fix Debian dependency bugs and lintian checks.
1
#!/usr/bin/python
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
2
# -*- mode: python; coding: utf-8 -*-
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
3
# 
4
# Mandos server - give out binary blobs to connecting clients.
5
# 
6
# This program is partly derived from an example program for an Avahi
7
# service publisher, downloaded from
8
# <http://avahi.org/wiki/PythonPublishExample>.  This includes the
336 by Teddy Hogeborn
Code cleanup.
9
# methods "add", "remove", "server_state_changed",
10
# "entry_group_state_changed", "cleanup", and "activate" in the
11
# "AvahiService" class, and some lines in "main".
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
12
# 
28 by Teddy Hogeborn
* server.conf: New file.
13
# Everything else is
807 by Teddy Hogeborn
Update copyright year.
14
# Copyright © 2008-2016 Teddy Hogeborn
15
# Copyright © 2008-2016 Björn Påhlsson
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
16
# 
17
# This program is free software: you can redistribute it and/or modify
18
# it under the terms of the GNU General Public License as published by
19
# the Free Software Foundation, either version 3 of the License, or
20
# (at your option) any later version.
21
#
22
#     This program is distributed in the hope that it will be useful,
23
#     but WITHOUT ANY WARRANTY; without even the implied warranty of
24
#     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
25
#     GNU General Public License for more details.
26
# 
27
# You should have received a copy of the GNU General Public License
109 by Teddy Hogeborn
* .bzrignore: New.
28
# along with this program.  If not, see
29
# <http://www.gnu.org/licenses/>.
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
30
# 
505.1.2 by Teddy Hogeborn
Change "fukt.bsnet.se" to "recompile.se" throughout.
31
# Contact the authors at <mandos@recompile.se>.
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
32
# 
3 by Björn Påhlsson
Python based server
33
463.1.5 by teddy at bsnet
* mandos: Use unicode string literals.
34
from __future__ import (division, absolute_import, print_function,
35
                        unicode_literals)
10 by Teddy Hogeborn
* server.py: Bug fix: Do "from __future__ import division".
36
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
37
try:
38
    from future_builtins import *
39
except ImportError:
40
    pass
579 by Teddy Hogeborn
* mandos: Use all new builtins.
41
749 by Teddy Hogeborn
mandos: Some more minor changes to prepare for Python 3.
42
try:
43
    import SocketServer as socketserver
44
except ImportError:
45
    import socketserver
3 by Björn Påhlsson
Python based server
46
import socket
474 by teddy at bsnet
* mandos: Use the new argparse library instead of optparse.
47
import argparse
3 by Björn Påhlsson
Python based server
48
import datetime
49
import errno
749 by Teddy Hogeborn
mandos: Some more minor changes to prepare for Python 3.
50
try:
51
    import ConfigParser as configparser
52
except ImportError:
53
    import configparser
4 by Teddy Hogeborn
* server.py (Client.created, Client.next_check): New.
54
import sys
9 by Teddy Hogeborn
* client.cpp (main): Get t_old early since it is used on error exits.
55
import re
56
import os
57
import signal
10 by Teddy Hogeborn
* server.py: Bug fix: Do "from __future__ import division".
58
import subprocess
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
59
import atexit
60
import stat
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
61
import logging
62
import logging.handlers
163 by Teddy Hogeborn
* Makefile (PIDDIR, USER, GROUP): Removed.
63
import pwd
411 by Teddy Hogeborn
More consistent terminology: Clients are no longer "invalid" - they
64
import contextlib
333 by Teddy Hogeborn
Minor code cleanup; one minor bug fix.
65
import struct
66
import fcntl
337 by Teddy Hogeborn
Code cleanup. Move some global stuff into main.
67
import functools
749 by Teddy Hogeborn
mandos: Some more minor changes to prepare for Python 3.
68
try:
69
    import cPickle as pickle
70
except ImportError:
71
    import pickle
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
72
import multiprocessing
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
73
import types
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
74
import binascii
75
import tempfile
560.1.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
76
import itertools
609 by Teddy Hogeborn
* clients.conf: Convert all time intervals to new RFC 3339 syntax.
77
import collections
751 by Teddy Hogeborn
mandos: Use codecs.open() and print() for PID file.
78
import codecs
5 by Teddy Hogeborn
* server.py (server_metaclass): New.
79
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
80
import dbus
237.1.1 by Teddy Hogeborn
First steps of a D-Bus interface to the server.
81
import dbus.service
830 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
82
from gi.repository import GLib
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
83
from dbus.mainloop.glib import DBusGMainLoop
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
84
import ctypes
215 by Teddy Hogeborn
* mandos: Remove unused "select" module. Import "ctypes.util".
85
import ctypes.util
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
86
import xml.dom.minidom
87
import inspect
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
88
331 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
89
try:
90
    SO_BINDTODEVICE = socket.SO_BINDTODEVICE
91
except AttributeError:
92
    try:
93
        from IN import SO_BINDTODEVICE
94
    except ImportError:
338 by Teddy Hogeborn
* mandos: Minor doc string fixes.
95
        SO_BINDTODEVICE = None
331 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
96
730 by Teddy Hogeborn
mandos: Replace unicode() with str().
97
if sys.version_info.major == 2:
98
    str = unicode
99
237.4.73 by Teddy Hogeborn
* Makefile (version): Changed to "1.7.7".
100
version = "1.7.7"
518.2.2 by Teddy Hogeborn
Directory with persistent state can now be changed with the "statedir"
101
stored_state_file = "clients.pickle"
13 by Björn Påhlsson
Added following support:
102
505.1.20 by Teddy Hogeborn
* Makefile (run-server): Remove obsolete warning.
103
logger = logging.getLogger()
655 by Teddy Hogeborn
Allow self-tests to run without needing /dev/log.
104
syslogger = None
13 by Björn Påhlsson
Added following support:
105
518.1.5 by Björn Påhlsson
First run of python-lint. Fixed some *obviously* bad code and turned
106
try:
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
107
    if_nametoindex = ctypes.cdll.LoadLibrary(
108
        ctypes.util.find_library("c")).if_nametoindex
518.1.5 by Björn Påhlsson
First run of python-lint. Fixed some *obviously* bad code and turned
109
except (OSError, AttributeError):
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
110
    
518.1.5 by Björn Påhlsson
First run of python-lint. Fixed some *obviously* bad code and turned
111
    def if_nametoindex(interface):
112
        "Get an interface index the hard way, i.e. using fcntl()"
113
        SIOCGIFINDEX = 0x8933  # From /usr/include/linux/sockios.h
114
        with contextlib.closing(socket.socket()) as s:
115
            ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
729 by Teddy Hogeborn
mandos: Stop using str() and remove unnecessary unicode() calls.
116
                                struct.pack(b"16s16x", interface))
117
        interface_index = struct.unpack("I", ifreq[16:20])[0]
518.1.5 by Björn Påhlsson
First run of python-lint. Fixed some *obviously* bad code and turned
118
        return interface_index
119
120
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
121
def copy_function(func):
122
    """Make a copy of a function"""
123
    if sys.version_info.major == 2:
124
        return types.FunctionType(func.func_code,
125
                                  func.func_globals,
126
                                  func.func_name,
127
                                  func.func_defaults,
128
                                  func.func_closure)
129
    else:
130
        return types.FunctionType(func.__code__,
131
                                  func.__globals__,
132
                                  func.__name__,
133
                                  func.__defaults__,
134
                                  func.__closure__)
135
136
530 by teddy at bsnet
* mandos (initlogger): Take new "debug" argument; all callers changed.
137
def initlogger(debug, level=logging.WARNING):
518.1.4 by Björn Påhlsson
restructured logger
138
    """init logger and add loglevel"""
139
    
698 by Teddy Hogeborn
Fix mandos server "--servicename" option, broken since 1.6.4.
140
    global syslogger
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
141
    syslogger = (logging.handlers.SysLogHandler(
142
        facility = logging.handlers.SysLogHandler.LOG_DAEMON,
143
        address = "/dev/log"))
518.1.4 by Björn Påhlsson
restructured logger
144
    syslogger.setFormatter(logging.Formatter
145
                           ('Mandos [%(process)d]: %(levelname)s:'
146
                            ' %(message)s'))
147
    logger.addHandler(syslogger)
148
    
530 by teddy at bsnet
* mandos (initlogger): Take new "debug" argument; all callers changed.
149
    if debug:
150
        console = logging.StreamHandler()
151
        console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
152
                                               ' [%(process)d]:'
153
                                               ' %(levelname)s:'
154
                                               ' %(message)s'))
155
        logger.addHandler(console)
518.1.4 by Björn Påhlsson
restructured logger
156
    logger.setLevel(level)
28 by Teddy Hogeborn
* server.conf: New file.
157
505.1.20 by Teddy Hogeborn
* Makefile (run-server): Remove obsolete warning.
158
518.1.9 by Björn Påhlsson
renamed variables
159
class PGPError(Exception):
160
    """Exception if encryption/decryption fails"""
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
161
    pass
162
163
518.1.9 by Björn Påhlsson
renamed variables
164
class PGPEngine(object):
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
165
    """A simple class for OpenPGP symmetric encryption & decryption"""
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
166
    
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
167
    def __init__(self):
168
        self.tempdir = tempfile.mkdtemp(prefix="mandos-")
805 by Teddy Hogeborn
Use GnuPG 2 if available
169
        self.gpg = "gpg"
170
        try:
171
            output = subprocess.check_output(["gpgconf"])
172
            for line in output.splitlines():
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
173
                name, text, path = line.split(b":")
805 by Teddy Hogeborn
Use GnuPG 2 if available
174
                if name == "gpg":
175
                    self.gpg = path
176
                    break
177
        except OSError as e:
178
            if e.errno != errno.ENOENT:
179
                raise
615 by Teddy Hogeborn
* mandos: Don't use the GnuPGInterface module.
180
        self.gnupgargs = ['--batch',
805 by Teddy Hogeborn
Use GnuPG 2 if available
181
                          '--homedir', self.tempdir,
615 by Teddy Hogeborn
* mandos: Don't use the GnuPGInterface module.
182
                          '--force-mdc',
183
                          '--quiet',
184
                          '--no-use-agent']
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
185
    
186
    def __enter__(self):
187
        return self
188
    
587 by Teddy Hogeborn
* Makefile (DOCBOOKTOMAN): Only run man --warnings if both "man" and
189
    def __exit__(self, exc_type, exc_value, traceback):
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
190
        self._cleanup()
191
        return False
192
    
193
    def __del__(self):
194
        self._cleanup()
195
    
196
    def _cleanup(self):
197
        if self.tempdir is not None:
198
            # Delete contents of tempdir
199
            for root, dirs, files in os.walk(self.tempdir,
200
                                             topdown = False):
201
                for filename in files:
202
                    os.remove(os.path.join(root, filename))
203
                for dirname in dirs:
204
                    os.rmdir(os.path.join(root, dirname))
205
            # Remove tempdir
206
            os.rmdir(self.tempdir)
207
            self.tempdir = None
208
    
209
    def password_encode(self, password):
210
        # Passphrase can not be empty and can not contain newlines or
211
        # NUL bytes.  So we prefix it and hex encode it.
630 by Teddy Hogeborn
* mandos (PGPEngine.password_encode): Bug fix: GnuPG can't handle
212
        encoded = b"mandos" + binascii.hexlify(password)
213
        if len(encoded) > 2048:
214
            # GnuPG can't handle long passwords, so encode differently
215
            encoded = (b"mandos" + password.replace(b"\\", b"\\\\")
216
                       .replace(b"\n", b"\\n")
217
                       .replace(b"\0", b"\\x00"))
218
        return encoded
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
219
    
220
    def encrypt(self, data, password):
615 by Teddy Hogeborn
* mandos: Don't use the GnuPGInterface module.
221
        passphrase = self.password_encode(password)
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
222
        with tempfile.NamedTemporaryFile(
223
                dir=self.tempdir) as passfile:
615 by Teddy Hogeborn
* mandos: Don't use the GnuPGInterface module.
224
            passfile.write(passphrase)
225
            passfile.flush()
805 by Teddy Hogeborn
Use GnuPG 2 if available
226
            proc = subprocess.Popen([self.gpg, '--symmetric',
615 by Teddy Hogeborn
* mandos: Don't use the GnuPGInterface module.
227
                                     '--passphrase-file',
228
                                     passfile.name]
229
                                    + self.gnupgargs,
230
                                    stdin = subprocess.PIPE,
231
                                    stdout = subprocess.PIPE,
232
                                    stderr = subprocess.PIPE)
233
            ciphertext, err = proc.communicate(input = data)
234
        if proc.returncode != 0:
235
            raise PGPError(err)
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
236
        return ciphertext
237
    
238
    def decrypt(self, data, password):
615 by Teddy Hogeborn
* mandos: Don't use the GnuPGInterface module.
239
        passphrase = self.password_encode(password)
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
240
        with tempfile.NamedTemporaryFile(
241
                dir = self.tempdir) as passfile:
615 by Teddy Hogeborn
* mandos: Don't use the GnuPGInterface module.
242
            passfile.write(passphrase)
243
            passfile.flush()
805 by Teddy Hogeborn
Use GnuPG 2 if available
244
            proc = subprocess.Popen([self.gpg, '--decrypt',
615 by Teddy Hogeborn
* mandos: Don't use the GnuPGInterface module.
245
                                     '--passphrase-file',
246
                                     passfile.name]
247
                                    + self.gnupgargs,
248
                                    stdin = subprocess.PIPE,
249
                                    stdout = subprocess.PIPE,
250
                                    stderr = subprocess.PIPE)
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
251
            decrypted_plaintext, err = proc.communicate(input = data)
615 by Teddy Hogeborn
* mandos: Don't use the GnuPGInterface module.
252
        if proc.returncode != 0:
253
            raise PGPError(err)
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
254
        return decrypted_plaintext
255
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
256
# Pretend that we have an Avahi module
257
class Avahi(object):
258
    """This isn't so much a class as it is a module-like namespace.
259
    It is instantiated once, and simulates having an Avahi module."""
260
    IF_UNSPEC = -1              # avahi-common/address.h
261
    PROTO_UNSPEC = -1           # avahi-common/address.h
262
    PROTO_INET = 0              # avahi-common/address.h
263
    PROTO_INET6 = 1             # avahi-common/address.h
264
    DBUS_NAME = "org.freedesktop.Avahi"
265
    DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"
266
    DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"
267
    DBUS_PATH_SERVER = "/"
268
    def string_array_to_txt_array(self, t):
269
        return dbus.Array((dbus.ByteArray(s.encode("utf-8"))
270
                           for s in t), signature="ay")
271
    ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
272
    ENTRY_GROUP_COLLISION = 3   # avahi-common/defs.h
273
    ENTRY_GROUP_FAILURE = 4     # avahi-common/defs.h
274
    SERVER_INVALID = 0          # avahi-common/defs.h
275
    SERVER_REGISTERING = 1      # avahi-common/defs.h
276
    SERVER_RUNNING = 2          # avahi-common/defs.h
277
    SERVER_COLLISION = 3        # avahi-common/defs.h
278
    SERVER_FAILURE = 4          # avahi-common/defs.h
279
avahi = Avahi()
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
280
28 by Teddy Hogeborn
* server.conf: New file.
281
class AvahiError(Exception):
242 by Teddy Hogeborn
* mandos (AvahiError): Converted to use unicode. All users changed.
282
    def __init__(self, value, *args, **kwargs):
28 by Teddy Hogeborn
* server.conf: New file.
283
        self.value = value
729 by Teddy Hogeborn
mandos: Stop using str() and remove unnecessary unicode() calls.
284
        return super(AvahiError, self).__init__(value, *args,
285
                                                **kwargs)
28 by Teddy Hogeborn
* server.conf: New file.
286
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
287
28 by Teddy Hogeborn
* server.conf: New file.
288
class AvahiServiceError(AvahiError):
289
    pass
290
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
291
28 by Teddy Hogeborn
* server.conf: New file.
292
class AvahiGroupError(AvahiError):
293
    pass
294
295
296
class AvahiService(object):
45 by Teddy Hogeborn
* server.py: Cosmetic changes.
297
    """An Avahi (Zeroconf) service.
331 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
298
    
45 by Teddy Hogeborn
* server.py: Cosmetic changes.
299
    Attributes:
28 by Teddy Hogeborn
* server.conf: New file.
300
    interface: integer; avahi.IF_UNSPEC or an interface index.
301
               Used to optionally bind to the specified interface.
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
302
    name: string; Example: 'Mandos'
303
    type: string; Example: '_mandos._tcp'.
614 by Teddy Hogeborn
* mandos: Comment changes.
304
     See <https://www.iana.org/assignments/service-names-port-numbers>
45 by Teddy Hogeborn
* server.py: Cosmetic changes.
305
    port: integer; what port to announce
306
    TXT: list of strings; TXT record for the service
307
    domain: string; Domain to publish on, default to .local if empty.
308
    host: string; Host to publish records for, default is localhost
309
    max_renames: integer; maximum number of renames
310
    rename_count: integer; counter so we only rename after collisions
311
                  a sensible number of times
336 by Teddy Hogeborn
Code cleanup.
312
    group: D-Bus Entry Group
313
    server: D-Bus Server
338 by Teddy Hogeborn
* mandos: Minor doc string fixes.
314
    bus: dbus.SystemBus()
28 by Teddy Hogeborn
* server.conf: New file.
315
    """
573 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
316
    
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
317
    def __init__(self,
318
                 interface = avahi.IF_UNSPEC,
319
                 name = None,
320
                 servicetype = None,
321
                 port = None,
322
                 TXT = None,
323
                 domain = "",
324
                 host = "",
325
                 max_renames = 32768,
326
                 protocol = avahi.PROTO_UNSPEC,
327
                 bus = None):
28 by Teddy Hogeborn
* server.conf: New file.
328
        self.interface = interface
329
        self.name = name
215 by Teddy Hogeborn
* mandos: Remove unused "select" module. Import "ctypes.util".
330
        self.type = servicetype
28 by Teddy Hogeborn
* server.conf: New file.
331
        self.port = port
237.1.2 by Teddy Hogeborn
Further steps towards a D-Bus server interface, plus minor syntax
332
        self.TXT = TXT if TXT is not None else []
28 by Teddy Hogeborn
* server.conf: New file.
333
        self.domain = domain
334
        self.host = host
335
        self.rename_count = 0
76 by Teddy Hogeborn
* plugins.d/password-request.c (init_gnutls_global): Renamed
336
        self.max_renames = max_renames
314 by Teddy Hogeborn
Support not using IPv6 in server:
337
        self.protocol = protocol
336 by Teddy Hogeborn
Code cleanup.
338
        self.group = None       # our entry group
339
        self.server = None
337 by Teddy Hogeborn
Code cleanup. Move some global stuff into main.
340
        self.bus = bus
482 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
341
        self.entry_group_state_changed_match = None
573 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
342
    
738 by Teddy Hogeborn
Handle local Zeroconf service name collisions.
343
    def rename(self, remove=True):
28 by Teddy Hogeborn
* server.conf: New file.
344
        """Derived from the Avahi example code"""
345
        if self.rename_count >= self.max_renames:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
346
            logger.critical("No suitable Zeroconf service name found"
347
                            " after %i retries, exiting.",
215 by Teddy Hogeborn
* mandos: Remove unused "select" module. Import "ctypes.util".
348
                            self.rename_count)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
349
            raise AvahiServiceError("Too many renames")
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
350
        self.name = str(
351
            self.server.GetAlternativeServiceName(self.name))
738 by Teddy Hogeborn
Handle local Zeroconf service name collisions.
352
        self.rename_count += 1
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
353
        logger.info("Changing Zeroconf service name to %r ...",
24.1.155 by Björn Påhlsson
mandos server: Added debuglevel that adjust at what level information
354
                    self.name)
738 by Teddy Hogeborn
Handle local Zeroconf service name collisions.
355
        if remove:
356
            self.remove()
24.1.160 by Björn Påhlsson
fixed bug with local name collisions after a non-local name collision
357
        try:
358
            self.add()
482 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
359
        except dbus.exceptions.DBusException as error:
738 by Teddy Hogeborn
Handle local Zeroconf service name collisions.
360
            if (error.get_dbus_name()
361
                == "org.freedesktop.Avahi.CollisionError"):
362
                logger.info("Local Zeroconf service name collision.")
363
                return self.rename(remove=False)
364
            else:
365
                logger.critical("D-Bus Exception", exc_info=error)
366
                self.cleanup()
367
                os._exit(1)
573 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
368
    
28 by Teddy Hogeborn
* server.conf: New file.
369
    def remove(self):
370
        """Derived from the Avahi example code"""
482 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
371
        if self.entry_group_state_changed_match is not None:
372
            self.entry_group_state_changed_match.remove()
373
            self.entry_group_state_changed_match = None
483 by Teddy Hogeborn
* mandos: Never call .Reset() on a defunct Avahi entry group.
374
        if self.group is not None:
375
            self.group.Reset()
573 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
376
    
28 by Teddy Hogeborn
* server.conf: New file.
377
    def add(self):
378
        """Derived from the Avahi example code"""
482 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
379
        self.remove()
483 by Teddy Hogeborn
* mandos: Never call .Reset() on a defunct Avahi entry group.
380
        if self.group is None:
381
            self.group = dbus.Interface(
382
                self.bus.get_object(avahi.DBUS_NAME,
383
                                    self.server.EntryGroupNew()),
384
                avahi.DBUS_INTERFACE_ENTRY_GROUP)
482 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
385
        self.entry_group_state_changed_match = (
386
            self.group.connect_to_signal(
505.1.20 by Teddy Hogeborn
* Makefile (run-server): Remove obsolete warning.
387
                'StateChanged', self.entry_group_state_changed))
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
388
        logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
336 by Teddy Hogeborn
Code cleanup.
389
                     self.name, self.type)
390
        self.group.AddService(
391
            self.interface,
392
            self.protocol,
393
            dbus.UInt32(0),     # flags
394
            self.name, self.type,
395
            self.domain, self.host,
396
            dbus.UInt16(self.port),
397
            avahi.string_array_to_txt_array(self.TXT))
398
        self.group.Commit()
573 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
399
    
336 by Teddy Hogeborn
Code cleanup.
400
    def entry_group_state_changed(self, state, error):
401
        """Derived from the Avahi example code"""
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
402
        logger.debug("Avahi entry group state change: %i", state)
336 by Teddy Hogeborn
Code cleanup.
403
        
404
        if state == avahi.ENTRY_GROUP_ESTABLISHED:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
405
            logger.debug("Zeroconf service established.")
336 by Teddy Hogeborn
Code cleanup.
406
        elif state == avahi.ENTRY_GROUP_COLLISION:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
407
            logger.info("Zeroconf service name collision.")
336 by Teddy Hogeborn
Code cleanup.
408
            self.rename()
409
        elif state == avahi.ENTRY_GROUP_FAILURE:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
410
            logger.critical("Avahi: Error in group state changed %s",
730 by Teddy Hogeborn
mandos: Replace unicode() with str().
411
                            str(error))
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
412
            raise AvahiGroupError("State changed: {!s}".format(error))
573 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
413
    
336 by Teddy Hogeborn
Code cleanup.
414
    def cleanup(self):
415
        """Derived from the Avahi example code"""
483 by Teddy Hogeborn
* mandos: Never call .Reset() on a defunct Avahi entry group.
416
        if self.group is not None:
417
            try:
418
                self.group.Free()
419
            except (dbus.exceptions.UnknownMethodException,
518.1.5 by Björn Påhlsson
First run of python-lint. Fixed some *obviously* bad code and turned
420
                    dbus.exceptions.DBusException):
483 by Teddy Hogeborn
* mandos: Never call .Reset() on a defunct Avahi entry group.
421
                pass
422
            self.group = None
482 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
423
        self.remove()
573 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
424
    
482 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
425
    def server_state_changed(self, state, error=None):
336 by Teddy Hogeborn
Code cleanup.
426
        """Derived from the Avahi example code"""
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
427
        logger.debug("Avahi server state change: %i", state)
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
428
        bad_states = {
429
            avahi.SERVER_INVALID: "Zeroconf server invalid",
430
            avahi.SERVER_REGISTERING: None,
431
            avahi.SERVER_COLLISION: "Zeroconf server name collision",
432
            avahi.SERVER_FAILURE: "Zeroconf server failure",
433
        }
482 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
434
        if state in bad_states:
483 by Teddy Hogeborn
* mandos: Never call .Reset() on a defunct Avahi entry group.
435
            if bad_states[state] is not None:
436
                if error is None:
437
                    logger.error(bad_states[state])
438
                else:
439
                    logger.error(bad_states[state] + ": %r", error)
440
            self.cleanup()
336 by Teddy Hogeborn
Code cleanup.
441
        elif state == avahi.SERVER_RUNNING:
769 by Teddy Hogeborn
Handle local Zeroconf service name collisions on startup, too.
442
            try:
443
                self.add()
444
            except dbus.exceptions.DBusException as error:
445
                if (error.get_dbus_name()
446
                    == "org.freedesktop.Avahi.CollisionError"):
447
                    logger.info("Local Zeroconf service name"
448
                                " collision.")
449
                    return self.rename(remove=False)
450
                else:
451
                    logger.critical("D-Bus Exception", exc_info=error)
452
                    self.cleanup()
453
                    os._exit(1)
482 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
454
        else:
483 by Teddy Hogeborn
* mandos: Never call .Reset() on a defunct Avahi entry group.
455
            if error is None:
456
                logger.debug("Unknown state: %r", state)
457
            else:
458
                logger.debug("Unknown state: %r: %r", state, error)
573 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
459
    
336 by Teddy Hogeborn
Code cleanup.
460
    def activate(self):
461
        """Derived from the Avahi example code"""
462
        if self.server is None:
463
            self.server = dbus.Interface(
337 by Teddy Hogeborn
Code cleanup. Move some global stuff into main.
464
                self.bus.get_object(avahi.DBUS_NAME,
482 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
465
                                    avahi.DBUS_PATH_SERVER,
466
                                    follow_name_owner_changes=True),
336 by Teddy Hogeborn
Code cleanup.
467
                avahi.DBUS_INTERFACE_SERVER)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
468
        self.server.connect_to_signal("StateChanged",
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
469
                                      self.server_state_changed)
336 by Teddy Hogeborn
Code cleanup.
470
        self.server_state_changed(self.server.GetState())
238 by Teddy Hogeborn
First version of a somewhat complete D-Bus server interface. Also
471
582 by Teddy Hogeborn
* mandos (IPv6_TCPServer.server_bind): Bug fix: handle non-existing
472
505.1.20 by Teddy Hogeborn
* Makefile (run-server): Remove obsolete warning.
473
class AvahiServiceToSyslog(AvahiService):
738 by Teddy Hogeborn
Handle local Zeroconf service name collisions.
474
    def rename(self, *args, **kwargs):
505.1.20 by Teddy Hogeborn
* Makefile (run-server): Remove obsolete warning.
475
        """Add the new name to the syslog messages"""
738 by Teddy Hogeborn
Handle local Zeroconf service name collisions.
476
        ret = AvahiService.rename(self, *args, **kwargs)
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
477
        syslogger.setFormatter(logging.Formatter(
478
            'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
479
            .format(self.name)))
505.1.20 by Teddy Hogeborn
* Makefile (run-server): Remove obsolete warning.
480
        return ret
238 by Teddy Hogeborn
First version of a somewhat complete D-Bus server interface. Also
481
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
482
# Pretend that we have a GnuTLS module
483
class GnuTLS(object):
484
    """This isn't so much a class as it is a module-like namespace.
485
    It is instantiated once, and simulates having a GnuTLS module."""
486
    
487
    _library = ctypes.cdll.LoadLibrary(
488
        ctypes.util.find_library("gnutls"))
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
489
    _need_version = b"3.3.0"
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
490
    def __init__(self):
491
        # Need to use class name "GnuTLS" here, since this method is
492
        # called before the assignment to the "gnutls" global variable
493
        # happens.
494
        if GnuTLS.check_version(self._need_version) is None:
495
            raise GnuTLS.Error("Needs GnuTLS {} or later"
496
                               .format(self._need_version))
497
    
498
    # Unless otherwise indicated, the constants and types below are
499
    # all from the gnutls/gnutls.h C header file.
500
    
501
    # Constants
502
    E_SUCCESS = 0
802 by Teddy Hogeborn
Handle GnuTLS errors and partial sends in gnutls "module".
503
    E_INTERRUPTED = -52
504
    E_AGAIN = -28
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
505
    CRT_OPENPGP = 2
506
    CLIENT = 2
507
    SHUT_RDWR = 0
508
    CRD_CERTIFICATE = 1
509
    E_NO_CERTIFICATE_FOUND = -49
510
    OPENPGP_FMT_RAW = 0         # gnutls/openpgp.h
511
    
512
    # Types
513
    class session_int(ctypes.Structure):
514
        _fields_ = []
515
    session_t = ctypes.POINTER(session_int)
516
    class certificate_credentials_st(ctypes.Structure):
517
        _fields_ = []
518
    certificate_credentials_t = ctypes.POINTER(
519
        certificate_credentials_st)
520
    certificate_type_t = ctypes.c_int
521
    class datum_t(ctypes.Structure):
522
        _fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
523
                    ('size', ctypes.c_uint)]
524
    class openpgp_crt_int(ctypes.Structure):
525
        _fields_ = []
526
    openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
527
    openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
528
    log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
824 by Teddy Hogeborn
Remove empty comment
529
    credentials_type_t = ctypes.c_int
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
530
    transport_ptr_t = ctypes.c_void_p
531
    close_request_t = ctypes.c_int
532
    
533
    # Exceptions
534
    class Error(Exception):
535
        # We need to use the class name "GnuTLS" here, since this
536
        # exception might be raised from within GnuTLS.__init__,
537
        # which is called before the assignment to the "gnutls"
802 by Teddy Hogeborn
Handle GnuTLS errors and partial sends in gnutls "module".
538
        # global variable has happened.
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
539
        def __init__(self, message = None, code = None, args=()):
540
            # Default usage is by a message string, but if a return
541
            # code is passed, convert it to a string with
542
            # gnutls.strerror()
802 by Teddy Hogeborn
Handle GnuTLS errors and partial sends in gnutls "module".
543
            self.code = code
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
544
            if message is None and code is not None:
545
                message = GnuTLS.strerror(code)
546
            return super(GnuTLS.Error, self).__init__(
547
                message, *args)
548
    
549
    class CertificateSecurityError(Error):
550
        pass
551
    
552
    # Classes
553
    class Credentials(object):
554
        def __init__(self):
555
            self._c_object = gnutls.certificate_credentials_t()
556
            gnutls.certificate_allocate_credentials(
557
                ctypes.byref(self._c_object))
558
            self.type = gnutls.CRD_CERTIFICATE
559
        
560
        def __del__(self):
561
            gnutls.certificate_free_credentials(self._c_object)
562
    
563
    class ClientSession(object):
564
        def __init__(self, socket, credentials = None):
565
            self._c_object = gnutls.session_t()
566
            gnutls.init(ctypes.byref(self._c_object), gnutls.CLIENT)
567
            gnutls.set_default_priority(self._c_object)
568
            gnutls.transport_set_ptr(self._c_object, socket.fileno())
569
            gnutls.handshake_set_private_extensions(self._c_object,
570
                                                    True)
571
            self.socket = socket
572
            if credentials is None:
573
                credentials = gnutls.Credentials()
574
            gnutls.credentials_set(self._c_object, credentials.type,
575
                                   ctypes.cast(credentials._c_object,
576
                                               ctypes.c_void_p))
577
            self.credentials = credentials
578
        
579
        def __del__(self):
580
            gnutls.deinit(self._c_object)
581
        
582
        def handshake(self):
583
            return gnutls.handshake(self._c_object)
584
        
585
        def send(self, data):
586
            data = bytes(data)
802 by Teddy Hogeborn
Handle GnuTLS errors and partial sends in gnutls "module".
587
            data_len = len(data)
588
            while data_len > 0:
589
                data_len -= gnutls.record_send(self._c_object,
590
                                               data[-data_len:],
591
                                               data_len)
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
592
        
593
        def bye(self):
594
            return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
595
    
802 by Teddy Hogeborn
Handle GnuTLS errors and partial sends in gnutls "module".
596
    # Error handling functions
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
597
    def _error_code(result):
598
        """A function to raise exceptions on errors, suitable
599
        for the 'restype' attribute on ctypes functions"""
600
        if result >= 0:
601
            return result
602
        if result == gnutls.E_NO_CERTIFICATE_FOUND:
603
            raise gnutls.CertificateSecurityError(code = result)
604
        raise gnutls.Error(code = result)
605
    
802 by Teddy Hogeborn
Handle GnuTLS errors and partial sends in gnutls "module".
606
    def _retry_on_error(result, func, arguments):
607
        """A function to retry on some errors, suitable
608
        for the 'errcheck' attribute on ctypes functions"""
609
        while result < 0:
610
            if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
611
                return _error_code(result)
612
            result = func(*arguments)
613
        return result
614
    
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
615
    # Unless otherwise indicated, the function declarations below are
616
    # all from the gnutls/gnutls.h C header file.
617
    
618
    # Functions
619
    priority_set_direct = _library.gnutls_priority_set_direct
620
    priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
621
                                    ctypes.POINTER(ctypes.c_char_p)]
622
    priority_set_direct.restype = _error_code
623
    
624
    init = _library.gnutls_init
625
    init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
626
    init.restype = _error_code
627
    
628
    set_default_priority = _library.gnutls_set_default_priority
629
    set_default_priority.argtypes = [session_t]
630
    set_default_priority.restype = _error_code
631
    
632
    record_send = _library.gnutls_record_send
633
    record_send.argtypes = [session_t, ctypes.c_void_p,
634
                            ctypes.c_size_t]
635
    record_send.restype = ctypes.c_ssize_t
802 by Teddy Hogeborn
Handle GnuTLS errors and partial sends in gnutls "module".
636
    record_send.errcheck = _retry_on_error
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
637
    
638
    certificate_allocate_credentials = (
639
        _library.gnutls_certificate_allocate_credentials)
640
    certificate_allocate_credentials.argtypes = [
641
        ctypes.POINTER(certificate_credentials_t)]
642
    certificate_allocate_credentials.restype = _error_code
643
    
644
    certificate_free_credentials = (
645
        _library.gnutls_certificate_free_credentials)
646
    certificate_free_credentials.argtypes = [certificate_credentials_t]
647
    certificate_free_credentials.restype = None
648
    
649
    handshake_set_private_extensions = (
650
        _library.gnutls_handshake_set_private_extensions)
651
    handshake_set_private_extensions.argtypes = [session_t,
652
                                                 ctypes.c_int]
653
    handshake_set_private_extensions.restype = None
654
    
655
    credentials_set = _library.gnutls_credentials_set
656
    credentials_set.argtypes = [session_t, credentials_type_t,
657
                                ctypes.c_void_p]
658
    credentials_set.restype = _error_code
659
    
660
    strerror = _library.gnutls_strerror
661
    strerror.argtypes = [ctypes.c_int]
662
    strerror.restype = ctypes.c_char_p
663
    
664
    certificate_type_get = _library.gnutls_certificate_type_get
665
    certificate_type_get.argtypes = [session_t]
666
    certificate_type_get.restype = _error_code
667
    
668
    certificate_get_peers = _library.gnutls_certificate_get_peers
669
    certificate_get_peers.argtypes = [session_t,
670
                                      ctypes.POINTER(ctypes.c_uint)]
671
    certificate_get_peers.restype = ctypes.POINTER(datum_t)
672
    
673
    global_set_log_level = _library.gnutls_global_set_log_level
674
    global_set_log_level.argtypes = [ctypes.c_int]
675
    global_set_log_level.restype = None
676
    
677
    global_set_log_function = _library.gnutls_global_set_log_function
678
    global_set_log_function.argtypes = [log_func]
679
    global_set_log_function.restype = None
680
    
681
    deinit = _library.gnutls_deinit
682
    deinit.argtypes = [session_t]
683
    deinit.restype = None
684
    
685
    handshake = _library.gnutls_handshake
686
    handshake.argtypes = [session_t]
687
    handshake.restype = _error_code
802 by Teddy Hogeborn
Handle GnuTLS errors and partial sends in gnutls "module".
688
    handshake.errcheck = _retry_on_error
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
689
    
690
    transport_set_ptr = _library.gnutls_transport_set_ptr
691
    transport_set_ptr.argtypes = [session_t, transport_ptr_t]
692
    transport_set_ptr.restype = None
693
    
694
    bye = _library.gnutls_bye
695
    bye.argtypes = [session_t, close_request_t]
696
    bye.restype = _error_code
802 by Teddy Hogeborn
Handle GnuTLS errors and partial sends in gnutls "module".
697
    bye.errcheck = _retry_on_error
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
698
    
699
    check_version = _library.gnutls_check_version
700
    check_version.argtypes = [ctypes.c_char_p]
701
    check_version.restype = ctypes.c_char_p
702
    
703
    # All the function declarations below are from gnutls/openpgp.h
704
    
705
    openpgp_crt_init = _library.gnutls_openpgp_crt_init
706
    openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
707
    openpgp_crt_init.restype = _error_code
708
    
709
    openpgp_crt_import = _library.gnutls_openpgp_crt_import
710
    openpgp_crt_import.argtypes = [openpgp_crt_t,
711
                                   ctypes.POINTER(datum_t),
712
                                   openpgp_crt_fmt_t]
713
    openpgp_crt_import.restype = _error_code
714
    
715
    openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
716
    openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
717
                                        ctypes.POINTER(ctypes.c_uint)]
718
    openpgp_crt_verify_self.restype = _error_code
719
    
720
    openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
721
    openpgp_crt_deinit.argtypes = [openpgp_crt_t]
722
    openpgp_crt_deinit.restype = None
723
    
724
    openpgp_crt_get_fingerprint = (
725
        _library.gnutls_openpgp_crt_get_fingerprint)
726
    openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
727
                                            ctypes.c_void_p,
728
                                            ctypes.POINTER(
729
                                                ctypes.c_size_t)]
730
    openpgp_crt_get_fingerprint.restype = _error_code
731
    
802 by Teddy Hogeborn
Handle GnuTLS errors and partial sends in gnutls "module".
732
    # Remove non-public functions
733
    del _error_code, _retry_on_error
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
734
# Create the global "gnutls" object, simulating a module
735
gnutls = GnuTLS()
736
749.1.2 by Teddy Hogeborn
mandos (subprocess_call_pipe): Rename to "call_pipe" and take "func".
737
def call_pipe(connection,       # : multiprocessing.Connection
738
              func, *args, **kwargs):
749.1.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
739
    """This function is meant to be called by multiprocessing.Process
740
    
749.1.2 by Teddy Hogeborn
mandos (subprocess_call_pipe): Rename to "call_pipe" and take "func".
741
    This function runs func(*args, **kwargs), and writes the resulting
742
    return value on the provided multiprocessing.Connection.
749.1.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
743
    """
749.1.2 by Teddy Hogeborn
mandos (subprocess_call_pipe): Rename to "call_pipe" and take "func".
744
    connection.send(func(*args, **kwargs))
749.1.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
745
    connection.close()
582 by Teddy Hogeborn
* mandos (IPv6_TCPServer.server_bind): Bug fix: handle non-existing
746
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
747
class Client(object):
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
748
    """A representation of a client host served by this server.
331 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
749
    
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
750
    Attributes:
518.2.4 by Teddy Hogeborn
* mandos (_timedelta_to_milliseconds): Renamed to
751
    approved:   bool(); 'None' if not yet approved/disapproved
438 by Teddy Hogeborn
* mandos (Client.runtime_expansions): New attribute containing the
752
    approval_delay: datetime.timedelta(); Time to wait for approval
753
    approval_duration: datetime.timedelta(); Duration of one approval
238 by Teddy Hogeborn
First version of a somewhat complete D-Bus server interface. Also
754
    checker:    subprocess.Popen(); a running checker process used
755
                                    to see if the client lives.
756
                                    'None' if no process is running.
830 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
757
    checker_callback_tag: a GLib event source tag, or None
438 by Teddy Hogeborn
* mandos (Client.runtime_expansions): New attribute containing the
758
    checker_command: string; External command which is run to check
759
                     if client lives.  %() expansions are done at
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
760
                     runtime with vars(self) as dict, so that for
761
                     instance %(name)s can be used in the command.
830 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
762
    checker_initiator_tag: a GLib event source tag, or None
438 by Teddy Hogeborn
* mandos (Client.runtime_expansions): New attribute containing the
763
    created:    datetime.datetime(); (UTC) object creation
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
764
    client_structure: Object describing what attributes a client has
765
                      and is used for storing the client at exit
315 by Teddy Hogeborn
* mandos (Client.current_checker_command): New attribute.
766
    current_checker_command: string; current running checker_command
830 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
767
    disable_initiator_tag: a GLib event source tag, or None
438 by Teddy Hogeborn
* mandos (Client.runtime_expansions): New attribute containing the
768
    enabled:    bool()
769
    fingerprint: string (40 or 32 hexadecimal digits); used to
770
                 uniquely identify the client
771
    host:       string; available for use by the checker command
772
    interval:   datetime.timedelta(); How often to start a new checker
442 by Teddy Hogeborn
* DBUS-API: Document new "LastApprovalRequest" client property.
773
    last_approval_request: datetime.datetime(); (UTC) or None
438 by Teddy Hogeborn
* mandos (Client.runtime_expansions): New attribute containing the
774
    last_checked_ok: datetime.datetime(); (UTC) or None
521 by teddy at bsnet
* debian/control (mandos/Depends): Added "python-crypto".
775
    last_checker_status: integer between 0 and 255 reflecting exit
518.1.7 by Teddy Hogeborn
* mandos: Break long lines and fix some more white space.
776
                         status of last checker. -1 reflects crashed
556 by Teddy Hogeborn
* DBUS-API (se.recompile.Mandos.Client.LastCheckerStatus): New
777
                         checker, -2 means no checker completed yet.
749.1.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
778
    last_checker_signal: The signal which killed the last checker, if
779
                         last_checker_status is -1
518.2.3 by Teddy Hogeborn
Make "enabled" a client config option.
780
    last_enabled: datetime.datetime(); (UTC) or None
438 by Teddy Hogeborn
* mandos (Client.runtime_expansions): New attribute containing the
781
    name:       string; from the config file, used in log messages and
782
                        D-Bus identifiers
783
    secret:     bytestring; sent verbatim (over TLS) to client
784
    timeout:    datetime.timedelta(); How long from last_checked_ok
785
                                      until this client is disabled
552 by teddy at recompile
* mandos: Consistent terminology; use the term "secret" for the
786
    extended_timeout:   extra long timeout when secret has been sent
438 by Teddy Hogeborn
* mandos (Client.runtime_expansions): New attribute containing the
787
    runtime_expansions: Allowed attributes for runtime expansion.
497 by Teddy Hogeborn
* DBUS-API: Document new "Expires" and "ExtendedTimeout" properties.
788
    expires:    datetime.datetime(); time (UTC) when a client will be
24.1.179 by Björn Påhlsson
New feature:
789
                disabled, or None
617 by Teddy Hogeborn
* mandos: Bug fix: Don't print output from checkers when running in
790
    server_settings: The server_settings dict from main()
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
791
    """
333 by Teddy Hogeborn
Minor code cleanup; one minor bug fix.
792
    
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
793
    runtime_expansions = ("approval_delay", "approval_duration",
584 by Teddy Hogeborn
* mandos (Client.runtime_expansions): Add "expires" and (bug fix)
794
                          "created", "enabled", "expires",
795
                          "fingerprint", "host", "interval",
796
                          "last_approval_request", "last_checked_ok",
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
797
                          "last_enabled", "name", "timeout")
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
798
    client_defaults = {
799
        "timeout": "PT5M",
800
        "extended_timeout": "PT15M",
801
        "interval": "PT2M",
802
        "checker": "fping -q -- %%(host)s",
803
        "host": "",
804
        "approval_delay": "PT0S",
805
        "approval_duration": "PT1S",
806
        "approved_by_default": "True",
807
        "enabled": "True",
808
    }
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
809
    
518.1.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
810
    @staticmethod
811
    def config_parser(config):
542 by Björn Påhlsson
fixed bug with bad stored config state for expires and last_checked_ok.
812
        """Construct a new dict of client settings of this form:
518.1.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
813
        { client_name: {setting_name: value, ...}, ...}
542 by Björn Påhlsson
fixed bug with bad stored config state for expires and last_checked_ok.
814
        with exceptions for any special settings as defined above.
815
        NOTE: Must be a pure function. Must return the same result
816
        value given the same arguments.
817
        """
518.1.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
818
        settings = {}
819
        for client_name in config.sections():
820
            section = dict(config.items(client_name))
821
            client = settings[client_name] = {}
822
            
518.1.15 by Björn Påhlsson
more refactoring in regards to how clients get created
823
            client["host"] = section["host"]
518.1.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
824
            # Reformat values from string types to Python types
825
            client["approved_by_default"] = config.getboolean(
826
                client_name, "approved_by_default")
543 by Teddy Hogeborn
* mandos: Break some long lines.
827
            client["enabled"] = config.getboolean(client_name,
828
                                                  "enabled")
518.1.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
829
            
739 by Teddy Hogeborn
mandos (Client.config_parser): Move comment to correct place.
830
            # Uppercase and remove spaces from fingerprint for later
831
            # comparison purposes with return value from the
832
            # fingerprint() function
518.1.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
833
            client["fingerprint"] = (section["fingerprint"].upper()
834
                                     .replace(" ", ""))
835
            if "secret" in section:
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
836
                client["secret"] = codecs.decode(section["secret"]
837
                                                 .encode("utf-8"),
838
                                                 "base64")
518.1.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
839
            elif "secfile" in section:
840
                with open(os.path.expanduser(os.path.expandvars
841
                                             (section["secfile"])),
842
                          "rb") as secfile:
843
                    client["secret"] = secfile.read()
844
            else:
723.1.5 by Teddy Hogeborn
Use the new auto-numbered "{}" syntax for the .format() string method.
845
                raise TypeError("No secret or secfile for section {}"
568 by Teddy Hogeborn
* mandos-monitor: Use new string format method.
846
                                .format(section))
518.1.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
847
            client["timeout"] = string_to_delta(section["timeout"])
848
            client["extended_timeout"] = string_to_delta(
849
                section["extended_timeout"])
850
            client["interval"] = string_to_delta(section["interval"])
851
            client["approval_delay"] = string_to_delta(
852
                section["approval_delay"])
853
            client["approval_duration"] = string_to_delta(
854
                section["approval_duration"])
518.1.15 by Björn Påhlsson
more refactoring in regards to how clients get created
855
            client["checker_command"] = section["checker"]
856
            client["last_approval_request"] = None
857
            client["last_checked_ok"] = None
556 by Teddy Hogeborn
* DBUS-API (se.recompile.Mandos.Client.LastCheckerStatus): New
858
            client["last_checker_status"] = -2
542 by Björn Påhlsson
fixed bug with bad stored config state for expires and last_checked_ok.
859
        
518.1.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
860
        return settings
573 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
861
    
617 by Teddy Hogeborn
* mandos: Bug fix: Don't print output from checkers when running in
862
    def __init__(self, settings, name = None, server_settings=None):
243 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
863
        self.name = name
617 by Teddy Hogeborn
* mandos: Bug fix: Don't print output from checkers when running in
864
        if server_settings is None:
865
            server_settings = {}
866
        self.server_settings = server_settings
518.1.15 by Björn Påhlsson
more refactoring in regards to how clients get created
867
        # adding all client settings
723.1.4 by Teddy Hogeborn
Use the .items() method instead of .iteritems().
868
        for setting, value in settings.items():
518.1.15 by Björn Påhlsson
more refactoring in regards to how clients get created
869
            setattr(self, setting, value)
870
        
542 by Björn Påhlsson
fixed bug with bad stored config state for expires and last_checked_ok.
871
        if self.enabled:
872
            if not hasattr(self, "last_enabled"):
873
                self.last_enabled = datetime.datetime.utcnow()
874
            if not hasattr(self, "expires"):
875
                self.expires = (datetime.datetime.utcnow()
876
                                + self.timeout)
877
        else:
878
            self.last_enabled = None
879
            self.expires = None
573 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
880
        
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
881
        logger.debug("Creating client %r", self.name)
882
        logger.debug("  Fingerprint: %s", self.fingerprint)
543 by Teddy Hogeborn
* mandos: Break some long lines.
883
        self.created = settings.get("created",
884
                                    datetime.datetime.utcnow())
573 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
885
        
518.1.15 by Björn Påhlsson
more refactoring in regards to how clients get created
886
        # attributes specific for this server instance
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
887
        self.checker = None
888
        self.checker_initiator_tag = None
239 by Teddy Hogeborn
* mandos (_datetime_to_dbus_struct): Renamed to "_datetime_to_dbus";
889
        self.disable_initiator_tag = None
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
890
        self.checker_callback_tag = None
315 by Teddy Hogeborn
* mandos (Client.current_checker_command): New attribute.
891
        self.current_checker_command = None
518.2.4 by Teddy Hogeborn
* mandos (_timedelta_to_milliseconds): Renamed to
892
        self.approved = None
24.1.150 by Björn Påhlsson
* mandos: Added ClientDBus.approve_pending property. Exposed
893
        self.approvals_pending = 0
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
894
        self.changedstate = multiprocessing_manager.Condition(
895
            multiprocessing_manager.Lock())
896
        self.client_structure = [attr
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
897
                                 for attr in self.__dict__.keys()
521 by teddy at bsnet
* debian/control (mandos/Depends): Added "python-crypto".
898
                                 if not attr.startswith("_")]
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
899
        self.client_structure.append("client_structure")
518.1.6 by Teddy Hogeborn
* mandos: Fix whitespace.
900
        
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
901
        for name, t in inspect.getmembers(
902
                type(self), lambda obj: isinstance(obj, property)):
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
903
            if not name.startswith("_"):
904
                self.client_structure.append(name)
905
    
520 by Björn Påhlsson
merge persistent state
906
    # Send notice to process children that client state has changed
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
907
    def send_changedstate(self):
520 by Björn Påhlsson
merge persistent state
908
        with self.changedstate:
909
            self.changedstate.notify_all()
505.1.3 by Teddy Hogeborn
* mandos: Break long lines.
910
    
239 by Teddy Hogeborn
* mandos (_datetime_to_dbus_struct): Renamed to "_datetime_to_dbus";
911
    def enable(self):
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
912
        """Start this client's checker and timeout hooks"""
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
913
        if getattr(self, "enabled", False):
341 by Teddy Hogeborn
Code cleanup and one bug fix.
914
            # Already enabled
915
            return
24.1.179 by Björn Påhlsson
New feature:
916
        self.expires = datetime.datetime.utcnow() + self.timeout
239 by Teddy Hogeborn
* mandos (_datetime_to_dbus_struct): Renamed to "_datetime_to_dbus";
917
        self.enabled = True
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
918
        self.last_enabled = datetime.datetime.utcnow()
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
919
        self.init_checker()
581 by Teddy Hogeborn
* mandos (Client.enable, Client.disable, ClientDBus.approve): Call
920
        self.send_changedstate()
237.1.1 by Teddy Hogeborn
First steps of a D-Bus interface to the server.
921
    
402 by Teddy Hogeborn
* mandos (Client.disable): Rename keyword argument "log" to "quiet",
922
    def disable(self, quiet=True):
239 by Teddy Hogeborn
* mandos (_datetime_to_dbus_struct): Renamed to "_datetime_to_dbus";
923
        """Disable this client."""
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
924
        if not getattr(self, "enabled", False):
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
925
            return False
402 by Teddy Hogeborn
* mandos (Client.disable): Rename keyword argument "log" to "quiet",
926
        if not quiet:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
927
            logger.info("Disabling client %s", self.name)
581 by Teddy Hogeborn
* mandos (Client.enable, Client.disable, ClientDBus.approve): Call
928
        if getattr(self, "disable_initiator_tag", None) is not None:
830 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
929
            GLib.source_remove(self.disable_initiator_tag)
239 by Teddy Hogeborn
* mandos (_datetime_to_dbus_struct): Renamed to "_datetime_to_dbus";
930
            self.disable_initiator_tag = None
24.1.179 by Björn Påhlsson
New feature:
931
        self.expires = None
581 by Teddy Hogeborn
* mandos (Client.enable, Client.disable, ClientDBus.approve): Call
932
        if getattr(self, "checker_initiator_tag", None) is not None:
830 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
933
            GLib.source_remove(self.checker_initiator_tag)
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
934
            self.checker_initiator_tag = None
935
        self.stop_checker()
239 by Teddy Hogeborn
* mandos (_datetime_to_dbus_struct): Renamed to "_datetime_to_dbus";
936
        self.enabled = False
581 by Teddy Hogeborn
* mandos (Client.enable, Client.disable, ClientDBus.approve): Call
937
        if not quiet:
938
            self.send_changedstate()
830 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
939
        # Do not run this again if called by a GLib.timeout_add
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
940
        return False
237.1.1 by Teddy Hogeborn
First steps of a D-Bus interface to the server.
941
    
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
942
    def __del__(self):
239 by Teddy Hogeborn
* mandos (_datetime_to_dbus_struct): Renamed to "_datetime_to_dbus";
943
        self.disable()
518.1.6 by Teddy Hogeborn
* mandos: Fix whitespace.
944
    
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
945
    def init_checker(self):
946
        # Schedule a new checker to be started an 'interval' from now,
947
        # and every interval from then on.
581 by Teddy Hogeborn
* mandos (Client.enable, Client.disable, ClientDBus.approve): Call
948
        if self.checker_initiator_tag is not None:
830 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
949
            GLib.source_remove(self.checker_initiator_tag)
950
        self.checker_initiator_tag = GLib.timeout_add(
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
951
            int(self.interval.total_seconds() * 1000),
952
            self.start_checker)
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
953
        # Schedule a disable() when 'timeout' has passed
581 by Teddy Hogeborn
* mandos (Client.enable, Client.disable, ClientDBus.approve): Call
954
        if self.disable_initiator_tag is not None:
830 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
955
            GLib.source_remove(self.disable_initiator_tag)
956
        self.disable_initiator_tag = GLib.timeout_add(
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
957
            int(self.timeout.total_seconds() * 1000), self.disable)
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
958
        # Also start a new checker *right now*.
959
        self.start_checker()
518.1.6 by Teddy Hogeborn
* mandos: Fix whitespace.
960
    
756 by Teddy Hogeborn
Merge change to use multiprocessing module to run checkers.
961
    def checker_callback(self, source, condition, connection,
962
                         command):
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
963
        """The checker has completed, so take appropriate actions."""
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
964
        self.checker_callback_tag = None
965
        self.checker = None
749.1.2 by Teddy Hogeborn
mandos (subprocess_call_pipe): Rename to "call_pipe" and take "func".
966
        # Read return code from connection (see call_pipe)
749.1.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
967
        returncode = connection.recv()
968
        connection.close()
969
        
970
        if returncode >= 0:
971
            self.last_checker_status = returncode
972
            self.last_checker_signal = None
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
973
            if self.last_checker_status == 0:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
974
                logger.info("Checker for %(name)s succeeded",
280 by Teddy Hogeborn
* mandos (Client.CheckerCompleted): Changed signature to "nxs"; return
975
                            vars(self))
281 by Teddy Hogeborn
* mandos (Client.bump_timeout): Renamed to "checked_ok". All callers
976
                self.checked_ok()
280 by Teddy Hogeborn
* mandos (Client.CheckerCompleted): Changed signature to "nxs"; return
977
            else:
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
978
                logger.info("Checker for %(name)s failed", vars(self))
280 by Teddy Hogeborn
* mandos (Client.CheckerCompleted): Changed signature to "nxs"; return
979
        else:
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
980
            self.last_checker_status = -1
749.1.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
981
            self.last_checker_signal = -returncode
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
982
            logger.warning("Checker for %(name)s crashed?",
13 by Björn Påhlsson
Added following support:
983
                           vars(self))
749.1.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
984
        return False
237.1.1 by Teddy Hogeborn
First steps of a D-Bus interface to the server.
985
    
556 by Teddy Hogeborn
* DBUS-API (se.recompile.Mandos.Client.LastCheckerStatus): New
986
    def checked_ok(self):
987
        """Assert that the client has been seen, alive and well."""
988
        self.last_checked_ok = datetime.datetime.utcnow()
989
        self.last_checker_status = 0
749.1.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
990
        self.last_checker_signal = None
556 by Teddy Hogeborn
* DBUS-API (se.recompile.Mandos.Client.LastCheckerStatus): New
991
        self.bump_timeout()
992
    
993
    def bump_timeout(self, timeout=None):
994
        """Bump up the timeout for this client."""
24.1.179 by Björn Påhlsson
New feature:
995
        if timeout is None:
996
            timeout = self.timeout
505.1.17 by Teddy Hogeborn
* mandos (Client.checked_ok): Bug fix: Handle disabled client.
997
        if self.disable_initiator_tag is not None:
830 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
998
            GLib.source_remove(self.disable_initiator_tag)
581 by Teddy Hogeborn
* mandos (Client.enable, Client.disable, ClientDBus.approve): Call
999
            self.disable_initiator_tag = None
505.1.17 by Teddy Hogeborn
* mandos (Client.checked_ok): Bug fix: Handle disabled client.
1000
        if getattr(self, "enabled", False):
830 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
1001
            self.disable_initiator_tag = GLib.timeout_add(
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1002
                int(timeout.total_seconds() * 1000), self.disable)
505.1.17 by Teddy Hogeborn
* mandos (Client.checked_ok): Bug fix: Handle disabled client.
1003
            self.expires = datetime.datetime.utcnow() + timeout
237.1.1 by Teddy Hogeborn
First steps of a D-Bus interface to the server.
1004
    
442 by Teddy Hogeborn
* DBUS-API: Document new "LastApprovalRequest" client property.
1005
    def need_approval(self):
1006
        self.last_approval_request = datetime.datetime.utcnow()
1007
    
9 by Teddy Hogeborn
* client.cpp (main): Get t_old early since it is used on error exits.
1008
    def start_checker(self):
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
1009
        """Start a new checker subprocess if one is not running.
331 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
1010
        
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
1011
        If a checker already exists, leave it running and do
1012
        nothing."""
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
1013
        # The reason for not killing a running checker is that if we
577 by Teddy Hogeborn
* mandos (Client.start_checker): Reworded comment.
1014
        # did that, and if a checker (for some reason) started running
1015
        # slowly and taking more than 'interval' time, then the client
1016
        # would inevitably timeout, since no checker would get a
1017
        # chance to run to completion.  If we instead leave running
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
1018
        # checkers alone, the checker would have to take more time
411 by Teddy Hogeborn
More consistent terminology: Clients are no longer "invalid" - they
1019
        # than 'timeout' for the client to be disabled, which is as it
1020
        # should be.
315 by Teddy Hogeborn
* mandos (Client.current_checker_command): New attribute.
1021
        
749.1.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
1022
        if self.checker is not None and not self.checker.is_alive():
1023
            logger.warning("Checker was not alive; joining")
1024
            self.checker.join()
1025
            self.checker = None
315 by Teddy Hogeborn
* mandos (Client.current_checker_command): New attribute.
1026
        # Start a new checker if needed
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
1027
        if self.checker is None:
583 by Teddy Hogeborn
* mandos (Client.start_checker): Remove undocumented support for "%%s"
1028
            # Escape attributes for the shell
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1029
            escaped_attrs = {
1030
                attr: re.escape(str(getattr(self, attr)))
1031
                for attr in self.runtime_expansions }
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
1032
            try:
583 by Teddy Hogeborn
* mandos (Client.start_checker): Remove undocumented support for "%%s"
1033
                command = self.checker_command % escaped_attrs
1034
            except TypeError as error:
1035
                logger.error('Could not format string "%s"',
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1036
                             self.checker_command,
1037
                             exc_info=error)
1038
                return True     # Try again later
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1039
            self.current_checker_command = command
749.1.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
1040
            logger.info("Starting checker %r for %s", command,
1041
                        self.name)
1042
            # We don't need to redirect stdout and stderr, since
1043
            # in normal mode, that is already done by daemon(),
1044
            # and in debug mode we don't want to.  (Stdin is
1045
            # always replaced by /dev/null.)
1046
            # The exception is when not debugging but nevertheless
1047
            # running in the foreground; use the previously
1048
            # created wnull.
1049
            popen_args = { "close_fds": True,
1050
                           "shell": True,
1051
                           "cwd": "/" }
1052
            if (not self.server_settings["debug"]
1053
                and self.server_settings["foreground"]):
1054
                popen_args.update({"stdout": wnull,
1055
                                   "stderr": wnull })
756 by Teddy Hogeborn
Merge change to use multiprocessing module to run checkers.
1056
            pipe = multiprocessing.Pipe(duplex = False)
749.1.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
1057
            self.checker = multiprocessing.Process(
749.1.2 by Teddy Hogeborn
mandos (subprocess_call_pipe): Rename to "call_pipe" and take "func".
1058
                target = call_pipe,
756 by Teddy Hogeborn
Merge change to use multiprocessing module to run checkers.
1059
                args = (pipe[1], subprocess.call, command),
749.1.2 by Teddy Hogeborn
mandos (subprocess_call_pipe): Rename to "call_pipe" and take "func".
1060
                kwargs = popen_args)
749.1.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
1061
            self.checker.start()
830 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
1062
            self.checker_callback_tag = GLib.io_add_watch(
1063
                pipe[0].fileno(), GLib.IO_IN,
756 by Teddy Hogeborn
Merge change to use multiprocessing module to run checkers.
1064
                self.checker_callback, pipe[0], command)
830 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
1065
        # Re-run this periodically if run by GLib.timeout_add
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
1066
        return True
237.1.1 by Teddy Hogeborn
First steps of a D-Bus interface to the server.
1067
    
9 by Teddy Hogeborn
* client.cpp (main): Get t_old early since it is used on error exits.
1068
    def stop_checker(self):
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
1069
        """Force the checker process, if any, to stop."""
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
1070
        if self.checker_callback_tag:
830 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
1071
            GLib.source_remove(self.checker_callback_tag)
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
1072
            self.checker_callback_tag = None
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1073
        if getattr(self, "checker", None) is None:
9 by Teddy Hogeborn
* client.cpp (main): Get t_old early since it is used on error exits.
1074
            return
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1075
        logger.debug("Stopping checker for %(name)s", vars(self))
749.1.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
1076
        self.checker.terminate()
9 by Teddy Hogeborn
* client.cpp (main): Get t_old early since it is used on error exits.
1077
        self.checker = None
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
1078
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
1079
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1080
def dbus_service_property(dbus_interface,
1081
                          signature="v",
1082
                          access="readwrite",
1083
                          byte_arrays=False):
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1084
    """Decorators for marking methods of a DBusObjectWithProperties to
1085
    become properties on the D-Bus.
1086
    
1087
    The decorated method will be called with no arguments by "Get"
1088
    and with one argument by "Set".
1089
    
1090
    The parameters, where they are supported, are the same as
1091
    dbus.service.method, except there is only "signature", since the
1092
    type from Get() and the type sent to Set() is the same.
1093
    """
411 by Teddy Hogeborn
More consistent terminology: Clients are no longer "invalid" - they
1094
    # Encoding deeply encoded byte arrays is not supported yet by the
1095
    # "Set" method, so we fail early here:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1096
    if byte_arrays and signature != "ay":
1097
        raise ValueError("Byte arrays not supported for non-'ay'"
723.1.5 by Teddy Hogeborn
Use the new auto-numbered "{}" syntax for the .format() string method.
1098
                         " signature {!r}".format(signature))
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1099
    
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1100
    def decorator(func):
1101
        func._dbus_is_property = True
1102
        func._dbus_interface = dbus_interface
1103
        func._dbus_signature = signature
1104
        func._dbus_access = access
1105
        func._dbus_name = func.__name__
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1106
        if func._dbus_name.endswith("_dbus_property"):
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1107
            func._dbus_name = func._dbus_name[:-14]
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1108
        func._dbus_get_args_options = {'byte_arrays': byte_arrays }
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1109
        return func
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1110
    
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1111
    return decorator
1112
1113
560.1.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
1114
def dbus_interface_annotations(dbus_interface):
573 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
1115
    """Decorator for marking functions returning interface annotations
560.1.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
1116
    
1117
    Usage:
1118
    
1119
    @dbus_interface_annotations("org.example.Interface")
1120
    def _foo(self):  # Function name does not matter
1121
        return {"org.freedesktop.DBus.Deprecated": "true",
1122
                "org.freedesktop.DBus.Property.EmitsChangedSignal":
1123
                    "false"}
1124
    """
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1125
    
560.1.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
1126
    def decorator(func):
1127
        func._dbus_is_interface = True
1128
        func._dbus_interface = dbus_interface
1129
        func._dbus_name = dbus_interface
1130
        return func
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1131
    
560.1.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
1132
    return decorator
1133
1134
561.1.1 by Teddy Hogeborn
Add D-Bus annotations support to methods, signals and properties.
1135
def dbus_annotations(annotations):
1136
    """Decorator to annotate D-Bus methods, signals or properties
1137
    Usage:
1138
    
732 by Teddy Hogeborn
Emit D-Bus "org.freedesktop.DBus.Properties.PropertiesChanged" signal.
1139
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",
1140
                       "org.freedesktop.DBus.Property."
1141
                       "EmitsChangedSignal": "false"})
561.1.1 by Teddy Hogeborn
Add D-Bus annotations support to methods, signals and properties.
1142
    @dbus_service_property("org.example.Interface", signature="b",
1143
                           access="r")
1144
    def Property_dbus_property(self):
1145
        return dbus.Boolean(False)
784 by Teddy Hogeborn
Refactor D-Bus annotation class out from D-Bus properties class.
1146
    
1147
    See also the DBusObjectWithAnnotations class.
561.1.1 by Teddy Hogeborn
Add D-Bus annotations support to methods, signals and properties.
1148
    """
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1149
    
561.1.1 by Teddy Hogeborn
Add D-Bus annotations support to methods, signals and properties.
1150
    def decorator(func):
1151
        func._dbus_annotations = annotations
1152
        return func
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1153
    
561.1.1 by Teddy Hogeborn
Add D-Bus annotations support to methods, signals and properties.
1154
    return decorator
1155
1156
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1157
class DBusPropertyException(dbus.exceptions.DBusException):
1158
    """A base class for D-Bus property-related exceptions
1159
    """
729 by Teddy Hogeborn
mandos: Stop using str() and remove unnecessary unicode() calls.
1160
    pass
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1161
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1162
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1163
class DBusPropertyAccessException(DBusPropertyException):
1164
    """A property's access permissions disallows an operation.
1165
    """
1166
    pass
1167
1168
1169
class DBusPropertyNotFound(DBusPropertyException):
1170
    """An attempt was made to access a non-existing property.
1171
    """
1172
    pass
1173
1174
784 by Teddy Hogeborn
Refactor D-Bus annotation class out from D-Bus properties class.
1175
class DBusObjectWithAnnotations(dbus.service.Object):
1176
    """A D-Bus object with annotations.
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
1177
    
784 by Teddy Hogeborn
Refactor D-Bus annotation class out from D-Bus properties class.
1178
    Classes inheriting from this can use the dbus_annotations
1179
    decorator to add annotations to methods or signals.
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1180
    """
1181
    
1182
    @staticmethod
560.1.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
1183
    def _is_dbus_thing(thing):
1184
        """Returns a function testing if an attribute is a D-Bus thing
1185
        
1186
        If called like _is_dbus_thing("method") it returns a function
1187
        suitable for use as predicate to inspect.getmembers().
1188
        """
723.1.5 by Teddy Hogeborn
Use the new auto-numbered "{}" syntax for the .format() string method.
1189
        return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
560.1.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
1190
                                   False)
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1191
    
560.1.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
1192
    def _get_all_dbus_things(self, thing):
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1193
        """Returns a generator of (name, attribute) pairs
1194
        """
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1195
        return ((getattr(athing.__get__(self), "_dbus_name", name),
560.1.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
1196
                 athing.__get__(self))
24.1.186 by Björn Påhlsson
transitional stuff actually working
1197
                for cls in self.__class__.__mro__
560.1.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
1198
                for name, athing in
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1199
                inspect.getmembers(cls, self._is_dbus_thing(thing)))
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1200
    
784 by Teddy Hogeborn
Refactor D-Bus annotation class out from D-Bus properties class.
1201
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1202
                         out_signature = "s",
1203
                         path_keyword = 'object_path',
1204
                         connection_keyword = 'connection')
1205
    def Introspect(self, object_path, connection):
1206
        """Overloading of standard D-Bus method.
1207
        
1208
        Inserts annotation tags on methods and signals.
1209
        """
1210
        xmlstring = dbus.service.Object.Introspect(self, object_path,
1211
                                                   connection)
1212
        try:
1213
            document = xml.dom.minidom.parseString(xmlstring)
1214
            
1215
            for if_tag in document.getElementsByTagName("interface"):
1216
                # Add annotation tags
1217
                for typ in ("method", "signal"):
1218
                    for tag in if_tag.getElementsByTagName(typ):
1219
                        annots = dict()
1220
                        for name, prop in (self.
1221
                                           _get_all_dbus_things(typ)):
1222
                            if (name == tag.getAttribute("name")
1223
                                and prop._dbus_interface
1224
                                == if_tag.getAttribute("name")):
1225
                                annots.update(getattr(
1226
                                    prop, "_dbus_annotations", {}))
1227
                        for name, value in annots.items():
1228
                            ann_tag = document.createElement(
1229
                                "annotation")
1230
                            ann_tag.setAttribute("name", name)
1231
                            ann_tag.setAttribute("value", value)
1232
                            tag.appendChild(ann_tag)
1233
                # Add interface annotation tags
1234
                for annotation, value in dict(
1235
                    itertools.chain.from_iterable(
1236
                        annotations().items()
1237
                        for name, annotations
1238
                        in self._get_all_dbus_things("interface")
1239
                        if name == if_tag.getAttribute("name")
1240
                        )).items():
1241
                    ann_tag = document.createElement("annotation")
1242
                    ann_tag.setAttribute("name", annotation)
1243
                    ann_tag.setAttribute("value", value)
1244
                    if_tag.appendChild(ann_tag)
1245
                # Fix argument name for the Introspect method itself
1246
                if (if_tag.getAttribute("name")
1247
                                == dbus.INTROSPECTABLE_IFACE):
1248
                    for cn in if_tag.getElementsByTagName("method"):
1249
                        if cn.getAttribute("name") == "Introspect":
1250
                            for arg in cn.getElementsByTagName("arg"):
1251
                                if (arg.getAttribute("direction")
1252
                                    == "out"):
1253
                                    arg.setAttribute("name",
1254
                                                     "xml_data")
1255
            xmlstring = document.toxml("utf-8")
1256
            document.unlink()
1257
        except (AttributeError, xml.dom.DOMException,
1258
                xml.parsers.expat.ExpatError) as error:
1259
            logger.error("Failed to override Introspection method",
1260
                         exc_info=error)
1261
        return xmlstring
1262
1263
1264
class DBusObjectWithProperties(DBusObjectWithAnnotations):
1265
    """A D-Bus object with properties.
1266
    
1267
    Classes inheriting from this can use the dbus_service_property
1268
    decorator to expose methods as D-Bus properties.  It exposes the
1269
    standard Get(), Set(), and GetAll() methods on the D-Bus.
1270
    """
1271
    
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1272
    def _get_dbus_property(self, interface_name, property_name):
1273
        """Returns a bound method if one exists which is a D-Bus
1274
        property with the specified name and interface.
1275
        """
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1276
        for cls in self.__class__.__mro__:
1277
            for name, value in inspect.getmembers(
1278
                    cls, self._is_dbus_thing("property")):
505.1.3 by Teddy Hogeborn
* mandos: Break long lines.
1279
                if (value._dbus_name == property_name
1280
                    and value._dbus_interface == interface_name):
24.1.186 by Björn Påhlsson
transitional stuff actually working
1281
                    return value.__get__(self)
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
1282
        
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1283
        # No such property
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1284
        raise DBusPropertyNotFound("{}:{}.{}".format(
1285
            self.dbus_object_path, interface_name, property_name))
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1286
    
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
1287
    @classmethod
1288
    def _get_all_interface_names(cls):
1289
        """Get a sequence of all interfaces supported by an object"""
1290
        return (name for name in set(getattr(getattr(x, attr),
1291
                                             "_dbus_interface", None)
1292
                                     for x in (inspect.getmro(cls))
1293
                                     for attr in dir(x))
1294
                if name is not None)
1295
    
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1296
    @dbus.service.method(dbus.PROPERTIES_IFACE,
1297
                         in_signature="ss",
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1298
                         out_signature="v")
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1299
    def Get(self, interface_name, property_name):
1300
        """Standard D-Bus property Get() method, see D-Bus standard.
1301
        """
1302
        prop = self._get_dbus_property(interface_name, property_name)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1303
        if prop._dbus_access == "write":
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1304
            raise DBusPropertyAccessException(property_name)
1305
        value = prop()
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1306
        if not hasattr(value, "variant_level"):
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1307
            return value
1308
        return type(value)(value, variant_level=value.variant_level+1)
1309
    
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1310
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1311
    def Set(self, interface_name, property_name, value):
1312
        """Standard D-Bus property Set() method, see D-Bus standard.
1313
        """
1314
        prop = self._get_dbus_property(interface_name, property_name)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1315
        if prop._dbus_access == "read":
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1316
            raise DBusPropertyAccessException(property_name)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1317
        if prop._dbus_get_args_options["byte_arrays"]:
411 by Teddy Hogeborn
More consistent terminology: Clients are no longer "invalid" - they
1318
            # The byte_arrays option is not supported yet on
1319
            # signatures other than "ay".
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1320
            if prop._dbus_signature != "ay":
649 by Teddy Hogeborn
Minor code fix; raise only exception instances, not classes.
1321
                raise ValueError("Byte arrays not supported for non-"
723.1.5 by Teddy Hogeborn
Use the new auto-numbered "{}" syntax for the .format() string method.
1322
                                 "'ay' signature {!r}"
649 by Teddy Hogeborn
Minor code fix; raise only exception instances, not classes.
1323
                                 .format(prop._dbus_signature))
546 by Teddy Hogeborn
* debian/rules (binary-common): Exclude network-hooks.d from
1324
            value = dbus.ByteArray(b''.join(chr(byte)
1325
                                            for byte in value))
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1326
        prop(value)
1327
    
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1328
    @dbus.service.method(dbus.PROPERTIES_IFACE,
1329
                         in_signature="s",
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1330
                         out_signature="a{sv}")
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1331
    def GetAll(self, interface_name):
1332
        """Standard D-Bus property GetAll() method, see D-Bus
1333
        standard.
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
1334
        
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1335
        Note: Will not include properties with access="write".
1336
        """
518.1.5 by Björn Påhlsson
First run of python-lint. Fixed some *obviously* bad code and turned
1337
        properties = {}
560.1.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
1338
        for name, prop in self._get_all_dbus_things("property"):
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1339
            if (interface_name
1340
                and interface_name != prop._dbus_interface):
1341
                # Interface non-empty but did not match
1342
                continue
1343
            # Ignore write-only properties
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1344
            if prop._dbus_access == "write":
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1345
                continue
1346
            value = prop()
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1347
            if not hasattr(value, "variant_level"):
518.1.5 by Björn Påhlsson
First run of python-lint. Fixed some *obviously* bad code and turned
1348
                properties[name] = value
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1349
                continue
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1350
            properties[name] = type(value)(
1351
                value, variant_level = value.variant_level + 1)
518.1.5 by Björn Påhlsson
First run of python-lint. Fixed some *obviously* bad code and turned
1352
        return dbus.Dictionary(properties, signature="sv")
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1353
    
732 by Teddy Hogeborn
Emit D-Bus "org.freedesktop.DBus.Properties.PropertiesChanged" signal.
1354
    @dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")
1355
    def PropertiesChanged(self, interface_name, changed_properties,
1356
                          invalidated_properties):
1357
        """Standard D-Bus PropertiesChanged() signal, see D-Bus
1358
        standard.
1359
        """
1360
        pass
1361
    
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1362
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1363
                         out_signature="s",
1364
                         path_keyword='object_path',
1365
                         connection_keyword='connection')
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1366
    def Introspect(self, object_path, connection):
560.1.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
1367
        """Overloading of standard D-Bus method.
1368
        
1369
        Inserts property tags and interface annotation tags.
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1370
        """
784 by Teddy Hogeborn
Refactor D-Bus annotation class out from D-Bus properties class.
1371
        xmlstring = DBusObjectWithAnnotations.Introspect(self,
1372
                                                         object_path,
1373
                                                         connection)
387 by Teddy Hogeborn
* mandos (ClientDBus.ReceivedSecret): Renamed to "GotSecret". All
1374
        try:
1375
            document = xml.dom.minidom.parseString(xmlstring)
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1376
            
387 by Teddy Hogeborn
* mandos (ClientDBus.ReceivedSecret): Renamed to "GotSecret". All
1377
            def make_tag(document, name, prop):
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1378
                e = document.createElement("property")
1379
                e.setAttribute("name", name)
1380
                e.setAttribute("type", prop._dbus_signature)
1381
                e.setAttribute("access", prop._dbus_access)
387 by Teddy Hogeborn
* mandos (ClientDBus.ReceivedSecret): Renamed to "GotSecret". All
1382
                return e
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1383
            
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1384
            for if_tag in document.getElementsByTagName("interface"):
560.1.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
1385
                # Add property tags
387 by Teddy Hogeborn
* mandos (ClientDBus.ReceivedSecret): Renamed to "GotSecret". All
1386
                for tag in (make_tag(document, name, prop)
1387
                            for name, prop
560.1.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
1388
                            in self._get_all_dbus_things("property")
387 by Teddy Hogeborn
* mandos (ClientDBus.ReceivedSecret): Renamed to "GotSecret". All
1389
                            if prop._dbus_interface
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1390
                            == if_tag.getAttribute("name")):
387 by Teddy Hogeborn
* mandos (ClientDBus.ReceivedSecret): Renamed to "GotSecret". All
1391
                    if_tag.appendChild(tag)
784 by Teddy Hogeborn
Refactor D-Bus annotation class out from D-Bus properties class.
1392
                # Add annotation tags for properties
1393
                for tag in if_tag.getElementsByTagName("property"):
1394
                    annots = dict()
1395
                    for name, prop in self._get_all_dbus_things(
1396
                            "property"):
1397
                        if (name == tag.getAttribute("name")
1398
                            and prop._dbus_interface
1399
                            == if_tag.getAttribute("name")):
1400
                            annots.update(getattr(
1401
                                prop, "_dbus_annotations", {}))
1402
                    for name, value in annots.items():
1403
                        ann_tag = document.createElement(
1404
                            "annotation")
1405
                        ann_tag.setAttribute("name", name)
1406
                        ann_tag.setAttribute("value", value)
1407
                        tag.appendChild(ann_tag)
387 by Teddy Hogeborn
* mandos (ClientDBus.ReceivedSecret): Renamed to "GotSecret". All
1408
                # Add the names to the return values for the
1409
                # "org.freedesktop.DBus.Properties" methods
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1410
                if (if_tag.getAttribute("name")
1411
                    == "org.freedesktop.DBus.Properties"):
1412
                    for cn in if_tag.getElementsByTagName("method"):
1413
                        if cn.getAttribute("name") == "Get":
1414
                            for arg in cn.getElementsByTagName("arg"):
1415
                                if (arg.getAttribute("direction")
1416
                                    == "out"):
1417
                                    arg.setAttribute("name", "value")
1418
                        elif cn.getAttribute("name") == "GetAll":
1419
                            for arg in cn.getElementsByTagName("arg"):
1420
                                if (arg.getAttribute("direction")
1421
                                    == "out"):
1422
                                    arg.setAttribute("name", "props")
1423
            xmlstring = document.toxml("utf-8")
387 by Teddy Hogeborn
* mandos (ClientDBus.ReceivedSecret): Renamed to "GotSecret". All
1424
            document.unlink()
1425
        except (AttributeError, xml.dom.DOMException,
482 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
1426
                xml.parsers.expat.ExpatError) as error:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1427
            logger.error("Failed to override Introspection method",
565 by Teddy Hogeborn
* mandos (AvahiService.rename, Client.start_checker,
1428
                         exc_info=error)
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1429
        return xmlstring
1430
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
1431
try:
1432
    dbus.OBJECT_MANAGER_IFACE
1433
except AttributeError:
1434
    dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
1435
1436
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
1437
    """A D-Bus object with an ObjectManager.
1438
    
1439
    Classes inheriting from this exposes the standard
1440
    GetManagedObjects call and the InterfacesAdded and
1441
    InterfacesRemoved signals on the standard
1442
    "org.freedesktop.DBus.ObjectManager" interface.
1443
    
1444
    Note: No signals are sent automatically; they must be sent
1445
    manually.
1446
    """
1447
    @dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
1448
                         out_signature = "a{oa{sa{sv}}}")
1449
    def GetManagedObjects(self):
1450
        """This function must be overridden"""
1451
        raise NotImplementedError()
1452
    
1453
    @dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
1454
                         signature = "oa{sa{sv}}")
1455
    def InterfacesAdded(self, object_path, interfaces_and_properties):
1456
        pass
1457
    
786 by Teddy Hogeborn
Server Bug fix: Make D-Bus introspection work again.
1458
    @dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature = "oas")
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
1459
    def InterfacesRemoved(self, object_path, interfaces):
1460
        pass
1461
    
1462
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1463
                         out_signature = "s",
1464
                         path_keyword = 'object_path',
1465
                         connection_keyword = 'connection')
1466
    def Introspect(self, object_path, connection):
1467
        """Overloading of standard D-Bus method.
1468
        
1469
        Override return argument name of GetManagedObjects to be
1470
        "objpath_interfaces_and_properties"
1471
        """
786 by Teddy Hogeborn
Server Bug fix: Make D-Bus introspection work again.
1472
        xmlstring = DBusObjectWithAnnotations.Introspect(self,
1473
                                                         object_path,
1474
                                                         connection)
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
1475
        try:
1476
            document = xml.dom.minidom.parseString(xmlstring)
1477
            
1478
            for if_tag in document.getElementsByTagName("interface"):
1479
                # Fix argument name for the GetManagedObjects method
1480
                if (if_tag.getAttribute("name")
1481
                                == dbus.OBJECT_MANAGER_IFACE):
1482
                    for cn in if_tag.getElementsByTagName("method"):
1483
                        if (cn.getAttribute("name")
1484
                            == "GetManagedObjects"):
1485
                            for arg in cn.getElementsByTagName("arg"):
1486
                                if (arg.getAttribute("direction")
1487
                                    == "out"):
1488
                                    arg.setAttribute(
1489
                                        "name",
1490
                                        "objpath_interfaces"
1491
                                        "_and_properties")
1492
            xmlstring = document.toxml("utf-8")
1493
            document.unlink()
1494
        except (AttributeError, xml.dom.DOMException,
1495
                xml.parsers.expat.ExpatError) as error:
1496
            logger.error("Failed to override Introspection method",
1497
                         exc_info = error)
1498
        return xmlstring
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1499
587 by Teddy Hogeborn
* Makefile (DOCBOOKTOMAN): Only run man --warnings if both "man" and
1500
def datetime_to_dbus(dt, variant_level=0):
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1501
    """Convert a UTC datetime.datetime() to a D-Bus type."""
1502
    if dt is None:
1503
        return dbus.String("", variant_level = variant_level)
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1504
    return dbus.String(dt.isoformat(), variant_level=variant_level)
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1505
518.1.6 by Teddy Hogeborn
* mandos: Fix whitespace.
1506
575 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1507
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
1508
    """A class decorator; applied to a subclass of
1509
    dbus.service.Object, it will add alternate D-Bus attributes with
1510
    interface names according to the "alt_interface_names" mapping.
1511
    Usage:
1512
    
587 by Teddy Hogeborn
* Makefile (DOCBOOKTOMAN): Only run man --warnings if both "man" and
1513
    @alternate_dbus_interfaces({"org.example.Interface":
1514
                                    "net.example.AlternateInterface"})
575 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1515
    class SampleDBusObject(dbus.service.Object):
1516
        @dbus.service.method("org.example.Interface")
1517
        def SampleDBusMethod():
1518
            pass
1519
    
1520
    The above "SampleDBusMethod" on "SampleDBusObject" will be
1521
    reachable via two interfaces: "org.example.Interface" and
1522
    "net.example.AlternateInterface", the latter of which will have
1523
    its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
1524
    "true", unless "deprecate" is passed with a False value.
1525
    
1526
    This works for methods and signals, and also for D-Bus properties
1527
    (from DBusObjectWithProperties) and interfaces (from the
1528
    dbus_interface_annotations decorator).
505.1.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1529
    """
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1530
    
575 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1531
    def wrapper(cls):
1532
        for orig_interface_name, alt_interface_name in (
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1533
                alt_interface_names.items()):
575 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1534
            attr = {}
1535
            interface_names = set()
1536
            # Go though all attributes of the class
1537
            for attrname, attribute in inspect.getmembers(cls):
505.1.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1538
                # Ignore non-D-Bus attributes, and D-Bus attributes
1539
                # with the wrong interface name
1540
                if (not hasattr(attribute, "_dbus_interface")
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1541
                    or not attribute._dbus_interface.startswith(
1542
                        orig_interface_name)):
505.1.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1543
                    continue
1544
                # Create an alternate D-Bus interface name based on
1545
                # the current name
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1546
                alt_interface = attribute._dbus_interface.replace(
1547
                    orig_interface_name, alt_interface_name)
575 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1548
                interface_names.add(alt_interface)
505.1.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1549
                # Is this a D-Bus signal?
1550
                if getattr(attribute, "_dbus_is_signal", False):
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
1551
                    # Extract the original non-method undecorated
1552
                    # function by black magic
756 by Teddy Hogeborn
Merge change to use multiprocessing module to run checkers.
1553
                    if sys.version_info.major == 2:
754 by Teddy Hogeborn
mandos: More Python 3 fixes.
1554
                        nonmethod_func = (dict(
1555
                            zip(attribute.func_code.co_freevars,
1556
                                attribute.__closure__))
1557
                                          ["func"].cell_contents)
1558
                    else:
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
1559
                        nonmethod_func = (dict(
1560
                            zip(attribute.__code__.co_freevars,
1561
                                attribute.__closure__))
1562
                                          ["func"].cell_contents)
505.1.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1563
                    # Create a new, but exactly alike, function
1564
                    # object, and decorate it to be a new D-Bus signal
1565
                    # with the alternate D-Bus interface name
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
1566
                    new_function = copy_function(nonmethod_func)
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1567
                    new_function = (dbus.service.signal(
754 by Teddy Hogeborn
mandos: More Python 3 fixes.
1568
                        alt_interface,
1569
                        attribute._dbus_signature)(new_function))
561.1.1 by Teddy Hogeborn
Add D-Bus annotations support to methods, signals and properties.
1570
                    # Copy annotations, if any
1571
                    try:
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1572
                        new_function._dbus_annotations = dict(
1573
                            attribute._dbus_annotations)
561.1.1 by Teddy Hogeborn
Add D-Bus annotations support to methods, signals and properties.
1574
                    except AttributeError:
1575
                        pass
505.1.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1576
                    # Define a creator of a function to call both the
575 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1577
                    # original and alternate functions, so both the
1578
                    # original and alternate signals gets sent when
1579
                    # the function is called
505.1.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1580
                    def fixscope(func1, func2):
1581
                        """This function is a scope container to pass
1582
                        func1 and func2 to the "call_both" function
1583
                        outside of its arguments"""
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1584
                        
786 by Teddy Hogeborn
Server Bug fix: Make D-Bus introspection work again.
1585
                        @functools.wraps(func2)
505.1.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1586
                        def call_both(*args, **kwargs):
1587
                            """This function will emit two D-Bus
1588
                            signals by calling func1 and func2"""
1589
                            func1(*args, **kwargs)
1590
                            func2(*args, **kwargs)
786 by Teddy Hogeborn
Server Bug fix: Make D-Bus introspection work again.
1591
                        # Make wrapper function look like a D-Bus signal
1592
                        for name, attr in inspect.getmembers(func2):
1593
                            if name.startswith("_dbus_"):
1594
                                setattr(call_both, name, attr)
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1595
                        
505.1.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1596
                        return call_both
1597
                    # Create the "call_both" function and add it to
1598
                    # the class
575 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1599
                    attr[attrname] = fixscope(attribute, new_function)
505.1.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1600
                # Is this a D-Bus method?
1601
                elif getattr(attribute, "_dbus_is_method", False):
1602
                    # Create a new, but exactly alike, function
1603
                    # object.  Decorate it to be a new D-Bus method
1604
                    # with the alternate D-Bus interface name.  Add it
1605
                    # to the class.
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1606
                    attr[attrname] = (
1607
                        dbus.service.method(
1608
                            alt_interface,
1609
                            attribute._dbus_in_signature,
1610
                            attribute._dbus_out_signature)
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
1611
                        (copy_function(attribute)))
561.1.1 by Teddy Hogeborn
Add D-Bus annotations support to methods, signals and properties.
1612
                    # Copy annotations, if any
1613
                    try:
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1614
                        attr[attrname]._dbus_annotations = dict(
1615
                            attribute._dbus_annotations)
561.1.1 by Teddy Hogeborn
Add D-Bus annotations support to methods, signals and properties.
1616
                    except AttributeError:
1617
                        pass
505.1.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1618
                # Is this a D-Bus property?
1619
                elif getattr(attribute, "_dbus_is_property", False):
1620
                    # Create a new, but exactly alike, function
1621
                    # object, and decorate it to be a new D-Bus
1622
                    # property with the alternate D-Bus interface
1623
                    # name.  Add it to the class.
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1624
                    attr[attrname] = (dbus_service_property(
1625
                        alt_interface, attribute._dbus_signature,
1626
                        attribute._dbus_access,
1627
                        attribute._dbus_get_args_options
1628
                        ["byte_arrays"])
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
1629
                                      (copy_function(attribute)))
561.1.1 by Teddy Hogeborn
Add D-Bus annotations support to methods, signals and properties.
1630
                    # Copy annotations, if any
1631
                    try:
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1632
                        attr[attrname]._dbus_annotations = dict(
1633
                            attribute._dbus_annotations)
561.1.1 by Teddy Hogeborn
Add D-Bus annotations support to methods, signals and properties.
1634
                    except AttributeError:
1635
                        pass
560.1.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
1636
                # Is this a D-Bus interface?
1637
                elif getattr(attribute, "_dbus_is_interface", False):
1638
                    # Create a new, but exactly alike, function
1639
                    # object.  Decorate it to be a new D-Bus interface
1640
                    # with the alternate D-Bus interface name.  Add it
1641
                    # to the class.
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1642
                    attr[attrname] = (
1643
                        dbus_interface_annotations(alt_interface)
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
1644
                        (copy_function(attribute)))
575 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1645
            if deprecate:
1646
                # Deprecate all alternate interfaces
723.1.5 by Teddy Hogeborn
Use the new auto-numbered "{}" syntax for the .format() string method.
1647
                iname="_AlternateDBusNames_interface_annotation{}"
575 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1648
                for interface_name in interface_names:
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1649
                    
575 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1650
                    @dbus_interface_annotations(interface_name)
1651
                    def func(self):
1652
                        return { "org.freedesktop.DBus.Deprecated":
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1653
                                 "true" }
575 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1654
                    # Find an unused name
1655
                    for aname in (iname.format(i)
1656
                                  for i in itertools.count()):
1657
                        if aname not in attr:
1658
                            attr[aname] = func
1659
                            break
1660
            if interface_names:
1661
                # Replace the class with a new subclass of it with
1662
                # methods, signals, etc. as created above.
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
1663
                if sys.version_info.major == 2:
1664
                    cls = type(b"{}Alternate".format(cls.__name__),
1665
                               (cls, ), attr)
1666
                else:
1667
                    cls = type("{}Alternate".format(cls.__name__),
1668
                               (cls, ), attr)
575 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1669
        return cls
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1670
    
575 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1671
    return wrapper
1672
1673
1674
@alternate_dbus_interfaces({"se.recompile.Mandos":
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1675
                            "se.bsnet.fukt.Mandos"})
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1676
class ClientDBus(Client, DBusObjectWithProperties):
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1677
    """A Client class using D-Bus
331 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
1678
    
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1679
    Attributes:
338 by Teddy Hogeborn
* mandos: Minor doc string fixes.
1680
    dbus_object_path: dbus.ObjectPath
1681
    bus: dbus.SystemBus()
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1682
    """
438 by Teddy Hogeborn
* mandos (Client.runtime_expansions): New attribute containing the
1683
    
1684
    runtime_expansions = (Client.runtime_expansions
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1685
                          + ("dbus_object_path", ))
438 by Teddy Hogeborn
* mandos (Client.runtime_expansions): New attribute containing the
1686
    
732 by Teddy Hogeborn
Emit D-Bus "org.freedesktop.DBus.Properties.PropertiesChanged" signal.
1687
    _interface = "se.recompile.Mandos.Client"
1688
    
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1689
    # dbus.service.Object doesn't use super(), so we can't either.
1690
    
337 by Teddy Hogeborn
Code cleanup. Move some global stuff into main.
1691
    def __init__(self, bus = None, *args, **kwargs):
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
1692
        self.bus = bus
1693
        Client.__init__(self, *args, **kwargs)
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1694
        # Only now, when this client is initialized, can it show up on
1695
        # the D-Bus
730 by Teddy Hogeborn
mandos: Replace unicode() with str().
1696
        client_object_name = str(self.name).translate(
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1697
            {ord("."): ord("_"),
1698
             ord("-"): ord("_")})
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1699
        self.dbus_object_path = dbus.ObjectPath(
1700
            "/clients/" + client_object_name)
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1701
        DBusObjectWithProperties.__init__(self, self.bus,
1702
                                          self.dbus_object_path)
573 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
1703
    
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1704
    def notifychangeproperty(transform_func, dbus_name,
1705
                             type_func=lambda x: x,
1706
                             variant_level=1,
1707
                             invalidate_only=False,
732 by Teddy Hogeborn
Emit D-Bus "org.freedesktop.DBus.Properties.PropertiesChanged" signal.
1708
                             _interface=_interface):
505.1.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1709
        """ Modify a variable so that it's a property which announces
1710
        its changes to DBus.
518.1.6 by Teddy Hogeborn
* mandos: Fix whitespace.
1711
        
505.1.15 by Teddy Hogeborn
Bug fix: Make D-Bus properties settable again.
1712
        transform_fun: Function that takes a value and a variant_level
1713
                       and transforms it to a D-Bus type.
505.1.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1714
        dbus_name: D-Bus name of the variable
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1715
        type_func: Function that transform the value before sending it
505.1.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1716
                   to the D-Bus.  Default: no transform
1717
        variant_level: D-Bus variant level.  Default: 1
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1718
        """
723.1.5 by Teddy Hogeborn
Use the new auto-numbered "{}" syntax for the .format() string method.
1719
        attrname = "_{}".format(dbus_name)
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1720
        
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1721
        def setter(self, value):
1722
            if hasattr(self, "dbus_object_path"):
505.1.6 by Teddy Hogeborn
* mandos (ClientDBus.notifychangeproperty): Bug fix: Use instance
1723
                if (not hasattr(self, attrname) or
1724
                    type_func(getattr(self, attrname, None))
1725
                    != type_func(value)):
732 by Teddy Hogeborn
Emit D-Bus "org.freedesktop.DBus.Properties.PropertiesChanged" signal.
1726
                    if invalidate_only:
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1727
                        self.PropertiesChanged(
1728
                            _interface, dbus.Dictionary(),
1729
                            dbus.Array((dbus_name, )))
732 by Teddy Hogeborn
Emit D-Bus "org.freedesktop.DBus.Properties.PropertiesChanged" signal.
1730
                    else:
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1731
                        dbus_value = transform_func(
1732
                            type_func(value),
1733
                            variant_level = variant_level)
732 by Teddy Hogeborn
Emit D-Bus "org.freedesktop.DBus.Properties.PropertiesChanged" signal.
1734
                        self.PropertyChanged(dbus.String(dbus_name),
1735
                                             dbus_value)
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1736
                        self.PropertiesChanged(
1737
                            _interface,
1738
                            dbus.Dictionary({ dbus.String(dbus_name):
1739
                                              dbus_value }),
1740
                            dbus.Array())
505.1.6 by Teddy Hogeborn
* mandos (ClientDBus.notifychangeproperty): Bug fix: Use instance
1741
            setattr(self, attrname, value)
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
1742
        
505.1.6 by Teddy Hogeborn
* mandos (ClientDBus.notifychangeproperty): Bug fix: Use instance
1743
        return property(lambda self: getattr(self, attrname), setter)
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
1744
    
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1745
    expires = notifychangeproperty(datetime_to_dbus, "Expires")
1746
    approvals_pending = notifychangeproperty(dbus.Boolean,
1747
                                             "ApprovalPending",
1748
                                             type_func = bool)
1749
    enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1750
    last_enabled = notifychangeproperty(datetime_to_dbus,
1751
                                        "LastEnabled")
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1752
    checker = notifychangeproperty(
1753
        dbus.Boolean, "CheckerRunning",
1754
        type_func = lambda checker: checker is not None)
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1755
    last_checked_ok = notifychangeproperty(datetime_to_dbus,
1756
                                           "LastCheckedOK")
556 by Teddy Hogeborn
* DBUS-API (se.recompile.Mandos.Client.LastCheckerStatus): New
1757
    last_checker_status = notifychangeproperty(dbus.Int16,
1758
                                               "LastCheckerStatus")
505.1.3 by Teddy Hogeborn
* mandos: Break long lines.
1759
    last_approval_request = notifychangeproperty(
1760
        datetime_to_dbus, "LastApprovalRequest")
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1761
    approved_by_default = notifychangeproperty(dbus.Boolean,
1762
                                               "ApprovedByDefault")
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1763
    approval_delay = notifychangeproperty(
1764
        dbus.UInt64, "ApprovalDelay",
1765
        type_func = lambda td: td.total_seconds() * 1000)
505.1.3 by Teddy Hogeborn
* mandos: Break long lines.
1766
    approval_duration = notifychangeproperty(
518.2.9 by Teddy Hogeborn
* mandos (ClientDBus.approval_delay, ClientDBus.approval_duration,
1767
        dbus.UInt64, "ApprovalDuration",
723.1.6 by Teddy Hogeborn
Use the new .total_seconds() method on datetime.timedelta objects.
1768
        type_func = lambda td: td.total_seconds() * 1000)
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1769
    host = notifychangeproperty(dbus.String, "Host")
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1770
    timeout = notifychangeproperty(
1771
        dbus.UInt64, "Timeout",
1772
        type_func = lambda td: td.total_seconds() * 1000)
505.1.3 by Teddy Hogeborn
* mandos: Break long lines.
1773
    extended_timeout = notifychangeproperty(
518.2.9 by Teddy Hogeborn
* mandos (ClientDBus.approval_delay, ClientDBus.approval_duration,
1774
        dbus.UInt64, "ExtendedTimeout",
723.1.6 by Teddy Hogeborn
Use the new .total_seconds() method on datetime.timedelta objects.
1775
        type_func = lambda td: td.total_seconds() * 1000)
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1776
    interval = notifychangeproperty(
1777
        dbus.UInt64, "Interval",
1778
        type_func = lambda td: td.total_seconds() * 1000)
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1779
    checker_command = notifychangeproperty(dbus.String, "Checker")
732 by Teddy Hogeborn
Emit D-Bus "org.freedesktop.DBus.Properties.PropertiesChanged" signal.
1780
    secret = notifychangeproperty(dbus.ByteArray, "Secret",
1781
                                  invalidate_only=True)
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1782
    
1783
    del notifychangeproperty
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1784
    
1785
    def __del__(self, *args, **kwargs):
1786
        try:
1787
            self.remove_from_connection()
329 by Teddy Hogeborn
* mandos (ClientDBus.__del__): Bug fix: Correct mispasted code, and do
1788
        except LookupError:
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1789
            pass
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1790
        if hasattr(DBusObjectWithProperties, "__del__"):
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1791
            DBusObjectWithProperties.__del__(self, *args, **kwargs)
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1792
        Client.__del__(self, *args, **kwargs)
1793
    
749.1.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
1794
    def checker_callback(self, source, condition,
756 by Teddy Hogeborn
Merge change to use multiprocessing module to run checkers.
1795
                         connection, command, *args, **kwargs):
749.1.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
1796
        ret = Client.checker_callback(self, source, condition,
756 by Teddy Hogeborn
Merge change to use multiprocessing module to run checkers.
1797
                                      connection, command, *args,
749.1.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
1798
                                      **kwargs)
1799
        exitstatus = self.last_checker_status
1800
        if exitstatus >= 0:
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1801
            # Emit D-Bus signal
1802
            self.CheckerCompleted(dbus.Int16(exitstatus),
783 by Teddy Hogeborn
Revert change to D-Bus API.
1803
                                  # This is specific to GNU libC
1804
                                  dbus.Int64(exitstatus << 8),
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1805
                                  dbus.String(command))
1806
        else:
1807
            # Emit D-Bus signal
1808
            self.CheckerCompleted(dbus.Int16(-1),
749.1.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
1809
                                  dbus.Int64(
783 by Teddy Hogeborn
Revert change to D-Bus API.
1810
                                      # This is specific to GNU libC
1811
                                      (exitstatus << 8)
1812
                                      | self.last_checker_signal),
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1813
                                  dbus.String(command))
749.1.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
1814
        return ret
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
1815
    
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1816
    def start_checker(self, *args, **kwargs):
658 by Teddy Hogeborn
* mandos (ClientDBus.start_checker): Removed unused variable
1817
        old_checker_pid = getattr(self.checker, "pid", None)
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1818
        r = Client.start_checker(self, *args, **kwargs)
329 by Teddy Hogeborn
* mandos (ClientDBus.__del__): Bug fix: Correct mispasted code, and do
1819
        # Only if new checker process was started
1820
        if (self.checker is not None
1821
            and old_checker_pid != self.checker.pid):
1822
            # Emit D-Bus signal
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1823
            self.CheckerStarted(self.current_checker_command)
1824
        return r
1825
    
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1826
    def _reset_approved(self):
518.2.4 by Teddy Hogeborn
* mandos (_timedelta_to_milliseconds): Renamed to
1827
        self.approved = None
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1828
        return False
1829
    
1830
    def approve(self, value=True):
518.2.4 by Teddy Hogeborn
* mandos (_timedelta_to_milliseconds): Renamed to
1831
        self.approved = value
830 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
1832
        GLib.timeout_add(int(self.approval_duration.total_seconds()
1833
                             * 1000), self._reset_approved)
581 by Teddy Hogeborn
* mandos (Client.enable, Client.disable, ClientDBus.approve): Call
1834
        self.send_changedstate()
24.2.1 by teddy at bsnet
* debian/control (mandos/Depends): Added "python-urwid".
1835
    
24.1.147 by Björn Påhlsson
The IPC pipes are now file objects, not file descriptors:
1836
    ## D-Bus methods, signals & properties
237.1.2 by Teddy Hogeborn
Further steps towards a D-Bus server interface, plus minor syntax
1837
    
560.1.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
1838
    ## Interfaces
1839
    
24.1.147 by Björn Påhlsson
The IPC pipes are now file objects, not file descriptors:
1840
    ## Signals
381 by Teddy Hogeborn
Restore some poor D-Bus methods who got a bit hastily deleted. Enable
1841
    
237.1.2 by Teddy Hogeborn
Further steps towards a D-Bus server interface, plus minor syntax
1842
    # CheckerCompleted - signal
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1843
    @dbus.service.signal(_interface, signature="nxs")
280 by Teddy Hogeborn
* mandos (Client.CheckerCompleted): Changed signature to "nxs"; return
1844
    def CheckerCompleted(self, exitcode, waitstatus, command):
237.1.2 by Teddy Hogeborn
Further steps towards a D-Bus server interface, plus minor syntax
1845
        "D-Bus signal"
1846
        pass
1847
    
1848
    # CheckerStarted - signal
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1849
    @dbus.service.signal(_interface, signature="s")
237.1.2 by Teddy Hogeborn
Further steps towards a D-Bus server interface, plus minor syntax
1850
    def CheckerStarted(self, command):
1851
        "D-Bus signal"
1852
        pass
1853
    
238 by Teddy Hogeborn
First version of a somewhat complete D-Bus server interface. Also
1854
    # PropertyChanged - signal
732 by Teddy Hogeborn
Emit D-Bus "org.freedesktop.DBus.Properties.PropertiesChanged" signal.
1855
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1856
    @dbus.service.signal(_interface, signature="sv")
238 by Teddy Hogeborn
First version of a somewhat complete D-Bus server interface. Also
1857
    def PropertyChanged(self, property, value):
1858
        "D-Bus signal"
1859
        pass
237.1.2 by Teddy Hogeborn
Further steps towards a D-Bus server interface, plus minor syntax
1860
    
387 by Teddy Hogeborn
* mandos (ClientDBus.ReceivedSecret): Renamed to "GotSecret". All
1861
    # GotSecret - signal
327 by Teddy Hogeborn
Merge from pipe IPC branch.
1862
    @dbus.service.signal(_interface)
387 by Teddy Hogeborn
* mandos (ClientDBus.ReceivedSecret): Renamed to "GotSecret". All
1863
    def GotSecret(self):
24.1.155 by Björn Påhlsson
mandos server: Added debuglevel that adjust at what level information
1864
        """D-Bus signal
1865
        Is sent after a successful transfer of secret from the Mandos
1866
        server to mandos-client
1867
        """
24.2.4 by teddy at bsnet
* mandos (ClientDBus.approvals_pending): Changed to be a property
1868
        pass
327 by Teddy Hogeborn
Merge from pipe IPC branch.
1869
    
1870
    # Rejected - signal
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1871
    @dbus.service.signal(_interface, signature="s")
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1872
    def Rejected(self, reason):
1873
        "D-Bus signal"
24.2.4 by teddy at bsnet
* mandos (ClientDBus.approvals_pending): Changed to be a property
1874
        pass
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1875
    
1876
    # NeedApproval - signal
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1877
    @dbus.service.signal(_interface, signature="tb")
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1878
    def NeedApproval(self, timeout, default):
327 by Teddy Hogeborn
Merge from pipe IPC branch.
1879
        "D-Bus signal"
442 by Teddy Hogeborn
* DBUS-API: Document new "LastApprovalRequest" client property.
1880
        return self.need_approval()
327 by Teddy Hogeborn
Merge from pipe IPC branch.
1881
    
24.1.147 by Björn Påhlsson
The IPC pipes are now file objects, not file descriptors:
1882
    ## Methods
442 by Teddy Hogeborn
* DBUS-API: Document new "LastApprovalRequest" client property.
1883
    
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1884
    # Approve - method
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1885
    @dbus.service.method(_interface, in_signature="b")
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1886
    def Approve(self, value):
1887
        self.approve(value)
442 by Teddy Hogeborn
* DBUS-API: Document new "LastApprovalRequest" client property.
1888
    
24.1.147 by Björn Påhlsson
The IPC pipes are now file objects, not file descriptors:
1889
    # CheckedOK - method
1890
    @dbus.service.method(_interface)
1891
    def CheckedOK(self):
482 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
1892
        self.checked_ok()
24.1.147 by Björn Påhlsson
The IPC pipes are now file objects, not file descriptors:
1893
    
381 by Teddy Hogeborn
Restore some poor D-Bus methods who got a bit hastily deleted. Enable
1894
    # Enable - method
781 by Teddy Hogeborn
Deprecate some D-Bus methods in favor of D-Bus properties.
1895
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
381 by Teddy Hogeborn
Restore some poor D-Bus methods who got a bit hastily deleted. Enable
1896
    @dbus.service.method(_interface)
1897
    def Enable(self):
1898
        "D-Bus method"
1899
        self.enable()
1900
    
1901
    # StartChecker - method
781 by Teddy Hogeborn
Deprecate some D-Bus methods in favor of D-Bus properties.
1902
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
381 by Teddy Hogeborn
Restore some poor D-Bus methods who got a bit hastily deleted. Enable
1903
    @dbus.service.method(_interface)
1904
    def StartChecker(self):
1905
        "D-Bus method"
1906
        self.start_checker()
1907
    
1908
    # Disable - method
781 by Teddy Hogeborn
Deprecate some D-Bus methods in favor of D-Bus properties.
1909
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
381 by Teddy Hogeborn
Restore some poor D-Bus methods who got a bit hastily deleted. Enable
1910
    @dbus.service.method(_interface)
1911
    def Disable(self):
1912
        "D-Bus method"
1913
        self.disable()
1914
    
1915
    # StopChecker - method
781 by Teddy Hogeborn
Deprecate some D-Bus methods in favor of D-Bus properties.
1916
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
381 by Teddy Hogeborn
Restore some poor D-Bus methods who got a bit hastily deleted. Enable
1917
    @dbus.service.method(_interface)
1918
    def StopChecker(self):
1919
        self.stop_checker()
1920
    
24.1.147 by Björn Påhlsson
The IPC pipes are now file objects, not file descriptors:
1921
    ## Properties
1922
    
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1923
    # ApprovalPending - property
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1924
    @dbus_service_property(_interface, signature="b", access="read")
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1925
    def ApprovalPending_dbus_property(self):
24.2.4 by teddy at bsnet
* mandos (ClientDBus.approvals_pending): Changed to be a property
1926
        return dbus.Boolean(bool(self.approvals_pending))
24.1.150 by Björn Påhlsson
* mandos: Added ClientDBus.approve_pending property. Exposed
1927
    
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1928
    # ApprovedByDefault - property
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1929
    @dbus_service_property(_interface,
1930
                           signature="b",
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1931
                           access="readwrite")
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1932
    def ApprovedByDefault_dbus_property(self, value=None):
1933
        if value is None:       # get
1934
            return dbus.Boolean(self.approved_by_default)
1935
        self.approved_by_default = bool(value)
1936
    
1937
    # ApprovalDelay - property
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1938
    @dbus_service_property(_interface,
1939
                           signature="t",
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1940
                           access="readwrite")
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1941
    def ApprovalDelay_dbus_property(self, value=None):
1942
        if value is None:       # get
723.1.6 by Teddy Hogeborn
Use the new .total_seconds() method on datetime.timedelta objects.
1943
            return dbus.UInt64(self.approval_delay.total_seconds()
1944
                               * 1000)
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1945
        self.approval_delay = datetime.timedelta(0, 0, 0, value)
1946
    
1947
    # ApprovalDuration - property
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1948
    @dbus_service_property(_interface,
1949
                           signature="t",
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1950
                           access="readwrite")
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1951
    def ApprovalDuration_dbus_property(self, value=None):
1952
        if value is None:       # get
723.1.6 by Teddy Hogeborn
Use the new .total_seconds() method on datetime.timedelta objects.
1953
            return dbus.UInt64(self.approval_duration.total_seconds()
1954
                               * 1000)
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1955
        self.approval_duration = datetime.timedelta(0, 0, 0, value)
1956
    
1957
    # Name - property
780 by Teddy Hogeborn
Add D-Bus annotations on a few properties on the Client object.
1958
    @dbus_annotations(
1959
        {"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1960
    @dbus_service_property(_interface, signature="s", access="read")
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1961
    def Name_dbus_property(self):
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1962
        return dbus.String(self.name)
1963
    
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1964
    # Fingerprint - property
780 by Teddy Hogeborn
Add D-Bus annotations on a few properties on the Client object.
1965
    @dbus_annotations(
1966
        {"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1967
    @dbus_service_property(_interface, signature="s", access="read")
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1968
    def Fingerprint_dbus_property(self):
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1969
        return dbus.String(self.fingerprint)
1970
    
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1971
    # Host - property
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1972
    @dbus_service_property(_interface,
1973
                           signature="s",
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1974
                           access="readwrite")
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1975
    def Host_dbus_property(self, value=None):
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1976
        if value is None:       # get
1977
            return dbus.String(self.host)
730 by Teddy Hogeborn
mandos: Replace unicode() with str().
1978
        self.host = str(value)
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1979
    
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1980
    # Created - property
780 by Teddy Hogeborn
Add D-Bus annotations on a few properties on the Client object.
1981
    @dbus_annotations(
1982
        {"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1983
    @dbus_service_property(_interface, signature="s", access="read")
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1984
    def Created_dbus_property(self):
518.2.3 by Teddy Hogeborn
Make "enabled" a client config option.
1985
        return datetime_to_dbus(self.created)
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1986
    
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1987
    # LastEnabled - property
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1988
    @dbus_service_property(_interface, signature="s", access="read")
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1989
    def LastEnabled_dbus_property(self):
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1990
        return datetime_to_dbus(self.last_enabled)
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1991
    
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1992
    # Enabled - property
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1993
    @dbus_service_property(_interface,
1994
                           signature="b",
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1995
                           access="readwrite")
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1996
    def Enabled_dbus_property(self, value=None):
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1997
        if value is None:       # get
1998
            return dbus.Boolean(self.enabled)
1999
        if value:
2000
            self.enable()
2001
        else:
2002
            self.disable()
2003
    
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2004
    # LastCheckedOK - property
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2005
    @dbus_service_property(_interface,
2006
                           signature="s",
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2007
                           access="readwrite")
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2008
    def LastCheckedOK_dbus_property(self, value=None):
381 by Teddy Hogeborn
Restore some poor D-Bus methods who got a bit hastily deleted. Enable
2009
        if value is not None:
2010
            self.checked_ok()
2011
            return
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
2012
        return datetime_to_dbus(self.last_checked_ok)
24.1.179 by Björn Påhlsson
New feature:
2013
    
556 by Teddy Hogeborn
* DBUS-API (se.recompile.Mandos.Client.LastCheckerStatus): New
2014
    # LastCheckerStatus - property
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2015
    @dbus_service_property(_interface, signature="n", access="read")
556 by Teddy Hogeborn
* DBUS-API (se.recompile.Mandos.Client.LastCheckerStatus): New
2016
    def LastCheckerStatus_dbus_property(self):
2017
        return dbus.Int16(self.last_checker_status)
2018
    
24.1.179 by Björn Påhlsson
New feature:
2019
    # Expires - property
2020
    @dbus_service_property(_interface, signature="s", access="read")
2021
    def Expires_dbus_property(self):
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
2022
        return datetime_to_dbus(self.expires)
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
2023
    
442 by Teddy Hogeborn
* DBUS-API: Document new "LastApprovalRequest" client property.
2024
    # LastApprovalRequest - property
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2025
    @dbus_service_property(_interface, signature="s", access="read")
442 by Teddy Hogeborn
* DBUS-API: Document new "LastApprovalRequest" client property.
2026
    def LastApprovalRequest_dbus_property(self):
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
2027
        return datetime_to_dbus(self.last_approval_request)
442 by Teddy Hogeborn
* DBUS-API: Document new "LastApprovalRequest" client property.
2028
    
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2029
    # Timeout - property
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2030
    @dbus_service_property(_interface,
2031
                           signature="t",
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2032
                           access="readwrite")
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2033
    def Timeout_dbus_property(self, value=None):
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
2034
        if value is None:       # get
723.1.6 by Teddy Hogeborn
Use the new .total_seconds() method on datetime.timedelta objects.
2035
            return dbus.UInt64(self.timeout.total_seconds() * 1000)
581 by Teddy Hogeborn
* mandos (Client.enable, Client.disable, ClientDBus.approve): Call
2036
        old_timeout = self.timeout
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
2037
        self.timeout = datetime.timedelta(0, 0, 0, value)
581 by Teddy Hogeborn
* mandos (Client.enable, Client.disable, ClientDBus.approve): Call
2038
        # Reschedule disabling
543 by Teddy Hogeborn
* mandos: Break some long lines.
2039
        if self.enabled:
2040
            now = datetime.datetime.utcnow()
581 by Teddy Hogeborn
* mandos (Client.enable, Client.disable, ClientDBus.approve): Call
2041
            self.expires += self.timeout - old_timeout
2042
            if self.expires <= now:
543 by Teddy Hogeborn
* mandos: Break some long lines.
2043
                # The timeout has passed
2044
                self.disable()
2045
            else:
2046
                if (getattr(self, "disable_initiator_tag", None)
2047
                    is None):
2048
                    return
830 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
2049
                GLib.source_remove(self.disable_initiator_tag)
2050
                self.disable_initiator_tag = GLib.timeout_add(
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2051
                    int((self.expires - now).total_seconds() * 1000),
2052
                    self.disable)
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
2053
    
24.1.179 by Björn Påhlsson
New feature:
2054
    # ExtendedTimeout - property
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2055
    @dbus_service_property(_interface,
2056
                           signature="t",
24.1.179 by Björn Påhlsson
New feature:
2057
                           access="readwrite")
2058
    def ExtendedTimeout_dbus_property(self, value=None):
2059
        if value is None:       # get
723.1.6 by Teddy Hogeborn
Use the new .total_seconds() method on datetime.timedelta objects.
2060
            return dbus.UInt64(self.extended_timeout.total_seconds()
2061
                               * 1000)
24.1.179 by Björn Påhlsson
New feature:
2062
        self.extended_timeout = datetime.timedelta(0, 0, 0, value)
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
2063
    
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2064
    # Interval - property
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2065
    @dbus_service_property(_interface,
2066
                           signature="t",
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2067
                           access="readwrite")
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2068
    def Interval_dbus_property(self, value=None):
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
2069
        if value is None:       # get
723.1.6 by Teddy Hogeborn
Use the new .total_seconds() method on datetime.timedelta objects.
2070
            return dbus.UInt64(self.interval.total_seconds() * 1000)
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
2071
        self.interval = datetime.timedelta(0, 0, 0, value)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2072
        if getattr(self, "checker_initiator_tag", None) is None:
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
2073
            return
518.2.3 by Teddy Hogeborn
Make "enabled" a client config option.
2074
        if self.enabled:
2075
            # Reschedule checker run
830 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
2076
            GLib.source_remove(self.checker_initiator_tag)
2077
            self.checker_initiator_tag = GLib.timeout_add(
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2078
                value, self.start_checker)
2079
            self.start_checker() # Start one now, too
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
2080
    
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2081
    # Checker - property
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2082
    @dbus_service_property(_interface,
2083
                           signature="s",
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2084
                           access="readwrite")
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2085
    def Checker_dbus_property(self, value=None):
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
2086
        if value is None:       # get
2087
            return dbus.String(self.checker_command)
730 by Teddy Hogeborn
mandos: Replace unicode() with str().
2088
        self.checker_command = str(value)
237.1.2 by Teddy Hogeborn
Further steps towards a D-Bus server interface, plus minor syntax
2089
    
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2090
    # CheckerRunning - property
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2091
    @dbus_service_property(_interface,
2092
                           signature="b",
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2093
                           access="readwrite")
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2094
    def CheckerRunning_dbus_property(self, value=None):
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
2095
        if value is None:       # get
2096
            return dbus.Boolean(self.checker is not None)
2097
        if value:
2098
            self.start_checker()
2099
        else:
2100
            self.stop_checker()
2101
    
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2102
    # ObjectPath - property
780 by Teddy Hogeborn
Add D-Bus annotations on a few properties on the Client object.
2103
    @dbus_annotations(
782 by Teddy Hogeborn
Deprecate the D-Bus property "se.recompile.Mandos.Client.ObjectPath".
2104
        {"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",
2105
         "org.freedesktop.DBus.Deprecated": "true"})
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2106
    @dbus_service_property(_interface, signature="o", access="read")
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2107
    def ObjectPath_dbus_property(self):
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
2108
        return self.dbus_object_path # is already a dbus.ObjectPath
2109
    
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2110
    # Secret = property
780 by Teddy Hogeborn
Add D-Bus annotations on a few properties on the Client object.
2111
    @dbus_annotations(
2112
        {"org.freedesktop.DBus.Property.EmitsChangedSignal":
2113
         "invalidates"})
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2114
    @dbus_service_property(_interface,
2115
                           signature="ay",
2116
                           access="write",
2117
                           byte_arrays=True)
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2118
    def Secret_dbus_property(self, value):
729 by Teddy Hogeborn
mandos: Stop using str() and remove unnecessary unicode() calls.
2119
        self.secret = bytes(value)
237.1.2 by Teddy Hogeborn
Further steps towards a D-Bus server interface, plus minor syntax
2120
    
2121
    del _interface
3 by Björn Påhlsson
Python based server
2122
2123
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2124
class ProxyClient(object):
2125
    def __init__(self, child_pipe, fpr, address):
2126
        self._pipe = child_pipe
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2127
        self._pipe.send(('init', fpr, address))
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2128
        if not self._pipe.recv():
752 by Teddy Hogeborn
mandos: Generate better messages in exceptions.
2129
            raise KeyError(fpr)
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
2130
    
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2131
    def __getattribute__(self, name):
518.2.4 by Teddy Hogeborn
* mandos (_timedelta_to_milliseconds): Renamed to
2132
        if name == '_pipe':
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2133
            return super(ProxyClient, self).__getattribute__(name)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2134
        self._pipe.send(('getattr', name))
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2135
        data = self._pipe.recv()
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2136
        if data[0] == 'data':
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2137
            return data[1]
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2138
        if data[0] == 'function':
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2139
            
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2140
            def func(*args, **kwargs):
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2141
                self._pipe.send(('funcall', name, args, kwargs))
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2142
                return self._pipe.recv()[1]
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2143
            
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2144
            return func
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
2145
    
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2146
    def __setattr__(self, name, value):
518.2.4 by Teddy Hogeborn
* mandos (_timedelta_to_milliseconds): Renamed to
2147
        if name == '_pipe':
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2148
            return super(ProxyClient, self).__setattr__(name, value)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2149
        self._pipe.send(('setattr', name, value))
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2150
518.1.6 by Teddy Hogeborn
* mandos: Fix whitespace.
2151
335 by Teddy Hogeborn
* mandos: Import "SocketServer" as "socketserver" and "ConfigParser"
2152
class ClientHandler(socketserver.BaseRequestHandler, object):
331 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
2153
    """A class to handle client connections.
2154
    
2155
    Instantiated once for each connection to handle it.
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
2156
    Note: This will run in its own forked process."""
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
2157
    
3 by Björn Påhlsson
Python based server
2158
    def handle(self):
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2159
        with contextlib.closing(self.server.child_pipe) as child_pipe:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2160
            logger.info("TCP connection from: %s",
730 by Teddy Hogeborn
mandos: Replace unicode() with str().
2161
                        str(self.client_address))
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2162
            logger.debug("Pipe FD: %d",
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2163
                         self.server.child_pipe.fileno())
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
2164
            
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
2165
            session = gnutls.ClientSession(self.request)
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
2166
            
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2167
            #priority = ':'.join(("NONE", "+VERS-TLS1.1",
2168
            #                      "+AES-256-CBC", "+SHA1",
2169
            #                      "+COMP-NULL", "+CTYPE-OPENPGP",
2170
            #                      "+DHE-DSS"))
288.1.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
2171
            # Use a fallback default, since this MUST be set.
331 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
2172
            priority = self.server.gnutls_priority
2173
            if priority is None:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2174
                priority = "NORMAL"
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
2175
            gnutls.priority_set_direct(session._c_object, priority,
2176
                                       None)
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
2177
            
416.1.2 by Teddy Hogeborn
* mandos (ClientHandler.handle): Set up the GnuTLS session object
2178
            # Start communication using the Mandos protocol
2179
            # Get protocol number
2180
            line = self.request.makefile().readline()
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2181
            logger.debug("Protocol version: %r", line)
416.1.2 by Teddy Hogeborn
* mandos (ClientHandler.handle): Set up the GnuTLS session object
2182
            try:
2183
                if int(line.strip().split()[0]) > 1:
642 by Teddy Hogeborn
Syntax fix; use "raise" better in Mandos server.
2184
                    raise RuntimeError(line)
482 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
2185
            except (ValueError, IndexError, RuntimeError) as error:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2186
                logger.error("Unknown protocol version: %s", error)
416.1.2 by Teddy Hogeborn
* mandos (ClientHandler.handle): Set up the GnuTLS session object
2187
                return
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
2188
            
416.1.2 by Teddy Hogeborn
* mandos (ClientHandler.handle): Set up the GnuTLS session object
2189
            # Start GnuTLS connection
288.1.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
2190
            try:
2191
                session.handshake()
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
2192
            except gnutls.Error as error:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2193
                logger.warning("Handshake failed: %s", error)
288.1.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
2194
                # Do not run session.bye() here: the session is not
2195
                # established.  Just abandon the request.
2196
                return
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2197
            logger.debug("Handshake succeeded")
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
2198
            
24.1.150 by Björn Påhlsson
* mandos: Added ClientDBus.approve_pending property. Exposed
2199
            approval_required = False
288.1.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
2200
            try:
411 by Teddy Hogeborn
More consistent terminology: Clients are no longer "invalid" - they
2201
                try:
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2202
                    fpr = self.fingerprint(
2203
                        self.peer_certificate(session))
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
2204
                except (TypeError, gnutls.Error) as error:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2205
                    logger.warning("Bad certificate: %s", error)
411 by Teddy Hogeborn
More consistent terminology: Clients are no longer "invalid" - they
2206
                    return
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2207
                logger.debug("Fingerprint: %s", fpr)
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
2208
                
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2209
                try:
2210
                    client = ProxyClient(child_pipe, fpr,
2211
                                         self.client_address)
2212
                except KeyError:
411 by Teddy Hogeborn
More consistent terminology: Clients are no longer "invalid" - they
2213
                    return
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2214
                
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2215
                if client.approval_delay:
2216
                    delay = client.approval_delay
24.1.150 by Björn Påhlsson
* mandos: Added ClientDBus.approve_pending property. Exposed
2217
                    client.approvals_pending += 1
2218
                    approval_required = True
2219
                
24.1.148 by Björn Påhlsson
half working on-demand password and approved code
2220
                while True:
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2221
                    if not client.enabled:
24.1.174 by Björn Påhlsson
* Makefile (CFLAGS): Added "-lrt" to include real time library.
2222
                        logger.info("Client %s is disabled",
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2223
                                    client.name)
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2224
                        if self.server.use_dbus:
2225
                            # Emit D-Bus signal
505.1.3 by Teddy Hogeborn
* mandos: Break long lines.
2226
                            client.Rejected("Disabled")
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2227
                        return
24.1.150 by Björn Påhlsson
* mandos: Added ClientDBus.approve_pending property. Exposed
2228
                    
518.2.4 by Teddy Hogeborn
* mandos (_timedelta_to_milliseconds): Renamed to
2229
                    if client.approved or not client.approval_delay:
24.1.150 by Björn Påhlsson
* mandos: Added ClientDBus.approve_pending property. Exposed
2230
                        #We are approved or approval is disabled
2231
                        break
518.2.4 by Teddy Hogeborn
* mandos (_timedelta_to_milliseconds): Renamed to
2232
                    elif client.approved is None:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2233
                        logger.info("Client %s needs approval",
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2234
                                    client.name)
2235
                        if self.server.use_dbus:
2236
                            # Emit D-Bus signal
2237
                            client.NeedApproval(
723.1.6 by Teddy Hogeborn
Use the new .total_seconds() method on datetime.timedelta objects.
2238
                                client.approval_delay.total_seconds()
2239
                                * 1000, client.approved_by_default)
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2240
                    else:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2241
                        logger.warning("Client %s was not approved",
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2242
                                       client.name)
2243
                        if self.server.use_dbus:
24.1.150 by Björn Påhlsson
* mandos: Added ClientDBus.approve_pending property. Exposed
2244
                            # Emit D-Bus signal
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2245
                            client.Rejected("Denied")
24.1.148 by Björn Påhlsson
half working on-demand password and approved code
2246
                        return
2247
                    
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2248
                    #wait until timeout or approved
2249
                    time = datetime.datetime.now()
2250
                    client.changedstate.acquire()
723.1.6 by Teddy Hogeborn
Use the new .total_seconds() method on datetime.timedelta objects.
2251
                    client.changedstate.wait(delay.total_seconds())
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2252
                    client.changedstate.release()
2253
                    time2 = datetime.datetime.now()
2254
                    if (time2 - time) >= delay:
2255
                        if not client.approved_by_default:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2256
                            logger.warning("Client %s timed out while"
2257
                                           " waiting for approval",
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2258
                                           client.name)
2259
                            if self.server.use_dbus:
2260
                                # Emit D-Bus signal
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2261
                                client.Rejected("Approval timed out")
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2262
                            return
2263
                        else:
2264
                            break
2265
                    else:
2266
                        delay -= time2 - time
2267
                
802 by Teddy Hogeborn
Handle GnuTLS errors and partial sends in gnutls "module".
2268
                try:
2269
                    session.send(client.secret)
2270
                except gnutls.Error as error:
2271
                    logger.warning("gnutls send failed",
2272
                                   exc_info = error)
2273
                    return
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
2274
                
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2275
                logger.info("Sending secret to %s", client.name)
505.1.13 by Teddy Hogeborn
Miscellaneous fixes prompted by lintian:
2276
                # bump the timeout using extended_timeout
556 by Teddy Hogeborn
* DBUS-API (se.recompile.Mandos.Client.LastCheckerStatus): New
2277
                client.bump_timeout(client.extended_timeout)
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2278
                if self.server.use_dbus:
2279
                    # Emit D-Bus signal
2280
                    client.GotSecret()
24.1.150 by Björn Påhlsson
* mandos: Added ClientDBus.approve_pending property. Exposed
2281
            
411 by Teddy Hogeborn
More consistent terminology: Clients are no longer "invalid" - they
2282
            finally:
24.1.150 by Björn Påhlsson
* mandos: Added ClientDBus.approve_pending property. Exposed
2283
                if approval_required:
2284
                    client.approvals_pending -= 1
24.1.155 by Björn Påhlsson
mandos server: Added debuglevel that adjust at what level information
2285
                try:
2286
                    session.bye()
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
2287
                except gnutls.Error as error:
574 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
2288
                    logger.warning("GnuTLS bye failed",
2289
                                   exc_info=error)
330 by Teddy Hogeborn
* mandos (peer_certificate, fingerprint): Moved into "TCP_handler"
2290
    
2291
    @staticmethod
2292
    def peer_certificate(session):
2293
        "Return the peer's OpenPGP certificate as a bytestring"
2294
        # If not an OpenPGP certificate...
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
2295
        if (gnutls.certificate_type_get(session._c_object)
2296
            != gnutls.CRT_OPENPGP):
2297
            # ...return invalid data
2298
            return b""
330 by Teddy Hogeborn
* mandos (peer_certificate, fingerprint): Moved into "TCP_handler"
2299
        list_size = ctypes.c_uint(1)
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
2300
        cert_list = (gnutls.certificate_get_peers
330 by Teddy Hogeborn
* mandos (peer_certificate, fingerprint): Moved into "TCP_handler"
2301
                     (session._c_object, ctypes.byref(list_size)))
2302
        if not bool(cert_list) and list_size.value != 0:
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
2303
            raise gnutls.Error("error getting peer certificate")
330 by Teddy Hogeborn
* mandos (peer_certificate, fingerprint): Moved into "TCP_handler"
2304
        if list_size.value == 0:
2305
            return None
2306
        cert = cert_list[0]
2307
        return ctypes.string_at(cert.data, cert.size)
2308
    
2309
    @staticmethod
2310
    def fingerprint(openpgp):
2311
        "Convert an OpenPGP bytestring to a hexdigit fingerprint"
2312
        # New GnuTLS "datum" with the OpenPGP public key
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
2313
        datum = gnutls.datum_t(
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2314
            ctypes.cast(ctypes.c_char_p(openpgp),
2315
                        ctypes.POINTER(ctypes.c_ubyte)),
2316
            ctypes.c_uint(len(openpgp)))
330 by Teddy Hogeborn
* mandos (peer_certificate, fingerprint): Moved into "TCP_handler"
2317
        # New empty GnuTLS certificate
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
2318
        crt = gnutls.openpgp_crt_t()
2319
        gnutls.openpgp_crt_init(ctypes.byref(crt))
330 by Teddy Hogeborn
* mandos (peer_certificate, fingerprint): Moved into "TCP_handler"
2320
        # Import the OpenPGP public key into the certificate
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
2321
        gnutls.openpgp_crt_import(crt, ctypes.byref(datum),
2322
                                  gnutls.OPENPGP_FMT_RAW)
330 by Teddy Hogeborn
* mandos (peer_certificate, fingerprint): Moved into "TCP_handler"
2323
        # Verify the self signature in the key
2324
        crtverify = ctypes.c_uint()
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
2325
        gnutls.openpgp_crt_verify_self(crt, 0,
2326
                                       ctypes.byref(crtverify))
330 by Teddy Hogeborn
* mandos (peer_certificate, fingerprint): Moved into "TCP_handler"
2327
        if crtverify.value != 0:
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
2328
            gnutls.openpgp_crt_deinit(crt)
2329
            raise gnutls.CertificateSecurityError("Verify failed")
330 by Teddy Hogeborn
* mandos (peer_certificate, fingerprint): Moved into "TCP_handler"
2330
        # New buffer for the fingerprint
2331
        buf = ctypes.create_string_buffer(20)
2332
        buf_len = ctypes.c_size_t()
2333
        # Get the fingerprint from the certificate into the buffer
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
2334
        gnutls.openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
2335
                                           ctypes.byref(buf_len))
330 by Teddy Hogeborn
* mandos (peer_certificate, fingerprint): Moved into "TCP_handler"
2336
        # Deinit the certificate
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
2337
        gnutls.openpgp_crt_deinit(crt)
330 by Teddy Hogeborn
* mandos (peer_certificate, fingerprint): Moved into "TCP_handler"
2338
        # Convert the buffer to a Python bytestring
2339
        fpr = ctypes.string_at(buf, buf_len.value)
2340
        # Convert the bytestring to hexadecimal notation
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
2341
        hex_fpr = binascii.hexlify(fpr).upper()
330 by Teddy Hogeborn
* mandos (peer_certificate, fingerprint): Moved into "TCP_handler"
2342
        return hex_fpr
288.1.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
2343
2344
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2345
class MultiprocessingMixIn(object):
2346
    """Like socketserver.ThreadingMixIn, but with multiprocessing"""
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2347
    
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2348
    def sub_process_main(self, request, address):
2349
        try:
2350
            self.finish_request(request, address)
518.1.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
2351
        except Exception:
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2352
            self.handle_error(request, address)
2353
        self.close_request(request)
505.1.11 by Teddy Hogeborn
* mandos (Client.checked_ok): Set "expires" after setting timeout.
2354
    
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2355
    def process_request(self, request, address):
2356
        """Start a new process to process the request."""
505.1.11 by Teddy Hogeborn
* mandos (Client.checked_ok): Set "expires" after setting timeout.
2357
        proc = multiprocessing.Process(target = self.sub_process_main,
579 by Teddy Hogeborn
* mandos: Use all new builtins.
2358
                                       args = (request, address))
505.1.11 by Teddy Hogeborn
* mandos (Client.checked_ok): Set "expires" after setting timeout.
2359
        proc.start()
2360
        return proc
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2361
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
2362
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2363
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
2364
    """ adds a pipe to the MixIn """
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2365
    
288.1.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
2366
    def process_request(self, request, client_address):
331 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
2367
        """Overrides and wraps the original process_request().
2368
        
355 by Teddy Hogeborn
* mandos: White-space fixes only.
2369
        This function creates a new pipe in self.pipe
288.1.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
2370
        """
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2371
        parent_pipe, self.child_pipe = multiprocessing.Pipe()
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
2372
        
505.1.11 by Teddy Hogeborn
* mandos (Client.checked_ok): Set "expires" after setting timeout.
2373
        proc = MultiprocessingMixIn.process_request(self, request,
2374
                                                    client_address)
24.1.152 by Björn Påhlsson
bug fixes that prevent problems when runing server as root
2375
        self.child_pipe.close()
505.1.11 by Teddy Hogeborn
* mandos (Client.checked_ok): Set "expires" after setting timeout.
2376
        self.add_pipe(parent_pipe, proc)
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
2377
    
505.1.11 by Teddy Hogeborn
* mandos (Client.checked_ok): Set "expires" after setting timeout.
2378
    def add_pipe(self, parent_pipe, proc):
288.1.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
2379
        """Dummy function; override as necessary"""
642 by Teddy Hogeborn
Syntax fix; use "raise" better in Mandos server.
2380
        raise NotImplementedError()
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2381
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
2382
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2383
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
335 by Teddy Hogeborn
* mandos: Import "SocketServer" as "socketserver" and "ConfigParser"
2384
                     socketserver.TCPServer, object):
237.2.13 by Teddy Hogeborn
Merge from trunk. Notable changes:
2385
    """IPv6-capable TCP server.  Accepts 'None' as address and/or port
331 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
2386
    
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
2387
    Attributes:
331 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
2388
        enabled:        Boolean; whether this server is activated yet
2389
        interface:      None or a network interface name (string)
2390
        use_ipv6:       Boolean; to use IPv6 or not
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
2391
    """
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2392
    
331 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
2393
    def __init__(self, server_address, RequestHandlerClass,
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2394
                 interface=None,
2395
                 use_ipv6=True,
2396
                 socketfd=None):
589.1.1 by Teddy Hogeborn
* mandos: Implement "--socket" option.
2397
        """If socketfd is set, use that file descriptor instead of
2398
        creating a new one with socket.socket().
2399
        """
331 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
2400
        self.interface = interface
2401
        if use_ipv6:
2402
            self.address_family = socket.AF_INET6
589.1.1 by Teddy Hogeborn
* mandos: Implement "--socket" option.
2403
        if socketfd is not None:
2404
            # Save the file descriptor
2405
            self.socketfd = socketfd
2406
            # Save the original socket.socket() function
2407
            self.socket_socket = socket.socket
2408
            # To implement --socket, we monkey patch socket.socket.
2409
            # 
2410
            # (When socketserver.TCPServer is a new-style class, we
2411
            # could make self.socket into a property instead of monkey
2412
            # patching socket.socket.)
2413
            # 
2414
            # Create a one-time-only replacement for socket.socket()
2415
            @functools.wraps(socket.socket)
2416
            def socket_wrapper(*args, **kwargs):
2417
                # Restore original function so subsequent calls are
2418
                # not affected.
2419
                socket.socket = self.socket_socket
2420
                del self.socket_socket
2421
                # This time only, return a new socket object from the
2422
                # saved file descriptor.
2423
                return socket.fromfd(self.socketfd, *args, **kwargs)
2424
            # Replace socket.socket() function with wrapper
2425
            socket.socket = socket_wrapper
2426
        # The socketserver.TCPServer.__init__ will call
2427
        # socket.socket(), which might be our replacement,
2428
        # socket_wrapper(), if socketfd was set.
335 by Teddy Hogeborn
* mandos: Import "SocketServer" as "socketserver" and "ConfigParser"
2429
        socketserver.TCPServer.__init__(self, server_address,
331 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
2430
                                        RequestHandlerClass)
589.1.1 by Teddy Hogeborn
* mandos: Implement "--socket" option.
2431
    
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
2432
    def server_bind(self):
2433
        """This overrides the normal server_bind() function
2434
        to bind to an interface if one was specified, and also NOT to
2435
        bind to an address or port if they were not specified."""
331 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
2436
        if self.interface is not None:
338 by Teddy Hogeborn
* mandos: Minor doc string fixes.
2437
            if SO_BINDTODEVICE is None:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2438
                logger.error("SO_BINDTODEVICE does not exist;"
2439
                             " cannot bind to interface %s",
338 by Teddy Hogeborn
* mandos: Minor doc string fixes.
2440
                             self.interface)
2441
            else:
2442
                try:
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2443
                    self.socket.setsockopt(
2444
                        socket.SOL_SOCKET, SO_BINDTODEVICE,
2445
                        (self.interface + "\0").encode("utf-8"))
482 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
2446
                except socket.error as error:
582 by Teddy Hogeborn
* mandos (IPv6_TCPServer.server_bind): Bug fix: handle non-existing
2447
                    if error.errno == errno.EPERM:
606 by Teddy Hogeborn
* mandos: New "--foreground" option.
2448
                        logger.error("No permission to bind to"
2449
                                     " interface %s", self.interface)
582 by Teddy Hogeborn
* mandos (IPv6_TCPServer.server_bind): Bug fix: handle non-existing
2450
                    elif error.errno == errno.ENOPROTOOPT:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2451
                        logger.error("SO_BINDTODEVICE not available;"
2452
                                     " cannot bind to interface %s",
338 by Teddy Hogeborn
* mandos: Minor doc string fixes.
2453
                                     self.interface)
582 by Teddy Hogeborn
* mandos (IPv6_TCPServer.server_bind): Bug fix: handle non-existing
2454
                    elif error.errno == errno.ENODEV:
606 by Teddy Hogeborn
* mandos: New "--foreground" option.
2455
                        logger.error("Interface %s does not exist,"
2456
                                     " cannot bind", self.interface)
338 by Teddy Hogeborn
* mandos: Minor doc string fixes.
2457
                    else:
2458
                        raise
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
2459
        # Only bind(2) the socket if we really need to.
2460
        if self.server_address[0] or self.server_address[1]:
2461
            if not self.server_address[0]:
314 by Teddy Hogeborn
Support not using IPv6 in server:
2462
                if self.address_family == socket.AF_INET6:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2463
                    any_address = "::" # in6addr_any
314 by Teddy Hogeborn
Support not using IPv6 in server:
2464
                else:
618 by Teddy Hogeborn
* mandos: Bug fix: Make boolean options work from the config file
2465
                    any_address = "0.0.0.0" # INADDR_ANY
314 by Teddy Hogeborn
Support not using IPv6 in server:
2466
                self.server_address = (any_address,
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
2467
                                       self.server_address[1])
49 by Teddy Hogeborn
* mandos (IPv6_TCPServer.server_bind): Bug fix: allow port to be empty
2468
            elif not self.server_address[1]:
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2469
                self.server_address = (self.server_address[0], 0)
331 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
2470
#                 if self.interface:
49 by Teddy Hogeborn
* mandos (IPv6_TCPServer.server_bind): Bug fix: allow port to be empty
2471
#                     self.server_address = (self.server_address[0],
2472
#                                            0, # port
2473
#                                            0, # flowinfo
2474
#                                            if_nametoindex
331 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
2475
#                                            (self.interface))
335 by Teddy Hogeborn
* mandos: Import "SocketServer" as "socketserver" and "ConfigParser"
2476
            return socketserver.TCPServer.server_bind(self)
339 by Teddy Hogeborn
Code cleanup.
2477
2478
2479
class MandosServer(IPv6_TCPServer):
2480
    """Mandos server.
2481
    
2482
    Attributes:
2483
        clients:        set of Client objects
2484
        gnutls_priority GnuTLS priority string
2485
        use_dbus:       Boolean; to emit D-Bus signals or not
340 by Teddy Hogeborn
Code cleanup.
2486
    
830 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
2487
    Assumes a GLib.MainLoop event loop.
339 by Teddy Hogeborn
Code cleanup.
2488
    """
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2489
    
339 by Teddy Hogeborn
Code cleanup.
2490
    def __init__(self, server_address, RequestHandlerClass,
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2491
                 interface=None,
2492
                 use_ipv6=True,
2493
                 clients=None,
2494
                 gnutls_priority=None,
2495
                 use_dbus=True,
2496
                 socketfd=None):
339 by Teddy Hogeborn
Code cleanup.
2497
        self.enabled = False
2498
        self.clients = clients
341 by Teddy Hogeborn
Code cleanup and one bug fix.
2499
        if self.clients is None:
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
2500
            self.clients = {}
339 by Teddy Hogeborn
Code cleanup.
2501
        self.use_dbus = use_dbus
2502
        self.gnutls_priority = gnutls_priority
2503
        IPv6_TCPServer.__init__(self, server_address,
2504
                                RequestHandlerClass,
2505
                                interface = interface,
589.1.1 by Teddy Hogeborn
* mandos: Implement "--socket" option.
2506
                                use_ipv6 = use_ipv6,
2507
                                socketfd = socketfd)
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2508
    
163 by Teddy Hogeborn
* Makefile (PIDDIR, USER, GROUP): Removed.
2509
    def server_activate(self):
2510
        if self.enabled:
335 by Teddy Hogeborn
* mandos: Import "SocketServer" as "socketserver" and "ConfigParser"
2511
            return socketserver.TCPServer.server_activate(self)
505.1.11 by Teddy Hogeborn
* mandos (Client.checked_ok): Set "expires" after setting timeout.
2512
    
163 by Teddy Hogeborn
* Makefile (PIDDIR, USER, GROUP): Removed.
2513
    def enable(self):
2514
        self.enabled = True
505.1.11 by Teddy Hogeborn
* mandos (Client.checked_ok): Set "expires" after setting timeout.
2515
    
2516
    def add_pipe(self, parent_pipe, proc):
340 by Teddy Hogeborn
Code cleanup.
2517
        # Call "handle_ipc" for both data and EOF events
830 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
2518
        GLib.io_add_watch(
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2519
            parent_pipe.fileno(),
830 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
2520
            GLib.IO_IN | GLib.IO_HUP,
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2521
            functools.partial(self.handle_ipc,
2522
                              parent_pipe = parent_pipe,
2523
                              proc = proc))
505.1.9 by Teddy Hogeborn
Whitespace
2524
    
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2525
    def handle_ipc(self, source, condition,
2526
                   parent_pipe=None,
2527
                   proc = None,
2528
                   client_object=None):
505.1.13 by Teddy Hogeborn
Miscellaneous fixes prompted by lintian:
2529
        # error, or the other end of multiprocessing.Pipe has closed
830 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
2530
        if condition & (GLib.IO_ERR | GLib.IO_HUP):
505.1.13 by Teddy Hogeborn
Miscellaneous fixes prompted by lintian:
2531
            # Wait for other process to exit
505.1.11 by Teddy Hogeborn
* mandos (Client.checked_ok): Set "expires" after setting timeout.
2532
            proc.join()
24.1.152 by Björn Påhlsson
bug fixes that prevent problems when runing server as root
2533
            return False
288.1.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
2534
        
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2535
        # Read a request from the child
2536
        request = parent_pipe.recv()
2537
        command = request[0]
2538
        
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2539
        if command == 'init':
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2540
            fpr = request[1]
2541
            address = request[2]
2542
            
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
2543
            for c in self.clients.values():
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2544
                if c.fingerprint == fpr:
2545
                    client = c
2546
                    break
2547
            else:
24.1.174 by Björn Påhlsson
* Makefile (CFLAGS): Added "-lrt" to include real time library.
2548
                logger.info("Client not found for fingerprint: %s, ad"
2549
                            "dress: %s", fpr, address)
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2550
                if self.use_dbus:
2551
                    # Emit D-Bus signal
505.1.3 by Teddy Hogeborn
* mandos: Break long lines.
2552
                    mandos_dbus_service.ClientNotFound(fpr,
2553
                                                       address[0])
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2554
                parent_pipe.send(False)
2555
                return False
2556
            
830 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
2557
            GLib.io_add_watch(
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2558
                parent_pipe.fileno(),
830 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
2559
                GLib.IO_IN | GLib.IO_HUP,
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2560
                functools.partial(self.handle_ipc,
2561
                                  parent_pipe = parent_pipe,
2562
                                  proc = proc,
2563
                                  client_object = client))
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2564
            parent_pipe.send(True)
505.1.3 by Teddy Hogeborn
* mandos: Break long lines.
2565
            # remove the old hook in favor of the new above hook on
2566
            # same fileno
288.1.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
2567
            return False
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2568
        if command == 'funcall':
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2569
            funcname = request[1]
2570
            args = request[2]
2571
            kwargs = request[3]
2572
            
505.1.3 by Teddy Hogeborn
* mandos: Break long lines.
2573
            parent_pipe.send(('data', getattr(client_object,
2574
                                              funcname)(*args,
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2575
                                                        **kwargs)))
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
2576
        
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2577
        if command == 'getattr':
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2578
            attrname = request[1]
755 by Teddy Hogeborn
mandos: More Python 3 fixes.
2579
            if isinstance(client_object.__getattribute__(attrname),
2580
                          collections.Callable):
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2581
                parent_pipe.send(('function', ))
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2582
            else:
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2583
                parent_pipe.send((
2584
                    'data', client_object.__getattribute__(attrname)))
24.2.4 by teddy at bsnet
* mandos (ClientDBus.approvals_pending): Changed to be a property
2585
        
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2586
        if command == 'setattr':
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2587
            attrname = request[1]
2588
            value = request[2]
2589
            setattr(client_object, attrname, value)
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
2590
        
288.1.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
2591
        return True
10 by Teddy Hogeborn
* server.py: Bug fix: Do "from __future__ import division".
2592
3 by Björn Påhlsson
Python based server
2593
609 by Teddy Hogeborn
* clients.conf: Convert all time intervals to new RFC 3339 syntax.
2594
def rfc3339_duration_to_delta(duration):
2595
    """Parse an RFC 3339 "duration" and return a datetime.timedelta
2596
    
2597
    >>> rfc3339_duration_to_delta("P7D")
2598
    datetime.timedelta(7)
2599
    >>> rfc3339_duration_to_delta("PT60S")
2600
    datetime.timedelta(0, 60)
2601
    >>> rfc3339_duration_to_delta("PT60M")
2602
    datetime.timedelta(0, 3600)
2603
    >>> rfc3339_duration_to_delta("PT24H")
2604
    datetime.timedelta(1)
2605
    >>> rfc3339_duration_to_delta("P1W")
2606
    datetime.timedelta(7)
2607
    >>> rfc3339_duration_to_delta("PT5M30S")
2608
    datetime.timedelta(0, 330)
2609
    >>> rfc3339_duration_to_delta("P1DT3M20S")
2610
    datetime.timedelta(1, 200)
2611
    """
2612
    
2613
    # Parsing an RFC 3339 duration with regular expressions is not
2614
    # possible - there would have to be multiple places for the same
2615
    # values, like seconds.  The current code, while more esoteric, is
2616
    # cleaner without depending on a parsing library.  If Python had a
2617
    # built-in library for parsing we would use it, but we'd like to
2618
    # avoid excessive use of external libraries.
2619
    
2620
    # New type for defining tokens, syntax, and semantics all-in-one
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2621
    Token = collections.namedtuple("Token", (
2622
        "regexp",  # To match token; if "value" is not None, must have
2623
                   # a "group" containing digits
2624
        "value",   # datetime.timedelta or None
2625
        "followers"))           # Tokens valid after this token
609 by Teddy Hogeborn
* clients.conf: Convert all time intervals to new RFC 3339 syntax.
2626
    # RFC 3339 "duration" tokens, syntax, and semantics; taken from
2627
    # the "duration" ABNF definition in RFC 3339, Appendix A.
2628
    token_end = Token(re.compile(r"$"), None, frozenset())
2629
    token_second = Token(re.compile(r"(\d+)S"),
2630
                         datetime.timedelta(seconds=1),
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2631
                         frozenset((token_end, )))
609 by Teddy Hogeborn
* clients.conf: Convert all time intervals to new RFC 3339 syntax.
2632
    token_minute = Token(re.compile(r"(\d+)M"),
2633
                         datetime.timedelta(minutes=1),
2634
                         frozenset((token_second, token_end)))
2635
    token_hour = Token(re.compile(r"(\d+)H"),
2636
                       datetime.timedelta(hours=1),
2637
                       frozenset((token_minute, token_end)))
2638
    token_time = Token(re.compile(r"T"),
2639
                       None,
2640
                       frozenset((token_hour, token_minute,
2641
                                  token_second)))
2642
    token_day = Token(re.compile(r"(\d+)D"),
2643
                      datetime.timedelta(days=1),
2644
                      frozenset((token_time, token_end)))
2645
    token_month = Token(re.compile(r"(\d+)M"),
2646
                        datetime.timedelta(weeks=4),
2647
                        frozenset((token_day, token_end)))
2648
    token_year = Token(re.compile(r"(\d+)Y"),
2649
                       datetime.timedelta(weeks=52),
2650
                       frozenset((token_month, token_end)))
2651
    token_week = Token(re.compile(r"(\d+)W"),
2652
                       datetime.timedelta(weeks=1),
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2653
                       frozenset((token_end, )))
609 by Teddy Hogeborn
* clients.conf: Convert all time intervals to new RFC 3339 syntax.
2654
    token_duration = Token(re.compile(r"P"), None,
2655
                           frozenset((token_year, token_month,
2656
                                      token_day, token_time,
721 by Teddy Hogeborn
Fix two mutually cancelling bugs.
2657
                                      token_week)))
609 by Teddy Hogeborn
* clients.conf: Convert all time intervals to new RFC 3339 syntax.
2658
    # Define starting values
2659
    value = datetime.timedelta() # Value so far
2660
    found_token = None
753 by Teddy Hogeborn
mandos-ctl: Generate better messages in exceptions.
2661
    followers = frozenset((token_duration, )) # Following valid tokens
609 by Teddy Hogeborn
* clients.conf: Convert all time intervals to new RFC 3339 syntax.
2662
    s = duration                # String left to parse
2663
    # Loop until end token is found
2664
    while found_token is not token_end:
2665
        # Search for any currently valid tokens
2666
        for token in followers:
2667
            match = token.regexp.match(s)
2668
            if match is not None:
2669
                # Token found
2670
                if token.value is not None:
2671
                    # Value found, parse digits
2672
                    factor = int(match.group(1), 10)
2673
                    # Add to value so far
2674
                    value += factor * token.value
2675
                # Strip token from string
2676
                s = token.regexp.sub("", s, 1)
2677
                # Go to found token
2678
                found_token = token
2679
                # Set valid next tokens
2680
                followers = found_token.followers
2681
                break
2682
        else:
2683
            # No currently valid tokens were found
752 by Teddy Hogeborn
mandos: Generate better messages in exceptions.
2684
            raise ValueError("Invalid RFC 3339 duration: {!r}"
2685
                             .format(duration))
609 by Teddy Hogeborn
* clients.conf: Convert all time intervals to new RFC 3339 syntax.
2686
    # End token found
2687
    return value
2688
2689
4 by Teddy Hogeborn
* server.py (Client.created, Client.next_check): New.
2690
def string_to_delta(interval):
2691
    """Parse a string and return a datetime.timedelta
290 by Teddy Hogeborn
* mandos (main): Bug fix: Do setgid before setuid. Add verbose GnuTLS
2692
    
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2693
    >>> string_to_delta('7d')
4 by Teddy Hogeborn
* server.py (Client.created, Client.next_check): New.
2694
    datetime.timedelta(7)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2695
    >>> string_to_delta('60s')
4 by Teddy Hogeborn
* server.py (Client.created, Client.next_check): New.
2696
    datetime.timedelta(0, 60)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2697
    >>> string_to_delta('60m')
4 by Teddy Hogeborn
* server.py (Client.created, Client.next_check): New.
2698
    datetime.timedelta(0, 3600)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2699
    >>> string_to_delta('24h')
4 by Teddy Hogeborn
* server.py (Client.created, Client.next_check): New.
2700
    datetime.timedelta(1)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2701
    >>> string_to_delta('1w')
4 by Teddy Hogeborn
* server.py (Client.created, Client.next_check): New.
2702
    datetime.timedelta(7)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2703
    >>> string_to_delta('5m 30s')
93 by Teddy Hogeborn
* mandos (string_to_delta): Accept a whitespace-separated sequence of
2704
    datetime.timedelta(0, 330)
4 by Teddy Hogeborn
* server.py (Client.created, Client.next_check): New.
2705
    """
609 by Teddy Hogeborn
* clients.conf: Convert all time intervals to new RFC 3339 syntax.
2706
    
2707
    try:
2708
        return rfc3339_duration_to_delta(interval)
2709
    except ValueError:
2710
        pass
2711
    
93 by Teddy Hogeborn
* mandos (string_to_delta): Accept a whitespace-separated sequence of
2712
    timevalue = datetime.timedelta(0)
2713
    for s in interval.split():
2714
        try:
729 by Teddy Hogeborn
mandos: Stop using str() and remove unnecessary unicode() calls.
2715
            suffix = s[-1]
215 by Teddy Hogeborn
* mandos: Remove unused "select" module. Import "ctypes.util".
2716
            value = int(s[:-1])
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2717
            if suffix == "d":
93 by Teddy Hogeborn
* mandos (string_to_delta): Accept a whitespace-separated sequence of
2718
                delta = datetime.timedelta(value)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2719
            elif suffix == "s":
93 by Teddy Hogeborn
* mandos (string_to_delta): Accept a whitespace-separated sequence of
2720
                delta = datetime.timedelta(0, value)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2721
            elif suffix == "m":
93 by Teddy Hogeborn
* mandos (string_to_delta): Accept a whitespace-separated sequence of
2722
                delta = datetime.timedelta(0, 0, 0, 0, value)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2723
            elif suffix == "h":
93 by Teddy Hogeborn
* mandos (string_to_delta): Accept a whitespace-separated sequence of
2724
                delta = datetime.timedelta(0, 0, 0, 0, 0, value)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2725
            elif suffix == "w":
93 by Teddy Hogeborn
* mandos (string_to_delta): Accept a whitespace-separated sequence of
2726
                delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
2727
            else:
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2728
                raise ValueError("Unknown suffix {!r}".format(suffix))
642 by Teddy Hogeborn
Syntax fix; use "raise" better in Mandos server.
2729
        except IndexError as e:
464 by Teddy Hogeborn
* debian/mandos-client.postrm (purge): Bug fix: update initramfs also
2730
            raise ValueError(*(e.args))
93 by Teddy Hogeborn
* mandos (string_to_delta): Accept a whitespace-separated sequence of
2731
        timevalue += delta
2732
    return timevalue
4 by Teddy Hogeborn
* server.py (Client.created, Client.next_check): New.
2733
8 by Teddy Hogeborn
* Makefile (client_debug): Bug fix; add quotes and / to CERT_ROOT.
2734
47 by Teddy Hogeborn
* plugbasedclient.c: Renamed to "mandos-client.c". All users changed.
2735
def daemon(nochdir = False, noclose = False):
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
2736
    """See daemon(3).  Standard BSD Unix function.
331 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
2737
    
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
2738
    This should really exist as os.daemon, but it doesn't (yet)."""
2739
    if os.fork():
2740
        sys.exit()
2741
    os.setsid()
2742
    if not nochdir:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2743
        os.chdir("/")
46 by Teddy Hogeborn
* network-protocol.txt: New.
2744
    if os.fork():
2745
        sys.exit()
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
2746
    if not noclose:
2747
        # Close all standard open file descriptors
560.1.1 by teddy at recompile
* mandos: Use os.devnull instead of os.path.devnull. Fix some white
2748
        null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
2749
        if not stat.S_ISCHR(os.fstat(null).st_mode):
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2750
            raise OSError(errno.ENODEV,
2751
                          "{} not a character device"
568 by Teddy Hogeborn
* mandos-monitor: Use new string format method.
2752
                          .format(os.devnull))
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
2753
        os.dup2(null, sys.stdin.fileno())
2754
        os.dup2(null, sys.stdout.fileno())
2755
        os.dup2(null, sys.stderr.fileno())
2756
        if null > 2:
2757
            os.close(null)
2758
2759
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
2760
def main():
327 by Teddy Hogeborn
Merge from pipe IPC branch.
2761
    
379 by Teddy Hogeborn
* mandos: Fix line lengths.
2762
    ##################################################################
327 by Teddy Hogeborn
Merge from pipe IPC branch.
2763
    # Parsing of options, both command line and config file
2764
    
474 by teddy at bsnet
* mandos: Use the new argparse library instead of optparse.
2765
    parser = argparse.ArgumentParser()
2766
    parser.add_argument("-v", "--version", action="version",
723.1.5 by Teddy Hogeborn
Use the new auto-numbered "{}" syntax for the .format() string method.
2767
                        version = "%(prog)s {}".format(version),
474 by teddy at bsnet
* mandos: Use the new argparse library instead of optparse.
2768
                        help="show version number and exit")
2769
    parser.add_argument("-i", "--interface", metavar="IF",
2770
                        help="Bind to interface IF")
2771
    parser.add_argument("-a", "--address",
2772
                        help="Address to listen for requests on")
2773
    parser.add_argument("-p", "--port", type=int,
2774
                        help="Port number to receive requests on")
2775
    parser.add_argument("--check", action="store_true",
2776
                        help="Run self-test")
2777
    parser.add_argument("--debug", action="store_true",
2778
                        help="Debug mode; run in foreground and log"
618 by Teddy Hogeborn
* mandos: Bug fix: Make boolean options work from the config file
2779
                        " to terminal", default=None)
474 by teddy at bsnet
* mandos: Use the new argparse library instead of optparse.
2780
    parser.add_argument("--debuglevel", metavar="LEVEL",
2781
                        help="Debug level for stdout output")
2782
    parser.add_argument("--priority", help="GnuTLS"
2783
                        " priority string (see GnuTLS documentation)")
2784
    parser.add_argument("--servicename",
2785
                        metavar="NAME", help="Zeroconf service name")
2786
    parser.add_argument("--configdir",
2787
                        default="/etc/mandos", metavar="DIR",
2788
                        help="Directory to search for configuration"
2789
                        " files")
2790
    parser.add_argument("--no-dbus", action="store_false",
2791
                        dest="use_dbus", help="Do not provide D-Bus"
618 by Teddy Hogeborn
* mandos: Bug fix: Make boolean options work from the config file
2792
                        " system bus interface", default=None)
474 by teddy at bsnet
* mandos: Use the new argparse library instead of optparse.
2793
    parser.add_argument("--no-ipv6", action="store_false",
618 by Teddy Hogeborn
* mandos: Bug fix: Make boolean options work from the config file
2794
                        dest="use_ipv6", help="Do not use IPv6",
2795
                        default=None)
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
2796
    parser.add_argument("--no-restore", action="store_false",
518.1.7 by Teddy Hogeborn
* mandos: Break long lines and fix some more white space.
2797
                        dest="restore", help="Do not restore stored"
618 by Teddy Hogeborn
* mandos: Bug fix: Make boolean options work from the config file
2798
                        " state", default=None)
589.1.1 by Teddy Hogeborn
* mandos: Implement "--socket" option.
2799
    parser.add_argument("--socket", type=int,
2800
                        help="Specify a file descriptor to a network"
2801
                        " socket to use instead of creating one")
518.2.2 by Teddy Hogeborn
Directory with persistent state can now be changed with the "statedir"
2802
    parser.add_argument("--statedir", metavar="DIR",
2803
                        help="Directory to save/restore state in")
606 by Teddy Hogeborn
* mandos: New "--foreground" option.
2804
    parser.add_argument("--foreground", action="store_true",
618 by Teddy Hogeborn
* mandos: Bug fix: Make boolean options work from the config file
2805
                        help="Run in foreground", default=None)
707 by Teddy Hogeborn
mandos: New "--no-zeroconf" option. Also make "--socket=0" work.
2806
    parser.add_argument("--no-zeroconf", action="store_false",
2807
                        dest="zeroconf", help="Do not use Zeroconf",
2808
                        default=None)
518.1.6 by Teddy Hogeborn
* mandos: Fix whitespace.
2809
    
474 by teddy at bsnet
* mandos: Use the new argparse library instead of optparse.
2810
    options = parser.parse_args()
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
2811
    
4 by Teddy Hogeborn
* server.py (Client.created, Client.next_check): New.
2812
    if options.check:
2813
        import doctest
654 by Teddy Hogeborn
Fix running of self-tests.
2814
        fail_count, test_count = doctest.testmod()
2815
        sys.exit(os.EX_OK if fail_count == 0 else 1)
3 by Björn Påhlsson
Python based server
2816
    
28 by Teddy Hogeborn
* server.conf: New file.
2817
    # Default values for config file for server-global settings
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2818
    server_defaults = { "interface": "",
2819
                        "address": "",
2820
                        "port": "",
2821
                        "debug": "False",
2822
                        "priority":
742 by Teddy Hogeborn
Add ":!RSA" to GnuTLS priority string, to disallow non-DHE kx.
2823
                        "SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
777 by Teddy Hogeborn
Bug fix for GnuTLS 3: be compatible with old 2048-bit DSA keys.
2824
                        ":+SIGN-DSA-SHA256",
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2825
                        "servicename": "Mandos",
2826
                        "use_dbus": "True",
2827
                        "use_ipv6": "True",
2828
                        "debuglevel": "",
518.2.2 by Teddy Hogeborn
Directory with persistent state can now be changed with the "statedir"
2829
                        "restore": "True",
589.1.1 by Teddy Hogeborn
* mandos: Implement "--socket" option.
2830
                        "socket": "",
606 by Teddy Hogeborn
* mandos: New "--foreground" option.
2831
                        "statedir": "/var/lib/mandos",
2832
                        "foreground": "False",
707 by Teddy Hogeborn
mandos: New "--no-zeroconf" option. Also make "--socket=0" work.
2833
                        "zeroconf": "True",
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2834
                    }
28 by Teddy Hogeborn
* server.conf: New file.
2835
    
2836
    # Parse config file for server-global settings
335 by Teddy Hogeborn
* mandos: Import "SocketServer" as "socketserver" and "ConfigParser"
2837
    server_config = configparser.SafeConfigParser(server_defaults)
28 by Teddy Hogeborn
* server.conf: New file.
2838
    del server_defaults
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2839
    server_config.read(os.path.join(options.configdir, "mandos.conf"))
28 by Teddy Hogeborn
* server.conf: New file.
2840
    # Convert the SafeConfigParser object to a dict
89 by Teddy Hogeborn
* Makefile: Bug fix: fixed creation of man pages for section 5 pages.
2841
    server_settings = server_config.defaults()
282 by Teddy Hogeborn
* mandos (main): Bug fix: use "getint" on the "port" config file
2842
    # Use the appropriate methods on the non-string config options
606 by Teddy Hogeborn
* mandos: New "--foreground" option.
2843
    for option in ("debug", "use_dbus", "use_ipv6", "foreground"):
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2844
        server_settings[option] = server_config.getboolean("DEFAULT",
333 by Teddy Hogeborn
Minor code cleanup; one minor bug fix.
2845
                                                           option)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2846
    if server_settings["port"]:
2847
        server_settings["port"] = server_config.getint("DEFAULT",
2848
                                                       "port")
589.1.1 by Teddy Hogeborn
* mandos: Implement "--socket" option.
2849
    if server_settings["socket"]:
2850
        server_settings["socket"] = server_config.getint("DEFAULT",
2851
                                                         "socket")
591 by Teddy Hogeborn
Merge "--socket" option for server.
2852
        # Later, stdin will, and stdout and stderr might, be dup'ed
589.1.1 by Teddy Hogeborn
* mandos: Implement "--socket" option.
2853
        # over with an opened os.devnull.  But we don't want this to
2854
        # happen with a supplied network socket.
2855
        if 0 <= server_settings["socket"] <= 2:
2856
            server_settings["socket"] = os.dup(server_settings
2857
                                               ["socket"])
28 by Teddy Hogeborn
* server.conf: New file.
2858
    del server_config
2859
    
2860
    # Override the settings from the config file with command line
2861
    # options, if set.
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2862
    for option in ("interface", "address", "port", "debug",
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2863
                   "priority", "servicename", "configdir", "use_dbus",
2864
                   "use_ipv6", "debuglevel", "restore", "statedir",
2865
                   "socket", "foreground", "zeroconf"):
28 by Teddy Hogeborn
* server.conf: New file.
2866
        value = getattr(options, option)
2867
        if value is not None:
2868
            server_settings[option] = value
2869
    del options
333 by Teddy Hogeborn
Minor code cleanup; one minor bug fix.
2870
    # Force all strings to be unicode
2871
    for option in server_settings.keys():
729 by Teddy Hogeborn
mandos: Stop using str() and remove unnecessary unicode() calls.
2872
        if isinstance(server_settings[option], bytes):
2873
            server_settings[option] = (server_settings[option]
2874
                                       .decode("utf-8"))
618 by Teddy Hogeborn
* mandos: Bug fix: Make boolean options work from the config file
2875
    # Force all boolean options to be boolean
2876
    for option in ("debug", "use_dbus", "use_ipv6", "restore",
707 by Teddy Hogeborn
mandos: New "--no-zeroconf" option. Also make "--socket=0" work.
2877
                   "foreground", "zeroconf"):
618 by Teddy Hogeborn
* mandos: Bug fix: Make boolean options work from the config file
2878
        server_settings[option] = bool(server_settings[option])
606 by Teddy Hogeborn
* mandos: New "--foreground" option.
2879
    # Debug implies foreground
2880
    if server_settings["debug"]:
2881
        server_settings["foreground"] = True
28 by Teddy Hogeborn
* server.conf: New file.
2882
    # Now we have our good server settings in "server_settings"
2883
    
327 by Teddy Hogeborn
Merge from pipe IPC branch.
2884
    ##################################################################
2885
    
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2886
    if (not server_settings["zeroconf"]
2887
        and not (server_settings["port"]
2888
                 or server_settings["socket"] != "")):
2889
        parser.error("Needs port or socket to work without Zeroconf")
707 by Teddy Hogeborn
mandos: New "--no-zeroconf" option. Also make "--socket=0" work.
2890
    
243 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
2891
    # For convenience
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2892
    debug = server_settings["debug"]
2893
    debuglevel = server_settings["debuglevel"]
2894
    use_dbus = server_settings["use_dbus"]
2895
    use_ipv6 = server_settings["use_ipv6"]
518.2.2 by Teddy Hogeborn
Directory with persistent state can now be changed with the "statedir"
2896
    stored_state_path = os.path.join(server_settings["statedir"],
2897
                                     stored_state_file)
606 by Teddy Hogeborn
* mandos: New "--foreground" option.
2898
    foreground = server_settings["foreground"]
707 by Teddy Hogeborn
mandos: New "--no-zeroconf" option. Also make "--socket=0" work.
2899
    zeroconf = server_settings["zeroconf"]
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
2900
    
518.1.4 by Björn Påhlsson
restructured logger
2901
    if debug:
530 by teddy at bsnet
* mandos (initlogger): Take new "debug" argument; all callers changed.
2902
        initlogger(debug, logging.DEBUG)
518.1.4 by Björn Påhlsson
restructured logger
2903
    else:
2904
        if not debuglevel:
530 by teddy at bsnet
* mandos (initlogger): Take new "debug" argument; all callers changed.
2905
            initlogger(debug)
518.1.4 by Björn Påhlsson
restructured logger
2906
        else:
2907
            level = getattr(logging, debuglevel.upper())
530 by teddy at bsnet
* mandos (initlogger): Take new "debug" argument; all callers changed.
2908
            initlogger(debug, level)
518.1.4 by Björn Påhlsson
restructured logger
2909
    
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2910
    if server_settings["servicename"] != "Mandos":
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2911
        syslogger.setFormatter(
2912
            logging.Formatter('Mandos ({}) [%(process)d]:'
2913
                              ' %(levelname)s: %(message)s'.format(
2914
                                  server_settings["servicename"])))
52 by Teddy Hogeborn
* mandos: Make syslog use "/dev/log" instead of UDP to localhost.
2915
    
28 by Teddy Hogeborn
* server.conf: New file.
2916
    # Parse config file with clients
543 by Teddy Hogeborn
* mandos: Break some long lines.
2917
    client_config = configparser.SafeConfigParser(Client
2918
                                                  .client_defaults)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2919
    client_config.read(os.path.join(server_settings["configdir"],
2920
                                    "clients.conf"))
333 by Teddy Hogeborn
Minor code cleanup; one minor bug fix.
2921
    
327 by Teddy Hogeborn
Merge from pipe IPC branch.
2922
    global mandos_dbus_service
2923
    mandos_dbus_service = None
28 by Teddy Hogeborn
* server.conf: New file.
2924
    
707 by Teddy Hogeborn
mandos: New "--no-zeroconf" option. Also make "--socket=0" work.
2925
    socketfd = None
2926
    if server_settings["socket"] != "":
2927
        socketfd = server_settings["socket"]
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2928
    tcp_server = MandosServer(
2929
        (server_settings["address"], server_settings["port"]),
2930
        ClientHandler,
2931
        interface=(server_settings["interface"] or None),
2932
        use_ipv6=use_ipv6,
2933
        gnutls_priority=server_settings["priority"],
2934
        use_dbus=use_dbus,
2935
        socketfd=socketfd)
606 by Teddy Hogeborn
* mandos: New "--foreground" option.
2936
    if not foreground:
626 by Teddy Hogeborn
* Makefile (CFLAGS, LDFLAGS): Keep default flags from environment.
2937
        pidfilename = "/run/mandos.pid"
636 by Teddy Hogeborn
Fall back to /var/run for pidfile if /run is not a directory.
2938
        if not os.path.isdir("/run/."):
2939
            pidfilename = "/var/run/mandos.pid"
606 by Teddy Hogeborn
* mandos: New "--foreground" option.
2940
        pidfile = None
439 by Teddy Hogeborn
* mandos: Do not write pid file if --debug is passed.
2941
        try:
751 by Teddy Hogeborn
mandos: Use codecs.open() and print() for PID file.
2942
            pidfile = codecs.open(pidfilename, "w", encoding="utf-8")
574 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
2943
        except IOError as e:
2944
            logger.error("Could not open file %r", pidfilename,
2945
                         exc_info=e)
164 by Teddy Hogeborn
* mandos: Open the PID file before daemonizing, but write to it
2946
    
816 by Teddy Hogeborn
Use "nogroup" as a fallback group, not "nobody".
2947
    for name, group in (("_mandos", "_mandos"),
2948
                        ("mandos", "mandos"),
2949
                        ("nobody", "nogroup")):
238 by Teddy Hogeborn
First version of a somewhat complete D-Bus server interface. Also
2950
        try:
566 by Teddy Hogeborn
* mandos (main): Simplify and shorten code selecting user and group ID
2951
            uid = pwd.getpwnam(name).pw_uid
816 by Teddy Hogeborn
Use "nogroup" as a fallback group, not "nobody".
2952
            gid = pwd.getpwnam(group).pw_gid
566 by Teddy Hogeborn
* mandos (main): Simplify and shorten code selecting user and group ID
2953
            break
238 by Teddy Hogeborn
First version of a somewhat complete D-Bus server interface. Also
2954
        except KeyError:
566 by Teddy Hogeborn
* mandos (main): Simplify and shorten code selecting user and group ID
2955
            continue
2956
    else:
2957
        uid = 65534
2958
        gid = 65534
163 by Teddy Hogeborn
* Makefile (PIDDIR, USER, GROUP): Removed.
2959
    try:
290 by Teddy Hogeborn
* mandos (main): Bug fix: Do setgid before setuid. Add verbose GnuTLS
2960
        os.setgid(gid)
163 by Teddy Hogeborn
* Makefile (PIDDIR, USER, GROUP): Removed.
2961
        os.setuid(uid)
825 by Teddy Hogeborn
Server bug fix: Include CAP_SETGID so it does not run as root
2962
        if debug:
2963
            logger.debug("Did setuid/setgid to {}:{}".format(uid,
2964
                                                             gid))
482 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
2965
    except OSError as error:
825 by Teddy Hogeborn
Server bug fix: Include CAP_SETGID so it does not run as root
2966
        logger.warning("Failed to setuid/setgid to {}:{}: {}"
2967
                       .format(uid, gid, os.strerror(error.errno)))
583 by Teddy Hogeborn
* mandos (Client.start_checker): Remove undocumented support for "%%s"
2968
        if error.errno != errno.EPERM:
642 by Teddy Hogeborn
Syntax fix; use "raise" better in Mandos server.
2969
            raise
164 by Teddy Hogeborn
* mandos: Open the PID file before daemonizing, but write to it
2970
    
290 by Teddy Hogeborn
* mandos (main): Bug fix: Do setgid before setuid. Add verbose GnuTLS
2971
    if debug:
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2972
        # Enable all possible GnuTLS debugging
2973
        
290 by Teddy Hogeborn
* mandos (main): Bug fix: Do setgid before setuid. Add verbose GnuTLS
2974
        # "Use a log level over 10 to enable all debugging options."
2975
        # - GnuTLS manual
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
2976
        gnutls.global_set_log_level(11)
290 by Teddy Hogeborn
* mandos (main): Bug fix: Do setgid before setuid. Add verbose GnuTLS
2977
        
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
2978
        @gnutls.log_func
290 by Teddy Hogeborn
* mandos (main): Bug fix: Do setgid before setuid. Add verbose GnuTLS
2979
        def debug_gnutls(level, string):
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2980
            logger.debug("GnuTLS: %s", string[:-1])
290 by Teddy Hogeborn
* mandos (main): Bug fix: Do setgid before setuid. Add verbose GnuTLS
2981
        
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
2982
        gnutls.global_set_log_function(debug_gnutls)
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2983
        
24.1.155 by Björn Påhlsson
mandos server: Added debuglevel that adjust at what level information
2984
        # Redirect stdin so all checkers get /dev/null
560.1.1 by teddy at recompile
* mandos: Use os.devnull instead of os.path.devnull. Fix some white
2985
        null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
24.1.155 by Björn Påhlsson
mandos server: Added debuglevel that adjust at what level information
2986
        os.dup2(null, sys.stdin.fileno())
2987
        if null > 2:
2988
            os.close(null)
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2989
    
458 by teddy at bsnet
* mandos (main): Bug fix: Fork before connecting to D-Bus.
2990
    # Need to fork before connecting to D-Bus
606 by Teddy Hogeborn
* mandos: New "--foreground" option.
2991
    if not foreground:
458 by teddy at bsnet
* mandos (main): Bug fix: Fork before connecting to D-Bus.
2992
        # Close all input and output, do double fork, etc.
2993
        daemon()
290 by Teddy Hogeborn
* mandos (main): Bug fix: Do setgid before setuid. Add verbose GnuTLS
2994
    
830 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
2995
    # multiprocessing will use threads, so before we use GLib we need
2996
    # to inform GLib that threads will be used.
2997
    GLib.threads_init()
518.2.11 by Teddy Hogeborn
* mandos (main): Tell gobject we're (or, rather, multiprocessing is)
2998
    
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
2999
    global main_loop
3000
    # From the Avahi example code
560.1.1 by teddy at recompile
* mandos: Use os.devnull instead of os.path.devnull. Fix some white
3001
    DBusGMainLoop(set_as_default=True)
830 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
3002
    main_loop = GLib.MainLoop()
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
3003
    bus = dbus.SystemBus()
3004
    # End of Avahi example code
243 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
3005
    if use_dbus:
402 by Teddy Hogeborn
* mandos (Client.disable): Rename keyword argument "log" to "quiet",
3006
        try:
505 by Björn Påhlsson
The domain name has changed, so the D-Bus bus and interface names must
3007
            bus_name = dbus.service.BusName("se.recompile.Mandos",
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3008
                                            bus,
3009
                                            do_not_queue=True)
3010
            old_bus_name = dbus.service.BusName(
3011
                "se.bsnet.fukt.Mandos", bus,
3012
                do_not_queue=True)
750 by Teddy Hogeborn
mandos: Disable D-Bus if any DBusException is raised when connecting.
3013
        except dbus.exceptions.DBusException as e:
574 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
3014
            logger.error("Disabling D-Bus:", exc_info=e)
402 by Teddy Hogeborn
* mandos (Client.disable): Rename keyword argument "log" to "quiet",
3015
            use_dbus = False
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
3016
            server_settings["use_dbus"] = False
402 by Teddy Hogeborn
* mandos (Client.disable): Rename keyword argument "log" to "quiet",
3017
            tcp_server.use_dbus = False
707 by Teddy Hogeborn
mandos: New "--no-zeroconf" option. Also make "--socket=0" work.
3018
    if zeroconf:
3019
        protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3020
        service = AvahiServiceToSyslog(
3021
            name = server_settings["servicename"],
3022
            servicetype = "_mandos._tcp",
3023
            protocol = protocol,
3024
            bus = bus)
707 by Teddy Hogeborn
mandos: New "--no-zeroconf" option. Also make "--socket=0" work.
3025
        if server_settings["interface"]:
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3026
            service.interface = if_nametoindex(
3027
                server_settings["interface"].encode("utf-8"))
458 by teddy at bsnet
* mandos (main): Bug fix: Fork before connecting to D-Bus.
3028
    
24.1.152 by Björn Påhlsson
bug fixes that prevent problems when runing server as root
3029
    global multiprocessing_manager
3030
    multiprocessing_manager = multiprocessing.Manager()
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
3031
    
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
3032
    client_class = Client
3033
    if use_dbus:
575 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
3034
        client_class = functools.partial(ClientDBus, bus = bus)
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
3035
    
518.1.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
3036
    client_settings = Client.config_parser(client_config)
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
3037
    old_client_settings = {}
518.1.15 by Björn Påhlsson
more refactoring in regards to how clients get created
3038
    clients_data = {}
518.1.6 by Teddy Hogeborn
* mandos: Fix whitespace.
3039
    
617 by Teddy Hogeborn
* mandos: Bug fix: Don't print output from checkers when running in
3040
    # This is used to redirect stdout and stderr for checker processes
3041
    global wnull
3042
    wnull = open(os.devnull, "w") # A writable /dev/null
3043
    # Only used if server is running in foreground but not in debug
3044
    # mode
3045
    if debug or not foreground:
3046
        wnull.close()
3047
    
518.1.7 by Teddy Hogeborn
* mandos: Break long lines and fix some more white space.
3048
    # Get client data and settings from last running state.
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
3049
    if server_settings["restore"]:
3050
        try:
3051
            with open(stored_state_path, "rb") as stored_state:
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
3052
                if sys.version_info.major == 2:                
3053
                    clients_data, old_client_settings = pickle.load(
3054
                        stored_state)
3055
                else:
3056
                    bytes_clients_data, bytes_old_client_settings = (
3057
                        pickle.load(stored_state, encoding = "bytes"))
3058
                    ### Fix bytes to strings
3059
                    ## clients_data
3060
                    # .keys()
3061
                    clients_data = { (key.decode("utf-8")
3062
                                      if isinstance(key, bytes)
3063
                                      else key): value
3064
                                     for key, value in
3065
                                     bytes_clients_data.items() }
829 by Teddy Hogeborn
Server: Fix minor thing with Python 3 compatibility
3066
                    del bytes_clients_data
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
3067
                    for key in clients_data:
3068
                        value = { (k.decode("utf-8")
3069
                                   if isinstance(k, bytes) else k): v
3070
                                  for k, v in
3071
                                  clients_data[key].items() }
3072
                        clients_data[key] = value
3073
                        # .client_structure
3074
                        value["client_structure"] = [
3075
                            (s.decode("utf-8")
3076
                             if isinstance(s, bytes)
3077
                             else s) for s in
3078
                            value["client_structure"] ]
3079
                        # .name & .host
3080
                        for k in ("name", "host"):
3081
                            if isinstance(value[k], bytes):
3082
                                value[k] = value[k].decode("utf-8")
3083
                    ## old_client_settings
829 by Teddy Hogeborn
Server: Fix minor thing with Python 3 compatibility
3084
                    # .keys()
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
3085
                    old_client_settings = {
3086
                        (key.decode("utf-8")
3087
                         if isinstance(key, bytes)
3088
                         else key): value
3089
                        for key, value in
3090
                        bytes_old_client_settings.items() }
829 by Teddy Hogeborn
Server: Fix minor thing with Python 3 compatibility
3091
                    del bytes_old_client_settings
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
3092
                    # .host
3093
                    for value in old_client_settings.values():
829 by Teddy Hogeborn
Server: Fix minor thing with Python 3 compatibility
3094
                        if isinstance(value["host"], bytes):
3095
                            value["host"] = (value["host"]
3096
                                             .decode("utf-8"))
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
3097
            os.remove(stored_state_path)
3098
        except IOError as e:
574 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
3099
            if e.errno == errno.ENOENT:
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3100
                logger.warning("Could not load persistent state:"
3101
                               " {}".format(os.strerror(e.errno)))
574 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
3102
            else:
3103
                logger.critical("Could not load persistent state:",
3104
                                exc_info=e)
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
3105
                raise
505.1.23 by Teddy Hogeborn
* mandos (main): Handle EOFError when reading state file.
3106
        except EOFError as e:
3107
            logger.warning("Could not load persistent state: "
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3108
                           "EOFError:",
3109
                           exc_info=e)
518.1.6 by Teddy Hogeborn
* mandos: Fix whitespace.
3110
    
518.1.9 by Björn Påhlsson
renamed variables
3111
    with PGPEngine() as pgp:
723.1.4 by Teddy Hogeborn
Use the .items() method instead of .iteritems().
3112
        for client_name, client in clients_data.items():
617 by Teddy Hogeborn
* mandos: Bug fix: Don't print output from checkers when running in
3113
            # Skip removed clients
3114
            if client_name not in client_settings:
3115
                continue
3116
            
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
3117
            # Decide which value to use after restoring saved state.
3118
            # We have three different values: Old config file,
3119
            # new config file, and saved state.
3120
            # New config value takes precedence if it differs from old
3121
            # config value, otherwise use saved state.
3122
            for name, value in client_settings[client_name].items():
3123
                try:
3124
                    # For each value in new config, check if it
3125
                    # differs from the old config value (Except for
3126
                    # the "secret" attribute)
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3127
                    if (name != "secret"
3128
                        and (value !=
3129
                             old_client_settings[client_name][name])):
518.2.10 by Teddy Hogeborn
* mandos (main): Bug fix: Syntax fix when restoring settings.
3130
                        client[name] = value
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
3131
                except KeyError:
3132
                    pass
3133
            
3134
            # Clients who has passed its expire date can still be
749.1.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
3135
            # enabled if its last checker was successful.  A Client
552 by teddy at recompile
* mandos: Consistent terminology; use the term "secret" for the
3136
            # whose checker succeeded before we stored its state is
3137
            # assumed to have successfully run all checkers during
3138
            # downtime.
518.2.8 by Teddy Hogeborn
* mandos (ClientDBus.Host_dbus_property,
3139
            if client["enabled"]:
518.1.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
3140
                if datetime.datetime.utcnow() >= client["expires"]:
3141
                    if not client["last_checked_ok"]:
3142
                        logger.warning(
723.1.5 by Teddy Hogeborn
Use the new auto-numbered "{}" syntax for the .format() string method.
3143
                            "disabling client {} - Client never "
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3144
                            "performed a successful checker".format(
3145
                                client_name))
518.1.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
3146
                        client["enabled"] = False
3147
                    elif client["last_checker_status"] != 0:
3148
                        logger.warning(
723.1.5 by Teddy Hogeborn
Use the new auto-numbered "{}" syntax for the .format() string method.
3149
                            "disabling client {} - Client last"
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3150
                            " checker failed with error code"
3151
                            " {}".format(
3152
                                client_name,
3153
                                client["last_checker_status"]))
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
3154
                        client["enabled"] = False
3155
                    else:
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3156
                        client["expires"] = (
3157
                            datetime.datetime.utcnow()
3158
                            + client["timeout"])
542 by Björn Påhlsson
fixed bug with bad stored config state for expires and last_checked_ok.
3159
                        logger.debug("Last checker succeeded,"
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3160
                                     " keeping {} enabled".format(
3161
                                         client_name))
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
3162
            try:
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3163
                client["secret"] = pgp.decrypt(
3164
                    client["encrypted_secret"],
3165
                    client_settings[client_name]["secret"])
518.1.9 by Björn Påhlsson
renamed variables
3166
            except PGPError:
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
3167
                # If decryption fails, we use secret from new settings
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3168
                logger.debug("Failed to decrypt {} old secret".format(
3169
                    client_name))
3170
                client["secret"] = (client_settings[client_name]
3171
                                    ["secret"])
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
3172
    
518.1.15 by Björn Påhlsson
more refactoring in regards to how clients get created
3173
    # Add/remove clients based on new changes made to config
543 by Teddy Hogeborn
* mandos: Break some long lines.
3174
    for client_name in (set(old_client_settings)
3175
                        - set(client_settings)):
518.1.15 by Björn Påhlsson
more refactoring in regards to how clients get created
3176
        del clients_data[client_name]
543 by Teddy Hogeborn
* mandos: Break some long lines.
3177
    for client_name in (set(client_settings)
3178
                        - set(old_client_settings)):
518.1.15 by Björn Påhlsson
more refactoring in regards to how clients get created
3179
        clients_data[client_name] = client_settings[client_name]
573 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
3180
    
552 by teddy at recompile
* mandos: Consistent terminology; use the term "secret" for the
3181
    # Create all client objects
723.1.4 by Teddy Hogeborn
Use the .items() method instead of .iteritems().
3182
    for client_name, client in clients_data.items():
518.1.15 by Björn Påhlsson
more refactoring in regards to how clients get created
3183
        tcp_server.clients[client_name] = client_class(
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3184
            name = client_name,
3185
            settings = client,
617 by Teddy Hogeborn
* mandos: Bug fix: Don't print output from checkers when running in
3186
            server_settings = server_settings)
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
3187
    
341 by Teddy Hogeborn
Code cleanup and one bug fix.
3188
    if not tcp_server.clients:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
3189
        logger.warning("No clients defined")
573 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
3190
    
606 by Teddy Hogeborn
* mandos: New "--foreground" option.
3191
    if not foreground:
3192
        if pidfile is not None:
751 by Teddy Hogeborn
mandos: Use codecs.open() and print() for PID file.
3193
            pid = os.getpid()
606 by Teddy Hogeborn
* mandos: New "--foreground" option.
3194
            try:
3195
                with pidfile:
751 by Teddy Hogeborn
mandos: Use codecs.open() and print() for PID file.
3196
                    print(pid, file=pidfile)
606 by Teddy Hogeborn
* mandos: New "--foreground" option.
3197
            except IOError:
3198
                logger.error("Could not write to file %r with PID %d",
3199
                             pidfilename, pid)
3200
        del pidfile
439 by Teddy Hogeborn
* mandos: Do not write pid file if --debug is passed.
3201
        del pidfilename
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
3202
    
831 by Teddy Hogeborn
Server: Fix bug where it did not exit timely on signals
3203
    for termsig in (signal.SIGHUP, signal.SIGTERM):
3204
        GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,
3205
                             lambda: main_loop.quit() and False)
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
3206
    
243 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
3207
    if use_dbus:
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3208
        
3209
        @alternate_dbus_interfaces(
3210
            { "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
3211
        class MandosDBusService(DBusObjectWithObjectManager):
243 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
3212
            """A D-Bus proxy object"""
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3213
            
243 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
3214
            def __init__(self):
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
3215
                dbus.service.Object.__init__(self, bus, "/")
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3216
            
505.1.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
3217
            _interface = "se.recompile.Mandos"
278 by Teddy Hogeborn
* mandos (Client.GetAllProperties): Also send Client.dbus_object_path
3218
            
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
3219
            @dbus.service.signal(_interface, signature="o")
411 by Teddy Hogeborn
More consistent terminology: Clients are no longer "invalid" - they
3220
            def ClientAdded(self, objpath):
243 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
3221
                "D-Bus signal"
3222
                pass
278 by Teddy Hogeborn
* mandos (Client.GetAllProperties): Also send Client.dbus_object_path
3223
            
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
3224
            @dbus.service.signal(_interface, signature="ss")
409 by Teddy Hogeborn
* mandos (MandosServer.handle_ipc): Better log message.
3225
            def ClientNotFound(self, fingerprint, address):
327 by Teddy Hogeborn
Merge from pipe IPC branch.
3226
                "D-Bus signal"
3227
                pass
3228
            
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
3229
            @dbus_annotations({"org.freedesktop.DBus.Deprecated":
3230
                               "true"})
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
3231
            @dbus.service.signal(_interface, signature="os")
278 by Teddy Hogeborn
* mandos (Client.GetAllProperties): Also send Client.dbus_object_path
3232
            def ClientRemoved(self, objpath, name):
243 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
3233
                "D-Bus signal"
3234
                pass
278 by Teddy Hogeborn
* mandos (Client.GetAllProperties): Also send Client.dbus_object_path
3235
            
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
3236
            @dbus_annotations({"org.freedesktop.DBus.Deprecated":
3237
                               "true"})
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
3238
            @dbus.service.method(_interface, out_signature="ao")
243 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
3239
            def GetAllClients(self):
283 by Teddy Hogeborn
* mandos (peer_certificate): Handle NULL pointer from
3240
                "D-Bus method"
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3241
                return dbus.Array(c.dbus_object_path for c in
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
3242
                                  tcp_server.clients.values())
278 by Teddy Hogeborn
* mandos (Client.GetAllProperties): Also send Client.dbus_object_path
3243
            
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
3244
            @dbus_annotations({"org.freedesktop.DBus.Deprecated":
3245
                               "true"})
333 by Teddy Hogeborn
Minor code cleanup; one minor bug fix.
3246
            @dbus.service.method(_interface,
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
3247
                                 out_signature="a{oa{sv}}")
243 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
3248
            def GetAllClientsWithProperties(self):
283 by Teddy Hogeborn
* mandos (peer_certificate): Handle NULL pointer from
3249
                "D-Bus method"
243 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
3250
                return dbus.Dictionary(
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
3251
                    { c.dbus_object_path: c.GetAll(
3252
                        "se.recompile.Mandos.Client")
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
3253
                      for c in tcp_server.clients.values() },
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
3254
                    signature="oa{sv}")
278 by Teddy Hogeborn
* mandos (Client.GetAllProperties): Also send Client.dbus_object_path
3255
            
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
3256
            @dbus.service.method(_interface, in_signature="o")
243 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
3257
            def RemoveClient(self, object_path):
283 by Teddy Hogeborn
* mandos (peer_certificate): Handle NULL pointer from
3258
                "D-Bus method"
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
3259
                for c in tcp_server.clients.values():
243 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
3260
                    if c.dbus_object_path == object_path:
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
3261
                        del tcp_server.clients[c.name]
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
3262
                        c.remove_from_connection()
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
3263
                        # Don't signal the disabling
402 by Teddy Hogeborn
* mandos (Client.disable): Rename keyword argument "log" to "quiet",
3264
                        c.disable(quiet=True)
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
3265
                        # Emit D-Bus signal for removal
3266
                        self.client_removed_signal(c)
278 by Teddy Hogeborn
* mandos (Client.GetAllProperties): Also send Client.dbus_object_path
3267
                        return
400 by Teddy Hogeborn
* mandos (Client.enable): Bug fix: Start new immediate checker last to
3268
                raise KeyError(object_path)
278 by Teddy Hogeborn
* mandos (Client.GetAllProperties): Also send Client.dbus_object_path
3269
            
243 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
3270
            del _interface
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
3271
            
3272
            @dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
3273
                                 out_signature = "a{oa{sa{sv}}}")
3274
            def GetManagedObjects(self):
3275
                """D-Bus method"""
3276
                return dbus.Dictionary(
3277
                    { client.dbus_object_path:
3278
                      dbus.Dictionary(
3279
                          { interface: client.GetAll(interface)
3280
                            for interface in
3281
                                 client._get_all_interface_names()})
3282
                      for client in tcp_server.clients.values()})
3283
            
3284
            def client_added_signal(self, client):
3285
                """Send the new standard signal and the old signal"""
3286
                if use_dbus:
3287
                    # New standard signal
3288
                    self.InterfacesAdded(
3289
                        client.dbus_object_path,
3290
                        dbus.Dictionary(
3291
                            { interface: client.GetAll(interface)
3292
                              for interface in
3293
                              client._get_all_interface_names()}))
3294
                    # Old signal
3295
                    self.ClientAdded(client.dbus_object_path)
3296
            
3297
            def client_removed_signal(self, client):
3298
                """Send the new standard signal and the old signal"""
3299
                if use_dbus:
3300
                    # New standard signal
3301
                    self.InterfacesRemoved(
3302
                        client.dbus_object_path,
3303
                        client._get_all_interface_names())
3304
                    # Old signal
3305
                    self.ClientRemoved(client.dbus_object_path,
3306
                                       client.name)
278 by Teddy Hogeborn
* mandos (Client.GetAllProperties): Also send Client.dbus_object_path
3307
        
575 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
3308
        mandos_dbus_service = MandosDBusService()
238 by Teddy Hogeborn
First version of a somewhat complete D-Bus server interface. Also
3309
    
400 by Teddy Hogeborn
* mandos (Client.enable): Bug fix: Start new immediate checker last to
3310
    def cleanup():
3311
        "Cleanup function; run on exit"
707 by Teddy Hogeborn
mandos: New "--no-zeroconf" option. Also make "--socket=0" work.
3312
        if zeroconf:
3313
            service.cleanup()
400 by Teddy Hogeborn
* mandos (Client.enable): Bug fix: Start new immediate checker last to
3314
        
505.1.11 by Teddy Hogeborn
* mandos (Client.checked_ok): Set "expires" after setting timeout.
3315
        multiprocessing.active_children()
617 by Teddy Hogeborn
* mandos: Bug fix: Don't print output from checkers when running in
3316
        wnull.close()
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
3317
        if not (tcp_server.clients or client_settings):
3318
            return
518.1.6 by Teddy Hogeborn
* mandos: Fix whitespace.
3319
        
521 by teddy at bsnet
* debian/control (mandos/Depends): Added "python-crypto".
3320
        # Store client before exiting. Secrets are encrypted with key
3321
        # based on what config file has. If config file is
3322
        # removed/edited, old secret will thus be unrecovable.
518.1.15 by Björn Påhlsson
more refactoring in regards to how clients get created
3323
        clients = {}
518.1.9 by Björn Påhlsson
renamed variables
3324
        with PGPEngine() as pgp:
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
3325
            for client in tcp_server.clients.values():
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
3326
                key = client_settings[client.name]["secret"]
518.1.9 by Björn Påhlsson
renamed variables
3327
                client.encrypted_secret = pgp.encrypt(client.secret,
3328
                                                      key)
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
3329
                client_dict = {}
3330
                
518.1.15 by Björn Påhlsson
more refactoring in regards to how clients get created
3331
                # A list of attributes that can not be pickled
3332
                # + secret.
723.1.2 by Teddy Hogeborn
Use set literals.
3333
                exclude = { "bus", "changedstate", "secret",
3334
                            "checker", "server_settings" }
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3335
                for name, typ in inspect.getmembers(dbus.service
3336
                                                    .Object):
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
3337
                    exclude.add(name)
3338
                
3339
                client_dict["encrypted_secret"] = (client
3340
                                                   .encrypted_secret)
3341
                for attr in client.client_structure:
3342
                    if attr not in exclude:
3343
                        client_dict[attr] = getattr(client, attr)
3344
                
518.1.15 by Björn Påhlsson
more refactoring in regards to how clients get created
3345
                clients[client.name] = client_dict
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
3346
                del client_settings[client.name]["secret"]
3347
        
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
3348
        try:
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3349
            with tempfile.NamedTemporaryFile(
3350
                    mode='wb',
3351
                    suffix=".pickle",
3352
                    prefix='clients-',
3353
                    dir=os.path.dirname(stored_state_path),
3354
                    delete=False) as stored_state:
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
3355
                pickle.dump((clients, client_settings), stored_state,
3356
                            protocol = 2)
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3357
                tempname = stored_state.name
505.1.26 by teddy at bsnet
* mandos (main/cleanup): Write new file, then rename. Use
3358
            os.rename(tempname, stored_state_path)
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
3359
        except (IOError, OSError) as e:
530 by teddy at bsnet
* mandos (initlogger): Take new "debug" argument; all callers changed.
3360
            if not debug:
3361
                try:
3362
                    os.remove(tempname)
3363
                except NameError:
3364
                    pass
574 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
3365
            if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
723.1.5 by Teddy Hogeborn
Use the new auto-numbered "{}" syntax for the .format() string method.
3366
                logger.warning("Could not save persistent state: {}"
574 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
3367
                               .format(os.strerror(e.errno)))
3368
            else:
3369
                logger.warning("Could not save persistent state:",
3370
                               exc_info=e)
642 by Teddy Hogeborn
Syntax fix; use "raise" better in Mandos server.
3371
                raise
518.1.6 by Teddy Hogeborn
* mandos: Fix whitespace.
3372
        
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
3373
        # Delete all clients, and settings from config
400 by Teddy Hogeborn
* mandos (Client.enable): Bug fix: Start new immediate checker last to
3374
        while tcp_server.clients:
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
3375
            name, client = tcp_server.clients.popitem()
402 by Teddy Hogeborn
* mandos (Client.disable): Rename keyword argument "log" to "quiet",
3376
            if use_dbus:
3377
                client.remove_from_connection()
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
3378
            # Don't signal the disabling
402 by Teddy Hogeborn
* mandos (Client.disable): Rename keyword argument "log" to "quiet",
3379
            client.disable(quiet=True)
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
3380
            # Emit D-Bus signal for removal
796 by Teddy Hogeborn
On cleanup, Signal ClientRemoved only if using D-Bus.
3381
            if use_dbus:
3382
                mandos_dbus_service.client_removed_signal(client)
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
3383
        client_settings.clear()
400 by Teddy Hogeborn
* mandos (Client.enable): Bug fix: Start new immediate checker last to
3384
    
3385
    atexit.register(cleanup)
3386
    
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
3387
    for client in tcp_server.clients.values():
243 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
3388
        if use_dbus:
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
3389
            # Emit D-Bus signal for adding
3390
            mandos_dbus_service.client_added_signal(client)
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
3391
        # Need to initiate checking of clients
3392
        if client.enabled:
3393
            client.init_checker()
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
3394
    
163 by Teddy Hogeborn
* Makefile (PIDDIR, USER, GROUP): Removed.
3395
    tcp_server.enable()
3396
    tcp_server.server_activate()
3397
    
28 by Teddy Hogeborn
* server.conf: New file.
3398
    # Find out what port we got
707 by Teddy Hogeborn
mandos: New "--no-zeroconf" option. Also make "--socket=0" work.
3399
    if zeroconf:
3400
        service.port = tcp_server.socket.getsockname()[1]
314 by Teddy Hogeborn
Support not using IPv6 in server:
3401
    if use_ipv6:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
3402
        logger.info("Now listening on address %r, port %d,"
568 by Teddy Hogeborn
* mandos-monitor: Use new string format method.
3403
                    " flowinfo %d, scope_id %d",
3404
                    *tcp_server.socket.getsockname())
314 by Teddy Hogeborn
Support not using IPv6 in server:
3405
    else:                       # IPv4
568 by Teddy Hogeborn
* mandos-monitor: Use new string format method.
3406
        logger.info("Now listening on address %r, port %d",
3407
                    *tcp_server.socket.getsockname())
28 by Teddy Hogeborn
* server.conf: New file.
3408
    
29 by Teddy Hogeborn
* plugins.d/mandosclient.c (start_mandos_communication): Changed
3409
    #service.interface = tcp_server.socket.getsockname()[3]
28 by Teddy Hogeborn
* server.conf: New file.
3410
    
3411
    try:
707 by Teddy Hogeborn
mandos: New "--no-zeroconf" option. Also make "--socket=0" work.
3412
        if zeroconf:
3413
            # From the Avahi example code
3414
            try:
3415
                service.activate()
3416
            except dbus.exceptions.DBusException as error:
3417
                logger.critical("D-Bus Exception", exc_info=error)
3418
                cleanup()
3419
                sys.exit(1)
3420
            # End of Avahi example code
28 by Teddy Hogeborn
* server.conf: New file.
3421
        
830 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
3422
        GLib.io_add_watch(tcp_server.fileno(), GLib.IO_IN,
3423
                          lambda *args, **kwargs:
3424
                          (tcp_server.handle_request
3425
                           (*args[2:], **kwargs) or True))
28 by Teddy Hogeborn
* server.conf: New file.
3426
        
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
3427
        logger.debug("Starting main loop")
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
3428
        main_loop.run()
482 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
3429
    except AvahiError as error:
565 by Teddy Hogeborn
* mandos (AvahiService.rename, Client.start_checker,
3430
        logger.critical("Avahi Error", exc_info=error)
401 by Teddy Hogeborn
* README (FAQ): Fix typo.
3431
        cleanup()
28 by Teddy Hogeborn
* server.conf: New file.
3432
        sys.exit(1)
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
3433
    except KeyboardInterrupt:
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
3434
        if debug:
463.1.5 by teddy at bsnet
* mandos: Use unicode string literals.
3435
            print("", file=sys.stderr)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
3436
        logger.debug("Server received KeyboardInterrupt")
3437
    logger.debug("Server exiting")
401 by Teddy Hogeborn
* README (FAQ): Fix typo.
3438
    # Must run before the D-Bus bus name gets deregistered
3439
    cleanup()
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
3440
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3441
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
3442
if __name__ == '__main__':
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
3443
    main()