/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk
806 by Teddy Hogeborn
Fix Debian dependency bugs and lintian checks.
1
#!/usr/bin/python
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
2
# -*- mode: python; coding: utf-8 -*-
874 by Teddy Hogeborn
PEP8 compliance: mandos
3
#
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
4
# Mandos server - give out binary blobs to connecting clients.
874 by Teddy Hogeborn
PEP8 compliance: mandos
5
#
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
6
# This program is partly derived from an example program for an Avahi
7
# service publisher, downloaded from
8
# <http://avahi.org/wiki/PythonPublishExample>.  This includes the
336 by Teddy Hogeborn
Code cleanup.
9
# methods "add", "remove", "server_state_changed",
10
# "entry_group_state_changed", "cleanup", and "activate" in the
11
# "AvahiService" class, and some lines in "main".
874 by Teddy Hogeborn
PEP8 compliance: mandos
12
#
28 by Teddy Hogeborn
* server.conf: New file.
13
# Everything else is
969 by Teddy Hogeborn
Update copyright year to 2019
14
# Copyright © 2008-2019 Teddy Hogeborn
15
# Copyright © 2008-2019 Björn Påhlsson
874 by Teddy Hogeborn
PEP8 compliance: mandos
16
#
907 by Teddy Hogeborn
Alter copyright notices slightly. Actual license is unchanged!
17
# This file is part of Mandos.
18
#
19
# Mandos is free software: you can redistribute it and/or modify it
20
# under the terms of the GNU General Public License as published by
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
21
# the Free Software Foundation, either version 3 of the License, or
22
# (at your option) any later version.
23
#
907 by Teddy Hogeborn
Alter copyright notices slightly. Actual license is unchanged!
24
#     Mandos is distributed in the hope that it will be useful, but
25
#     WITHOUT ANY WARRANTY; without even the implied warranty of
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
26
#     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
27
#     GNU General Public License for more details.
874 by Teddy Hogeborn
PEP8 compliance: mandos
28
#
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
29
# You should have received a copy of the GNU General Public License
907 by Teddy Hogeborn
Alter copyright notices slightly. Actual license is unchanged!
30
# along with Mandos.  If not, see <http://www.gnu.org/licenses/>.
874 by Teddy Hogeborn
PEP8 compliance: mandos
31
#
505.1.2 by Teddy Hogeborn
Change "fukt.bsnet.se" to "recompile.se" throughout.
32
# Contact the authors at <mandos@recompile.se>.
874 by Teddy Hogeborn
PEP8 compliance: mandos
33
#
3 by Björn Påhlsson
Python based server
34
463.1.5 by teddy at bsnet
* mandos: Use unicode string literals.
35
from __future__ import (division, absolute_import, print_function,
36
                        unicode_literals)
10 by Teddy Hogeborn
* server.py: Bug fix: Do "from __future__ import division".
37
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
38
try:
39
    from future_builtins import *
40
except ImportError:
41
    pass
579 by Teddy Hogeborn
* mandos: Use all new builtins.
42
749 by Teddy Hogeborn
mandos: Some more minor changes to prepare for Python 3.
43
try:
44
    import SocketServer as socketserver
45
except ImportError:
46
    import socketserver
3 by Björn Påhlsson
Python based server
47
import socket
474 by teddy at bsnet
* mandos: Use the new argparse library instead of optparse.
48
import argparse
3 by Björn Påhlsson
Python based server
49
import datetime
50
import errno
749 by Teddy Hogeborn
mandos: Some more minor changes to prepare for Python 3.
51
try:
52
    import ConfigParser as configparser
53
except ImportError:
54
    import configparser
4 by Teddy Hogeborn
* server.py (Client.created, Client.next_check): New.
55
import sys
9 by Teddy Hogeborn
* client.cpp (main): Get t_old early since it is used on error exits.
56
import re
57
import os
58
import signal
10 by Teddy Hogeborn
* server.py: Bug fix: Do "from __future__ import division".
59
import subprocess
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
60
import atexit
61
import stat
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
62
import logging
63
import logging.handlers
163 by Teddy Hogeborn
* Makefile (PIDDIR, USER, GROUP): Removed.
64
import pwd
411 by Teddy Hogeborn
More consistent terminology: Clients are no longer "invalid" - they
65
import contextlib
333 by Teddy Hogeborn
Minor code cleanup; one minor bug fix.
66
import struct
67
import fcntl
337 by Teddy Hogeborn
Code cleanup. Move some global stuff into main.
68
import functools
749 by Teddy Hogeborn
mandos: Some more minor changes to prepare for Python 3.
69
try:
70
    import cPickle as pickle
71
except ImportError:
72
    import pickle
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
73
import multiprocessing
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
74
import types
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
75
import binascii
76
import tempfile
560.1.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
77
import itertools
609 by Teddy Hogeborn
* clients.conf: Convert all time intervals to new RFC 3339 syntax.
78
import collections
751 by Teddy Hogeborn
mandos: Use codecs.open() and print() for PID file.
79
import codecs
5 by Teddy Hogeborn
* server.py (server_metaclass): New.
80
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
81
import dbus
237.1.1 by Teddy Hogeborn
First steps of a D-Bus interface to the server.
82
import dbus.service
830 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
83
from gi.repository import GLib
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
84
from dbus.mainloop.glib import DBusGMainLoop
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
85
import ctypes
215 by Teddy Hogeborn
* mandos: Remove unused "select" module. Import "ctypes.util".
86
import ctypes.util
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
87
import xml.dom.minidom
88
import inspect
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
89
852 by Teddy Hogeborn
mandos: Bug fix for Python 2.7 and the "--interface" option
90
# Try to find the value of SO_BINDTODEVICE:
331 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
91
try:
852 by Teddy Hogeborn
mandos: Bug fix for Python 2.7 and the "--interface" option
92
    # This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and
93
    # newer, and it is also the most natural place for it:
331 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
94
    SO_BINDTODEVICE = socket.SO_BINDTODEVICE
95
except AttributeError:
96
    try:
852 by Teddy Hogeborn
mandos: Bug fix for Python 2.7 and the "--interface" option
97
        # This is where SO_BINDTODEVICE was up to and including Python
98
        # 2.6, and also 3.2:
331 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
99
        from IN import SO_BINDTODEVICE
100
    except ImportError:
852 by Teddy Hogeborn
mandos: Bug fix for Python 2.7 and the "--interface" option
101
        # In Python 2.7 it seems to have been removed entirely.
102
        # Try running the C preprocessor:
103
        try:
104
            cc = subprocess.Popen(["cc", "--language=c", "-E",
105
                                   "/dev/stdin"],
106
                                  stdin=subprocess.PIPE,
107
                                  stdout=subprocess.PIPE)
108
            stdout = cc.communicate(
109
                "#include <sys/socket.h>\nSO_BINDTODEVICE\n")[0]
110
            SO_BINDTODEVICE = int(stdout.splitlines()[-1])
111
        except (OSError, ValueError, IndexError):
112
            # No value found
113
            SO_BINDTODEVICE = None
331 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
114
730 by Teddy Hogeborn
mandos: Replace unicode() with str().
115
if sys.version_info.major == 2:
116
    str = unicode
117
237.4.104 by Teddy Hogeborn
* Makefile (version): Change to 1.8.1.
118
version = "1.8.1"
518.2.2 by Teddy Hogeborn
Directory with persistent state can now be changed with the "statedir"
119
stored_state_file = "clients.pickle"
13 by Björn Påhlsson
Added following support:
120
505.1.20 by Teddy Hogeborn
* Makefile (run-server): Remove obsolete warning.
121
logger = logging.getLogger()
655 by Teddy Hogeborn
Allow self-tests to run without needing /dev/log.
122
syslogger = None
13 by Björn Påhlsson
Added following support:
123
518.1.5 by Björn Påhlsson
First run of python-lint. Fixed some *obviously* bad code and turned
124
try:
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
125
    if_nametoindex = ctypes.cdll.LoadLibrary(
126
        ctypes.util.find_library("c")).if_nametoindex
518.1.5 by Björn Påhlsson
First run of python-lint. Fixed some *obviously* bad code and turned
127
except (OSError, AttributeError):
874 by Teddy Hogeborn
PEP8 compliance: mandos
128
518.1.5 by Björn Påhlsson
First run of python-lint. Fixed some *obviously* bad code and turned
129
    def if_nametoindex(interface):
130
        "Get an interface index the hard way, i.e. using fcntl()"
131
        SIOCGIFINDEX = 0x8933  # From /usr/include/linux/sockios.h
132
        with contextlib.closing(socket.socket()) as s:
133
            ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
729 by Teddy Hogeborn
mandos: Stop using str() and remove unnecessary unicode() calls.
134
                                struct.pack(b"16s16x", interface))
135
        interface_index = struct.unpack("I", ifreq[16:20])[0]
518.1.5 by Björn Påhlsson
First run of python-lint. Fixed some *obviously* bad code and turned
136
        return interface_index
137
138
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
139
def copy_function(func):
140
    """Make a copy of a function"""
141
    if sys.version_info.major == 2:
142
        return types.FunctionType(func.func_code,
143
                                  func.func_globals,
144
                                  func.func_name,
145
                                  func.func_defaults,
146
                                  func.func_closure)
147
    else:
148
        return types.FunctionType(func.__code__,
149
                                  func.__globals__,
150
                                  func.__name__,
151
                                  func.__defaults__,
152
                                  func.__closure__)
153
154
530 by teddy at bsnet
* mandos (initlogger): Take new "debug" argument; all callers changed.
155
def initlogger(debug, level=logging.WARNING):
518.1.4 by Björn Påhlsson
restructured logger
156
    """init logger and add loglevel"""
874 by Teddy Hogeborn
PEP8 compliance: mandos
157
698 by Teddy Hogeborn
Fix mandos server "--servicename" option, broken since 1.6.4.
158
    global syslogger
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
159
    syslogger = (logging.handlers.SysLogHandler(
874 by Teddy Hogeborn
PEP8 compliance: mandos
160
        facility=logging.handlers.SysLogHandler.LOG_DAEMON,
161
        address="/dev/log"))
518.1.4 by Björn Påhlsson
restructured logger
162
    syslogger.setFormatter(logging.Formatter
163
                           ('Mandos [%(process)d]: %(levelname)s:'
164
                            ' %(message)s'))
165
    logger.addHandler(syslogger)
874 by Teddy Hogeborn
PEP8 compliance: mandos
166
530 by teddy at bsnet
* mandos (initlogger): Take new "debug" argument; all callers changed.
167
    if debug:
168
        console = logging.StreamHandler()
169
        console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
170
                                               ' [%(process)d]:'
171
                                               ' %(levelname)s:'
172
                                               ' %(message)s'))
173
        logger.addHandler(console)
518.1.4 by Björn Påhlsson
restructured logger
174
    logger.setLevel(level)
28 by Teddy Hogeborn
* server.conf: New file.
175
505.1.20 by Teddy Hogeborn
* Makefile (run-server): Remove obsolete warning.
176
518.1.9 by Björn Påhlsson
renamed variables
177
class PGPError(Exception):
178
    """Exception if encryption/decryption fails"""
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
179
    pass
180
181
518.1.9 by Björn Påhlsson
renamed variables
182
class PGPEngine(object):
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
183
    """A simple class for OpenPGP symmetric encryption & decryption"""
874 by Teddy Hogeborn
PEP8 compliance: mandos
184
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
185
    def __init__(self):
186
        self.tempdir = tempfile.mkdtemp(prefix="mandos-")
805 by Teddy Hogeborn
Use GnuPG 2 if available
187
        self.gpg = "gpg"
188
        try:
189
            output = subprocess.check_output(["gpgconf"])
190
            for line in output.splitlines():
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
191
                name, text, path = line.split(b":")
805 by Teddy Hogeborn
Use GnuPG 2 if available
192
                if name == "gpg":
193
                    self.gpg = path
194
                    break
195
        except OSError as e:
196
            if e.errno != errno.ENOENT:
197
                raise
615 by Teddy Hogeborn
* mandos: Don't use the GnuPGInterface module.
198
        self.gnupgargs = ['--batch',
805 by Teddy Hogeborn
Use GnuPG 2 if available
199
                          '--homedir', self.tempdir,
615 by Teddy Hogeborn
* mandos: Don't use the GnuPGInterface module.
200
                          '--force-mdc',
849 by Teddy Hogeborn
mandos: Bug fix: Only use the --no-use-agent option for GPG 1
201
                          '--quiet']
202
        # Only GPG version 1 has the --no-use-agent option.
203
        if self.gpg == "gpg" or self.gpg.endswith("/gpg"):
204
            self.gnupgargs.append("--no-use-agent")
874 by Teddy Hogeborn
PEP8 compliance: mandos
205
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
206
    def __enter__(self):
207
        return self
874 by Teddy Hogeborn
PEP8 compliance: mandos
208
587 by Teddy Hogeborn
* Makefile (DOCBOOKTOMAN): Only run man --warnings if both "man" and
209
    def __exit__(self, exc_type, exc_value, traceback):
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
210
        self._cleanup()
211
        return False
874 by Teddy Hogeborn
PEP8 compliance: mandos
212
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
213
    def __del__(self):
214
        self._cleanup()
874 by Teddy Hogeborn
PEP8 compliance: mandos
215
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
216
    def _cleanup(self):
217
        if self.tempdir is not None:
218
            # Delete contents of tempdir
219
            for root, dirs, files in os.walk(self.tempdir,
874 by Teddy Hogeborn
PEP8 compliance: mandos
220
                                             topdown=False):
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
221
                for filename in files:
222
                    os.remove(os.path.join(root, filename))
223
                for dirname in dirs:
224
                    os.rmdir(os.path.join(root, dirname))
225
            # Remove tempdir
226
            os.rmdir(self.tempdir)
227
            self.tempdir = None
874 by Teddy Hogeborn
PEP8 compliance: mandos
228
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
229
    def password_encode(self, password):
230
        # Passphrase can not be empty and can not contain newlines or
231
        # NUL bytes.  So we prefix it and hex encode it.
630 by Teddy Hogeborn
* mandos (PGPEngine.password_encode): Bug fix: GnuPG can't handle
232
        encoded = b"mandos" + binascii.hexlify(password)
233
        if len(encoded) > 2048:
234
            # GnuPG can't handle long passwords, so encode differently
235
            encoded = (b"mandos" + password.replace(b"\\", b"\\\\")
236
                       .replace(b"\n", b"\\n")
237
                       .replace(b"\0", b"\\x00"))
238
        return encoded
874 by Teddy Hogeborn
PEP8 compliance: mandos
239
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
240
    def encrypt(self, data, password):
615 by Teddy Hogeborn
* mandos: Don't use the GnuPGInterface module.
241
        passphrase = self.password_encode(password)
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
242
        with tempfile.NamedTemporaryFile(
243
                dir=self.tempdir) as passfile:
615 by Teddy Hogeborn
* mandos: Don't use the GnuPGInterface module.
244
            passfile.write(passphrase)
245
            passfile.flush()
805 by Teddy Hogeborn
Use GnuPG 2 if available
246
            proc = subprocess.Popen([self.gpg, '--symmetric',
615 by Teddy Hogeborn
* mandos: Don't use the GnuPGInterface module.
247
                                     '--passphrase-file',
248
                                     passfile.name]
249
                                    + self.gnupgargs,
874 by Teddy Hogeborn
PEP8 compliance: mandos
250
                                    stdin=subprocess.PIPE,
251
                                    stdout=subprocess.PIPE,
252
                                    stderr=subprocess.PIPE)
253
            ciphertext, err = proc.communicate(input=data)
615 by Teddy Hogeborn
* mandos: Don't use the GnuPGInterface module.
254
        if proc.returncode != 0:
255
            raise PGPError(err)
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
256
        return ciphertext
874 by Teddy Hogeborn
PEP8 compliance: mandos
257
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
258
    def decrypt(self, data, password):
615 by Teddy Hogeborn
* mandos: Don't use the GnuPGInterface module.
259
        passphrase = self.password_encode(password)
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
260
        with tempfile.NamedTemporaryFile(
874 by Teddy Hogeborn
PEP8 compliance: mandos
261
                dir=self.tempdir) as passfile:
615 by Teddy Hogeborn
* mandos: Don't use the GnuPGInterface module.
262
            passfile.write(passphrase)
263
            passfile.flush()
805 by Teddy Hogeborn
Use GnuPG 2 if available
264
            proc = subprocess.Popen([self.gpg, '--decrypt',
615 by Teddy Hogeborn
* mandos: Don't use the GnuPGInterface module.
265
                                     '--passphrase-file',
266
                                     passfile.name]
267
                                    + self.gnupgargs,
874 by Teddy Hogeborn
PEP8 compliance: mandos
268
                                    stdin=subprocess.PIPE,
269
                                    stdout=subprocess.PIPE,
270
                                    stderr=subprocess.PIPE)
271
            decrypted_plaintext, err = proc.communicate(input=data)
615 by Teddy Hogeborn
* mandos: Don't use the GnuPGInterface module.
272
        if proc.returncode != 0:
273
            raise PGPError(err)
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
274
        return decrypted_plaintext
275
874 by Teddy Hogeborn
PEP8 compliance: mandos
276
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
277
# Pretend that we have an Avahi module
278
class Avahi(object):
279
    """This isn't so much a class as it is a module-like namespace.
280
    It is instantiated once, and simulates having an Avahi module."""
874 by Teddy Hogeborn
PEP8 compliance: mandos
281
    IF_UNSPEC = -1               # avahi-common/address.h
282
    PROTO_UNSPEC = -1            # avahi-common/address.h
283
    PROTO_INET = 0               # avahi-common/address.h
284
    PROTO_INET6 = 1              # avahi-common/address.h
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
285
    DBUS_NAME = "org.freedesktop.Avahi"
286
    DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"
287
    DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"
288
    DBUS_PATH_SERVER = "/"
874 by Teddy Hogeborn
PEP8 compliance: mandos
289
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
290
    def string_array_to_txt_array(self, t):
291
        return dbus.Array((dbus.ByteArray(s.encode("utf-8"))
292
                           for s in t), signature="ay")
874 by Teddy Hogeborn
PEP8 compliance: mandos
293
    ENTRY_GROUP_ESTABLISHED = 2  # avahi-common/defs.h
294
    ENTRY_GROUP_COLLISION = 3    # avahi-common/defs.h
295
    ENTRY_GROUP_FAILURE = 4      # avahi-common/defs.h
296
    SERVER_INVALID = 0           # avahi-common/defs.h
297
    SERVER_REGISTERING = 1       # avahi-common/defs.h
298
    SERVER_RUNNING = 2           # avahi-common/defs.h
299
    SERVER_COLLISION = 3         # avahi-common/defs.h
300
    SERVER_FAILURE = 4           # avahi-common/defs.h
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
301
avahi = Avahi()
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
302
874 by Teddy Hogeborn
PEP8 compliance: mandos
303
28 by Teddy Hogeborn
* server.conf: New file.
304
class AvahiError(Exception):
242 by Teddy Hogeborn
* mandos (AvahiError): Converted to use unicode. All users changed.
305
    def __init__(self, value, *args, **kwargs):
28 by Teddy Hogeborn
* server.conf: New file.
306
        self.value = value
729 by Teddy Hogeborn
mandos: Stop using str() and remove unnecessary unicode() calls.
307
        return super(AvahiError, self).__init__(value, *args,
308
                                                **kwargs)
28 by Teddy Hogeborn
* server.conf: New file.
309
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
310
28 by Teddy Hogeborn
* server.conf: New file.
311
class AvahiServiceError(AvahiError):
312
    pass
313
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
314
28 by Teddy Hogeborn
* server.conf: New file.
315
class AvahiGroupError(AvahiError):
316
    pass
317
318
319
class AvahiService(object):
45 by Teddy Hogeborn
* server.py: Cosmetic changes.
320
    """An Avahi (Zeroconf) service.
874 by Teddy Hogeborn
PEP8 compliance: mandos
321
45 by Teddy Hogeborn
* server.py: Cosmetic changes.
322
    Attributes:
28 by Teddy Hogeborn
* server.conf: New file.
323
    interface: integer; avahi.IF_UNSPEC or an interface index.
324
               Used to optionally bind to the specified interface.
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
325
    name: string; Example: 'Mandos'
326
    type: string; Example: '_mandos._tcp'.
614 by Teddy Hogeborn
* mandos: Comment changes.
327
     See <https://www.iana.org/assignments/service-names-port-numbers>
45 by Teddy Hogeborn
* server.py: Cosmetic changes.
328
    port: integer; what port to announce
329
    TXT: list of strings; TXT record for the service
330
    domain: string; Domain to publish on, default to .local if empty.
331
    host: string; Host to publish records for, default is localhost
332
    max_renames: integer; maximum number of renames
333
    rename_count: integer; counter so we only rename after collisions
334
                  a sensible number of times
336 by Teddy Hogeborn
Code cleanup.
335
    group: D-Bus Entry Group
336
    server: D-Bus Server
338 by Teddy Hogeborn
* mandos: Minor doc string fixes.
337
    bus: dbus.SystemBus()
28 by Teddy Hogeborn
* server.conf: New file.
338
    """
874 by Teddy Hogeborn
PEP8 compliance: mandos
339
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
340
    def __init__(self,
874 by Teddy Hogeborn
PEP8 compliance: mandos
341
                 interface=avahi.IF_UNSPEC,
342
                 name=None,
343
                 servicetype=None,
344
                 port=None,
345
                 TXT=None,
346
                 domain="",
347
                 host="",
348
                 max_renames=32768,
349
                 protocol=avahi.PROTO_UNSPEC,
350
                 bus=None):
28 by Teddy Hogeborn
* server.conf: New file.
351
        self.interface = interface
352
        self.name = name
215 by Teddy Hogeborn
* mandos: Remove unused "select" module. Import "ctypes.util".
353
        self.type = servicetype
28 by Teddy Hogeborn
* server.conf: New file.
354
        self.port = port
237.1.2 by Teddy Hogeborn
Further steps towards a D-Bus server interface, plus minor syntax
355
        self.TXT = TXT if TXT is not None else []
28 by Teddy Hogeborn
* server.conf: New file.
356
        self.domain = domain
357
        self.host = host
358
        self.rename_count = 0
76 by Teddy Hogeborn
* plugins.d/password-request.c (init_gnutls_global): Renamed
359
        self.max_renames = max_renames
314 by Teddy Hogeborn
Support not using IPv6 in server:
360
        self.protocol = protocol
336 by Teddy Hogeborn
Code cleanup.
361
        self.group = None       # our entry group
362
        self.server = None
337 by Teddy Hogeborn
Code cleanup. Move some global stuff into main.
363
        self.bus = bus
482 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
364
        self.entry_group_state_changed_match = None
874 by Teddy Hogeborn
PEP8 compliance: mandos
365
738 by Teddy Hogeborn
Handle local Zeroconf service name collisions.
366
    def rename(self, remove=True):
28 by Teddy Hogeborn
* server.conf: New file.
367
        """Derived from the Avahi example code"""
368
        if self.rename_count >= self.max_renames:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
369
            logger.critical("No suitable Zeroconf service name found"
370
                            " after %i retries, exiting.",
215 by Teddy Hogeborn
* mandos: Remove unused "select" module. Import "ctypes.util".
371
                            self.rename_count)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
372
            raise AvahiServiceError("Too many renames")
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
373
        self.name = str(
374
            self.server.GetAlternativeServiceName(self.name))
738 by Teddy Hogeborn
Handle local Zeroconf service name collisions.
375
        self.rename_count += 1
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
376
        logger.info("Changing Zeroconf service name to %r ...",
24.1.155 by Björn Påhlsson
mandos server: Added debuglevel that adjust at what level information
377
                    self.name)
738 by Teddy Hogeborn
Handle local Zeroconf service name collisions.
378
        if remove:
379
            self.remove()
24.1.160 by Björn Påhlsson
fixed bug with local name collisions after a non-local name collision
380
        try:
381
            self.add()
482 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
382
        except dbus.exceptions.DBusException as error:
738 by Teddy Hogeborn
Handle local Zeroconf service name collisions.
383
            if (error.get_dbus_name()
384
                == "org.freedesktop.Avahi.CollisionError"):
385
                logger.info("Local Zeroconf service name collision.")
386
                return self.rename(remove=False)
387
            else:
388
                logger.critical("D-Bus Exception", exc_info=error)
389
                self.cleanup()
390
                os._exit(1)
874 by Teddy Hogeborn
PEP8 compliance: mandos
391
28 by Teddy Hogeborn
* server.conf: New file.
392
    def remove(self):
393
        """Derived from the Avahi example code"""
482 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
394
        if self.entry_group_state_changed_match is not None:
395
            self.entry_group_state_changed_match.remove()
396
            self.entry_group_state_changed_match = None
483 by Teddy Hogeborn
* mandos: Never call .Reset() on a defunct Avahi entry group.
397
        if self.group is not None:
398
            self.group.Reset()
874 by Teddy Hogeborn
PEP8 compliance: mandos
399
28 by Teddy Hogeborn
* server.conf: New file.
400
    def add(self):
401
        """Derived from the Avahi example code"""
482 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
402
        self.remove()
483 by Teddy Hogeborn
* mandos: Never call .Reset() on a defunct Avahi entry group.
403
        if self.group is None:
404
            self.group = dbus.Interface(
405
                self.bus.get_object(avahi.DBUS_NAME,
406
                                    self.server.EntryGroupNew()),
407
                avahi.DBUS_INTERFACE_ENTRY_GROUP)
482 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
408
        self.entry_group_state_changed_match = (
409
            self.group.connect_to_signal(
505.1.20 by Teddy Hogeborn
* Makefile (run-server): Remove obsolete warning.
410
                'StateChanged', self.entry_group_state_changed))
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
411
        logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
336 by Teddy Hogeborn
Code cleanup.
412
                     self.name, self.type)
413
        self.group.AddService(
414
            self.interface,
415
            self.protocol,
416
            dbus.UInt32(0),     # flags
417
            self.name, self.type,
418
            self.domain, self.host,
419
            dbus.UInt16(self.port),
420
            avahi.string_array_to_txt_array(self.TXT))
421
        self.group.Commit()
874 by Teddy Hogeborn
PEP8 compliance: mandos
422
336 by Teddy Hogeborn
Code cleanup.
423
    def entry_group_state_changed(self, state, error):
424
        """Derived from the Avahi example code"""
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
425
        logger.debug("Avahi entry group state change: %i", state)
874 by Teddy Hogeborn
PEP8 compliance: mandos
426
336 by Teddy Hogeborn
Code cleanup.
427
        if state == avahi.ENTRY_GROUP_ESTABLISHED:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
428
            logger.debug("Zeroconf service established.")
336 by Teddy Hogeborn
Code cleanup.
429
        elif state == avahi.ENTRY_GROUP_COLLISION:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
430
            logger.info("Zeroconf service name collision.")
336 by Teddy Hogeborn
Code cleanup.
431
            self.rename()
432
        elif state == avahi.ENTRY_GROUP_FAILURE:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
433
            logger.critical("Avahi: Error in group state changed %s",
730 by Teddy Hogeborn
mandos: Replace unicode() with str().
434
                            str(error))
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
435
            raise AvahiGroupError("State changed: {!s}".format(error))
874 by Teddy Hogeborn
PEP8 compliance: mandos
436
336 by Teddy Hogeborn
Code cleanup.
437
    def cleanup(self):
438
        """Derived from the Avahi example code"""
483 by Teddy Hogeborn
* mandos: Never call .Reset() on a defunct Avahi entry group.
439
        if self.group is not None:
440
            try:
441
                self.group.Free()
442
            except (dbus.exceptions.UnknownMethodException,
518.1.5 by Björn Påhlsson
First run of python-lint. Fixed some *obviously* bad code and turned
443
                    dbus.exceptions.DBusException):
483 by Teddy Hogeborn
* mandos: Never call .Reset() on a defunct Avahi entry group.
444
                pass
445
            self.group = None
482 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
446
        self.remove()
874 by Teddy Hogeborn
PEP8 compliance: mandos
447
482 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
448
    def server_state_changed(self, state, error=None):
336 by Teddy Hogeborn
Code cleanup.
449
        """Derived from the Avahi example code"""
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
450
        logger.debug("Avahi server state change: %i", state)
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
451
        bad_states = {
452
            avahi.SERVER_INVALID: "Zeroconf server invalid",
453
            avahi.SERVER_REGISTERING: None,
454
            avahi.SERVER_COLLISION: "Zeroconf server name collision",
455
            avahi.SERVER_FAILURE: "Zeroconf server failure",
456
        }
482 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
457
        if state in bad_states:
483 by Teddy Hogeborn
* mandos: Never call .Reset() on a defunct Avahi entry group.
458
            if bad_states[state] is not None:
459
                if error is None:
460
                    logger.error(bad_states[state])
461
                else:
462
                    logger.error(bad_states[state] + ": %r", error)
463
            self.cleanup()
336 by Teddy Hogeborn
Code cleanup.
464
        elif state == avahi.SERVER_RUNNING:
769 by Teddy Hogeborn
Handle local Zeroconf service name collisions on startup, too.
465
            try:
466
                self.add()
467
            except dbus.exceptions.DBusException as error:
468
                if (error.get_dbus_name()
469
                    == "org.freedesktop.Avahi.CollisionError"):
470
                    logger.info("Local Zeroconf service name"
471
                                " collision.")
472
                    return self.rename(remove=False)
473
                else:
474
                    logger.critical("D-Bus Exception", exc_info=error)
475
                    self.cleanup()
476
                    os._exit(1)
482 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
477
        else:
483 by Teddy Hogeborn
* mandos: Never call .Reset() on a defunct Avahi entry group.
478
            if error is None:
479
                logger.debug("Unknown state: %r", state)
480
            else:
481
                logger.debug("Unknown state: %r: %r", state, error)
874 by Teddy Hogeborn
PEP8 compliance: mandos
482
336 by Teddy Hogeborn
Code cleanup.
483
    def activate(self):
484
        """Derived from the Avahi example code"""
485
        if self.server is None:
486
            self.server = dbus.Interface(
337 by Teddy Hogeborn
Code cleanup. Move some global stuff into main.
487
                self.bus.get_object(avahi.DBUS_NAME,
482 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
488
                                    avahi.DBUS_PATH_SERVER,
489
                                    follow_name_owner_changes=True),
336 by Teddy Hogeborn
Code cleanup.
490
                avahi.DBUS_INTERFACE_SERVER)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
491
        self.server.connect_to_signal("StateChanged",
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
492
                                      self.server_state_changed)
336 by Teddy Hogeborn
Code cleanup.
493
        self.server_state_changed(self.server.GetState())
238 by Teddy Hogeborn
First version of a somewhat complete D-Bus server interface. Also
494
582 by Teddy Hogeborn
* mandos (IPv6_TCPServer.server_bind): Bug fix: handle non-existing
495
505.1.20 by Teddy Hogeborn
* Makefile (run-server): Remove obsolete warning.
496
class AvahiServiceToSyslog(AvahiService):
738 by Teddy Hogeborn
Handle local Zeroconf service name collisions.
497
    def rename(self, *args, **kwargs):
505.1.20 by Teddy Hogeborn
* Makefile (run-server): Remove obsolete warning.
498
        """Add the new name to the syslog messages"""
926 by Teddy Hogeborn
Server bug fix: Correct bad argument list
499
        ret = super(AvahiServiceToSyslog, self).rename(*args, **kwargs)
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
500
        syslogger.setFormatter(logging.Formatter(
501
            'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
502
            .format(self.name)))
505.1.20 by Teddy Hogeborn
* Makefile (run-server): Remove obsolete warning.
503
        return ret
238 by Teddy Hogeborn
First version of a somewhat complete D-Bus server interface. Also
504
874 by Teddy Hogeborn
PEP8 compliance: mandos
505
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
506
# Pretend that we have a GnuTLS module
507
class GnuTLS(object):
508
    """This isn't so much a class as it is a module-like namespace.
509
    It is instantiated once, and simulates having a GnuTLS module."""
874 by Teddy Hogeborn
PEP8 compliance: mandos
510
875 by Teddy Hogeborn
Fix bug where mandos server could not find GnuTLS library
511
    library = ctypes.util.find_library("gnutls")
512
    if library is None:
513
        library = ctypes.util.find_library("gnutls-deb0")
514
    _library = ctypes.cdll.LoadLibrary(library)
515
    del library
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
516
    _need_version = b"3.3.0"
962 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
517
    _tls_rawpk_version = b"3.6.6"
874 by Teddy Hogeborn
PEP8 compliance: mandos
518
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
519
    def __init__(self):
884 by Teddy Hogeborn
mandos: Use "self" instead of class name "GnuTLS" in __init__.
520
        # Need to use "self" here, since this method is called before
521
        # the assignment to the "gnutls" global variable happens.
522
        if self.check_version(self._need_version) is None:
523
            raise self.Error("Needs GnuTLS {} or later"
524
                             .format(self._need_version))
874 by Teddy Hogeborn
PEP8 compliance: mandos
525
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
526
    # Unless otherwise indicated, the constants and types below are
527
    # all from the gnutls/gnutls.h C header file.
874 by Teddy Hogeborn
PEP8 compliance: mandos
528
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
529
    # Constants
530
    E_SUCCESS = 0
802 by Teddy Hogeborn
Handle GnuTLS errors and partial sends in gnutls "module".
531
    E_INTERRUPTED = -52
532
    E_AGAIN = -28
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
533
    CRT_OPENPGP = 2
962 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
534
    CRT_RAWPK = 3
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
535
    CLIENT = 2
536
    SHUT_RDWR = 0
537
    CRD_CERTIFICATE = 1
538
    E_NO_CERTIFICATE_FOUND = -49
962 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
539
    X509_FMT_DER = 0
540
    NO_TICKETS = 1<<10
541
    ENABLE_RAWPK = 1<<18
542
    CTYPE_PEERS = 3
543
    KEYID_USE_SHA256 = 1        # gnutls/x509.h
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
544
    OPENPGP_FMT_RAW = 0         # gnutls/openpgp.h
874 by Teddy Hogeborn
PEP8 compliance: mandos
545
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
546
    # Types
547
    class session_int(ctypes.Structure):
548
        _fields_ = []
549
    session_t = ctypes.POINTER(session_int)
874 by Teddy Hogeborn
PEP8 compliance: mandos
550
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
551
    class certificate_credentials_st(ctypes.Structure):
552
        _fields_ = []
553
    certificate_credentials_t = ctypes.POINTER(
554
        certificate_credentials_st)
555
    certificate_type_t = ctypes.c_int
874 by Teddy Hogeborn
PEP8 compliance: mandos
556
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
557
    class datum_t(ctypes.Structure):
558
        _fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
559
                    ('size', ctypes.c_uint)]
874 by Teddy Hogeborn
PEP8 compliance: mandos
560
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
561
    class openpgp_crt_int(ctypes.Structure):
562
        _fields_ = []
563
    openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
874 by Teddy Hogeborn
PEP8 compliance: mandos
564
    openpgp_crt_fmt_t = ctypes.c_int  # gnutls/openpgp.h
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
565
    log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
824 by Teddy Hogeborn
Remove empty comment
566
    credentials_type_t = ctypes.c_int
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
567
    transport_ptr_t = ctypes.c_void_p
568
    close_request_t = ctypes.c_int
874 by Teddy Hogeborn
PEP8 compliance: mandos
569
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
570
    # Exceptions
571
    class Error(Exception):
572
        # We need to use the class name "GnuTLS" here, since this
573
        # exception might be raised from within GnuTLS.__init__,
574
        # which is called before the assignment to the "gnutls"
802 by Teddy Hogeborn
Handle GnuTLS errors and partial sends in gnutls "module".
575
        # global variable has happened.
874 by Teddy Hogeborn
PEP8 compliance: mandos
576
        def __init__(self, message=None, code=None, args=()):
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
577
            # Default usage is by a message string, but if a return
578
            # code is passed, convert it to a string with
579
            # gnutls.strerror()
802 by Teddy Hogeborn
Handle GnuTLS errors and partial sends in gnutls "module".
580
            self.code = code
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
581
            if message is None and code is not None:
582
                message = GnuTLS.strerror(code)
583
            return super(GnuTLS.Error, self).__init__(
584
                message, *args)
874 by Teddy Hogeborn
PEP8 compliance: mandos
585
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
586
    class CertificateSecurityError(Error):
587
        pass
874 by Teddy Hogeborn
PEP8 compliance: mandos
588
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
589
    # Classes
590
    class Credentials(object):
591
        def __init__(self):
592
            self._c_object = gnutls.certificate_credentials_t()
593
            gnutls.certificate_allocate_credentials(
594
                ctypes.byref(self._c_object))
595
            self.type = gnutls.CRD_CERTIFICATE
874 by Teddy Hogeborn
PEP8 compliance: mandos
596
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
597
        def __del__(self):
598
            gnutls.certificate_free_credentials(self._c_object)
874 by Teddy Hogeborn
PEP8 compliance: mandos
599
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
600
    class ClientSession(object):
874 by Teddy Hogeborn
PEP8 compliance: mandos
601
        def __init__(self, socket, credentials=None):
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
602
            self._c_object = gnutls.session_t()
962 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
603
            gnutls_flags = gnutls.CLIENT
604
            if gnutls.check_version("3.5.6"):
605
                gnutls_flags |= gnutls.NO_TICKETS
606
            if gnutls.has_rawpk:
607
                gnutls_flags |= gnutls.ENABLE_RAWPK
608
            gnutls.init(ctypes.byref(self._c_object), gnutls_flags)
609
            del gnutls_flags
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
610
            gnutls.set_default_priority(self._c_object)
611
            gnutls.transport_set_ptr(self._c_object, socket.fileno())
612
            gnutls.handshake_set_private_extensions(self._c_object,
613
                                                    True)
614
            self.socket = socket
615
            if credentials is None:
616
                credentials = gnutls.Credentials()
617
            gnutls.credentials_set(self._c_object, credentials.type,
618
                                   ctypes.cast(credentials._c_object,
619
                                               ctypes.c_void_p))
620
            self.credentials = credentials
874 by Teddy Hogeborn
PEP8 compliance: mandos
621
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
622
        def __del__(self):
623
            gnutls.deinit(self._c_object)
874 by Teddy Hogeborn
PEP8 compliance: mandos
624
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
625
        def handshake(self):
626
            return gnutls.handshake(self._c_object)
874 by Teddy Hogeborn
PEP8 compliance: mandos
627
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
628
        def send(self, data):
629
            data = bytes(data)
802 by Teddy Hogeborn
Handle GnuTLS errors and partial sends in gnutls "module".
630
            data_len = len(data)
631
            while data_len > 0:
632
                data_len -= gnutls.record_send(self._c_object,
633
                                               data[-data_len:],
634
                                               data_len)
874 by Teddy Hogeborn
PEP8 compliance: mandos
635
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
636
        def bye(self):
637
            return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
874 by Teddy Hogeborn
PEP8 compliance: mandos
638
802 by Teddy Hogeborn
Handle GnuTLS errors and partial sends in gnutls "module".
639
    # Error handling functions
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
640
    def _error_code(result):
641
        """A function to raise exceptions on errors, suitable
642
        for the 'restype' attribute on ctypes functions"""
643
        if result >= 0:
644
            return result
645
        if result == gnutls.E_NO_CERTIFICATE_FOUND:
874 by Teddy Hogeborn
PEP8 compliance: mandos
646
            raise gnutls.CertificateSecurityError(code=result)
647
        raise gnutls.Error(code=result)
648
802 by Teddy Hogeborn
Handle GnuTLS errors and partial sends in gnutls "module".
649
    def _retry_on_error(result, func, arguments):
650
        """A function to retry on some errors, suitable
651
        for the 'errcheck' attribute on ctypes functions"""
652
        while result < 0:
653
            if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
654
                return _error_code(result)
655
            result = func(*arguments)
656
        return result
874 by Teddy Hogeborn
PEP8 compliance: mandos
657
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
658
    # Unless otherwise indicated, the function declarations below are
659
    # all from the gnutls/gnutls.h C header file.
874 by Teddy Hogeborn
PEP8 compliance: mandos
660
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
661
    # Functions
662
    priority_set_direct = _library.gnutls_priority_set_direct
663
    priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
664
                                    ctypes.POINTER(ctypes.c_char_p)]
665
    priority_set_direct.restype = _error_code
874 by Teddy Hogeborn
PEP8 compliance: mandos
666
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
667
    init = _library.gnutls_init
668
    init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
669
    init.restype = _error_code
874 by Teddy Hogeborn
PEP8 compliance: mandos
670
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
671
    set_default_priority = _library.gnutls_set_default_priority
672
    set_default_priority.argtypes = [session_t]
673
    set_default_priority.restype = _error_code
874 by Teddy Hogeborn
PEP8 compliance: mandos
674
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
675
    record_send = _library.gnutls_record_send
676
    record_send.argtypes = [session_t, ctypes.c_void_p,
677
                            ctypes.c_size_t]
678
    record_send.restype = ctypes.c_ssize_t
802 by Teddy Hogeborn
Handle GnuTLS errors and partial sends in gnutls "module".
679
    record_send.errcheck = _retry_on_error
874 by Teddy Hogeborn
PEP8 compliance: mandos
680
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
681
    certificate_allocate_credentials = (
682
        _library.gnutls_certificate_allocate_credentials)
683
    certificate_allocate_credentials.argtypes = [
684
        ctypes.POINTER(certificate_credentials_t)]
685
    certificate_allocate_credentials.restype = _error_code
874 by Teddy Hogeborn
PEP8 compliance: mandos
686
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
687
    certificate_free_credentials = (
688
        _library.gnutls_certificate_free_credentials)
874 by Teddy Hogeborn
PEP8 compliance: mandos
689
    certificate_free_credentials.argtypes = [
690
        certificate_credentials_t]
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
691
    certificate_free_credentials.restype = None
874 by Teddy Hogeborn
PEP8 compliance: mandos
692
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
693
    handshake_set_private_extensions = (
694
        _library.gnutls_handshake_set_private_extensions)
695
    handshake_set_private_extensions.argtypes = [session_t,
696
                                                 ctypes.c_int]
697
    handshake_set_private_extensions.restype = None
874 by Teddy Hogeborn
PEP8 compliance: mandos
698
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
699
    credentials_set = _library.gnutls_credentials_set
700
    credentials_set.argtypes = [session_t, credentials_type_t,
701
                                ctypes.c_void_p]
702
    credentials_set.restype = _error_code
874 by Teddy Hogeborn
PEP8 compliance: mandos
703
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
704
    strerror = _library.gnutls_strerror
705
    strerror.argtypes = [ctypes.c_int]
706
    strerror.restype = ctypes.c_char_p
874 by Teddy Hogeborn
PEP8 compliance: mandos
707
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
708
    certificate_type_get = _library.gnutls_certificate_type_get
709
    certificate_type_get.argtypes = [session_t]
710
    certificate_type_get.restype = _error_code
874 by Teddy Hogeborn
PEP8 compliance: mandos
711
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
712
    certificate_get_peers = _library.gnutls_certificate_get_peers
713
    certificate_get_peers.argtypes = [session_t,
714
                                      ctypes.POINTER(ctypes.c_uint)]
715
    certificate_get_peers.restype = ctypes.POINTER(datum_t)
874 by Teddy Hogeborn
PEP8 compliance: mandos
716
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
717
    global_set_log_level = _library.gnutls_global_set_log_level
718
    global_set_log_level.argtypes = [ctypes.c_int]
719
    global_set_log_level.restype = None
874 by Teddy Hogeborn
PEP8 compliance: mandos
720
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
721
    global_set_log_function = _library.gnutls_global_set_log_function
722
    global_set_log_function.argtypes = [log_func]
723
    global_set_log_function.restype = None
874 by Teddy Hogeborn
PEP8 compliance: mandos
724
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
725
    deinit = _library.gnutls_deinit
726
    deinit.argtypes = [session_t]
727
    deinit.restype = None
874 by Teddy Hogeborn
PEP8 compliance: mandos
728
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
729
    handshake = _library.gnutls_handshake
730
    handshake.argtypes = [session_t]
731
    handshake.restype = _error_code
802 by Teddy Hogeborn
Handle GnuTLS errors and partial sends in gnutls "module".
732
    handshake.errcheck = _retry_on_error
874 by Teddy Hogeborn
PEP8 compliance: mandos
733
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
734
    transport_set_ptr = _library.gnutls_transport_set_ptr
735
    transport_set_ptr.argtypes = [session_t, transport_ptr_t]
736
    transport_set_ptr.restype = None
874 by Teddy Hogeborn
PEP8 compliance: mandos
737
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
738
    bye = _library.gnutls_bye
739
    bye.argtypes = [session_t, close_request_t]
740
    bye.restype = _error_code
802 by Teddy Hogeborn
Handle GnuTLS errors and partial sends in gnutls "module".
741
    bye.errcheck = _retry_on_error
874 by Teddy Hogeborn
PEP8 compliance: mandos
742
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
743
    check_version = _library.gnutls_check_version
744
    check_version.argtypes = [ctypes.c_char_p]
745
    check_version.restype = ctypes.c_char_p
874 by Teddy Hogeborn
PEP8 compliance: mandos
746
962 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
747
    has_rawpk = bool(check_version(_tls_rawpk_version))
748
749
    if has_rawpk:
750
        # Types
751
        class pubkey_st(ctypes.Structure):
752
            _fields = []
753
        pubkey_t = ctypes.POINTER(pubkey_st)
754
755
        x509_crt_fmt_t = ctypes.c_int
756
757
        # All the function declarations below are from gnutls/abstract.h
758
        pubkey_init = _library.gnutls_pubkey_init
759
        pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]
760
        pubkey_init.restype = _error_code
761
762
        pubkey_import = _library.gnutls_pubkey_import
763
        pubkey_import.argtypes = [pubkey_t, ctypes.POINTER(datum_t),
764
                                  x509_crt_fmt_t]
765
        pubkey_import.restype = _error_code
766
767
        pubkey_get_key_id = _library.gnutls_pubkey_get_key_id
768
        pubkey_get_key_id.argtypes = [pubkey_t, ctypes.c_int,
769
                                      ctypes.POINTER(ctypes.c_ubyte),
770
                                      ctypes.POINTER(ctypes.c_size_t)]
771
        pubkey_get_key_id.restype = _error_code
772
773
        pubkey_deinit = _library.gnutls_pubkey_deinit
774
        pubkey_deinit.argtypes = [pubkey_t]
775
        pubkey_deinit.restype = None
776
    else:
777
        # All the function declarations below are from gnutls/openpgp.h
778
779
        openpgp_crt_init = _library.gnutls_openpgp_crt_init
780
        openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
781
        openpgp_crt_init.restype = _error_code
782
783
        openpgp_crt_import = _library.gnutls_openpgp_crt_import
784
        openpgp_crt_import.argtypes = [openpgp_crt_t,
785
                                       ctypes.POINTER(datum_t),
786
                                       openpgp_crt_fmt_t]
787
        openpgp_crt_import.restype = _error_code
788
789
        openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
790
        openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
791
                                            ctypes.POINTER(ctypes.c_uint)]
792
        openpgp_crt_verify_self.restype = _error_code
793
794
        openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
795
        openpgp_crt_deinit.argtypes = [openpgp_crt_t]
796
        openpgp_crt_deinit.restype = None
797
798
        openpgp_crt_get_fingerprint = (
799
            _library.gnutls_openpgp_crt_get_fingerprint)
800
        openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
801
                                                ctypes.c_void_p,
802
                                                ctypes.POINTER(
803
                                                    ctypes.c_size_t)]
804
        openpgp_crt_get_fingerprint.restype = _error_code
805
806
    if check_version("3.6.4"):
807
        certificate_type_get2 = _library.gnutls_certificate_type_get2
808
        certificate_type_get2.argtypes = [session_t, ctypes.c_int]
809
        certificate_type_get2.restype = _error_code
874 by Teddy Hogeborn
PEP8 compliance: mandos
810
802 by Teddy Hogeborn
Handle GnuTLS errors and partial sends in gnutls "module".
811
    # Remove non-public functions
812
    del _error_code, _retry_on_error
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
813
# Create the global "gnutls" object, simulating a module
814
gnutls = GnuTLS()
815
874 by Teddy Hogeborn
PEP8 compliance: mandos
816
749.1.2 by Teddy Hogeborn
mandos (subprocess_call_pipe): Rename to "call_pipe" and take "func".
817
def call_pipe(connection,       # : multiprocessing.Connection
818
              func, *args, **kwargs):
749.1.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
819
    """This function is meant to be called by multiprocessing.Process
874 by Teddy Hogeborn
PEP8 compliance: mandos
820
749.1.2 by Teddy Hogeborn
mandos (subprocess_call_pipe): Rename to "call_pipe" and take "func".
821
    This function runs func(*args, **kwargs), and writes the resulting
822
    return value on the provided multiprocessing.Connection.
749.1.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
823
    """
749.1.2 by Teddy Hogeborn
mandos (subprocess_call_pipe): Rename to "call_pipe" and take "func".
824
    connection.send(func(*args, **kwargs))
749.1.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
825
    connection.close()
582 by Teddy Hogeborn
* mandos (IPv6_TCPServer.server_bind): Bug fix: handle non-existing
826
874 by Teddy Hogeborn
PEP8 compliance: mandos
827
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
828
class Client(object):
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
829
    """A representation of a client host served by this server.
874 by Teddy Hogeborn
PEP8 compliance: mandos
830
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
831
    Attributes:
518.2.4 by Teddy Hogeborn
* mandos (_timedelta_to_milliseconds): Renamed to
832
    approved:   bool(); 'None' if not yet approved/disapproved
438 by Teddy Hogeborn
* mandos (Client.runtime_expansions): New attribute containing the
833
    approval_delay: datetime.timedelta(); Time to wait for approval
834
    approval_duration: datetime.timedelta(); Duration of one approval
238 by Teddy Hogeborn
First version of a somewhat complete D-Bus server interface. Also
835
    checker:    subprocess.Popen(); a running checker process used
836
                                    to see if the client lives.
837
                                    'None' if no process is running.
830 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
838
    checker_callback_tag: a GLib event source tag, or None
438 by Teddy Hogeborn
* mandos (Client.runtime_expansions): New attribute containing the
839
    checker_command: string; External command which is run to check
840
                     if client lives.  %() expansions are done at
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
841
                     runtime with vars(self) as dict, so that for
842
                     instance %(name)s can be used in the command.
830 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
843
    checker_initiator_tag: a GLib event source tag, or None
438 by Teddy Hogeborn
* mandos (Client.runtime_expansions): New attribute containing the
844
    created:    datetime.datetime(); (UTC) object creation
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
845
    client_structure: Object describing what attributes a client has
846
                      and is used for storing the client at exit
315 by Teddy Hogeborn
* mandos (Client.current_checker_command): New attribute.
847
    current_checker_command: string; current running checker_command
830 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
848
    disable_initiator_tag: a GLib event source tag, or None
438 by Teddy Hogeborn
* mandos (Client.runtime_expansions): New attribute containing the
849
    enabled:    bool()
850
    fingerprint: string (40 or 32 hexadecimal digits); used to
962 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
851
                 uniquely identify an OpenPGP client
852
    key_id: string (64 hexadecimal digits); used to uniquely identify
853
            a client using raw public keys
438 by Teddy Hogeborn
* mandos (Client.runtime_expansions): New attribute containing the
854
    host:       string; available for use by the checker command
855
    interval:   datetime.timedelta(); How often to start a new checker
442 by Teddy Hogeborn
* DBUS-API: Document new "LastApprovalRequest" client property.
856
    last_approval_request: datetime.datetime(); (UTC) or None
438 by Teddy Hogeborn
* mandos (Client.runtime_expansions): New attribute containing the
857
    last_checked_ok: datetime.datetime(); (UTC) or None
521 by teddy at bsnet
* debian/control (mandos/Depends): Added "python-crypto".
858
    last_checker_status: integer between 0 and 255 reflecting exit
518.1.7 by Teddy Hogeborn
* mandos: Break long lines and fix some more white space.
859
                         status of last checker. -1 reflects crashed
556 by Teddy Hogeborn
* DBUS-API (se.recompile.Mandos.Client.LastCheckerStatus): New
860
                         checker, -2 means no checker completed yet.
749.1.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
861
    last_checker_signal: The signal which killed the last checker, if
862
                         last_checker_status is -1
518.2.3 by Teddy Hogeborn
Make "enabled" a client config option.
863
    last_enabled: datetime.datetime(); (UTC) or None
438 by Teddy Hogeborn
* mandos (Client.runtime_expansions): New attribute containing the
864
    name:       string; from the config file, used in log messages and
865
                        D-Bus identifiers
866
    secret:     bytestring; sent verbatim (over TLS) to client
867
    timeout:    datetime.timedelta(); How long from last_checked_ok
868
                                      until this client is disabled
552 by teddy at recompile
* mandos: Consistent terminology; use the term "secret" for the
869
    extended_timeout:   extra long timeout when secret has been sent
438 by Teddy Hogeborn
* mandos (Client.runtime_expansions): New attribute containing the
870
    runtime_expansions: Allowed attributes for runtime expansion.
497 by Teddy Hogeborn
* DBUS-API: Document new "Expires" and "ExtendedTimeout" properties.
871
    expires:    datetime.datetime(); time (UTC) when a client will be
24.1.179 by Björn Påhlsson
New feature:
872
                disabled, or None
617 by Teddy Hogeborn
* mandos: Bug fix: Don't print output from checkers when running in
873
    server_settings: The server_settings dict from main()
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
874
    """
874 by Teddy Hogeborn
PEP8 compliance: mandos
875
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
876
    runtime_expansions = ("approval_delay", "approval_duration",
962 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
877
                          "created", "enabled", "expires", "key_id",
584 by Teddy Hogeborn
* mandos (Client.runtime_expansions): Add "expires" and (bug fix)
878
                          "fingerprint", "host", "interval",
879
                          "last_approval_request", "last_checked_ok",
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
880
                          "last_enabled", "name", "timeout")
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
881
    client_defaults = {
882
        "timeout": "PT5M",
883
        "extended_timeout": "PT15M",
884
        "interval": "PT2M",
885
        "checker": "fping -q -- %%(host)s",
886
        "host": "",
887
        "approval_delay": "PT0S",
888
        "approval_duration": "PT1S",
889
        "approved_by_default": "True",
890
        "enabled": "True",
891
    }
874 by Teddy Hogeborn
PEP8 compliance: mandos
892
518.1.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
893
    @staticmethod
894
    def config_parser(config):
542 by Björn Påhlsson
fixed bug with bad stored config state for expires and last_checked_ok.
895
        """Construct a new dict of client settings of this form:
518.1.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
896
        { client_name: {setting_name: value, ...}, ...}
542 by Björn Påhlsson
fixed bug with bad stored config state for expires and last_checked_ok.
897
        with exceptions for any special settings as defined above.
898
        NOTE: Must be a pure function. Must return the same result
899
        value given the same arguments.
900
        """
518.1.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
901
        settings = {}
902
        for client_name in config.sections():
903
            section = dict(config.items(client_name))
904
            client = settings[client_name] = {}
874 by Teddy Hogeborn
PEP8 compliance: mandos
905
518.1.15 by Björn Påhlsson
more refactoring in regards to how clients get created
906
            client["host"] = section["host"]
518.1.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
907
            # Reformat values from string types to Python types
908
            client["approved_by_default"] = config.getboolean(
909
                client_name, "approved_by_default")
543 by Teddy Hogeborn
* mandos: Break some long lines.
910
            client["enabled"] = config.getboolean(client_name,
911
                                                  "enabled")
874 by Teddy Hogeborn
PEP8 compliance: mandos
912
962 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
913
            # Uppercase and remove spaces from key_id and fingerprint
914
            # for later comparison purposes with return value from the
915
            # key_id() and fingerprint() functions
916
            client["key_id"] = (section.get("key_id", "").upper()
917
                                .replace(" ", ""))
518.1.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
918
            client["fingerprint"] = (section["fingerprint"].upper()
919
                                     .replace(" ", ""))
920
            if "secret" in section:
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
921
                client["secret"] = codecs.decode(section["secret"]
922
                                                 .encode("utf-8"),
923
                                                 "base64")
518.1.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
924
            elif "secfile" in section:
925
                with open(os.path.expanduser(os.path.expandvars
926
                                             (section["secfile"])),
927
                          "rb") as secfile:
928
                    client["secret"] = secfile.read()
929
            else:
723.1.5 by Teddy Hogeborn
Use the new auto-numbered "{}" syntax for the .format() string method.
930
                raise TypeError("No secret or secfile for section {}"
568 by Teddy Hogeborn
* mandos-monitor: Use new string format method.
931
                                .format(section))
518.1.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
932
            client["timeout"] = string_to_delta(section["timeout"])
933
            client["extended_timeout"] = string_to_delta(
934
                section["extended_timeout"])
935
            client["interval"] = string_to_delta(section["interval"])
936
            client["approval_delay"] = string_to_delta(
937
                section["approval_delay"])
938
            client["approval_duration"] = string_to_delta(
939
                section["approval_duration"])
518.1.15 by Björn Påhlsson
more refactoring in regards to how clients get created
940
            client["checker_command"] = section["checker"]
941
            client["last_approval_request"] = None
942
            client["last_checked_ok"] = None
556 by Teddy Hogeborn
* DBUS-API (se.recompile.Mandos.Client.LastCheckerStatus): New
943
            client["last_checker_status"] = -2
874 by Teddy Hogeborn
PEP8 compliance: mandos
944
518.1.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
945
        return settings
874 by Teddy Hogeborn
PEP8 compliance: mandos
946
947
    def __init__(self, settings, name=None, server_settings=None):
243 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
948
        self.name = name
617 by Teddy Hogeborn
* mandos: Bug fix: Don't print output from checkers when running in
949
        if server_settings is None:
950
            server_settings = {}
951
        self.server_settings = server_settings
518.1.15 by Björn Påhlsson
more refactoring in regards to how clients get created
952
        # adding all client settings
723.1.4 by Teddy Hogeborn
Use the .items() method instead of .iteritems().
953
        for setting, value in settings.items():
518.1.15 by Björn Påhlsson
more refactoring in regards to how clients get created
954
            setattr(self, setting, value)
874 by Teddy Hogeborn
PEP8 compliance: mandos
955
542 by Björn Påhlsson
fixed bug with bad stored config state for expires and last_checked_ok.
956
        if self.enabled:
957
            if not hasattr(self, "last_enabled"):
958
                self.last_enabled = datetime.datetime.utcnow()
959
            if not hasattr(self, "expires"):
960
                self.expires = (datetime.datetime.utcnow()
961
                                + self.timeout)
962
        else:
963
            self.last_enabled = None
964
            self.expires = None
874 by Teddy Hogeborn
PEP8 compliance: mandos
965
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
966
        logger.debug("Creating client %r", self.name)
962 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
967
        logger.debug("  Key ID: %s", self.key_id)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
968
        logger.debug("  Fingerprint: %s", self.fingerprint)
543 by Teddy Hogeborn
* mandos: Break some long lines.
969
        self.created = settings.get("created",
970
                                    datetime.datetime.utcnow())
874 by Teddy Hogeborn
PEP8 compliance: mandos
971
518.1.15 by Björn Påhlsson
more refactoring in regards to how clients get created
972
        # attributes specific for this server instance
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
973
        self.checker = None
974
        self.checker_initiator_tag = None
239 by Teddy Hogeborn
* mandos (_datetime_to_dbus_struct): Renamed to "_datetime_to_dbus";
975
        self.disable_initiator_tag = None
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
976
        self.checker_callback_tag = None
315 by Teddy Hogeborn
* mandos (Client.current_checker_command): New attribute.
977
        self.current_checker_command = None
518.2.4 by Teddy Hogeborn
* mandos (_timedelta_to_milliseconds): Renamed to
978
        self.approved = None
24.1.150 by Björn Påhlsson
* mandos: Added ClientDBus.approve_pending property. Exposed
979
        self.approvals_pending = 0
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
980
        self.changedstate = multiprocessing_manager.Condition(
981
            multiprocessing_manager.Lock())
982
        self.client_structure = [attr
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
983
                                 for attr in self.__dict__.keys()
521 by teddy at bsnet
* debian/control (mandos/Depends): Added "python-crypto".
984
                                 if not attr.startswith("_")]
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
985
        self.client_structure.append("client_structure")
874 by Teddy Hogeborn
PEP8 compliance: mandos
986
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
987
        for name, t in inspect.getmembers(
988
                type(self), lambda obj: isinstance(obj, property)):
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
989
            if not name.startswith("_"):
990
                self.client_structure.append(name)
874 by Teddy Hogeborn
PEP8 compliance: mandos
991
520 by Björn Påhlsson
merge persistent state
992
    # Send notice to process children that client state has changed
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
993
    def send_changedstate(self):
520 by Björn Påhlsson
merge persistent state
994
        with self.changedstate:
995
            self.changedstate.notify_all()
874 by Teddy Hogeborn
PEP8 compliance: mandos
996
239 by Teddy Hogeborn
* mandos (_datetime_to_dbus_struct): Renamed to "_datetime_to_dbus";
997
    def enable(self):
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
998
        """Start this client's checker and timeout hooks"""
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
999
        if getattr(self, "enabled", False):
341 by Teddy Hogeborn
Code cleanup and one bug fix.
1000
            # Already enabled
1001
            return
24.1.179 by Björn Påhlsson
New feature:
1002
        self.expires = datetime.datetime.utcnow() + self.timeout
239 by Teddy Hogeborn
* mandos (_datetime_to_dbus_struct): Renamed to "_datetime_to_dbus";
1003
        self.enabled = True
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1004
        self.last_enabled = datetime.datetime.utcnow()
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
1005
        self.init_checker()
581 by Teddy Hogeborn
* mandos (Client.enable, Client.disable, ClientDBus.approve): Call
1006
        self.send_changedstate()
874 by Teddy Hogeborn
PEP8 compliance: mandos
1007
402 by Teddy Hogeborn
* mandos (Client.disable): Rename keyword argument "log" to "quiet",
1008
    def disable(self, quiet=True):
239 by Teddy Hogeborn
* mandos (_datetime_to_dbus_struct): Renamed to "_datetime_to_dbus";
1009
        """Disable this client."""
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1010
        if not getattr(self, "enabled", False):
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
1011
            return False
402 by Teddy Hogeborn
* mandos (Client.disable): Rename keyword argument "log" to "quiet",
1012
        if not quiet:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1013
            logger.info("Disabling client %s", self.name)
581 by Teddy Hogeborn
* mandos (Client.enable, Client.disable, ClientDBus.approve): Call
1014
        if getattr(self, "disable_initiator_tag", None) is not None:
830 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
1015
            GLib.source_remove(self.disable_initiator_tag)
239 by Teddy Hogeborn
* mandos (_datetime_to_dbus_struct): Renamed to "_datetime_to_dbus";
1016
            self.disable_initiator_tag = None
24.1.179 by Björn Påhlsson
New feature:
1017
        self.expires = None
581 by Teddy Hogeborn
* mandos (Client.enable, Client.disable, ClientDBus.approve): Call
1018
        if getattr(self, "checker_initiator_tag", None) is not None:
830 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
1019
            GLib.source_remove(self.checker_initiator_tag)
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
1020
            self.checker_initiator_tag = None
1021
        self.stop_checker()
239 by Teddy Hogeborn
* mandos (_datetime_to_dbus_struct): Renamed to "_datetime_to_dbus";
1022
        self.enabled = False
581 by Teddy Hogeborn
* mandos (Client.enable, Client.disable, ClientDBus.approve): Call
1023
        if not quiet:
1024
            self.send_changedstate()
830 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
1025
        # Do not run this again if called by a GLib.timeout_add
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
1026
        return False
874 by Teddy Hogeborn
PEP8 compliance: mandos
1027
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
1028
    def __del__(self):
239 by Teddy Hogeborn
* mandos (_datetime_to_dbus_struct): Renamed to "_datetime_to_dbus";
1029
        self.disable()
874 by Teddy Hogeborn
PEP8 compliance: mandos
1030
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
1031
    def init_checker(self):
1032
        # Schedule a new checker to be started an 'interval' from now,
1033
        # and every interval from then on.
581 by Teddy Hogeborn
* mandos (Client.enable, Client.disable, ClientDBus.approve): Call
1034
        if self.checker_initiator_tag is not None:
830 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
1035
            GLib.source_remove(self.checker_initiator_tag)
1036
        self.checker_initiator_tag = GLib.timeout_add(
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1037
            int(self.interval.total_seconds() * 1000),
1038
            self.start_checker)
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
1039
        # Schedule a disable() when 'timeout' has passed
581 by Teddy Hogeborn
* mandos (Client.enable, Client.disable, ClientDBus.approve): Call
1040
        if self.disable_initiator_tag is not None:
830 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
1041
            GLib.source_remove(self.disable_initiator_tag)
1042
        self.disable_initiator_tag = GLib.timeout_add(
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1043
            int(self.timeout.total_seconds() * 1000), self.disable)
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
1044
        # Also start a new checker *right now*.
1045
        self.start_checker()
874 by Teddy Hogeborn
PEP8 compliance: mandos
1046
756 by Teddy Hogeborn
Merge change to use multiprocessing module to run checkers.
1047
    def checker_callback(self, source, condition, connection,
1048
                         command):
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
1049
        """The checker has completed, so take appropriate actions."""
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
1050
        self.checker_callback_tag = None
1051
        self.checker = None
749.1.2 by Teddy Hogeborn
mandos (subprocess_call_pipe): Rename to "call_pipe" and take "func".
1052
        # Read return code from connection (see call_pipe)
749.1.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
1053
        returncode = connection.recv()
1054
        connection.close()
874 by Teddy Hogeborn
PEP8 compliance: mandos
1055
749.1.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
1056
        if returncode >= 0:
1057
            self.last_checker_status = returncode
1058
            self.last_checker_signal = None
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
1059
            if self.last_checker_status == 0:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1060
                logger.info("Checker for %(name)s succeeded",
280 by Teddy Hogeborn
* mandos (Client.CheckerCompleted): Changed signature to "nxs"; return
1061
                            vars(self))
281 by Teddy Hogeborn
* mandos (Client.bump_timeout): Renamed to "checked_ok". All callers
1062
                self.checked_ok()
280 by Teddy Hogeborn
* mandos (Client.CheckerCompleted): Changed signature to "nxs"; return
1063
            else:
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1064
                logger.info("Checker for %(name)s failed", vars(self))
280 by Teddy Hogeborn
* mandos (Client.CheckerCompleted): Changed signature to "nxs"; return
1065
        else:
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
1066
            self.last_checker_status = -1
749.1.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
1067
            self.last_checker_signal = -returncode
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1068
            logger.warning("Checker for %(name)s crashed?",
13 by Björn Påhlsson
Added following support:
1069
                           vars(self))
749.1.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
1070
        return False
874 by Teddy Hogeborn
PEP8 compliance: mandos
1071
556 by Teddy Hogeborn
* DBUS-API (se.recompile.Mandos.Client.LastCheckerStatus): New
1072
    def checked_ok(self):
1073
        """Assert that the client has been seen, alive and well."""
1074
        self.last_checked_ok = datetime.datetime.utcnow()
1075
        self.last_checker_status = 0
749.1.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
1076
        self.last_checker_signal = None
556 by Teddy Hogeborn
* DBUS-API (se.recompile.Mandos.Client.LastCheckerStatus): New
1077
        self.bump_timeout()
874 by Teddy Hogeborn
PEP8 compliance: mandos
1078
556 by Teddy Hogeborn
* DBUS-API (se.recompile.Mandos.Client.LastCheckerStatus): New
1079
    def bump_timeout(self, timeout=None):
1080
        """Bump up the timeout for this client."""
24.1.179 by Björn Påhlsson
New feature:
1081
        if timeout is None:
1082
            timeout = self.timeout
505.1.17 by Teddy Hogeborn
* mandos (Client.checked_ok): Bug fix: Handle disabled client.
1083
        if self.disable_initiator_tag is not None:
830 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
1084
            GLib.source_remove(self.disable_initiator_tag)
581 by Teddy Hogeborn
* mandos (Client.enable, Client.disable, ClientDBus.approve): Call
1085
            self.disable_initiator_tag = None
505.1.17 by Teddy Hogeborn
* mandos (Client.checked_ok): Bug fix: Handle disabled client.
1086
        if getattr(self, "enabled", False):
830 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
1087
            self.disable_initiator_tag = GLib.timeout_add(
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1088
                int(timeout.total_seconds() * 1000), self.disable)
505.1.17 by Teddy Hogeborn
* mandos (Client.checked_ok): Bug fix: Handle disabled client.
1089
            self.expires = datetime.datetime.utcnow() + timeout
874 by Teddy Hogeborn
PEP8 compliance: mandos
1090
442 by Teddy Hogeborn
* DBUS-API: Document new "LastApprovalRequest" client property.
1091
    def need_approval(self):
1092
        self.last_approval_request = datetime.datetime.utcnow()
874 by Teddy Hogeborn
PEP8 compliance: mandos
1093
9 by Teddy Hogeborn
* client.cpp (main): Get t_old early since it is used on error exits.
1094
    def start_checker(self):
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
1095
        """Start a new checker subprocess if one is not running.
874 by Teddy Hogeborn
PEP8 compliance: mandos
1096
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
1097
        If a checker already exists, leave it running and do
1098
        nothing."""
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
1099
        # The reason for not killing a running checker is that if we
577 by Teddy Hogeborn
* mandos (Client.start_checker): Reworded comment.
1100
        # did that, and if a checker (for some reason) started running
1101
        # slowly and taking more than 'interval' time, then the client
1102
        # would inevitably timeout, since no checker would get a
1103
        # chance to run to completion.  If we instead leave running
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
1104
        # checkers alone, the checker would have to take more time
411 by Teddy Hogeborn
More consistent terminology: Clients are no longer "invalid" - they
1105
        # than 'timeout' for the client to be disabled, which is as it
1106
        # should be.
874 by Teddy Hogeborn
PEP8 compliance: mandos
1107
749.1.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
1108
        if self.checker is not None and not self.checker.is_alive():
1109
            logger.warning("Checker was not alive; joining")
1110
            self.checker.join()
1111
            self.checker = None
315 by Teddy Hogeborn
* mandos (Client.current_checker_command): New attribute.
1112
        # Start a new checker if needed
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
1113
        if self.checker is None:
583 by Teddy Hogeborn
* mandos (Client.start_checker): Remove undocumented support for "%%s"
1114
            # Escape attributes for the shell
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1115
            escaped_attrs = {
1116
                attr: re.escape(str(getattr(self, attr)))
874 by Teddy Hogeborn
PEP8 compliance: mandos
1117
                for attr in self.runtime_expansions}
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
1118
            try:
583 by Teddy Hogeborn
* mandos (Client.start_checker): Remove undocumented support for "%%s"
1119
                command = self.checker_command % escaped_attrs
1120
            except TypeError as error:
1121
                logger.error('Could not format string "%s"',
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1122
                             self.checker_command,
1123
                             exc_info=error)
1124
                return True     # Try again later
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1125
            self.current_checker_command = command
749.1.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
1126
            logger.info("Starting checker %r for %s", command,
1127
                        self.name)
1128
            # We don't need to redirect stdout and stderr, since
1129
            # in normal mode, that is already done by daemon(),
1130
            # and in debug mode we don't want to.  (Stdin is
1131
            # always replaced by /dev/null.)
1132
            # The exception is when not debugging but nevertheless
1133
            # running in the foreground; use the previously
1134
            # created wnull.
874 by Teddy Hogeborn
PEP8 compliance: mandos
1135
            popen_args = {"close_fds": True,
1136
                          "shell": True,
1137
                          "cwd": "/"}
749.1.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
1138
            if (not self.server_settings["debug"]
1139
                and self.server_settings["foreground"]):
1140
                popen_args.update({"stdout": wnull,
874 by Teddy Hogeborn
PEP8 compliance: mandos
1141
                                   "stderr": wnull})
1142
            pipe = multiprocessing.Pipe(duplex=False)
749.1.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
1143
            self.checker = multiprocessing.Process(
874 by Teddy Hogeborn
PEP8 compliance: mandos
1144
                target=call_pipe,
1145
                args=(pipe[1], subprocess.call, command),
1146
                kwargs=popen_args)
749.1.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
1147
            self.checker.start()
830 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
1148
            self.checker_callback_tag = GLib.io_add_watch(
1149
                pipe[0].fileno(), GLib.IO_IN,
756 by Teddy Hogeborn
Merge change to use multiprocessing module to run checkers.
1150
                self.checker_callback, pipe[0], command)
830 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
1151
        # Re-run this periodically if run by GLib.timeout_add
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
1152
        return True
874 by Teddy Hogeborn
PEP8 compliance: mandos
1153
9 by Teddy Hogeborn
* client.cpp (main): Get t_old early since it is used on error exits.
1154
    def stop_checker(self):
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
1155
        """Force the checker process, if any, to stop."""
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
1156
        if self.checker_callback_tag:
830 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
1157
            GLib.source_remove(self.checker_callback_tag)
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
1158
            self.checker_callback_tag = None
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1159
        if getattr(self, "checker", None) is None:
9 by Teddy Hogeborn
* client.cpp (main): Get t_old early since it is used on error exits.
1160
            return
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1161
        logger.debug("Stopping checker for %(name)s", vars(self))
749.1.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
1162
        self.checker.terminate()
9 by Teddy Hogeborn
* client.cpp (main): Get t_old early since it is used on error exits.
1163
        self.checker = None
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
1164
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
1165
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1166
def dbus_service_property(dbus_interface,
1167
                          signature="v",
1168
                          access="readwrite",
1169
                          byte_arrays=False):
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1170
    """Decorators for marking methods of a DBusObjectWithProperties to
1171
    become properties on the D-Bus.
874 by Teddy Hogeborn
PEP8 compliance: mandos
1172
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1173
    The decorated method will be called with no arguments by "Get"
1174
    and with one argument by "Set".
874 by Teddy Hogeborn
PEP8 compliance: mandos
1175
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1176
    The parameters, where they are supported, are the same as
1177
    dbus.service.method, except there is only "signature", since the
1178
    type from Get() and the type sent to Set() is the same.
1179
    """
411 by Teddy Hogeborn
More consistent terminology: Clients are no longer "invalid" - they
1180
    # Encoding deeply encoded byte arrays is not supported yet by the
1181
    # "Set" method, so we fail early here:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1182
    if byte_arrays and signature != "ay":
1183
        raise ValueError("Byte arrays not supported for non-'ay'"
723.1.5 by Teddy Hogeborn
Use the new auto-numbered "{}" syntax for the .format() string method.
1184
                         " signature {!r}".format(signature))
874 by Teddy Hogeborn
PEP8 compliance: mandos
1185
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1186
    def decorator(func):
1187
        func._dbus_is_property = True
1188
        func._dbus_interface = dbus_interface
1189
        func._dbus_signature = signature
1190
        func._dbus_access = access
1191
        func._dbus_name = func.__name__
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1192
        if func._dbus_name.endswith("_dbus_property"):
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1193
            func._dbus_name = func._dbus_name[:-14]
874 by Teddy Hogeborn
PEP8 compliance: mandos
1194
        func._dbus_get_args_options = {'byte_arrays': byte_arrays}
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1195
        return func
874 by Teddy Hogeborn
PEP8 compliance: mandos
1196
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1197
    return decorator
1198
1199
560.1.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
1200
def dbus_interface_annotations(dbus_interface):
573 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
1201
    """Decorator for marking functions returning interface annotations
874 by Teddy Hogeborn
PEP8 compliance: mandos
1202
560.1.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
1203
    Usage:
874 by Teddy Hogeborn
PEP8 compliance: mandos
1204
560.1.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
1205
    @dbus_interface_annotations("org.example.Interface")
1206
    def _foo(self):  # Function name does not matter
1207
        return {"org.freedesktop.DBus.Deprecated": "true",
1208
                "org.freedesktop.DBus.Property.EmitsChangedSignal":
1209
                    "false"}
1210
    """
874 by Teddy Hogeborn
PEP8 compliance: mandos
1211
560.1.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
1212
    def decorator(func):
1213
        func._dbus_is_interface = True
1214
        func._dbus_interface = dbus_interface
1215
        func._dbus_name = dbus_interface
1216
        return func
874 by Teddy Hogeborn
PEP8 compliance: mandos
1217
560.1.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
1218
    return decorator
1219
1220
561.1.1 by Teddy Hogeborn
Add D-Bus annotations support to methods, signals and properties.
1221
def dbus_annotations(annotations):
1222
    """Decorator to annotate D-Bus methods, signals or properties
1223
    Usage:
874 by Teddy Hogeborn
PEP8 compliance: mandos
1224
732 by Teddy Hogeborn
Emit D-Bus "org.freedesktop.DBus.Properties.PropertiesChanged" signal.
1225
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",
1226
                       "org.freedesktop.DBus.Property."
1227
                       "EmitsChangedSignal": "false"})
561.1.1 by Teddy Hogeborn
Add D-Bus annotations support to methods, signals and properties.
1228
    @dbus_service_property("org.example.Interface", signature="b",
1229
                           access="r")
1230
    def Property_dbus_property(self):
1231
        return dbus.Boolean(False)
874 by Teddy Hogeborn
PEP8 compliance: mandos
1232
784 by Teddy Hogeborn
Refactor D-Bus annotation class out from D-Bus properties class.
1233
    See also the DBusObjectWithAnnotations class.
561.1.1 by Teddy Hogeborn
Add D-Bus annotations support to methods, signals and properties.
1234
    """
874 by Teddy Hogeborn
PEP8 compliance: mandos
1235
561.1.1 by Teddy Hogeborn
Add D-Bus annotations support to methods, signals and properties.
1236
    def decorator(func):
1237
        func._dbus_annotations = annotations
1238
        return func
874 by Teddy Hogeborn
PEP8 compliance: mandos
1239
561.1.1 by Teddy Hogeborn
Add D-Bus annotations support to methods, signals and properties.
1240
    return decorator
1241
1242
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1243
class DBusPropertyException(dbus.exceptions.DBusException):
1244
    """A base class for D-Bus property-related exceptions
1245
    """
729 by Teddy Hogeborn
mandos: Stop using str() and remove unnecessary unicode() calls.
1246
    pass
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1247
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1248
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1249
class DBusPropertyAccessException(DBusPropertyException):
1250
    """A property's access permissions disallows an operation.
1251
    """
1252
    pass
1253
1254
1255
class DBusPropertyNotFound(DBusPropertyException):
1256
    """An attempt was made to access a non-existing property.
1257
    """
1258
    pass
1259
1260
784 by Teddy Hogeborn
Refactor D-Bus annotation class out from D-Bus properties class.
1261
class DBusObjectWithAnnotations(dbus.service.Object):
1262
    """A D-Bus object with annotations.
874 by Teddy Hogeborn
PEP8 compliance: mandos
1263
784 by Teddy Hogeborn
Refactor D-Bus annotation class out from D-Bus properties class.
1264
    Classes inheriting from this can use the dbus_annotations
1265
    decorator to add annotations to methods or signals.
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1266
    """
874 by Teddy Hogeborn
PEP8 compliance: mandos
1267
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1268
    @staticmethod
560.1.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
1269
    def _is_dbus_thing(thing):
1270
        """Returns a function testing if an attribute is a D-Bus thing
874 by Teddy Hogeborn
PEP8 compliance: mandos
1271
560.1.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
1272
        If called like _is_dbus_thing("method") it returns a function
1273
        suitable for use as predicate to inspect.getmembers().
1274
        """
723.1.5 by Teddy Hogeborn
Use the new auto-numbered "{}" syntax for the .format() string method.
1275
        return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
560.1.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
1276
                                   False)
874 by Teddy Hogeborn
PEP8 compliance: mandos
1277
560.1.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
1278
    def _get_all_dbus_things(self, thing):
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1279
        """Returns a generator of (name, attribute) pairs
1280
        """
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1281
        return ((getattr(athing.__get__(self), "_dbus_name", name),
560.1.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
1282
                 athing.__get__(self))
24.1.186 by Björn Påhlsson
transitional stuff actually working
1283
                for cls in self.__class__.__mro__
560.1.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
1284
                for name, athing in
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1285
                inspect.getmembers(cls, self._is_dbus_thing(thing)))
874 by Teddy Hogeborn
PEP8 compliance: mandos
1286
784 by Teddy Hogeborn
Refactor D-Bus annotation class out from D-Bus properties class.
1287
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
874 by Teddy Hogeborn
PEP8 compliance: mandos
1288
                         out_signature="s",
1289
                         path_keyword='object_path',
1290
                         connection_keyword='connection')
784 by Teddy Hogeborn
Refactor D-Bus annotation class out from D-Bus properties class.
1291
    def Introspect(self, object_path, connection):
1292
        """Overloading of standard D-Bus method.
874 by Teddy Hogeborn
PEP8 compliance: mandos
1293
784 by Teddy Hogeborn
Refactor D-Bus annotation class out from D-Bus properties class.
1294
        Inserts annotation tags on methods and signals.
1295
        """
1296
        xmlstring = dbus.service.Object.Introspect(self, object_path,
1297
                                                   connection)
1298
        try:
1299
            document = xml.dom.minidom.parseString(xmlstring)
874 by Teddy Hogeborn
PEP8 compliance: mandos
1300
784 by Teddy Hogeborn
Refactor D-Bus annotation class out from D-Bus properties class.
1301
            for if_tag in document.getElementsByTagName("interface"):
1302
                # Add annotation tags
1303
                for typ in ("method", "signal"):
1304
                    for tag in if_tag.getElementsByTagName(typ):
1305
                        annots = dict()
1306
                        for name, prop in (self.
1307
                                           _get_all_dbus_things(typ)):
1308
                            if (name == tag.getAttribute("name")
1309
                                and prop._dbus_interface
1310
                                == if_tag.getAttribute("name")):
1311
                                annots.update(getattr(
1312
                                    prop, "_dbus_annotations", {}))
1313
                        for name, value in annots.items():
1314
                            ann_tag = document.createElement(
1315
                                "annotation")
1316
                            ann_tag.setAttribute("name", name)
1317
                            ann_tag.setAttribute("value", value)
1318
                            tag.appendChild(ann_tag)
1319
                # Add interface annotation tags
1320
                for annotation, value in dict(
1321
                    itertools.chain.from_iterable(
1322
                        annotations().items()
1323
                        for name, annotations
1324
                        in self._get_all_dbus_things("interface")
1325
                        if name == if_tag.getAttribute("name")
1326
                        )).items():
1327
                    ann_tag = document.createElement("annotation")
1328
                    ann_tag.setAttribute("name", annotation)
1329
                    ann_tag.setAttribute("value", value)
1330
                    if_tag.appendChild(ann_tag)
1331
                # Fix argument name for the Introspect method itself
1332
                if (if_tag.getAttribute("name")
874 by Teddy Hogeborn
PEP8 compliance: mandos
1333
                    == dbus.INTROSPECTABLE_IFACE):
784 by Teddy Hogeborn
Refactor D-Bus annotation class out from D-Bus properties class.
1334
                    for cn in if_tag.getElementsByTagName("method"):
1335
                        if cn.getAttribute("name") == "Introspect":
1336
                            for arg in cn.getElementsByTagName("arg"):
1337
                                if (arg.getAttribute("direction")
1338
                                    == "out"):
1339
                                    arg.setAttribute("name",
1340
                                                     "xml_data")
1341
            xmlstring = document.toxml("utf-8")
1342
            document.unlink()
1343
        except (AttributeError, xml.dom.DOMException,
1344
                xml.parsers.expat.ExpatError) as error:
1345
            logger.error("Failed to override Introspection method",
1346
                         exc_info=error)
1347
        return xmlstring
1348
1349
1350
class DBusObjectWithProperties(DBusObjectWithAnnotations):
1351
    """A D-Bus object with properties.
874 by Teddy Hogeborn
PEP8 compliance: mandos
1352
784 by Teddy Hogeborn
Refactor D-Bus annotation class out from D-Bus properties class.
1353
    Classes inheriting from this can use the dbus_service_property
1354
    decorator to expose methods as D-Bus properties.  It exposes the
1355
    standard Get(), Set(), and GetAll() methods on the D-Bus.
1356
    """
874 by Teddy Hogeborn
PEP8 compliance: mandos
1357
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1358
    def _get_dbus_property(self, interface_name, property_name):
1359
        """Returns a bound method if one exists which is a D-Bus
1360
        property with the specified name and interface.
1361
        """
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1362
        for cls in self.__class__.__mro__:
1363
            for name, value in inspect.getmembers(
1364
                    cls, self._is_dbus_thing("property")):
505.1.3 by Teddy Hogeborn
* mandos: Break long lines.
1365
                if (value._dbus_name == property_name
1366
                    and value._dbus_interface == interface_name):
24.1.186 by Björn Påhlsson
transitional stuff actually working
1367
                    return value.__get__(self)
874 by Teddy Hogeborn
PEP8 compliance: mandos
1368
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1369
        # No such property
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1370
        raise DBusPropertyNotFound("{}:{}.{}".format(
1371
            self.dbus_object_path, interface_name, property_name))
874 by Teddy Hogeborn
PEP8 compliance: mandos
1372
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
1373
    @classmethod
1374
    def _get_all_interface_names(cls):
1375
        """Get a sequence of all interfaces supported by an object"""
1376
        return (name for name in set(getattr(getattr(x, attr),
1377
                                             "_dbus_interface", None)
1378
                                     for x in (inspect.getmro(cls))
1379
                                     for attr in dir(x))
1380
                if name is not None)
874 by Teddy Hogeborn
PEP8 compliance: mandos
1381
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1382
    @dbus.service.method(dbus.PROPERTIES_IFACE,
1383
                         in_signature="ss",
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1384
                         out_signature="v")
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1385
    def Get(self, interface_name, property_name):
1386
        """Standard D-Bus property Get() method, see D-Bus standard.
1387
        """
1388
        prop = self._get_dbus_property(interface_name, property_name)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1389
        if prop._dbus_access == "write":
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1390
            raise DBusPropertyAccessException(property_name)
1391
        value = prop()
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1392
        if not hasattr(value, "variant_level"):
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1393
            return value
1394
        return type(value)(value, variant_level=value.variant_level+1)
874 by Teddy Hogeborn
PEP8 compliance: mandos
1395
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1396
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1397
    def Set(self, interface_name, property_name, value):
1398
        """Standard D-Bus property Set() method, see D-Bus standard.
1399
        """
1400
        prop = self._get_dbus_property(interface_name, property_name)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1401
        if prop._dbus_access == "read":
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1402
            raise DBusPropertyAccessException(property_name)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1403
        if prop._dbus_get_args_options["byte_arrays"]:
411 by Teddy Hogeborn
More consistent terminology: Clients are no longer "invalid" - they
1404
            # The byte_arrays option is not supported yet on
1405
            # signatures other than "ay".
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1406
            if prop._dbus_signature != "ay":
649 by Teddy Hogeborn
Minor code fix; raise only exception instances, not classes.
1407
                raise ValueError("Byte arrays not supported for non-"
723.1.5 by Teddy Hogeborn
Use the new auto-numbered "{}" syntax for the .format() string method.
1408
                                 "'ay' signature {!r}"
649 by Teddy Hogeborn
Minor code fix; raise only exception instances, not classes.
1409
                                 .format(prop._dbus_signature))
546 by Teddy Hogeborn
* debian/rules (binary-common): Exclude network-hooks.d from
1410
            value = dbus.ByteArray(b''.join(chr(byte)
1411
                                            for byte in value))
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1412
        prop(value)
874 by Teddy Hogeborn
PEP8 compliance: mandos
1413
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1414
    @dbus.service.method(dbus.PROPERTIES_IFACE,
1415
                         in_signature="s",
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1416
                         out_signature="a{sv}")
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1417
    def GetAll(self, interface_name):
1418
        """Standard D-Bus property GetAll() method, see D-Bus
1419
        standard.
874 by Teddy Hogeborn
PEP8 compliance: mandos
1420
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1421
        Note: Will not include properties with access="write".
1422
        """
518.1.5 by Björn Påhlsson
First run of python-lint. Fixed some *obviously* bad code and turned
1423
        properties = {}
560.1.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
1424
        for name, prop in self._get_all_dbus_things("property"):
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1425
            if (interface_name
1426
                and interface_name != prop._dbus_interface):
1427
                # Interface non-empty but did not match
1428
                continue
1429
            # Ignore write-only properties
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1430
            if prop._dbus_access == "write":
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1431
                continue
1432
            value = prop()
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1433
            if not hasattr(value, "variant_level"):
518.1.5 by Björn Påhlsson
First run of python-lint. Fixed some *obviously* bad code and turned
1434
                properties[name] = value
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1435
                continue
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1436
            properties[name] = type(value)(
874 by Teddy Hogeborn
PEP8 compliance: mandos
1437
                value, variant_level=value.variant_level + 1)
518.1.5 by Björn Påhlsson
First run of python-lint. Fixed some *obviously* bad code and turned
1438
        return dbus.Dictionary(properties, signature="sv")
874 by Teddy Hogeborn
PEP8 compliance: mandos
1439
732 by Teddy Hogeborn
Emit D-Bus "org.freedesktop.DBus.Properties.PropertiesChanged" signal.
1440
    @dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")
1441
    def PropertiesChanged(self, interface_name, changed_properties,
1442
                          invalidated_properties):
1443
        """Standard D-Bus PropertiesChanged() signal, see D-Bus
1444
        standard.
1445
        """
1446
        pass
874 by Teddy Hogeborn
PEP8 compliance: mandos
1447
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1448
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1449
                         out_signature="s",
1450
                         path_keyword='object_path',
1451
                         connection_keyword='connection')
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1452
    def Introspect(self, object_path, connection):
560.1.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
1453
        """Overloading of standard D-Bus method.
874 by Teddy Hogeborn
PEP8 compliance: mandos
1454
560.1.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
1455
        Inserts property tags and interface annotation tags.
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1456
        """
784 by Teddy Hogeborn
Refactor D-Bus annotation class out from D-Bus properties class.
1457
        xmlstring = DBusObjectWithAnnotations.Introspect(self,
1458
                                                         object_path,
1459
                                                         connection)
387 by Teddy Hogeborn
* mandos (ClientDBus.ReceivedSecret): Renamed to "GotSecret". All
1460
        try:
1461
            document = xml.dom.minidom.parseString(xmlstring)
874 by Teddy Hogeborn
PEP8 compliance: mandos
1462
387 by Teddy Hogeborn
* mandos (ClientDBus.ReceivedSecret): Renamed to "GotSecret". All
1463
            def make_tag(document, name, prop):
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1464
                e = document.createElement("property")
1465
                e.setAttribute("name", name)
1466
                e.setAttribute("type", prop._dbus_signature)
1467
                e.setAttribute("access", prop._dbus_access)
387 by Teddy Hogeborn
* mandos (ClientDBus.ReceivedSecret): Renamed to "GotSecret". All
1468
                return e
874 by Teddy Hogeborn
PEP8 compliance: mandos
1469
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1470
            for if_tag in document.getElementsByTagName("interface"):
560.1.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
1471
                # Add property tags
387 by Teddy Hogeborn
* mandos (ClientDBus.ReceivedSecret): Renamed to "GotSecret". All
1472
                for tag in (make_tag(document, name, prop)
1473
                            for name, prop
560.1.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
1474
                            in self._get_all_dbus_things("property")
387 by Teddy Hogeborn
* mandos (ClientDBus.ReceivedSecret): Renamed to "GotSecret". All
1475
                            if prop._dbus_interface
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1476
                            == if_tag.getAttribute("name")):
387 by Teddy Hogeborn
* mandos (ClientDBus.ReceivedSecret): Renamed to "GotSecret". All
1477
                    if_tag.appendChild(tag)
784 by Teddy Hogeborn
Refactor D-Bus annotation class out from D-Bus properties class.
1478
                # Add annotation tags for properties
1479
                for tag in if_tag.getElementsByTagName("property"):
1480
                    annots = dict()
1481
                    for name, prop in self._get_all_dbus_things(
1482
                            "property"):
1483
                        if (name == tag.getAttribute("name")
1484
                            and prop._dbus_interface
1485
                            == if_tag.getAttribute("name")):
1486
                            annots.update(getattr(
1487
                                prop, "_dbus_annotations", {}))
1488
                    for name, value in annots.items():
1489
                        ann_tag = document.createElement(
1490
                            "annotation")
1491
                        ann_tag.setAttribute("name", name)
1492
                        ann_tag.setAttribute("value", value)
1493
                        tag.appendChild(ann_tag)
387 by Teddy Hogeborn
* mandos (ClientDBus.ReceivedSecret): Renamed to "GotSecret". All
1494
                # Add the names to the return values for the
1495
                # "org.freedesktop.DBus.Properties" methods
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1496
                if (if_tag.getAttribute("name")
1497
                    == "org.freedesktop.DBus.Properties"):
1498
                    for cn in if_tag.getElementsByTagName("method"):
1499
                        if cn.getAttribute("name") == "Get":
1500
                            for arg in cn.getElementsByTagName("arg"):
1501
                                if (arg.getAttribute("direction")
1502
                                    == "out"):
1503
                                    arg.setAttribute("name", "value")
1504
                        elif cn.getAttribute("name") == "GetAll":
1505
                            for arg in cn.getElementsByTagName("arg"):
1506
                                if (arg.getAttribute("direction")
1507
                                    == "out"):
1508
                                    arg.setAttribute("name", "props")
1509
            xmlstring = document.toxml("utf-8")
387 by Teddy Hogeborn
* mandos (ClientDBus.ReceivedSecret): Renamed to "GotSecret". All
1510
            document.unlink()
1511
        except (AttributeError, xml.dom.DOMException,
482 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
1512
                xml.parsers.expat.ExpatError) as error:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1513
            logger.error("Failed to override Introspection method",
565 by Teddy Hogeborn
* mandos (AvahiService.rename, Client.start_checker,
1514
                         exc_info=error)
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1515
        return xmlstring
1516
888 by Teddy Hogeborn
Add more PEP8 compliance (as per the "pycodestyle" tool).
1517
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
1518
try:
1519
    dbus.OBJECT_MANAGER_IFACE
1520
except AttributeError:
1521
    dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
1522
874 by Teddy Hogeborn
PEP8 compliance: mandos
1523
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
1524
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
1525
    """A D-Bus object with an ObjectManager.
874 by Teddy Hogeborn
PEP8 compliance: mandos
1526
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
1527
    Classes inheriting from this exposes the standard
1528
    GetManagedObjects call and the InterfacesAdded and
1529
    InterfacesRemoved signals on the standard
1530
    "org.freedesktop.DBus.ObjectManager" interface.
874 by Teddy Hogeborn
PEP8 compliance: mandos
1531
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
1532
    Note: No signals are sent automatically; they must be sent
1533
    manually.
1534
    """
1535
    @dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
874 by Teddy Hogeborn
PEP8 compliance: mandos
1536
                         out_signature="a{oa{sa{sv}}}")
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
1537
    def GetManagedObjects(self):
1538
        """This function must be overridden"""
1539
        raise NotImplementedError()
874 by Teddy Hogeborn
PEP8 compliance: mandos
1540
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
1541
    @dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
874 by Teddy Hogeborn
PEP8 compliance: mandos
1542
                         signature="oa{sa{sv}}")
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
1543
    def InterfacesAdded(self, object_path, interfaces_and_properties):
1544
        pass
874 by Teddy Hogeborn
PEP8 compliance: mandos
1545
1546
    @dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature="oas")
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
1547
    def InterfacesRemoved(self, object_path, interfaces):
1548
        pass
874 by Teddy Hogeborn
PEP8 compliance: mandos
1549
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
1550
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
874 by Teddy Hogeborn
PEP8 compliance: mandos
1551
                         out_signature="s",
1552
                         path_keyword='object_path',
1553
                         connection_keyword='connection')
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
1554
    def Introspect(self, object_path, connection):
1555
        """Overloading of standard D-Bus method.
874 by Teddy Hogeborn
PEP8 compliance: mandos
1556
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
1557
        Override return argument name of GetManagedObjects to be
1558
        "objpath_interfaces_and_properties"
1559
        """
786 by Teddy Hogeborn
Server Bug fix: Make D-Bus introspection work again.
1560
        xmlstring = DBusObjectWithAnnotations.Introspect(self,
1561
                                                         object_path,
1562
                                                         connection)
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
1563
        try:
1564
            document = xml.dom.minidom.parseString(xmlstring)
874 by Teddy Hogeborn
PEP8 compliance: mandos
1565
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
1566
            for if_tag in document.getElementsByTagName("interface"):
1567
                # Fix argument name for the GetManagedObjects method
1568
                if (if_tag.getAttribute("name")
874 by Teddy Hogeborn
PEP8 compliance: mandos
1569
                    == dbus.OBJECT_MANAGER_IFACE):
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
1570
                    for cn in if_tag.getElementsByTagName("method"):
1571
                        if (cn.getAttribute("name")
1572
                            == "GetManagedObjects"):
1573
                            for arg in cn.getElementsByTagName("arg"):
1574
                                if (arg.getAttribute("direction")
1575
                                    == "out"):
1576
                                    arg.setAttribute(
1577
                                        "name",
1578
                                        "objpath_interfaces"
1579
                                        "_and_properties")
1580
            xmlstring = document.toxml("utf-8")
1581
            document.unlink()
1582
        except (AttributeError, xml.dom.DOMException,
1583
                xml.parsers.expat.ExpatError) as error:
1584
            logger.error("Failed to override Introspection method",
874 by Teddy Hogeborn
PEP8 compliance: mandos
1585
                         exc_info=error)
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
1586
        return xmlstring
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1587
874 by Teddy Hogeborn
PEP8 compliance: mandos
1588
587 by Teddy Hogeborn
* Makefile (DOCBOOKTOMAN): Only run man --warnings if both "man" and
1589
def datetime_to_dbus(dt, variant_level=0):
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1590
    """Convert a UTC datetime.datetime() to a D-Bus type."""
1591
    if dt is None:
874 by Teddy Hogeborn
PEP8 compliance: mandos
1592
        return dbus.String("", variant_level=variant_level)
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1593
    return dbus.String(dt.isoformat(), variant_level=variant_level)
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1594
518.1.6 by Teddy Hogeborn
* mandos: Fix whitespace.
1595
575 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1596
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
1597
    """A class decorator; applied to a subclass of
1598
    dbus.service.Object, it will add alternate D-Bus attributes with
1599
    interface names according to the "alt_interface_names" mapping.
1600
    Usage:
874 by Teddy Hogeborn
PEP8 compliance: mandos
1601
587 by Teddy Hogeborn
* Makefile (DOCBOOKTOMAN): Only run man --warnings if both "man" and
1602
    @alternate_dbus_interfaces({"org.example.Interface":
1603
                                    "net.example.AlternateInterface"})
575 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1604
    class SampleDBusObject(dbus.service.Object):
1605
        @dbus.service.method("org.example.Interface")
1606
        def SampleDBusMethod():
1607
            pass
874 by Teddy Hogeborn
PEP8 compliance: mandos
1608
575 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1609
    The above "SampleDBusMethod" on "SampleDBusObject" will be
1610
    reachable via two interfaces: "org.example.Interface" and
1611
    "net.example.AlternateInterface", the latter of which will have
1612
    its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
1613
    "true", unless "deprecate" is passed with a False value.
874 by Teddy Hogeborn
PEP8 compliance: mandos
1614
575 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1615
    This works for methods and signals, and also for D-Bus properties
1616
    (from DBusObjectWithProperties) and interfaces (from the
1617
    dbus_interface_annotations decorator).
505.1.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1618
    """
874 by Teddy Hogeborn
PEP8 compliance: mandos
1619
575 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1620
    def wrapper(cls):
1621
        for orig_interface_name, alt_interface_name in (
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1622
                alt_interface_names.items()):
575 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1623
            attr = {}
1624
            interface_names = set()
1625
            # Go though all attributes of the class
1626
            for attrname, attribute in inspect.getmembers(cls):
505.1.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1627
                # Ignore non-D-Bus attributes, and D-Bus attributes
1628
                # with the wrong interface name
1629
                if (not hasattr(attribute, "_dbus_interface")
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1630
                    or not attribute._dbus_interface.startswith(
1631
                        orig_interface_name)):
505.1.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1632
                    continue
1633
                # Create an alternate D-Bus interface name based on
1634
                # the current name
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1635
                alt_interface = attribute._dbus_interface.replace(
1636
                    orig_interface_name, alt_interface_name)
575 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1637
                interface_names.add(alt_interface)
505.1.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1638
                # Is this a D-Bus signal?
1639
                if getattr(attribute, "_dbus_is_signal", False):
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
1640
                    # Extract the original non-method undecorated
1641
                    # function by black magic
756 by Teddy Hogeborn
Merge change to use multiprocessing module to run checkers.
1642
                    if sys.version_info.major == 2:
754 by Teddy Hogeborn
mandos: More Python 3 fixes.
1643
                        nonmethod_func = (dict(
1644
                            zip(attribute.func_code.co_freevars,
1645
                                attribute.__closure__))
1646
                                          ["func"].cell_contents)
1647
                    else:
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
1648
                        nonmethod_func = (dict(
1649
                            zip(attribute.__code__.co_freevars,
1650
                                attribute.__closure__))
1651
                                          ["func"].cell_contents)
505.1.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1652
                    # Create a new, but exactly alike, function
1653
                    # object, and decorate it to be a new D-Bus signal
1654
                    # with the alternate D-Bus interface name
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
1655
                    new_function = copy_function(nonmethod_func)
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1656
                    new_function = (dbus.service.signal(
754 by Teddy Hogeborn
mandos: More Python 3 fixes.
1657
                        alt_interface,
1658
                        attribute._dbus_signature)(new_function))
561.1.1 by Teddy Hogeborn
Add D-Bus annotations support to methods, signals and properties.
1659
                    # Copy annotations, if any
1660
                    try:
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1661
                        new_function._dbus_annotations = dict(
1662
                            attribute._dbus_annotations)
561.1.1 by Teddy Hogeborn
Add D-Bus annotations support to methods, signals and properties.
1663
                    except AttributeError:
1664
                        pass
874 by Teddy Hogeborn
PEP8 compliance: mandos
1665
505.1.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1666
                    # Define a creator of a function to call both the
575 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1667
                    # original and alternate functions, so both the
1668
                    # original and alternate signals gets sent when
1669
                    # the function is called
505.1.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1670
                    def fixscope(func1, func2):
1671
                        """This function is a scope container to pass
1672
                        func1 and func2 to the "call_both" function
1673
                        outside of its arguments"""
874 by Teddy Hogeborn
PEP8 compliance: mandos
1674
786 by Teddy Hogeborn
Server Bug fix: Make D-Bus introspection work again.
1675
                        @functools.wraps(func2)
505.1.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1676
                        def call_both(*args, **kwargs):
1677
                            """This function will emit two D-Bus
1678
                            signals by calling func1 and func2"""
1679
                            func1(*args, **kwargs)
1680
                            func2(*args, **kwargs)
874 by Teddy Hogeborn
PEP8 compliance: mandos
1681
                        # Make wrapper function look like a D-Bus
1682
                        # signal
786 by Teddy Hogeborn
Server Bug fix: Make D-Bus introspection work again.
1683
                        for name, attr in inspect.getmembers(func2):
1684
                            if name.startswith("_dbus_"):
1685
                                setattr(call_both, name, attr)
874 by Teddy Hogeborn
PEP8 compliance: mandos
1686
505.1.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1687
                        return call_both
1688
                    # Create the "call_both" function and add it to
1689
                    # the class
575 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1690
                    attr[attrname] = fixscope(attribute, new_function)
505.1.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1691
                # Is this a D-Bus method?
1692
                elif getattr(attribute, "_dbus_is_method", False):
1693
                    # Create a new, but exactly alike, function
1694
                    # object.  Decorate it to be a new D-Bus method
1695
                    # with the alternate D-Bus interface name.  Add it
1696
                    # to the class.
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1697
                    attr[attrname] = (
1698
                        dbus.service.method(
1699
                            alt_interface,
1700
                            attribute._dbus_in_signature,
1701
                            attribute._dbus_out_signature)
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
1702
                        (copy_function(attribute)))
561.1.1 by Teddy Hogeborn
Add D-Bus annotations support to methods, signals and properties.
1703
                    # Copy annotations, if any
1704
                    try:
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1705
                        attr[attrname]._dbus_annotations = dict(
1706
                            attribute._dbus_annotations)
561.1.1 by Teddy Hogeborn
Add D-Bus annotations support to methods, signals and properties.
1707
                    except AttributeError:
1708
                        pass
505.1.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1709
                # Is this a D-Bus property?
1710
                elif getattr(attribute, "_dbus_is_property", False):
1711
                    # Create a new, but exactly alike, function
1712
                    # object, and decorate it to be a new D-Bus
1713
                    # property with the alternate D-Bus interface
1714
                    # name.  Add it to the class.
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1715
                    attr[attrname] = (dbus_service_property(
1716
                        alt_interface, attribute._dbus_signature,
1717
                        attribute._dbus_access,
1718
                        attribute._dbus_get_args_options
1719
                        ["byte_arrays"])
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
1720
                                      (copy_function(attribute)))
561.1.1 by Teddy Hogeborn
Add D-Bus annotations support to methods, signals and properties.
1721
                    # Copy annotations, if any
1722
                    try:
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1723
                        attr[attrname]._dbus_annotations = dict(
1724
                            attribute._dbus_annotations)
561.1.1 by Teddy Hogeborn
Add D-Bus annotations support to methods, signals and properties.
1725
                    except AttributeError:
1726
                        pass
560.1.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
1727
                # Is this a D-Bus interface?
1728
                elif getattr(attribute, "_dbus_is_interface", False):
1729
                    # Create a new, but exactly alike, function
1730
                    # object.  Decorate it to be a new D-Bus interface
1731
                    # with the alternate D-Bus interface name.  Add it
1732
                    # to the class.
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1733
                    attr[attrname] = (
1734
                        dbus_interface_annotations(alt_interface)
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
1735
                        (copy_function(attribute)))
575 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1736
            if deprecate:
1737
                # Deprecate all alternate interfaces
874 by Teddy Hogeborn
PEP8 compliance: mandos
1738
                iname = "_AlternateDBusNames_interface_annotation{}"
575 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1739
                for interface_name in interface_names:
874 by Teddy Hogeborn
PEP8 compliance: mandos
1740
575 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1741
                    @dbus_interface_annotations(interface_name)
1742
                    def func(self):
874 by Teddy Hogeborn
PEP8 compliance: mandos
1743
                        return {"org.freedesktop.DBus.Deprecated":
1744
                                "true"}
575 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1745
                    # Find an unused name
1746
                    for aname in (iname.format(i)
1747
                                  for i in itertools.count()):
1748
                        if aname not in attr:
1749
                            attr[aname] = func
1750
                            break
1751
            if interface_names:
1752
                # Replace the class with a new subclass of it with
1753
                # methods, signals, etc. as created above.
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
1754
                if sys.version_info.major == 2:
1755
                    cls = type(b"{}Alternate".format(cls.__name__),
1756
                               (cls, ), attr)
1757
                else:
1758
                    cls = type("{}Alternate".format(cls.__name__),
1759
                               (cls, ), attr)
575 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1760
        return cls
874 by Teddy Hogeborn
PEP8 compliance: mandos
1761
575 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1762
    return wrapper
1763
1764
1765
@alternate_dbus_interfaces({"se.recompile.Mandos":
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1766
                            "se.bsnet.fukt.Mandos"})
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1767
class ClientDBus(Client, DBusObjectWithProperties):
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1768
    """A Client class using D-Bus
874 by Teddy Hogeborn
PEP8 compliance: mandos
1769
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1770
    Attributes:
338 by Teddy Hogeborn
* mandos: Minor doc string fixes.
1771
    dbus_object_path: dbus.ObjectPath
1772
    bus: dbus.SystemBus()
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1773
    """
874 by Teddy Hogeborn
PEP8 compliance: mandos
1774
438 by Teddy Hogeborn
* mandos (Client.runtime_expansions): New attribute containing the
1775
    runtime_expansions = (Client.runtime_expansions
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1776
                          + ("dbus_object_path", ))
874 by Teddy Hogeborn
PEP8 compliance: mandos
1777
732 by Teddy Hogeborn
Emit D-Bus "org.freedesktop.DBus.Properties.PropertiesChanged" signal.
1778
    _interface = "se.recompile.Mandos.Client"
874 by Teddy Hogeborn
PEP8 compliance: mandos
1779
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1780
    # dbus.service.Object doesn't use super(), so we can't either.
874 by Teddy Hogeborn
PEP8 compliance: mandos
1781
1782
    def __init__(self, bus=None, *args, **kwargs):
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
1783
        self.bus = bus
1784
        Client.__init__(self, *args, **kwargs)
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1785
        # Only now, when this client is initialized, can it show up on
1786
        # the D-Bus
730 by Teddy Hogeborn
mandos: Replace unicode() with str().
1787
        client_object_name = str(self.name).translate(
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1788
            {ord("."): ord("_"),
1789
             ord("-"): ord("_")})
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1790
        self.dbus_object_path = dbus.ObjectPath(
1791
            "/clients/" + client_object_name)
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1792
        DBusObjectWithProperties.__init__(self, self.bus,
1793
                                          self.dbus_object_path)
874 by Teddy Hogeborn
PEP8 compliance: mandos
1794
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1795
    def notifychangeproperty(transform_func, dbus_name,
1796
                             type_func=lambda x: x,
1797
                             variant_level=1,
1798
                             invalidate_only=False,
732 by Teddy Hogeborn
Emit D-Bus "org.freedesktop.DBus.Properties.PropertiesChanged" signal.
1799
                             _interface=_interface):
505.1.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1800
        """ Modify a variable so that it's a property which announces
1801
        its changes to DBus.
874 by Teddy Hogeborn
PEP8 compliance: mandos
1802
505.1.15 by Teddy Hogeborn
Bug fix: Make D-Bus properties settable again.
1803
        transform_fun: Function that takes a value and a variant_level
1804
                       and transforms it to a D-Bus type.
505.1.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1805
        dbus_name: D-Bus name of the variable
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1806
        type_func: Function that transform the value before sending it
505.1.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1807
                   to the D-Bus.  Default: no transform
1808
        variant_level: D-Bus variant level.  Default: 1
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1809
        """
723.1.5 by Teddy Hogeborn
Use the new auto-numbered "{}" syntax for the .format() string method.
1810
        attrname = "_{}".format(dbus_name)
874 by Teddy Hogeborn
PEP8 compliance: mandos
1811
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1812
        def setter(self, value):
1813
            if hasattr(self, "dbus_object_path"):
505.1.6 by Teddy Hogeborn
* mandos (ClientDBus.notifychangeproperty): Bug fix: Use instance
1814
                if (not hasattr(self, attrname) or
1815
                    type_func(getattr(self, attrname, None))
1816
                    != type_func(value)):
732 by Teddy Hogeborn
Emit D-Bus "org.freedesktop.DBus.Properties.PropertiesChanged" signal.
1817
                    if invalidate_only:
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1818
                        self.PropertiesChanged(
1819
                            _interface, dbus.Dictionary(),
1820
                            dbus.Array((dbus_name, )))
732 by Teddy Hogeborn
Emit D-Bus "org.freedesktop.DBus.Properties.PropertiesChanged" signal.
1821
                    else:
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1822
                        dbus_value = transform_func(
1823
                            type_func(value),
874 by Teddy Hogeborn
PEP8 compliance: mandos
1824
                            variant_level=variant_level)
732 by Teddy Hogeborn
Emit D-Bus "org.freedesktop.DBus.Properties.PropertiesChanged" signal.
1825
                        self.PropertyChanged(dbus.String(dbus_name),
1826
                                             dbus_value)
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1827
                        self.PropertiesChanged(
1828
                            _interface,
874 by Teddy Hogeborn
PEP8 compliance: mandos
1829
                            dbus.Dictionary({dbus.String(dbus_name):
1830
                                             dbus_value}),
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1831
                            dbus.Array())
505.1.6 by Teddy Hogeborn
* mandos (ClientDBus.notifychangeproperty): Bug fix: Use instance
1832
            setattr(self, attrname, value)
874 by Teddy Hogeborn
PEP8 compliance: mandos
1833
505.1.6 by Teddy Hogeborn
* mandos (ClientDBus.notifychangeproperty): Bug fix: Use instance
1834
        return property(lambda self: getattr(self, attrname), setter)
874 by Teddy Hogeborn
PEP8 compliance: mandos
1835
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1836
    expires = notifychangeproperty(datetime_to_dbus, "Expires")
1837
    approvals_pending = notifychangeproperty(dbus.Boolean,
1838
                                             "ApprovalPending",
874 by Teddy Hogeborn
PEP8 compliance: mandos
1839
                                             type_func=bool)
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1840
    enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1841
    last_enabled = notifychangeproperty(datetime_to_dbus,
1842
                                        "LastEnabled")
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1843
    checker = notifychangeproperty(
1844
        dbus.Boolean, "CheckerRunning",
874 by Teddy Hogeborn
PEP8 compliance: mandos
1845
        type_func=lambda checker: checker is not None)
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1846
    last_checked_ok = notifychangeproperty(datetime_to_dbus,
1847
                                           "LastCheckedOK")
556 by Teddy Hogeborn
* DBUS-API (se.recompile.Mandos.Client.LastCheckerStatus): New
1848
    last_checker_status = notifychangeproperty(dbus.Int16,
1849
                                               "LastCheckerStatus")
505.1.3 by Teddy Hogeborn
* mandos: Break long lines.
1850
    last_approval_request = notifychangeproperty(
1851
        datetime_to_dbus, "LastApprovalRequest")
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1852
    approved_by_default = notifychangeproperty(dbus.Boolean,
1853
                                               "ApprovedByDefault")
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1854
    approval_delay = notifychangeproperty(
1855
        dbus.UInt64, "ApprovalDelay",
874 by Teddy Hogeborn
PEP8 compliance: mandos
1856
        type_func=lambda td: td.total_seconds() * 1000)
505.1.3 by Teddy Hogeborn
* mandos: Break long lines.
1857
    approval_duration = notifychangeproperty(
518.2.9 by Teddy Hogeborn
* mandos (ClientDBus.approval_delay, ClientDBus.approval_duration,
1858
        dbus.UInt64, "ApprovalDuration",
874 by Teddy Hogeborn
PEP8 compliance: mandos
1859
        type_func=lambda td: td.total_seconds() * 1000)
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1860
    host = notifychangeproperty(dbus.String, "Host")
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1861
    timeout = notifychangeproperty(
1862
        dbus.UInt64, "Timeout",
874 by Teddy Hogeborn
PEP8 compliance: mandos
1863
        type_func=lambda td: td.total_seconds() * 1000)
505.1.3 by Teddy Hogeborn
* mandos: Break long lines.
1864
    extended_timeout = notifychangeproperty(
518.2.9 by Teddy Hogeborn
* mandos (ClientDBus.approval_delay, ClientDBus.approval_duration,
1865
        dbus.UInt64, "ExtendedTimeout",
874 by Teddy Hogeborn
PEP8 compliance: mandos
1866
        type_func=lambda td: td.total_seconds() * 1000)
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1867
    interval = notifychangeproperty(
1868
        dbus.UInt64, "Interval",
874 by Teddy Hogeborn
PEP8 compliance: mandos
1869
        type_func=lambda td: td.total_seconds() * 1000)
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1870
    checker_command = notifychangeproperty(dbus.String, "Checker")
732 by Teddy Hogeborn
Emit D-Bus "org.freedesktop.DBus.Properties.PropertiesChanged" signal.
1871
    secret = notifychangeproperty(dbus.ByteArray, "Secret",
1872
                                  invalidate_only=True)
874 by Teddy Hogeborn
PEP8 compliance: mandos
1873
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1874
    del notifychangeproperty
874 by Teddy Hogeborn
PEP8 compliance: mandos
1875
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1876
    def __del__(self, *args, **kwargs):
1877
        try:
1878
            self.remove_from_connection()
329 by Teddy Hogeborn
* mandos (ClientDBus.__del__): Bug fix: Correct mispasted code, and do
1879
        except LookupError:
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1880
            pass
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1881
        if hasattr(DBusObjectWithProperties, "__del__"):
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1882
            DBusObjectWithProperties.__del__(self, *args, **kwargs)
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1883
        Client.__del__(self, *args, **kwargs)
874 by Teddy Hogeborn
PEP8 compliance: mandos
1884
749.1.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
1885
    def checker_callback(self, source, condition,
756 by Teddy Hogeborn
Merge change to use multiprocessing module to run checkers.
1886
                         connection, command, *args, **kwargs):
749.1.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
1887
        ret = Client.checker_callback(self, source, condition,
756 by Teddy Hogeborn
Merge change to use multiprocessing module to run checkers.
1888
                                      connection, command, *args,
749.1.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
1889
                                      **kwargs)
1890
        exitstatus = self.last_checker_status
1891
        if exitstatus >= 0:
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1892
            # Emit D-Bus signal
1893
            self.CheckerCompleted(dbus.Int16(exitstatus),
783 by Teddy Hogeborn
Revert change to D-Bus API.
1894
                                  # This is specific to GNU libC
1895
                                  dbus.Int64(exitstatus << 8),
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1896
                                  dbus.String(command))
1897
        else:
1898
            # Emit D-Bus signal
1899
            self.CheckerCompleted(dbus.Int16(-1),
749.1.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
1900
                                  dbus.Int64(
783 by Teddy Hogeborn
Revert change to D-Bus API.
1901
                                      # This is specific to GNU libC
1902
                                      (exitstatus << 8)
1903
                                      | self.last_checker_signal),
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1904
                                  dbus.String(command))
749.1.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
1905
        return ret
874 by Teddy Hogeborn
PEP8 compliance: mandos
1906
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1907
    def start_checker(self, *args, **kwargs):
658 by Teddy Hogeborn
* mandos (ClientDBus.start_checker): Removed unused variable
1908
        old_checker_pid = getattr(self.checker, "pid", None)
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1909
        r = Client.start_checker(self, *args, **kwargs)
329 by Teddy Hogeborn
* mandos (ClientDBus.__del__): Bug fix: Correct mispasted code, and do
1910
        # Only if new checker process was started
1911
        if (self.checker is not None
1912
            and old_checker_pid != self.checker.pid):
1913
            # Emit D-Bus signal
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1914
            self.CheckerStarted(self.current_checker_command)
1915
        return r
874 by Teddy Hogeborn
PEP8 compliance: mandos
1916
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1917
    def _reset_approved(self):
518.2.4 by Teddy Hogeborn
* mandos (_timedelta_to_milliseconds): Renamed to
1918
        self.approved = None
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1919
        return False
874 by Teddy Hogeborn
PEP8 compliance: mandos
1920
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1921
    def approve(self, value=True):
518.2.4 by Teddy Hogeborn
* mandos (_timedelta_to_milliseconds): Renamed to
1922
        self.approved = value
830 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
1923
        GLib.timeout_add(int(self.approval_duration.total_seconds()
1924
                             * 1000), self._reset_approved)
581 by Teddy Hogeborn
* mandos (Client.enable, Client.disable, ClientDBus.approve): Call
1925
        self.send_changedstate()
874 by Teddy Hogeborn
PEP8 compliance: mandos
1926
1927
    #  D-Bus methods, signals & properties
1928
1929
    #  Interfaces
1930
1931
    #  Signals
1932
237.1.2 by Teddy Hogeborn
Further steps towards a D-Bus server interface, plus minor syntax
1933
    # CheckerCompleted - signal
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1934
    @dbus.service.signal(_interface, signature="nxs")
280 by Teddy Hogeborn
* mandos (Client.CheckerCompleted): Changed signature to "nxs"; return
1935
    def CheckerCompleted(self, exitcode, waitstatus, command):
237.1.2 by Teddy Hogeborn
Further steps towards a D-Bus server interface, plus minor syntax
1936
        "D-Bus signal"
1937
        pass
874 by Teddy Hogeborn
PEP8 compliance: mandos
1938
237.1.2 by Teddy Hogeborn
Further steps towards a D-Bus server interface, plus minor syntax
1939
    # CheckerStarted - signal
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1940
    @dbus.service.signal(_interface, signature="s")
237.1.2 by Teddy Hogeborn
Further steps towards a D-Bus server interface, plus minor syntax
1941
    def CheckerStarted(self, command):
1942
        "D-Bus signal"
1943
        pass
874 by Teddy Hogeborn
PEP8 compliance: mandos
1944
238 by Teddy Hogeborn
First version of a somewhat complete D-Bus server interface. Also
1945
    # PropertyChanged - signal
732 by Teddy Hogeborn
Emit D-Bus "org.freedesktop.DBus.Properties.PropertiesChanged" signal.
1946
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1947
    @dbus.service.signal(_interface, signature="sv")
238 by Teddy Hogeborn
First version of a somewhat complete D-Bus server interface. Also
1948
    def PropertyChanged(self, property, value):
1949
        "D-Bus signal"
1950
        pass
874 by Teddy Hogeborn
PEP8 compliance: mandos
1951
387 by Teddy Hogeborn
* mandos (ClientDBus.ReceivedSecret): Renamed to "GotSecret". All
1952
    # GotSecret - signal
327 by Teddy Hogeborn
Merge from pipe IPC branch.
1953
    @dbus.service.signal(_interface)
387 by Teddy Hogeborn
* mandos (ClientDBus.ReceivedSecret): Renamed to "GotSecret". All
1954
    def GotSecret(self):
24.1.155 by Björn Påhlsson
mandos server: Added debuglevel that adjust at what level information
1955
        """D-Bus signal
1956
        Is sent after a successful transfer of secret from the Mandos
1957
        server to mandos-client
1958
        """
24.2.4 by teddy at bsnet
* mandos (ClientDBus.approvals_pending): Changed to be a property
1959
        pass
874 by Teddy Hogeborn
PEP8 compliance: mandos
1960
327 by Teddy Hogeborn
Merge from pipe IPC branch.
1961
    # Rejected - signal
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1962
    @dbus.service.signal(_interface, signature="s")
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1963
    def Rejected(self, reason):
1964
        "D-Bus signal"
24.2.4 by teddy at bsnet
* mandos (ClientDBus.approvals_pending): Changed to be a property
1965
        pass
874 by Teddy Hogeborn
PEP8 compliance: mandos
1966
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1967
    # NeedApproval - signal
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1968
    @dbus.service.signal(_interface, signature="tb")
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1969
    def NeedApproval(self, timeout, default):
327 by Teddy Hogeborn
Merge from pipe IPC branch.
1970
        "D-Bus signal"
442 by Teddy Hogeborn
* DBUS-API: Document new "LastApprovalRequest" client property.
1971
        return self.need_approval()
874 by Teddy Hogeborn
PEP8 compliance: mandos
1972
1973
    #  Methods
1974
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1975
    # Approve - method
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1976
    @dbus.service.method(_interface, in_signature="b")
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1977
    def Approve(self, value):
1978
        self.approve(value)
874 by Teddy Hogeborn
PEP8 compliance: mandos
1979
24.1.147 by Björn Påhlsson
The IPC pipes are now file objects, not file descriptors:
1980
    # CheckedOK - method
1981
    @dbus.service.method(_interface)
1982
    def CheckedOK(self):
482 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
1983
        self.checked_ok()
874 by Teddy Hogeborn
PEP8 compliance: mandos
1984
381 by Teddy Hogeborn
Restore some poor D-Bus methods who got a bit hastily deleted. Enable
1985
    # Enable - method
781 by Teddy Hogeborn
Deprecate some D-Bus methods in favor of D-Bus properties.
1986
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
381 by Teddy Hogeborn
Restore some poor D-Bus methods who got a bit hastily deleted. Enable
1987
    @dbus.service.method(_interface)
1988
    def Enable(self):
1989
        "D-Bus method"
1990
        self.enable()
874 by Teddy Hogeborn
PEP8 compliance: mandos
1991
381 by Teddy Hogeborn
Restore some poor D-Bus methods who got a bit hastily deleted. Enable
1992
    # StartChecker - method
781 by Teddy Hogeborn
Deprecate some D-Bus methods in favor of D-Bus properties.
1993
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
381 by Teddy Hogeborn
Restore some poor D-Bus methods who got a bit hastily deleted. Enable
1994
    @dbus.service.method(_interface)
1995
    def StartChecker(self):
1996
        "D-Bus method"
1997
        self.start_checker()
874 by Teddy Hogeborn
PEP8 compliance: mandos
1998
381 by Teddy Hogeborn
Restore some poor D-Bus methods who got a bit hastily deleted. Enable
1999
    # Disable - method
781 by Teddy Hogeborn
Deprecate some D-Bus methods in favor of D-Bus properties.
2000
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
381 by Teddy Hogeborn
Restore some poor D-Bus methods who got a bit hastily deleted. Enable
2001
    @dbus.service.method(_interface)
2002
    def Disable(self):
2003
        "D-Bus method"
2004
        self.disable()
874 by Teddy Hogeborn
PEP8 compliance: mandos
2005
381 by Teddy Hogeborn
Restore some poor D-Bus methods who got a bit hastily deleted. Enable
2006
    # StopChecker - method
781 by Teddy Hogeborn
Deprecate some D-Bus methods in favor of D-Bus properties.
2007
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
381 by Teddy Hogeborn
Restore some poor D-Bus methods who got a bit hastily deleted. Enable
2008
    @dbus.service.method(_interface)
2009
    def StopChecker(self):
2010
        self.stop_checker()
874 by Teddy Hogeborn
PEP8 compliance: mandos
2011
2012
    #  Properties
2013
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2014
    # ApprovalPending - property
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2015
    @dbus_service_property(_interface, signature="b", access="read")
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2016
    def ApprovalPending_dbus_property(self):
24.2.4 by teddy at bsnet
* mandos (ClientDBus.approvals_pending): Changed to be a property
2017
        return dbus.Boolean(bool(self.approvals_pending))
874 by Teddy Hogeborn
PEP8 compliance: mandos
2018
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2019
    # ApprovedByDefault - property
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2020
    @dbus_service_property(_interface,
2021
                           signature="b",
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2022
                           access="readwrite")
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2023
    def ApprovedByDefault_dbus_property(self, value=None):
2024
        if value is None:       # get
2025
            return dbus.Boolean(self.approved_by_default)
2026
        self.approved_by_default = bool(value)
874 by Teddy Hogeborn
PEP8 compliance: mandos
2027
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2028
    # ApprovalDelay - property
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2029
    @dbus_service_property(_interface,
2030
                           signature="t",
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2031
                           access="readwrite")
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2032
    def ApprovalDelay_dbus_property(self, value=None):
2033
        if value is None:       # get
723.1.6 by Teddy Hogeborn
Use the new .total_seconds() method on datetime.timedelta objects.
2034
            return dbus.UInt64(self.approval_delay.total_seconds()
2035
                               * 1000)
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2036
        self.approval_delay = datetime.timedelta(0, 0, 0, value)
874 by Teddy Hogeborn
PEP8 compliance: mandos
2037
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2038
    # ApprovalDuration - property
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2039
    @dbus_service_property(_interface,
2040
                           signature="t",
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2041
                           access="readwrite")
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2042
    def ApprovalDuration_dbus_property(self, value=None):
2043
        if value is None:       # get
723.1.6 by Teddy Hogeborn
Use the new .total_seconds() method on datetime.timedelta objects.
2044
            return dbus.UInt64(self.approval_duration.total_seconds()
2045
                               * 1000)
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2046
        self.approval_duration = datetime.timedelta(0, 0, 0, value)
874 by Teddy Hogeborn
PEP8 compliance: mandos
2047
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2048
    # Name - property
780 by Teddy Hogeborn
Add D-Bus annotations on a few properties on the Client object.
2049
    @dbus_annotations(
2050
        {"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2051
    @dbus_service_property(_interface, signature="s", access="read")
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2052
    def Name_dbus_property(self):
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
2053
        return dbus.String(self.name)
874 by Teddy Hogeborn
PEP8 compliance: mandos
2054
962 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
2055
    # KeyID - property
2056
    @dbus_annotations(
2057
        {"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2058
    @dbus_service_property(_interface, signature="s", access="read")
2059
    def KeyID_dbus_property(self):
2060
        return dbus.String(self.key_id)
2061
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2062
    # Fingerprint - property
780 by Teddy Hogeborn
Add D-Bus annotations on a few properties on the Client object.
2063
    @dbus_annotations(
2064
        {"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2065
    @dbus_service_property(_interface, signature="s", access="read")
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2066
    def Fingerprint_dbus_property(self):
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
2067
        return dbus.String(self.fingerprint)
874 by Teddy Hogeborn
PEP8 compliance: mandos
2068
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2069
    # Host - property
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2070
    @dbus_service_property(_interface,
2071
                           signature="s",
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2072
                           access="readwrite")
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2073
    def Host_dbus_property(self, value=None):
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
2074
        if value is None:       # get
2075
            return dbus.String(self.host)
730 by Teddy Hogeborn
mandos: Replace unicode() with str().
2076
        self.host = str(value)
874 by Teddy Hogeborn
PEP8 compliance: mandos
2077
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2078
    # Created - property
780 by Teddy Hogeborn
Add D-Bus annotations on a few properties on the Client object.
2079
    @dbus_annotations(
2080
        {"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2081
    @dbus_service_property(_interface, signature="s", access="read")
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2082
    def Created_dbus_property(self):
518.2.3 by Teddy Hogeborn
Make "enabled" a client config option.
2083
        return datetime_to_dbus(self.created)
874 by Teddy Hogeborn
PEP8 compliance: mandos
2084
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2085
    # LastEnabled - property
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2086
    @dbus_service_property(_interface, signature="s", access="read")
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2087
    def LastEnabled_dbus_property(self):
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
2088
        return datetime_to_dbus(self.last_enabled)
874 by Teddy Hogeborn
PEP8 compliance: mandos
2089
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2090
    # Enabled - property
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2091
    @dbus_service_property(_interface,
2092
                           signature="b",
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2093
                           access="readwrite")
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2094
    def Enabled_dbus_property(self, value=None):
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
2095
        if value is None:       # get
2096
            return dbus.Boolean(self.enabled)
2097
        if value:
2098
            self.enable()
2099
        else:
2100
            self.disable()
874 by Teddy Hogeborn
PEP8 compliance: mandos
2101
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2102
    # LastCheckedOK - property
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2103
    @dbus_service_property(_interface,
2104
                           signature="s",
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2105
                           access="readwrite")
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2106
    def LastCheckedOK_dbus_property(self, value=None):
381 by Teddy Hogeborn
Restore some poor D-Bus methods who got a bit hastily deleted. Enable
2107
        if value is not None:
2108
            self.checked_ok()
2109
            return
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
2110
        return datetime_to_dbus(self.last_checked_ok)
874 by Teddy Hogeborn
PEP8 compliance: mandos
2111
556 by Teddy Hogeborn
* DBUS-API (se.recompile.Mandos.Client.LastCheckerStatus): New
2112
    # LastCheckerStatus - property
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2113
    @dbus_service_property(_interface, signature="n", access="read")
556 by Teddy Hogeborn
* DBUS-API (se.recompile.Mandos.Client.LastCheckerStatus): New
2114
    def LastCheckerStatus_dbus_property(self):
2115
        return dbus.Int16(self.last_checker_status)
874 by Teddy Hogeborn
PEP8 compliance: mandos
2116
24.1.179 by Björn Påhlsson
New feature:
2117
    # Expires - property
2118
    @dbus_service_property(_interface, signature="s", access="read")
2119
    def Expires_dbus_property(self):
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
2120
        return datetime_to_dbus(self.expires)
874 by Teddy Hogeborn
PEP8 compliance: mandos
2121
442 by Teddy Hogeborn
* DBUS-API: Document new "LastApprovalRequest" client property.
2122
    # LastApprovalRequest - property
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2123
    @dbus_service_property(_interface, signature="s", access="read")
442 by Teddy Hogeborn
* DBUS-API: Document new "LastApprovalRequest" client property.
2124
    def LastApprovalRequest_dbus_property(self):
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
2125
        return datetime_to_dbus(self.last_approval_request)
874 by Teddy Hogeborn
PEP8 compliance: mandos
2126
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2127
    # Timeout - property
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2128
    @dbus_service_property(_interface,
2129
                           signature="t",
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2130
                           access="readwrite")
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2131
    def Timeout_dbus_property(self, value=None):
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
2132
        if value is None:       # get
723.1.6 by Teddy Hogeborn
Use the new .total_seconds() method on datetime.timedelta objects.
2133
            return dbus.UInt64(self.timeout.total_seconds() * 1000)
581 by Teddy Hogeborn
* mandos (Client.enable, Client.disable, ClientDBus.approve): Call
2134
        old_timeout = self.timeout
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
2135
        self.timeout = datetime.timedelta(0, 0, 0, value)
581 by Teddy Hogeborn
* mandos (Client.enable, Client.disable, ClientDBus.approve): Call
2136
        # Reschedule disabling
543 by Teddy Hogeborn
* mandos: Break some long lines.
2137
        if self.enabled:
2138
            now = datetime.datetime.utcnow()
581 by Teddy Hogeborn
* mandos (Client.enable, Client.disable, ClientDBus.approve): Call
2139
            self.expires += self.timeout - old_timeout
2140
            if self.expires <= now:
543 by Teddy Hogeborn
* mandos: Break some long lines.
2141
                # The timeout has passed
2142
                self.disable()
2143
            else:
2144
                if (getattr(self, "disable_initiator_tag", None)
2145
                    is None):
2146
                    return
830 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
2147
                GLib.source_remove(self.disable_initiator_tag)
2148
                self.disable_initiator_tag = GLib.timeout_add(
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2149
                    int((self.expires - now).total_seconds() * 1000),
2150
                    self.disable)
874 by Teddy Hogeborn
PEP8 compliance: mandos
2151
24.1.179 by Björn Påhlsson
New feature:
2152
    # ExtendedTimeout - property
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2153
    @dbus_service_property(_interface,
2154
                           signature="t",
24.1.179 by Björn Påhlsson
New feature:
2155
                           access="readwrite")
2156
    def ExtendedTimeout_dbus_property(self, value=None):
2157
        if value is None:       # get
723.1.6 by Teddy Hogeborn
Use the new .total_seconds() method on datetime.timedelta objects.
2158
            return dbus.UInt64(self.extended_timeout.total_seconds()
2159
                               * 1000)
24.1.179 by Björn Påhlsson
New feature:
2160
        self.extended_timeout = datetime.timedelta(0, 0, 0, value)
874 by Teddy Hogeborn
PEP8 compliance: mandos
2161
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2162
    # Interval - property
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2163
    @dbus_service_property(_interface,
2164
                           signature="t",
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2165
                           access="readwrite")
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2166
    def Interval_dbus_property(self, value=None):
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
2167
        if value is None:       # get
723.1.6 by Teddy Hogeborn
Use the new .total_seconds() method on datetime.timedelta objects.
2168
            return dbus.UInt64(self.interval.total_seconds() * 1000)
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
2169
        self.interval = datetime.timedelta(0, 0, 0, value)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2170
        if getattr(self, "checker_initiator_tag", None) is None:
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
2171
            return
518.2.3 by Teddy Hogeborn
Make "enabled" a client config option.
2172
        if self.enabled:
2173
            # Reschedule checker run
830 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
2174
            GLib.source_remove(self.checker_initiator_tag)
2175
            self.checker_initiator_tag = GLib.timeout_add(
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2176
                value, self.start_checker)
874 by Teddy Hogeborn
PEP8 compliance: mandos
2177
            self.start_checker()  # Start one now, too
2178
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2179
    # Checker - property
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2180
    @dbus_service_property(_interface,
2181
                           signature="s",
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2182
                           access="readwrite")
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2183
    def Checker_dbus_property(self, value=None):
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
2184
        if value is None:       # get
2185
            return dbus.String(self.checker_command)
730 by Teddy Hogeborn
mandos: Replace unicode() with str().
2186
        self.checker_command = str(value)
874 by Teddy Hogeborn
PEP8 compliance: mandos
2187
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2188
    # CheckerRunning - property
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2189
    @dbus_service_property(_interface,
2190
                           signature="b",
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2191
                           access="readwrite")
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2192
    def CheckerRunning_dbus_property(self, value=None):
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
2193
        if value is None:       # get
2194
            return dbus.Boolean(self.checker is not None)
2195
        if value:
2196
            self.start_checker()
2197
        else:
2198
            self.stop_checker()
874 by Teddy Hogeborn
PEP8 compliance: mandos
2199
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2200
    # ObjectPath - property
780 by Teddy Hogeborn
Add D-Bus annotations on a few properties on the Client object.
2201
    @dbus_annotations(
782 by Teddy Hogeborn
Deprecate the D-Bus property "se.recompile.Mandos.Client.ObjectPath".
2202
        {"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",
2203
         "org.freedesktop.DBus.Deprecated": "true"})
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2204
    @dbus_service_property(_interface, signature="o", access="read")
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2205
    def ObjectPath_dbus_property(self):
874 by Teddy Hogeborn
PEP8 compliance: mandos
2206
        return self.dbus_object_path  # is already a dbus.ObjectPath
2207
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2208
    # Secret = property
780 by Teddy Hogeborn
Add D-Bus annotations on a few properties on the Client object.
2209
    @dbus_annotations(
2210
        {"org.freedesktop.DBus.Property.EmitsChangedSignal":
2211
         "invalidates"})
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2212
    @dbus_service_property(_interface,
2213
                           signature="ay",
2214
                           access="write",
2215
                           byte_arrays=True)
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2216
    def Secret_dbus_property(self, value):
729 by Teddy Hogeborn
mandos: Stop using str() and remove unnecessary unicode() calls.
2217
        self.secret = bytes(value)
874 by Teddy Hogeborn
PEP8 compliance: mandos
2218
237.1.2 by Teddy Hogeborn
Further steps towards a D-Bus server interface, plus minor syntax
2219
    del _interface
3 by Björn Påhlsson
Python based server
2220
2221
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2222
class ProxyClient(object):
962 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
2223
    def __init__(self, child_pipe, key_id, fpr, address):
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2224
        self._pipe = child_pipe
962 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
2225
        self._pipe.send(('init', key_id, fpr, address))
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2226
        if not self._pipe.recv():
962 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
2227
            raise KeyError(key_id or fpr)
874 by Teddy Hogeborn
PEP8 compliance: mandos
2228
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2229
    def __getattribute__(self, name):
518.2.4 by Teddy Hogeborn
* mandos (_timedelta_to_milliseconds): Renamed to
2230
        if name == '_pipe':
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2231
            return super(ProxyClient, self).__getattribute__(name)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2232
        self._pipe.send(('getattr', name))
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2233
        data = self._pipe.recv()
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2234
        if data[0] == 'data':
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2235
            return data[1]
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2236
        if data[0] == 'function':
874 by Teddy Hogeborn
PEP8 compliance: mandos
2237
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2238
            def func(*args, **kwargs):
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2239
                self._pipe.send(('funcall', name, args, kwargs))
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2240
                return self._pipe.recv()[1]
874 by Teddy Hogeborn
PEP8 compliance: mandos
2241
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2242
            return func
874 by Teddy Hogeborn
PEP8 compliance: mandos
2243
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2244
    def __setattr__(self, name, value):
518.2.4 by Teddy Hogeborn
* mandos (_timedelta_to_milliseconds): Renamed to
2245
        if name == '_pipe':
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2246
            return super(ProxyClient, self).__setattr__(name, value)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2247
        self._pipe.send(('setattr', name, value))
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2248
518.1.6 by Teddy Hogeborn
* mandos: Fix whitespace.
2249
335 by Teddy Hogeborn
* mandos: Import "SocketServer" as "socketserver" and "ConfigParser"
2250
class ClientHandler(socketserver.BaseRequestHandler, object):
331 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
2251
    """A class to handle client connections.
874 by Teddy Hogeborn
PEP8 compliance: mandos
2252
331 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
2253
    Instantiated once for each connection to handle it.
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
2254
    Note: This will run in its own forked process."""
874 by Teddy Hogeborn
PEP8 compliance: mandos
2255
3 by Björn Påhlsson
Python based server
2256
    def handle(self):
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2257
        with contextlib.closing(self.server.child_pipe) as child_pipe:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2258
            logger.info("TCP connection from: %s",
730 by Teddy Hogeborn
mandos: Replace unicode() with str().
2259
                        str(self.client_address))
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2260
            logger.debug("Pipe FD: %d",
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2261
                         self.server.child_pipe.fileno())
874 by Teddy Hogeborn
PEP8 compliance: mandos
2262
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
2263
            session = gnutls.ClientSession(self.request)
874 by Teddy Hogeborn
PEP8 compliance: mandos
2264
2265
            # priority = ':'.join(("NONE", "+VERS-TLS1.1",
2266
            #                       "+AES-256-CBC", "+SHA1",
2267
            #                       "+COMP-NULL", "+CTYPE-OPENPGP",
2268
            #                       "+DHE-DSS"))
288.1.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
2269
            # Use a fallback default, since this MUST be set.
331 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
2270
            priority = self.server.gnutls_priority
2271
            if priority is None:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2272
                priority = "NORMAL"
851 by Teddy Hogeborn
mandos: Minor bug fix for Python 3
2273
            gnutls.priority_set_direct(session._c_object,
2274
                                       priority.encode("utf-8"),
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
2275
                                       None)
874 by Teddy Hogeborn
PEP8 compliance: mandos
2276
416.1.2 by Teddy Hogeborn
* mandos (ClientHandler.handle): Set up the GnuTLS session object
2277
            # Start communication using the Mandos protocol
2278
            # Get protocol number
2279
            line = self.request.makefile().readline()
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2280
            logger.debug("Protocol version: %r", line)
416.1.2 by Teddy Hogeborn
* mandos (ClientHandler.handle): Set up the GnuTLS session object
2281
            try:
2282
                if int(line.strip().split()[0]) > 1:
642 by Teddy Hogeborn
Syntax fix; use "raise" better in Mandos server.
2283
                    raise RuntimeError(line)
482 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
2284
            except (ValueError, IndexError, RuntimeError) as error:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2285
                logger.error("Unknown protocol version: %s", error)
416.1.2 by Teddy Hogeborn
* mandos (ClientHandler.handle): Set up the GnuTLS session object
2286
                return
874 by Teddy Hogeborn
PEP8 compliance: mandos
2287
416.1.2 by Teddy Hogeborn
* mandos (ClientHandler.handle): Set up the GnuTLS session object
2288
            # Start GnuTLS connection
288.1.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
2289
            try:
2290
                session.handshake()
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
2291
            except gnutls.Error as error:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2292
                logger.warning("Handshake failed: %s", error)
288.1.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
2293
                # Do not run session.bye() here: the session is not
2294
                # established.  Just abandon the request.
2295
                return
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2296
            logger.debug("Handshake succeeded")
874 by Teddy Hogeborn
PEP8 compliance: mandos
2297
24.1.150 by Björn Påhlsson
* mandos: Added ClientDBus.approve_pending property. Exposed
2298
            approval_required = False
288.1.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
2299
            try:
962 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
2300
                if gnutls.has_rawpk:
2301
                    fpr = ""
2302
                    try:
2303
                        key_id = self.key_id(
2304
                            self.peer_certificate(session))
2305
                    except (TypeError, gnutls.Error) as error:
2306
                        logger.warning("Bad certificate: %s", error)
2307
                        return
2308
                    logger.debug("Key ID: %s", key_id)
2309
2310
                else:
2311
                    key_id = ""
2312
                    try:
2313
                        fpr = self.fingerprint(
2314
                            self.peer_certificate(session))
2315
                    except (TypeError, gnutls.Error) as error:
2316
                        logger.warning("Bad certificate: %s", error)
2317
                        return
2318
                    logger.debug("Fingerprint: %s", fpr)
2319
2320
                try:
2321
                    client = ProxyClient(child_pipe, key_id, fpr,
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2322
                                         self.client_address)
2323
                except KeyError:
411 by Teddy Hogeborn
More consistent terminology: Clients are no longer "invalid" - they
2324
                    return
874 by Teddy Hogeborn
PEP8 compliance: mandos
2325
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2326
                if client.approval_delay:
2327
                    delay = client.approval_delay
24.1.150 by Björn Påhlsson
* mandos: Added ClientDBus.approve_pending property. Exposed
2328
                    client.approvals_pending += 1
2329
                    approval_required = True
874 by Teddy Hogeborn
PEP8 compliance: mandos
2330
24.1.148 by Björn Påhlsson
half working on-demand password and approved code
2331
                while True:
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2332
                    if not client.enabled:
24.1.174 by Björn Påhlsson
* Makefile (CFLAGS): Added "-lrt" to include real time library.
2333
                        logger.info("Client %s is disabled",
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2334
                                    client.name)
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2335
                        if self.server.use_dbus:
2336
                            # Emit D-Bus signal
505.1.3 by Teddy Hogeborn
* mandos: Break long lines.
2337
                            client.Rejected("Disabled")
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2338
                        return
874 by Teddy Hogeborn
PEP8 compliance: mandos
2339
518.2.4 by Teddy Hogeborn
* mandos (_timedelta_to_milliseconds): Renamed to
2340
                    if client.approved or not client.approval_delay:
874 by Teddy Hogeborn
PEP8 compliance: mandos
2341
                        # We are approved or approval is disabled
24.1.150 by Björn Påhlsson
* mandos: Added ClientDBus.approve_pending property. Exposed
2342
                        break
518.2.4 by Teddy Hogeborn
* mandos (_timedelta_to_milliseconds): Renamed to
2343
                    elif client.approved is None:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2344
                        logger.info("Client %s needs approval",
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2345
                                    client.name)
2346
                        if self.server.use_dbus:
2347
                            # Emit D-Bus signal
2348
                            client.NeedApproval(
723.1.6 by Teddy Hogeborn
Use the new .total_seconds() method on datetime.timedelta objects.
2349
                                client.approval_delay.total_seconds()
2350
                                * 1000, client.approved_by_default)
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2351
                    else:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2352
                        logger.warning("Client %s was not approved",
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2353
                                       client.name)
2354
                        if self.server.use_dbus:
24.1.150 by Björn Påhlsson
* mandos: Added ClientDBus.approve_pending property. Exposed
2355
                            # Emit D-Bus signal
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2356
                            client.Rejected("Denied")
24.1.148 by Björn Påhlsson
half working on-demand password and approved code
2357
                        return
874 by Teddy Hogeborn
PEP8 compliance: mandos
2358
2359
                    # wait until timeout or approved
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2360
                    time = datetime.datetime.now()
2361
                    client.changedstate.acquire()
723.1.6 by Teddy Hogeborn
Use the new .total_seconds() method on datetime.timedelta objects.
2362
                    client.changedstate.wait(delay.total_seconds())
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2363
                    client.changedstate.release()
2364
                    time2 = datetime.datetime.now()
2365
                    if (time2 - time) >= delay:
2366
                        if not client.approved_by_default:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2367
                            logger.warning("Client %s timed out while"
2368
                                           " waiting for approval",
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2369
                                           client.name)
2370
                            if self.server.use_dbus:
2371
                                # Emit D-Bus signal
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2372
                                client.Rejected("Approval timed out")
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2373
                            return
2374
                        else:
2375
                            break
2376
                    else:
2377
                        delay -= time2 - time
874 by Teddy Hogeborn
PEP8 compliance: mandos
2378
802 by Teddy Hogeborn
Handle GnuTLS errors and partial sends in gnutls "module".
2379
                try:
2380
                    session.send(client.secret)
2381
                except gnutls.Error as error:
2382
                    logger.warning("gnutls send failed",
874 by Teddy Hogeborn
PEP8 compliance: mandos
2383
                                   exc_info=error)
802 by Teddy Hogeborn
Handle GnuTLS errors and partial sends in gnutls "module".
2384
                    return
874 by Teddy Hogeborn
PEP8 compliance: mandos
2385
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2386
                logger.info("Sending secret to %s", client.name)
505.1.13 by Teddy Hogeborn
Miscellaneous fixes prompted by lintian:
2387
                # bump the timeout using extended_timeout
556 by Teddy Hogeborn
* DBUS-API (se.recompile.Mandos.Client.LastCheckerStatus): New
2388
                client.bump_timeout(client.extended_timeout)
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2389
                if self.server.use_dbus:
2390
                    # Emit D-Bus signal
2391
                    client.GotSecret()
874 by Teddy Hogeborn
PEP8 compliance: mandos
2392
411 by Teddy Hogeborn
More consistent terminology: Clients are no longer "invalid" - they
2393
            finally:
24.1.150 by Björn Påhlsson
* mandos: Added ClientDBus.approve_pending property. Exposed
2394
                if approval_required:
2395
                    client.approvals_pending -= 1
24.1.155 by Björn Påhlsson
mandos server: Added debuglevel that adjust at what level information
2396
                try:
2397
                    session.bye()
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
2398
                except gnutls.Error as error:
574 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
2399
                    logger.warning("GnuTLS bye failed",
2400
                                   exc_info=error)
874 by Teddy Hogeborn
PEP8 compliance: mandos
2401
330 by Teddy Hogeborn
* mandos (peer_certificate, fingerprint): Moved into "TCP_handler"
2402
    @staticmethod
2403
    def peer_certificate(session):
962 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
2404
        "Return the peer's certificate as a bytestring"
2405
        try:
2406
            cert_type = gnutls.certificate_type_get2(session._c_object,
2407
                                                     gnutls.CTYPE_PEERS)
2408
        except AttributeError:
2409
            cert_type = gnutls.certificate_type_get(session._c_object)
2410
        if gnutls.has_rawpk:
2411
            valid_cert_types = frozenset((gnutls.CRT_RAWPK,))
2412
        else:
2413
            valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))
2414
        # If not a valid certificate type...
2415
        if cert_type not in valid_cert_types:
2416
            logger.info("Cert type %r not in %r", cert_type,
2417
                        valid_cert_types)
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
2418
            # ...return invalid data
2419
            return b""
330 by Teddy Hogeborn
* mandos (peer_certificate, fingerprint): Moved into "TCP_handler"
2420
        list_size = ctypes.c_uint(1)
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
2421
        cert_list = (gnutls.certificate_get_peers
330 by Teddy Hogeborn
* mandos (peer_certificate, fingerprint): Moved into "TCP_handler"
2422
                     (session._c_object, ctypes.byref(list_size)))
2423
        if not bool(cert_list) and list_size.value != 0:
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
2424
            raise gnutls.Error("error getting peer certificate")
330 by Teddy Hogeborn
* mandos (peer_certificate, fingerprint): Moved into "TCP_handler"
2425
        if list_size.value == 0:
2426
            return None
2427
        cert = cert_list[0]
2428
        return ctypes.string_at(cert.data, cert.size)
874 by Teddy Hogeborn
PEP8 compliance: mandos
2429
330 by Teddy Hogeborn
* mandos (peer_certificate, fingerprint): Moved into "TCP_handler"
2430
    @staticmethod
962 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
2431
    def key_id(certificate):
2432
        "Convert a certificate bytestring to a hexdigit key ID"
2433
        # New GnuTLS "datum" with the public key
2434
        datum = gnutls.datum_t(
2435
            ctypes.cast(ctypes.c_char_p(certificate),
2436
                        ctypes.POINTER(ctypes.c_ubyte)),
2437
            ctypes.c_uint(len(certificate)))
2438
        # XXX all these need to be created in the gnutls "module"
2439
        # New empty GnuTLS certificate
2440
        pubkey = gnutls.pubkey_t()
2441
        gnutls.pubkey_init(ctypes.byref(pubkey))
2442
        # Import the raw public key into the certificate
2443
        gnutls.pubkey_import(pubkey,
2444
                             ctypes.byref(datum),
2445
                             gnutls.X509_FMT_DER)
2446
        # New buffer for the key ID
2447
        buf = ctypes.create_string_buffer(32)
2448
        buf_len = ctypes.c_size_t(len(buf))
2449
        # Get the key ID from the raw public key into the buffer
2450
        gnutls.pubkey_get_key_id(pubkey,
2451
                                 gnutls.KEYID_USE_SHA256,
2452
                                 ctypes.cast(ctypes.byref(buf),
2453
                                             ctypes.POINTER(ctypes.c_ubyte)),
2454
                                 ctypes.byref(buf_len))
2455
        # Deinit the certificate
2456
        gnutls.pubkey_deinit(pubkey)
2457
2458
        # Convert the buffer to a Python bytestring
2459
        key_id = ctypes.string_at(buf, buf_len.value)
2460
        # Convert the bytestring to hexadecimal notation
2461
        hex_key_id = binascii.hexlify(key_id).upper()
2462
        return hex_key_id
2463
2464
    @staticmethod
330 by Teddy Hogeborn
* mandos (peer_certificate, fingerprint): Moved into "TCP_handler"
2465
    def fingerprint(openpgp):
2466
        "Convert an OpenPGP bytestring to a hexdigit fingerprint"
2467
        # New GnuTLS "datum" with the OpenPGP public key
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
2468
        datum = gnutls.datum_t(
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2469
            ctypes.cast(ctypes.c_char_p(openpgp),
2470
                        ctypes.POINTER(ctypes.c_ubyte)),
2471
            ctypes.c_uint(len(openpgp)))
330 by Teddy Hogeborn
* mandos (peer_certificate, fingerprint): Moved into "TCP_handler"
2472
        # New empty GnuTLS certificate
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
2473
        crt = gnutls.openpgp_crt_t()
2474
        gnutls.openpgp_crt_init(ctypes.byref(crt))
330 by Teddy Hogeborn
* mandos (peer_certificate, fingerprint): Moved into "TCP_handler"
2475
        # Import the OpenPGP public key into the certificate
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
2476
        gnutls.openpgp_crt_import(crt, ctypes.byref(datum),
2477
                                  gnutls.OPENPGP_FMT_RAW)
330 by Teddy Hogeborn
* mandos (peer_certificate, fingerprint): Moved into "TCP_handler"
2478
        # Verify the self signature in the key
2479
        crtverify = ctypes.c_uint()
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
2480
        gnutls.openpgp_crt_verify_self(crt, 0,
2481
                                       ctypes.byref(crtverify))
330 by Teddy Hogeborn
* mandos (peer_certificate, fingerprint): Moved into "TCP_handler"
2482
        if crtverify.value != 0:
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
2483
            gnutls.openpgp_crt_deinit(crt)
950 by Teddy Hogeborn
mandos: Better error message if self-signature verification fails
2484
            raise gnutls.CertificateSecurityError(code
2485
                                                  =crtverify.value)
330 by Teddy Hogeborn
* mandos (peer_certificate, fingerprint): Moved into "TCP_handler"
2486
        # New buffer for the fingerprint
2487
        buf = ctypes.create_string_buffer(20)
2488
        buf_len = ctypes.c_size_t()
2489
        # Get the fingerprint from the certificate into the buffer
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
2490
        gnutls.openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
2491
                                           ctypes.byref(buf_len))
330 by Teddy Hogeborn
* mandos (peer_certificate, fingerprint): Moved into "TCP_handler"
2492
        # Deinit the certificate
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
2493
        gnutls.openpgp_crt_deinit(crt)
330 by Teddy Hogeborn
* mandos (peer_certificate, fingerprint): Moved into "TCP_handler"
2494
        # Convert the buffer to a Python bytestring
2495
        fpr = ctypes.string_at(buf, buf_len.value)
2496
        # Convert the bytestring to hexadecimal notation
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
2497
        hex_fpr = binascii.hexlify(fpr).upper()
330 by Teddy Hogeborn
* mandos (peer_certificate, fingerprint): Moved into "TCP_handler"
2498
        return hex_fpr
288.1.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
2499
2500
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2501
class MultiprocessingMixIn(object):
2502
    """Like socketserver.ThreadingMixIn, but with multiprocessing"""
874 by Teddy Hogeborn
PEP8 compliance: mandos
2503
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2504
    def sub_process_main(self, request, address):
2505
        try:
2506
            self.finish_request(request, address)
518.1.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
2507
        except Exception:
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2508
            self.handle_error(request, address)
2509
        self.close_request(request)
874 by Teddy Hogeborn
PEP8 compliance: mandos
2510
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2511
    def process_request(self, request, address):
2512
        """Start a new process to process the request."""
874 by Teddy Hogeborn
PEP8 compliance: mandos
2513
        proc = multiprocessing.Process(target=self.sub_process_main,
2514
                                       args=(request, address))
505.1.11 by Teddy Hogeborn
* mandos (Client.checked_ok): Set "expires" after setting timeout.
2515
        proc.start()
2516
        return proc
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2517
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
2518
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2519
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
2520
    """ adds a pipe to the MixIn """
874 by Teddy Hogeborn
PEP8 compliance: mandos
2521
288.1.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
2522
    def process_request(self, request, client_address):
331 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
2523
        """Overrides and wraps the original process_request().
874 by Teddy Hogeborn
PEP8 compliance: mandos
2524
355 by Teddy Hogeborn
* mandos: White-space fixes only.
2525
        This function creates a new pipe in self.pipe
288.1.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
2526
        """
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2527
        parent_pipe, self.child_pipe = multiprocessing.Pipe()
874 by Teddy Hogeborn
PEP8 compliance: mandos
2528
505.1.11 by Teddy Hogeborn
* mandos (Client.checked_ok): Set "expires" after setting timeout.
2529
        proc = MultiprocessingMixIn.process_request(self, request,
2530
                                                    client_address)
24.1.152 by Björn Påhlsson
bug fixes that prevent problems when runing server as root
2531
        self.child_pipe.close()
505.1.11 by Teddy Hogeborn
* mandos (Client.checked_ok): Set "expires" after setting timeout.
2532
        self.add_pipe(parent_pipe, proc)
874 by Teddy Hogeborn
PEP8 compliance: mandos
2533
505.1.11 by Teddy Hogeborn
* mandos (Client.checked_ok): Set "expires" after setting timeout.
2534
    def add_pipe(self, parent_pipe, proc):
288.1.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
2535
        """Dummy function; override as necessary"""
642 by Teddy Hogeborn
Syntax fix; use "raise" better in Mandos server.
2536
        raise NotImplementedError()
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2537
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
2538
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2539
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
335 by Teddy Hogeborn
* mandos: Import "SocketServer" as "socketserver" and "ConfigParser"
2540
                     socketserver.TCPServer, object):
237.2.13 by Teddy Hogeborn
Merge from trunk. Notable changes:
2541
    """IPv6-capable TCP server.  Accepts 'None' as address and/or port
874 by Teddy Hogeborn
PEP8 compliance: mandos
2542
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
2543
    Attributes:
331 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
2544
        enabled:        Boolean; whether this server is activated yet
2545
        interface:      None or a network interface name (string)
2546
        use_ipv6:       Boolean; to use IPv6 or not
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
2547
    """
874 by Teddy Hogeborn
PEP8 compliance: mandos
2548
331 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
2549
    def __init__(self, server_address, RequestHandlerClass,
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2550
                 interface=None,
2551
                 use_ipv6=True,
2552
                 socketfd=None):
589.1.1 by Teddy Hogeborn
* mandos: Implement "--socket" option.
2553
        """If socketfd is set, use that file descriptor instead of
2554
        creating a new one with socket.socket().
2555
        """
331 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
2556
        self.interface = interface
2557
        if use_ipv6:
2558
            self.address_family = socket.AF_INET6
589.1.1 by Teddy Hogeborn
* mandos: Implement "--socket" option.
2559
        if socketfd is not None:
2560
            # Save the file descriptor
2561
            self.socketfd = socketfd
2562
            # Save the original socket.socket() function
2563
            self.socket_socket = socket.socket
874 by Teddy Hogeborn
PEP8 compliance: mandos
2564
589.1.1 by Teddy Hogeborn
* mandos: Implement "--socket" option.
2565
            # To implement --socket, we monkey patch socket.socket.
874 by Teddy Hogeborn
PEP8 compliance: mandos
2566
            #
589.1.1 by Teddy Hogeborn
* mandos: Implement "--socket" option.
2567
            # (When socketserver.TCPServer is a new-style class, we
2568
            # could make self.socket into a property instead of monkey
2569
            # patching socket.socket.)
874 by Teddy Hogeborn
PEP8 compliance: mandos
2570
            #
589.1.1 by Teddy Hogeborn
* mandos: Implement "--socket" option.
2571
            # Create a one-time-only replacement for socket.socket()
2572
            @functools.wraps(socket.socket)
2573
            def socket_wrapper(*args, **kwargs):
2574
                # Restore original function so subsequent calls are
2575
                # not affected.
2576
                socket.socket = self.socket_socket
2577
                del self.socket_socket
2578
                # This time only, return a new socket object from the
2579
                # saved file descriptor.
2580
                return socket.fromfd(self.socketfd, *args, **kwargs)
2581
            # Replace socket.socket() function with wrapper
2582
            socket.socket = socket_wrapper
2583
        # The socketserver.TCPServer.__init__ will call
2584
        # socket.socket(), which might be our replacement,
2585
        # socket_wrapper(), if socketfd was set.
335 by Teddy Hogeborn
* mandos: Import "SocketServer" as "socketserver" and "ConfigParser"
2586
        socketserver.TCPServer.__init__(self, server_address,
331 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
2587
                                        RequestHandlerClass)
874 by Teddy Hogeborn
PEP8 compliance: mandos
2588
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
2589
    def server_bind(self):
2590
        """This overrides the normal server_bind() function
2591
        to bind to an interface if one was specified, and also NOT to
2592
        bind to an address or port if they were not specified."""
858 by Teddy Hogeborn
Server: Fix bug with --interface flag when "cc" is not installed.
2593
        global SO_BINDTODEVICE
331 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
2594
        if self.interface is not None:
338 by Teddy Hogeborn
* mandos: Minor doc string fixes.
2595
            if SO_BINDTODEVICE is None:
852 by Teddy Hogeborn
mandos: Bug fix for Python 2.7 and the "--interface" option
2596
                # Fall back to a hard-coded value which seems to be
2597
                # common enough.
2598
                logger.warning("SO_BINDTODEVICE not found, trying 25")
2599
                SO_BINDTODEVICE = 25
2600
            try:
2601
                self.socket.setsockopt(
2602
                    socket.SOL_SOCKET, SO_BINDTODEVICE,
2603
                    (self.interface + "\0").encode("utf-8"))
2604
            except socket.error as error:
2605
                if error.errno == errno.EPERM:
2606
                    logger.error("No permission to bind to"
2607
                                 " interface %s", self.interface)
2608
                elif error.errno == errno.ENOPROTOOPT:
2609
                    logger.error("SO_BINDTODEVICE not available;"
2610
                                 " cannot bind to interface %s",
2611
                                 self.interface)
2612
                elif error.errno == errno.ENODEV:
2613
                    logger.error("Interface %s does not exist,"
2614
                                 " cannot bind", self.interface)
2615
                else:
2616
                    raise
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
2617
        # Only bind(2) the socket if we really need to.
2618
        if self.server_address[0] or self.server_address[1]:
2619
            if not self.server_address[0]:
314 by Teddy Hogeborn
Support not using IPv6 in server:
2620
                if self.address_family == socket.AF_INET6:
874 by Teddy Hogeborn
PEP8 compliance: mandos
2621
                    any_address = "::"  # in6addr_any
314 by Teddy Hogeborn
Support not using IPv6 in server:
2622
                else:
874 by Teddy Hogeborn
PEP8 compliance: mandos
2623
                    any_address = "0.0.0.0"  # INADDR_ANY
314 by Teddy Hogeborn
Support not using IPv6 in server:
2624
                self.server_address = (any_address,
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
2625
                                       self.server_address[1])
49 by Teddy Hogeborn
* mandos (IPv6_TCPServer.server_bind): Bug fix: allow port to be empty
2626
            elif not self.server_address[1]:
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2627
                self.server_address = (self.server_address[0], 0)
331 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
2628
#                 if self.interface:
49 by Teddy Hogeborn
* mandos (IPv6_TCPServer.server_bind): Bug fix: allow port to be empty
2629
#                     self.server_address = (self.server_address[0],
2630
#                                            0, # port
2631
#                                            0, # flowinfo
2632
#                                            if_nametoindex
331 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
2633
#                                            (self.interface))
335 by Teddy Hogeborn
* mandos: Import "SocketServer" as "socketserver" and "ConfigParser"
2634
            return socketserver.TCPServer.server_bind(self)
339 by Teddy Hogeborn
Code cleanup.
2635
2636
2637
class MandosServer(IPv6_TCPServer):
2638
    """Mandos server.
874 by Teddy Hogeborn
PEP8 compliance: mandos
2639
339 by Teddy Hogeborn
Code cleanup.
2640
    Attributes:
2641
        clients:        set of Client objects
2642
        gnutls_priority GnuTLS priority string
2643
        use_dbus:       Boolean; to emit D-Bus signals or not
874 by Teddy Hogeborn
PEP8 compliance: mandos
2644
830 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
2645
    Assumes a GLib.MainLoop event loop.
339 by Teddy Hogeborn
Code cleanup.
2646
    """
874 by Teddy Hogeborn
PEP8 compliance: mandos
2647
339 by Teddy Hogeborn
Code cleanup.
2648
    def __init__(self, server_address, RequestHandlerClass,
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2649
                 interface=None,
2650
                 use_ipv6=True,
2651
                 clients=None,
2652
                 gnutls_priority=None,
2653
                 use_dbus=True,
2654
                 socketfd=None):
339 by Teddy Hogeborn
Code cleanup.
2655
        self.enabled = False
2656
        self.clients = clients
341 by Teddy Hogeborn
Code cleanup and one bug fix.
2657
        if self.clients is None:
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
2658
            self.clients = {}
339 by Teddy Hogeborn
Code cleanup.
2659
        self.use_dbus = use_dbus
2660
        self.gnutls_priority = gnutls_priority
2661
        IPv6_TCPServer.__init__(self, server_address,
2662
                                RequestHandlerClass,
874 by Teddy Hogeborn
PEP8 compliance: mandos
2663
                                interface=interface,
2664
                                use_ipv6=use_ipv6,
2665
                                socketfd=socketfd)
2666
163 by Teddy Hogeborn
* Makefile (PIDDIR, USER, GROUP): Removed.
2667
    def server_activate(self):
2668
        if self.enabled:
335 by Teddy Hogeborn
* mandos: Import "SocketServer" as "socketserver" and "ConfigParser"
2669
            return socketserver.TCPServer.server_activate(self)
874 by Teddy Hogeborn
PEP8 compliance: mandos
2670
163 by Teddy Hogeborn
* Makefile (PIDDIR, USER, GROUP): Removed.
2671
    def enable(self):
2672
        self.enabled = True
874 by Teddy Hogeborn
PEP8 compliance: mandos
2673
505.1.11 by Teddy Hogeborn
* mandos (Client.checked_ok): Set "expires" after setting timeout.
2674
    def add_pipe(self, parent_pipe, proc):
340 by Teddy Hogeborn
Code cleanup.
2675
        # Call "handle_ipc" for both data and EOF events
830 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
2676
        GLib.io_add_watch(
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2677
            parent_pipe.fileno(),
830 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
2678
            GLib.IO_IN | GLib.IO_HUP,
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2679
            functools.partial(self.handle_ipc,
874 by Teddy Hogeborn
PEP8 compliance: mandos
2680
                              parent_pipe=parent_pipe,
2681
                              proc=proc))
2682
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2683
    def handle_ipc(self, source, condition,
2684
                   parent_pipe=None,
874 by Teddy Hogeborn
PEP8 compliance: mandos
2685
                   proc=None,
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2686
                   client_object=None):
505.1.13 by Teddy Hogeborn
Miscellaneous fixes prompted by lintian:
2687
        # error, or the other end of multiprocessing.Pipe has closed
830 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
2688
        if condition & (GLib.IO_ERR | GLib.IO_HUP):
505.1.13 by Teddy Hogeborn
Miscellaneous fixes prompted by lintian:
2689
            # Wait for other process to exit
505.1.11 by Teddy Hogeborn
* mandos (Client.checked_ok): Set "expires" after setting timeout.
2690
            proc.join()
24.1.152 by Björn Påhlsson
bug fixes that prevent problems when runing server as root
2691
            return False
874 by Teddy Hogeborn
PEP8 compliance: mandos
2692
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2693
        # Read a request from the child
2694
        request = parent_pipe.recv()
2695
        command = request[0]
874 by Teddy Hogeborn
PEP8 compliance: mandos
2696
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2697
        if command == 'init':
962 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
2698
            key_id = request[1].decode("ascii")
2699
            fpr = request[2].decode("ascii")
2700
            address = request[3]
874 by Teddy Hogeborn
PEP8 compliance: mandos
2701
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
2702
            for c in self.clients.values():
971 by Teddy Hogeborn
Bug fix: Only create TLS key with certtool, and read correct key file
2703
                if key_id == "E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855":
2704
                    continue
962 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
2705
                if key_id and c.key_id == key_id:
2706
                    client = c
2707
                    break
2708
                if fpr and c.fingerprint == fpr:
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2709
                    client = c
2710
                    break
2711
            else:
962 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
2712
                logger.info("Client not found for key ID: %s, address"
2713
                            ": %s", key_id or fpr, address)
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2714
                if self.use_dbus:
2715
                    # Emit D-Bus signal
962 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
2716
                    mandos_dbus_service.ClientNotFound(key_id or fpr,
505.1.3 by Teddy Hogeborn
* mandos: Break long lines.
2717
                                                       address[0])
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2718
                parent_pipe.send(False)
2719
                return False
874 by Teddy Hogeborn
PEP8 compliance: mandos
2720
830 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
2721
            GLib.io_add_watch(
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2722
                parent_pipe.fileno(),
830 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
2723
                GLib.IO_IN | GLib.IO_HUP,
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2724
                functools.partial(self.handle_ipc,
874 by Teddy Hogeborn
PEP8 compliance: mandos
2725
                                  parent_pipe=parent_pipe,
2726
                                  proc=proc,
2727
                                  client_object=client))
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2728
            parent_pipe.send(True)
505.1.3 by Teddy Hogeborn
* mandos: Break long lines.
2729
            # remove the old hook in favor of the new above hook on
2730
            # same fileno
288.1.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
2731
            return False
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2732
        if command == 'funcall':
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2733
            funcname = request[1]
2734
            args = request[2]
2735
            kwargs = request[3]
874 by Teddy Hogeborn
PEP8 compliance: mandos
2736
505.1.3 by Teddy Hogeborn
* mandos: Break long lines.
2737
            parent_pipe.send(('data', getattr(client_object,
2738
                                              funcname)(*args,
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2739
                                                        **kwargs)))
874 by Teddy Hogeborn
PEP8 compliance: mandos
2740
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2741
        if command == 'getattr':
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2742
            attrname = request[1]
755 by Teddy Hogeborn
mandos: More Python 3 fixes.
2743
            if isinstance(client_object.__getattribute__(attrname),
2744
                          collections.Callable):
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2745
                parent_pipe.send(('function', ))
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2746
            else:
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2747
                parent_pipe.send((
2748
                    'data', client_object.__getattribute__(attrname)))
874 by Teddy Hogeborn
PEP8 compliance: mandos
2749
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2750
        if command == 'setattr':
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2751
            attrname = request[1]
2752
            value = request[2]
2753
            setattr(client_object, attrname, value)
874 by Teddy Hogeborn
PEP8 compliance: mandos
2754
288.1.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
2755
        return True
10 by Teddy Hogeborn
* server.py: Bug fix: Do "from __future__ import division".
2756
3 by Björn Påhlsson
Python based server
2757
609 by Teddy Hogeborn
* clients.conf: Convert all time intervals to new RFC 3339 syntax.
2758
def rfc3339_duration_to_delta(duration):
2759
    """Parse an RFC 3339 "duration" and return a datetime.timedelta
874 by Teddy Hogeborn
PEP8 compliance: mandos
2760
609 by Teddy Hogeborn
* clients.conf: Convert all time intervals to new RFC 3339 syntax.
2761
    >>> rfc3339_duration_to_delta("P7D")
2762
    datetime.timedelta(7)
2763
    >>> rfc3339_duration_to_delta("PT60S")
2764
    datetime.timedelta(0, 60)
2765
    >>> rfc3339_duration_to_delta("PT60M")
2766
    datetime.timedelta(0, 3600)
2767
    >>> rfc3339_duration_to_delta("PT24H")
2768
    datetime.timedelta(1)
2769
    >>> rfc3339_duration_to_delta("P1W")
2770
    datetime.timedelta(7)
2771
    >>> rfc3339_duration_to_delta("PT5M30S")
2772
    datetime.timedelta(0, 330)
2773
    >>> rfc3339_duration_to_delta("P1DT3M20S")
2774
    datetime.timedelta(1, 200)
2775
    """
874 by Teddy Hogeborn
PEP8 compliance: mandos
2776
609 by Teddy Hogeborn
* clients.conf: Convert all time intervals to new RFC 3339 syntax.
2777
    # Parsing an RFC 3339 duration with regular expressions is not
2778
    # possible - there would have to be multiple places for the same
2779
    # values, like seconds.  The current code, while more esoteric, is
2780
    # cleaner without depending on a parsing library.  If Python had a
2781
    # built-in library for parsing we would use it, but we'd like to
2782
    # avoid excessive use of external libraries.
874 by Teddy Hogeborn
PEP8 compliance: mandos
2783
609 by Teddy Hogeborn
* clients.conf: Convert all time intervals to new RFC 3339 syntax.
2784
    # New type for defining tokens, syntax, and semantics all-in-one
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2785
    Token = collections.namedtuple("Token", (
2786
        "regexp",  # To match token; if "value" is not None, must have
2787
                   # a "group" containing digits
2788
        "value",   # datetime.timedelta or None
2789
        "followers"))           # Tokens valid after this token
609 by Teddy Hogeborn
* clients.conf: Convert all time intervals to new RFC 3339 syntax.
2790
    # RFC 3339 "duration" tokens, syntax, and semantics; taken from
2791
    # the "duration" ABNF definition in RFC 3339, Appendix A.
2792
    token_end = Token(re.compile(r"$"), None, frozenset())
2793
    token_second = Token(re.compile(r"(\d+)S"),
2794
                         datetime.timedelta(seconds=1),
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2795
                         frozenset((token_end, )))
609 by Teddy Hogeborn
* clients.conf: Convert all time intervals to new RFC 3339 syntax.
2796
    token_minute = Token(re.compile(r"(\d+)M"),
2797
                         datetime.timedelta(minutes=1),
2798
                         frozenset((token_second, token_end)))
2799
    token_hour = Token(re.compile(r"(\d+)H"),
2800
                       datetime.timedelta(hours=1),
2801
                       frozenset((token_minute, token_end)))
2802
    token_time = Token(re.compile(r"T"),
2803
                       None,
2804
                       frozenset((token_hour, token_minute,
2805
                                  token_second)))
2806
    token_day = Token(re.compile(r"(\d+)D"),
2807
                      datetime.timedelta(days=1),
2808
                      frozenset((token_time, token_end)))
2809
    token_month = Token(re.compile(r"(\d+)M"),
2810
                        datetime.timedelta(weeks=4),
2811
                        frozenset((token_day, token_end)))
2812
    token_year = Token(re.compile(r"(\d+)Y"),
2813
                       datetime.timedelta(weeks=52),
2814
                       frozenset((token_month, token_end)))
2815
    token_week = Token(re.compile(r"(\d+)W"),
2816
                       datetime.timedelta(weeks=1),
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2817
                       frozenset((token_end, )))
609 by Teddy Hogeborn
* clients.conf: Convert all time intervals to new RFC 3339 syntax.
2818
    token_duration = Token(re.compile(r"P"), None,
2819
                           frozenset((token_year, token_month,
2820
                                      token_day, token_time,
721 by Teddy Hogeborn
Fix two mutually cancelling bugs.
2821
                                      token_week)))
874 by Teddy Hogeborn
PEP8 compliance: mandos
2822
    # Define starting values:
2823
    # Value so far
2824
    value = datetime.timedelta()
609 by Teddy Hogeborn
* clients.conf: Convert all time intervals to new RFC 3339 syntax.
2825
    found_token = None
874 by Teddy Hogeborn
PEP8 compliance: mandos
2826
    # Following valid tokens
2827
    followers = frozenset((token_duration, ))
2828
    # String left to parse
2829
    s = duration
609 by Teddy Hogeborn
* clients.conf: Convert all time intervals to new RFC 3339 syntax.
2830
    # Loop until end token is found
2831
    while found_token is not token_end:
2832
        # Search for any currently valid tokens
2833
        for token in followers:
2834
            match = token.regexp.match(s)
2835
            if match is not None:
2836
                # Token found
2837
                if token.value is not None:
2838
                    # Value found, parse digits
2839
                    factor = int(match.group(1), 10)
2840
                    # Add to value so far
2841
                    value += factor * token.value
2842
                # Strip token from string
2843
                s = token.regexp.sub("", s, 1)
2844
                # Go to found token
2845
                found_token = token
2846
                # Set valid next tokens
2847
                followers = found_token.followers
2848
                break
2849
        else:
2850
            # No currently valid tokens were found
752 by Teddy Hogeborn
mandos: Generate better messages in exceptions.
2851
            raise ValueError("Invalid RFC 3339 duration: {!r}"
2852
                             .format(duration))
609 by Teddy Hogeborn
* clients.conf: Convert all time intervals to new RFC 3339 syntax.
2853
    # End token found
2854
    return value
2855
2856
4 by Teddy Hogeborn
* server.py (Client.created, Client.next_check): New.
2857
def string_to_delta(interval):
2858
    """Parse a string and return a datetime.timedelta
874 by Teddy Hogeborn
PEP8 compliance: mandos
2859
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2860
    >>> string_to_delta('7d')
4 by Teddy Hogeborn
* server.py (Client.created, Client.next_check): New.
2861
    datetime.timedelta(7)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2862
    >>> string_to_delta('60s')
4 by Teddy Hogeborn
* server.py (Client.created, Client.next_check): New.
2863
    datetime.timedelta(0, 60)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2864
    >>> string_to_delta('60m')
4 by Teddy Hogeborn
* server.py (Client.created, Client.next_check): New.
2865
    datetime.timedelta(0, 3600)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2866
    >>> string_to_delta('24h')
4 by Teddy Hogeborn
* server.py (Client.created, Client.next_check): New.
2867
    datetime.timedelta(1)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2868
    >>> string_to_delta('1w')
4 by Teddy Hogeborn
* server.py (Client.created, Client.next_check): New.
2869
    datetime.timedelta(7)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2870
    >>> string_to_delta('5m 30s')
93 by Teddy Hogeborn
* mandos (string_to_delta): Accept a whitespace-separated sequence of
2871
    datetime.timedelta(0, 330)
4 by Teddy Hogeborn
* server.py (Client.created, Client.next_check): New.
2872
    """
874 by Teddy Hogeborn
PEP8 compliance: mandos
2873
609 by Teddy Hogeborn
* clients.conf: Convert all time intervals to new RFC 3339 syntax.
2874
    try:
2875
        return rfc3339_duration_to_delta(interval)
2876
    except ValueError:
2877
        pass
874 by Teddy Hogeborn
PEP8 compliance: mandos
2878
93 by Teddy Hogeborn
* mandos (string_to_delta): Accept a whitespace-separated sequence of
2879
    timevalue = datetime.timedelta(0)
2880
    for s in interval.split():
2881
        try:
729 by Teddy Hogeborn
mandos: Stop using str() and remove unnecessary unicode() calls.
2882
            suffix = s[-1]
215 by Teddy Hogeborn
* mandos: Remove unused "select" module. Import "ctypes.util".
2883
            value = int(s[:-1])
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2884
            if suffix == "d":
93 by Teddy Hogeborn
* mandos (string_to_delta): Accept a whitespace-separated sequence of
2885
                delta = datetime.timedelta(value)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2886
            elif suffix == "s":
93 by Teddy Hogeborn
* mandos (string_to_delta): Accept a whitespace-separated sequence of
2887
                delta = datetime.timedelta(0, value)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2888
            elif suffix == "m":
93 by Teddy Hogeborn
* mandos (string_to_delta): Accept a whitespace-separated sequence of
2889
                delta = datetime.timedelta(0, 0, 0, 0, value)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2890
            elif suffix == "h":
93 by Teddy Hogeborn
* mandos (string_to_delta): Accept a whitespace-separated sequence of
2891
                delta = datetime.timedelta(0, 0, 0, 0, 0, value)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2892
            elif suffix == "w":
93 by Teddy Hogeborn
* mandos (string_to_delta): Accept a whitespace-separated sequence of
2893
                delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
2894
            else:
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2895
                raise ValueError("Unknown suffix {!r}".format(suffix))
642 by Teddy Hogeborn
Syntax fix; use "raise" better in Mandos server.
2896
        except IndexError as e:
464 by Teddy Hogeborn
* debian/mandos-client.postrm (purge): Bug fix: update initramfs also
2897
            raise ValueError(*(e.args))
93 by Teddy Hogeborn
* mandos (string_to_delta): Accept a whitespace-separated sequence of
2898
        timevalue += delta
2899
    return timevalue
4 by Teddy Hogeborn
* server.py (Client.created, Client.next_check): New.
2900
8 by Teddy Hogeborn
* Makefile (client_debug): Bug fix; add quotes and / to CERT_ROOT.
2901
874 by Teddy Hogeborn
PEP8 compliance: mandos
2902
def daemon(nochdir=False, noclose=False):
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
2903
    """See daemon(3).  Standard BSD Unix function.
874 by Teddy Hogeborn
PEP8 compliance: mandos
2904
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
2905
    This should really exist as os.daemon, but it doesn't (yet)."""
2906
    if os.fork():
2907
        sys.exit()
2908
    os.setsid()
2909
    if not nochdir:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2910
        os.chdir("/")
46 by Teddy Hogeborn
* network-protocol.txt: New.
2911
    if os.fork():
2912
        sys.exit()
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
2913
    if not noclose:
2914
        # Close all standard open file descriptors
560.1.1 by teddy at recompile
* mandos: Use os.devnull instead of os.path.devnull. Fix some white
2915
        null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
2916
        if not stat.S_ISCHR(os.fstat(null).st_mode):
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2917
            raise OSError(errno.ENODEV,
2918
                          "{} not a character device"
568 by Teddy Hogeborn
* mandos-monitor: Use new string format method.
2919
                          .format(os.devnull))
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
2920
        os.dup2(null, sys.stdin.fileno())
2921
        os.dup2(null, sys.stdout.fileno())
2922
        os.dup2(null, sys.stderr.fileno())
2923
        if null > 2:
2924
            os.close(null)
2925
2926
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
2927
def main():
874 by Teddy Hogeborn
PEP8 compliance: mandos
2928
379 by Teddy Hogeborn
* mandos: Fix line lengths.
2929
    ##################################################################
327 by Teddy Hogeborn
Merge from pipe IPC branch.
2930
    # Parsing of options, both command line and config file
874 by Teddy Hogeborn
PEP8 compliance: mandos
2931
474 by teddy at bsnet
* mandos: Use the new argparse library instead of optparse.
2932
    parser = argparse.ArgumentParser()
2933
    parser.add_argument("-v", "--version", action="version",
874 by Teddy Hogeborn
PEP8 compliance: mandos
2934
                        version="%(prog)s {}".format(version),
474 by teddy at bsnet
* mandos: Use the new argparse library instead of optparse.
2935
                        help="show version number and exit")
2936
    parser.add_argument("-i", "--interface", metavar="IF",
2937
                        help="Bind to interface IF")
2938
    parser.add_argument("-a", "--address",
2939
                        help="Address to listen for requests on")
2940
    parser.add_argument("-p", "--port", type=int,
2941
                        help="Port number to receive requests on")
2942
    parser.add_argument("--check", action="store_true",
2943
                        help="Run self-test")
2944
    parser.add_argument("--debug", action="store_true",
2945
                        help="Debug mode; run in foreground and log"
618 by Teddy Hogeborn
* mandos: Bug fix: Make boolean options work from the config file
2946
                        " to terminal", default=None)
474 by teddy at bsnet
* mandos: Use the new argparse library instead of optparse.
2947
    parser.add_argument("--debuglevel", metavar="LEVEL",
2948
                        help="Debug level for stdout output")
2949
    parser.add_argument("--priority", help="GnuTLS"
2950
                        " priority string (see GnuTLS documentation)")
2951
    parser.add_argument("--servicename",
2952
                        metavar="NAME", help="Zeroconf service name")
2953
    parser.add_argument("--configdir",
2954
                        default="/etc/mandos", metavar="DIR",
2955
                        help="Directory to search for configuration"
2956
                        " files")
2957
    parser.add_argument("--no-dbus", action="store_false",
2958
                        dest="use_dbus", help="Do not provide D-Bus"
618 by Teddy Hogeborn
* mandos: Bug fix: Make boolean options work from the config file
2959
                        " system bus interface", default=None)
474 by teddy at bsnet
* mandos: Use the new argparse library instead of optparse.
2960
    parser.add_argument("--no-ipv6", action="store_false",
618 by Teddy Hogeborn
* mandos: Bug fix: Make boolean options work from the config file
2961
                        dest="use_ipv6", help="Do not use IPv6",
2962
                        default=None)
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
2963
    parser.add_argument("--no-restore", action="store_false",
518.1.7 by Teddy Hogeborn
* mandos: Break long lines and fix some more white space.
2964
                        dest="restore", help="Do not restore stored"
618 by Teddy Hogeborn
* mandos: Bug fix: Make boolean options work from the config file
2965
                        " state", default=None)
589.1.1 by Teddy Hogeborn
* mandos: Implement "--socket" option.
2966
    parser.add_argument("--socket", type=int,
2967
                        help="Specify a file descriptor to a network"
2968
                        " socket to use instead of creating one")
518.2.2 by Teddy Hogeborn
Directory with persistent state can now be changed with the "statedir"
2969
    parser.add_argument("--statedir", metavar="DIR",
2970
                        help="Directory to save/restore state in")
606 by Teddy Hogeborn
* mandos: New "--foreground" option.
2971
    parser.add_argument("--foreground", action="store_true",
618 by Teddy Hogeborn
* mandos: Bug fix: Make boolean options work from the config file
2972
                        help="Run in foreground", default=None)
707 by Teddy Hogeborn
mandos: New "--no-zeroconf" option. Also make "--socket=0" work.
2973
    parser.add_argument("--no-zeroconf", action="store_false",
2974
                        dest="zeroconf", help="Do not use Zeroconf",
2975
                        default=None)
874 by Teddy Hogeborn
PEP8 compliance: mandos
2976
474 by teddy at bsnet
* mandos: Use the new argparse library instead of optparse.
2977
    options = parser.parse_args()
874 by Teddy Hogeborn
PEP8 compliance: mandos
2978
4 by Teddy Hogeborn
* server.py (Client.created, Client.next_check): New.
2979
    if options.check:
2980
        import doctest
654 by Teddy Hogeborn
Fix running of self-tests.
2981
        fail_count, test_count = doctest.testmod()
2982
        sys.exit(os.EX_OK if fail_count == 0 else 1)
874 by Teddy Hogeborn
PEP8 compliance: mandos
2983
28 by Teddy Hogeborn
* server.conf: New file.
2984
    # Default values for config file for server-global settings
962 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
2985
    if gnutls.has_rawpk:
2986
        priority = ("SECURE128:!CTYPE-X.509:+CTYPE-RAWPK:!RSA"
2987
                    ":!VERS-ALL:+VERS-TLS1.3:%PROFILE_ULTRA")
2988
    else:
2989
        priority = ("SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2990
                    ":+SIGN-DSA-SHA256")
874 by Teddy Hogeborn
PEP8 compliance: mandos
2991
    server_defaults = {"interface": "",
2992
                       "address": "",
2993
                       "port": "",
2994
                       "debug": "False",
962 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
2995
                       "priority": priority,
874 by Teddy Hogeborn
PEP8 compliance: mandos
2996
                       "servicename": "Mandos",
2997
                       "use_dbus": "True",
2998
                       "use_ipv6": "True",
2999
                       "debuglevel": "",
3000
                       "restore": "True",
3001
                       "socket": "",
3002
                       "statedir": "/var/lib/mandos",
3003
                       "foreground": "False",
3004
                       "zeroconf": "True",
3005
                       }
962 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
3006
    del priority
874 by Teddy Hogeborn
PEP8 compliance: mandos
3007
28 by Teddy Hogeborn
* server.conf: New file.
3008
    # Parse config file for server-global settings
335 by Teddy Hogeborn
* mandos: Import "SocketServer" as "socketserver" and "ConfigParser"
3009
    server_config = configparser.SafeConfigParser(server_defaults)
28 by Teddy Hogeborn
* server.conf: New file.
3010
    del server_defaults
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3011
    server_config.read(os.path.join(options.configdir, "mandos.conf"))
28 by Teddy Hogeborn
* server.conf: New file.
3012
    # Convert the SafeConfigParser object to a dict
89 by Teddy Hogeborn
* Makefile: Bug fix: fixed creation of man pages for section 5 pages.
3013
    server_settings = server_config.defaults()
282 by Teddy Hogeborn
* mandos (main): Bug fix: use "getint" on the "port" config file
3014
    # Use the appropriate methods on the non-string config options
898 by Teddy Hogeborn
Server bug fix: Use the mandos.conf "zeroconf" and "restore" options
3015
    for option in ("debug", "use_dbus", "use_ipv6", "restore",
3016
                   "foreground", "zeroconf"):
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
3017
        server_settings[option] = server_config.getboolean("DEFAULT",
333 by Teddy Hogeborn
Minor code cleanup; one minor bug fix.
3018
                                                           option)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
3019
    if server_settings["port"]:
3020
        server_settings["port"] = server_config.getint("DEFAULT",
3021
                                                       "port")
589.1.1 by Teddy Hogeborn
* mandos: Implement "--socket" option.
3022
    if server_settings["socket"]:
3023
        server_settings["socket"] = server_config.getint("DEFAULT",
3024
                                                         "socket")
591 by Teddy Hogeborn
Merge "--socket" option for server.
3025
        # Later, stdin will, and stdout and stderr might, be dup'ed
589.1.1 by Teddy Hogeborn
* mandos: Implement "--socket" option.
3026
        # over with an opened os.devnull.  But we don't want this to
3027
        # happen with a supplied network socket.
3028
        if 0 <= server_settings["socket"] <= 2:
3029
            server_settings["socket"] = os.dup(server_settings
3030
                                               ["socket"])
28 by Teddy Hogeborn
* server.conf: New file.
3031
    del server_config
874 by Teddy Hogeborn
PEP8 compliance: mandos
3032
28 by Teddy Hogeborn
* server.conf: New file.
3033
    # Override the settings from the config file with command line
3034
    # options, if set.
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
3035
    for option in ("interface", "address", "port", "debug",
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3036
                   "priority", "servicename", "configdir", "use_dbus",
3037
                   "use_ipv6", "debuglevel", "restore", "statedir",
3038
                   "socket", "foreground", "zeroconf"):
28 by Teddy Hogeborn
* server.conf: New file.
3039
        value = getattr(options, option)
3040
        if value is not None:
3041
            server_settings[option] = value
3042
    del options
333 by Teddy Hogeborn
Minor code cleanup; one minor bug fix.
3043
    # Force all strings to be unicode
3044
    for option in server_settings.keys():
729 by Teddy Hogeborn
mandos: Stop using str() and remove unnecessary unicode() calls.
3045
        if isinstance(server_settings[option], bytes):
3046
            server_settings[option] = (server_settings[option]
3047
                                       .decode("utf-8"))
618 by Teddy Hogeborn
* mandos: Bug fix: Make boolean options work from the config file
3048
    # Force all boolean options to be boolean
3049
    for option in ("debug", "use_dbus", "use_ipv6", "restore",
707 by Teddy Hogeborn
mandos: New "--no-zeroconf" option. Also make "--socket=0" work.
3050
                   "foreground", "zeroconf"):
618 by Teddy Hogeborn
* mandos: Bug fix: Make boolean options work from the config file
3051
        server_settings[option] = bool(server_settings[option])
606 by Teddy Hogeborn
* mandos: New "--foreground" option.
3052
    # Debug implies foreground
3053
    if server_settings["debug"]:
3054
        server_settings["foreground"] = True
28 by Teddy Hogeborn
* server.conf: New file.
3055
    # Now we have our good server settings in "server_settings"
874 by Teddy Hogeborn
PEP8 compliance: mandos
3056
327 by Teddy Hogeborn
Merge from pipe IPC branch.
3057
    ##################################################################
874 by Teddy Hogeborn
PEP8 compliance: mandos
3058
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3059
    if (not server_settings["zeroconf"]
3060
        and not (server_settings["port"]
3061
                 or server_settings["socket"] != "")):
3062
        parser.error("Needs port or socket to work without Zeroconf")
874 by Teddy Hogeborn
PEP8 compliance: mandos
3063
243 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
3064
    # For convenience
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
3065
    debug = server_settings["debug"]
3066
    debuglevel = server_settings["debuglevel"]
3067
    use_dbus = server_settings["use_dbus"]
3068
    use_ipv6 = server_settings["use_ipv6"]
518.2.2 by Teddy Hogeborn
Directory with persistent state can now be changed with the "statedir"
3069
    stored_state_path = os.path.join(server_settings["statedir"],
3070
                                     stored_state_file)
606 by Teddy Hogeborn
* mandos: New "--foreground" option.
3071
    foreground = server_settings["foreground"]
707 by Teddy Hogeborn
mandos: New "--no-zeroconf" option. Also make "--socket=0" work.
3072
    zeroconf = server_settings["zeroconf"]
874 by Teddy Hogeborn
PEP8 compliance: mandos
3073
518.1.4 by Björn Påhlsson
restructured logger
3074
    if debug:
530 by teddy at bsnet
* mandos (initlogger): Take new "debug" argument; all callers changed.
3075
        initlogger(debug, logging.DEBUG)
518.1.4 by Björn Påhlsson
restructured logger
3076
    else:
3077
        if not debuglevel:
530 by teddy at bsnet
* mandos (initlogger): Take new "debug" argument; all callers changed.
3078
            initlogger(debug)
518.1.4 by Björn Påhlsson
restructured logger
3079
        else:
3080
            level = getattr(logging, debuglevel.upper())
530 by teddy at bsnet
* mandos (initlogger): Take new "debug" argument; all callers changed.
3081
            initlogger(debug, level)
874 by Teddy Hogeborn
PEP8 compliance: mandos
3082
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
3083
    if server_settings["servicename"] != "Mandos":
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3084
        syslogger.setFormatter(
3085
            logging.Formatter('Mandos ({}) [%(process)d]:'
3086
                              ' %(levelname)s: %(message)s'.format(
3087
                                  server_settings["servicename"])))
874 by Teddy Hogeborn
PEP8 compliance: mandos
3088
28 by Teddy Hogeborn
* server.conf: New file.
3089
    # Parse config file with clients
543 by Teddy Hogeborn
* mandos: Break some long lines.
3090
    client_config = configparser.SafeConfigParser(Client
3091
                                                  .client_defaults)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
3092
    client_config.read(os.path.join(server_settings["configdir"],
3093
                                    "clients.conf"))
874 by Teddy Hogeborn
PEP8 compliance: mandos
3094
327 by Teddy Hogeborn
Merge from pipe IPC branch.
3095
    global mandos_dbus_service
3096
    mandos_dbus_service = None
874 by Teddy Hogeborn
PEP8 compliance: mandos
3097
707 by Teddy Hogeborn
mandos: New "--no-zeroconf" option. Also make "--socket=0" work.
3098
    socketfd = None
3099
    if server_settings["socket"] != "":
3100
        socketfd = server_settings["socket"]
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3101
    tcp_server = MandosServer(
3102
        (server_settings["address"], server_settings["port"]),
3103
        ClientHandler,
3104
        interface=(server_settings["interface"] or None),
3105
        use_ipv6=use_ipv6,
3106
        gnutls_priority=server_settings["priority"],
3107
        use_dbus=use_dbus,
3108
        socketfd=socketfd)
606 by Teddy Hogeborn
* mandos: New "--foreground" option.
3109
    if not foreground:
626 by Teddy Hogeborn
* Makefile (CFLAGS, LDFLAGS): Keep default flags from environment.
3110
        pidfilename = "/run/mandos.pid"
636 by Teddy Hogeborn
Fall back to /var/run for pidfile if /run is not a directory.
3111
        if not os.path.isdir("/run/."):
3112
            pidfilename = "/var/run/mandos.pid"
606 by Teddy Hogeborn
* mandos: New "--foreground" option.
3113
        pidfile = None
439 by Teddy Hogeborn
* mandos: Do not write pid file if --debug is passed.
3114
        try:
751 by Teddy Hogeborn
mandos: Use codecs.open() and print() for PID file.
3115
            pidfile = codecs.open(pidfilename, "w", encoding="utf-8")
574 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
3116
        except IOError as e:
3117
            logger.error("Could not open file %r", pidfilename,
3118
                         exc_info=e)
874 by Teddy Hogeborn
PEP8 compliance: mandos
3119
816 by Teddy Hogeborn
Use "nogroup" as a fallback group, not "nobody".
3120
    for name, group in (("_mandos", "_mandos"),
3121
                        ("mandos", "mandos"),
3122
                        ("nobody", "nogroup")):
238 by Teddy Hogeborn
First version of a somewhat complete D-Bus server interface. Also
3123
        try:
566 by Teddy Hogeborn
* mandos (main): Simplify and shorten code selecting user and group ID
3124
            uid = pwd.getpwnam(name).pw_uid
816 by Teddy Hogeborn
Use "nogroup" as a fallback group, not "nobody".
3125
            gid = pwd.getpwnam(group).pw_gid
566 by Teddy Hogeborn
* mandos (main): Simplify and shorten code selecting user and group ID
3126
            break
238 by Teddy Hogeborn
First version of a somewhat complete D-Bus server interface. Also
3127
        except KeyError:
566 by Teddy Hogeborn
* mandos (main): Simplify and shorten code selecting user and group ID
3128
            continue
3129
    else:
3130
        uid = 65534
3131
        gid = 65534
163 by Teddy Hogeborn
* Makefile (PIDDIR, USER, GROUP): Removed.
3132
    try:
290 by Teddy Hogeborn
* mandos (main): Bug fix: Do setgid before setuid. Add verbose GnuTLS
3133
        os.setgid(gid)
163 by Teddy Hogeborn
* Makefile (PIDDIR, USER, GROUP): Removed.
3134
        os.setuid(uid)
825 by Teddy Hogeborn
Server bug fix: Include CAP_SETGID so it does not run as root
3135
        if debug:
3136
            logger.debug("Did setuid/setgid to {}:{}".format(uid,
3137
                                                             gid))
482 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
3138
    except OSError as error:
825 by Teddy Hogeborn
Server bug fix: Include CAP_SETGID so it does not run as root
3139
        logger.warning("Failed to setuid/setgid to {}:{}: {}"
3140
                       .format(uid, gid, os.strerror(error.errno)))
583 by Teddy Hogeborn
* mandos (Client.start_checker): Remove undocumented support for "%%s"
3141
        if error.errno != errno.EPERM:
642 by Teddy Hogeborn
Syntax fix; use "raise" better in Mandos server.
3142
            raise
874 by Teddy Hogeborn
PEP8 compliance: mandos
3143
290 by Teddy Hogeborn
* mandos (main): Bug fix: Do setgid before setuid. Add verbose GnuTLS
3144
    if debug:
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
3145
        # Enable all possible GnuTLS debugging
874 by Teddy Hogeborn
PEP8 compliance: mandos
3146
290 by Teddy Hogeborn
* mandos (main): Bug fix: Do setgid before setuid. Add verbose GnuTLS
3147
        # "Use a log level over 10 to enable all debugging options."
3148
        # - GnuTLS manual
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
3149
        gnutls.global_set_log_level(11)
874 by Teddy Hogeborn
PEP8 compliance: mandos
3150
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
3151
        @gnutls.log_func
290 by Teddy Hogeborn
* mandos (main): Bug fix: Do setgid before setuid. Add verbose GnuTLS
3152
        def debug_gnutls(level, string):
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
3153
            logger.debug("GnuTLS: %s", string[:-1])
874 by Teddy Hogeborn
PEP8 compliance: mandos
3154
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
3155
        gnutls.global_set_log_function(debug_gnutls)
874 by Teddy Hogeborn
PEP8 compliance: mandos
3156
24.1.155 by Björn Påhlsson
mandos server: Added debuglevel that adjust at what level information
3157
        # Redirect stdin so all checkers get /dev/null
560.1.1 by teddy at recompile
* mandos: Use os.devnull instead of os.path.devnull. Fix some white
3158
        null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
24.1.155 by Björn Påhlsson
mandos server: Added debuglevel that adjust at what level information
3159
        os.dup2(null, sys.stdin.fileno())
3160
        if null > 2:
3161
            os.close(null)
874 by Teddy Hogeborn
PEP8 compliance: mandos
3162
458 by teddy at bsnet
* mandos (main): Bug fix: Fork before connecting to D-Bus.
3163
    # Need to fork before connecting to D-Bus
606 by Teddy Hogeborn
* mandos: New "--foreground" option.
3164
    if not foreground:
458 by teddy at bsnet
* mandos (main): Bug fix: Fork before connecting to D-Bus.
3165
        # Close all input and output, do double fork, etc.
3166
        daemon()
874 by Teddy Hogeborn
PEP8 compliance: mandos
3167
830 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
3168
    # multiprocessing will use threads, so before we use GLib we need
3169
    # to inform GLib that threads will be used.
3170
    GLib.threads_init()
874 by Teddy Hogeborn
PEP8 compliance: mandos
3171
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
3172
    global main_loop
3173
    # From the Avahi example code
560.1.1 by teddy at recompile
* mandos: Use os.devnull instead of os.path.devnull. Fix some white
3174
    DBusGMainLoop(set_as_default=True)
830 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
3175
    main_loop = GLib.MainLoop()
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
3176
    bus = dbus.SystemBus()
3177
    # End of Avahi example code
243 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
3178
    if use_dbus:
402 by Teddy Hogeborn
* mandos (Client.disable): Rename keyword argument "log" to "quiet",
3179
        try:
505 by Björn Påhlsson
The domain name has changed, so the D-Bus bus and interface names must
3180
            bus_name = dbus.service.BusName("se.recompile.Mandos",
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3181
                                            bus,
3182
                                            do_not_queue=True)
3183
            old_bus_name = dbus.service.BusName(
3184
                "se.bsnet.fukt.Mandos", bus,
3185
                do_not_queue=True)
750 by Teddy Hogeborn
mandos: Disable D-Bus if any DBusException is raised when connecting.
3186
        except dbus.exceptions.DBusException as e:
574 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
3187
            logger.error("Disabling D-Bus:", exc_info=e)
402 by Teddy Hogeborn
* mandos (Client.disable): Rename keyword argument "log" to "quiet",
3188
            use_dbus = False
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
3189
            server_settings["use_dbus"] = False
402 by Teddy Hogeborn
* mandos (Client.disable): Rename keyword argument "log" to "quiet",
3190
            tcp_server.use_dbus = False
707 by Teddy Hogeborn
mandos: New "--no-zeroconf" option. Also make "--socket=0" work.
3191
    if zeroconf:
3192
        protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3193
        service = AvahiServiceToSyslog(
874 by Teddy Hogeborn
PEP8 compliance: mandos
3194
            name=server_settings["servicename"],
3195
            servicetype="_mandos._tcp",
3196
            protocol=protocol,
3197
            bus=bus)
707 by Teddy Hogeborn
mandos: New "--no-zeroconf" option. Also make "--socket=0" work.
3198
        if server_settings["interface"]:
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3199
            service.interface = if_nametoindex(
3200
                server_settings["interface"].encode("utf-8"))
874 by Teddy Hogeborn
PEP8 compliance: mandos
3201
24.1.152 by Björn Påhlsson
bug fixes that prevent problems when runing server as root
3202
    global multiprocessing_manager
3203
    multiprocessing_manager = multiprocessing.Manager()
874 by Teddy Hogeborn
PEP8 compliance: mandos
3204
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
3205
    client_class = Client
3206
    if use_dbus:
874 by Teddy Hogeborn
PEP8 compliance: mandos
3207
        client_class = functools.partial(ClientDBus, bus=bus)
3208
518.1.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
3209
    client_settings = Client.config_parser(client_config)
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
3210
    old_client_settings = {}
518.1.15 by Björn Påhlsson
more refactoring in regards to how clients get created
3211
    clients_data = {}
874 by Teddy Hogeborn
PEP8 compliance: mandos
3212
617 by Teddy Hogeborn
* mandos: Bug fix: Don't print output from checkers when running in
3213
    # This is used to redirect stdout and stderr for checker processes
3214
    global wnull
874 by Teddy Hogeborn
PEP8 compliance: mandos
3215
    wnull = open(os.devnull, "w")  # A writable /dev/null
617 by Teddy Hogeborn
* mandos: Bug fix: Don't print output from checkers when running in
3216
    # Only used if server is running in foreground but not in debug
3217
    # mode
3218
    if debug or not foreground:
3219
        wnull.close()
874 by Teddy Hogeborn
PEP8 compliance: mandos
3220
518.1.7 by Teddy Hogeborn
* mandos: Break long lines and fix some more white space.
3221
    # Get client data and settings from last running state.
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
3222
    if server_settings["restore"]:
3223
        try:
3224
            with open(stored_state_path, "rb") as stored_state:
874 by Teddy Hogeborn
PEP8 compliance: mandos
3225
                if sys.version_info.major == 2:
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
3226
                    clients_data, old_client_settings = pickle.load(
3227
                        stored_state)
3228
                else:
3229
                    bytes_clients_data, bytes_old_client_settings = (
874 by Teddy Hogeborn
PEP8 compliance: mandos
3230
                        pickle.load(stored_state, encoding="bytes"))
3231
                    #   Fix bytes to strings
3232
                    #  clients_data
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
3233
                    # .keys()
874 by Teddy Hogeborn
PEP8 compliance: mandos
3234
                    clients_data = {(key.decode("utf-8")
3235
                                     if isinstance(key, bytes)
3236
                                     else key): value
3237
                                    for key, value in
3238
                                    bytes_clients_data.items()}
829 by Teddy Hogeborn
Server: Fix minor thing with Python 3 compatibility
3239
                    del bytes_clients_data
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
3240
                    for key in clients_data:
874 by Teddy Hogeborn
PEP8 compliance: mandos
3241
                        value = {(k.decode("utf-8")
3242
                                  if isinstance(k, bytes) else k): v
3243
                                 for k, v in
3244
                                 clients_data[key].items()}
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
3245
                        clients_data[key] = value
3246
                        # .client_structure
3247
                        value["client_structure"] = [
3248
                            (s.decode("utf-8")
3249
                             if isinstance(s, bytes)
3250
                             else s) for s in
874 by Teddy Hogeborn
PEP8 compliance: mandos
3251
                            value["client_structure"]]
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
3252
                        # .name & .host
3253
                        for k in ("name", "host"):
3254
                            if isinstance(value[k], bytes):
3255
                                value[k] = value[k].decode("utf-8")
962 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
3256
                        if not value.has_key("key_id"):
3257
                            value["key_id"] = ""
3258
                        elif not value.has_key("fingerprint"):
3259
                            value["fingerprint"] = ""
874 by Teddy Hogeborn
PEP8 compliance: mandos
3260
                    #  old_client_settings
829 by Teddy Hogeborn
Server: Fix minor thing with Python 3 compatibility
3261
                    # .keys()
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
3262
                    old_client_settings = {
3263
                        (key.decode("utf-8")
3264
                         if isinstance(key, bytes)
3265
                         else key): value
3266
                        for key, value in
874 by Teddy Hogeborn
PEP8 compliance: mandos
3267
                        bytes_old_client_settings.items()}
829 by Teddy Hogeborn
Server: Fix minor thing with Python 3 compatibility
3268
                    del bytes_old_client_settings
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
3269
                    # .host
3270
                    for value in old_client_settings.values():
829 by Teddy Hogeborn
Server: Fix minor thing with Python 3 compatibility
3271
                        if isinstance(value["host"], bytes):
3272
                            value["host"] = (value["host"]
3273
                                             .decode("utf-8"))
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
3274
            os.remove(stored_state_path)
3275
        except IOError as e:
574 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
3276
            if e.errno == errno.ENOENT:
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3277
                logger.warning("Could not load persistent state:"
3278
                               " {}".format(os.strerror(e.errno)))
574 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
3279
            else:
3280
                logger.critical("Could not load persistent state:",
3281
                                exc_info=e)
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
3282
                raise
505.1.23 by Teddy Hogeborn
* mandos (main): Handle EOFError when reading state file.
3283
        except EOFError as e:
3284
            logger.warning("Could not load persistent state: "
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3285
                           "EOFError:",
3286
                           exc_info=e)
874 by Teddy Hogeborn
PEP8 compliance: mandos
3287
518.1.9 by Björn Påhlsson
renamed variables
3288
    with PGPEngine() as pgp:
723.1.4 by Teddy Hogeborn
Use the .items() method instead of .iteritems().
3289
        for client_name, client in clients_data.items():
617 by Teddy Hogeborn
* mandos: Bug fix: Don't print output from checkers when running in
3290
            # Skip removed clients
3291
            if client_name not in client_settings:
3292
                continue
874 by Teddy Hogeborn
PEP8 compliance: mandos
3293
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
3294
            # Decide which value to use after restoring saved state.
3295
            # We have three different values: Old config file,
3296
            # new config file, and saved state.
3297
            # New config value takes precedence if it differs from old
3298
            # config value, otherwise use saved state.
3299
            for name, value in client_settings[client_name].items():
3300
                try:
3301
                    # For each value in new config, check if it
3302
                    # differs from the old config value (Except for
3303
                    # the "secret" attribute)
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3304
                    if (name != "secret"
3305
                        and (value !=
3306
                             old_client_settings[client_name][name])):
518.2.10 by Teddy Hogeborn
* mandos (main): Bug fix: Syntax fix when restoring settings.
3307
                        client[name] = value
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
3308
                except KeyError:
3309
                    pass
874 by Teddy Hogeborn
PEP8 compliance: mandos
3310
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
3311
            # Clients who has passed its expire date can still be
749.1.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
3312
            # enabled if its last checker was successful.  A Client
552 by teddy at recompile
* mandos: Consistent terminology; use the term "secret" for the
3313
            # whose checker succeeded before we stored its state is
3314
            # assumed to have successfully run all checkers during
3315
            # downtime.
518.2.8 by Teddy Hogeborn
* mandos (ClientDBus.Host_dbus_property,
3316
            if client["enabled"]:
518.1.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
3317
                if datetime.datetime.utcnow() >= client["expires"]:
3318
                    if not client["last_checked_ok"]:
3319
                        logger.warning(
723.1.5 by Teddy Hogeborn
Use the new auto-numbered "{}" syntax for the .format() string method.
3320
                            "disabling client {} - Client never "
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3321
                            "performed a successful checker".format(
3322
                                client_name))
518.1.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
3323
                        client["enabled"] = False
3324
                    elif client["last_checker_status"] != 0:
3325
                        logger.warning(
723.1.5 by Teddy Hogeborn
Use the new auto-numbered "{}" syntax for the .format() string method.
3326
                            "disabling client {} - Client last"
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3327
                            " checker failed with error code"
3328
                            " {}".format(
3329
                                client_name,
3330
                                client["last_checker_status"]))
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
3331
                        client["enabled"] = False
3332
                    else:
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3333
                        client["expires"] = (
3334
                            datetime.datetime.utcnow()
3335
                            + client["timeout"])
542 by Björn Påhlsson
fixed bug with bad stored config state for expires and last_checked_ok.
3336
                        logger.debug("Last checker succeeded,"
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3337
                                     " keeping {} enabled".format(
3338
                                         client_name))
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
3339
            try:
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3340
                client["secret"] = pgp.decrypt(
3341
                    client["encrypted_secret"],
3342
                    client_settings[client_name]["secret"])
518.1.9 by Björn Påhlsson
renamed variables
3343
            except PGPError:
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
3344
                # If decryption fails, we use secret from new settings
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3345
                logger.debug("Failed to decrypt {} old secret".format(
3346
                    client_name))
3347
                client["secret"] = (client_settings[client_name]
3348
                                    ["secret"])
874 by Teddy Hogeborn
PEP8 compliance: mandos
3349
518.1.15 by Björn Påhlsson
more refactoring in regards to how clients get created
3350
    # Add/remove clients based on new changes made to config
543 by Teddy Hogeborn
* mandos: Break some long lines.
3351
    for client_name in (set(old_client_settings)
3352
                        - set(client_settings)):
518.1.15 by Björn Påhlsson
more refactoring in regards to how clients get created
3353
        del clients_data[client_name]
543 by Teddy Hogeborn
* mandos: Break some long lines.
3354
    for client_name in (set(client_settings)
3355
                        - set(old_client_settings)):
518.1.15 by Björn Påhlsson
more refactoring in regards to how clients get created
3356
        clients_data[client_name] = client_settings[client_name]
874 by Teddy Hogeborn
PEP8 compliance: mandos
3357
552 by teddy at recompile
* mandos: Consistent terminology; use the term "secret" for the
3358
    # Create all client objects
723.1.4 by Teddy Hogeborn
Use the .items() method instead of .iteritems().
3359
    for client_name, client in clients_data.items():
518.1.15 by Björn Påhlsson
more refactoring in regards to how clients get created
3360
        tcp_server.clients[client_name] = client_class(
874 by Teddy Hogeborn
PEP8 compliance: mandos
3361
            name=client_name,
3362
            settings=client,
3363
            server_settings=server_settings)
3364
341 by Teddy Hogeborn
Code cleanup and one bug fix.
3365
    if not tcp_server.clients:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
3366
        logger.warning("No clients defined")
874 by Teddy Hogeborn
PEP8 compliance: mandos
3367
606 by Teddy Hogeborn
* mandos: New "--foreground" option.
3368
    if not foreground:
3369
        if pidfile is not None:
751 by Teddy Hogeborn
mandos: Use codecs.open() and print() for PID file.
3370
            pid = os.getpid()
606 by Teddy Hogeborn
* mandos: New "--foreground" option.
3371
            try:
3372
                with pidfile:
751 by Teddy Hogeborn
mandos: Use codecs.open() and print() for PID file.
3373
                    print(pid, file=pidfile)
606 by Teddy Hogeborn
* mandos: New "--foreground" option.
3374
            except IOError:
3375
                logger.error("Could not write to file %r with PID %d",
3376
                             pidfilename, pid)
3377
        del pidfile
439 by Teddy Hogeborn
* mandos: Do not write pid file if --debug is passed.
3378
        del pidfilename
874 by Teddy Hogeborn
PEP8 compliance: mandos
3379
831 by Teddy Hogeborn
Server: Fix bug where it did not exit timely on signals
3380
    for termsig in (signal.SIGHUP, signal.SIGTERM):
3381
        GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,
3382
                             lambda: main_loop.quit() and False)
874 by Teddy Hogeborn
PEP8 compliance: mandos
3383
243 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
3384
    if use_dbus:
874 by Teddy Hogeborn
PEP8 compliance: mandos
3385
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3386
        @alternate_dbus_interfaces(
874 by Teddy Hogeborn
PEP8 compliance: mandos
3387
            {"se.recompile.Mandos": "se.bsnet.fukt.Mandos"})
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
3388
        class MandosDBusService(DBusObjectWithObjectManager):
243 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
3389
            """A D-Bus proxy object"""
874 by Teddy Hogeborn
PEP8 compliance: mandos
3390
243 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
3391
            def __init__(self):
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
3392
                dbus.service.Object.__init__(self, bus, "/")
874 by Teddy Hogeborn
PEP8 compliance: mandos
3393
505.1.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
3394
            _interface = "se.recompile.Mandos"
874 by Teddy Hogeborn
PEP8 compliance: mandos
3395
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
3396
            @dbus.service.signal(_interface, signature="o")
411 by Teddy Hogeborn
More consistent terminology: Clients are no longer "invalid" - they
3397
            def ClientAdded(self, objpath):
243 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
3398
                "D-Bus signal"
3399
                pass
874 by Teddy Hogeborn
PEP8 compliance: mandos
3400
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
3401
            @dbus.service.signal(_interface, signature="ss")
962 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
3402
            def ClientNotFound(self, key_id, address):
327 by Teddy Hogeborn
Merge from pipe IPC branch.
3403
                "D-Bus signal"
3404
                pass
874 by Teddy Hogeborn
PEP8 compliance: mandos
3405
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
3406
            @dbus_annotations({"org.freedesktop.DBus.Deprecated":
3407
                               "true"})
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
3408
            @dbus.service.signal(_interface, signature="os")
278 by Teddy Hogeborn
* mandos (Client.GetAllProperties): Also send Client.dbus_object_path
3409
            def ClientRemoved(self, objpath, name):
243 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
3410
                "D-Bus signal"
3411
                pass
874 by Teddy Hogeborn
PEP8 compliance: mandos
3412
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
3413
            @dbus_annotations({"org.freedesktop.DBus.Deprecated":
3414
                               "true"})
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
3415
            @dbus.service.method(_interface, out_signature="ao")
243 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
3416
            def GetAllClients(self):
283 by Teddy Hogeborn
* mandos (peer_certificate): Handle NULL pointer from
3417
                "D-Bus method"
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3418
                return dbus.Array(c.dbus_object_path for c in
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
3419
                                  tcp_server.clients.values())
874 by Teddy Hogeborn
PEP8 compliance: mandos
3420
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
3421
            @dbus_annotations({"org.freedesktop.DBus.Deprecated":
3422
                               "true"})
333 by Teddy Hogeborn
Minor code cleanup; one minor bug fix.
3423
            @dbus.service.method(_interface,
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
3424
                                 out_signature="a{oa{sv}}")
243 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
3425
            def GetAllClientsWithProperties(self):
283 by Teddy Hogeborn
* mandos (peer_certificate): Handle NULL pointer from
3426
                "D-Bus method"
243 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
3427
                return dbus.Dictionary(
874 by Teddy Hogeborn
PEP8 compliance: mandos
3428
                    {c.dbus_object_path: c.GetAll(
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
3429
                        "se.recompile.Mandos.Client")
874 by Teddy Hogeborn
PEP8 compliance: mandos
3430
                     for c in tcp_server.clients.values()},
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
3431
                    signature="oa{sv}")
874 by Teddy Hogeborn
PEP8 compliance: mandos
3432
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
3433
            @dbus.service.method(_interface, in_signature="o")
243 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
3434
            def RemoveClient(self, object_path):
283 by Teddy Hogeborn
* mandos (peer_certificate): Handle NULL pointer from
3435
                "D-Bus method"
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
3436
                for c in tcp_server.clients.values():
243 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
3437
                    if c.dbus_object_path == object_path:
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
3438
                        del tcp_server.clients[c.name]
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
3439
                        c.remove_from_connection()
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
3440
                        # Don't signal the disabling
402 by Teddy Hogeborn
* mandos (Client.disable): Rename keyword argument "log" to "quiet",
3441
                        c.disable(quiet=True)
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
3442
                        # Emit D-Bus signal for removal
3443
                        self.client_removed_signal(c)
278 by Teddy Hogeborn
* mandos (Client.GetAllProperties): Also send Client.dbus_object_path
3444
                        return
400 by Teddy Hogeborn
* mandos (Client.enable): Bug fix: Start new immediate checker last to
3445
                raise KeyError(object_path)
874 by Teddy Hogeborn
PEP8 compliance: mandos
3446
243 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
3447
            del _interface
874 by Teddy Hogeborn
PEP8 compliance: mandos
3448
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
3449
            @dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
874 by Teddy Hogeborn
PEP8 compliance: mandos
3450
                                 out_signature="a{oa{sa{sv}}}")
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
3451
            def GetManagedObjects(self):
3452
                """D-Bus method"""
3453
                return dbus.Dictionary(
874 by Teddy Hogeborn
PEP8 compliance: mandos
3454
                    {client.dbus_object_path:
3455
                     dbus.Dictionary(
3456
                         {interface: client.GetAll(interface)
3457
                          for interface in
3458
                          client._get_all_interface_names()})
3459
                     for client in tcp_server.clients.values()})
3460
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
3461
            def client_added_signal(self, client):
3462
                """Send the new standard signal and the old signal"""
3463
                if use_dbus:
3464
                    # New standard signal
3465
                    self.InterfacesAdded(
3466
                        client.dbus_object_path,
3467
                        dbus.Dictionary(
874 by Teddy Hogeborn
PEP8 compliance: mandos
3468
                            {interface: client.GetAll(interface)
3469
                             for interface in
3470
                             client._get_all_interface_names()}))
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
3471
                    # Old signal
3472
                    self.ClientAdded(client.dbus_object_path)
874 by Teddy Hogeborn
PEP8 compliance: mandos
3473
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
3474
            def client_removed_signal(self, client):
3475
                """Send the new standard signal and the old signal"""
3476
                if use_dbus:
3477
                    # New standard signal
3478
                    self.InterfacesRemoved(
3479
                        client.dbus_object_path,
3480
                        client._get_all_interface_names())
3481
                    # Old signal
3482
                    self.ClientRemoved(client.dbus_object_path,
3483
                                       client.name)
874 by Teddy Hogeborn
PEP8 compliance: mandos
3484
575 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
3485
        mandos_dbus_service = MandosDBusService()
874 by Teddy Hogeborn
PEP8 compliance: mandos
3486
850 by Teddy Hogeborn
mandos: Bug fix: Do multiprocessing cleanup correctly on exit
3487
    # Save modules to variables to exempt the modules from being
3488
    # unloaded before the function registered with atexit() is run.
3489
    mp = multiprocessing
3490
    wn = wnull
874 by Teddy Hogeborn
PEP8 compliance: mandos
3491
400 by Teddy Hogeborn
* mandos (Client.enable): Bug fix: Start new immediate checker last to
3492
    def cleanup():
3493
        "Cleanup function; run on exit"
707 by Teddy Hogeborn
mandos: New "--no-zeroconf" option. Also make "--socket=0" work.
3494
        if zeroconf:
3495
            service.cleanup()
874 by Teddy Hogeborn
PEP8 compliance: mandos
3496
850 by Teddy Hogeborn
mandos: Bug fix: Do multiprocessing cleanup correctly on exit
3497
        mp.active_children()
3498
        wn.close()
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
3499
        if not (tcp_server.clients or client_settings):
3500
            return
874 by Teddy Hogeborn
PEP8 compliance: mandos
3501
521 by teddy at bsnet
* debian/control (mandos/Depends): Added "python-crypto".
3502
        # Store client before exiting. Secrets are encrypted with key
3503
        # based on what config file has. If config file is
3504
        # removed/edited, old secret will thus be unrecovable.
518.1.15 by Björn Påhlsson
more refactoring in regards to how clients get created
3505
        clients = {}
518.1.9 by Björn Påhlsson
renamed variables
3506
        with PGPEngine() as pgp:
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
3507
            for client in tcp_server.clients.values():
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
3508
                key = client_settings[client.name]["secret"]
518.1.9 by Björn Påhlsson
renamed variables
3509
                client.encrypted_secret = pgp.encrypt(client.secret,
3510
                                                      key)
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
3511
                client_dict = {}
874 by Teddy Hogeborn
PEP8 compliance: mandos
3512
518.1.15 by Björn Påhlsson
more refactoring in regards to how clients get created
3513
                # A list of attributes that can not be pickled
3514
                # + secret.
874 by Teddy Hogeborn
PEP8 compliance: mandos
3515
                exclude = {"bus", "changedstate", "secret",
3516
                           "checker", "server_settings"}
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3517
                for name, typ in inspect.getmembers(dbus.service
3518
                                                    .Object):
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
3519
                    exclude.add(name)
874 by Teddy Hogeborn
PEP8 compliance: mandos
3520
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
3521
                client_dict["encrypted_secret"] = (client
3522
                                                   .encrypted_secret)
3523
                for attr in client.client_structure:
3524
                    if attr not in exclude:
3525
                        client_dict[attr] = getattr(client, attr)
874 by Teddy Hogeborn
PEP8 compliance: mandos
3526
518.1.15 by Björn Påhlsson
more refactoring in regards to how clients get created
3527
                clients[client.name] = client_dict
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
3528
                del client_settings[client.name]["secret"]
874 by Teddy Hogeborn
PEP8 compliance: mandos
3529
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
3530
        try:
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3531
            with tempfile.NamedTemporaryFile(
3532
                    mode='wb',
3533
                    suffix=".pickle",
3534
                    prefix='clients-',
3535
                    dir=os.path.dirname(stored_state_path),
3536
                    delete=False) as stored_state:
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
3537
                pickle.dump((clients, client_settings), stored_state,
874 by Teddy Hogeborn
PEP8 compliance: mandos
3538
                            protocol=2)
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3539
                tempname = stored_state.name
505.1.26 by teddy at bsnet
* mandos (main/cleanup): Write new file, then rename. Use
3540
            os.rename(tempname, stored_state_path)
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
3541
        except (IOError, OSError) as e:
530 by teddy at bsnet
* mandos (initlogger): Take new "debug" argument; all callers changed.
3542
            if not debug:
3543
                try:
3544
                    os.remove(tempname)
3545
                except NameError:
3546
                    pass
574 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
3547
            if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
723.1.5 by Teddy Hogeborn
Use the new auto-numbered "{}" syntax for the .format() string method.
3548
                logger.warning("Could not save persistent state: {}"
574 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
3549
                               .format(os.strerror(e.errno)))
3550
            else:
3551
                logger.warning("Could not save persistent state:",
3552
                               exc_info=e)
642 by Teddy Hogeborn
Syntax fix; use "raise" better in Mandos server.
3553
                raise
874 by Teddy Hogeborn
PEP8 compliance: mandos
3554
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
3555
        # Delete all clients, and settings from config
400 by Teddy Hogeborn
* mandos (Client.enable): Bug fix: Start new immediate checker last to
3556
        while tcp_server.clients:
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
3557
            name, client = tcp_server.clients.popitem()
402 by Teddy Hogeborn
* mandos (Client.disable): Rename keyword argument "log" to "quiet",
3558
            if use_dbus:
3559
                client.remove_from_connection()
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
3560
            # Don't signal the disabling
402 by Teddy Hogeborn
* mandos (Client.disable): Rename keyword argument "log" to "quiet",
3561
            client.disable(quiet=True)
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
3562
            # Emit D-Bus signal for removal
796 by Teddy Hogeborn
On cleanup, Signal ClientRemoved only if using D-Bus.
3563
            if use_dbus:
3564
                mandos_dbus_service.client_removed_signal(client)
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
3565
        client_settings.clear()
874 by Teddy Hogeborn
PEP8 compliance: mandos
3566
400 by Teddy Hogeborn
* mandos (Client.enable): Bug fix: Start new immediate checker last to
3567
    atexit.register(cleanup)
874 by Teddy Hogeborn
PEP8 compliance: mandos
3568
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
3569
    for client in tcp_server.clients.values():
243 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
3570
        if use_dbus:
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
3571
            # Emit D-Bus signal for adding
3572
            mandos_dbus_service.client_added_signal(client)
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
3573
        # Need to initiate checking of clients
3574
        if client.enabled:
3575
            client.init_checker()
874 by Teddy Hogeborn
PEP8 compliance: mandos
3576
163 by Teddy Hogeborn
* Makefile (PIDDIR, USER, GROUP): Removed.
3577
    tcp_server.enable()
3578
    tcp_server.server_activate()
874 by Teddy Hogeborn
PEP8 compliance: mandos
3579
28 by Teddy Hogeborn
* server.conf: New file.
3580
    # Find out what port we got
707 by Teddy Hogeborn
mandos: New "--no-zeroconf" option. Also make "--socket=0" work.
3581
    if zeroconf:
3582
        service.port = tcp_server.socket.getsockname()[1]
314 by Teddy Hogeborn
Support not using IPv6 in server:
3583
    if use_ipv6:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
3584
        logger.info("Now listening on address %r, port %d,"
568 by Teddy Hogeborn
* mandos-monitor: Use new string format method.
3585
                    " flowinfo %d, scope_id %d",
3586
                    *tcp_server.socket.getsockname())
314 by Teddy Hogeborn
Support not using IPv6 in server:
3587
    else:                       # IPv4
568 by Teddy Hogeborn
* mandos-monitor: Use new string format method.
3588
        logger.info("Now listening on address %r, port %d",
3589
                    *tcp_server.socket.getsockname())
874 by Teddy Hogeborn
PEP8 compliance: mandos
3590
3591
    # service.interface = tcp_server.socket.getsockname()[3]
3592
28 by Teddy Hogeborn
* server.conf: New file.
3593
    try:
707 by Teddy Hogeborn
mandos: New "--no-zeroconf" option. Also make "--socket=0" work.
3594
        if zeroconf:
3595
            # From the Avahi example code
3596
            try:
3597
                service.activate()
3598
            except dbus.exceptions.DBusException as error:
3599
                logger.critical("D-Bus Exception", exc_info=error)
3600
                cleanup()
3601
                sys.exit(1)
3602
            # End of Avahi example code
874 by Teddy Hogeborn
PEP8 compliance: mandos
3603
830 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
3604
        GLib.io_add_watch(tcp_server.fileno(), GLib.IO_IN,
3605
                          lambda *args, **kwargs:
3606
                          (tcp_server.handle_request
3607
                           (*args[2:], **kwargs) or True))
874 by Teddy Hogeborn
PEP8 compliance: mandos
3608
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
3609
        logger.debug("Starting main loop")
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
3610
        main_loop.run()
482 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
3611
    except AvahiError as error:
565 by Teddy Hogeborn
* mandos (AvahiService.rename, Client.start_checker,
3612
        logger.critical("Avahi Error", exc_info=error)
401 by Teddy Hogeborn
* README (FAQ): Fix typo.
3613
        cleanup()
28 by Teddy Hogeborn
* server.conf: New file.
3614
        sys.exit(1)
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
3615
    except KeyboardInterrupt:
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
3616
        if debug:
463.1.5 by teddy at bsnet
* mandos: Use unicode string literals.
3617
            print("", file=sys.stderr)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
3618
        logger.debug("Server received KeyboardInterrupt")
3619
    logger.debug("Server exiting")
401 by Teddy Hogeborn
* README (FAQ): Fix typo.
3620
    # Must run before the D-Bus bus name gets deregistered
3621
    cleanup()
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
3622
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3623
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
3624
if __name__ == '__main__':
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
3625
    main()