/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk
1185 by Teddy Hogeborn
Add -I option to python 3 on the interpreter script ("shebang") line
1
#!/usr/bin/python3 -bI
1255 by Teddy Hogeborn
mandos-ctl: Update testing code
2
# -*- coding: utf-8; lexical-binding: t -*-
874 by Teddy Hogeborn
PEP8 compliance: mandos
3
#
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
4
# Mandos server - give out binary blobs to connecting clients.
874 by Teddy Hogeborn
PEP8 compliance: mandos
5
#
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
6
# This program is partly derived from an example program for an Avahi
7
# service publisher, downloaded from
8
# <http://avahi.org/wiki/PythonPublishExample>.  This includes the
336 by Teddy Hogeborn
Code cleanup.
9
# methods "add", "remove", "server_state_changed",
10
# "entry_group_state_changed", "cleanup", and "activate" in the
11
# "AvahiService" class, and some lines in "main".
874 by Teddy Hogeborn
PEP8 compliance: mandos
12
#
28 by Teddy Hogeborn
* server.conf: New file.
13
# Everything else is
1259 by Teddy Hogeborn
Update copyright year
14
# Copyright © 2008-2022 Teddy Hogeborn
15
# Copyright © 2008-2022 Björn Påhlsson
874 by Teddy Hogeborn
PEP8 compliance: mandos
16
#
907 by Teddy Hogeborn
Alter copyright notices slightly. Actual license is unchanged!
17
# This file is part of Mandos.
18
#
19
# Mandos is free software: you can redistribute it and/or modify it
20
# under the terms of the GNU General Public License as published by
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
21
# the Free Software Foundation, either version 3 of the License, or
22
# (at your option) any later version.
23
#
907 by Teddy Hogeborn
Alter copyright notices slightly. Actual license is unchanged!
24
#     Mandos is distributed in the hope that it will be useful, but
25
#     WITHOUT ANY WARRANTY; without even the implied warranty of
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
26
#     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
27
#     GNU General Public License for more details.
874 by Teddy Hogeborn
PEP8 compliance: mandos
28
#
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
29
# You should have received a copy of the GNU General Public License
907 by Teddy Hogeborn
Alter copyright notices slightly. Actual license is unchanged!
30
# along with Mandos.  If not, see <http://www.gnu.org/licenses/>.
874 by Teddy Hogeborn
PEP8 compliance: mandos
31
#
505.1.2 by Teddy Hogeborn
Change "fukt.bsnet.se" to "recompile.se" throughout.
32
# Contact the authors at <mandos@recompile.se>.
874 by Teddy Hogeborn
PEP8 compliance: mandos
33
#
463.1.5 by teddy at bsnet
* mandos: Use unicode string literals.
34
from __future__ import (division, absolute_import, print_function,
35
                        unicode_literals)
10 by Teddy Hogeborn
* server.py: Bug fix: Do "from __future__ import division".
36
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
37
try:
38
    from future_builtins import *
39
except ImportError:
40
    pass
579 by Teddy Hogeborn
* mandos: Use all new builtins.
41
1255 by Teddy Hogeborn
mandos-ctl: Update testing code
42
import sys
43
import unittest
44
import argparse
45
import logging
46
import os
749 by Teddy Hogeborn
mandos: Some more minor changes to prepare for Python 3.
47
try:
48
    import SocketServer as socketserver
49
except ImportError:
50
    import socketserver
3 by Björn Påhlsson
Python based server
51
import socket
52
import datetime
53
import errno
749 by Teddy Hogeborn
mandos: Some more minor changes to prepare for Python 3.
54
try:
55
    import ConfigParser as configparser
56
except ImportError:
57
    import configparser
9 by Teddy Hogeborn
* client.cpp (main): Get t_old early since it is used on error exits.
58
import re
59
import signal
10 by Teddy Hogeborn
* server.py: Bug fix: Do "from __future__ import division".
60
import subprocess
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
61
import atexit
62
import stat
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
63
import logging.handlers
163 by Teddy Hogeborn
* Makefile (PIDDIR, USER, GROUP): Removed.
64
import pwd
411 by Teddy Hogeborn
More consistent terminology: Clients are no longer "invalid" - they
65
import contextlib
333 by Teddy Hogeborn
Minor code cleanup; one minor bug fix.
66
import struct
67
import fcntl
337 by Teddy Hogeborn
Code cleanup. Move some global stuff into main.
68
import functools
749 by Teddy Hogeborn
mandos: Some more minor changes to prepare for Python 3.
69
try:
70
    import cPickle as pickle
71
except ImportError:
72
    import pickle
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
73
import multiprocessing
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
74
import types
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
75
import binascii
76
import tempfile
560.1.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
77
import itertools
609 by Teddy Hogeborn
* clients.conf: Convert all time intervals to new RFC 3339 syntax.
78
import collections
751 by Teddy Hogeborn
mandos: Use codecs.open() and print() for PID file.
79
import codecs
1200 by teddy at recompile
Server: Stagger checker runs when creating clients
80
import random
1204 by teddy at recompile
mandos: If possible, use shlex.quote() instead of re.escape()
81
import shlex
5 by Teddy Hogeborn
* server.py (server_metaclass): New.
82
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
83
import dbus
237.1.1 by Teddy Hogeborn
First steps of a D-Bus interface to the server.
84
import dbus.service
1139 by Teddy Hogeborn
Update Python 3 compatibility
85
import gi
830 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
86
from gi.repository import GLib
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
87
from dbus.mainloop.glib import DBusGMainLoop
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
88
import ctypes
215 by Teddy Hogeborn
* mandos: Remove unused "select" module. Import "ctypes.util".
89
import ctypes.util
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
90
import xml.dom.minidom
91
import inspect
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
92
1154 by Teddy Hogeborn
Simplification of Python 3 compatibility code
93
if sys.version_info.major == 2:
94
    __metaclass__ = type
1191 by teddy at recompile
Minor refactor of Python code: Move "str = unicode" to top
95
    str = unicode
1255 by Teddy Hogeborn
mandos-ctl: Update testing code
96
    input = raw_input
1154 by Teddy Hogeborn
Simplification of Python 3 compatibility code
97
1202 by Teddy Hogeborn
Use collections.abc.Callable instead of collections.Callable
98
# Add collections.abc.Callable if it does not exist
99
try:
100
    collections.abc.Callable
101
except AttributeError:
102
    class abc:
103
        Callable = collections.Callable
104
    collections.abc = abc
105
    del abc
106
1204 by teddy at recompile
mandos: If possible, use shlex.quote() instead of re.escape()
107
# Add shlex.quote if it does not exist
108
try:
109
    shlex.quote
110
except AttributeError:
111
    shlex.quote = re.escape
112
1166 by Teddy Hogeborn
Server: Show Python warnings
113
# Show warnings by default
114
if not sys.warnoptions:
115
    import warnings
116
    warnings.simplefilter("default")
117
852 by Teddy Hogeborn
mandos: Bug fix for Python 2.7 and the "--interface" option
118
# Try to find the value of SO_BINDTODEVICE:
331 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
119
try:
852 by Teddy Hogeborn
mandos: Bug fix for Python 2.7 and the "--interface" option
120
    # This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and
121
    # newer, and it is also the most natural place for it:
331 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
122
    SO_BINDTODEVICE = socket.SO_BINDTODEVICE
123
except AttributeError:
124
    try:
852 by Teddy Hogeborn
mandos: Bug fix for Python 2.7 and the "--interface" option
125
        # This is where SO_BINDTODEVICE was up to and including Python
126
        # 2.6, and also 3.2:
331 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
127
        from IN import SO_BINDTODEVICE
128
    except ImportError:
852 by Teddy Hogeborn
mandos: Bug fix for Python 2.7 and the "--interface" option
129
        # In Python 2.7 it seems to have been removed entirely.
130
        # Try running the C preprocessor:
131
        try:
132
            cc = subprocess.Popen(["cc", "--language=c", "-E",
133
                                   "/dev/stdin"],
134
                                  stdin=subprocess.PIPE,
135
                                  stdout=subprocess.PIPE)
136
            stdout = cc.communicate(
137
                "#include <sys/socket.h>\nSO_BINDTODEVICE\n")[0]
138
            SO_BINDTODEVICE = int(stdout.splitlines()[-1])
139
        except (OSError, ValueError, IndexError):
140
            # No value found
141
            SO_BINDTODEVICE = None
331 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
142
1139 by Teddy Hogeborn
Update Python 3 compatibility
143
if sys.version_info < (3, 2):
144
    configparser.Configparser = configparser.SafeConfigParser
145
237.4.142 by Teddy Hogeborn
Version 1.8.17-1
146
version = "1.8.17"
518.2.2 by Teddy Hogeborn
Directory with persistent state can now be changed with the "statedir"
147
stored_state_file = "clients.pickle"
13 by Björn Påhlsson
Added following support:
148
1254 by Teddy Hogeborn
mandos: Update logging code to more standard idioms
149
log = logging.getLogger(os.path.basename(sys.argv[0]))
1166 by Teddy Hogeborn
Server: Show Python warnings
150
logging.captureWarnings(True)   # Show warnings via the logging system
655 by Teddy Hogeborn
Allow self-tests to run without needing /dev/log.
151
syslogger = None
13 by Björn Påhlsson
Added following support:
152
518.1.5 by Björn Påhlsson
First run of python-lint. Fixed some *obviously* bad code and turned
153
try:
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
154
    if_nametoindex = ctypes.cdll.LoadLibrary(
155
        ctypes.util.find_library("c")).if_nametoindex
518.1.5 by Björn Påhlsson
First run of python-lint. Fixed some *obviously* bad code and turned
156
except (OSError, AttributeError):
874 by Teddy Hogeborn
PEP8 compliance: mandos
157
518.1.5 by Björn Påhlsson
First run of python-lint. Fixed some *obviously* bad code and turned
158
    def if_nametoindex(interface):
159
        "Get an interface index the hard way, i.e. using fcntl()"
160
        SIOCGIFINDEX = 0x8933  # From /usr/include/linux/sockios.h
161
        with contextlib.closing(socket.socket()) as s:
162
            ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
729 by Teddy Hogeborn
mandos: Stop using str() and remove unnecessary unicode() calls.
163
                                struct.pack(b"16s16x", interface))
164
        interface_index = struct.unpack("I", ifreq[16:20])[0]
518.1.5 by Björn Påhlsson
First run of python-lint. Fixed some *obviously* bad code and turned
165
        return interface_index
166
167
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
168
def copy_function(func):
169
    """Make a copy of a function"""
170
    if sys.version_info.major == 2:
171
        return types.FunctionType(func.func_code,
172
                                  func.func_globals,
173
                                  func.func_name,
174
                                  func.func_defaults,
175
                                  func.func_closure)
176
    else:
177
        return types.FunctionType(func.__code__,
178
                                  func.__globals__,
179
                                  func.__name__,
180
                                  func.__defaults__,
181
                                  func.__closure__)
182
183
530 by teddy at bsnet
* mandos (initlogger): Take new "debug" argument; all callers changed.
184
def initlogger(debug, level=logging.WARNING):
518.1.4 by Björn Påhlsson
restructured logger
185
    """init logger and add loglevel"""
874 by Teddy Hogeborn
PEP8 compliance: mandos
186
698 by Teddy Hogeborn
Fix mandos server "--servicename" option, broken since 1.6.4.
187
    global syslogger
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
188
    syslogger = (logging.handlers.SysLogHandler(
874 by Teddy Hogeborn
PEP8 compliance: mandos
189
        facility=logging.handlers.SysLogHandler.LOG_DAEMON,
190
        address="/dev/log"))
518.1.4 by Björn Påhlsson
restructured logger
191
    syslogger.setFormatter(logging.Formatter
1247 by Teddy Hogeborn
Server: Fix minor style issue
192
                           ("Mandos [%(process)d]: %(levelname)s:"
193
                            " %(message)s"))
1254 by Teddy Hogeborn
mandos: Update logging code to more standard idioms
194
    log.addHandler(syslogger)
874 by Teddy Hogeborn
PEP8 compliance: mandos
195
530 by teddy at bsnet
* mandos (initlogger): Take new "debug" argument; all callers changed.
196
    if debug:
197
        console = logging.StreamHandler()
1247 by Teddy Hogeborn
Server: Fix minor style issue
198
        console.setFormatter(logging.Formatter("%(asctime)s %(name)s"
199
                                               " [%(process)d]:"
200
                                               " %(levelname)s:"
201
                                               " %(message)s"))
1254 by Teddy Hogeborn
mandos: Update logging code to more standard idioms
202
        log.addHandler(console)
203
    log.setLevel(level)
28 by Teddy Hogeborn
* server.conf: New file.
204
505.1.20 by Teddy Hogeborn
* Makefile (run-server): Remove obsolete warning.
205
518.1.9 by Björn Påhlsson
renamed variables
206
class PGPError(Exception):
207
    """Exception if encryption/decryption fails"""
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
208
    pass
209
210
1154 by Teddy Hogeborn
Simplification of Python 3 compatibility code
211
class PGPEngine:
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
212
    """A simple class for OpenPGP symmetric encryption & decryption"""
874 by Teddy Hogeborn
PEP8 compliance: mandos
213
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
214
    def __init__(self):
215
        self.tempdir = tempfile.mkdtemp(prefix="mandos-")
805 by Teddy Hogeborn
Use GnuPG 2 if available
216
        self.gpg = "gpg"
217
        try:
218
            output = subprocess.check_output(["gpgconf"])
219
            for line in output.splitlines():
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
220
                name, text, path = line.split(b":")
1173 by Teddy Hogeborn
Fix minor Python 3 bytes/str mixups
221
                if name == b"gpg":
805 by Teddy Hogeborn
Use GnuPG 2 if available
222
                    self.gpg = path
223
                    break
224
        except OSError as e:
225
            if e.errno != errno.ENOENT:
226
                raise
1247 by Teddy Hogeborn
Server: Fix minor style issue
227
        self.gnupgargs = ["--batch",
228
                          "--homedir", self.tempdir,
229
                          "--force-mdc",
230
                          "--quiet"]
849 by Teddy Hogeborn
mandos: Bug fix: Only use the --no-use-agent option for GPG 1
231
        # Only GPG version 1 has the --no-use-agent option.
1173 by Teddy Hogeborn
Fix minor Python 3 bytes/str mixups
232
        if self.gpg == b"gpg" or self.gpg.endswith(b"/gpg"):
849 by Teddy Hogeborn
mandos: Bug fix: Only use the --no-use-agent option for GPG 1
233
            self.gnupgargs.append("--no-use-agent")
874 by Teddy Hogeborn
PEP8 compliance: mandos
234
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
235
    def __enter__(self):
236
        return self
874 by Teddy Hogeborn
PEP8 compliance: mandos
237
587 by Teddy Hogeborn
* Makefile (DOCBOOKTOMAN): Only run man --warnings if both "man" and
238
    def __exit__(self, exc_type, exc_value, traceback):
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
239
        self._cleanup()
240
        return False
874 by Teddy Hogeborn
PEP8 compliance: mandos
241
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
242
    def __del__(self):
243
        self._cleanup()
874 by Teddy Hogeborn
PEP8 compliance: mandos
244
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
245
    def _cleanup(self):
246
        if self.tempdir is not None:
247
            # Delete contents of tempdir
248
            for root, dirs, files in os.walk(self.tempdir,
874 by Teddy Hogeborn
PEP8 compliance: mandos
249
                                             topdown=False):
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
250
                for filename in files:
251
                    os.remove(os.path.join(root, filename))
252
                for dirname in dirs:
253
                    os.rmdir(os.path.join(root, dirname))
254
            # Remove tempdir
255
            os.rmdir(self.tempdir)
256
            self.tempdir = None
874 by Teddy Hogeborn
PEP8 compliance: mandos
257
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
258
    def password_encode(self, password):
259
        # Passphrase can not be empty and can not contain newlines or
260
        # NUL bytes.  So we prefix it and hex encode it.
630 by Teddy Hogeborn
* mandos (PGPEngine.password_encode): Bug fix: GnuPG can't handle
261
        encoded = b"mandos" + binascii.hexlify(password)
262
        if len(encoded) > 2048:
263
            # GnuPG can't handle long passwords, so encode differently
264
            encoded = (b"mandos" + password.replace(b"\\", b"\\\\")
265
                       .replace(b"\n", b"\\n")
266
                       .replace(b"\0", b"\\x00"))
267
        return encoded
874 by Teddy Hogeborn
PEP8 compliance: mandos
268
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
269
    def encrypt(self, data, password):
615 by Teddy Hogeborn
* mandos: Don't use the GnuPGInterface module.
270
        passphrase = self.password_encode(password)
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
271
        with tempfile.NamedTemporaryFile(
272
                dir=self.tempdir) as passfile:
615 by Teddy Hogeborn
* mandos: Don't use the GnuPGInterface module.
273
            passfile.write(passphrase)
274
            passfile.flush()
1247 by Teddy Hogeborn
Server: Fix minor style issue
275
            proc = subprocess.Popen([self.gpg, "--symmetric",
276
                                     "--passphrase-file",
615 by Teddy Hogeborn
* mandos: Don't use the GnuPGInterface module.
277
                                     passfile.name]
278
                                    + self.gnupgargs,
874 by Teddy Hogeborn
PEP8 compliance: mandos
279
                                    stdin=subprocess.PIPE,
280
                                    stdout=subprocess.PIPE,
281
                                    stderr=subprocess.PIPE)
282
            ciphertext, err = proc.communicate(input=data)
615 by Teddy Hogeborn
* mandos: Don't use the GnuPGInterface module.
283
        if proc.returncode != 0:
284
            raise PGPError(err)
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
285
        return ciphertext
874 by Teddy Hogeborn
PEP8 compliance: mandos
286
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
287
    def decrypt(self, data, password):
615 by Teddy Hogeborn
* mandos: Don't use the GnuPGInterface module.
288
        passphrase = self.password_encode(password)
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
289
        with tempfile.NamedTemporaryFile(
874 by Teddy Hogeborn
PEP8 compliance: mandos
290
                dir=self.tempdir) as passfile:
615 by Teddy Hogeborn
* mandos: Don't use the GnuPGInterface module.
291
            passfile.write(passphrase)
292
            passfile.flush()
1247 by Teddy Hogeborn
Server: Fix minor style issue
293
            proc = subprocess.Popen([self.gpg, "--decrypt",
294
                                     "--passphrase-file",
615 by Teddy Hogeborn
* mandos: Don't use the GnuPGInterface module.
295
                                     passfile.name]
296
                                    + self.gnupgargs,
874 by Teddy Hogeborn
PEP8 compliance: mandos
297
                                    stdin=subprocess.PIPE,
298
                                    stdout=subprocess.PIPE,
299
                                    stderr=subprocess.PIPE)
300
            decrypted_plaintext, err = proc.communicate(input=data)
615 by Teddy Hogeborn
* mandos: Don't use the GnuPGInterface module.
301
        if proc.returncode != 0:
302
            raise PGPError(err)
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
303
        return decrypted_plaintext
304
874 by Teddy Hogeborn
PEP8 compliance: mandos
305
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
306
# Pretend that we have an Avahi module
1154 by Teddy Hogeborn
Simplification of Python 3 compatibility code
307
class avahi:
1088 by Teddy Hogeborn
mandos: Refactor; use classes, not instances, as namespaces
308
    """This isn't so much a class as it is a module-like namespace."""
874 by Teddy Hogeborn
PEP8 compliance: mandos
309
    IF_UNSPEC = -1               # avahi-common/address.h
310
    PROTO_UNSPEC = -1            # avahi-common/address.h
311
    PROTO_INET = 0               # avahi-common/address.h
312
    PROTO_INET6 = 1              # avahi-common/address.h
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
313
    DBUS_NAME = "org.freedesktop.Avahi"
314
    DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"
315
    DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"
316
    DBUS_PATH_SERVER = "/"
874 by Teddy Hogeborn
PEP8 compliance: mandos
317
1088 by Teddy Hogeborn
mandos: Refactor; use classes, not instances, as namespaces
318
    @staticmethod
319
    def string_array_to_txt_array(t):
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
320
        return dbus.Array((dbus.ByteArray(s.encode("utf-8"))
321
                           for s in t), signature="ay")
874 by Teddy Hogeborn
PEP8 compliance: mandos
322
    ENTRY_GROUP_ESTABLISHED = 2  # avahi-common/defs.h
323
    ENTRY_GROUP_COLLISION = 3    # avahi-common/defs.h
324
    ENTRY_GROUP_FAILURE = 4      # avahi-common/defs.h
325
    SERVER_INVALID = 0           # avahi-common/defs.h
326
    SERVER_REGISTERING = 1       # avahi-common/defs.h
327
    SERVER_RUNNING = 2           # avahi-common/defs.h
328
    SERVER_COLLISION = 3         # avahi-common/defs.h
329
    SERVER_FAILURE = 4           # avahi-common/defs.h
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
330
874 by Teddy Hogeborn
PEP8 compliance: mandos
331
28 by Teddy Hogeborn
* server.conf: New file.
332
class AvahiError(Exception):
242 by Teddy Hogeborn
* mandos (AvahiError): Converted to use unicode. All users changed.
333
    def __init__(self, value, *args, **kwargs):
28 by Teddy Hogeborn
* server.conf: New file.
334
        self.value = value
729 by Teddy Hogeborn
mandos: Stop using str() and remove unnecessary unicode() calls.
335
        return super(AvahiError, self).__init__(value, *args,
336
                                                **kwargs)
28 by Teddy Hogeborn
* server.conf: New file.
337
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
338
28 by Teddy Hogeborn
* server.conf: New file.
339
class AvahiServiceError(AvahiError):
340
    pass
341
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
342
28 by Teddy Hogeborn
* server.conf: New file.
343
class AvahiGroupError(AvahiError):
344
    pass
345
346
1154 by Teddy Hogeborn
Simplification of Python 3 compatibility code
347
class AvahiService:
45 by Teddy Hogeborn
* server.py: Cosmetic changes.
348
    """An Avahi (Zeroconf) service.
874 by Teddy Hogeborn
PEP8 compliance: mandos
349
45 by Teddy Hogeborn
* server.py: Cosmetic changes.
350
    Attributes:
28 by Teddy Hogeborn
* server.conf: New file.
351
    interface: integer; avahi.IF_UNSPEC or an interface index.
352
               Used to optionally bind to the specified interface.
1247 by Teddy Hogeborn
Server: Fix minor style issue
353
    name: string; Example: "Mandos"
354
    type: string; Example: "_mandos._tcp".
614 by Teddy Hogeborn
* mandos: Comment changes.
355
     See <https://www.iana.org/assignments/service-names-port-numbers>
45 by Teddy Hogeborn
* server.py: Cosmetic changes.
356
    port: integer; what port to announce
357
    TXT: list of strings; TXT record for the service
358
    domain: string; Domain to publish on, default to .local if empty.
359
    host: string; Host to publish records for, default is localhost
360
    max_renames: integer; maximum number of renames
361
    rename_count: integer; counter so we only rename after collisions
362
                  a sensible number of times
336 by Teddy Hogeborn
Code cleanup.
363
    group: D-Bus Entry Group
364
    server: D-Bus Server
338 by Teddy Hogeborn
* mandos: Minor doc string fixes.
365
    bus: dbus.SystemBus()
28 by Teddy Hogeborn
* server.conf: New file.
366
    """
874 by Teddy Hogeborn
PEP8 compliance: mandos
367
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
368
    def __init__(self,
874 by Teddy Hogeborn
PEP8 compliance: mandos
369
                 interface=avahi.IF_UNSPEC,
370
                 name=None,
371
                 servicetype=None,
372
                 port=None,
373
                 TXT=None,
374
                 domain="",
375
                 host="",
376
                 max_renames=32768,
377
                 protocol=avahi.PROTO_UNSPEC,
378
                 bus=None):
28 by Teddy Hogeborn
* server.conf: New file.
379
        self.interface = interface
380
        self.name = name
215 by Teddy Hogeborn
* mandos: Remove unused "select" module. Import "ctypes.util".
381
        self.type = servicetype
28 by Teddy Hogeborn
* server.conf: New file.
382
        self.port = port
237.1.2 by Teddy Hogeborn
Further steps towards a D-Bus server interface, plus minor syntax
383
        self.TXT = TXT if TXT is not None else []
28 by Teddy Hogeborn
* server.conf: New file.
384
        self.domain = domain
385
        self.host = host
386
        self.rename_count = 0
76 by Teddy Hogeborn
* plugins.d/password-request.c (init_gnutls_global): Renamed
387
        self.max_renames = max_renames
314 by Teddy Hogeborn
Support not using IPv6 in server:
388
        self.protocol = protocol
336 by Teddy Hogeborn
Code cleanup.
389
        self.group = None       # our entry group
390
        self.server = None
337 by Teddy Hogeborn
Code cleanup. Move some global stuff into main.
391
        self.bus = bus
482 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
392
        self.entry_group_state_changed_match = None
874 by Teddy Hogeborn
PEP8 compliance: mandos
393
738 by Teddy Hogeborn
Handle local Zeroconf service name collisions.
394
    def rename(self, remove=True):
28 by Teddy Hogeborn
* server.conf: New file.
395
        """Derived from the Avahi example code"""
396
        if self.rename_count >= self.max_renames:
1254 by Teddy Hogeborn
mandos: Update logging code to more standard idioms
397
            log.critical("No suitable Zeroconf service name found"
398
                         " after %i retries, exiting.",
399
                         self.rename_count)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
400
            raise AvahiServiceError("Too many renames")
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
401
        self.name = str(
402
            self.server.GetAlternativeServiceName(self.name))
738 by Teddy Hogeborn
Handle local Zeroconf service name collisions.
403
        self.rename_count += 1
1254 by Teddy Hogeborn
mandos: Update logging code to more standard idioms
404
        log.info("Changing Zeroconf service name to %r ...",
405
                 self.name)
738 by Teddy Hogeborn
Handle local Zeroconf service name collisions.
406
        if remove:
407
            self.remove()
24.1.160 by Björn Påhlsson
fixed bug with local name collisions after a non-local name collision
408
        try:
409
            self.add()
482 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
410
        except dbus.exceptions.DBusException as error:
738 by Teddy Hogeborn
Handle local Zeroconf service name collisions.
411
            if (error.get_dbus_name()
412
                == "org.freedesktop.Avahi.CollisionError"):
1254 by Teddy Hogeborn
mandos: Update logging code to more standard idioms
413
                log.info("Local Zeroconf service name collision.")
738 by Teddy Hogeborn
Handle local Zeroconf service name collisions.
414
                return self.rename(remove=False)
415
            else:
1254 by Teddy Hogeborn
mandos: Update logging code to more standard idioms
416
                log.critical("D-Bus Exception", exc_info=error)
738 by Teddy Hogeborn
Handle local Zeroconf service name collisions.
417
                self.cleanup()
418
                os._exit(1)
874 by Teddy Hogeborn
PEP8 compliance: mandos
419
28 by Teddy Hogeborn
* server.conf: New file.
420
    def remove(self):
421
        """Derived from the Avahi example code"""
482 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
422
        if self.entry_group_state_changed_match is not None:
423
            self.entry_group_state_changed_match.remove()
424
            self.entry_group_state_changed_match = None
483 by Teddy Hogeborn
* mandos: Never call .Reset() on a defunct Avahi entry group.
425
        if self.group is not None:
426
            self.group.Reset()
874 by Teddy Hogeborn
PEP8 compliance: mandos
427
28 by Teddy Hogeborn
* server.conf: New file.
428
    def add(self):
429
        """Derived from the Avahi example code"""
482 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
430
        self.remove()
483 by Teddy Hogeborn
* mandos: Never call .Reset() on a defunct Avahi entry group.
431
        if self.group is None:
432
            self.group = dbus.Interface(
433
                self.bus.get_object(avahi.DBUS_NAME,
434
                                    self.server.EntryGroupNew()),
435
                avahi.DBUS_INTERFACE_ENTRY_GROUP)
482 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
436
        self.entry_group_state_changed_match = (
437
            self.group.connect_to_signal(
1247 by Teddy Hogeborn
Server: Fix minor style issue
438
                "StateChanged", self.entry_group_state_changed))
1254 by Teddy Hogeborn
mandos: Update logging code to more standard idioms
439
        log.debug("Adding Zeroconf service '%s' of type '%s' ...",
440
                  self.name, self.type)
336 by Teddy Hogeborn
Code cleanup.
441
        self.group.AddService(
442
            self.interface,
443
            self.protocol,
444
            dbus.UInt32(0),     # flags
445
            self.name, self.type,
446
            self.domain, self.host,
447
            dbus.UInt16(self.port),
448
            avahi.string_array_to_txt_array(self.TXT))
449
        self.group.Commit()
874 by Teddy Hogeborn
PEP8 compliance: mandos
450
336 by Teddy Hogeborn
Code cleanup.
451
    def entry_group_state_changed(self, state, error):
452
        """Derived from the Avahi example code"""
1254 by Teddy Hogeborn
mandos: Update logging code to more standard idioms
453
        log.debug("Avahi entry group state change: %i", state)
874 by Teddy Hogeborn
PEP8 compliance: mandos
454
336 by Teddy Hogeborn
Code cleanup.
455
        if state == avahi.ENTRY_GROUP_ESTABLISHED:
1254 by Teddy Hogeborn
mandos: Update logging code to more standard idioms
456
            log.debug("Zeroconf service established.")
336 by Teddy Hogeborn
Code cleanup.
457
        elif state == avahi.ENTRY_GROUP_COLLISION:
1254 by Teddy Hogeborn
mandos: Update logging code to more standard idioms
458
            log.info("Zeroconf service name collision.")
336 by Teddy Hogeborn
Code cleanup.
459
            self.rename()
460
        elif state == avahi.ENTRY_GROUP_FAILURE:
1254 by Teddy Hogeborn
mandos: Update logging code to more standard idioms
461
            log.critical("Avahi: Error in group state changed %s",
462
                         str(error))
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
463
            raise AvahiGroupError("State changed: {!s}".format(error))
874 by Teddy Hogeborn
PEP8 compliance: mandos
464
336 by Teddy Hogeborn
Code cleanup.
465
    def cleanup(self):
466
        """Derived from the Avahi example code"""
483 by Teddy Hogeborn
* mandos: Never call .Reset() on a defunct Avahi entry group.
467
        if self.group is not None:
468
            try:
469
                self.group.Free()
470
            except (dbus.exceptions.UnknownMethodException,
518.1.5 by Björn Påhlsson
First run of python-lint. Fixed some *obviously* bad code and turned
471
                    dbus.exceptions.DBusException):
483 by Teddy Hogeborn
* mandos: Never call .Reset() on a defunct Avahi entry group.
472
                pass
473
            self.group = None
482 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
474
        self.remove()
874 by Teddy Hogeborn
PEP8 compliance: mandos
475
482 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
476
    def server_state_changed(self, state, error=None):
336 by Teddy Hogeborn
Code cleanup.
477
        """Derived from the Avahi example code"""
1254 by Teddy Hogeborn
mandos: Update logging code to more standard idioms
478
        log.debug("Avahi server state change: %i", state)
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
479
        bad_states = {
480
            avahi.SERVER_INVALID: "Zeroconf server invalid",
481
            avahi.SERVER_REGISTERING: None,
482
            avahi.SERVER_COLLISION: "Zeroconf server name collision",
483
            avahi.SERVER_FAILURE: "Zeroconf server failure",
484
        }
482 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
485
        if state in bad_states:
483 by Teddy Hogeborn
* mandos: Never call .Reset() on a defunct Avahi entry group.
486
            if bad_states[state] is not None:
487
                if error is None:
1254 by Teddy Hogeborn
mandos: Update logging code to more standard idioms
488
                    log.error(bad_states[state])
483 by Teddy Hogeborn
* mandos: Never call .Reset() on a defunct Avahi entry group.
489
                else:
1254 by Teddy Hogeborn
mandos: Update logging code to more standard idioms
490
                    log.error(bad_states[state] + ": %r", error)
483 by Teddy Hogeborn
* mandos: Never call .Reset() on a defunct Avahi entry group.
491
            self.cleanup()
336 by Teddy Hogeborn
Code cleanup.
492
        elif state == avahi.SERVER_RUNNING:
769 by Teddy Hogeborn
Handle local Zeroconf service name collisions on startup, too.
493
            try:
494
                self.add()
495
            except dbus.exceptions.DBusException as error:
496
                if (error.get_dbus_name()
497
                    == "org.freedesktop.Avahi.CollisionError"):
1254 by Teddy Hogeborn
mandos: Update logging code to more standard idioms
498
                    log.info("Local Zeroconf service name collision.")
769 by Teddy Hogeborn
Handle local Zeroconf service name collisions on startup, too.
499
                    return self.rename(remove=False)
500
                else:
1254 by Teddy Hogeborn
mandos: Update logging code to more standard idioms
501
                    log.critical("D-Bus Exception", exc_info=error)
769 by Teddy Hogeborn
Handle local Zeroconf service name collisions on startup, too.
502
                    self.cleanup()
503
                    os._exit(1)
482 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
504
        else:
483 by Teddy Hogeborn
* mandos: Never call .Reset() on a defunct Avahi entry group.
505
            if error is None:
1254 by Teddy Hogeborn
mandos: Update logging code to more standard idioms
506
                log.debug("Unknown state: %r", state)
483 by Teddy Hogeborn
* mandos: Never call .Reset() on a defunct Avahi entry group.
507
            else:
1254 by Teddy Hogeborn
mandos: Update logging code to more standard idioms
508
                log.debug("Unknown state: %r: %r", state, error)
874 by Teddy Hogeborn
PEP8 compliance: mandos
509
336 by Teddy Hogeborn
Code cleanup.
510
    def activate(self):
511
        """Derived from the Avahi example code"""
512
        if self.server is None:
513
            self.server = dbus.Interface(
337 by Teddy Hogeborn
Code cleanup. Move some global stuff into main.
514
                self.bus.get_object(avahi.DBUS_NAME,
482 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
515
                                    avahi.DBUS_PATH_SERVER,
516
                                    follow_name_owner_changes=True),
336 by Teddy Hogeborn
Code cleanup.
517
                avahi.DBUS_INTERFACE_SERVER)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
518
        self.server.connect_to_signal("StateChanged",
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
519
                                      self.server_state_changed)
336 by Teddy Hogeborn
Code cleanup.
520
        self.server_state_changed(self.server.GetState())
238 by Teddy Hogeborn
First version of a somewhat complete D-Bus server interface. Also
521
582 by Teddy Hogeborn
* mandos (IPv6_TCPServer.server_bind): Bug fix: handle non-existing
522
505.1.20 by Teddy Hogeborn
* Makefile (run-server): Remove obsolete warning.
523
class AvahiServiceToSyslog(AvahiService):
738 by Teddy Hogeborn
Handle local Zeroconf service name collisions.
524
    def rename(self, *args, **kwargs):
505.1.20 by Teddy Hogeborn
* Makefile (run-server): Remove obsolete warning.
525
        """Add the new name to the syslog messages"""
1220 by teddy at recompile
mandos: Shorten or break long lines
526
        ret = super(AvahiServiceToSyslog, self).rename(*args,
527
                                                       **kwargs)
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
528
        syslogger.setFormatter(logging.Formatter(
1247 by Teddy Hogeborn
Server: Fix minor style issue
529
            "Mandos ({}) [%(process)d]: %(levelname)s: %(message)s"
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
530
            .format(self.name)))
505.1.20 by Teddy Hogeborn
* Makefile (run-server): Remove obsolete warning.
531
        return ret
238 by Teddy Hogeborn
First version of a somewhat complete D-Bus server interface. Also
532
874 by Teddy Hogeborn
PEP8 compliance: mandos
533
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
534
# Pretend that we have a GnuTLS module
1154 by Teddy Hogeborn
Simplification of Python 3 compatibility code
535
class gnutls:
1088 by Teddy Hogeborn
mandos: Refactor; use classes, not instances, as namespaces
536
    """This isn't so much a class as it is a module-like namespace."""
874 by Teddy Hogeborn
PEP8 compliance: mandos
537
875 by Teddy Hogeborn
Fix bug where mandos server could not find GnuTLS library
538
    library = ctypes.util.find_library("gnutls")
539
    if library is None:
540
        library = ctypes.util.find_library("gnutls-deb0")
541
    _library = ctypes.cdll.LoadLibrary(library)
542
    del library
874 by Teddy Hogeborn
PEP8 compliance: mandos
543
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
544
    # Unless otherwise indicated, the constants and types below are
545
    # all from the gnutls/gnutls.h C header file.
874 by Teddy Hogeborn
PEP8 compliance: mandos
546
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
547
    # Constants
548
    E_SUCCESS = 0
802 by Teddy Hogeborn
Handle GnuTLS errors and partial sends in gnutls "module".
549
    E_INTERRUPTED = -52
550
    E_AGAIN = -28
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
551
    CRT_OPENPGP = 2
962 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
552
    CRT_RAWPK = 3
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
553
    CLIENT = 2
554
    SHUT_RDWR = 0
555
    CRD_CERTIFICATE = 1
556
    E_NO_CERTIFICATE_FOUND = -49
962 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
557
    X509_FMT_DER = 0
558
    NO_TICKETS = 1<<10
559
    ENABLE_RAWPK = 1<<18
560
    CTYPE_PEERS = 3
561
    KEYID_USE_SHA256 = 1        # gnutls/x509.h
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
562
    OPENPGP_FMT_RAW = 0         # gnutls/openpgp.h
874 by Teddy Hogeborn
PEP8 compliance: mandos
563
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
564
    # Types
1243 by Teddy Hogeborn
Some cleanup of GnuTLS interface
565
    class _session_int(ctypes.Structure):
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
566
        _fields_ = []
1243 by Teddy Hogeborn
Some cleanup of GnuTLS interface
567
    session_t = ctypes.POINTER(_session_int)
874 by Teddy Hogeborn
PEP8 compliance: mandos
568
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
569
    class certificate_credentials_st(ctypes.Structure):
570
        _fields_ = []
571
    certificate_credentials_t = ctypes.POINTER(
572
        certificate_credentials_st)
573
    certificate_type_t = ctypes.c_int
874 by Teddy Hogeborn
PEP8 compliance: mandos
574
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
575
    class datum_t(ctypes.Structure):
1247 by Teddy Hogeborn
Server: Fix minor style issue
576
        _fields_ = [("data", ctypes.POINTER(ctypes.c_ubyte)),
577
                    ("size", ctypes.c_uint)]
874 by Teddy Hogeborn
PEP8 compliance: mandos
578
1243 by Teddy Hogeborn
Some cleanup of GnuTLS interface
579
    class _openpgp_crt_int(ctypes.Structure):
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
580
        _fields_ = []
1243 by Teddy Hogeborn
Some cleanup of GnuTLS interface
581
    openpgp_crt_t = ctypes.POINTER(_openpgp_crt_int)
874 by Teddy Hogeborn
PEP8 compliance: mandos
582
    openpgp_crt_fmt_t = ctypes.c_int  # gnutls/openpgp.h
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
583
    log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
824 by Teddy Hogeborn
Remove empty comment
584
    credentials_type_t = ctypes.c_int
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
585
    transport_ptr_t = ctypes.c_void_p
586
    close_request_t = ctypes.c_int
874 by Teddy Hogeborn
PEP8 compliance: mandos
587
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
588
    # Exceptions
589
    class Error(Exception):
874 by Teddy Hogeborn
PEP8 compliance: mandos
590
        def __init__(self, message=None, code=None, args=()):
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
591
            # Default usage is by a message string, but if a return
592
            # code is passed, convert it to a string with
593
            # gnutls.strerror()
802 by Teddy Hogeborn
Handle GnuTLS errors and partial sends in gnutls "module".
594
            self.code = code
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
595
            if message is None and code is not None:
1243 by Teddy Hogeborn
Some cleanup of GnuTLS interface
596
                message = gnutls.strerror(code).decode(
597
                    "utf-8", errors="replace")
1088 by Teddy Hogeborn
mandos: Refactor; use classes, not instances, as namespaces
598
            return super(gnutls.Error, self).__init__(
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
599
                message, *args)
874 by Teddy Hogeborn
PEP8 compliance: mandos
600
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
601
    class CertificateSecurityError(Error):
602
        pass
874 by Teddy Hogeborn
PEP8 compliance: mandos
603
1243 by Teddy Hogeborn
Some cleanup of GnuTLS interface
604
    class PointerTo:
605
        def __init__(self, cls):
606
            self.cls = cls
607
608
        def from_param(self, obj):
609
            if not isinstance(obj, self.cls):
610
                raise TypeError("Not of type {}: {!r}"
611
                                .format(self.cls.__name__, obj))
612
            return ctypes.byref(obj.from_param(obj))
613
614
    class CastToVoidPointer:
615
        def __init__(self, cls):
616
            self.cls = cls
617
618
        def from_param(self, obj):
619
            if not isinstance(obj, self.cls):
620
                raise TypeError("Not of type {}: {!r}"
621
                                .format(self.cls.__name__, obj))
622
            return ctypes.cast(obj.from_param(obj), ctypes.c_void_p)
623
624
    class With_from_param:
625
        @classmethod
626
        def from_param(cls, obj):
627
            return obj._as_parameter_
628
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
629
    # Classes
1243 by Teddy Hogeborn
Some cleanup of GnuTLS interface
630
    class Credentials(With_from_param):
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
631
        def __init__(self):
1243 by Teddy Hogeborn
Some cleanup of GnuTLS interface
632
            self._as_parameter_ = gnutls.certificate_credentials_t()
633
            gnutls.certificate_allocate_credentials(self)
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
634
            self.type = gnutls.CRD_CERTIFICATE
874 by Teddy Hogeborn
PEP8 compliance: mandos
635
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
636
        def __del__(self):
1243 by Teddy Hogeborn
Some cleanup of GnuTLS interface
637
            gnutls.certificate_free_credentials(self)
874 by Teddy Hogeborn
PEP8 compliance: mandos
638
1243 by Teddy Hogeborn
Some cleanup of GnuTLS interface
639
    class ClientSession(With_from_param):
874 by Teddy Hogeborn
PEP8 compliance: mandos
640
        def __init__(self, socket, credentials=None):
1243 by Teddy Hogeborn
Some cleanup of GnuTLS interface
641
            self._as_parameter_ = gnutls.session_t()
962 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
642
            gnutls_flags = gnutls.CLIENT
1130 by Teddy Hogeborn
Update Python 3 compatibility
643
            if gnutls.check_version(b"3.5.6"):
962 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
644
                gnutls_flags |= gnutls.NO_TICKETS
645
            if gnutls.has_rawpk:
646
                gnutls_flags |= gnutls.ENABLE_RAWPK
1243 by Teddy Hogeborn
Some cleanup of GnuTLS interface
647
            gnutls.init(self, gnutls_flags)
962 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
648
            del gnutls_flags
1243 by Teddy Hogeborn
Some cleanup of GnuTLS interface
649
            gnutls.set_default_priority(self)
650
            gnutls.transport_set_ptr(self, socket.fileno())
651
            gnutls.handshake_set_private_extensions(self, True)
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
652
            self.socket = socket
653
            if credentials is None:
654
                credentials = gnutls.Credentials()
1243 by Teddy Hogeborn
Some cleanup of GnuTLS interface
655
            gnutls.credentials_set(self, credentials.type,
656
                                   credentials)
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
657
            self.credentials = credentials
874 by Teddy Hogeborn
PEP8 compliance: mandos
658
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
659
        def __del__(self):
1243 by Teddy Hogeborn
Some cleanup of GnuTLS interface
660
            gnutls.deinit(self)
874 by Teddy Hogeborn
PEP8 compliance: mandos
661
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
662
        def handshake(self):
1243 by Teddy Hogeborn
Some cleanup of GnuTLS interface
663
            return gnutls.handshake(self)
874 by Teddy Hogeborn
PEP8 compliance: mandos
664
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
665
        def send(self, data):
666
            data = bytes(data)
802 by Teddy Hogeborn
Handle GnuTLS errors and partial sends in gnutls "module".
667
            data_len = len(data)
668
            while data_len > 0:
1243 by Teddy Hogeborn
Some cleanup of GnuTLS interface
669
                data_len -= gnutls.record_send(self, data[-data_len:],
802 by Teddy Hogeborn
Handle GnuTLS errors and partial sends in gnutls "module".
670
                                               data_len)
874 by Teddy Hogeborn
PEP8 compliance: mandos
671
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
672
        def bye(self):
1243 by Teddy Hogeborn
Some cleanup of GnuTLS interface
673
            return gnutls.bye(self, gnutls.SHUT_RDWR)
874 by Teddy Hogeborn
PEP8 compliance: mandos
674
802 by Teddy Hogeborn
Handle GnuTLS errors and partial sends in gnutls "module".
675
    # Error handling functions
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
676
    def _error_code(result):
677
        """A function to raise exceptions on errors, suitable
1247 by Teddy Hogeborn
Server: Fix minor style issue
678
        for the "restype" attribute on ctypes functions"""
1243 by Teddy Hogeborn
Some cleanup of GnuTLS interface
679
        if result >= gnutls.E_SUCCESS:
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
680
            return result
681
        if result == gnutls.E_NO_CERTIFICATE_FOUND:
874 by Teddy Hogeborn
PEP8 compliance: mandos
682
            raise gnutls.CertificateSecurityError(code=result)
683
        raise gnutls.Error(code=result)
684
1242 by Teddy Hogeborn
Fix theoretical GnuTLS bug
685
    def _retry_on_error(result, func, arguments,
686
                        _error_code=_error_code):
802 by Teddy Hogeborn
Handle GnuTLS errors and partial sends in gnutls "module".
687
        """A function to retry on some errors, suitable
1247 by Teddy Hogeborn
Server: Fix minor style issue
688
        for the "errcheck" attribute on ctypes functions"""
1243 by Teddy Hogeborn
Some cleanup of GnuTLS interface
689
        while result < gnutls.E_SUCCESS:
802 by Teddy Hogeborn
Handle GnuTLS errors and partial sends in gnutls "module".
690
            if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
691
                return _error_code(result)
692
            result = func(*arguments)
693
        return result
874 by Teddy Hogeborn
PEP8 compliance: mandos
694
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
695
    # Unless otherwise indicated, the function declarations below are
696
    # all from the gnutls/gnutls.h C header file.
874 by Teddy Hogeborn
PEP8 compliance: mandos
697
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
698
    # Functions
699
    priority_set_direct = _library.gnutls_priority_set_direct
1243 by Teddy Hogeborn
Some cleanup of GnuTLS interface
700
    priority_set_direct.argtypes = [ClientSession, ctypes.c_char_p,
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
701
                                    ctypes.POINTER(ctypes.c_char_p)]
702
    priority_set_direct.restype = _error_code
874 by Teddy Hogeborn
PEP8 compliance: mandos
703
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
704
    init = _library.gnutls_init
1243 by Teddy Hogeborn
Some cleanup of GnuTLS interface
705
    init.argtypes = [PointerTo(ClientSession), ctypes.c_int]
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
706
    init.restype = _error_code
874 by Teddy Hogeborn
PEP8 compliance: mandos
707
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
708
    set_default_priority = _library.gnutls_set_default_priority
1243 by Teddy Hogeborn
Some cleanup of GnuTLS interface
709
    set_default_priority.argtypes = [ClientSession]
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
710
    set_default_priority.restype = _error_code
874 by Teddy Hogeborn
PEP8 compliance: mandos
711
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
712
    record_send = _library.gnutls_record_send
1243 by Teddy Hogeborn
Some cleanup of GnuTLS interface
713
    record_send.argtypes = [ClientSession, ctypes.c_void_p,
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
714
                            ctypes.c_size_t]
715
    record_send.restype = ctypes.c_ssize_t
802 by Teddy Hogeborn
Handle GnuTLS errors and partial sends in gnutls "module".
716
    record_send.errcheck = _retry_on_error
874 by Teddy Hogeborn
PEP8 compliance: mandos
717
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
718
    certificate_allocate_credentials = (
719
        _library.gnutls_certificate_allocate_credentials)
720
    certificate_allocate_credentials.argtypes = [
1243 by Teddy Hogeborn
Some cleanup of GnuTLS interface
721
        PointerTo(Credentials)]
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
722
    certificate_allocate_credentials.restype = _error_code
874 by Teddy Hogeborn
PEP8 compliance: mandos
723
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
724
    certificate_free_credentials = (
725
        _library.gnutls_certificate_free_credentials)
1243 by Teddy Hogeborn
Some cleanup of GnuTLS interface
726
    certificate_free_credentials.argtypes = [Credentials]
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
727
    certificate_free_credentials.restype = None
874 by Teddy Hogeborn
PEP8 compliance: mandos
728
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
729
    handshake_set_private_extensions = (
730
        _library.gnutls_handshake_set_private_extensions)
1243 by Teddy Hogeborn
Some cleanup of GnuTLS interface
731
    handshake_set_private_extensions.argtypes = [ClientSession,
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
732
                                                 ctypes.c_int]
733
    handshake_set_private_extensions.restype = None
874 by Teddy Hogeborn
PEP8 compliance: mandos
734
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
735
    credentials_set = _library.gnutls_credentials_set
1243 by Teddy Hogeborn
Some cleanup of GnuTLS interface
736
    credentials_set.argtypes = [ClientSession, credentials_type_t,
737
                                CastToVoidPointer(Credentials)]
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
738
    credentials_set.restype = _error_code
874 by Teddy Hogeborn
PEP8 compliance: mandos
739
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
740
    strerror = _library.gnutls_strerror
741
    strerror.argtypes = [ctypes.c_int]
742
    strerror.restype = ctypes.c_char_p
874 by Teddy Hogeborn
PEP8 compliance: mandos
743
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
744
    certificate_type_get = _library.gnutls_certificate_type_get
1243 by Teddy Hogeborn
Some cleanup of GnuTLS interface
745
    certificate_type_get.argtypes = [ClientSession]
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
746
    certificate_type_get.restype = _error_code
874 by Teddy Hogeborn
PEP8 compliance: mandos
747
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
748
    certificate_get_peers = _library.gnutls_certificate_get_peers
1243 by Teddy Hogeborn
Some cleanup of GnuTLS interface
749
    certificate_get_peers.argtypes = [ClientSession,
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
750
                                      ctypes.POINTER(ctypes.c_uint)]
751
    certificate_get_peers.restype = ctypes.POINTER(datum_t)
874 by Teddy Hogeborn
PEP8 compliance: mandos
752
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
753
    global_set_log_level = _library.gnutls_global_set_log_level
754
    global_set_log_level.argtypes = [ctypes.c_int]
755
    global_set_log_level.restype = None
874 by Teddy Hogeborn
PEP8 compliance: mandos
756
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
757
    global_set_log_function = _library.gnutls_global_set_log_function
758
    global_set_log_function.argtypes = [log_func]
759
    global_set_log_function.restype = None
874 by Teddy Hogeborn
PEP8 compliance: mandos
760
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
761
    deinit = _library.gnutls_deinit
1243 by Teddy Hogeborn
Some cleanup of GnuTLS interface
762
    deinit.argtypes = [ClientSession]
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
763
    deinit.restype = None
874 by Teddy Hogeborn
PEP8 compliance: mandos
764
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
765
    handshake = _library.gnutls_handshake
1243 by Teddy Hogeborn
Some cleanup of GnuTLS interface
766
    handshake.argtypes = [ClientSession]
767
    handshake.restype = ctypes.c_int
802 by Teddy Hogeborn
Handle GnuTLS errors and partial sends in gnutls "module".
768
    handshake.errcheck = _retry_on_error
874 by Teddy Hogeborn
PEP8 compliance: mandos
769
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
770
    transport_set_ptr = _library.gnutls_transport_set_ptr
1243 by Teddy Hogeborn
Some cleanup of GnuTLS interface
771
    transport_set_ptr.argtypes = [ClientSession, transport_ptr_t]
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
772
    transport_set_ptr.restype = None
874 by Teddy Hogeborn
PEP8 compliance: mandos
773
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
774
    bye = _library.gnutls_bye
1243 by Teddy Hogeborn
Some cleanup of GnuTLS interface
775
    bye.argtypes = [ClientSession, close_request_t]
776
    bye.restype = ctypes.c_int
802 by Teddy Hogeborn
Handle GnuTLS errors and partial sends in gnutls "module".
777
    bye.errcheck = _retry_on_error
874 by Teddy Hogeborn
PEP8 compliance: mandos
778
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
779
    check_version = _library.gnutls_check_version
780
    check_version.argtypes = [ctypes.c_char_p]
781
    check_version.restype = ctypes.c_char_p
874 by Teddy Hogeborn
PEP8 compliance: mandos
782
1088 by Teddy Hogeborn
mandos: Refactor; use classes, not instances, as namespaces
783
    _need_version = b"3.3.0"
784
    if check_version(_need_version) is None:
785
        raise self.Error("Needs GnuTLS {} or later"
786
                         .format(_need_version))
787
788
    _tls_rawpk_version = b"3.6.6"
962 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
789
    has_rawpk = bool(check_version(_tls_rawpk_version))
790
791
    if has_rawpk:
792
        # Types
793
        class pubkey_st(ctypes.Structure):
794
            _fields = []
795
        pubkey_t = ctypes.POINTER(pubkey_st)
796
797
        x509_crt_fmt_t = ctypes.c_int
798
1220 by teddy at recompile
mandos: Shorten or break long lines
799
        # All the function declarations below are from
800
        # gnutls/abstract.h
962 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
801
        pubkey_init = _library.gnutls_pubkey_init
802
        pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]
803
        pubkey_init.restype = _error_code
804
805
        pubkey_import = _library.gnutls_pubkey_import
806
        pubkey_import.argtypes = [pubkey_t, ctypes.POINTER(datum_t),
807
                                  x509_crt_fmt_t]
808
        pubkey_import.restype = _error_code
809
810
        pubkey_get_key_id = _library.gnutls_pubkey_get_key_id
811
        pubkey_get_key_id.argtypes = [pubkey_t, ctypes.c_int,
812
                                      ctypes.POINTER(ctypes.c_ubyte),
813
                                      ctypes.POINTER(ctypes.c_size_t)]
814
        pubkey_get_key_id.restype = _error_code
815
816
        pubkey_deinit = _library.gnutls_pubkey_deinit
817
        pubkey_deinit.argtypes = [pubkey_t]
818
        pubkey_deinit.restype = None
819
    else:
1220 by teddy at recompile
mandos: Shorten or break long lines
820
        # All the function declarations below are from
821
        # gnutls/openpgp.h
962 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
822
823
        openpgp_crt_init = _library.gnutls_openpgp_crt_init
824
        openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
825
        openpgp_crt_init.restype = _error_code
826
827
        openpgp_crt_import = _library.gnutls_openpgp_crt_import
828
        openpgp_crt_import.argtypes = [openpgp_crt_t,
829
                                       ctypes.POINTER(datum_t),
830
                                       openpgp_crt_fmt_t]
831
        openpgp_crt_import.restype = _error_code
832
1220 by teddy at recompile
mandos: Shorten or break long lines
833
        openpgp_crt_verify_self = \
834
            _library.gnutls_openpgp_crt_verify_self
835
        openpgp_crt_verify_self.argtypes = [
836
            openpgp_crt_t,
837
            ctypes.c_uint,
838
            ctypes.POINTER(ctypes.c_uint),
839
        ]
962 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
840
        openpgp_crt_verify_self.restype = _error_code
841
842
        openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
843
        openpgp_crt_deinit.argtypes = [openpgp_crt_t]
844
        openpgp_crt_deinit.restype = None
845
846
        openpgp_crt_get_fingerprint = (
847
            _library.gnutls_openpgp_crt_get_fingerprint)
848
        openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
849
                                                ctypes.c_void_p,
850
                                                ctypes.POINTER(
851
                                                    ctypes.c_size_t)]
852
        openpgp_crt_get_fingerprint.restype = _error_code
853
1130 by Teddy Hogeborn
Update Python 3 compatibility
854
    if check_version(b"3.6.4"):
962 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
855
        certificate_type_get2 = _library.gnutls_certificate_type_get2
1243 by Teddy Hogeborn
Some cleanup of GnuTLS interface
856
        certificate_type_get2.argtypes = [ClientSession, ctypes.c_int]
962 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
857
        certificate_type_get2.restype = _error_code
874 by Teddy Hogeborn
PEP8 compliance: mandos
858
802 by Teddy Hogeborn
Handle GnuTLS errors and partial sends in gnutls "module".
859
    # Remove non-public functions
860
    del _error_code, _retry_on_error
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
861
874 by Teddy Hogeborn
PEP8 compliance: mandos
862
749.1.2 by Teddy Hogeborn
mandos (subprocess_call_pipe): Rename to "call_pipe" and take "func".
863
def call_pipe(connection,       # : multiprocessing.Connection
864
              func, *args, **kwargs):
749.1.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
865
    """This function is meant to be called by multiprocessing.Process
874 by Teddy Hogeborn
PEP8 compliance: mandos
866
749.1.2 by Teddy Hogeborn
mandos (subprocess_call_pipe): Rename to "call_pipe" and take "func".
867
    This function runs func(*args, **kwargs), and writes the resulting
868
    return value on the provided multiprocessing.Connection.
749.1.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
869
    """
749.1.2 by Teddy Hogeborn
mandos (subprocess_call_pipe): Rename to "call_pipe" and take "func".
870
    connection.send(func(*args, **kwargs))
749.1.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
871
    connection.close()
582 by Teddy Hogeborn
* mandos (IPv6_TCPServer.server_bind): Bug fix: handle non-existing
872
874 by Teddy Hogeborn
PEP8 compliance: mandos
873
1154 by Teddy Hogeborn
Simplification of Python 3 compatibility code
874
class Client:
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
875
    """A representation of a client host served by this server.
874 by Teddy Hogeborn
PEP8 compliance: mandos
876
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
877
    Attributes:
1247 by Teddy Hogeborn
Server: Fix minor style issue
878
    approved:   bool(); None if not yet approved/disapproved
438 by Teddy Hogeborn
* mandos (Client.runtime_expansions): New attribute containing the
879
    approval_delay: datetime.timedelta(); Time to wait for approval
880
    approval_duration: datetime.timedelta(); Duration of one approval
1132 by Teddy Hogeborn
Server: Reap zombies created by multiprocessing.Process()
881
    checker: multiprocessing.Process(); a running checker process used
1247 by Teddy Hogeborn
Server: Fix minor style issue
882
             to see if the client lives. None if no process is
1132 by Teddy Hogeborn
Server: Reap zombies created by multiprocessing.Process()
883
             running.
830 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
884
    checker_callback_tag: a GLib event source tag, or None
438 by Teddy Hogeborn
* mandos (Client.runtime_expansions): New attribute containing the
885
    checker_command: string; External command which is run to check
886
                     if client lives.  %() expansions are done at
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
887
                     runtime with vars(self) as dict, so that for
888
                     instance %(name)s can be used in the command.
830 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
889
    checker_initiator_tag: a GLib event source tag, or None
438 by Teddy Hogeborn
* mandos (Client.runtime_expansions): New attribute containing the
890
    created:    datetime.datetime(); (UTC) object creation
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
891
    client_structure: Object describing what attributes a client has
892
                      and is used for storing the client at exit
315 by Teddy Hogeborn
* mandos (Client.current_checker_command): New attribute.
893
    current_checker_command: string; current running checker_command
830 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
894
    disable_initiator_tag: a GLib event source tag, or None
438 by Teddy Hogeborn
* mandos (Client.runtime_expansions): New attribute containing the
895
    enabled:    bool()
896
    fingerprint: string (40 or 32 hexadecimal digits); used to
962 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
897
                 uniquely identify an OpenPGP client
898
    key_id: string (64 hexadecimal digits); used to uniquely identify
899
            a client using raw public keys
438 by Teddy Hogeborn
* mandos (Client.runtime_expansions): New attribute containing the
900
    host:       string; available for use by the checker command
901
    interval:   datetime.timedelta(); How often to start a new checker
442 by Teddy Hogeborn
* DBUS-API: Document new "LastApprovalRequest" client property.
902
    last_approval_request: datetime.datetime(); (UTC) or None
438 by Teddy Hogeborn
* mandos (Client.runtime_expansions): New attribute containing the
903
    last_checked_ok: datetime.datetime(); (UTC) or None
521 by teddy at bsnet
* debian/control (mandos/Depends): Added "python-crypto".
904
    last_checker_status: integer between 0 and 255 reflecting exit
518.1.7 by Teddy Hogeborn
* mandos: Break long lines and fix some more white space.
905
                         status of last checker. -1 reflects crashed
556 by Teddy Hogeborn
* DBUS-API (se.recompile.Mandos.Client.LastCheckerStatus): New
906
                         checker, -2 means no checker completed yet.
749.1.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
907
    last_checker_signal: The signal which killed the last checker, if
908
                         last_checker_status is -1
518.2.3 by Teddy Hogeborn
Make "enabled" a client config option.
909
    last_enabled: datetime.datetime(); (UTC) or None
438 by Teddy Hogeborn
* mandos (Client.runtime_expansions): New attribute containing the
910
    name:       string; from the config file, used in log messages and
911
                        D-Bus identifiers
912
    secret:     bytestring; sent verbatim (over TLS) to client
913
    timeout:    datetime.timedelta(); How long from last_checked_ok
914
                                      until this client is disabled
552 by teddy at recompile
* mandos: Consistent terminology; use the term "secret" for the
915
    extended_timeout:   extra long timeout when secret has been sent
438 by Teddy Hogeborn
* mandos (Client.runtime_expansions): New attribute containing the
916
    runtime_expansions: Allowed attributes for runtime expansion.
497 by Teddy Hogeborn
* DBUS-API: Document new "Expires" and "ExtendedTimeout" properties.
917
    expires:    datetime.datetime(); time (UTC) when a client will be
24.1.179 by Björn Påhlsson
New feature:
918
                disabled, or None
617 by Teddy Hogeborn
* mandos: Bug fix: Don't print output from checkers when running in
919
    server_settings: The server_settings dict from main()
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
920
    """
874 by Teddy Hogeborn
PEP8 compliance: mandos
921
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
922
    runtime_expansions = ("approval_delay", "approval_duration",
962 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
923
                          "created", "enabled", "expires", "key_id",
584 by Teddy Hogeborn
* mandos (Client.runtime_expansions): Add "expires" and (bug fix)
924
                          "fingerprint", "host", "interval",
925
                          "last_approval_request", "last_checked_ok",
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
926
                          "last_enabled", "name", "timeout")
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
927
    client_defaults = {
928
        "timeout": "PT5M",
929
        "extended_timeout": "PT15M",
930
        "interval": "PT2M",
931
        "checker": "fping -q -- %%(host)s",
932
        "host": "",
933
        "approval_delay": "PT0S",
934
        "approval_duration": "PT1S",
935
        "approved_by_default": "True",
936
        "enabled": "True",
937
    }
874 by Teddy Hogeborn
PEP8 compliance: mandos
938
518.1.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
939
    @staticmethod
940
    def config_parser(config):
542 by Björn Påhlsson
fixed bug with bad stored config state for expires and last_checked_ok.
941
        """Construct a new dict of client settings of this form:
518.1.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
942
        { client_name: {setting_name: value, ...}, ...}
542 by Björn Påhlsson
fixed bug with bad stored config state for expires and last_checked_ok.
943
        with exceptions for any special settings as defined above.
944
        NOTE: Must be a pure function. Must return the same result
945
        value given the same arguments.
946
        """
518.1.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
947
        settings = {}
948
        for client_name in config.sections():
949
            section = dict(config.items(client_name))
950
            client = settings[client_name] = {}
874 by Teddy Hogeborn
PEP8 compliance: mandos
951
518.1.15 by Björn Påhlsson
more refactoring in regards to how clients get created
952
            client["host"] = section["host"]
518.1.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
953
            # Reformat values from string types to Python types
954
            client["approved_by_default"] = config.getboolean(
955
                client_name, "approved_by_default")
543 by Teddy Hogeborn
* mandos: Break some long lines.
956
            client["enabled"] = config.getboolean(client_name,
957
                                                  "enabled")
874 by Teddy Hogeborn
PEP8 compliance: mandos
958
962 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
959
            # Uppercase and remove spaces from key_id and fingerprint
960
            # for later comparison purposes with return value from the
961
            # key_id() and fingerprint() functions
962
            client["key_id"] = (section.get("key_id", "").upper()
963
                                .replace(" ", ""))
1284 by Teddy Hogeborn
Be more tolerant when a client is misconfigured in clients.conf
964
            client["fingerprint"] = (section.get("fingerprint",
965
                                                 "").upper()
518.1.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
966
                                     .replace(" ", ""))
1284 by Teddy Hogeborn
Be more tolerant when a client is misconfigured in clients.conf
967
            if not (client["key_id"] or client["fingerprint"]):
968
                log.error("Skipping client %s without key_id or"
969
                          " fingerprint", client_name)
970
                del settings[client_name]
971
                continue
518.1.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
972
            if "secret" in section:
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
973
                client["secret"] = codecs.decode(section["secret"]
974
                                                 .encode("utf-8"),
975
                                                 "base64")
518.1.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
976
            elif "secfile" in section:
977
                with open(os.path.expanduser(os.path.expandvars
978
                                             (section["secfile"])),
979
                          "rb") as secfile:
980
                    client["secret"] = secfile.read()
981
            else:
723.1.5 by Teddy Hogeborn
Use the new auto-numbered "{}" syntax for the .format() string method.
982
                raise TypeError("No secret or secfile for section {}"
568 by Teddy Hogeborn
* mandos-monitor: Use new string format method.
983
                                .format(section))
518.1.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
984
            client["timeout"] = string_to_delta(section["timeout"])
985
            client["extended_timeout"] = string_to_delta(
986
                section["extended_timeout"])
987
            client["interval"] = string_to_delta(section["interval"])
988
            client["approval_delay"] = string_to_delta(
989
                section["approval_delay"])
990
            client["approval_duration"] = string_to_delta(
991
                section["approval_duration"])
518.1.15 by Björn Påhlsson
more refactoring in regards to how clients get created
992
            client["checker_command"] = section["checker"]
993
            client["last_approval_request"] = None
994
            client["last_checked_ok"] = None
556 by Teddy Hogeborn
* DBUS-API (se.recompile.Mandos.Client.LastCheckerStatus): New
995
            client["last_checker_status"] = -2
874 by Teddy Hogeborn
PEP8 compliance: mandos
996
518.1.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
997
        return settings
874 by Teddy Hogeborn
PEP8 compliance: mandos
998
999
    def __init__(self, settings, name=None, server_settings=None):
243 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
1000
        self.name = name
617 by Teddy Hogeborn
* mandos: Bug fix: Don't print output from checkers when running in
1001
        if server_settings is None:
1002
            server_settings = {}
1003
        self.server_settings = server_settings
518.1.15 by Björn Påhlsson
more refactoring in regards to how clients get created
1004
        # adding all client settings
723.1.4 by Teddy Hogeborn
Use the .items() method instead of .iteritems().
1005
        for setting, value in settings.items():
518.1.15 by Björn Påhlsson
more refactoring in regards to how clients get created
1006
            setattr(self, setting, value)
874 by Teddy Hogeborn
PEP8 compliance: mandos
1007
542 by Björn Påhlsson
fixed bug with bad stored config state for expires and last_checked_ok.
1008
        if self.enabled:
1009
            if not hasattr(self, "last_enabled"):
1010
                self.last_enabled = datetime.datetime.utcnow()
1011
            if not hasattr(self, "expires"):
1012
                self.expires = (datetime.datetime.utcnow()
1013
                                + self.timeout)
1014
        else:
1015
            self.last_enabled = None
1016
            self.expires = None
874 by Teddy Hogeborn
PEP8 compliance: mandos
1017
1254 by Teddy Hogeborn
mandos: Update logging code to more standard idioms
1018
        log.debug("Creating client %r", self.name)
1019
        log.debug("  Key ID: %s", self.key_id)
1020
        log.debug("  Fingerprint: %s", self.fingerprint)
543 by Teddy Hogeborn
* mandos: Break some long lines.
1021
        self.created = settings.get("created",
1022
                                    datetime.datetime.utcnow())
874 by Teddy Hogeborn
PEP8 compliance: mandos
1023
518.1.15 by Björn Påhlsson
more refactoring in regards to how clients get created
1024
        # attributes specific for this server instance
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
1025
        self.checker = None
1026
        self.checker_initiator_tag = None
239 by Teddy Hogeborn
* mandos (_datetime_to_dbus_struct): Renamed to "_datetime_to_dbus";
1027
        self.disable_initiator_tag = None
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
1028
        self.checker_callback_tag = None
315 by Teddy Hogeborn
* mandos (Client.current_checker_command): New attribute.
1029
        self.current_checker_command = None
518.2.4 by Teddy Hogeborn
* mandos (_timedelta_to_milliseconds): Renamed to
1030
        self.approved = None
24.1.150 by Björn Påhlsson
* mandos: Added ClientDBus.approve_pending property. Exposed
1031
        self.approvals_pending = 0
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1032
        self.changedstate = multiprocessing_manager.Condition(
1033
            multiprocessing_manager.Lock())
1034
        self.client_structure = [attr
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
1035
                                 for attr in self.__dict__.keys()
521 by teddy at bsnet
* debian/control (mandos/Depends): Added "python-crypto".
1036
                                 if not attr.startswith("_")]
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
1037
        self.client_structure.append("client_structure")
874 by Teddy Hogeborn
PEP8 compliance: mandos
1038
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1039
        for name, t in inspect.getmembers(
1040
                type(self), lambda obj: isinstance(obj, property)):
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
1041
            if not name.startswith("_"):
1042
                self.client_structure.append(name)
874 by Teddy Hogeborn
PEP8 compliance: mandos
1043
520 by Björn Påhlsson
merge persistent state
1044
    # Send notice to process children that client state has changed
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1045
    def send_changedstate(self):
520 by Björn Påhlsson
merge persistent state
1046
        with self.changedstate:
1047
            self.changedstate.notify_all()
874 by Teddy Hogeborn
PEP8 compliance: mandos
1048
239 by Teddy Hogeborn
* mandos (_datetime_to_dbus_struct): Renamed to "_datetime_to_dbus";
1049
    def enable(self):
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
1050
        """Start this client's checker and timeout hooks"""
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1051
        if getattr(self, "enabled", False):
341 by Teddy Hogeborn
Code cleanup and one bug fix.
1052
            # Already enabled
1053
            return
239 by Teddy Hogeborn
* mandos (_datetime_to_dbus_struct): Renamed to "_datetime_to_dbus";
1054
        self.enabled = True
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1055
        self.last_enabled = datetime.datetime.utcnow()
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
1056
        self.init_checker()
581 by Teddy Hogeborn
* mandos (Client.enable, Client.disable, ClientDBus.approve): Call
1057
        self.send_changedstate()
874 by Teddy Hogeborn
PEP8 compliance: mandos
1058
402 by Teddy Hogeborn
* mandos (Client.disable): Rename keyword argument "log" to "quiet",
1059
    def disable(self, quiet=True):
239 by Teddy Hogeborn
* mandos (_datetime_to_dbus_struct): Renamed to "_datetime_to_dbus";
1060
        """Disable this client."""
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1061
        if not getattr(self, "enabled", False):
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
1062
            return False
402 by Teddy Hogeborn
* mandos (Client.disable): Rename keyword argument "log" to "quiet",
1063
        if not quiet:
1254 by Teddy Hogeborn
mandos: Update logging code to more standard idioms
1064
            log.info("Disabling client %s", self.name)
581 by Teddy Hogeborn
* mandos (Client.enable, Client.disable, ClientDBus.approve): Call
1065
        if getattr(self, "disable_initiator_tag", None) is not None:
830 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
1066
            GLib.source_remove(self.disable_initiator_tag)
239 by Teddy Hogeborn
* mandos (_datetime_to_dbus_struct): Renamed to "_datetime_to_dbus";
1067
            self.disable_initiator_tag = None
24.1.179 by Björn Påhlsson
New feature:
1068
        self.expires = None
581 by Teddy Hogeborn
* mandos (Client.enable, Client.disable, ClientDBus.approve): Call
1069
        if getattr(self, "checker_initiator_tag", None) is not None:
830 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
1070
            GLib.source_remove(self.checker_initiator_tag)
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
1071
            self.checker_initiator_tag = None
1072
        self.stop_checker()
239 by Teddy Hogeborn
* mandos (_datetime_to_dbus_struct): Renamed to "_datetime_to_dbus";
1073
        self.enabled = False
581 by Teddy Hogeborn
* mandos (Client.enable, Client.disable, ClientDBus.approve): Call
1074
        if not quiet:
1075
            self.send_changedstate()
830 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
1076
        # Do not run this again if called by a GLib.timeout_add
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
1077
        return False
874 by Teddy Hogeborn
PEP8 compliance: mandos
1078
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
1079
    def __del__(self):
239 by Teddy Hogeborn
* mandos (_datetime_to_dbus_struct): Renamed to "_datetime_to_dbus";
1080
        self.disable()
874 by Teddy Hogeborn
PEP8 compliance: mandos
1081
1268 by Teddy Hogeborn
Server: Bug fix: Stagger checker runs when creating clients
1082
    def init_checker(self, randomize_start=False):
1083
        # Schedule a new checker to be started a randomly selected
1084
        # time (a fraction of 'interval') from now.  This spreads out
1085
        # the startup of checkers over time when the server is
1086
        # started.
581 by Teddy Hogeborn
* mandos (Client.enable, Client.disable, ClientDBus.approve): Call
1087
        if self.checker_initiator_tag is not None:
830 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
1088
            GLib.source_remove(self.checker_initiator_tag)
1268 by Teddy Hogeborn
Server: Bug fix: Stagger checker runs when creating clients
1089
        interval_milliseconds = int(self.interval.total_seconds()
1090
                                    * 1000)
1091
        if randomize_start:
1092
            delay_milliseconds = random.randrange(
1093
                interval_milliseconds + 1)
1094
        else:
1095
            delay_milliseconds = interval_milliseconds
830 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
1096
        self.checker_initiator_tag = GLib.timeout_add(
1268 by Teddy Hogeborn
Server: Bug fix: Stagger checker runs when creating clients
1097
            delay_milliseconds, self.start_checker, randomize_start)
1098
        delay = datetime.timedelta(0, 0, 0, delay_milliseconds)
1099
        # A checker might take up to an 'interval' of time, so we can
1100
        # expire at the soonest one interval after a checker was
1101
        # started.  Since the initial checker is delayed, the expire
1102
        # time might have to be extended.
1103
        now = datetime.datetime.utcnow()
1104
        self.expires = now + delay + self.interval
1105
        # Schedule a disable() at expire time
581 by Teddy Hogeborn
* mandos (Client.enable, Client.disable, ClientDBus.approve): Call
1106
        if self.disable_initiator_tag is not None:
830 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
1107
            GLib.source_remove(self.disable_initiator_tag)
1108
        self.disable_initiator_tag = GLib.timeout_add(
1268 by Teddy Hogeborn
Server: Bug fix: Stagger checker runs when creating clients
1109
            int((self.expires - now).total_seconds() * 1000),
1110
            self.disable)
874 by Teddy Hogeborn
PEP8 compliance: mandos
1111
756 by Teddy Hogeborn
Merge change to use multiprocessing module to run checkers.
1112
    def checker_callback(self, source, condition, connection,
1113
                         command):
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
1114
        """The checker has completed, so take appropriate actions."""
749.1.2 by Teddy Hogeborn
mandos (subprocess_call_pipe): Rename to "call_pipe" and take "func".
1115
        # Read return code from connection (see call_pipe)
749.1.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
1116
        returncode = connection.recv()
1117
        connection.close()
1176 by Teddy Hogeborn
mandos: Only join() still running checker processes
1118
        if self.checker is not None:
1119
            self.checker.join()
1132 by Teddy Hogeborn
Server: Reap zombies created by multiprocessing.Process()
1120
        self.checker_callback_tag = None
1121
        self.checker = None
874 by Teddy Hogeborn
PEP8 compliance: mandos
1122
749.1.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
1123
        if returncode >= 0:
1124
            self.last_checker_status = returncode
1125
            self.last_checker_signal = None
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
1126
            if self.last_checker_status == 0:
1254 by Teddy Hogeborn
mandos: Update logging code to more standard idioms
1127
                log.info("Checker for %(name)s succeeded", vars(self))
281 by Teddy Hogeborn
* mandos (Client.bump_timeout): Renamed to "checked_ok". All callers
1128
                self.checked_ok()
280 by Teddy Hogeborn
* mandos (Client.CheckerCompleted): Changed signature to "nxs"; return
1129
            else:
1254 by Teddy Hogeborn
mandos: Update logging code to more standard idioms
1130
                log.info("Checker for %(name)s failed", vars(self))
280 by Teddy Hogeborn
* mandos (Client.CheckerCompleted): Changed signature to "nxs"; return
1131
        else:
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
1132
            self.last_checker_status = -1
749.1.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
1133
            self.last_checker_signal = -returncode
1254 by Teddy Hogeborn
mandos: Update logging code to more standard idioms
1134
            log.warning("Checker for %(name)s crashed?", vars(self))
749.1.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
1135
        return False
874 by Teddy Hogeborn
PEP8 compliance: mandos
1136
556 by Teddy Hogeborn
* DBUS-API (se.recompile.Mandos.Client.LastCheckerStatus): New
1137
    def checked_ok(self):
1138
        """Assert that the client has been seen, alive and well."""
1139
        self.last_checked_ok = datetime.datetime.utcnow()
1140
        self.last_checker_status = 0
749.1.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
1141
        self.last_checker_signal = None
556 by Teddy Hogeborn
* DBUS-API (se.recompile.Mandos.Client.LastCheckerStatus): New
1142
        self.bump_timeout()
874 by Teddy Hogeborn
PEP8 compliance: mandos
1143
556 by Teddy Hogeborn
* DBUS-API (se.recompile.Mandos.Client.LastCheckerStatus): New
1144
    def bump_timeout(self, timeout=None):
1145
        """Bump up the timeout for this client."""
24.1.179 by Björn Påhlsson
New feature:
1146
        if timeout is None:
1147
            timeout = self.timeout
505.1.17 by Teddy Hogeborn
* mandos (Client.checked_ok): Bug fix: Handle disabled client.
1148
        if self.disable_initiator_tag is not None:
830 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
1149
            GLib.source_remove(self.disable_initiator_tag)
581 by Teddy Hogeborn
* mandos (Client.enable, Client.disable, ClientDBus.approve): Call
1150
            self.disable_initiator_tag = None
505.1.17 by Teddy Hogeborn
* mandos (Client.checked_ok): Bug fix: Handle disabled client.
1151
        if getattr(self, "enabled", False):
830 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
1152
            self.disable_initiator_tag = GLib.timeout_add(
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1153
                int(timeout.total_seconds() * 1000), self.disable)
505.1.17 by Teddy Hogeborn
* mandos (Client.checked_ok): Bug fix: Handle disabled client.
1154
            self.expires = datetime.datetime.utcnow() + timeout
874 by Teddy Hogeborn
PEP8 compliance: mandos
1155
442 by Teddy Hogeborn
* DBUS-API: Document new "LastApprovalRequest" client property.
1156
    def need_approval(self):
1157
        self.last_approval_request = datetime.datetime.utcnow()
874 by Teddy Hogeborn
PEP8 compliance: mandos
1158
1268 by Teddy Hogeborn
Server: Bug fix: Stagger checker runs when creating clients
1159
    def start_checker(self, start_was_randomized=False):
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
1160
        """Start a new checker subprocess if one is not running.
874 by Teddy Hogeborn
PEP8 compliance: mandos
1161
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
1162
        If a checker already exists, leave it running and do
1163
        nothing."""
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
1164
        # The reason for not killing a running checker is that if we
577 by Teddy Hogeborn
* mandos (Client.start_checker): Reworded comment.
1165
        # did that, and if a checker (for some reason) started running
1166
        # slowly and taking more than 'interval' time, then the client
1167
        # would inevitably timeout, since no checker would get a
1168
        # chance to run to completion.  If we instead leave running
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
1169
        # checkers alone, the checker would have to take more time
411 by Teddy Hogeborn
More consistent terminology: Clients are no longer "invalid" - they
1170
        # than 'timeout' for the client to be disabled, which is as it
1171
        # should be.
874 by Teddy Hogeborn
PEP8 compliance: mandos
1172
749.1.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
1173
        if self.checker is not None and not self.checker.is_alive():
1254 by Teddy Hogeborn
mandos: Update logging code to more standard idioms
1174
            log.warning("Checker was not alive; joining")
749.1.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
1175
            self.checker.join()
1176
            self.checker = None
315 by Teddy Hogeborn
* mandos (Client.current_checker_command): New attribute.
1177
        # Start a new checker if needed
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
1178
        if self.checker is None:
583 by Teddy Hogeborn
* mandos (Client.start_checker): Remove undocumented support for "%%s"
1179
            # Escape attributes for the shell
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1180
            escaped_attrs = {
1204 by teddy at recompile
mandos: If possible, use shlex.quote() instead of re.escape()
1181
                attr: shlex.quote(str(getattr(self, attr)))
874 by Teddy Hogeborn
PEP8 compliance: mandos
1182
                for attr in self.runtime_expansions}
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
1183
            try:
583 by Teddy Hogeborn
* mandos (Client.start_checker): Remove undocumented support for "%%s"
1184
                command = self.checker_command % escaped_attrs
1185
            except TypeError as error:
1254 by Teddy Hogeborn
mandos: Update logging code to more standard idioms
1186
                log.error('Could not format string "%s"',
1187
                          self.checker_command, exc_info=error)
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1188
                return True     # Try again later
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1189
            self.current_checker_command = command
1254 by Teddy Hogeborn
mandos: Update logging code to more standard idioms
1190
            log.info("Starting checker %r for %s", command, self.name)
749.1.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
1191
            # We don't need to redirect stdout and stderr, since
1192
            # in normal mode, that is already done by daemon(),
1193
            # and in debug mode we don't want to.  (Stdin is
1194
            # always replaced by /dev/null.)
1195
            # The exception is when not debugging but nevertheless
1196
            # running in the foreground; use the previously
1197
            # created wnull.
874 by Teddy Hogeborn
PEP8 compliance: mandos
1198
            popen_args = {"close_fds": True,
1199
                          "shell": True,
1200
                          "cwd": "/"}
749.1.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
1201
            if (not self.server_settings["debug"]
1202
                and self.server_settings["foreground"]):
1203
                popen_args.update({"stdout": wnull,
874 by Teddy Hogeborn
PEP8 compliance: mandos
1204
                                   "stderr": wnull})
1205
            pipe = multiprocessing.Pipe(duplex=False)
749.1.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
1206
            self.checker = multiprocessing.Process(
874 by Teddy Hogeborn
PEP8 compliance: mandos
1207
                target=call_pipe,
1208
                args=(pipe[1], subprocess.call, command),
1209
                kwargs=popen_args)
749.1.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
1210
            self.checker.start()
830 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
1211
            self.checker_callback_tag = GLib.io_add_watch(
1168 by Teddy Hogeborn
Server: Fully use new GLib.io_add_watch() call signature
1212
                GLib.IOChannel.unix_new(pipe[0].fileno()),
1213
                GLib.PRIORITY_DEFAULT, GLib.IO_IN,
756 by Teddy Hogeborn
Merge change to use multiprocessing module to run checkers.
1214
                self.checker_callback, pipe[0], command)
1268 by Teddy Hogeborn
Server: Bug fix: Stagger checker runs when creating clients
1215
        if start_was_randomized:
1216
            # We were started after a random delay; Schedule a new
1217
            # checker to be started an 'interval' from now, and every
1218
            # interval from then on.
1219
            now = datetime.datetime.utcnow()
1220
            self.checker_initiator_tag = GLib.timeout_add(
1221
                int(self.interval.total_seconds() * 1000),
1222
                self.start_checker)
1223
            self.expires = max(self.expires, now + self.interval)
1224
            # Don't start a new checker again after same random delay
1225
            return False
830 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
1226
        # Re-run this periodically if run by GLib.timeout_add
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
1227
        return True
874 by Teddy Hogeborn
PEP8 compliance: mandos
1228
9 by Teddy Hogeborn
* client.cpp (main): Get t_old early since it is used on error exits.
1229
    def stop_checker(self):
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
1230
        """Force the checker process, if any, to stop."""
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
1231
        if self.checker_callback_tag:
830 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
1232
            GLib.source_remove(self.checker_callback_tag)
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
1233
            self.checker_callback_tag = None
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1234
        if getattr(self, "checker", None) is None:
9 by Teddy Hogeborn
* client.cpp (main): Get t_old early since it is used on error exits.
1235
            return
1254 by Teddy Hogeborn
mandos: Update logging code to more standard idioms
1236
        log.debug("Stopping checker for %(name)s", vars(self))
749.1.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
1237
        self.checker.terminate()
9 by Teddy Hogeborn
* client.cpp (main): Get t_old early since it is used on error exits.
1238
        self.checker = None
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
1239
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
1240
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1241
def dbus_service_property(dbus_interface,
1242
                          signature="v",
1243
                          access="readwrite",
1244
                          byte_arrays=False):
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1245
    """Decorators for marking methods of a DBusObjectWithProperties to
1246
    become properties on the D-Bus.
874 by Teddy Hogeborn
PEP8 compliance: mandos
1247
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1248
    The decorated method will be called with no arguments by "Get"
1249
    and with one argument by "Set".
874 by Teddy Hogeborn
PEP8 compliance: mandos
1250
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1251
    The parameters, where they are supported, are the same as
1252
    dbus.service.method, except there is only "signature", since the
1253
    type from Get() and the type sent to Set() is the same.
1254
    """
411 by Teddy Hogeborn
More consistent terminology: Clients are no longer "invalid" - they
1255
    # Encoding deeply encoded byte arrays is not supported yet by the
1256
    # "Set" method, so we fail early here:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1257
    if byte_arrays and signature != "ay":
1258
        raise ValueError("Byte arrays not supported for non-'ay'"
723.1.5 by Teddy Hogeborn
Use the new auto-numbered "{}" syntax for the .format() string method.
1259
                         " signature {!r}".format(signature))
874 by Teddy Hogeborn
PEP8 compliance: mandos
1260
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1261
    def decorator(func):
1262
        func._dbus_is_property = True
1263
        func._dbus_interface = dbus_interface
1264
        func._dbus_signature = signature
1265
        func._dbus_access = access
1266
        func._dbus_name = func.__name__
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1267
        if func._dbus_name.endswith("_dbus_property"):
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1268
            func._dbus_name = func._dbus_name[:-14]
1247 by Teddy Hogeborn
Server: Fix minor style issue
1269
        func._dbus_get_args_options = {"byte_arrays": byte_arrays}
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1270
        return func
874 by Teddy Hogeborn
PEP8 compliance: mandos
1271
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1272
    return decorator
1273
1274
560.1.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
1275
def dbus_interface_annotations(dbus_interface):
573 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
1276
    """Decorator for marking functions returning interface annotations
874 by Teddy Hogeborn
PEP8 compliance: mandos
1277
560.1.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
1278
    Usage:
874 by Teddy Hogeborn
PEP8 compliance: mandos
1279
560.1.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
1280
    @dbus_interface_annotations("org.example.Interface")
1281
    def _foo(self):  # Function name does not matter
1282
        return {"org.freedesktop.DBus.Deprecated": "true",
1283
                "org.freedesktop.DBus.Property.EmitsChangedSignal":
1284
                    "false"}
1285
    """
874 by Teddy Hogeborn
PEP8 compliance: mandos
1286
560.1.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
1287
    def decorator(func):
1288
        func._dbus_is_interface = True
1289
        func._dbus_interface = dbus_interface
1290
        func._dbus_name = dbus_interface
1291
        return func
874 by Teddy Hogeborn
PEP8 compliance: mandos
1292
560.1.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
1293
    return decorator
1294
1295
561.1.1 by Teddy Hogeborn
Add D-Bus annotations support to methods, signals and properties.
1296
def dbus_annotations(annotations):
1297
    """Decorator to annotate D-Bus methods, signals or properties
1298
    Usage:
874 by Teddy Hogeborn
PEP8 compliance: mandos
1299
732 by Teddy Hogeborn
Emit D-Bus "org.freedesktop.DBus.Properties.PropertiesChanged" signal.
1300
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",
1301
                       "org.freedesktop.DBus.Property."
1302
                       "EmitsChangedSignal": "false"})
561.1.1 by Teddy Hogeborn
Add D-Bus annotations support to methods, signals and properties.
1303
    @dbus_service_property("org.example.Interface", signature="b",
1304
                           access="r")
1305
    def Property_dbus_property(self):
1306
        return dbus.Boolean(False)
874 by Teddy Hogeborn
PEP8 compliance: mandos
1307
784 by Teddy Hogeborn
Refactor D-Bus annotation class out from D-Bus properties class.
1308
    See also the DBusObjectWithAnnotations class.
561.1.1 by Teddy Hogeborn
Add D-Bus annotations support to methods, signals and properties.
1309
    """
874 by Teddy Hogeborn
PEP8 compliance: mandos
1310
561.1.1 by Teddy Hogeborn
Add D-Bus annotations support to methods, signals and properties.
1311
    def decorator(func):
1312
        func._dbus_annotations = annotations
1313
        return func
874 by Teddy Hogeborn
PEP8 compliance: mandos
1314
561.1.1 by Teddy Hogeborn
Add D-Bus annotations support to methods, signals and properties.
1315
    return decorator
1316
1317
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1318
class DBusPropertyException(dbus.exceptions.DBusException):
1319
    """A base class for D-Bus property-related exceptions
1320
    """
729 by Teddy Hogeborn
mandos: Stop using str() and remove unnecessary unicode() calls.
1321
    pass
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1322
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1323
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1324
class DBusPropertyAccessException(DBusPropertyException):
1325
    """A property's access permissions disallows an operation.
1326
    """
1327
    pass
1328
1329
1330
class DBusPropertyNotFound(DBusPropertyException):
1331
    """An attempt was made to access a non-existing property.
1332
    """
1333
    pass
1334
1335
784 by Teddy Hogeborn
Refactor D-Bus annotation class out from D-Bus properties class.
1336
class DBusObjectWithAnnotations(dbus.service.Object):
1337
    """A D-Bus object with annotations.
874 by Teddy Hogeborn
PEP8 compliance: mandos
1338
784 by Teddy Hogeborn
Refactor D-Bus annotation class out from D-Bus properties class.
1339
    Classes inheriting from this can use the dbus_annotations
1340
    decorator to add annotations to methods or signals.
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1341
    """
874 by Teddy Hogeborn
PEP8 compliance: mandos
1342
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1343
    @staticmethod
560.1.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
1344
    def _is_dbus_thing(thing):
1345
        """Returns a function testing if an attribute is a D-Bus thing
874 by Teddy Hogeborn
PEP8 compliance: mandos
1346
560.1.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
1347
        If called like _is_dbus_thing("method") it returns a function
1348
        suitable for use as predicate to inspect.getmembers().
1349
        """
723.1.5 by Teddy Hogeborn
Use the new auto-numbered "{}" syntax for the .format() string method.
1350
        return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
560.1.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
1351
                                   False)
874 by Teddy Hogeborn
PEP8 compliance: mandos
1352
560.1.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
1353
    def _get_all_dbus_things(self, thing):
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1354
        """Returns a generator of (name, attribute) pairs
1355
        """
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1356
        return ((getattr(athing.__get__(self), "_dbus_name", name),
560.1.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
1357
                 athing.__get__(self))
24.1.186 by Björn Påhlsson
transitional stuff actually working
1358
                for cls in self.__class__.__mro__
560.1.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
1359
                for name, athing in
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1360
                inspect.getmembers(cls, self._is_dbus_thing(thing)))
874 by Teddy Hogeborn
PEP8 compliance: mandos
1361
784 by Teddy Hogeborn
Refactor D-Bus annotation class out from D-Bus properties class.
1362
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
874 by Teddy Hogeborn
PEP8 compliance: mandos
1363
                         out_signature="s",
1247 by Teddy Hogeborn
Server: Fix minor style issue
1364
                         path_keyword="object_path",
1365
                         connection_keyword="connection")
784 by Teddy Hogeborn
Refactor D-Bus annotation class out from D-Bus properties class.
1366
    def Introspect(self, object_path, connection):
1367
        """Overloading of standard D-Bus method.
874 by Teddy Hogeborn
PEP8 compliance: mandos
1368
784 by Teddy Hogeborn
Refactor D-Bus annotation class out from D-Bus properties class.
1369
        Inserts annotation tags on methods and signals.
1370
        """
1371
        xmlstring = dbus.service.Object.Introspect(self, object_path,
1372
                                                   connection)
1373
        try:
1374
            document = xml.dom.minidom.parseString(xmlstring)
874 by Teddy Hogeborn
PEP8 compliance: mandos
1375
784 by Teddy Hogeborn
Refactor D-Bus annotation class out from D-Bus properties class.
1376
            for if_tag in document.getElementsByTagName("interface"):
1377
                # Add annotation tags
1378
                for typ in ("method", "signal"):
1379
                    for tag in if_tag.getElementsByTagName(typ):
1380
                        annots = dict()
1381
                        for name, prop in (self.
1382
                                           _get_all_dbus_things(typ)):
1383
                            if (name == tag.getAttribute("name")
1384
                                and prop._dbus_interface
1385
                                == if_tag.getAttribute("name")):
1386
                                annots.update(getattr(
1387
                                    prop, "_dbus_annotations", {}))
1388
                        for name, value in annots.items():
1389
                            ann_tag = document.createElement(
1390
                                "annotation")
1391
                            ann_tag.setAttribute("name", name)
1392
                            ann_tag.setAttribute("value", value)
1393
                            tag.appendChild(ann_tag)
1394
                # Add interface annotation tags
1395
                for annotation, value in dict(
1396
                    itertools.chain.from_iterable(
1397
                        annotations().items()
1398
                        for name, annotations
1399
                        in self._get_all_dbus_things("interface")
1400
                        if name == if_tag.getAttribute("name")
1401
                        )).items():
1402
                    ann_tag = document.createElement("annotation")
1403
                    ann_tag.setAttribute("name", annotation)
1404
                    ann_tag.setAttribute("value", value)
1405
                    if_tag.appendChild(ann_tag)
1406
                # Fix argument name for the Introspect method itself
1407
                if (if_tag.getAttribute("name")
874 by Teddy Hogeborn
PEP8 compliance: mandos
1408
                    == dbus.INTROSPECTABLE_IFACE):
784 by Teddy Hogeborn
Refactor D-Bus annotation class out from D-Bus properties class.
1409
                    for cn in if_tag.getElementsByTagName("method"):
1410
                        if cn.getAttribute("name") == "Introspect":
1411
                            for arg in cn.getElementsByTagName("arg"):
1412
                                if (arg.getAttribute("direction")
1413
                                    == "out"):
1414
                                    arg.setAttribute("name",
1415
                                                     "xml_data")
1416
            xmlstring = document.toxml("utf-8")
1417
            document.unlink()
1418
        except (AttributeError, xml.dom.DOMException,
1419
                xml.parsers.expat.ExpatError) as error:
1254 by Teddy Hogeborn
mandos: Update logging code to more standard idioms
1420
            log.error("Failed to override Introspection method",
1421
                      exc_info=error)
784 by Teddy Hogeborn
Refactor D-Bus annotation class out from D-Bus properties class.
1422
        return xmlstring
1423
1424
1425
class DBusObjectWithProperties(DBusObjectWithAnnotations):
1426
    """A D-Bus object with properties.
874 by Teddy Hogeborn
PEP8 compliance: mandos
1427
784 by Teddy Hogeborn
Refactor D-Bus annotation class out from D-Bus properties class.
1428
    Classes inheriting from this can use the dbus_service_property
1429
    decorator to expose methods as D-Bus properties.  It exposes the
1430
    standard Get(), Set(), and GetAll() methods on the D-Bus.
1431
    """
874 by Teddy Hogeborn
PEP8 compliance: mandos
1432
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1433
    def _get_dbus_property(self, interface_name, property_name):
1434
        """Returns a bound method if one exists which is a D-Bus
1435
        property with the specified name and interface.
1436
        """
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1437
        for cls in self.__class__.__mro__:
1438
            for name, value in inspect.getmembers(
1439
                    cls, self._is_dbus_thing("property")):
505.1.3 by Teddy Hogeborn
* mandos: Break long lines.
1440
                if (value._dbus_name == property_name
1441
                    and value._dbus_interface == interface_name):
24.1.186 by Björn Påhlsson
transitional stuff actually working
1442
                    return value.__get__(self)
874 by Teddy Hogeborn
PEP8 compliance: mandos
1443
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1444
        # No such property
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1445
        raise DBusPropertyNotFound("{}:{}.{}".format(
1446
            self.dbus_object_path, interface_name, property_name))
874 by Teddy Hogeborn
PEP8 compliance: mandos
1447
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
1448
    @classmethod
1449
    def _get_all_interface_names(cls):
1450
        """Get a sequence of all interfaces supported by an object"""
1451
        return (name for name in set(getattr(getattr(x, attr),
1452
                                             "_dbus_interface", None)
1453
                                     for x in (inspect.getmro(cls))
1454
                                     for attr in dir(x))
1455
                if name is not None)
874 by Teddy Hogeborn
PEP8 compliance: mandos
1456
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1457
    @dbus.service.method(dbus.PROPERTIES_IFACE,
1458
                         in_signature="ss",
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1459
                         out_signature="v")
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1460
    def Get(self, interface_name, property_name):
1461
        """Standard D-Bus property Get() method, see D-Bus standard.
1462
        """
1463
        prop = self._get_dbus_property(interface_name, property_name)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1464
        if prop._dbus_access == "write":
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1465
            raise DBusPropertyAccessException(property_name)
1466
        value = prop()
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1467
        if not hasattr(value, "variant_level"):
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1468
            return value
1469
        return type(value)(value, variant_level=value.variant_level+1)
874 by Teddy Hogeborn
PEP8 compliance: mandos
1470
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1471
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1472
    def Set(self, interface_name, property_name, value):
1473
        """Standard D-Bus property Set() method, see D-Bus standard.
1474
        """
1475
        prop = self._get_dbus_property(interface_name, property_name)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1476
        if prop._dbus_access == "read":
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1477
            raise DBusPropertyAccessException(property_name)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1478
        if prop._dbus_get_args_options["byte_arrays"]:
411 by Teddy Hogeborn
More consistent terminology: Clients are no longer "invalid" - they
1479
            # The byte_arrays option is not supported yet on
1480
            # signatures other than "ay".
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1481
            if prop._dbus_signature != "ay":
649 by Teddy Hogeborn
Minor code fix; raise only exception instances, not classes.
1482
                raise ValueError("Byte arrays not supported for non-"
723.1.5 by Teddy Hogeborn
Use the new auto-numbered "{}" syntax for the .format() string method.
1483
                                 "'ay' signature {!r}"
649 by Teddy Hogeborn
Minor code fix; raise only exception instances, not classes.
1484
                                 .format(prop._dbus_signature))
1190 by Teddy Hogeborn
Server: Fix bug when setting Secret property of clients via D-Bus
1485
            value = dbus.ByteArray(bytes(value))
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1486
        prop(value)
874 by Teddy Hogeborn
PEP8 compliance: mandos
1487
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1488
    @dbus.service.method(dbus.PROPERTIES_IFACE,
1489
                         in_signature="s",
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1490
                         out_signature="a{sv}")
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1491
    def GetAll(self, interface_name):
1492
        """Standard D-Bus property GetAll() method, see D-Bus
1493
        standard.
874 by Teddy Hogeborn
PEP8 compliance: mandos
1494
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1495
        Note: Will not include properties with access="write".
1496
        """
518.1.5 by Björn Påhlsson
First run of python-lint. Fixed some *obviously* bad code and turned
1497
        properties = {}
560.1.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
1498
        for name, prop in self._get_all_dbus_things("property"):
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1499
            if (interface_name
1500
                and interface_name != prop._dbus_interface):
1501
                # Interface non-empty but did not match
1502
                continue
1503
            # Ignore write-only properties
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1504
            if prop._dbus_access == "write":
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1505
                continue
1506
            value = prop()
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1507
            if not hasattr(value, "variant_level"):
518.1.5 by Björn Påhlsson
First run of python-lint. Fixed some *obviously* bad code and turned
1508
                properties[name] = value
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1509
                continue
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1510
            properties[name] = type(value)(
874 by Teddy Hogeborn
PEP8 compliance: mandos
1511
                value, variant_level=value.variant_level + 1)
518.1.5 by Björn Påhlsson
First run of python-lint. Fixed some *obviously* bad code and turned
1512
        return dbus.Dictionary(properties, signature="sv")
874 by Teddy Hogeborn
PEP8 compliance: mandos
1513
732 by Teddy Hogeborn
Emit D-Bus "org.freedesktop.DBus.Properties.PropertiesChanged" signal.
1514
    @dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")
1515
    def PropertiesChanged(self, interface_name, changed_properties,
1516
                          invalidated_properties):
1517
        """Standard D-Bus PropertiesChanged() signal, see D-Bus
1518
        standard.
1519
        """
1520
        pass
874 by Teddy Hogeborn
PEP8 compliance: mandos
1521
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1522
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1523
                         out_signature="s",
1247 by Teddy Hogeborn
Server: Fix minor style issue
1524
                         path_keyword="object_path",
1525
                         connection_keyword="connection")
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1526
    def Introspect(self, object_path, connection):
560.1.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
1527
        """Overloading of standard D-Bus method.
874 by Teddy Hogeborn
PEP8 compliance: mandos
1528
560.1.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
1529
        Inserts property tags and interface annotation tags.
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1530
        """
784 by Teddy Hogeborn
Refactor D-Bus annotation class out from D-Bus properties class.
1531
        xmlstring = DBusObjectWithAnnotations.Introspect(self,
1532
                                                         object_path,
1533
                                                         connection)
387 by Teddy Hogeborn
* mandos (ClientDBus.ReceivedSecret): Renamed to "GotSecret". All
1534
        try:
1535
            document = xml.dom.minidom.parseString(xmlstring)
874 by Teddy Hogeborn
PEP8 compliance: mandos
1536
387 by Teddy Hogeborn
* mandos (ClientDBus.ReceivedSecret): Renamed to "GotSecret". All
1537
            def make_tag(document, name, prop):
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1538
                e = document.createElement("property")
1539
                e.setAttribute("name", name)
1540
                e.setAttribute("type", prop._dbus_signature)
1541
                e.setAttribute("access", prop._dbus_access)
387 by Teddy Hogeborn
* mandos (ClientDBus.ReceivedSecret): Renamed to "GotSecret". All
1542
                return e
874 by Teddy Hogeborn
PEP8 compliance: mandos
1543
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1544
            for if_tag in document.getElementsByTagName("interface"):
560.1.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
1545
                # Add property tags
387 by Teddy Hogeborn
* mandos (ClientDBus.ReceivedSecret): Renamed to "GotSecret". All
1546
                for tag in (make_tag(document, name, prop)
1547
                            for name, prop
560.1.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
1548
                            in self._get_all_dbus_things("property")
387 by Teddy Hogeborn
* mandos (ClientDBus.ReceivedSecret): Renamed to "GotSecret". All
1549
                            if prop._dbus_interface
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1550
                            == if_tag.getAttribute("name")):
387 by Teddy Hogeborn
* mandos (ClientDBus.ReceivedSecret): Renamed to "GotSecret". All
1551
                    if_tag.appendChild(tag)
784 by Teddy Hogeborn
Refactor D-Bus annotation class out from D-Bus properties class.
1552
                # Add annotation tags for properties
1553
                for tag in if_tag.getElementsByTagName("property"):
1554
                    annots = dict()
1555
                    for name, prop in self._get_all_dbus_things(
1556
                            "property"):
1557
                        if (name == tag.getAttribute("name")
1558
                            and prop._dbus_interface
1559
                            == if_tag.getAttribute("name")):
1560
                            annots.update(getattr(
1561
                                prop, "_dbus_annotations", {}))
1562
                    for name, value in annots.items():
1563
                        ann_tag = document.createElement(
1564
                            "annotation")
1565
                        ann_tag.setAttribute("name", name)
1566
                        ann_tag.setAttribute("value", value)
1567
                        tag.appendChild(ann_tag)
387 by Teddy Hogeborn
* mandos (ClientDBus.ReceivedSecret): Renamed to "GotSecret". All
1568
                # Add the names to the return values for the
1569
                # "org.freedesktop.DBus.Properties" methods
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1570
                if (if_tag.getAttribute("name")
1571
                    == "org.freedesktop.DBus.Properties"):
1572
                    for cn in if_tag.getElementsByTagName("method"):
1573
                        if cn.getAttribute("name") == "Get":
1574
                            for arg in cn.getElementsByTagName("arg"):
1575
                                if (arg.getAttribute("direction")
1576
                                    == "out"):
1577
                                    arg.setAttribute("name", "value")
1578
                        elif cn.getAttribute("name") == "GetAll":
1579
                            for arg in cn.getElementsByTagName("arg"):
1580
                                if (arg.getAttribute("direction")
1581
                                    == "out"):
1582
                                    arg.setAttribute("name", "props")
1583
            xmlstring = document.toxml("utf-8")
387 by Teddy Hogeborn
* mandos (ClientDBus.ReceivedSecret): Renamed to "GotSecret". All
1584
            document.unlink()
1585
        except (AttributeError, xml.dom.DOMException,
482 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
1586
                xml.parsers.expat.ExpatError) as error:
1254 by Teddy Hogeborn
mandos: Update logging code to more standard idioms
1587
            log.error("Failed to override Introspection method",
1588
                      exc_info=error)
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1589
        return xmlstring
1590
888 by Teddy Hogeborn
Add more PEP8 compliance (as per the "pycodestyle" tool).
1591
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
1592
try:
1593
    dbus.OBJECT_MANAGER_IFACE
1594
except AttributeError:
1595
    dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
1596
874 by Teddy Hogeborn
PEP8 compliance: mandos
1597
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
1598
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
1599
    """A D-Bus object with an ObjectManager.
874 by Teddy Hogeborn
PEP8 compliance: mandos
1600
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
1601
    Classes inheriting from this exposes the standard
1602
    GetManagedObjects call and the InterfacesAdded and
1603
    InterfacesRemoved signals on the standard
1604
    "org.freedesktop.DBus.ObjectManager" interface.
874 by Teddy Hogeborn
PEP8 compliance: mandos
1605
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
1606
    Note: No signals are sent automatically; they must be sent
1607
    manually.
1608
    """
1609
    @dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
874 by Teddy Hogeborn
PEP8 compliance: mandos
1610
                         out_signature="a{oa{sa{sv}}}")
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
1611
    def GetManagedObjects(self):
1612
        """This function must be overridden"""
1613
        raise NotImplementedError()
874 by Teddy Hogeborn
PEP8 compliance: mandos
1614
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
1615
    @dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
874 by Teddy Hogeborn
PEP8 compliance: mandos
1616
                         signature="oa{sa{sv}}")
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
1617
    def InterfacesAdded(self, object_path, interfaces_and_properties):
1618
        pass
874 by Teddy Hogeborn
PEP8 compliance: mandos
1619
1620
    @dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature="oas")
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
1621
    def InterfacesRemoved(self, object_path, interfaces):
1622
        pass
874 by Teddy Hogeborn
PEP8 compliance: mandos
1623
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
1624
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
874 by Teddy Hogeborn
PEP8 compliance: mandos
1625
                         out_signature="s",
1247 by Teddy Hogeborn
Server: Fix minor style issue
1626
                         path_keyword="object_path",
1627
                         connection_keyword="connection")
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
1628
    def Introspect(self, object_path, connection):
1629
        """Overloading of standard D-Bus method.
874 by Teddy Hogeborn
PEP8 compliance: mandos
1630
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
1631
        Override return argument name of GetManagedObjects to be
1632
        "objpath_interfaces_and_properties"
1633
        """
786 by Teddy Hogeborn
Server Bug fix: Make D-Bus introspection work again.
1634
        xmlstring = DBusObjectWithAnnotations.Introspect(self,
1635
                                                         object_path,
1636
                                                         connection)
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
1637
        try:
1638
            document = xml.dom.minidom.parseString(xmlstring)
874 by Teddy Hogeborn
PEP8 compliance: mandos
1639
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
1640
            for if_tag in document.getElementsByTagName("interface"):
1641
                # Fix argument name for the GetManagedObjects method
1642
                if (if_tag.getAttribute("name")
874 by Teddy Hogeborn
PEP8 compliance: mandos
1643
                    == dbus.OBJECT_MANAGER_IFACE):
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
1644
                    for cn in if_tag.getElementsByTagName("method"):
1645
                        if (cn.getAttribute("name")
1646
                            == "GetManagedObjects"):
1647
                            for arg in cn.getElementsByTagName("arg"):
1648
                                if (arg.getAttribute("direction")
1649
                                    == "out"):
1650
                                    arg.setAttribute(
1651
                                        "name",
1652
                                        "objpath_interfaces"
1653
                                        "_and_properties")
1654
            xmlstring = document.toxml("utf-8")
1655
            document.unlink()
1656
        except (AttributeError, xml.dom.DOMException,
1657
                xml.parsers.expat.ExpatError) as error:
1254 by Teddy Hogeborn
mandos: Update logging code to more standard idioms
1658
            log.error("Failed to override Introspection method",
1659
                      exc_info=error)
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
1660
        return xmlstring
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1661
874 by Teddy Hogeborn
PEP8 compliance: mandos
1662
587 by Teddy Hogeborn
* Makefile (DOCBOOKTOMAN): Only run man --warnings if both "man" and
1663
def datetime_to_dbus(dt, variant_level=0):
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1664
    """Convert a UTC datetime.datetime() to a D-Bus type."""
1665
    if dt is None:
874 by Teddy Hogeborn
PEP8 compliance: mandos
1666
        return dbus.String("", variant_level=variant_level)
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1667
    return dbus.String(dt.isoformat(), variant_level=variant_level)
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1668
518.1.6 by Teddy Hogeborn
* mandos: Fix whitespace.
1669
575 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1670
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
1671
    """A class decorator; applied to a subclass of
1672
    dbus.service.Object, it will add alternate D-Bus attributes with
1673
    interface names according to the "alt_interface_names" mapping.
1674
    Usage:
874 by Teddy Hogeborn
PEP8 compliance: mandos
1675
587 by Teddy Hogeborn
* Makefile (DOCBOOKTOMAN): Only run man --warnings if both "man" and
1676
    @alternate_dbus_interfaces({"org.example.Interface":
1677
                                    "net.example.AlternateInterface"})
575 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1678
    class SampleDBusObject(dbus.service.Object):
1679
        @dbus.service.method("org.example.Interface")
1680
        def SampleDBusMethod():
1681
            pass
874 by Teddy Hogeborn
PEP8 compliance: mandos
1682
575 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1683
    The above "SampleDBusMethod" on "SampleDBusObject" will be
1684
    reachable via two interfaces: "org.example.Interface" and
1685
    "net.example.AlternateInterface", the latter of which will have
1686
    its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
1687
    "true", unless "deprecate" is passed with a False value.
874 by Teddy Hogeborn
PEP8 compliance: mandos
1688
575 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1689
    This works for methods and signals, and also for D-Bus properties
1690
    (from DBusObjectWithProperties) and interfaces (from the
1691
    dbus_interface_annotations decorator).
505.1.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1692
    """
874 by Teddy Hogeborn
PEP8 compliance: mandos
1693
575 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1694
    def wrapper(cls):
1695
        for orig_interface_name, alt_interface_name in (
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1696
                alt_interface_names.items()):
575 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1697
            attr = {}
1698
            interface_names = set()
1699
            # Go though all attributes of the class
1700
            for attrname, attribute in inspect.getmembers(cls):
505.1.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1701
                # Ignore non-D-Bus attributes, and D-Bus attributes
1702
                # with the wrong interface name
1703
                if (not hasattr(attribute, "_dbus_interface")
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1704
                    or not attribute._dbus_interface.startswith(
1705
                        orig_interface_name)):
505.1.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1706
                    continue
1707
                # Create an alternate D-Bus interface name based on
1708
                # the current name
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1709
                alt_interface = attribute._dbus_interface.replace(
1710
                    orig_interface_name, alt_interface_name)
575 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1711
                interface_names.add(alt_interface)
505.1.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1712
                # Is this a D-Bus signal?
1713
                if getattr(attribute, "_dbus_is_signal", False):
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
1714
                    # Extract the original non-method undecorated
1715
                    # function by black magic
756 by Teddy Hogeborn
Merge change to use multiprocessing module to run checkers.
1716
                    if sys.version_info.major == 2:
754 by Teddy Hogeborn
mandos: More Python 3 fixes.
1717
                        nonmethod_func = (dict(
1718
                            zip(attribute.func_code.co_freevars,
1719
                                attribute.__closure__))
1720
                                          ["func"].cell_contents)
1721
                    else:
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
1722
                        nonmethod_func = (dict(
1723
                            zip(attribute.__code__.co_freevars,
1724
                                attribute.__closure__))
1725
                                          ["func"].cell_contents)
505.1.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1726
                    # Create a new, but exactly alike, function
1727
                    # object, and decorate it to be a new D-Bus signal
1728
                    # with the alternate D-Bus interface name
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
1729
                    new_function = copy_function(nonmethod_func)
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1730
                    new_function = (dbus.service.signal(
754 by Teddy Hogeborn
mandos: More Python 3 fixes.
1731
                        alt_interface,
1732
                        attribute._dbus_signature)(new_function))
561.1.1 by Teddy Hogeborn
Add D-Bus annotations support to methods, signals and properties.
1733
                    # Copy annotations, if any
1734
                    try:
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1735
                        new_function._dbus_annotations = dict(
1736
                            attribute._dbus_annotations)
561.1.1 by Teddy Hogeborn
Add D-Bus annotations support to methods, signals and properties.
1737
                    except AttributeError:
1738
                        pass
874 by Teddy Hogeborn
PEP8 compliance: mandos
1739
505.1.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1740
                    # Define a creator of a function to call both the
575 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1741
                    # original and alternate functions, so both the
1742
                    # original and alternate signals gets sent when
1743
                    # the function is called
505.1.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1744
                    def fixscope(func1, func2):
1745
                        """This function is a scope container to pass
1746
                        func1 and func2 to the "call_both" function
1747
                        outside of its arguments"""
874 by Teddy Hogeborn
PEP8 compliance: mandos
1748
786 by Teddy Hogeborn
Server Bug fix: Make D-Bus introspection work again.
1749
                        @functools.wraps(func2)
505.1.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1750
                        def call_both(*args, **kwargs):
1751
                            """This function will emit two D-Bus
1752
                            signals by calling func1 and func2"""
1753
                            func1(*args, **kwargs)
1754
                            func2(*args, **kwargs)
874 by Teddy Hogeborn
PEP8 compliance: mandos
1755
                        # Make wrapper function look like a D-Bus
1756
                        # signal
786 by Teddy Hogeborn
Server Bug fix: Make D-Bus introspection work again.
1757
                        for name, attr in inspect.getmembers(func2):
1758
                            if name.startswith("_dbus_"):
1759
                                setattr(call_both, name, attr)
874 by Teddy Hogeborn
PEP8 compliance: mandos
1760
505.1.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1761
                        return call_both
1762
                    # Create the "call_both" function and add it to
1763
                    # the class
575 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1764
                    attr[attrname] = fixscope(attribute, new_function)
505.1.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1765
                # Is this a D-Bus method?
1766
                elif getattr(attribute, "_dbus_is_method", False):
1767
                    # Create a new, but exactly alike, function
1768
                    # object.  Decorate it to be a new D-Bus method
1769
                    # with the alternate D-Bus interface name.  Add it
1770
                    # to the class.
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1771
                    attr[attrname] = (
1772
                        dbus.service.method(
1773
                            alt_interface,
1774
                            attribute._dbus_in_signature,
1775
                            attribute._dbus_out_signature)
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
1776
                        (copy_function(attribute)))
561.1.1 by Teddy Hogeborn
Add D-Bus annotations support to methods, signals and properties.
1777
                    # Copy annotations, if any
1778
                    try:
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1779
                        attr[attrname]._dbus_annotations = dict(
1780
                            attribute._dbus_annotations)
561.1.1 by Teddy Hogeborn
Add D-Bus annotations support to methods, signals and properties.
1781
                    except AttributeError:
1782
                        pass
505.1.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1783
                # Is this a D-Bus property?
1784
                elif getattr(attribute, "_dbus_is_property", False):
1785
                    # Create a new, but exactly alike, function
1786
                    # object, and decorate it to be a new D-Bus
1787
                    # property with the alternate D-Bus interface
1788
                    # name.  Add it to the class.
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1789
                    attr[attrname] = (dbus_service_property(
1790
                        alt_interface, attribute._dbus_signature,
1791
                        attribute._dbus_access,
1792
                        attribute._dbus_get_args_options
1793
                        ["byte_arrays"])
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
1794
                                      (copy_function(attribute)))
561.1.1 by Teddy Hogeborn
Add D-Bus annotations support to methods, signals and properties.
1795
                    # Copy annotations, if any
1796
                    try:
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1797
                        attr[attrname]._dbus_annotations = dict(
1798
                            attribute._dbus_annotations)
561.1.1 by Teddy Hogeborn
Add D-Bus annotations support to methods, signals and properties.
1799
                    except AttributeError:
1800
                        pass
560.1.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
1801
                # Is this a D-Bus interface?
1802
                elif getattr(attribute, "_dbus_is_interface", False):
1803
                    # Create a new, but exactly alike, function
1804
                    # object.  Decorate it to be a new D-Bus interface
1805
                    # with the alternate D-Bus interface name.  Add it
1806
                    # to the class.
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1807
                    attr[attrname] = (
1808
                        dbus_interface_annotations(alt_interface)
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
1809
                        (copy_function(attribute)))
575 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1810
            if deprecate:
1811
                # Deprecate all alternate interfaces
874 by Teddy Hogeborn
PEP8 compliance: mandos
1812
                iname = "_AlternateDBusNames_interface_annotation{}"
575 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1813
                for interface_name in interface_names:
874 by Teddy Hogeborn
PEP8 compliance: mandos
1814
575 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1815
                    @dbus_interface_annotations(interface_name)
1816
                    def func(self):
874 by Teddy Hogeborn
PEP8 compliance: mandos
1817
                        return {"org.freedesktop.DBus.Deprecated":
1818
                                "true"}
575 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1819
                    # Find an unused name
1820
                    for aname in (iname.format(i)
1821
                                  for i in itertools.count()):
1822
                        if aname not in attr:
1823
                            attr[aname] = func
1824
                            break
1825
            if interface_names:
1826
                # Replace the class with a new subclass of it with
1827
                # methods, signals, etc. as created above.
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
1828
                if sys.version_info.major == 2:
1829
                    cls = type(b"{}Alternate".format(cls.__name__),
1830
                               (cls, ), attr)
1831
                else:
1832
                    cls = type("{}Alternate".format(cls.__name__),
1833
                               (cls, ), attr)
575 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1834
        return cls
874 by Teddy Hogeborn
PEP8 compliance: mandos
1835
575 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1836
    return wrapper
1837
1838
1839
@alternate_dbus_interfaces({"se.recompile.Mandos":
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1840
                            "se.bsnet.fukt.Mandos"})
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1841
class ClientDBus(Client, DBusObjectWithProperties):
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1842
    """A Client class using D-Bus
874 by Teddy Hogeborn
PEP8 compliance: mandos
1843
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1844
    Attributes:
338 by Teddy Hogeborn
* mandos: Minor doc string fixes.
1845
    dbus_object_path: dbus.ObjectPath
1846
    bus: dbus.SystemBus()
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1847
    """
874 by Teddy Hogeborn
PEP8 compliance: mandos
1848
438 by Teddy Hogeborn
* mandos (Client.runtime_expansions): New attribute containing the
1849
    runtime_expansions = (Client.runtime_expansions
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1850
                          + ("dbus_object_path", ))
874 by Teddy Hogeborn
PEP8 compliance: mandos
1851
732 by Teddy Hogeborn
Emit D-Bus "org.freedesktop.DBus.Properties.PropertiesChanged" signal.
1852
    _interface = "se.recompile.Mandos.Client"
874 by Teddy Hogeborn
PEP8 compliance: mandos
1853
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1854
    # dbus.service.Object doesn't use super(), so we can't either.
874 by Teddy Hogeborn
PEP8 compliance: mandos
1855
1856
    def __init__(self, bus=None, *args, **kwargs):
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
1857
        self.bus = bus
1858
        Client.__init__(self, *args, **kwargs)
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1859
        # Only now, when this client is initialized, can it show up on
1860
        # the D-Bus
730 by Teddy Hogeborn
mandos: Replace unicode() with str().
1861
        client_object_name = str(self.name).translate(
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1862
            {ord("."): ord("_"),
1863
             ord("-"): ord("_")})
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1864
        self.dbus_object_path = dbus.ObjectPath(
1865
            "/clients/" + client_object_name)
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1866
        DBusObjectWithProperties.__init__(self, self.bus,
1867
                                          self.dbus_object_path)
874 by Teddy Hogeborn
PEP8 compliance: mandos
1868
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1869
    def notifychangeproperty(transform_func, dbus_name,
1870
                             type_func=lambda x: x,
1871
                             variant_level=1,
1872
                             invalidate_only=False,
732 by Teddy Hogeborn
Emit D-Bus "org.freedesktop.DBus.Properties.PropertiesChanged" signal.
1873
                             _interface=_interface):
505.1.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1874
        """ Modify a variable so that it's a property which announces
1875
        its changes to DBus.
874 by Teddy Hogeborn
PEP8 compliance: mandos
1876
505.1.15 by Teddy Hogeborn
Bug fix: Make D-Bus properties settable again.
1877
        transform_fun: Function that takes a value and a variant_level
1878
                       and transforms it to a D-Bus type.
505.1.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1879
        dbus_name: D-Bus name of the variable
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1880
        type_func: Function that transform the value before sending it
505.1.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1881
                   to the D-Bus.  Default: no transform
1882
        variant_level: D-Bus variant level.  Default: 1
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1883
        """
723.1.5 by Teddy Hogeborn
Use the new auto-numbered "{}" syntax for the .format() string method.
1884
        attrname = "_{}".format(dbus_name)
874 by Teddy Hogeborn
PEP8 compliance: mandos
1885
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1886
        def setter(self, value):
1887
            if hasattr(self, "dbus_object_path"):
505.1.6 by Teddy Hogeborn
* mandos (ClientDBus.notifychangeproperty): Bug fix: Use instance
1888
                if (not hasattr(self, attrname) or
1889
                    type_func(getattr(self, attrname, None))
1890
                    != type_func(value)):
732 by Teddy Hogeborn
Emit D-Bus "org.freedesktop.DBus.Properties.PropertiesChanged" signal.
1891
                    if invalidate_only:
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1892
                        self.PropertiesChanged(
1893
                            _interface, dbus.Dictionary(),
1894
                            dbus.Array((dbus_name, )))
732 by Teddy Hogeborn
Emit D-Bus "org.freedesktop.DBus.Properties.PropertiesChanged" signal.
1895
                    else:
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1896
                        dbus_value = transform_func(
1897
                            type_func(value),
874 by Teddy Hogeborn
PEP8 compliance: mandos
1898
                            variant_level=variant_level)
732 by Teddy Hogeborn
Emit D-Bus "org.freedesktop.DBus.Properties.PropertiesChanged" signal.
1899
                        self.PropertyChanged(dbus.String(dbus_name),
1900
                                             dbus_value)
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1901
                        self.PropertiesChanged(
1902
                            _interface,
874 by Teddy Hogeborn
PEP8 compliance: mandos
1903
                            dbus.Dictionary({dbus.String(dbus_name):
1904
                                             dbus_value}),
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1905
                            dbus.Array())
505.1.6 by Teddy Hogeborn
* mandos (ClientDBus.notifychangeproperty): Bug fix: Use instance
1906
            setattr(self, attrname, value)
874 by Teddy Hogeborn
PEP8 compliance: mandos
1907
505.1.6 by Teddy Hogeborn
* mandos (ClientDBus.notifychangeproperty): Bug fix: Use instance
1908
        return property(lambda self: getattr(self, attrname), setter)
874 by Teddy Hogeborn
PEP8 compliance: mandos
1909
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1910
    expires = notifychangeproperty(datetime_to_dbus, "Expires")
1911
    approvals_pending = notifychangeproperty(dbus.Boolean,
1912
                                             "ApprovalPending",
874 by Teddy Hogeborn
PEP8 compliance: mandos
1913
                                             type_func=bool)
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1914
    enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1915
    last_enabled = notifychangeproperty(datetime_to_dbus,
1916
                                        "LastEnabled")
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1917
    checker = notifychangeproperty(
1918
        dbus.Boolean, "CheckerRunning",
874 by Teddy Hogeborn
PEP8 compliance: mandos
1919
        type_func=lambda checker: checker is not None)
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1920
    last_checked_ok = notifychangeproperty(datetime_to_dbus,
1921
                                           "LastCheckedOK")
556 by Teddy Hogeborn
* DBUS-API (se.recompile.Mandos.Client.LastCheckerStatus): New
1922
    last_checker_status = notifychangeproperty(dbus.Int16,
1923
                                               "LastCheckerStatus")
505.1.3 by Teddy Hogeborn
* mandos: Break long lines.
1924
    last_approval_request = notifychangeproperty(
1925
        datetime_to_dbus, "LastApprovalRequest")
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1926
    approved_by_default = notifychangeproperty(dbus.Boolean,
1927
                                               "ApprovedByDefault")
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1928
    approval_delay = notifychangeproperty(
1929
        dbus.UInt64, "ApprovalDelay",
874 by Teddy Hogeborn
PEP8 compliance: mandos
1930
        type_func=lambda td: td.total_seconds() * 1000)
505.1.3 by Teddy Hogeborn
* mandos: Break long lines.
1931
    approval_duration = notifychangeproperty(
518.2.9 by Teddy Hogeborn
* mandos (ClientDBus.approval_delay, ClientDBus.approval_duration,
1932
        dbus.UInt64, "ApprovalDuration",
874 by Teddy Hogeborn
PEP8 compliance: mandos
1933
        type_func=lambda td: td.total_seconds() * 1000)
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1934
    host = notifychangeproperty(dbus.String, "Host")
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1935
    timeout = notifychangeproperty(
1936
        dbus.UInt64, "Timeout",
874 by Teddy Hogeborn
PEP8 compliance: mandos
1937
        type_func=lambda td: td.total_seconds() * 1000)
505.1.3 by Teddy Hogeborn
* mandos: Break long lines.
1938
    extended_timeout = notifychangeproperty(
518.2.9 by Teddy Hogeborn
* mandos (ClientDBus.approval_delay, ClientDBus.approval_duration,
1939
        dbus.UInt64, "ExtendedTimeout",
874 by Teddy Hogeborn
PEP8 compliance: mandos
1940
        type_func=lambda td: td.total_seconds() * 1000)
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
1941
    interval = notifychangeproperty(
1942
        dbus.UInt64, "Interval",
874 by Teddy Hogeborn
PEP8 compliance: mandos
1943
        type_func=lambda td: td.total_seconds() * 1000)
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1944
    checker_command = notifychangeproperty(dbus.String, "Checker")
732 by Teddy Hogeborn
Emit D-Bus "org.freedesktop.DBus.Properties.PropertiesChanged" signal.
1945
    secret = notifychangeproperty(dbus.ByteArray, "Secret",
1946
                                  invalidate_only=True)
874 by Teddy Hogeborn
PEP8 compliance: mandos
1947
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1948
    del notifychangeproperty
874 by Teddy Hogeborn
PEP8 compliance: mandos
1949
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1950
    def __del__(self, *args, **kwargs):
1951
        try:
1952
            self.remove_from_connection()
329 by Teddy Hogeborn
* mandos (ClientDBus.__del__): Bug fix: Correct mispasted code, and do
1953
        except LookupError:
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1954
            pass
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
1955
        if hasattr(DBusObjectWithProperties, "__del__"):
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1956
            DBusObjectWithProperties.__del__(self, *args, **kwargs)
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1957
        Client.__del__(self, *args, **kwargs)
874 by Teddy Hogeborn
PEP8 compliance: mandos
1958
749.1.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
1959
    def checker_callback(self, source, condition,
756 by Teddy Hogeborn
Merge change to use multiprocessing module to run checkers.
1960
                         connection, command, *args, **kwargs):
749.1.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
1961
        ret = Client.checker_callback(self, source, condition,
756 by Teddy Hogeborn
Merge change to use multiprocessing module to run checkers.
1962
                                      connection, command, *args,
749.1.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
1963
                                      **kwargs)
1964
        exitstatus = self.last_checker_status
1965
        if exitstatus >= 0:
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1966
            # Emit D-Bus signal
1967
            self.CheckerCompleted(dbus.Int16(exitstatus),
783 by Teddy Hogeborn
Revert change to D-Bus API.
1968
                                  # This is specific to GNU libC
1969
                                  dbus.Int64(exitstatus << 8),
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1970
                                  dbus.String(command))
1971
        else:
1972
            # Emit D-Bus signal
1973
            self.CheckerCompleted(dbus.Int16(-1),
749.1.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
1974
                                  dbus.Int64(
783 by Teddy Hogeborn
Revert change to D-Bus API.
1975
                                      # This is specific to GNU libC
1976
                                      (exitstatus << 8)
1977
                                      | self.last_checker_signal),
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1978
                                  dbus.String(command))
749.1.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
1979
        return ret
874 by Teddy Hogeborn
PEP8 compliance: mandos
1980
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1981
    def start_checker(self, *args, **kwargs):
658 by Teddy Hogeborn
* mandos (ClientDBus.start_checker): Removed unused variable
1982
        old_checker_pid = getattr(self.checker, "pid", None)
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1983
        r = Client.start_checker(self, *args, **kwargs)
329 by Teddy Hogeborn
* mandos (ClientDBus.__del__): Bug fix: Correct mispasted code, and do
1984
        # Only if new checker process was started
1985
        if (self.checker is not None
1986
            and old_checker_pid != self.checker.pid):
1987
            # Emit D-Bus signal
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1988
            self.CheckerStarted(self.current_checker_command)
1989
        return r
874 by Teddy Hogeborn
PEP8 compliance: mandos
1990
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1991
    def _reset_approved(self):
518.2.4 by Teddy Hogeborn
* mandos (_timedelta_to_milliseconds): Renamed to
1992
        self.approved = None
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1993
        return False
874 by Teddy Hogeborn
PEP8 compliance: mandos
1994
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1995
    def approve(self, value=True):
518.2.4 by Teddy Hogeborn
* mandos (_timedelta_to_milliseconds): Renamed to
1996
        self.approved = value
830 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
1997
        GLib.timeout_add(int(self.approval_duration.total_seconds()
1998
                             * 1000), self._reset_approved)
581 by Teddy Hogeborn
* mandos (Client.enable, Client.disable, ClientDBus.approve): Call
1999
        self.send_changedstate()
874 by Teddy Hogeborn
PEP8 compliance: mandos
2000
2001
    #  D-Bus methods, signals & properties
2002
2003
    #  Interfaces
2004
2005
    #  Signals
2006
237.1.2 by Teddy Hogeborn
Further steps towards a D-Bus server interface, plus minor syntax
2007
    # CheckerCompleted - signal
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2008
    @dbus.service.signal(_interface, signature="nxs")
280 by Teddy Hogeborn
* mandos (Client.CheckerCompleted): Changed signature to "nxs"; return
2009
    def CheckerCompleted(self, exitcode, waitstatus, command):
237.1.2 by Teddy Hogeborn
Further steps towards a D-Bus server interface, plus minor syntax
2010
        "D-Bus signal"
2011
        pass
874 by Teddy Hogeborn
PEP8 compliance: mandos
2012
237.1.2 by Teddy Hogeborn
Further steps towards a D-Bus server interface, plus minor syntax
2013
    # CheckerStarted - signal
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2014
    @dbus.service.signal(_interface, signature="s")
237.1.2 by Teddy Hogeborn
Further steps towards a D-Bus server interface, plus minor syntax
2015
    def CheckerStarted(self, command):
2016
        "D-Bus signal"
2017
        pass
874 by Teddy Hogeborn
PEP8 compliance: mandos
2018
238 by Teddy Hogeborn
First version of a somewhat complete D-Bus server interface. Also
2019
    # PropertyChanged - signal
732 by Teddy Hogeborn
Emit D-Bus "org.freedesktop.DBus.Properties.PropertiesChanged" signal.
2020
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2021
    @dbus.service.signal(_interface, signature="sv")
238 by Teddy Hogeborn
First version of a somewhat complete D-Bus server interface. Also
2022
    def PropertyChanged(self, property, value):
2023
        "D-Bus signal"
2024
        pass
874 by Teddy Hogeborn
PEP8 compliance: mandos
2025
387 by Teddy Hogeborn
* mandos (ClientDBus.ReceivedSecret): Renamed to "GotSecret". All
2026
    # GotSecret - signal
327 by Teddy Hogeborn
Merge from pipe IPC branch.
2027
    @dbus.service.signal(_interface)
387 by Teddy Hogeborn
* mandos (ClientDBus.ReceivedSecret): Renamed to "GotSecret". All
2028
    def GotSecret(self):
24.1.155 by Björn Påhlsson
mandos server: Added debuglevel that adjust at what level information
2029
        """D-Bus signal
2030
        Is sent after a successful transfer of secret from the Mandos
2031
        server to mandos-client
2032
        """
24.2.4 by teddy at bsnet
* mandos (ClientDBus.approvals_pending): Changed to be a property
2033
        pass
874 by Teddy Hogeborn
PEP8 compliance: mandos
2034
327 by Teddy Hogeborn
Merge from pipe IPC branch.
2035
    # Rejected - signal
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2036
    @dbus.service.signal(_interface, signature="s")
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2037
    def Rejected(self, reason):
2038
        "D-Bus signal"
24.2.4 by teddy at bsnet
* mandos (ClientDBus.approvals_pending): Changed to be a property
2039
        pass
874 by Teddy Hogeborn
PEP8 compliance: mandos
2040
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2041
    # NeedApproval - signal
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2042
    @dbus.service.signal(_interface, signature="tb")
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2043
    def NeedApproval(self, timeout, default):
327 by Teddy Hogeborn
Merge from pipe IPC branch.
2044
        "D-Bus signal"
442 by Teddy Hogeborn
* DBUS-API: Document new "LastApprovalRequest" client property.
2045
        return self.need_approval()
874 by Teddy Hogeborn
PEP8 compliance: mandos
2046
2047
    #  Methods
2048
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2049
    # Approve - method
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2050
    @dbus.service.method(_interface, in_signature="b")
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2051
    def Approve(self, value):
2052
        self.approve(value)
874 by Teddy Hogeborn
PEP8 compliance: mandos
2053
24.1.147 by Björn Påhlsson
The IPC pipes are now file objects, not file descriptors:
2054
    # CheckedOK - method
2055
    @dbus.service.method(_interface)
2056
    def CheckedOK(self):
482 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
2057
        self.checked_ok()
874 by Teddy Hogeborn
PEP8 compliance: mandos
2058
381 by Teddy Hogeborn
Restore some poor D-Bus methods who got a bit hastily deleted. Enable
2059
    # Enable - method
781 by Teddy Hogeborn
Deprecate some D-Bus methods in favor of D-Bus properties.
2060
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
381 by Teddy Hogeborn
Restore some poor D-Bus methods who got a bit hastily deleted. Enable
2061
    @dbus.service.method(_interface)
2062
    def Enable(self):
2063
        "D-Bus method"
2064
        self.enable()
874 by Teddy Hogeborn
PEP8 compliance: mandos
2065
381 by Teddy Hogeborn
Restore some poor D-Bus methods who got a bit hastily deleted. Enable
2066
    # StartChecker - method
781 by Teddy Hogeborn
Deprecate some D-Bus methods in favor of D-Bus properties.
2067
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
381 by Teddy Hogeborn
Restore some poor D-Bus methods who got a bit hastily deleted. Enable
2068
    @dbus.service.method(_interface)
2069
    def StartChecker(self):
2070
        "D-Bus method"
2071
        self.start_checker()
874 by Teddy Hogeborn
PEP8 compliance: mandos
2072
381 by Teddy Hogeborn
Restore some poor D-Bus methods who got a bit hastily deleted. Enable
2073
    # Disable - method
781 by Teddy Hogeborn
Deprecate some D-Bus methods in favor of D-Bus properties.
2074
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
381 by Teddy Hogeborn
Restore some poor D-Bus methods who got a bit hastily deleted. Enable
2075
    @dbus.service.method(_interface)
2076
    def Disable(self):
2077
        "D-Bus method"
2078
        self.disable()
874 by Teddy Hogeborn
PEP8 compliance: mandos
2079
381 by Teddy Hogeborn
Restore some poor D-Bus methods who got a bit hastily deleted. Enable
2080
    # StopChecker - method
781 by Teddy Hogeborn
Deprecate some D-Bus methods in favor of D-Bus properties.
2081
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
381 by Teddy Hogeborn
Restore some poor D-Bus methods who got a bit hastily deleted. Enable
2082
    @dbus.service.method(_interface)
2083
    def StopChecker(self):
2084
        self.stop_checker()
874 by Teddy Hogeborn
PEP8 compliance: mandos
2085
2086
    #  Properties
2087
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2088
    # ApprovalPending - property
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2089
    @dbus_service_property(_interface, signature="b", access="read")
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2090
    def ApprovalPending_dbus_property(self):
24.2.4 by teddy at bsnet
* mandos (ClientDBus.approvals_pending): Changed to be a property
2091
        return dbus.Boolean(bool(self.approvals_pending))
874 by Teddy Hogeborn
PEP8 compliance: mandos
2092
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2093
    # ApprovedByDefault - property
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2094
    @dbus_service_property(_interface,
2095
                           signature="b",
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2096
                           access="readwrite")
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2097
    def ApprovedByDefault_dbus_property(self, value=None):
2098
        if value is None:       # get
2099
            return dbus.Boolean(self.approved_by_default)
2100
        self.approved_by_default = bool(value)
874 by Teddy Hogeborn
PEP8 compliance: mandos
2101
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2102
    # ApprovalDelay - property
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2103
    @dbus_service_property(_interface,
2104
                           signature="t",
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2105
                           access="readwrite")
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2106
    def ApprovalDelay_dbus_property(self, value=None):
2107
        if value is None:       # get
723.1.6 by Teddy Hogeborn
Use the new .total_seconds() method on datetime.timedelta objects.
2108
            return dbus.UInt64(self.approval_delay.total_seconds()
2109
                               * 1000)
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2110
        self.approval_delay = datetime.timedelta(0, 0, 0, value)
874 by Teddy Hogeborn
PEP8 compliance: mandos
2111
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2112
    # ApprovalDuration - property
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2113
    @dbus_service_property(_interface,
2114
                           signature="t",
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2115
                           access="readwrite")
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2116
    def ApprovalDuration_dbus_property(self, value=None):
2117
        if value is None:       # get
723.1.6 by Teddy Hogeborn
Use the new .total_seconds() method on datetime.timedelta objects.
2118
            return dbus.UInt64(self.approval_duration.total_seconds()
2119
                               * 1000)
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2120
        self.approval_duration = datetime.timedelta(0, 0, 0, value)
874 by Teddy Hogeborn
PEP8 compliance: mandos
2121
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2122
    # Name - property
780 by Teddy Hogeborn
Add D-Bus annotations on a few properties on the Client object.
2123
    @dbus_annotations(
2124
        {"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2125
    @dbus_service_property(_interface, signature="s", access="read")
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2126
    def Name_dbus_property(self):
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
2127
        return dbus.String(self.name)
874 by Teddy Hogeborn
PEP8 compliance: mandos
2128
962 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
2129
    # KeyID - property
2130
    @dbus_annotations(
2131
        {"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2132
    @dbus_service_property(_interface, signature="s", access="read")
2133
    def KeyID_dbus_property(self):
2134
        return dbus.String(self.key_id)
2135
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2136
    # Fingerprint - property
780 by Teddy Hogeborn
Add D-Bus annotations on a few properties on the Client object.
2137
    @dbus_annotations(
2138
        {"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2139
    @dbus_service_property(_interface, signature="s", access="read")
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2140
    def Fingerprint_dbus_property(self):
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
2141
        return dbus.String(self.fingerprint)
874 by Teddy Hogeborn
PEP8 compliance: mandos
2142
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2143
    # Host - property
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2144
    @dbus_service_property(_interface,
2145
                           signature="s",
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2146
                           access="readwrite")
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2147
    def Host_dbus_property(self, value=None):
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
2148
        if value is None:       # get
2149
            return dbus.String(self.host)
730 by Teddy Hogeborn
mandos: Replace unicode() with str().
2150
        self.host = str(value)
874 by Teddy Hogeborn
PEP8 compliance: mandos
2151
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2152
    # Created - property
780 by Teddy Hogeborn
Add D-Bus annotations on a few properties on the Client object.
2153
    @dbus_annotations(
2154
        {"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2155
    @dbus_service_property(_interface, signature="s", access="read")
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2156
    def Created_dbus_property(self):
518.2.3 by Teddy Hogeborn
Make "enabled" a client config option.
2157
        return datetime_to_dbus(self.created)
874 by Teddy Hogeborn
PEP8 compliance: mandos
2158
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2159
    # LastEnabled - property
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2160
    @dbus_service_property(_interface, signature="s", access="read")
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2161
    def LastEnabled_dbus_property(self):
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
2162
        return datetime_to_dbus(self.last_enabled)
874 by Teddy Hogeborn
PEP8 compliance: mandos
2163
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2164
    # Enabled - property
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2165
    @dbus_service_property(_interface,
2166
                           signature="b",
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2167
                           access="readwrite")
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2168
    def Enabled_dbus_property(self, value=None):
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
2169
        if value is None:       # get
2170
            return dbus.Boolean(self.enabled)
2171
        if value:
2172
            self.enable()
2173
        else:
2174
            self.disable()
874 by Teddy Hogeborn
PEP8 compliance: mandos
2175
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2176
    # LastCheckedOK - property
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2177
    @dbus_service_property(_interface,
2178
                           signature="s",
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2179
                           access="readwrite")
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2180
    def LastCheckedOK_dbus_property(self, value=None):
381 by Teddy Hogeborn
Restore some poor D-Bus methods who got a bit hastily deleted. Enable
2181
        if value is not None:
2182
            self.checked_ok()
2183
            return
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
2184
        return datetime_to_dbus(self.last_checked_ok)
874 by Teddy Hogeborn
PEP8 compliance: mandos
2185
556 by Teddy Hogeborn
* DBUS-API (se.recompile.Mandos.Client.LastCheckerStatus): New
2186
    # LastCheckerStatus - property
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2187
    @dbus_service_property(_interface, signature="n", access="read")
556 by Teddy Hogeborn
* DBUS-API (se.recompile.Mandos.Client.LastCheckerStatus): New
2188
    def LastCheckerStatus_dbus_property(self):
2189
        return dbus.Int16(self.last_checker_status)
874 by Teddy Hogeborn
PEP8 compliance: mandos
2190
24.1.179 by Björn Påhlsson
New feature:
2191
    # Expires - property
2192
    @dbus_service_property(_interface, signature="s", access="read")
2193
    def Expires_dbus_property(self):
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
2194
        return datetime_to_dbus(self.expires)
874 by Teddy Hogeborn
PEP8 compliance: mandos
2195
442 by Teddy Hogeborn
* DBUS-API: Document new "LastApprovalRequest" client property.
2196
    # LastApprovalRequest - property
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2197
    @dbus_service_property(_interface, signature="s", access="read")
442 by Teddy Hogeborn
* DBUS-API: Document new "LastApprovalRequest" client property.
2198
    def LastApprovalRequest_dbus_property(self):
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
2199
        return datetime_to_dbus(self.last_approval_request)
874 by Teddy Hogeborn
PEP8 compliance: mandos
2200
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2201
    # Timeout - property
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2202
    @dbus_service_property(_interface,
2203
                           signature="t",
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2204
                           access="readwrite")
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2205
    def Timeout_dbus_property(self, value=None):
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
2206
        if value is None:       # get
723.1.6 by Teddy Hogeborn
Use the new .total_seconds() method on datetime.timedelta objects.
2207
            return dbus.UInt64(self.timeout.total_seconds() * 1000)
581 by Teddy Hogeborn
* mandos (Client.enable, Client.disable, ClientDBus.approve): Call
2208
        old_timeout = self.timeout
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
2209
        self.timeout = datetime.timedelta(0, 0, 0, value)
581 by Teddy Hogeborn
* mandos (Client.enable, Client.disable, ClientDBus.approve): Call
2210
        # Reschedule disabling
543 by Teddy Hogeborn
* mandos: Break some long lines.
2211
        if self.enabled:
2212
            now = datetime.datetime.utcnow()
581 by Teddy Hogeborn
* mandos (Client.enable, Client.disable, ClientDBus.approve): Call
2213
            self.expires += self.timeout - old_timeout
2214
            if self.expires <= now:
543 by Teddy Hogeborn
* mandos: Break some long lines.
2215
                # The timeout has passed
2216
                self.disable()
2217
            else:
2218
                if (getattr(self, "disable_initiator_tag", None)
2219
                    is None):
2220
                    return
830 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
2221
                GLib.source_remove(self.disable_initiator_tag)
2222
                self.disable_initiator_tag = GLib.timeout_add(
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2223
                    int((self.expires - now).total_seconds() * 1000),
2224
                    self.disable)
874 by Teddy Hogeborn
PEP8 compliance: mandos
2225
24.1.179 by Björn Påhlsson
New feature:
2226
    # ExtendedTimeout - property
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2227
    @dbus_service_property(_interface,
2228
                           signature="t",
24.1.179 by Björn Påhlsson
New feature:
2229
                           access="readwrite")
2230
    def ExtendedTimeout_dbus_property(self, value=None):
2231
        if value is None:       # get
723.1.6 by Teddy Hogeborn
Use the new .total_seconds() method on datetime.timedelta objects.
2232
            return dbus.UInt64(self.extended_timeout.total_seconds()
2233
                               * 1000)
24.1.179 by Björn Påhlsson
New feature:
2234
        self.extended_timeout = datetime.timedelta(0, 0, 0, value)
874 by Teddy Hogeborn
PEP8 compliance: mandos
2235
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2236
    # Interval - property
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2237
    @dbus_service_property(_interface,
2238
                           signature="t",
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2239
                           access="readwrite")
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2240
    def Interval_dbus_property(self, value=None):
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
2241
        if value is None:       # get
723.1.6 by Teddy Hogeborn
Use the new .total_seconds() method on datetime.timedelta objects.
2242
            return dbus.UInt64(self.interval.total_seconds() * 1000)
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
2243
        self.interval = datetime.timedelta(0, 0, 0, value)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2244
        if getattr(self, "checker_initiator_tag", None) is None:
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
2245
            return
518.2.3 by Teddy Hogeborn
Make "enabled" a client config option.
2246
        if self.enabled:
2247
            # Reschedule checker run
830 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
2248
            GLib.source_remove(self.checker_initiator_tag)
2249
            self.checker_initiator_tag = GLib.timeout_add(
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2250
                value, self.start_checker)
874 by Teddy Hogeborn
PEP8 compliance: mandos
2251
            self.start_checker()  # Start one now, too
2252
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2253
    # Checker - property
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2254
    @dbus_service_property(_interface,
2255
                           signature="s",
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2256
                           access="readwrite")
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2257
    def Checker_dbus_property(self, value=None):
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
2258
        if value is None:       # get
2259
            return dbus.String(self.checker_command)
730 by Teddy Hogeborn
mandos: Replace unicode() with str().
2260
        self.checker_command = str(value)
874 by Teddy Hogeborn
PEP8 compliance: mandos
2261
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2262
    # CheckerRunning - property
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2263
    @dbus_service_property(_interface,
2264
                           signature="b",
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2265
                           access="readwrite")
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2266
    def CheckerRunning_dbus_property(self, value=None):
380 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
2267
        if value is None:       # get
2268
            return dbus.Boolean(self.checker is not None)
2269
        if value:
2270
            self.start_checker()
2271
        else:
2272
            self.stop_checker()
874 by Teddy Hogeborn
PEP8 compliance: mandos
2273
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2274
    # ObjectPath - property
780 by Teddy Hogeborn
Add D-Bus annotations on a few properties on the Client object.
2275
    @dbus_annotations(
782 by Teddy Hogeborn
Deprecate the D-Bus property "se.recompile.Mandos.Client.ObjectPath".
2276
        {"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",
2277
         "org.freedesktop.DBus.Deprecated": "true"})
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2278
    @dbus_service_property(_interface, signature="o", access="read")
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2279
    def ObjectPath_dbus_property(self):
874 by Teddy Hogeborn
PEP8 compliance: mandos
2280
        return self.dbus_object_path  # is already a dbus.ObjectPath
2281
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2282
    # Secret = property
780 by Teddy Hogeborn
Add D-Bus annotations on a few properties on the Client object.
2283
    @dbus_annotations(
2284
        {"org.freedesktop.DBus.Property.EmitsChangedSignal":
2285
         "invalidates"})
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2286
    @dbus_service_property(_interface,
2287
                           signature="ay",
2288
                           access="write",
2289
                           byte_arrays=True)
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2290
    def Secret_dbus_property(self, value):
729 by Teddy Hogeborn
mandos: Stop using str() and remove unnecessary unicode() calls.
2291
        self.secret = bytes(value)
874 by Teddy Hogeborn
PEP8 compliance: mandos
2292
237.1.2 by Teddy Hogeborn
Further steps towards a D-Bus server interface, plus minor syntax
2293
    del _interface
3 by Björn Påhlsson
Python based server
2294
2295
1154 by Teddy Hogeborn
Simplification of Python 3 compatibility code
2296
class ProxyClient:
962 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
2297
    def __init__(self, child_pipe, key_id, fpr, address):
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2298
        self._pipe = child_pipe
1247 by Teddy Hogeborn
Server: Fix minor style issue
2299
        self._pipe.send(("init", key_id, fpr, address))
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2300
        if not self._pipe.recv():
962 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
2301
            raise KeyError(key_id or fpr)
874 by Teddy Hogeborn
PEP8 compliance: mandos
2302
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2303
    def __getattribute__(self, name):
1247 by Teddy Hogeborn
Server: Fix minor style issue
2304
        if name == "_pipe":
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2305
            return super(ProxyClient, self).__getattribute__(name)
1247 by Teddy Hogeborn
Server: Fix minor style issue
2306
        self._pipe.send(("getattr", name))
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2307
        data = self._pipe.recv()
1247 by Teddy Hogeborn
Server: Fix minor style issue
2308
        if data[0] == "data":
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2309
            return data[1]
1247 by Teddy Hogeborn
Server: Fix minor style issue
2310
        if data[0] == "function":
874 by Teddy Hogeborn
PEP8 compliance: mandos
2311
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2312
            def func(*args, **kwargs):
1247 by Teddy Hogeborn
Server: Fix minor style issue
2313
                self._pipe.send(("funcall", name, args, kwargs))
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2314
                return self._pipe.recv()[1]
874 by Teddy Hogeborn
PEP8 compliance: mandos
2315
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2316
            return func
874 by Teddy Hogeborn
PEP8 compliance: mandos
2317
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2318
    def __setattr__(self, name, value):
1247 by Teddy Hogeborn
Server: Fix minor style issue
2319
        if name == "_pipe":
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2320
            return super(ProxyClient, self).__setattr__(name, value)
1247 by Teddy Hogeborn
Server: Fix minor style issue
2321
        self._pipe.send(("setattr", name, value))
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2322
518.1.6 by Teddy Hogeborn
* mandos: Fix whitespace.
2323
335 by Teddy Hogeborn
* mandos: Import "SocketServer" as "socketserver" and "ConfigParser"
2324
class ClientHandler(socketserver.BaseRequestHandler, object):
331 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
2325
    """A class to handle client connections.
874 by Teddy Hogeborn
PEP8 compliance: mandos
2326
331 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
2327
    Instantiated once for each connection to handle it.
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
2328
    Note: This will run in its own forked process."""
874 by Teddy Hogeborn
PEP8 compliance: mandos
2329
3 by Björn Påhlsson
Python based server
2330
    def handle(self):
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2331
        with contextlib.closing(self.server.child_pipe) as child_pipe:
1254 by Teddy Hogeborn
mandos: Update logging code to more standard idioms
2332
            log.info("TCP connection from: %s",
2333
                     str(self.client_address))
2334
            log.debug("Pipe FD: %d", self.server.child_pipe.fileno())
874 by Teddy Hogeborn
PEP8 compliance: mandos
2335
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
2336
            session = gnutls.ClientSession(self.request)
874 by Teddy Hogeborn
PEP8 compliance: mandos
2337
1247 by Teddy Hogeborn
Server: Fix minor style issue
2338
            # priority = ":".join(("NONE", "+VERS-TLS1.1",
874 by Teddy Hogeborn
PEP8 compliance: mandos
2339
            #                       "+AES-256-CBC", "+SHA1",
2340
            #                       "+COMP-NULL", "+CTYPE-OPENPGP",
2341
            #                       "+DHE-DSS"))
288.1.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
2342
            # Use a fallback default, since this MUST be set.
331 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
2343
            priority = self.server.gnutls_priority
2344
            if priority is None:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2345
                priority = "NORMAL"
1243 by Teddy Hogeborn
Some cleanup of GnuTLS interface
2346
            gnutls.priority_set_direct(session,
2347
                                       priority.encode("utf-8"), None)
874 by Teddy Hogeborn
PEP8 compliance: mandos
2348
416.1.2 by Teddy Hogeborn
* mandos (ClientHandler.handle): Set up the GnuTLS session object
2349
            # Start communication using the Mandos protocol
2350
            # Get protocol number
2351
            line = self.request.makefile().readline()
1254 by Teddy Hogeborn
mandos: Update logging code to more standard idioms
2352
            log.debug("Protocol version: %r", line)
416.1.2 by Teddy Hogeborn
* mandos (ClientHandler.handle): Set up the GnuTLS session object
2353
            try:
2354
                if int(line.strip().split()[0]) > 1:
642 by Teddy Hogeborn
Syntax fix; use "raise" better in Mandos server.
2355
                    raise RuntimeError(line)
482 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
2356
            except (ValueError, IndexError, RuntimeError) as error:
1254 by Teddy Hogeborn
mandos: Update logging code to more standard idioms
2357
                log.error("Unknown protocol version: %s", error)
416.1.2 by Teddy Hogeborn
* mandos (ClientHandler.handle): Set up the GnuTLS session object
2358
                return
874 by Teddy Hogeborn
PEP8 compliance: mandos
2359
416.1.2 by Teddy Hogeborn
* mandos (ClientHandler.handle): Set up the GnuTLS session object
2360
            # Start GnuTLS connection
288.1.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
2361
            try:
2362
                session.handshake()
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
2363
            except gnutls.Error as error:
1254 by Teddy Hogeborn
mandos: Update logging code to more standard idioms
2364
                log.warning("Handshake failed: %s", error)
288.1.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
2365
                # Do not run session.bye() here: the session is not
2366
                # established.  Just abandon the request.
2367
                return
1254 by Teddy Hogeborn
mandos: Update logging code to more standard idioms
2368
            log.debug("Handshake succeeded")
874 by Teddy Hogeborn
PEP8 compliance: mandos
2369
24.1.150 by Björn Påhlsson
* mandos: Added ClientDBus.approve_pending property. Exposed
2370
            approval_required = False
288.1.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
2371
            try:
962 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
2372
                if gnutls.has_rawpk:
1130 by Teddy Hogeborn
Update Python 3 compatibility
2373
                    fpr = b""
962 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
2374
                    try:
2375
                        key_id = self.key_id(
2376
                            self.peer_certificate(session))
2377
                    except (TypeError, gnutls.Error) as error:
1254 by Teddy Hogeborn
mandos: Update logging code to more standard idioms
2378
                        log.warning("Bad certificate: %s", error)
962 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
2379
                        return
1254 by Teddy Hogeborn
mandos: Update logging code to more standard idioms
2380
                    log.debug("Key ID: %s",
2381
                              key_id.decode("utf-8",
2382
                                            errors="replace"))
962 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
2383
2384
                else:
1130 by Teddy Hogeborn
Update Python 3 compatibility
2385
                    key_id = b""
962 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
2386
                    try:
2387
                        fpr = self.fingerprint(
2388
                            self.peer_certificate(session))
2389
                    except (TypeError, gnutls.Error) as error:
1254 by Teddy Hogeborn
mandos: Update logging code to more standard idioms
2390
                        log.warning("Bad certificate: %s", error)
962 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
2391
                        return
1254 by Teddy Hogeborn
mandos: Update logging code to more standard idioms
2392
                    log.debug("Fingerprint: %s", fpr)
962 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
2393
2394
                try:
2395
                    client = ProxyClient(child_pipe, key_id, fpr,
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2396
                                         self.client_address)
2397
                except KeyError:
411 by Teddy Hogeborn
More consistent terminology: Clients are no longer "invalid" - they
2398
                    return
874 by Teddy Hogeborn
PEP8 compliance: mandos
2399
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2400
                if client.approval_delay:
2401
                    delay = client.approval_delay
24.1.150 by Björn Påhlsson
* mandos: Added ClientDBus.approve_pending property. Exposed
2402
                    client.approvals_pending += 1
2403
                    approval_required = True
874 by Teddy Hogeborn
PEP8 compliance: mandos
2404
24.1.148 by Björn Påhlsson
half working on-demand password and approved code
2405
                while True:
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2406
                    if not client.enabled:
1254 by Teddy Hogeborn
mandos: Update logging code to more standard idioms
2407
                        log.info("Client %s is disabled", client.name)
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2408
                        if self.server.use_dbus:
2409
                            # Emit D-Bus signal
505.1.3 by Teddy Hogeborn
* mandos: Break long lines.
2410
                            client.Rejected("Disabled")
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2411
                        return
874 by Teddy Hogeborn
PEP8 compliance: mandos
2412
518.2.4 by Teddy Hogeborn
* mandos (_timedelta_to_milliseconds): Renamed to
2413
                    if client.approved or not client.approval_delay:
874 by Teddy Hogeborn
PEP8 compliance: mandos
2414
                        # We are approved or approval is disabled
24.1.150 by Björn Påhlsson
* mandos: Added ClientDBus.approve_pending property. Exposed
2415
                        break
518.2.4 by Teddy Hogeborn
* mandos (_timedelta_to_milliseconds): Renamed to
2416
                    elif client.approved is None:
1254 by Teddy Hogeborn
mandos: Update logging code to more standard idioms
2417
                        log.info("Client %s needs approval",
2418
                                 client.name)
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2419
                        if self.server.use_dbus:
2420
                            # Emit D-Bus signal
2421
                            client.NeedApproval(
723.1.6 by Teddy Hogeborn
Use the new .total_seconds() method on datetime.timedelta objects.
2422
                                client.approval_delay.total_seconds()
2423
                                * 1000, client.approved_by_default)
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2424
                    else:
1254 by Teddy Hogeborn
mandos: Update logging code to more standard idioms
2425
                        log.warning("Client %s was not approved",
2426
                                    client.name)
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2427
                        if self.server.use_dbus:
24.1.150 by Björn Påhlsson
* mandos: Added ClientDBus.approve_pending property. Exposed
2428
                            # Emit D-Bus signal
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2429
                            client.Rejected("Denied")
24.1.148 by Björn Påhlsson
half working on-demand password and approved code
2430
                        return
874 by Teddy Hogeborn
PEP8 compliance: mandos
2431
2432
                    # wait until timeout or approved
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2433
                    time = datetime.datetime.now()
2434
                    client.changedstate.acquire()
723.1.6 by Teddy Hogeborn
Use the new .total_seconds() method on datetime.timedelta objects.
2435
                    client.changedstate.wait(delay.total_seconds())
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2436
                    client.changedstate.release()
2437
                    time2 = datetime.datetime.now()
2438
                    if (time2 - time) >= delay:
2439
                        if not client.approved_by_default:
1254 by Teddy Hogeborn
mandos: Update logging code to more standard idioms
2440
                            log.warning("Client %s timed out while"
2441
                                        " waiting for approval",
2442
                                        client.name)
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2443
                            if self.server.use_dbus:
2444
                                # Emit D-Bus signal
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2445
                                client.Rejected("Approval timed out")
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2446
                            return
2447
                        else:
2448
                            break
2449
                    else:
2450
                        delay -= time2 - time
874 by Teddy Hogeborn
PEP8 compliance: mandos
2451
802 by Teddy Hogeborn
Handle GnuTLS errors and partial sends in gnutls "module".
2452
                try:
2453
                    session.send(client.secret)
2454
                except gnutls.Error as error:
1254 by Teddy Hogeborn
mandos: Update logging code to more standard idioms
2455
                    log.warning("gnutls send failed", exc_info=error)
802 by Teddy Hogeborn
Handle GnuTLS errors and partial sends in gnutls "module".
2456
                    return
874 by Teddy Hogeborn
PEP8 compliance: mandos
2457
1254 by Teddy Hogeborn
mandos: Update logging code to more standard idioms
2458
                log.info("Sending secret to %s", client.name)
505.1.13 by Teddy Hogeborn
Miscellaneous fixes prompted by lintian:
2459
                # bump the timeout using extended_timeout
556 by Teddy Hogeborn
* DBUS-API (se.recompile.Mandos.Client.LastCheckerStatus): New
2460
                client.bump_timeout(client.extended_timeout)
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2461
                if self.server.use_dbus:
2462
                    # Emit D-Bus signal
2463
                    client.GotSecret()
874 by Teddy Hogeborn
PEP8 compliance: mandos
2464
411 by Teddy Hogeborn
More consistent terminology: Clients are no longer "invalid" - they
2465
            finally:
24.1.150 by Björn Påhlsson
* mandos: Added ClientDBus.approve_pending property. Exposed
2466
                if approval_required:
2467
                    client.approvals_pending -= 1
24.1.155 by Björn Påhlsson
mandos server: Added debuglevel that adjust at what level information
2468
                try:
2469
                    session.bye()
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
2470
                except gnutls.Error as error:
1254 by Teddy Hogeborn
mandos: Update logging code to more standard idioms
2471
                    log.warning("GnuTLS bye failed", exc_info=error)
874 by Teddy Hogeborn
PEP8 compliance: mandos
2472
330 by Teddy Hogeborn
* mandos (peer_certificate, fingerprint): Moved into "TCP_handler"
2473
    @staticmethod
2474
    def peer_certificate(session):
962 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
2475
        "Return the peer's certificate as a bytestring"
2476
        try:
1243 by Teddy Hogeborn
Some cleanup of GnuTLS interface
2477
            cert_type = gnutls.certificate_type_get2(
2478
                session, gnutls.CTYPE_PEERS)
962 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
2479
        except AttributeError:
1243 by Teddy Hogeborn
Some cleanup of GnuTLS interface
2480
            cert_type = gnutls.certificate_type_get(session)
962 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
2481
        if gnutls.has_rawpk:
2482
            valid_cert_types = frozenset((gnutls.CRT_RAWPK,))
2483
        else:
2484
            valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))
2485
        # If not a valid certificate type...
2486
        if cert_type not in valid_cert_types:
1254 by Teddy Hogeborn
mandos: Update logging code to more standard idioms
2487
            log.info("Cert type %r not in %r", cert_type,
2488
                     valid_cert_types)
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
2489
            # ...return invalid data
2490
            return b""
330 by Teddy Hogeborn
* mandos (peer_certificate, fingerprint): Moved into "TCP_handler"
2491
        list_size = ctypes.c_uint(1)
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
2492
        cert_list = (gnutls.certificate_get_peers
1243 by Teddy Hogeborn
Some cleanup of GnuTLS interface
2493
                     (session, ctypes.byref(list_size)))
330 by Teddy Hogeborn
* mandos (peer_certificate, fingerprint): Moved into "TCP_handler"
2494
        if not bool(cert_list) and list_size.value != 0:
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
2495
            raise gnutls.Error("error getting peer certificate")
330 by Teddy Hogeborn
* mandos (peer_certificate, fingerprint): Moved into "TCP_handler"
2496
        if list_size.value == 0:
2497
            return None
2498
        cert = cert_list[0]
2499
        return ctypes.string_at(cert.data, cert.size)
874 by Teddy Hogeborn
PEP8 compliance: mandos
2500
330 by Teddy Hogeborn
* mandos (peer_certificate, fingerprint): Moved into "TCP_handler"
2501
    @staticmethod
962 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
2502
    def key_id(certificate):
2503
        "Convert a certificate bytestring to a hexdigit key ID"
2504
        # New GnuTLS "datum" with the public key
2505
        datum = gnutls.datum_t(
2506
            ctypes.cast(ctypes.c_char_p(certificate),
2507
                        ctypes.POINTER(ctypes.c_ubyte)),
2508
            ctypes.c_uint(len(certificate)))
2509
        # XXX all these need to be created in the gnutls "module"
2510
        # New empty GnuTLS certificate
2511
        pubkey = gnutls.pubkey_t()
2512
        gnutls.pubkey_init(ctypes.byref(pubkey))
2513
        # Import the raw public key into the certificate
2514
        gnutls.pubkey_import(pubkey,
2515
                             ctypes.byref(datum),
2516
                             gnutls.X509_FMT_DER)
2517
        # New buffer for the key ID
2518
        buf = ctypes.create_string_buffer(32)
2519
        buf_len = ctypes.c_size_t(len(buf))
2520
        # Get the key ID from the raw public key into the buffer
1220 by teddy at recompile
mandos: Shorten or break long lines
2521
        gnutls.pubkey_get_key_id(
2522
            pubkey,
2523
            gnutls.KEYID_USE_SHA256,
2524
            ctypes.cast(ctypes.byref(buf),
2525
                        ctypes.POINTER(ctypes.c_ubyte)),
2526
            ctypes.byref(buf_len))
962 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
2527
        # Deinit the certificate
2528
        gnutls.pubkey_deinit(pubkey)
2529
2530
        # Convert the buffer to a Python bytestring
2531
        key_id = ctypes.string_at(buf, buf_len.value)
2532
        # Convert the bytestring to hexadecimal notation
2533
        hex_key_id = binascii.hexlify(key_id).upper()
2534
        return hex_key_id
2535
2536
    @staticmethod
330 by Teddy Hogeborn
* mandos (peer_certificate, fingerprint): Moved into "TCP_handler"
2537
    def fingerprint(openpgp):
2538
        "Convert an OpenPGP bytestring to a hexdigit fingerprint"
2539
        # New GnuTLS "datum" with the OpenPGP public key
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
2540
        datum = gnutls.datum_t(
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2541
            ctypes.cast(ctypes.c_char_p(openpgp),
2542
                        ctypes.POINTER(ctypes.c_ubyte)),
2543
            ctypes.c_uint(len(openpgp)))
330 by Teddy Hogeborn
* mandos (peer_certificate, fingerprint): Moved into "TCP_handler"
2544
        # New empty GnuTLS certificate
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
2545
        crt = gnutls.openpgp_crt_t()
2546
        gnutls.openpgp_crt_init(ctypes.byref(crt))
330 by Teddy Hogeborn
* mandos (peer_certificate, fingerprint): Moved into "TCP_handler"
2547
        # Import the OpenPGP public key into the certificate
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
2548
        gnutls.openpgp_crt_import(crt, ctypes.byref(datum),
2549
                                  gnutls.OPENPGP_FMT_RAW)
330 by Teddy Hogeborn
* mandos (peer_certificate, fingerprint): Moved into "TCP_handler"
2550
        # Verify the self signature in the key
2551
        crtverify = ctypes.c_uint()
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
2552
        gnutls.openpgp_crt_verify_self(crt, 0,
2553
                                       ctypes.byref(crtverify))
330 by Teddy Hogeborn
* mandos (peer_certificate, fingerprint): Moved into "TCP_handler"
2554
        if crtverify.value != 0:
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
2555
            gnutls.openpgp_crt_deinit(crt)
950 by Teddy Hogeborn
mandos: Better error message if self-signature verification fails
2556
            raise gnutls.CertificateSecurityError(code
2557
                                                  =crtverify.value)
330 by Teddy Hogeborn
* mandos (peer_certificate, fingerprint): Moved into "TCP_handler"
2558
        # New buffer for the fingerprint
2559
        buf = ctypes.create_string_buffer(20)
2560
        buf_len = ctypes.c_size_t()
2561
        # Get the fingerprint from the certificate into the buffer
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
2562
        gnutls.openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
2563
                                           ctypes.byref(buf_len))
330 by Teddy Hogeborn
* mandos (peer_certificate, fingerprint): Moved into "TCP_handler"
2564
        # Deinit the certificate
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
2565
        gnutls.openpgp_crt_deinit(crt)
330 by Teddy Hogeborn
* mandos (peer_certificate, fingerprint): Moved into "TCP_handler"
2566
        # Convert the buffer to a Python bytestring
2567
        fpr = ctypes.string_at(buf, buf_len.value)
2568
        # Convert the bytestring to hexadecimal notation
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
2569
        hex_fpr = binascii.hexlify(fpr).upper()
330 by Teddy Hogeborn
* mandos (peer_certificate, fingerprint): Moved into "TCP_handler"
2570
        return hex_fpr
288.1.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
2571
2572
1154 by Teddy Hogeborn
Simplification of Python 3 compatibility code
2573
class MultiprocessingMixIn:
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2574
    """Like socketserver.ThreadingMixIn, but with multiprocessing"""
874 by Teddy Hogeborn
PEP8 compliance: mandos
2575
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2576
    def sub_process_main(self, request, address):
2577
        try:
2578
            self.finish_request(request, address)
518.1.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
2579
        except Exception:
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2580
            self.handle_error(request, address)
2581
        self.close_request(request)
874 by Teddy Hogeborn
PEP8 compliance: mandos
2582
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2583
    def process_request(self, request, address):
2584
        """Start a new process to process the request."""
874 by Teddy Hogeborn
PEP8 compliance: mandos
2585
        proc = multiprocessing.Process(target=self.sub_process_main,
2586
                                       args=(request, address))
505.1.11 by Teddy Hogeborn
* mandos (Client.checked_ok): Set "expires" after setting timeout.
2587
        proc.start()
2588
        return proc
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2589
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
2590
1154 by Teddy Hogeborn
Simplification of Python 3 compatibility code
2591
class MultiprocessingMixInWithPipe(MultiprocessingMixIn):
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2592
    """ adds a pipe to the MixIn """
874 by Teddy Hogeborn
PEP8 compliance: mandos
2593
288.1.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
2594
    def process_request(self, request, client_address):
331 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
2595
        """Overrides and wraps the original process_request().
874 by Teddy Hogeborn
PEP8 compliance: mandos
2596
355 by Teddy Hogeborn
* mandos: White-space fixes only.
2597
        This function creates a new pipe in self.pipe
288.1.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
2598
        """
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2599
        parent_pipe, self.child_pipe = multiprocessing.Pipe()
874 by Teddy Hogeborn
PEP8 compliance: mandos
2600
505.1.11 by Teddy Hogeborn
* mandos (Client.checked_ok): Set "expires" after setting timeout.
2601
        proc = MultiprocessingMixIn.process_request(self, request,
2602
                                                    client_address)
24.1.152 by Björn Påhlsson
bug fixes that prevent problems when runing server as root
2603
        self.child_pipe.close()
505.1.11 by Teddy Hogeborn
* mandos (Client.checked_ok): Set "expires" after setting timeout.
2604
        self.add_pipe(parent_pipe, proc)
874 by Teddy Hogeborn
PEP8 compliance: mandos
2605
505.1.11 by Teddy Hogeborn
* mandos (Client.checked_ok): Set "expires" after setting timeout.
2606
    def add_pipe(self, parent_pipe, proc):
288.1.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
2607
        """Dummy function; override as necessary"""
642 by Teddy Hogeborn
Syntax fix; use "raise" better in Mandos server.
2608
        raise NotImplementedError()
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2609
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
2610
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2611
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
1154 by Teddy Hogeborn
Simplification of Python 3 compatibility code
2612
                     socketserver.TCPServer):
1247 by Teddy Hogeborn
Server: Fix minor style issue
2613
    """IPv6-capable TCP server.  Accepts None as address and/or port
874 by Teddy Hogeborn
PEP8 compliance: mandos
2614
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
2615
    Attributes:
331 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
2616
        enabled:        Boolean; whether this server is activated yet
2617
        interface:      None or a network interface name (string)
2618
        use_ipv6:       Boolean; to use IPv6 or not
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
2619
    """
874 by Teddy Hogeborn
PEP8 compliance: mandos
2620
331 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
2621
    def __init__(self, server_address, RequestHandlerClass,
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2622
                 interface=None,
2623
                 use_ipv6=True,
2624
                 socketfd=None):
589.1.1 by Teddy Hogeborn
* mandos: Implement "--socket" option.
2625
        """If socketfd is set, use that file descriptor instead of
2626
        creating a new one with socket.socket().
2627
        """
331 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
2628
        self.interface = interface
2629
        if use_ipv6:
2630
            self.address_family = socket.AF_INET6
589.1.1 by Teddy Hogeborn
* mandos: Implement "--socket" option.
2631
        if socketfd is not None:
2632
            # Save the file descriptor
2633
            self.socketfd = socketfd
2634
            # Save the original socket.socket() function
2635
            self.socket_socket = socket.socket
874 by Teddy Hogeborn
PEP8 compliance: mandos
2636
589.1.1 by Teddy Hogeborn
* mandos: Implement "--socket" option.
2637
            # To implement --socket, we monkey patch socket.socket.
874 by Teddy Hogeborn
PEP8 compliance: mandos
2638
            #
589.1.1 by Teddy Hogeborn
* mandos: Implement "--socket" option.
2639
            # (When socketserver.TCPServer is a new-style class, we
2640
            # could make self.socket into a property instead of monkey
2641
            # patching socket.socket.)
874 by Teddy Hogeborn
PEP8 compliance: mandos
2642
            #
589.1.1 by Teddy Hogeborn
* mandos: Implement "--socket" option.
2643
            # Create a one-time-only replacement for socket.socket()
2644
            @functools.wraps(socket.socket)
2645
            def socket_wrapper(*args, **kwargs):
2646
                # Restore original function so subsequent calls are
2647
                # not affected.
2648
                socket.socket = self.socket_socket
2649
                del self.socket_socket
2650
                # This time only, return a new socket object from the
2651
                # saved file descriptor.
2652
                return socket.fromfd(self.socketfd, *args, **kwargs)
2653
            # Replace socket.socket() function with wrapper
2654
            socket.socket = socket_wrapper
2655
        # The socketserver.TCPServer.__init__ will call
2656
        # socket.socket(), which might be our replacement,
2657
        # socket_wrapper(), if socketfd was set.
335 by Teddy Hogeborn
* mandos: Import "SocketServer" as "socketserver" and "ConfigParser"
2658
        socketserver.TCPServer.__init__(self, server_address,
331 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
2659
                                        RequestHandlerClass)
874 by Teddy Hogeborn
PEP8 compliance: mandos
2660
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
2661
    def server_bind(self):
2662
        """This overrides the normal server_bind() function
2663
        to bind to an interface if one was specified, and also NOT to
2664
        bind to an address or port if they were not specified."""
858 by Teddy Hogeborn
Server: Fix bug with --interface flag when "cc" is not installed.
2665
        global SO_BINDTODEVICE
331 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
2666
        if self.interface is not None:
338 by Teddy Hogeborn
* mandos: Minor doc string fixes.
2667
            if SO_BINDTODEVICE is None:
852 by Teddy Hogeborn
mandos: Bug fix for Python 2.7 and the "--interface" option
2668
                # Fall back to a hard-coded value which seems to be
2669
                # common enough.
1254 by Teddy Hogeborn
mandos: Update logging code to more standard idioms
2670
                log.warning("SO_BINDTODEVICE not found, trying 25")
852 by Teddy Hogeborn
mandos: Bug fix for Python 2.7 and the "--interface" option
2671
                SO_BINDTODEVICE = 25
2672
            try:
2673
                self.socket.setsockopt(
2674
                    socket.SOL_SOCKET, SO_BINDTODEVICE,
2675
                    (self.interface + "\0").encode("utf-8"))
2676
            except socket.error as error:
2677
                if error.errno == errno.EPERM:
1254 by Teddy Hogeborn
mandos: Update logging code to more standard idioms
2678
                    log.error("No permission to bind to interface %s",
2679
                              self.interface)
852 by Teddy Hogeborn
mandos: Bug fix for Python 2.7 and the "--interface" option
2680
                elif error.errno == errno.ENOPROTOOPT:
1254 by Teddy Hogeborn
mandos: Update logging code to more standard idioms
2681
                    log.error("SO_BINDTODEVICE not available; cannot"
2682
                              " bind to interface %s", self.interface)
852 by Teddy Hogeborn
mandos: Bug fix for Python 2.7 and the "--interface" option
2683
                elif error.errno == errno.ENODEV:
1254 by Teddy Hogeborn
mandos: Update logging code to more standard idioms
2684
                    log.error("Interface %s does not exist, cannot"
2685
                              " bind", self.interface)
852 by Teddy Hogeborn
mandos: Bug fix for Python 2.7 and the "--interface" option
2686
                else:
2687
                    raise
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
2688
        # Only bind(2) the socket if we really need to.
2689
        if self.server_address[0] or self.server_address[1]:
1115 by Teddy Hogeborn
Server bug fix: Allow restarts when using port= option
2690
            if self.server_address[1]:
2691
                self.allow_reuse_address = True
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
2692
            if not self.server_address[0]:
314 by Teddy Hogeborn
Support not using IPv6 in server:
2693
                if self.address_family == socket.AF_INET6:
874 by Teddy Hogeborn
PEP8 compliance: mandos
2694
                    any_address = "::"  # in6addr_any
314 by Teddy Hogeborn
Support not using IPv6 in server:
2695
                else:
874 by Teddy Hogeborn
PEP8 compliance: mandos
2696
                    any_address = "0.0.0.0"  # INADDR_ANY
314 by Teddy Hogeborn
Support not using IPv6 in server:
2697
                self.server_address = (any_address,
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
2698
                                       self.server_address[1])
49 by Teddy Hogeborn
* mandos (IPv6_TCPServer.server_bind): Bug fix: allow port to be empty
2699
            elif not self.server_address[1]:
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2700
                self.server_address = (self.server_address[0], 0)
331 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
2701
#                 if self.interface:
49 by Teddy Hogeborn
* mandos (IPv6_TCPServer.server_bind): Bug fix: allow port to be empty
2702
#                     self.server_address = (self.server_address[0],
2703
#                                            0, # port
2704
#                                            0, # flowinfo
2705
#                                            if_nametoindex
331 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
2706
#                                            (self.interface))
335 by Teddy Hogeborn
* mandos: Import "SocketServer" as "socketserver" and "ConfigParser"
2707
            return socketserver.TCPServer.server_bind(self)
339 by Teddy Hogeborn
Code cleanup.
2708
2709
2710
class MandosServer(IPv6_TCPServer):
2711
    """Mandos server.
874 by Teddy Hogeborn
PEP8 compliance: mandos
2712
339 by Teddy Hogeborn
Code cleanup.
2713
    Attributes:
2714
        clients:        set of Client objects
2715
        gnutls_priority GnuTLS priority string
2716
        use_dbus:       Boolean; to emit D-Bus signals or not
874 by Teddy Hogeborn
PEP8 compliance: mandos
2717
830 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
2718
    Assumes a GLib.MainLoop event loop.
339 by Teddy Hogeborn
Code cleanup.
2719
    """
874 by Teddy Hogeborn
PEP8 compliance: mandos
2720
339 by Teddy Hogeborn
Code cleanup.
2721
    def __init__(self, server_address, RequestHandlerClass,
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2722
                 interface=None,
2723
                 use_ipv6=True,
2724
                 clients=None,
2725
                 gnutls_priority=None,
2726
                 use_dbus=True,
2727
                 socketfd=None):
339 by Teddy Hogeborn
Code cleanup.
2728
        self.enabled = False
2729
        self.clients = clients
341 by Teddy Hogeborn
Code cleanup and one bug fix.
2730
        if self.clients is None:
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
2731
            self.clients = {}
339 by Teddy Hogeborn
Code cleanup.
2732
        self.use_dbus = use_dbus
2733
        self.gnutls_priority = gnutls_priority
2734
        IPv6_TCPServer.__init__(self, server_address,
2735
                                RequestHandlerClass,
874 by Teddy Hogeborn
PEP8 compliance: mandos
2736
                                interface=interface,
2737
                                use_ipv6=use_ipv6,
2738
                                socketfd=socketfd)
2739
163 by Teddy Hogeborn
* Makefile (PIDDIR, USER, GROUP): Removed.
2740
    def server_activate(self):
2741
        if self.enabled:
335 by Teddy Hogeborn
* mandos: Import "SocketServer" as "socketserver" and "ConfigParser"
2742
            return socketserver.TCPServer.server_activate(self)
874 by Teddy Hogeborn
PEP8 compliance: mandos
2743
163 by Teddy Hogeborn
* Makefile (PIDDIR, USER, GROUP): Removed.
2744
    def enable(self):
2745
        self.enabled = True
874 by Teddy Hogeborn
PEP8 compliance: mandos
2746
505.1.11 by Teddy Hogeborn
* mandos (Client.checked_ok): Set "expires" after setting timeout.
2747
    def add_pipe(self, parent_pipe, proc):
340 by Teddy Hogeborn
Code cleanup.
2748
        # Call "handle_ipc" for both data and EOF events
830 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
2749
        GLib.io_add_watch(
1168 by Teddy Hogeborn
Server: Fully use new GLib.io_add_watch() call signature
2750
            GLib.IOChannel.unix_new(parent_pipe.fileno()),
2751
            GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2752
            functools.partial(self.handle_ipc,
874 by Teddy Hogeborn
PEP8 compliance: mandos
2753
                              parent_pipe=parent_pipe,
2754
                              proc=proc))
2755
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2756
    def handle_ipc(self, source, condition,
2757
                   parent_pipe=None,
874 by Teddy Hogeborn
PEP8 compliance: mandos
2758
                   proc=None,
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2759
                   client_object=None):
505.1.13 by Teddy Hogeborn
Miscellaneous fixes prompted by lintian:
2760
        # error, or the other end of multiprocessing.Pipe has closed
830 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
2761
        if condition & (GLib.IO_ERR | GLib.IO_HUP):
505.1.13 by Teddy Hogeborn
Miscellaneous fixes prompted by lintian:
2762
            # Wait for other process to exit
505.1.11 by Teddy Hogeborn
* mandos (Client.checked_ok): Set "expires" after setting timeout.
2763
            proc.join()
24.1.152 by Björn Påhlsson
bug fixes that prevent problems when runing server as root
2764
            return False
874 by Teddy Hogeborn
PEP8 compliance: mandos
2765
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2766
        # Read a request from the child
2767
        request = parent_pipe.recv()
2768
        command = request[0]
874 by Teddy Hogeborn
PEP8 compliance: mandos
2769
1247 by Teddy Hogeborn
Server: Fix minor style issue
2770
        if command == "init":
962 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
2771
            key_id = request[1].decode("ascii")
2772
            fpr = request[2].decode("ascii")
2773
            address = request[3]
874 by Teddy Hogeborn
PEP8 compliance: mandos
2774
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
2775
            for c in self.clients.values():
1220 by teddy at recompile
mandos: Shorten or break long lines
2776
                if key_id == ("E3B0C44298FC1C149AFBF4C8996FB924"
2777
                              "27AE41E4649B934CA495991B7852B855"):
971 by Teddy Hogeborn
Bug fix: Only create TLS key with certtool, and read correct key file
2778
                    continue
962 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
2779
                if key_id and c.key_id == key_id:
2780
                    client = c
2781
                    break
2782
                if fpr and c.fingerprint == fpr:
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2783
                    client = c
2784
                    break
2785
            else:
1254 by Teddy Hogeborn
mandos: Update logging code to more standard idioms
2786
                log.info("Client not found for key ID: %s, address:"
2787
                         " %s", key_id or fpr, address)
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2788
                if self.use_dbus:
2789
                    # Emit D-Bus signal
962 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
2790
                    mandos_dbus_service.ClientNotFound(key_id or fpr,
505.1.3 by Teddy Hogeborn
* mandos: Break long lines.
2791
                                                       address[0])
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2792
                parent_pipe.send(False)
2793
                return False
874 by Teddy Hogeborn
PEP8 compliance: mandos
2794
830 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
2795
            GLib.io_add_watch(
1168 by Teddy Hogeborn
Server: Fully use new GLib.io_add_watch() call signature
2796
                GLib.IOChannel.unix_new(parent_pipe.fileno()),
2797
                GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2798
                functools.partial(self.handle_ipc,
874 by Teddy Hogeborn
PEP8 compliance: mandos
2799
                                  parent_pipe=parent_pipe,
2800
                                  proc=proc,
2801
                                  client_object=client))
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2802
            parent_pipe.send(True)
505.1.3 by Teddy Hogeborn
* mandos: Break long lines.
2803
            # remove the old hook in favor of the new above hook on
2804
            # same fileno
288.1.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
2805
            return False
1247 by Teddy Hogeborn
Server: Fix minor style issue
2806
        if command == "funcall":
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2807
            funcname = request[1]
2808
            args = request[2]
2809
            kwargs = request[3]
874 by Teddy Hogeborn
PEP8 compliance: mandos
2810
1247 by Teddy Hogeborn
Server: Fix minor style issue
2811
            parent_pipe.send(("data", getattr(client_object,
505.1.3 by Teddy Hogeborn
* mandos: Break long lines.
2812
                                              funcname)(*args,
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2813
                                                        **kwargs)))
874 by Teddy Hogeborn
PEP8 compliance: mandos
2814
1247 by Teddy Hogeborn
Server: Fix minor style issue
2815
        if command == "getattr":
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2816
            attrname = request[1]
755 by Teddy Hogeborn
mandos: More Python 3 fixes.
2817
            if isinstance(client_object.__getattribute__(attrname),
1202 by Teddy Hogeborn
Use collections.abc.Callable instead of collections.Callable
2818
                          collections.abc.Callable):
1247 by Teddy Hogeborn
Server: Fix minor style issue
2819
                parent_pipe.send(("function", ))
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2820
            else:
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2821
                parent_pipe.send((
1247 by Teddy Hogeborn
Server: Fix minor style issue
2822
                    "data", client_object.__getattribute__(attrname)))
874 by Teddy Hogeborn
PEP8 compliance: mandos
2823
1247 by Teddy Hogeborn
Server: Fix minor style issue
2824
        if command == "setattr":
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2825
            attrname = request[1]
2826
            value = request[2]
2827
            setattr(client_object, attrname, value)
874 by Teddy Hogeborn
PEP8 compliance: mandos
2828
288.1.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
2829
        return True
10 by Teddy Hogeborn
* server.py: Bug fix: Do "from __future__ import division".
2830
3 by Björn Påhlsson
Python based server
2831
609 by Teddy Hogeborn
* clients.conf: Convert all time intervals to new RFC 3339 syntax.
2832
def rfc3339_duration_to_delta(duration):
2833
    """Parse an RFC 3339 "duration" and return a datetime.timedelta
874 by Teddy Hogeborn
PEP8 compliance: mandos
2834
1220 by teddy at recompile
mandos: Shorten or break long lines
2835
    >>> timedelta = datetime.timedelta
2836
    >>> rfc3339_duration_to_delta("P7D") == timedelta(7)
2837
    True
2838
    >>> rfc3339_duration_to_delta("PT60S") == timedelta(0, 60)
2839
    True
2840
    >>> rfc3339_duration_to_delta("PT60M") == timedelta(0, 3600)
2841
    True
2842
    >>> rfc3339_duration_to_delta("PT24H") == timedelta(1)
2843
    True
2844
    >>> rfc3339_duration_to_delta("P1W") == timedelta(7)
2845
    True
2846
    >>> rfc3339_duration_to_delta("PT5M30S") == timedelta(0, 330)
2847
    True
2848
    >>> rfc3339_duration_to_delta("P1DT3M20S") == timedelta(1, 200)
2849
    True
2850
    >>> del timedelta
609 by Teddy Hogeborn
* clients.conf: Convert all time intervals to new RFC 3339 syntax.
2851
    """
874 by Teddy Hogeborn
PEP8 compliance: mandos
2852
609 by Teddy Hogeborn
* clients.conf: Convert all time intervals to new RFC 3339 syntax.
2853
    # Parsing an RFC 3339 duration with regular expressions is not
2854
    # possible - there would have to be multiple places for the same
2855
    # values, like seconds.  The current code, while more esoteric, is
2856
    # cleaner without depending on a parsing library.  If Python had a
2857
    # built-in library for parsing we would use it, but we'd like to
2858
    # avoid excessive use of external libraries.
874 by Teddy Hogeborn
PEP8 compliance: mandos
2859
609 by Teddy Hogeborn
* clients.conf: Convert all time intervals to new RFC 3339 syntax.
2860
    # New type for defining tokens, syntax, and semantics all-in-one
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2861
    Token = collections.namedtuple("Token", (
2862
        "regexp",  # To match token; if "value" is not None, must have
2863
                   # a "group" containing digits
2864
        "value",   # datetime.timedelta or None
2865
        "followers"))           # Tokens valid after this token
609 by Teddy Hogeborn
* clients.conf: Convert all time intervals to new RFC 3339 syntax.
2866
    # RFC 3339 "duration" tokens, syntax, and semantics; taken from
2867
    # the "duration" ABNF definition in RFC 3339, Appendix A.
2868
    token_end = Token(re.compile(r"$"), None, frozenset())
2869
    token_second = Token(re.compile(r"(\d+)S"),
2870
                         datetime.timedelta(seconds=1),
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2871
                         frozenset((token_end, )))
609 by Teddy Hogeborn
* clients.conf: Convert all time intervals to new RFC 3339 syntax.
2872
    token_minute = Token(re.compile(r"(\d+)M"),
2873
                         datetime.timedelta(minutes=1),
2874
                         frozenset((token_second, token_end)))
2875
    token_hour = Token(re.compile(r"(\d+)H"),
2876
                       datetime.timedelta(hours=1),
2877
                       frozenset((token_minute, token_end)))
2878
    token_time = Token(re.compile(r"T"),
2879
                       None,
2880
                       frozenset((token_hour, token_minute,
2881
                                  token_second)))
2882
    token_day = Token(re.compile(r"(\d+)D"),
2883
                      datetime.timedelta(days=1),
2884
                      frozenset((token_time, token_end)))
2885
    token_month = Token(re.compile(r"(\d+)M"),
2886
                        datetime.timedelta(weeks=4),
2887
                        frozenset((token_day, token_end)))
2888
    token_year = Token(re.compile(r"(\d+)Y"),
2889
                       datetime.timedelta(weeks=52),
2890
                       frozenset((token_month, token_end)))
2891
    token_week = Token(re.compile(r"(\d+)W"),
2892
                       datetime.timedelta(weeks=1),
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2893
                       frozenset((token_end, )))
609 by Teddy Hogeborn
* clients.conf: Convert all time intervals to new RFC 3339 syntax.
2894
    token_duration = Token(re.compile(r"P"), None,
2895
                           frozenset((token_year, token_month,
2896
                                      token_day, token_time,
721 by Teddy Hogeborn
Fix two mutually cancelling bugs.
2897
                                      token_week)))
874 by Teddy Hogeborn
PEP8 compliance: mandos
2898
    # Define starting values:
2899
    # Value so far
2900
    value = datetime.timedelta()
609 by Teddy Hogeborn
* clients.conf: Convert all time intervals to new RFC 3339 syntax.
2901
    found_token = None
874 by Teddy Hogeborn
PEP8 compliance: mandos
2902
    # Following valid tokens
2903
    followers = frozenset((token_duration, ))
2904
    # String left to parse
2905
    s = duration
609 by Teddy Hogeborn
* clients.conf: Convert all time intervals to new RFC 3339 syntax.
2906
    # Loop until end token is found
2907
    while found_token is not token_end:
2908
        # Search for any currently valid tokens
2909
        for token in followers:
2910
            match = token.regexp.match(s)
2911
            if match is not None:
2912
                # Token found
2913
                if token.value is not None:
2914
                    # Value found, parse digits
2915
                    factor = int(match.group(1), 10)
2916
                    # Add to value so far
2917
                    value += factor * token.value
2918
                # Strip token from string
2919
                s = token.regexp.sub("", s, 1)
2920
                # Go to found token
2921
                found_token = token
2922
                # Set valid next tokens
2923
                followers = found_token.followers
2924
                break
2925
        else:
2926
            # No currently valid tokens were found
752 by Teddy Hogeborn
mandos: Generate better messages in exceptions.
2927
            raise ValueError("Invalid RFC 3339 duration: {!r}"
2928
                             .format(duration))
609 by Teddy Hogeborn
* clients.conf: Convert all time intervals to new RFC 3339 syntax.
2929
    # End token found
2930
    return value
2931
2932
4 by Teddy Hogeborn
* server.py (Client.created, Client.next_check): New.
2933
def string_to_delta(interval):
2934
    """Parse a string and return a datetime.timedelta
874 by Teddy Hogeborn
PEP8 compliance: mandos
2935
1247 by Teddy Hogeborn
Server: Fix minor style issue
2936
    >>> string_to_delta("7d") == datetime.timedelta(7)
2937
    True
2938
    >>> string_to_delta("60s") == datetime.timedelta(0, 60)
2939
    True
2940
    >>> string_to_delta("60m") == datetime.timedelta(0, 3600)
2941
    True
2942
    >>> string_to_delta("24h") == datetime.timedelta(1)
2943
    True
2944
    >>> string_to_delta("1w") == datetime.timedelta(7)
2945
    True
2946
    >>> string_to_delta("5m 30s") == datetime.timedelta(0, 330)
1170 by Teddy Hogeborn
Update Python 3 compatibility
2947
    True
4 by Teddy Hogeborn
* server.py (Client.created, Client.next_check): New.
2948
    """
874 by Teddy Hogeborn
PEP8 compliance: mandos
2949
609 by Teddy Hogeborn
* clients.conf: Convert all time intervals to new RFC 3339 syntax.
2950
    try:
2951
        return rfc3339_duration_to_delta(interval)
2952
    except ValueError:
2953
        pass
874 by Teddy Hogeborn
PEP8 compliance: mandos
2954
93 by Teddy Hogeborn
* mandos (string_to_delta): Accept a whitespace-separated sequence of
2955
    timevalue = datetime.timedelta(0)
2956
    for s in interval.split():
2957
        try:
729 by Teddy Hogeborn
mandos: Stop using str() and remove unnecessary unicode() calls.
2958
            suffix = s[-1]
215 by Teddy Hogeborn
* mandos: Remove unused "select" module. Import "ctypes.util".
2959
            value = int(s[:-1])
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2960
            if suffix == "d":
93 by Teddy Hogeborn
* mandos (string_to_delta): Accept a whitespace-separated sequence of
2961
                delta = datetime.timedelta(value)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2962
            elif suffix == "s":
93 by Teddy Hogeborn
* mandos (string_to_delta): Accept a whitespace-separated sequence of
2963
                delta = datetime.timedelta(0, value)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2964
            elif suffix == "m":
93 by Teddy Hogeborn
* mandos (string_to_delta): Accept a whitespace-separated sequence of
2965
                delta = datetime.timedelta(0, 0, 0, 0, value)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2966
            elif suffix == "h":
93 by Teddy Hogeborn
* mandos (string_to_delta): Accept a whitespace-separated sequence of
2967
                delta = datetime.timedelta(0, 0, 0, 0, 0, value)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2968
            elif suffix == "w":
93 by Teddy Hogeborn
* mandos (string_to_delta): Accept a whitespace-separated sequence of
2969
                delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
2970
            else:
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2971
                raise ValueError("Unknown suffix {!r}".format(suffix))
642 by Teddy Hogeborn
Syntax fix; use "raise" better in Mandos server.
2972
        except IndexError as e:
464 by Teddy Hogeborn
* debian/mandos-client.postrm (purge): Bug fix: update initramfs also
2973
            raise ValueError(*(e.args))
93 by Teddy Hogeborn
* mandos (string_to_delta): Accept a whitespace-separated sequence of
2974
        timevalue += delta
2975
    return timevalue
4 by Teddy Hogeborn
* server.py (Client.created, Client.next_check): New.
2976
8 by Teddy Hogeborn
* Makefile (client_debug): Bug fix; add quotes and / to CERT_ROOT.
2977
874 by Teddy Hogeborn
PEP8 compliance: mandos
2978
def daemon(nochdir=False, noclose=False):
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
2979
    """See daemon(3).  Standard BSD Unix function.
874 by Teddy Hogeborn
PEP8 compliance: mandos
2980
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
2981
    This should really exist as os.daemon, but it doesn't (yet)."""
2982
    if os.fork():
2983
        sys.exit()
2984
    os.setsid()
2985
    if not nochdir:
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
2986
        os.chdir("/")
46 by Teddy Hogeborn
* network-protocol.txt: New.
2987
    if os.fork():
2988
        sys.exit()
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
2989
    if not noclose:
2990
        # Close all standard open file descriptors
560.1.1 by teddy at recompile
* mandos: Use os.devnull instead of os.path.devnull. Fix some white
2991
        null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
2992
        if not stat.S_ISCHR(os.fstat(null).st_mode):
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
2993
            raise OSError(errno.ENODEV,
2994
                          "{} not a character device"
568 by Teddy Hogeborn
* mandos-monitor: Use new string format method.
2995
                          .format(os.devnull))
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
2996
        os.dup2(null, sys.stdin.fileno())
2997
        os.dup2(null, sys.stdout.fileno())
2998
        os.dup2(null, sys.stderr.fileno())
2999
        if null > 2:
3000
            os.close(null)
3001
3002
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
3003
def main():
874 by Teddy Hogeborn
PEP8 compliance: mandos
3004
379 by Teddy Hogeborn
* mandos: Fix line lengths.
3005
    ##################################################################
327 by Teddy Hogeborn
Merge from pipe IPC branch.
3006
    # Parsing of options, both command line and config file
874 by Teddy Hogeborn
PEP8 compliance: mandos
3007
474 by teddy at bsnet
* mandos: Use the new argparse library instead of optparse.
3008
    parser = argparse.ArgumentParser()
3009
    parser.add_argument("-v", "--version", action="version",
874 by Teddy Hogeborn
PEP8 compliance: mandos
3010
                        version="%(prog)s {}".format(version),
474 by teddy at bsnet
* mandos: Use the new argparse library instead of optparse.
3011
                        help="show version number and exit")
3012
    parser.add_argument("-i", "--interface", metavar="IF",
3013
                        help="Bind to interface IF")
3014
    parser.add_argument("-a", "--address",
3015
                        help="Address to listen for requests on")
3016
    parser.add_argument("-p", "--port", type=int,
3017
                        help="Port number to receive requests on")
3018
    parser.add_argument("--check", action="store_true",
3019
                        help="Run self-test")
3020
    parser.add_argument("--debug", action="store_true",
3021
                        help="Debug mode; run in foreground and log"
618 by Teddy Hogeborn
* mandos: Bug fix: Make boolean options work from the config file
3022
                        " to terminal", default=None)
474 by teddy at bsnet
* mandos: Use the new argparse library instead of optparse.
3023
    parser.add_argument("--debuglevel", metavar="LEVEL",
3024
                        help="Debug level for stdout output")
3025
    parser.add_argument("--priority", help="GnuTLS"
3026
                        " priority string (see GnuTLS documentation)")
3027
    parser.add_argument("--servicename",
3028
                        metavar="NAME", help="Zeroconf service name")
3029
    parser.add_argument("--configdir",
3030
                        default="/etc/mandos", metavar="DIR",
3031
                        help="Directory to search for configuration"
3032
                        " files")
3033
    parser.add_argument("--no-dbus", action="store_false",
3034
                        dest="use_dbus", help="Do not provide D-Bus"
618 by Teddy Hogeborn
* mandos: Bug fix: Make boolean options work from the config file
3035
                        " system bus interface", default=None)
474 by teddy at bsnet
* mandos: Use the new argparse library instead of optparse.
3036
    parser.add_argument("--no-ipv6", action="store_false",
618 by Teddy Hogeborn
* mandos: Bug fix: Make boolean options work from the config file
3037
                        dest="use_ipv6", help="Do not use IPv6",
3038
                        default=None)
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
3039
    parser.add_argument("--no-restore", action="store_false",
518.1.7 by Teddy Hogeborn
* mandos: Break long lines and fix some more white space.
3040
                        dest="restore", help="Do not restore stored"
618 by Teddy Hogeborn
* mandos: Bug fix: Make boolean options work from the config file
3041
                        " state", default=None)
589.1.1 by Teddy Hogeborn
* mandos: Implement "--socket" option.
3042
    parser.add_argument("--socket", type=int,
3043
                        help="Specify a file descriptor to a network"
3044
                        " socket to use instead of creating one")
518.2.2 by Teddy Hogeborn
Directory with persistent state can now be changed with the "statedir"
3045
    parser.add_argument("--statedir", metavar="DIR",
3046
                        help="Directory to save/restore state in")
606 by Teddy Hogeborn
* mandos: New "--foreground" option.
3047
    parser.add_argument("--foreground", action="store_true",
618 by Teddy Hogeborn
* mandos: Bug fix: Make boolean options work from the config file
3048
                        help="Run in foreground", default=None)
707 by Teddy Hogeborn
mandos: New "--no-zeroconf" option. Also make "--socket=0" work.
3049
    parser.add_argument("--no-zeroconf", action="store_false",
3050
                        dest="zeroconf", help="Do not use Zeroconf",
3051
                        default=None)
874 by Teddy Hogeborn
PEP8 compliance: mandos
3052
474 by teddy at bsnet
* mandos: Use the new argparse library instead of optparse.
3053
    options = parser.parse_args()
874 by Teddy Hogeborn
PEP8 compliance: mandos
3054
28 by Teddy Hogeborn
* server.conf: New file.
3055
    # Default values for config file for server-global settings
962 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
3056
    if gnutls.has_rawpk:
3057
        priority = ("SECURE128:!CTYPE-X.509:+CTYPE-RAWPK:!RSA"
3058
                    ":!VERS-ALL:+VERS-TLS1.3:%PROFILE_ULTRA")
3059
    else:
3060
        priority = ("SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
3061
                    ":+SIGN-DSA-SHA256")
874 by Teddy Hogeborn
PEP8 compliance: mandos
3062
    server_defaults = {"interface": "",
3063
                       "address": "",
3064
                       "port": "",
3065
                       "debug": "False",
962 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
3066
                       "priority": priority,
874 by Teddy Hogeborn
PEP8 compliance: mandos
3067
                       "servicename": "Mandos",
3068
                       "use_dbus": "True",
3069
                       "use_ipv6": "True",
3070
                       "debuglevel": "",
3071
                       "restore": "True",
3072
                       "socket": "",
3073
                       "statedir": "/var/lib/mandos",
3074
                       "foreground": "False",
3075
                       "zeroconf": "True",
3076
                       }
962 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
3077
    del priority
874 by Teddy Hogeborn
PEP8 compliance: mandos
3078
28 by Teddy Hogeborn
* server.conf: New file.
3079
    # Parse config file for server-global settings
1139 by Teddy Hogeborn
Update Python 3 compatibility
3080
    server_config = configparser.ConfigParser(server_defaults)
28 by Teddy Hogeborn
* server.conf: New file.
3081
    del server_defaults
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3082
    server_config.read(os.path.join(options.configdir, "mandos.conf"))
1139 by Teddy Hogeborn
Update Python 3 compatibility
3083
    # Convert the ConfigParser object to a dict
89 by Teddy Hogeborn
* Makefile: Bug fix: fixed creation of man pages for section 5 pages.
3084
    server_settings = server_config.defaults()
282 by Teddy Hogeborn
* mandos (main): Bug fix: use "getint" on the "port" config file
3085
    # Use the appropriate methods on the non-string config options
898 by Teddy Hogeborn
Server bug fix: Use the mandos.conf "zeroconf" and "restore" options
3086
    for option in ("debug", "use_dbus", "use_ipv6", "restore",
3087
                   "foreground", "zeroconf"):
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
3088
        server_settings[option] = server_config.getboolean("DEFAULT",
333 by Teddy Hogeborn
Minor code cleanup; one minor bug fix.
3089
                                                           option)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
3090
    if server_settings["port"]:
3091
        server_settings["port"] = server_config.getint("DEFAULT",
3092
                                                       "port")
589.1.1 by Teddy Hogeborn
* mandos: Implement "--socket" option.
3093
    if server_settings["socket"]:
3094
        server_settings["socket"] = server_config.getint("DEFAULT",
3095
                                                         "socket")
591 by Teddy Hogeborn
Merge "--socket" option for server.
3096
        # Later, stdin will, and stdout and stderr might, be dup'ed
589.1.1 by Teddy Hogeborn
* mandos: Implement "--socket" option.
3097
        # over with an opened os.devnull.  But we don't want this to
3098
        # happen with a supplied network socket.
3099
        if 0 <= server_settings["socket"] <= 2:
3100
            server_settings["socket"] = os.dup(server_settings
3101
                                               ["socket"])
28 by Teddy Hogeborn
* server.conf: New file.
3102
    del server_config
874 by Teddy Hogeborn
PEP8 compliance: mandos
3103
28 by Teddy Hogeborn
* server.conf: New file.
3104
    # Override the settings from the config file with command line
3105
    # options, if set.
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
3106
    for option in ("interface", "address", "port", "debug",
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3107
                   "priority", "servicename", "configdir", "use_dbus",
3108
                   "use_ipv6", "debuglevel", "restore", "statedir",
3109
                   "socket", "foreground", "zeroconf"):
28 by Teddy Hogeborn
* server.conf: New file.
3110
        value = getattr(options, option)
3111
        if value is not None:
3112
            server_settings[option] = value
3113
    del options
333 by Teddy Hogeborn
Minor code cleanup; one minor bug fix.
3114
    # Force all strings to be unicode
3115
    for option in server_settings.keys():
729 by Teddy Hogeborn
mandos: Stop using str() and remove unnecessary unicode() calls.
3116
        if isinstance(server_settings[option], bytes):
3117
            server_settings[option] = (server_settings[option]
3118
                                       .decode("utf-8"))
618 by Teddy Hogeborn
* mandos: Bug fix: Make boolean options work from the config file
3119
    # Force all boolean options to be boolean
3120
    for option in ("debug", "use_dbus", "use_ipv6", "restore",
707 by Teddy Hogeborn
mandos: New "--no-zeroconf" option. Also make "--socket=0" work.
3121
                   "foreground", "zeroconf"):
618 by Teddy Hogeborn
* mandos: Bug fix: Make boolean options work from the config file
3122
        server_settings[option] = bool(server_settings[option])
606 by Teddy Hogeborn
* mandos: New "--foreground" option.
3123
    # Debug implies foreground
3124
    if server_settings["debug"]:
3125
        server_settings["foreground"] = True
28 by Teddy Hogeborn
* server.conf: New file.
3126
    # Now we have our good server settings in "server_settings"
874 by Teddy Hogeborn
PEP8 compliance: mandos
3127
327 by Teddy Hogeborn
Merge from pipe IPC branch.
3128
    ##################################################################
874 by Teddy Hogeborn
PEP8 compliance: mandos
3129
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3130
    if (not server_settings["zeroconf"]
3131
        and not (server_settings["port"]
3132
                 or server_settings["socket"] != "")):
3133
        parser.error("Needs port or socket to work without Zeroconf")
874 by Teddy Hogeborn
PEP8 compliance: mandos
3134
243 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
3135
    # For convenience
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
3136
    debug = server_settings["debug"]
3137
    debuglevel = server_settings["debuglevel"]
3138
    use_dbus = server_settings["use_dbus"]
3139
    use_ipv6 = server_settings["use_ipv6"]
518.2.2 by Teddy Hogeborn
Directory with persistent state can now be changed with the "statedir"
3140
    stored_state_path = os.path.join(server_settings["statedir"],
3141
                                     stored_state_file)
606 by Teddy Hogeborn
* mandos: New "--foreground" option.
3142
    foreground = server_settings["foreground"]
707 by Teddy Hogeborn
mandos: New "--no-zeroconf" option. Also make "--socket=0" work.
3143
    zeroconf = server_settings["zeroconf"]
874 by Teddy Hogeborn
PEP8 compliance: mandos
3144
518.1.4 by Björn Påhlsson
restructured logger
3145
    if debug:
530 by teddy at bsnet
* mandos (initlogger): Take new "debug" argument; all callers changed.
3146
        initlogger(debug, logging.DEBUG)
518.1.4 by Björn Påhlsson
restructured logger
3147
    else:
3148
        if not debuglevel:
530 by teddy at bsnet
* mandos (initlogger): Take new "debug" argument; all callers changed.
3149
            initlogger(debug)
518.1.4 by Björn Påhlsson
restructured logger
3150
        else:
3151
            level = getattr(logging, debuglevel.upper())
530 by teddy at bsnet
* mandos (initlogger): Take new "debug" argument; all callers changed.
3152
            initlogger(debug, level)
874 by Teddy Hogeborn
PEP8 compliance: mandos
3153
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
3154
    if server_settings["servicename"] != "Mandos":
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3155
        syslogger.setFormatter(
1247 by Teddy Hogeborn
Server: Fix minor style issue
3156
            logging.Formatter("Mandos ({}) [%(process)d]:"
3157
                              " %(levelname)s: %(message)s".format(
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3158
                                  server_settings["servicename"])))
874 by Teddy Hogeborn
PEP8 compliance: mandos
3159
28 by Teddy Hogeborn
* server.conf: New file.
3160
    # Parse config file with clients
1139 by Teddy Hogeborn
Update Python 3 compatibility
3161
    client_config = configparser.ConfigParser(Client.client_defaults)
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
3162
    client_config.read(os.path.join(server_settings["configdir"],
3163
                                    "clients.conf"))
874 by Teddy Hogeborn
PEP8 compliance: mandos
3164
327 by Teddy Hogeborn
Merge from pipe IPC branch.
3165
    global mandos_dbus_service
3166
    mandos_dbus_service = None
874 by Teddy Hogeborn
PEP8 compliance: mandos
3167
707 by Teddy Hogeborn
mandos: New "--no-zeroconf" option. Also make "--socket=0" work.
3168
    socketfd = None
3169
    if server_settings["socket"] != "":
3170
        socketfd = server_settings["socket"]
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3171
    tcp_server = MandosServer(
3172
        (server_settings["address"], server_settings["port"]),
3173
        ClientHandler,
3174
        interface=(server_settings["interface"] or None),
3175
        use_ipv6=use_ipv6,
3176
        gnutls_priority=server_settings["priority"],
3177
        use_dbus=use_dbus,
3178
        socketfd=socketfd)
606 by Teddy Hogeborn
* mandos: New "--foreground" option.
3179
    if not foreground:
626 by Teddy Hogeborn
* Makefile (CFLAGS, LDFLAGS): Keep default flags from environment.
3180
        pidfilename = "/run/mandos.pid"
636 by Teddy Hogeborn
Fall back to /var/run for pidfile if /run is not a directory.
3181
        if not os.path.isdir("/run/."):
3182
            pidfilename = "/var/run/mandos.pid"
606 by Teddy Hogeborn
* mandos: New "--foreground" option.
3183
        pidfile = None
439 by Teddy Hogeborn
* mandos: Do not write pid file if --debug is passed.
3184
        try:
751 by Teddy Hogeborn
mandos: Use codecs.open() and print() for PID file.
3185
            pidfile = codecs.open(pidfilename, "w", encoding="utf-8")
574 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
3186
        except IOError as e:
1254 by Teddy Hogeborn
mandos: Update logging code to more standard idioms
3187
            log.error("Could not open file %r", pidfilename,
3188
                      exc_info=e)
874 by Teddy Hogeborn
PEP8 compliance: mandos
3189
816 by Teddy Hogeborn
Use "nogroup" as a fallback group, not "nobody".
3190
    for name, group in (("_mandos", "_mandos"),
3191
                        ("mandos", "mandos"),
3192
                        ("nobody", "nogroup")):
238 by Teddy Hogeborn
First version of a somewhat complete D-Bus server interface. Also
3193
        try:
566 by Teddy Hogeborn
* mandos (main): Simplify and shorten code selecting user and group ID
3194
            uid = pwd.getpwnam(name).pw_uid
816 by Teddy Hogeborn
Use "nogroup" as a fallback group, not "nobody".
3195
            gid = pwd.getpwnam(group).pw_gid
566 by Teddy Hogeborn
* mandos (main): Simplify and shorten code selecting user and group ID
3196
            break
238 by Teddy Hogeborn
First version of a somewhat complete D-Bus server interface. Also
3197
        except KeyError:
566 by Teddy Hogeborn
* mandos (main): Simplify and shorten code selecting user and group ID
3198
            continue
3199
    else:
3200
        uid = 65534
3201
        gid = 65534
163 by Teddy Hogeborn
* Makefile (PIDDIR, USER, GROUP): Removed.
3202
    try:
290 by Teddy Hogeborn
* mandos (main): Bug fix: Do setgid before setuid. Add verbose GnuTLS
3203
        os.setgid(gid)
163 by Teddy Hogeborn
* Makefile (PIDDIR, USER, GROUP): Removed.
3204
        os.setuid(uid)
1254 by Teddy Hogeborn
mandos: Update logging code to more standard idioms
3205
        log.debug("Did setuid/setgid to %s:%s", uid, gid)
482 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
3206
    except OSError as error:
1254 by Teddy Hogeborn
mandos: Update logging code to more standard idioms
3207
        log.warning("Failed to setuid/setgid to %s:%s: %s", uid, gid,
3208
                    os.strerror(error.errno))
583 by Teddy Hogeborn
* mandos (Client.start_checker): Remove undocumented support for "%%s"
3209
        if error.errno != errno.EPERM:
642 by Teddy Hogeborn
Syntax fix; use "raise" better in Mandos server.
3210
            raise
874 by Teddy Hogeborn
PEP8 compliance: mandos
3211
290 by Teddy Hogeborn
* mandos (main): Bug fix: Do setgid before setuid. Add verbose GnuTLS
3212
    if debug:
422 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
3213
        # Enable all possible GnuTLS debugging
874 by Teddy Hogeborn
PEP8 compliance: mandos
3214
290 by Teddy Hogeborn
* mandos (main): Bug fix: Do setgid before setuid. Add verbose GnuTLS
3215
        # "Use a log level over 10 to enable all debugging options."
3216
        # - GnuTLS manual
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
3217
        gnutls.global_set_log_level(11)
874 by Teddy Hogeborn
PEP8 compliance: mandos
3218
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
3219
        @gnutls.log_func
290 by Teddy Hogeborn
* mandos (main): Bug fix: Do setgid before setuid. Add verbose GnuTLS
3220
        def debug_gnutls(level, string):
1254 by Teddy Hogeborn
mandos: Update logging code to more standard idioms
3221
            log.debug("GnuTLS: %s",
3222
                      string[:-1].decode("utf-8", errors="replace"))
874 by Teddy Hogeborn
PEP8 compliance: mandos
3223
801 by Teddy Hogeborn
Stop using python-gnutls. Use GnuTLS 3.3 or later directly.
3224
        gnutls.global_set_log_function(debug_gnutls)
874 by Teddy Hogeborn
PEP8 compliance: mandos
3225
24.1.155 by Björn Påhlsson
mandos server: Added debuglevel that adjust at what level information
3226
        # Redirect stdin so all checkers get /dev/null
560.1.1 by teddy at recompile
* mandos: Use os.devnull instead of os.path.devnull. Fix some white
3227
        null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
24.1.155 by Björn Påhlsson
mandos server: Added debuglevel that adjust at what level information
3228
        os.dup2(null, sys.stdin.fileno())
3229
        if null > 2:
3230
            os.close(null)
874 by Teddy Hogeborn
PEP8 compliance: mandos
3231
458 by teddy at bsnet
* mandos (main): Bug fix: Fork before connecting to D-Bus.
3232
    # Need to fork before connecting to D-Bus
606 by Teddy Hogeborn
* mandos: New "--foreground" option.
3233
    if not foreground:
458 by teddy at bsnet
* mandos (main): Bug fix: Fork before connecting to D-Bus.
3234
        # Close all input and output, do double fork, etc.
3235
        daemon()
874 by Teddy Hogeborn
PEP8 compliance: mandos
3236
1139 by Teddy Hogeborn
Update Python 3 compatibility
3237
    if gi.version_info < (3, 10, 2):
3238
        # multiprocessing will use threads, so before we use GLib we
3239
        # need to inform GLib that threads will be used.
3240
        GLib.threads_init()
874 by Teddy Hogeborn
PEP8 compliance: mandos
3241
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
3242
    global main_loop
3243
    # From the Avahi example code
560.1.1 by teddy at recompile
* mandos: Use os.devnull instead of os.path.devnull. Fix some white
3244
    DBusGMainLoop(set_as_default=True)
830 by Teddy Hogeborn
Server: Use python-gi instead of old python-gobject
3245
    main_loop = GLib.MainLoop()
1305 by Teddy Hogeborn
Only use D-Bus when necessary
3246
    if use_dbus or zeroconf:
3247
        bus = dbus.SystemBus()
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
3248
    # End of Avahi example code
243 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
3249
    if use_dbus:
402 by Teddy Hogeborn
* mandos (Client.disable): Rename keyword argument "log" to "quiet",
3250
        try:
505 by Björn Påhlsson
The domain name has changed, so the D-Bus bus and interface names must
3251
            bus_name = dbus.service.BusName("se.recompile.Mandos",
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3252
                                            bus,
3253
                                            do_not_queue=True)
3254
            old_bus_name = dbus.service.BusName(
3255
                "se.bsnet.fukt.Mandos", bus,
3256
                do_not_queue=True)
750 by Teddy Hogeborn
mandos: Disable D-Bus if any DBusException is raised when connecting.
3257
        except dbus.exceptions.DBusException as e:
1254 by Teddy Hogeborn
mandos: Update logging code to more standard idioms
3258
            log.error("Disabling D-Bus:", exc_info=e)
402 by Teddy Hogeborn
* mandos (Client.disable): Rename keyword argument "log" to "quiet",
3259
            use_dbus = False
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
3260
            server_settings["use_dbus"] = False
402 by Teddy Hogeborn
* mandos (Client.disable): Rename keyword argument "log" to "quiet",
3261
            tcp_server.use_dbus = False
707 by Teddy Hogeborn
mandos: New "--no-zeroconf" option. Also make "--socket=0" work.
3262
    if zeroconf:
3263
        protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3264
        service = AvahiServiceToSyslog(
874 by Teddy Hogeborn
PEP8 compliance: mandos
3265
            name=server_settings["servicename"],
3266
            servicetype="_mandos._tcp",
3267
            protocol=protocol,
3268
            bus=bus)
707 by Teddy Hogeborn
mandos: New "--no-zeroconf" option. Also make "--socket=0" work.
3269
        if server_settings["interface"]:
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3270
            service.interface = if_nametoindex(
3271
                server_settings["interface"].encode("utf-8"))
874 by Teddy Hogeborn
PEP8 compliance: mandos
3272
24.1.152 by Björn Påhlsson
bug fixes that prevent problems when runing server as root
3273
    global multiprocessing_manager
3274
    multiprocessing_manager = multiprocessing.Manager()
874 by Teddy Hogeborn
PEP8 compliance: mandos
3275
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
3276
    client_class = Client
3277
    if use_dbus:
874 by Teddy Hogeborn
PEP8 compliance: mandos
3278
        client_class = functools.partial(ClientDBus, bus=bus)
3279
518.1.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
3280
    client_settings = Client.config_parser(client_config)
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
3281
    old_client_settings = {}
518.1.15 by Björn Påhlsson
more refactoring in regards to how clients get created
3282
    clients_data = {}
874 by Teddy Hogeborn
PEP8 compliance: mandos
3283
617 by Teddy Hogeborn
* mandos: Bug fix: Don't print output from checkers when running in
3284
    # This is used to redirect stdout and stderr for checker processes
3285
    global wnull
874 by Teddy Hogeborn
PEP8 compliance: mandos
3286
    wnull = open(os.devnull, "w")  # A writable /dev/null
617 by Teddy Hogeborn
* mandos: Bug fix: Don't print output from checkers when running in
3287
    # Only used if server is running in foreground but not in debug
3288
    # mode
3289
    if debug or not foreground:
3290
        wnull.close()
874 by Teddy Hogeborn
PEP8 compliance: mandos
3291
518.1.7 by Teddy Hogeborn
* mandos: Break long lines and fix some more white space.
3292
    # Get client data and settings from last running state.
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
3293
    if server_settings["restore"]:
3294
        try:
3295
            with open(stored_state_path, "rb") as stored_state:
874 by Teddy Hogeborn
PEP8 compliance: mandos
3296
                if sys.version_info.major == 2:
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
3297
                    clients_data, old_client_settings = pickle.load(
3298
                        stored_state)
3299
                else:
3300
                    bytes_clients_data, bytes_old_client_settings = (
874 by Teddy Hogeborn
PEP8 compliance: mandos
3301
                        pickle.load(stored_state, encoding="bytes"))
3302
                    #   Fix bytes to strings
3303
                    #  clients_data
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
3304
                    # .keys()
874 by Teddy Hogeborn
PEP8 compliance: mandos
3305
                    clients_data = {(key.decode("utf-8")
3306
                                     if isinstance(key, bytes)
3307
                                     else key): value
3308
                                    for key, value in
3309
                                    bytes_clients_data.items()}
829 by Teddy Hogeborn
Server: Fix minor thing with Python 3 compatibility
3310
                    del bytes_clients_data
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
3311
                    for key in clients_data:
874 by Teddy Hogeborn
PEP8 compliance: mandos
3312
                        value = {(k.decode("utf-8")
3313
                                  if isinstance(k, bytes) else k): v
3314
                                 for k, v in
3315
                                 clients_data[key].items()}
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
3316
                        clients_data[key] = value
3317
                        # .client_structure
3318
                        value["client_structure"] = [
3319
                            (s.decode("utf-8")
3320
                             if isinstance(s, bytes)
3321
                             else s) for s in
874 by Teddy Hogeborn
PEP8 compliance: mandos
3322
                            value["client_structure"]]
1173 by Teddy Hogeborn
Fix minor Python 3 bytes/str mixups
3323
                        # .name, .host, and .checker_command
3324
                        for k in ("name", "host", "checker_command"):
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
3325
                            if isinstance(value[k], bytes):
3326
                                value[k] = value[k].decode("utf-8")
1130 by Teddy Hogeborn
Update Python 3 compatibility
3327
                        if "key_id" not in value:
962 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
3328
                            value["key_id"] = ""
1130 by Teddy Hogeborn
Update Python 3 compatibility
3329
                        elif "fingerprint" not in value:
962 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
3330
                            value["fingerprint"] = ""
874 by Teddy Hogeborn
PEP8 compliance: mandos
3331
                    #  old_client_settings
829 by Teddy Hogeborn
Server: Fix minor thing with Python 3 compatibility
3332
                    # .keys()
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
3333
                    old_client_settings = {
3334
                        (key.decode("utf-8")
3335
                         if isinstance(key, bytes)
3336
                         else key): value
3337
                        for key, value in
874 by Teddy Hogeborn
PEP8 compliance: mandos
3338
                        bytes_old_client_settings.items()}
829 by Teddy Hogeborn
Server: Fix minor thing with Python 3 compatibility
3339
                    del bytes_old_client_settings
1173 by Teddy Hogeborn
Fix minor Python 3 bytes/str mixups
3340
                    # .host and .checker_command
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
3341
                    for value in old_client_settings.values():
1173 by Teddy Hogeborn
Fix minor Python 3 bytes/str mixups
3342
                        for attribute in ("host", "checker_command"):
3343
                            if isinstance(value[attribute], bytes):
3344
                                value[attribute] = (value[attribute]
3345
                                                    .decode("utf-8"))
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
3346
            os.remove(stored_state_path)
3347
        except IOError as e:
574 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
3348
            if e.errno == errno.ENOENT:
1254 by Teddy Hogeborn
mandos: Update logging code to more standard idioms
3349
                log.warning("Could not load persistent state:"
3350
                            " %s", os.strerror(e.errno))
574 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
3351
            else:
1254 by Teddy Hogeborn
mandos: Update logging code to more standard idioms
3352
                log.critical("Could not load persistent state:",
3353
                             exc_info=e)
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
3354
                raise
505.1.23 by Teddy Hogeborn
* mandos (main): Handle EOFError when reading state file.
3355
        except EOFError as e:
1254 by Teddy Hogeborn
mandos: Update logging code to more standard idioms
3356
            log.warning("Could not load persistent state: EOFError:",
3357
                        exc_info=e)
874 by Teddy Hogeborn
PEP8 compliance: mandos
3358
518.1.9 by Björn Påhlsson
renamed variables
3359
    with PGPEngine() as pgp:
723.1.4 by Teddy Hogeborn
Use the .items() method instead of .iteritems().
3360
        for client_name, client in clients_data.items():
617 by Teddy Hogeborn
* mandos: Bug fix: Don't print output from checkers when running in
3361
            # Skip removed clients
3362
            if client_name not in client_settings:
3363
                continue
874 by Teddy Hogeborn
PEP8 compliance: mandos
3364
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
3365
            # Decide which value to use after restoring saved state.
3366
            # We have three different values: Old config file,
3367
            # new config file, and saved state.
3368
            # New config value takes precedence if it differs from old
3369
            # config value, otherwise use saved state.
3370
            for name, value in client_settings[client_name].items():
3371
                try:
3372
                    # For each value in new config, check if it
3373
                    # differs from the old config value (Except for
3374
                    # the "secret" attribute)
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3375
                    if (name != "secret"
3376
                        and (value !=
3377
                             old_client_settings[client_name][name])):
518.2.10 by Teddy Hogeborn
* mandos (main): Bug fix: Syntax fix when restoring settings.
3378
                        client[name] = value
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
3379
                except KeyError:
3380
                    pass
874 by Teddy Hogeborn
PEP8 compliance: mandos
3381
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
3382
            # Clients who has passed its expire date can still be
749.1.1 by Teddy Hogeborn
mandos: Use multiprocessing module to run checkers.
3383
            # enabled if its last checker was successful.  A Client
552 by teddy at recompile
* mandos: Consistent terminology; use the term "secret" for the
3384
            # whose checker succeeded before we stored its state is
3385
            # assumed to have successfully run all checkers during
3386
            # downtime.
518.2.8 by Teddy Hogeborn
* mandos (ClientDBus.Host_dbus_property,
3387
            if client["enabled"]:
518.1.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
3388
                if datetime.datetime.utcnow() >= client["expires"]:
3389
                    if not client["last_checked_ok"]:
1254 by Teddy Hogeborn
mandos: Update logging code to more standard idioms
3390
                        log.warning("disabling client %s - Client"
3391
                                    " never performed a successful"
3392
                                    " checker", client_name)
518.1.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
3393
                        client["enabled"] = False
3394
                    elif client["last_checker_status"] != 0:
1254 by Teddy Hogeborn
mandos: Update logging code to more standard idioms
3395
                        log.warning("disabling client %s - Client"
3396
                                    " last checker failed with error"
3397
                                    " code %s", client_name,
3398
                                    client["last_checker_status"])
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
3399
                        client["enabled"] = False
3400
                    else:
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3401
                        client["expires"] = (
3402
                            datetime.datetime.utcnow()
3403
                            + client["timeout"])
1254 by Teddy Hogeborn
mandos: Update logging code to more standard idioms
3404
                        log.debug("Last checker succeeded, keeping %s"
3405
                                  " enabled", client_name)
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
3406
            try:
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3407
                client["secret"] = pgp.decrypt(
3408
                    client["encrypted_secret"],
3409
                    client_settings[client_name]["secret"])
518.1.9 by Björn Påhlsson
renamed variables
3410
            except PGPError:
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
3411
                # If decryption fails, we use secret from new settings
1254 by Teddy Hogeborn
mandos: Update logging code to more standard idioms
3412
                log.debug("Failed to decrypt %s old secret",
3413
                          client_name)
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3414
                client["secret"] = (client_settings[client_name]
3415
                                    ["secret"])
874 by Teddy Hogeborn
PEP8 compliance: mandos
3416
518.1.15 by Björn Påhlsson
more refactoring in regards to how clients get created
3417
    # Add/remove clients based on new changes made to config
543 by Teddy Hogeborn
* mandos: Break some long lines.
3418
    for client_name in (set(old_client_settings)
3419
                        - set(client_settings)):
518.1.15 by Björn Påhlsson
more refactoring in regards to how clients get created
3420
        del clients_data[client_name]
543 by Teddy Hogeborn
* mandos: Break some long lines.
3421
    for client_name in (set(client_settings)
3422
                        - set(old_client_settings)):
518.1.15 by Björn Påhlsson
more refactoring in regards to how clients get created
3423
        clients_data[client_name] = client_settings[client_name]
874 by Teddy Hogeborn
PEP8 compliance: mandos
3424
552 by teddy at recompile
* mandos: Consistent terminology; use the term "secret" for the
3425
    # Create all client objects
723.1.4 by Teddy Hogeborn
Use the .items() method instead of .iteritems().
3426
    for client_name, client in clients_data.items():
518.1.15 by Björn Påhlsson
more refactoring in regards to how clients get created
3427
        tcp_server.clients[client_name] = client_class(
874 by Teddy Hogeborn
PEP8 compliance: mandos
3428
            name=client_name,
3429
            settings=client,
3430
            server_settings=server_settings)
3431
341 by Teddy Hogeborn
Code cleanup and one bug fix.
3432
    if not tcp_server.clients:
1254 by Teddy Hogeborn
mandos: Update logging code to more standard idioms
3433
        log.warning("No clients defined")
874 by Teddy Hogeborn
PEP8 compliance: mandos
3434
606 by Teddy Hogeborn
* mandos: New "--foreground" option.
3435
    if not foreground:
3436
        if pidfile is not None:
751 by Teddy Hogeborn
mandos: Use codecs.open() and print() for PID file.
3437
            pid = os.getpid()
606 by Teddy Hogeborn
* mandos: New "--foreground" option.
3438
            try:
3439
                with pidfile:
751 by Teddy Hogeborn
mandos: Use codecs.open() and print() for PID file.
3440
                    print(pid, file=pidfile)
606 by Teddy Hogeborn
* mandos: New "--foreground" option.
3441
            except IOError:
1254 by Teddy Hogeborn
mandos: Update logging code to more standard idioms
3442
                log.error("Could not write to file %r with PID %d",
3443
                          pidfilename, pid)
606 by Teddy Hogeborn
* mandos: New "--foreground" option.
3444
        del pidfile
439 by Teddy Hogeborn
* mandos: Do not write pid file if --debug is passed.
3445
        del pidfilename
874 by Teddy Hogeborn
PEP8 compliance: mandos
3446
831 by Teddy Hogeborn
Server: Fix bug where it did not exit timely on signals
3447
    for termsig in (signal.SIGHUP, signal.SIGTERM):
3448
        GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,
3449
                             lambda: main_loop.quit() and False)
874 by Teddy Hogeborn
PEP8 compliance: mandos
3450
243 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
3451
    if use_dbus:
874 by Teddy Hogeborn
PEP8 compliance: mandos
3452
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3453
        @alternate_dbus_interfaces(
874 by Teddy Hogeborn
PEP8 compliance: mandos
3454
            {"se.recompile.Mandos": "se.bsnet.fukt.Mandos"})
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
3455
        class MandosDBusService(DBusObjectWithObjectManager):
243 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
3456
            """A D-Bus proxy object"""
874 by Teddy Hogeborn
PEP8 compliance: mandos
3457
243 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
3458
            def __init__(self):
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
3459
                dbus.service.Object.__init__(self, bus, "/")
874 by Teddy Hogeborn
PEP8 compliance: mandos
3460
505.1.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
3461
            _interface = "se.recompile.Mandos"
874 by Teddy Hogeborn
PEP8 compliance: mandos
3462
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
3463
            @dbus.service.signal(_interface, signature="o")
411 by Teddy Hogeborn
More consistent terminology: Clients are no longer "invalid" - they
3464
            def ClientAdded(self, objpath):
243 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
3465
                "D-Bus signal"
3466
                pass
874 by Teddy Hogeborn
PEP8 compliance: mandos
3467
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
3468
            @dbus.service.signal(_interface, signature="ss")
962 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
3469
            def ClientNotFound(self, key_id, address):
327 by Teddy Hogeborn
Merge from pipe IPC branch.
3470
                "D-Bus signal"
3471
                pass
874 by Teddy Hogeborn
PEP8 compliance: mandos
3472
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
3473
            @dbus_annotations({"org.freedesktop.DBus.Deprecated":
3474
                               "true"})
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
3475
            @dbus.service.signal(_interface, signature="os")
278 by Teddy Hogeborn
* mandos (Client.GetAllProperties): Also send Client.dbus_object_path
3476
            def ClientRemoved(self, objpath, name):
243 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
3477
                "D-Bus signal"
3478
                pass
874 by Teddy Hogeborn
PEP8 compliance: mandos
3479
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
3480
            @dbus_annotations({"org.freedesktop.DBus.Deprecated":
3481
                               "true"})
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
3482
            @dbus.service.method(_interface, out_signature="ao")
243 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
3483
            def GetAllClients(self):
283 by Teddy Hogeborn
* mandos (peer_certificate): Handle NULL pointer from
3484
                "D-Bus method"
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3485
                return dbus.Array(c.dbus_object_path for c in
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
3486
                                  tcp_server.clients.values())
874 by Teddy Hogeborn
PEP8 compliance: mandos
3487
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
3488
            @dbus_annotations({"org.freedesktop.DBus.Deprecated":
3489
                               "true"})
333 by Teddy Hogeborn
Minor code cleanup; one minor bug fix.
3490
            @dbus.service.method(_interface,
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
3491
                                 out_signature="a{oa{sv}}")
243 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
3492
            def GetAllClientsWithProperties(self):
283 by Teddy Hogeborn
* mandos (peer_certificate): Handle NULL pointer from
3493
                "D-Bus method"
243 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
3494
                return dbus.Dictionary(
874 by Teddy Hogeborn
PEP8 compliance: mandos
3495
                    {c.dbus_object_path: c.GetAll(
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
3496
                        "se.recompile.Mandos.Client")
874 by Teddy Hogeborn
PEP8 compliance: mandos
3497
                     for c in tcp_server.clients.values()},
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
3498
                    signature="oa{sv}")
874 by Teddy Hogeborn
PEP8 compliance: mandos
3499
463.1.4 by teddy at bsnet
* mandos: Use unicode string literals.
3500
            @dbus.service.method(_interface, in_signature="o")
243 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
3501
            def RemoveClient(self, object_path):
283 by Teddy Hogeborn
* mandos (peer_certificate): Handle NULL pointer from
3502
                "D-Bus method"
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
3503
                for c in tcp_server.clients.values():
243 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
3504
                    if c.dbus_object_path == object_path:
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
3505
                        del tcp_server.clients[c.name]
328 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
3506
                        c.remove_from_connection()
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
3507
                        # Don't signal the disabling
402 by Teddy Hogeborn
* mandos (Client.disable): Rename keyword argument "log" to "quiet",
3508
                        c.disable(quiet=True)
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
3509
                        # Emit D-Bus signal for removal
3510
                        self.client_removed_signal(c)
278 by Teddy Hogeborn
* mandos (Client.GetAllProperties): Also send Client.dbus_object_path
3511
                        return
400 by Teddy Hogeborn
* mandos (Client.enable): Bug fix: Start new immediate checker last to
3512
                raise KeyError(object_path)
874 by Teddy Hogeborn
PEP8 compliance: mandos
3513
243 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
3514
            del _interface
874 by Teddy Hogeborn
PEP8 compliance: mandos
3515
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
3516
            @dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
874 by Teddy Hogeborn
PEP8 compliance: mandos
3517
                                 out_signature="a{oa{sa{sv}}}")
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
3518
            def GetManagedObjects(self):
3519
                """D-Bus method"""
3520
                return dbus.Dictionary(
874 by Teddy Hogeborn
PEP8 compliance: mandos
3521
                    {client.dbus_object_path:
3522
                     dbus.Dictionary(
3523
                         {interface: client.GetAll(interface)
3524
                          for interface in
3525
                          client._get_all_interface_names()})
3526
                     for client in tcp_server.clients.values()})
3527
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
3528
            def client_added_signal(self, client):
3529
                """Send the new standard signal and the old signal"""
3530
                if use_dbus:
3531
                    # New standard signal
3532
                    self.InterfacesAdded(
3533
                        client.dbus_object_path,
3534
                        dbus.Dictionary(
874 by Teddy Hogeborn
PEP8 compliance: mandos
3535
                            {interface: client.GetAll(interface)
3536
                             for interface in
3537
                             client._get_all_interface_names()}))
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
3538
                    # Old signal
3539
                    self.ClientAdded(client.dbus_object_path)
874 by Teddy Hogeborn
PEP8 compliance: mandos
3540
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
3541
            def client_removed_signal(self, client):
3542
                """Send the new standard signal and the old signal"""
3543
                if use_dbus:
3544
                    # New standard signal
3545
                    self.InterfacesRemoved(
3546
                        client.dbus_object_path,
3547
                        client._get_all_interface_names())
3548
                    # Old signal
3549
                    self.ClientRemoved(client.dbus_object_path,
3550
                                       client.name)
874 by Teddy Hogeborn
PEP8 compliance: mandos
3551
575 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
3552
        mandos_dbus_service = MandosDBusService()
874 by Teddy Hogeborn
PEP8 compliance: mandos
3553
850 by Teddy Hogeborn
mandos: Bug fix: Do multiprocessing cleanup correctly on exit
3554
    # Save modules to variables to exempt the modules from being
3555
    # unloaded before the function registered with atexit() is run.
3556
    mp = multiprocessing
3557
    wn = wnull
874 by Teddy Hogeborn
PEP8 compliance: mandos
3558
400 by Teddy Hogeborn
* mandos (Client.enable): Bug fix: Start new immediate checker last to
3559
    def cleanup():
3560
        "Cleanup function; run on exit"
707 by Teddy Hogeborn
mandos: New "--no-zeroconf" option. Also make "--socket=0" work.
3561
        if zeroconf:
3562
            service.cleanup()
874 by Teddy Hogeborn
PEP8 compliance: mandos
3563
850 by Teddy Hogeborn
mandos: Bug fix: Do multiprocessing cleanup correctly on exit
3564
        mp.active_children()
3565
        wn.close()
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
3566
        if not (tcp_server.clients or client_settings):
3567
            return
874 by Teddy Hogeborn
PEP8 compliance: mandos
3568
521 by teddy at bsnet
* debian/control (mandos/Depends): Added "python-crypto".
3569
        # Store client before exiting. Secrets are encrypted with key
3570
        # based on what config file has. If config file is
3571
        # removed/edited, old secret will thus be unrecovable.
518.1.15 by Björn Påhlsson
more refactoring in regards to how clients get created
3572
        clients = {}
518.1.9 by Björn Påhlsson
renamed variables
3573
        with PGPEngine() as pgp:
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
3574
            for client in tcp_server.clients.values():
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
3575
                key = client_settings[client.name]["secret"]
518.1.9 by Björn Påhlsson
renamed variables
3576
                client.encrypted_secret = pgp.encrypt(client.secret,
3577
                                                      key)
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
3578
                client_dict = {}
874 by Teddy Hogeborn
PEP8 compliance: mandos
3579
518.1.15 by Björn Påhlsson
more refactoring in regards to how clients get created
3580
                # A list of attributes that can not be pickled
3581
                # + secret.
874 by Teddy Hogeborn
PEP8 compliance: mandos
3582
                exclude = {"bus", "changedstate", "secret",
3583
                           "checker", "server_settings"}
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3584
                for name, typ in inspect.getmembers(dbus.service
3585
                                                    .Object):
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
3586
                    exclude.add(name)
874 by Teddy Hogeborn
PEP8 compliance: mandos
3587
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
3588
                client_dict["encrypted_secret"] = (client
3589
                                                   .encrypted_secret)
3590
                for attr in client.client_structure:
3591
                    if attr not in exclude:
3592
                        client_dict[attr] = getattr(client, attr)
874 by Teddy Hogeborn
PEP8 compliance: mandos
3593
518.1.15 by Björn Påhlsson
more refactoring in regards to how clients get created
3594
                clients[client.name] = client_dict
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
3595
                del client_settings[client.name]["secret"]
874 by Teddy Hogeborn
PEP8 compliance: mandos
3596
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
3597
        try:
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3598
            with tempfile.NamedTemporaryFile(
1247 by Teddy Hogeborn
Server: Fix minor style issue
3599
                    mode="wb",
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3600
                    suffix=".pickle",
1247 by Teddy Hogeborn
Server: Fix minor style issue
3601
                    prefix="clients-",
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3602
                    dir=os.path.dirname(stored_state_path),
3603
                    delete=False) as stored_state:
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
3604
                pickle.dump((clients, client_settings), stored_state,
874 by Teddy Hogeborn
PEP8 compliance: mandos
3605
                            protocol=2)
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3606
                tempname = stored_state.name
505.1.26 by teddy at bsnet
* mandos (main/cleanup): Write new file, then rename. Use
3607
            os.rename(tempname, stored_state_path)
518.2.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
3608
        except (IOError, OSError) as e:
530 by teddy at bsnet
* mandos (initlogger): Take new "debug" argument; all callers changed.
3609
            if not debug:
3610
                try:
3611
                    os.remove(tempname)
3612
                except NameError:
3613
                    pass
574 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
3614
            if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
1254 by Teddy Hogeborn
mandos: Update logging code to more standard idioms
3615
                log.warning("Could not save persistent state: %s",
3616
                            os.strerror(e.errno))
574 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
3617
            else:
1254 by Teddy Hogeborn
mandos: Update logging code to more standard idioms
3618
                log.warning("Could not save persistent state:",
3619
                            exc_info=e)
642 by Teddy Hogeborn
Syntax fix; use "raise" better in Mandos server.
3620
                raise
874 by Teddy Hogeborn
PEP8 compliance: mandos
3621
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
3622
        # Delete all clients, and settings from config
400 by Teddy Hogeborn
* mandos (Client.enable): Bug fix: Start new immediate checker last to
3623
        while tcp_server.clients:
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
3624
            name, client = tcp_server.clients.popitem()
402 by Teddy Hogeborn
* mandos (Client.disable): Rename keyword argument "log" to "quiet",
3625
            if use_dbus:
3626
                client.remove_from_connection()
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
3627
            # Don't signal the disabling
402 by Teddy Hogeborn
* mandos (Client.disable): Rename keyword argument "log" to "quiet",
3628
            client.disable(quiet=True)
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
3629
            # Emit D-Bus signal for removal
796 by Teddy Hogeborn
On cleanup, Signal ClientRemoved only if using D-Bus.
3630
            if use_dbus:
3631
                mandos_dbus_service.client_removed_signal(client)
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
3632
        client_settings.clear()
874 by Teddy Hogeborn
PEP8 compliance: mandos
3633
400 by Teddy Hogeborn
* mandos (Client.enable): Bug fix: Start new immediate checker last to
3634
    atexit.register(cleanup)
874 by Teddy Hogeborn
PEP8 compliance: mandos
3635
828 by Teddy Hogeborn
Server: Add Python 3 compatibility
3636
    for client in tcp_server.clients.values():
243 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
3637
        if use_dbus:
785 by Teddy Hogeborn
Support the standard org.freedesktop.DBus.ObjectManager interface.
3638
            # Emit D-Bus signal for adding
3639
            mandos_dbus_service.client_added_signal(client)
518.1.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
3640
        # Need to initiate checking of clients
3641
        if client.enabled:
1268 by Teddy Hogeborn
Server: Bug fix: Stagger checker runs when creating clients
3642
            client.init_checker(randomize_start=True)
874 by Teddy Hogeborn
PEP8 compliance: mandos
3643
163 by Teddy Hogeborn
* Makefile (PIDDIR, USER, GROUP): Removed.
3644
    tcp_server.enable()
3645
    tcp_server.server_activate()
874 by Teddy Hogeborn
PEP8 compliance: mandos
3646
28 by Teddy Hogeborn
* server.conf: New file.
3647
    # Find out what port we got
707 by Teddy Hogeborn
mandos: New "--no-zeroconf" option. Also make "--socket=0" work.
3648
    if zeroconf:
3649
        service.port = tcp_server.socket.getsockname()[1]
314 by Teddy Hogeborn
Support not using IPv6 in server:
3650
    if use_ipv6:
1254 by Teddy Hogeborn
mandos: Update logging code to more standard idioms
3651
        log.info("Now listening on address %r, port %d, flowinfo %d,"
3652
                 " scope_id %d", *tcp_server.socket.getsockname())
314 by Teddy Hogeborn
Support not using IPv6 in server:
3653
    else:                       # IPv4
1254 by Teddy Hogeborn
mandos: Update logging code to more standard idioms
3654
        log.info("Now listening on address %r, port %d",
3655
                 *tcp_server.socket.getsockname())
874 by Teddy Hogeborn
PEP8 compliance: mandos
3656
3657
    # service.interface = tcp_server.socket.getsockname()[3]
3658
28 by Teddy Hogeborn
* server.conf: New file.
3659
    try:
707 by Teddy Hogeborn
mandos: New "--no-zeroconf" option. Also make "--socket=0" work.
3660
        if zeroconf:
3661
            # From the Avahi example code
3662
            try:
3663
                service.activate()
3664
            except dbus.exceptions.DBusException as error:
1254 by Teddy Hogeborn
mandos: Update logging code to more standard idioms
3665
                log.critical("D-Bus Exception", exc_info=error)
707 by Teddy Hogeborn
mandos: New "--no-zeroconf" option. Also make "--socket=0" work.
3666
                cleanup()
3667
                sys.exit(1)
3668
            # End of Avahi example code
874 by Teddy Hogeborn
PEP8 compliance: mandos
3669
1168 by Teddy Hogeborn
Server: Fully use new GLib.io_add_watch() call signature
3670
        GLib.io_add_watch(
3671
            GLib.IOChannel.unix_new(tcp_server.fileno()),
3672
            GLib.PRIORITY_DEFAULT, GLib.IO_IN,
3673
            lambda *args, **kwargs: (tcp_server.handle_request
3674
                                     (*args[2:], **kwargs) or True))
874 by Teddy Hogeborn
PEP8 compliance: mandos
3675
1254 by Teddy Hogeborn
mandos: Update logging code to more standard idioms
3676
        log.debug("Starting main loop")
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
3677
        main_loop.run()
482 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
3678
    except AvahiError as error:
1254 by Teddy Hogeborn
mandos: Update logging code to more standard idioms
3679
        log.critical("Avahi Error", exc_info=error)
401 by Teddy Hogeborn
* README (FAQ): Fix typo.
3680
        cleanup()
28 by Teddy Hogeborn
* server.conf: New file.
3681
        sys.exit(1)
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
3682
    except KeyboardInterrupt:
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
3683
        if debug:
463.1.5 by teddy at bsnet
* mandos: Use unicode string literals.
3684
            print("", file=sys.stderr)
1254 by Teddy Hogeborn
mandos: Update logging code to more standard idioms
3685
        log.debug("Server received KeyboardInterrupt")
3686
    log.debug("Server exiting")
401 by Teddy Hogeborn
* README (FAQ): Fix typo.
3687
    # Must run before the D-Bus bus name gets deregistered
3688
    cleanup()
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
3689
1165 by Teddy Hogeborn
Server: Add scaffolding for tests
3690

1255 by Teddy Hogeborn
mandos-ctl: Update testing code
3691
def parse_test_args():
3692
    # type: () -> argparse.Namespace
1165 by Teddy Hogeborn
Server: Add scaffolding for tests
3693
    parser = argparse.ArgumentParser(add_help=False)
1247 by Teddy Hogeborn
Server: Fix minor style issue
3694
    parser.add_argument("--check", action="store_true")
1255 by Teddy Hogeborn
mandos-ctl: Update testing code
3695
    parser.add_argument("--prefix", )
1165 by Teddy Hogeborn
Server: Add scaffolding for tests
3696
    args, unknown_args = parser.parse_known_args()
1255 by Teddy Hogeborn
mandos-ctl: Update testing code
3697
    if args.check:
3698
        # Remove test options from sys.argv
1165 by Teddy Hogeborn
Server: Add scaffolding for tests
3699
        sys.argv[1:] = unknown_args
1255 by Teddy Hogeborn
mandos-ctl: Update testing code
3700
    return args
1165 by Teddy Hogeborn
Server: Add scaffolding for tests
3701
3702
# Add all tests from doctest strings
3703
def load_tests(loader, tests, none):
3704
    import doctest
3705
    tests.addTests(doctest.DocTestSuite())
3706
    return tests
746 by Teddy Hogeborn
mandos: Do minor formatting and whitespace adjustments.
3707
1247 by Teddy Hogeborn
Server: Fix minor style issue
3708
if __name__ == "__main__":
1255 by Teddy Hogeborn
mandos-ctl: Update testing code
3709
    options = parse_test_args()
1165 by Teddy Hogeborn
Server: Add scaffolding for tests
3710
    try:
1255 by Teddy Hogeborn
mandos-ctl: Update testing code
3711
        if options.check:
3712
            extra_test_prefix = options.prefix
3713
            if extra_test_prefix is not None:
3714
                if not (unittest.main(argv=[""], exit=False)
3715
                        .result.wasSuccessful()):
3716
                    sys.exit(1)
3717
                class ExtraTestLoader(unittest.TestLoader):
3718
                    testMethodPrefix = extra_test_prefix
3719
                # Call using ./scriptname --test [--verbose]
3720
                unittest.main(argv=[""], testLoader=ExtraTestLoader())
3721
            else:
3722
                unittest.main(argv=[""])
1165 by Teddy Hogeborn
Server: Add scaffolding for tests
3723
        else:
3724
            main()
3725
    finally:
3726
        logging.shutdown()
1255 by Teddy Hogeborn
mandos-ctl: Update testing code
3727

3728
# Local Variables:
3729
# run-tests:
3730
# (lambda (&optional extra)
3731
#   (if (not (funcall run-tests-in-test-buffer default-directory
3732
# 	      extra))
3733
# 	(funcall show-test-buffer-in-test-window)
3734
#     (funcall remove-test-window)
3735
#     (if extra (message "Extra tests run successfully!"))))
3736
# run-tests-in-test-buffer:
3737
# (lambda (dir &optional extra)
3738
#   (with-current-buffer (get-buffer-create "*Test*")
3739
#     (setq buffer-read-only nil
3740
# 	    default-directory dir)
3741
#     (erase-buffer)
3742
#     (compilation-mode))
1257 by Teddy Hogeborn
Fix testing code to handle abnormal exits
3743
#   (let ((process-result
3744
# 	   (let ((inhibit-read-only t))
3745
# 	     (process-file-shell-command
3746
# 	      (funcall get-command-line extra) nil "*Test*"))))
3747
#     (and (numberp process-result)
3748
# 	   (= process-result 0))))
1255 by Teddy Hogeborn
mandos-ctl: Update testing code
3749
# get-command-line:
3750
# (lambda (&optional extra)
3751
#   (let ((quoted-script
3752
# 	   (shell-quote-argument (funcall get-script-name))))
3753
#     (format
3754
#      (concat "%s --check" (if extra " --prefix=atest" ""))
3755
#      quoted-script)))
3756
# get-script-name:
3757
# (lambda ()
3758
#   (if (fboundp 'file-local-name)
3759
# 	(file-local-name (buffer-file-name))
3760
#     (or (file-remote-p (buffer-file-name) 'localname)
3761
# 	  (buffer-file-name))))
3762
# remove-test-window:
3763
# (lambda ()
3764
#   (let ((test-window (get-buffer-window "*Test*")))
3765
#     (if test-window (delete-window test-window))))
3766
# show-test-buffer-in-test-window:
3767
# (lambda ()
3768
#   (when (not (get-buffer-window-list "*Test*"))
3769
#     (setq next-error-last-buffer (get-buffer "*Test*"))
3770
#     (let* ((side (if (>= (window-width) 146) 'right 'bottom))
3771
# 	     (display-buffer-overriding-action
3772
# 	      `((display-buffer-in-side-window) (side . ,side)
3773
# 		(window-height . fit-window-to-buffer)
3774
# 		(window-width . fit-window-to-buffer))))
3775
# 	(display-buffer "*Test*"))))
3776
# eval:
3777
# (progn
3778
#   (let* ((run-extra-tests (lambda () (interactive)
3779
# 			      (funcall run-tests t)))
3780
# 	   (inner-keymap `(keymap (116 . ,run-extra-tests))) ; t
3781
# 	   (outer-keymap `(keymap (3 . ,inner-keymap))))     ; C-c
3782
#     (setq minor-mode-overriding-map-alist
3783
# 	    (cons `(run-tests . ,outer-keymap)
3784
# 		  minor-mode-overriding-map-alist)))
3785
#   (add-hook 'after-save-hook run-tests 90 t))
3786
# End: