/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos

  • Committer: Teddy Hogeborn
  • Date: 2019-08-16 19:32:47 UTC
  • Revision ID: teddy@recompile.se-20190816193247-3swy47ofqe7cr1i0
http://bugs.debian.org/934888
From: Grégoire Scano <gregoire.scano@malloc.fr>

Add French debconf translation

* debian/po/fr.po: New.

Acked-by: Teddy Hogeborn <teddy@recompile.se>

Show diffs side-by-side

added added

removed removed

Lines of Context:
mandos
1
 
#!/usr/bin/python2.7
 
1
#!/usr/bin/python
2
2
# -*- mode: python; coding: utf-8 -*-
3
 
# 
 
3
#
4
4
# Mandos server - give out binary blobs to connecting clients.
5
 
# 
 
5
#
6
6
# This program is partly derived from an example program for an Avahi
7
7
# service publisher, downloaded from
8
8
# <http://avahi.org/wiki/PythonPublishExample>.  This includes the
9
9
# methods "add", "remove", "server_state_changed",
10
10
# "entry_group_state_changed", "cleanup", and "activate" in the
11
11
# "AvahiService" class, and some lines in "main".
12
 
# 
 
12
#
13
13
# Everything else is
14
 
# Copyright © 2008-2014 Teddy Hogeborn
15
 
# Copyright © 2008-2014 Björn Påhlsson
16
 
# 
17
 
# This program is free software: you can redistribute it and/or modify
18
 
# it under the terms of the GNU General Public License as published by
 
14
# Copyright © 2008-2019 Teddy Hogeborn
 
15
# Copyright © 2008-2019 Björn Påhlsson
 
16
#
 
17
# This file is part of Mandos.
 
18
#
 
19
# Mandos is free software: you can redistribute it and/or modify it
 
20
# under the terms of the GNU General Public License as published by
19
21
# the Free Software Foundation, either version 3 of the License, or
20
22
# (at your option) any later version.
21
23
#
22
 
#     This program is distributed in the hope that it will be useful,
23
 
#     but WITHOUT ANY WARRANTY; without even the implied warranty of
 
24
#     Mandos is distributed in the hope that it will be useful, but
 
25
#     WITHOUT ANY WARRANTY; without even the implied warranty of
24
26
#     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
25
27
#     GNU General Public License for more details.
26
 
# 
 
28
#
27
29
# You should have received a copy of the GNU General Public License
28
 
# along with this program.  If not, see
29
 
# <http://www.gnu.org/licenses/>.
30
 
# 
 
30
# along with Mandos.  If not, see <http://www.gnu.org/licenses/>.
 
31
#
31
32
# Contact the authors at <mandos@recompile.se>.
32
 
# 
 
33
#
33
34
 
34
35
from __future__ import (division, absolute_import, print_function,
35
36
                        unicode_literals)
36
37
 
37
 
from future_builtins import *
 
38
try:
 
39
    from future_builtins import *
 
40
except ImportError:
 
41
    pass
38
42
 
39
 
import SocketServer as socketserver
 
43
try:
 
44
    import SocketServer as socketserver
 
45
except ImportError:
 
46
    import socketserver
40
47
import socket
41
48
import argparse
42
49
import datetime
43
50
import errno
44
 
import gnutls.crypto
45
 
import gnutls.connection
46
 
import gnutls.errors
47
 
import gnutls.library.functions
48
 
import gnutls.library.constants
49
 
import gnutls.library.types
50
 
import ConfigParser as configparser
 
51
try:
 
52
    import ConfigParser as configparser
 
53
except ImportError:
 
54
    import configparser
51
55
import sys
52
56
import re
53
57
import os
62
66
import struct
63
67
import fcntl
64
68
import functools
65
 
import cPickle as pickle
 
69
try:
 
70
    import cPickle as pickle
 
71
except ImportError:
 
72
    import pickle
66
73
import multiprocessing
67
74
import types
68
75
import binascii
69
76
import tempfile
70
77
import itertools
71
78
import collections
 
79
import codecs
72
80
 
73
81
import dbus
74
82
import dbus.service
75
 
import gobject
76
 
import avahi
 
83
import gi
 
84
from gi.repository import GLib
77
85
from dbus.mainloop.glib import DBusGMainLoop
78
86
import ctypes
79
87
import ctypes.util
80
88
import xml.dom.minidom
81
89
import inspect
82
90
 
 
91
if sys.version_info.major == 2:
 
92
    __metaclass__ = type
 
93
 
 
94
# Try to find the value of SO_BINDTODEVICE:
83
95
try:
 
96
    # This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and
 
97
    # newer, and it is also the most natural place for it:
84
98
    SO_BINDTODEVICE = socket.SO_BINDTODEVICE
85
99
except AttributeError:
86
100
    try:
 
101
        # This is where SO_BINDTODEVICE was up to and including Python
 
102
        # 2.6, and also 3.2:
87
103
        from IN import SO_BINDTODEVICE
88
104
    except ImportError:
89
 
        SO_BINDTODEVICE = None
 
105
        # In Python 2.7 it seems to have been removed entirely.
 
106
        # Try running the C preprocessor:
 
107
        try:
 
108
            cc = subprocess.Popen(["cc", "--language=c", "-E",
 
109
                                   "/dev/stdin"],
 
110
                                  stdin=subprocess.PIPE,
 
111
                                  stdout=subprocess.PIPE)
 
112
            stdout = cc.communicate(
 
113
                "#include <sys/socket.h>\nSO_BINDTODEVICE\n")[0]
 
114
            SO_BINDTODEVICE = int(stdout.splitlines()[-1])
 
115
        except (OSError, ValueError, IndexError):
 
116
            # No value found
 
117
            SO_BINDTODEVICE = None
90
118
 
91
119
if sys.version_info.major == 2:
92
120
    str = unicode
93
121
 
94
 
version = "1.6.8"
 
122
if sys.version_info < (3, 2):
 
123
    configparser.Configparser = configparser.SafeConfigParser
 
124
 
 
125
version = "1.8.7"
95
126
stored_state_file = "clients.pickle"
96
127
 
97
128
logger = logging.getLogger()
98
129
syslogger = None
99
130
 
100
131
try:
101
 
    if_nametoindex = (ctypes.cdll.LoadLibrary
102
 
                      (ctypes.util.find_library("c"))
103
 
                      .if_nametoindex)
 
132
    if_nametoindex = ctypes.cdll.LoadLibrary(
 
133
        ctypes.util.find_library("c")).if_nametoindex
104
134
except (OSError, AttributeError):
 
135
 
105
136
    def if_nametoindex(interface):
106
137
        "Get an interface index the hard way, i.e. using fcntl()"
107
138
        SIOCGIFINDEX = 0x8933  # From /usr/include/linux/sockios.h
112
143
        return interface_index
113
144
 
114
145
 
 
146
def copy_function(func):
 
147
    """Make a copy of a function"""
 
148
    if sys.version_info.major == 2:
 
149
        return types.FunctionType(func.func_code,
 
150
                                  func.func_globals,
 
151
                                  func.func_name,
 
152
                                  func.func_defaults,
 
153
                                  func.func_closure)
 
154
    else:
 
155
        return types.FunctionType(func.__code__,
 
156
                                  func.__globals__,
 
157
                                  func.__name__,
 
158
                                  func.__defaults__,
 
159
                                  func.__closure__)
 
160
 
 
161
 
115
162
def initlogger(debug, level=logging.WARNING):
116
163
    """init logger and add loglevel"""
117
 
    
 
164
 
118
165
    global syslogger
119
 
    syslogger = (logging.handlers.SysLogHandler
120
 
                 (facility =
121
 
                  logging.handlers.SysLogHandler.LOG_DAEMON,
122
 
                  address = "/dev/log"))
 
166
    syslogger = (logging.handlers.SysLogHandler(
 
167
        facility=logging.handlers.SysLogHandler.LOG_DAEMON,
 
168
        address="/dev/log"))
123
169
    syslogger.setFormatter(logging.Formatter
124
170
                           ('Mandos [%(process)d]: %(levelname)s:'
125
171
                            ' %(message)s'))
126
172
    logger.addHandler(syslogger)
127
 
    
 
173
 
128
174
    if debug:
129
175
        console = logging.StreamHandler()
130
176
        console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
140
186
    pass
141
187
 
142
188
 
143
 
class PGPEngine(object):
 
189
class PGPEngine:
144
190
    """A simple class for OpenPGP symmetric encryption & decryption"""
 
191
 
145
192
    def __init__(self):
146
193
        self.tempdir = tempfile.mkdtemp(prefix="mandos-")
 
194
        self.gpg = "gpg"
 
195
        try:
 
196
            output = subprocess.check_output(["gpgconf"])
 
197
            for line in output.splitlines():
 
198
                name, text, path = line.split(b":")
 
199
                if name == "gpg":
 
200
                    self.gpg = path
 
201
                    break
 
202
        except OSError as e:
 
203
            if e.errno != errno.ENOENT:
 
204
                raise
147
205
        self.gnupgargs = ['--batch',
148
 
                          '--home', self.tempdir,
 
206
                          '--homedir', self.tempdir,
149
207
                          '--force-mdc',
150
 
                          '--quiet',
151
 
                          '--no-use-agent']
152
 
    
 
208
                          '--quiet']
 
209
        # Only GPG version 1 has the --no-use-agent option.
 
210
        if self.gpg == "gpg" or self.gpg.endswith("/gpg"):
 
211
            self.gnupgargs.append("--no-use-agent")
 
212
 
153
213
    def __enter__(self):
154
214
        return self
155
 
    
 
215
 
156
216
    def __exit__(self, exc_type, exc_value, traceback):
157
217
        self._cleanup()
158
218
        return False
159
 
    
 
219
 
160
220
    def __del__(self):
161
221
        self._cleanup()
162
 
    
 
222
 
163
223
    def _cleanup(self):
164
224
        if self.tempdir is not None:
165
225
            # Delete contents of tempdir
166
226
            for root, dirs, files in os.walk(self.tempdir,
167
 
                                             topdown = False):
 
227
                                             topdown=False):
168
228
                for filename in files:
169
229
                    os.remove(os.path.join(root, filename))
170
230
                for dirname in dirs:
172
232
            # Remove tempdir
173
233
            os.rmdir(self.tempdir)
174
234
            self.tempdir = None
175
 
    
 
235
 
176
236
    def password_encode(self, password):
177
237
        # Passphrase can not be empty and can not contain newlines or
178
238
        # NUL bytes.  So we prefix it and hex encode it.
183
243
                       .replace(b"\n", b"\\n")
184
244
                       .replace(b"\0", b"\\x00"))
185
245
        return encoded
186
 
    
 
246
 
187
247
    def encrypt(self, data, password):
188
248
        passphrase = self.password_encode(password)
189
 
        with tempfile.NamedTemporaryFile(dir=self.tempdir
190
 
                                         ) as passfile:
 
249
        with tempfile.NamedTemporaryFile(
 
250
                dir=self.tempdir) as passfile:
191
251
            passfile.write(passphrase)
192
252
            passfile.flush()
193
 
            proc = subprocess.Popen(['gpg', '--symmetric',
 
253
            proc = subprocess.Popen([self.gpg, '--symmetric',
194
254
                                     '--passphrase-file',
195
255
                                     passfile.name]
196
256
                                    + self.gnupgargs,
197
 
                                    stdin = subprocess.PIPE,
198
 
                                    stdout = subprocess.PIPE,
199
 
                                    stderr = subprocess.PIPE)
200
 
            ciphertext, err = proc.communicate(input = data)
 
257
                                    stdin=subprocess.PIPE,
 
258
                                    stdout=subprocess.PIPE,
 
259
                                    stderr=subprocess.PIPE)
 
260
            ciphertext, err = proc.communicate(input=data)
201
261
        if proc.returncode != 0:
202
262
            raise PGPError(err)
203
263
        return ciphertext
204
 
    
 
264
 
205
265
    def decrypt(self, data, password):
206
266
        passphrase = self.password_encode(password)
207
 
        with tempfile.NamedTemporaryFile(dir = self.tempdir
208
 
                                         ) as passfile:
 
267
        with tempfile.NamedTemporaryFile(
 
268
                dir=self.tempdir) as passfile:
209
269
            passfile.write(passphrase)
210
270
            passfile.flush()
211
 
            proc = subprocess.Popen(['gpg', '--decrypt',
 
271
            proc = subprocess.Popen([self.gpg, '--decrypt',
212
272
                                     '--passphrase-file',
213
273
                                     passfile.name]
214
274
                                    + self.gnupgargs,
215
 
                                    stdin = subprocess.PIPE,
216
 
                                    stdout = subprocess.PIPE,
217
 
                                    stderr = subprocess.PIPE)
218
 
            decrypted_plaintext, err = proc.communicate(input
219
 
                                                        = data)
 
275
                                    stdin=subprocess.PIPE,
 
276
                                    stdout=subprocess.PIPE,
 
277
                                    stderr=subprocess.PIPE)
 
278
            decrypted_plaintext, err = proc.communicate(input=data)
220
279
        if proc.returncode != 0:
221
280
            raise PGPError(err)
222
281
        return decrypted_plaintext
223
282
 
224
283
 
 
284
# Pretend that we have an Avahi module
 
285
class avahi:
 
286
    """This isn't so much a class as it is a module-like namespace."""
 
287
    IF_UNSPEC = -1               # avahi-common/address.h
 
288
    PROTO_UNSPEC = -1            # avahi-common/address.h
 
289
    PROTO_INET = 0               # avahi-common/address.h
 
290
    PROTO_INET6 = 1              # avahi-common/address.h
 
291
    DBUS_NAME = "org.freedesktop.Avahi"
 
292
    DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"
 
293
    DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"
 
294
    DBUS_PATH_SERVER = "/"
 
295
 
 
296
    @staticmethod
 
297
    def string_array_to_txt_array(t):
 
298
        return dbus.Array((dbus.ByteArray(s.encode("utf-8"))
 
299
                           for s in t), signature="ay")
 
300
    ENTRY_GROUP_ESTABLISHED = 2  # avahi-common/defs.h
 
301
    ENTRY_GROUP_COLLISION = 3    # avahi-common/defs.h
 
302
    ENTRY_GROUP_FAILURE = 4      # avahi-common/defs.h
 
303
    SERVER_INVALID = 0           # avahi-common/defs.h
 
304
    SERVER_REGISTERING = 1       # avahi-common/defs.h
 
305
    SERVER_RUNNING = 2           # avahi-common/defs.h
 
306
    SERVER_COLLISION = 3         # avahi-common/defs.h
 
307
    SERVER_FAILURE = 4           # avahi-common/defs.h
 
308
 
 
309
 
225
310
class AvahiError(Exception):
226
311
    def __init__(self, value, *args, **kwargs):
227
312
        self.value = value
228
313
        return super(AvahiError, self).__init__(value, *args,
229
314
                                                **kwargs)
230
315
 
 
316
 
231
317
class AvahiServiceError(AvahiError):
232
318
    pass
233
319
 
 
320
 
234
321
class AvahiGroupError(AvahiError):
235
322
    pass
236
323
 
237
324
 
238
 
class AvahiService(object):
 
325
class AvahiService:
239
326
    """An Avahi (Zeroconf) service.
240
 
    
 
327
 
241
328
    Attributes:
242
329
    interface: integer; avahi.IF_UNSPEC or an interface index.
243
330
               Used to optionally bind to the specified interface.
255
342
    server: D-Bus Server
256
343
    bus: dbus.SystemBus()
257
344
    """
258
 
    
259
 
    def __init__(self, interface = avahi.IF_UNSPEC, name = None,
260
 
                 servicetype = None, port = None, TXT = None,
261
 
                 domain = "", host = "", max_renames = 32768,
262
 
                 protocol = avahi.PROTO_UNSPEC, bus = None):
 
345
 
 
346
    def __init__(self,
 
347
                 interface=avahi.IF_UNSPEC,
 
348
                 name=None,
 
349
                 servicetype=None,
 
350
                 port=None,
 
351
                 TXT=None,
 
352
                 domain="",
 
353
                 host="",
 
354
                 max_renames=32768,
 
355
                 protocol=avahi.PROTO_UNSPEC,
 
356
                 bus=None):
263
357
        self.interface = interface
264
358
        self.name = name
265
359
        self.type = servicetype
274
368
        self.server = None
275
369
        self.bus = bus
276
370
        self.entry_group_state_changed_match = None
277
 
    
278
 
    def rename(self):
 
371
 
 
372
    def rename(self, remove=True):
279
373
        """Derived from the Avahi example code"""
280
374
        if self.rename_count >= self.max_renames:
281
375
            logger.critical("No suitable Zeroconf service name found"
282
376
                            " after %i retries, exiting.",
283
377
                            self.rename_count)
284
378
            raise AvahiServiceError("Too many renames")
285
 
        self.name = str(self.server
286
 
                        .GetAlternativeServiceName(self.name))
 
379
        self.name = str(
 
380
            self.server.GetAlternativeServiceName(self.name))
 
381
        self.rename_count += 1
287
382
        logger.info("Changing Zeroconf service name to %r ...",
288
383
                    self.name)
289
 
        self.remove()
 
384
        if remove:
 
385
            self.remove()
290
386
        try:
291
387
            self.add()
292
388
        except dbus.exceptions.DBusException as error:
293
 
            logger.critical("D-Bus Exception", exc_info=error)
294
 
            self.cleanup()
295
 
            os._exit(1)
296
 
        self.rename_count += 1
297
 
    
 
389
            if (error.get_dbus_name()
 
390
                == "org.freedesktop.Avahi.CollisionError"):
 
391
                logger.info("Local Zeroconf service name collision.")
 
392
                return self.rename(remove=False)
 
393
            else:
 
394
                logger.critical("D-Bus Exception", exc_info=error)
 
395
                self.cleanup()
 
396
                os._exit(1)
 
397
 
298
398
    def remove(self):
299
399
        """Derived from the Avahi example code"""
300
400
        if self.entry_group_state_changed_match is not None:
302
402
            self.entry_group_state_changed_match = None
303
403
        if self.group is not None:
304
404
            self.group.Reset()
305
 
    
 
405
 
306
406
    def add(self):
307
407
        """Derived from the Avahi example code"""
308
408
        self.remove()
325
425
            dbus.UInt16(self.port),
326
426
            avahi.string_array_to_txt_array(self.TXT))
327
427
        self.group.Commit()
328
 
    
 
428
 
329
429
    def entry_group_state_changed(self, state, error):
330
430
        """Derived from the Avahi example code"""
331
431
        logger.debug("Avahi entry group state change: %i", state)
332
 
        
 
432
 
333
433
        if state == avahi.ENTRY_GROUP_ESTABLISHED:
334
434
            logger.debug("Zeroconf service established.")
335
435
        elif state == avahi.ENTRY_GROUP_COLLISION:
338
438
        elif state == avahi.ENTRY_GROUP_FAILURE:
339
439
            logger.critical("Avahi: Error in group state changed %s",
340
440
                            str(error))
341
 
            raise AvahiGroupError("State changed: {!s}"
342
 
                                  .format(error))
343
 
    
 
441
            raise AvahiGroupError("State changed: {!s}".format(error))
 
442
 
344
443
    def cleanup(self):
345
444
        """Derived from the Avahi example code"""
346
445
        if self.group is not None:
351
450
                pass
352
451
            self.group = None
353
452
        self.remove()
354
 
    
 
453
 
355
454
    def server_state_changed(self, state, error=None):
356
455
        """Derived from the Avahi example code"""
357
456
        logger.debug("Avahi server state change: %i", state)
358
 
        bad_states = { avahi.SERVER_INVALID:
359
 
                           "Zeroconf server invalid",
360
 
                       avahi.SERVER_REGISTERING: None,
361
 
                       avahi.SERVER_COLLISION:
362
 
                           "Zeroconf server name collision",
363
 
                       avahi.SERVER_FAILURE:
364
 
                           "Zeroconf server failure" }
 
457
        bad_states = {
 
458
            avahi.SERVER_INVALID: "Zeroconf server invalid",
 
459
            avahi.SERVER_REGISTERING: None,
 
460
            avahi.SERVER_COLLISION: "Zeroconf server name collision",
 
461
            avahi.SERVER_FAILURE: "Zeroconf server failure",
 
462
        }
365
463
        if state in bad_states:
366
464
            if bad_states[state] is not None:
367
465
                if error is None:
370
468
                    logger.error(bad_states[state] + ": %r", error)
371
469
            self.cleanup()
372
470
        elif state == avahi.SERVER_RUNNING:
373
 
            self.add()
 
471
            try:
 
472
                self.add()
 
473
            except dbus.exceptions.DBusException as error:
 
474
                if (error.get_dbus_name()
 
475
                    == "org.freedesktop.Avahi.CollisionError"):
 
476
                    logger.info("Local Zeroconf service name"
 
477
                                " collision.")
 
478
                    return self.rename(remove=False)
 
479
                else:
 
480
                    logger.critical("D-Bus Exception", exc_info=error)
 
481
                    self.cleanup()
 
482
                    os._exit(1)
374
483
        else:
375
484
            if error is None:
376
485
                logger.debug("Unknown state: %r", state)
377
486
            else:
378
487
                logger.debug("Unknown state: %r: %r", state, error)
379
 
    
 
488
 
380
489
    def activate(self):
381
490
        """Derived from the Avahi example code"""
382
491
        if self.server is None:
386
495
                                    follow_name_owner_changes=True),
387
496
                avahi.DBUS_INTERFACE_SERVER)
388
497
        self.server.connect_to_signal("StateChanged",
389
 
                                 self.server_state_changed)
 
498
                                      self.server_state_changed)
390
499
        self.server_state_changed(self.server.GetState())
391
500
 
392
501
 
393
502
class AvahiServiceToSyslog(AvahiService):
394
 
    def rename(self):
 
503
    def rename(self, *args, **kwargs):
395
504
        """Add the new name to the syslog messages"""
396
 
        ret = AvahiService.rename(self)
397
 
        syslogger.setFormatter(logging.Formatter
398
 
                               ('Mandos ({}) [%(process)d]:'
399
 
                                ' %(levelname)s: %(message)s'
400
 
                                .format(self.name)))
 
505
        ret = super(AvahiServiceToSyslog, self).rename(*args, **kwargs)
 
506
        syslogger.setFormatter(logging.Formatter(
 
507
            'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
 
508
            .format(self.name)))
401
509
        return ret
402
510
 
403
511
 
404
 
class Client(object):
 
512
# Pretend that we have a GnuTLS module
 
513
class gnutls:
 
514
    """This isn't so much a class as it is a module-like namespace."""
 
515
 
 
516
    library = ctypes.util.find_library("gnutls")
 
517
    if library is None:
 
518
        library = ctypes.util.find_library("gnutls-deb0")
 
519
    _library = ctypes.cdll.LoadLibrary(library)
 
520
    del library
 
521
 
 
522
    # Unless otherwise indicated, the constants and types below are
 
523
    # all from the gnutls/gnutls.h C header file.
 
524
 
 
525
    # Constants
 
526
    E_SUCCESS = 0
 
527
    E_INTERRUPTED = -52
 
528
    E_AGAIN = -28
 
529
    CRT_OPENPGP = 2
 
530
    CRT_RAWPK = 3
 
531
    CLIENT = 2
 
532
    SHUT_RDWR = 0
 
533
    CRD_CERTIFICATE = 1
 
534
    E_NO_CERTIFICATE_FOUND = -49
 
535
    X509_FMT_DER = 0
 
536
    NO_TICKETS = 1<<10
 
537
    ENABLE_RAWPK = 1<<18
 
538
    CTYPE_PEERS = 3
 
539
    KEYID_USE_SHA256 = 1        # gnutls/x509.h
 
540
    OPENPGP_FMT_RAW = 0         # gnutls/openpgp.h
 
541
 
 
542
    # Types
 
543
    class session_int(ctypes.Structure):
 
544
        _fields_ = []
 
545
    session_t = ctypes.POINTER(session_int)
 
546
 
 
547
    class certificate_credentials_st(ctypes.Structure):
 
548
        _fields_ = []
 
549
    certificate_credentials_t = ctypes.POINTER(
 
550
        certificate_credentials_st)
 
551
    certificate_type_t = ctypes.c_int
 
552
 
 
553
    class datum_t(ctypes.Structure):
 
554
        _fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
 
555
                    ('size', ctypes.c_uint)]
 
556
 
 
557
    class openpgp_crt_int(ctypes.Structure):
 
558
        _fields_ = []
 
559
    openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
 
560
    openpgp_crt_fmt_t = ctypes.c_int  # gnutls/openpgp.h
 
561
    log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
 
562
    credentials_type_t = ctypes.c_int
 
563
    transport_ptr_t = ctypes.c_void_p
 
564
    close_request_t = ctypes.c_int
 
565
 
 
566
    # Exceptions
 
567
    class Error(Exception):
 
568
        def __init__(self, message=None, code=None, args=()):
 
569
            # Default usage is by a message string, but if a return
 
570
            # code is passed, convert it to a string with
 
571
            # gnutls.strerror()
 
572
            self.code = code
 
573
            if message is None and code is not None:
 
574
                message = gnutls.strerror(code)
 
575
            return super(gnutls.Error, self).__init__(
 
576
                message, *args)
 
577
 
 
578
    class CertificateSecurityError(Error):
 
579
        pass
 
580
 
 
581
    # Classes
 
582
    class Credentials:
 
583
        def __init__(self):
 
584
            self._c_object = gnutls.certificate_credentials_t()
 
585
            gnutls.certificate_allocate_credentials(
 
586
                ctypes.byref(self._c_object))
 
587
            self.type = gnutls.CRD_CERTIFICATE
 
588
 
 
589
        def __del__(self):
 
590
            gnutls.certificate_free_credentials(self._c_object)
 
591
 
 
592
    class ClientSession:
 
593
        def __init__(self, socket, credentials=None):
 
594
            self._c_object = gnutls.session_t()
 
595
            gnutls_flags = gnutls.CLIENT
 
596
            if gnutls.check_version(b"3.5.6"):
 
597
                gnutls_flags |= gnutls.NO_TICKETS
 
598
            if gnutls.has_rawpk:
 
599
                gnutls_flags |= gnutls.ENABLE_RAWPK
 
600
            gnutls.init(ctypes.byref(self._c_object), gnutls_flags)
 
601
            del gnutls_flags
 
602
            gnutls.set_default_priority(self._c_object)
 
603
            gnutls.transport_set_ptr(self._c_object, socket.fileno())
 
604
            gnutls.handshake_set_private_extensions(self._c_object,
 
605
                                                    True)
 
606
            self.socket = socket
 
607
            if credentials is None:
 
608
                credentials = gnutls.Credentials()
 
609
            gnutls.credentials_set(self._c_object, credentials.type,
 
610
                                   ctypes.cast(credentials._c_object,
 
611
                                               ctypes.c_void_p))
 
612
            self.credentials = credentials
 
613
 
 
614
        def __del__(self):
 
615
            gnutls.deinit(self._c_object)
 
616
 
 
617
        def handshake(self):
 
618
            return gnutls.handshake(self._c_object)
 
619
 
 
620
        def send(self, data):
 
621
            data = bytes(data)
 
622
            data_len = len(data)
 
623
            while data_len > 0:
 
624
                data_len -= gnutls.record_send(self._c_object,
 
625
                                               data[-data_len:],
 
626
                                               data_len)
 
627
 
 
628
        def bye(self):
 
629
            return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
 
630
 
 
631
    # Error handling functions
 
632
    def _error_code(result):
 
633
        """A function to raise exceptions on errors, suitable
 
634
        for the 'restype' attribute on ctypes functions"""
 
635
        if result >= 0:
 
636
            return result
 
637
        if result == gnutls.E_NO_CERTIFICATE_FOUND:
 
638
            raise gnutls.CertificateSecurityError(code=result)
 
639
        raise gnutls.Error(code=result)
 
640
 
 
641
    def _retry_on_error(result, func, arguments):
 
642
        """A function to retry on some errors, suitable
 
643
        for the 'errcheck' attribute on ctypes functions"""
 
644
        while result < 0:
 
645
            if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
 
646
                return _error_code(result)
 
647
            result = func(*arguments)
 
648
        return result
 
649
 
 
650
    # Unless otherwise indicated, the function declarations below are
 
651
    # all from the gnutls/gnutls.h C header file.
 
652
 
 
653
    # Functions
 
654
    priority_set_direct = _library.gnutls_priority_set_direct
 
655
    priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
 
656
                                    ctypes.POINTER(ctypes.c_char_p)]
 
657
    priority_set_direct.restype = _error_code
 
658
 
 
659
    init = _library.gnutls_init
 
660
    init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
 
661
    init.restype = _error_code
 
662
 
 
663
    set_default_priority = _library.gnutls_set_default_priority
 
664
    set_default_priority.argtypes = [session_t]
 
665
    set_default_priority.restype = _error_code
 
666
 
 
667
    record_send = _library.gnutls_record_send
 
668
    record_send.argtypes = [session_t, ctypes.c_void_p,
 
669
                            ctypes.c_size_t]
 
670
    record_send.restype = ctypes.c_ssize_t
 
671
    record_send.errcheck = _retry_on_error
 
672
 
 
673
    certificate_allocate_credentials = (
 
674
        _library.gnutls_certificate_allocate_credentials)
 
675
    certificate_allocate_credentials.argtypes = [
 
676
        ctypes.POINTER(certificate_credentials_t)]
 
677
    certificate_allocate_credentials.restype = _error_code
 
678
 
 
679
    certificate_free_credentials = (
 
680
        _library.gnutls_certificate_free_credentials)
 
681
    certificate_free_credentials.argtypes = [
 
682
        certificate_credentials_t]
 
683
    certificate_free_credentials.restype = None
 
684
 
 
685
    handshake_set_private_extensions = (
 
686
        _library.gnutls_handshake_set_private_extensions)
 
687
    handshake_set_private_extensions.argtypes = [session_t,
 
688
                                                 ctypes.c_int]
 
689
    handshake_set_private_extensions.restype = None
 
690
 
 
691
    credentials_set = _library.gnutls_credentials_set
 
692
    credentials_set.argtypes = [session_t, credentials_type_t,
 
693
                                ctypes.c_void_p]
 
694
    credentials_set.restype = _error_code
 
695
 
 
696
    strerror = _library.gnutls_strerror
 
697
    strerror.argtypes = [ctypes.c_int]
 
698
    strerror.restype = ctypes.c_char_p
 
699
 
 
700
    certificate_type_get = _library.gnutls_certificate_type_get
 
701
    certificate_type_get.argtypes = [session_t]
 
702
    certificate_type_get.restype = _error_code
 
703
 
 
704
    certificate_get_peers = _library.gnutls_certificate_get_peers
 
705
    certificate_get_peers.argtypes = [session_t,
 
706
                                      ctypes.POINTER(ctypes.c_uint)]
 
707
    certificate_get_peers.restype = ctypes.POINTER(datum_t)
 
708
 
 
709
    global_set_log_level = _library.gnutls_global_set_log_level
 
710
    global_set_log_level.argtypes = [ctypes.c_int]
 
711
    global_set_log_level.restype = None
 
712
 
 
713
    global_set_log_function = _library.gnutls_global_set_log_function
 
714
    global_set_log_function.argtypes = [log_func]
 
715
    global_set_log_function.restype = None
 
716
 
 
717
    deinit = _library.gnutls_deinit
 
718
    deinit.argtypes = [session_t]
 
719
    deinit.restype = None
 
720
 
 
721
    handshake = _library.gnutls_handshake
 
722
    handshake.argtypes = [session_t]
 
723
    handshake.restype = _error_code
 
724
    handshake.errcheck = _retry_on_error
 
725
 
 
726
    transport_set_ptr = _library.gnutls_transport_set_ptr
 
727
    transport_set_ptr.argtypes = [session_t, transport_ptr_t]
 
728
    transport_set_ptr.restype = None
 
729
 
 
730
    bye = _library.gnutls_bye
 
731
    bye.argtypes = [session_t, close_request_t]
 
732
    bye.restype = _error_code
 
733
    bye.errcheck = _retry_on_error
 
734
 
 
735
    check_version = _library.gnutls_check_version
 
736
    check_version.argtypes = [ctypes.c_char_p]
 
737
    check_version.restype = ctypes.c_char_p
 
738
 
 
739
    _need_version = b"3.3.0"
 
740
    if check_version(_need_version) is None:
 
741
        raise self.Error("Needs GnuTLS {} or later"
 
742
                         .format(_need_version))
 
743
 
 
744
    _tls_rawpk_version = b"3.6.6"
 
745
    has_rawpk = bool(check_version(_tls_rawpk_version))
 
746
 
 
747
    if has_rawpk:
 
748
        # Types
 
749
        class pubkey_st(ctypes.Structure):
 
750
            _fields = []
 
751
        pubkey_t = ctypes.POINTER(pubkey_st)
 
752
 
 
753
        x509_crt_fmt_t = ctypes.c_int
 
754
 
 
755
        # All the function declarations below are from gnutls/abstract.h
 
756
        pubkey_init = _library.gnutls_pubkey_init
 
757
        pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]
 
758
        pubkey_init.restype = _error_code
 
759
 
 
760
        pubkey_import = _library.gnutls_pubkey_import
 
761
        pubkey_import.argtypes = [pubkey_t, ctypes.POINTER(datum_t),
 
762
                                  x509_crt_fmt_t]
 
763
        pubkey_import.restype = _error_code
 
764
 
 
765
        pubkey_get_key_id = _library.gnutls_pubkey_get_key_id
 
766
        pubkey_get_key_id.argtypes = [pubkey_t, ctypes.c_int,
 
767
                                      ctypes.POINTER(ctypes.c_ubyte),
 
768
                                      ctypes.POINTER(ctypes.c_size_t)]
 
769
        pubkey_get_key_id.restype = _error_code
 
770
 
 
771
        pubkey_deinit = _library.gnutls_pubkey_deinit
 
772
        pubkey_deinit.argtypes = [pubkey_t]
 
773
        pubkey_deinit.restype = None
 
774
    else:
 
775
        # All the function declarations below are from gnutls/openpgp.h
 
776
 
 
777
        openpgp_crt_init = _library.gnutls_openpgp_crt_init
 
778
        openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
 
779
        openpgp_crt_init.restype = _error_code
 
780
 
 
781
        openpgp_crt_import = _library.gnutls_openpgp_crt_import
 
782
        openpgp_crt_import.argtypes = [openpgp_crt_t,
 
783
                                       ctypes.POINTER(datum_t),
 
784
                                       openpgp_crt_fmt_t]
 
785
        openpgp_crt_import.restype = _error_code
 
786
 
 
787
        openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
 
788
        openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
 
789
                                            ctypes.POINTER(ctypes.c_uint)]
 
790
        openpgp_crt_verify_self.restype = _error_code
 
791
 
 
792
        openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
 
793
        openpgp_crt_deinit.argtypes = [openpgp_crt_t]
 
794
        openpgp_crt_deinit.restype = None
 
795
 
 
796
        openpgp_crt_get_fingerprint = (
 
797
            _library.gnutls_openpgp_crt_get_fingerprint)
 
798
        openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
 
799
                                                ctypes.c_void_p,
 
800
                                                ctypes.POINTER(
 
801
                                                    ctypes.c_size_t)]
 
802
        openpgp_crt_get_fingerprint.restype = _error_code
 
803
 
 
804
    if check_version(b"3.6.4"):
 
805
        certificate_type_get2 = _library.gnutls_certificate_type_get2
 
806
        certificate_type_get2.argtypes = [session_t, ctypes.c_int]
 
807
        certificate_type_get2.restype = _error_code
 
808
 
 
809
    # Remove non-public functions
 
810
    del _error_code, _retry_on_error
 
811
 
 
812
 
 
813
def call_pipe(connection,       # : multiprocessing.Connection
 
814
              func, *args, **kwargs):
 
815
    """This function is meant to be called by multiprocessing.Process
 
816
 
 
817
    This function runs func(*args, **kwargs), and writes the resulting
 
818
    return value on the provided multiprocessing.Connection.
 
819
    """
 
820
    connection.send(func(*args, **kwargs))
 
821
    connection.close()
 
822
 
 
823
 
 
824
class Client:
405
825
    """A representation of a client host served by this server.
406
 
    
 
826
 
407
827
    Attributes:
408
828
    approved:   bool(); 'None' if not yet approved/disapproved
409
829
    approval_delay: datetime.timedelta(); Time to wait for approval
410
830
    approval_duration: datetime.timedelta(); Duration of one approval
411
 
    checker:    subprocess.Popen(); a running checker process used
412
 
                                    to see if the client lives.
413
 
                                    'None' if no process is running.
414
 
    checker_callback_tag: a gobject event source tag, or None
 
831
    checker: multiprocessing.Process(); a running checker process used
 
832
             to see if the client lives. 'None' if no process is
 
833
             running.
 
834
    checker_callback_tag: a GLib event source tag, or None
415
835
    checker_command: string; External command which is run to check
416
836
                     if client lives.  %() expansions are done at
417
837
                     runtime with vars(self) as dict, so that for
418
838
                     instance %(name)s can be used in the command.
419
 
    checker_initiator_tag: a gobject event source tag, or None
 
839
    checker_initiator_tag: a GLib event source tag, or None
420
840
    created:    datetime.datetime(); (UTC) object creation
421
841
    client_structure: Object describing what attributes a client has
422
842
                      and is used for storing the client at exit
423
843
    current_checker_command: string; current running checker_command
424
 
    disable_initiator_tag: a gobject event source tag, or None
 
844
    disable_initiator_tag: a GLib event source tag, or None
425
845
    enabled:    bool()
426
846
    fingerprint: string (40 or 32 hexadecimal digits); used to
427
 
                 uniquely identify the client
 
847
                 uniquely identify an OpenPGP client
 
848
    key_id: string (64 hexadecimal digits); used to uniquely identify
 
849
            a client using raw public keys
428
850
    host:       string; available for use by the checker command
429
851
    interval:   datetime.timedelta(); How often to start a new checker
430
852
    last_approval_request: datetime.datetime(); (UTC) or None
432
854
    last_checker_status: integer between 0 and 255 reflecting exit
433
855
                         status of last checker. -1 reflects crashed
434
856
                         checker, -2 means no checker completed yet.
 
857
    last_checker_signal: The signal which killed the last checker, if
 
858
                         last_checker_status is -1
435
859
    last_enabled: datetime.datetime(); (UTC) or None
436
860
    name:       string; from the config file, used in log messages and
437
861
                        D-Bus identifiers
444
868
                disabled, or None
445
869
    server_settings: The server_settings dict from main()
446
870
    """
447
 
    
 
871
 
448
872
    runtime_expansions = ("approval_delay", "approval_duration",
449
 
                          "created", "enabled", "expires",
 
873
                          "created", "enabled", "expires", "key_id",
450
874
                          "fingerprint", "host", "interval",
451
875
                          "last_approval_request", "last_checked_ok",
452
876
                          "last_enabled", "name", "timeout")
453
 
    client_defaults = { "timeout": "PT5M",
454
 
                        "extended_timeout": "PT15M",
455
 
                        "interval": "PT2M",
456
 
                        "checker": "fping -q -- %%(host)s",
457
 
                        "host": "",
458
 
                        "approval_delay": "PT0S",
459
 
                        "approval_duration": "PT1S",
460
 
                        "approved_by_default": "True",
461
 
                        "enabled": "True",
462
 
                        }
463
 
    
 
877
    client_defaults = {
 
878
        "timeout": "PT5M",
 
879
        "extended_timeout": "PT15M",
 
880
        "interval": "PT2M",
 
881
        "checker": "fping -q -- %%(host)s",
 
882
        "host": "",
 
883
        "approval_delay": "PT0S",
 
884
        "approval_duration": "PT1S",
 
885
        "approved_by_default": "True",
 
886
        "enabled": "True",
 
887
    }
 
888
 
464
889
    @staticmethod
465
890
    def config_parser(config):
466
891
        """Construct a new dict of client settings of this form:
473
898
        for client_name in config.sections():
474
899
            section = dict(config.items(client_name))
475
900
            client = settings[client_name] = {}
476
 
            
 
901
 
477
902
            client["host"] = section["host"]
478
903
            # Reformat values from string types to Python types
479
904
            client["approved_by_default"] = config.getboolean(
480
905
                client_name, "approved_by_default")
481
906
            client["enabled"] = config.getboolean(client_name,
482
907
                                                  "enabled")
483
 
            
 
908
 
 
909
            # Uppercase and remove spaces from key_id and fingerprint
 
910
            # for later comparison purposes with return value from the
 
911
            # key_id() and fingerprint() functions
 
912
            client["key_id"] = (section.get("key_id", "").upper()
 
913
                                .replace(" ", ""))
484
914
            client["fingerprint"] = (section["fingerprint"].upper()
485
915
                                     .replace(" ", ""))
486
916
            if "secret" in section:
487
 
                client["secret"] = section["secret"].decode("base64")
 
917
                client["secret"] = codecs.decode(section["secret"]
 
918
                                                 .encode("utf-8"),
 
919
                                                 "base64")
488
920
            elif "secfile" in section:
489
921
                with open(os.path.expanduser(os.path.expandvars
490
922
                                             (section["secfile"])),
505
937
            client["last_approval_request"] = None
506
938
            client["last_checked_ok"] = None
507
939
            client["last_checker_status"] = -2
508
 
        
 
940
 
509
941
        return settings
510
 
    
511
 
    def __init__(self, settings, name = None, server_settings=None):
 
942
 
 
943
    def __init__(self, settings, name=None, server_settings=None):
512
944
        self.name = name
513
945
        if server_settings is None:
514
946
            server_settings = {}
516
948
        # adding all client settings
517
949
        for setting, value in settings.items():
518
950
            setattr(self, setting, value)
519
 
        
 
951
 
520
952
        if self.enabled:
521
953
            if not hasattr(self, "last_enabled"):
522
954
                self.last_enabled = datetime.datetime.utcnow()
526
958
        else:
527
959
            self.last_enabled = None
528
960
            self.expires = None
529
 
        
 
961
 
530
962
        logger.debug("Creating client %r", self.name)
531
 
        # Uppercase and remove spaces from fingerprint for later
532
 
        # comparison purposes with return value from the fingerprint()
533
 
        # function
 
963
        logger.debug("  Key ID: %s", self.key_id)
534
964
        logger.debug("  Fingerprint: %s", self.fingerprint)
535
965
        self.created = settings.get("created",
536
966
                                    datetime.datetime.utcnow())
537
 
        
 
967
 
538
968
        # attributes specific for this server instance
539
969
        self.checker = None
540
970
        self.checker_initiator_tag = None
543
973
        self.current_checker_command = None
544
974
        self.approved = None
545
975
        self.approvals_pending = 0
546
 
        self.changedstate = (multiprocessing_manager
547
 
                             .Condition(multiprocessing_manager
548
 
                                        .Lock()))
549
 
        self.client_structure = [attr for attr in
550
 
                                 self.__dict__.iterkeys()
 
976
        self.changedstate = multiprocessing_manager.Condition(
 
977
            multiprocessing_manager.Lock())
 
978
        self.client_structure = [attr
 
979
                                 for attr in self.__dict__.keys()
551
980
                                 if not attr.startswith("_")]
552
981
        self.client_structure.append("client_structure")
553
 
        
554
 
        for name, t in inspect.getmembers(type(self),
555
 
                                          lambda obj:
556
 
                                              isinstance(obj,
557
 
                                                         property)):
 
982
 
 
983
        for name, t in inspect.getmembers(
 
984
                type(self), lambda obj: isinstance(obj, property)):
558
985
            if not name.startswith("_"):
559
986
                self.client_structure.append(name)
560
 
    
 
987
 
561
988
    # Send notice to process children that client state has changed
562
989
    def send_changedstate(self):
563
990
        with self.changedstate:
564
991
            self.changedstate.notify_all()
565
 
    
 
992
 
566
993
    def enable(self):
567
994
        """Start this client's checker and timeout hooks"""
568
995
        if getattr(self, "enabled", False):
573
1000
        self.last_enabled = datetime.datetime.utcnow()
574
1001
        self.init_checker()
575
1002
        self.send_changedstate()
576
 
    
 
1003
 
577
1004
    def disable(self, quiet=True):
578
1005
        """Disable this client."""
579
1006
        if not getattr(self, "enabled", False):
581
1008
        if not quiet:
582
1009
            logger.info("Disabling client %s", self.name)
583
1010
        if getattr(self, "disable_initiator_tag", None) is not None:
584
 
            gobject.source_remove(self.disable_initiator_tag)
 
1011
            GLib.source_remove(self.disable_initiator_tag)
585
1012
            self.disable_initiator_tag = None
586
1013
        self.expires = None
587
1014
        if getattr(self, "checker_initiator_tag", None) is not None:
588
 
            gobject.source_remove(self.checker_initiator_tag)
 
1015
            GLib.source_remove(self.checker_initiator_tag)
589
1016
            self.checker_initiator_tag = None
590
1017
        self.stop_checker()
591
1018
        self.enabled = False
592
1019
        if not quiet:
593
1020
            self.send_changedstate()
594
 
        # Do not run this again if called by a gobject.timeout_add
 
1021
        # Do not run this again if called by a GLib.timeout_add
595
1022
        return False
596
 
    
 
1023
 
597
1024
    def __del__(self):
598
1025
        self.disable()
599
 
    
 
1026
 
600
1027
    def init_checker(self):
601
1028
        # Schedule a new checker to be started an 'interval' from now,
602
1029
        # and every interval from then on.
603
1030
        if self.checker_initiator_tag is not None:
604
 
            gobject.source_remove(self.checker_initiator_tag)
605
 
        self.checker_initiator_tag = (gobject.timeout_add
606
 
                                      (int(self.interval
607
 
                                           .total_seconds() * 1000),
608
 
                                       self.start_checker))
 
1031
            GLib.source_remove(self.checker_initiator_tag)
 
1032
        self.checker_initiator_tag = GLib.timeout_add(
 
1033
            int(self.interval.total_seconds() * 1000),
 
1034
            self.start_checker)
609
1035
        # Schedule a disable() when 'timeout' has passed
610
1036
        if self.disable_initiator_tag is not None:
611
 
            gobject.source_remove(self.disable_initiator_tag)
612
 
        self.disable_initiator_tag = (gobject.timeout_add
613
 
                                      (int(self.timeout
614
 
                                           .total_seconds() * 1000),
615
 
                                       self.disable))
 
1037
            GLib.source_remove(self.disable_initiator_tag)
 
1038
        self.disable_initiator_tag = GLib.timeout_add(
 
1039
            int(self.timeout.total_seconds() * 1000), self.disable)
616
1040
        # Also start a new checker *right now*.
617
1041
        self.start_checker()
618
 
    
619
 
    def checker_callback(self, pid, condition, command):
 
1042
 
 
1043
    def checker_callback(self, source, condition, connection,
 
1044
                         command):
620
1045
        """The checker has completed, so take appropriate actions."""
 
1046
        # Read return code from connection (see call_pipe)
 
1047
        returncode = connection.recv()
 
1048
        connection.close()
 
1049
        self.checker.join()
621
1050
        self.checker_callback_tag = None
622
1051
        self.checker = None
623
 
        if os.WIFEXITED(condition):
624
 
            self.last_checker_status = os.WEXITSTATUS(condition)
 
1052
 
 
1053
        if returncode >= 0:
 
1054
            self.last_checker_status = returncode
 
1055
            self.last_checker_signal = None
625
1056
            if self.last_checker_status == 0:
626
1057
                logger.info("Checker for %(name)s succeeded",
627
1058
                            vars(self))
628
1059
                self.checked_ok()
629
1060
            else:
630
 
                logger.info("Checker for %(name)s failed",
631
 
                            vars(self))
 
1061
                logger.info("Checker for %(name)s failed", vars(self))
632
1062
        else:
633
1063
            self.last_checker_status = -1
 
1064
            self.last_checker_signal = -returncode
634
1065
            logger.warning("Checker for %(name)s crashed?",
635
1066
                           vars(self))
636
 
    
 
1067
        return False
 
1068
 
637
1069
    def checked_ok(self):
638
1070
        """Assert that the client has been seen, alive and well."""
639
1071
        self.last_checked_ok = datetime.datetime.utcnow()
640
1072
        self.last_checker_status = 0
 
1073
        self.last_checker_signal = None
641
1074
        self.bump_timeout()
642
 
    
 
1075
 
643
1076
    def bump_timeout(self, timeout=None):
644
1077
        """Bump up the timeout for this client."""
645
1078
        if timeout is None:
646
1079
            timeout = self.timeout
647
1080
        if self.disable_initiator_tag is not None:
648
 
            gobject.source_remove(self.disable_initiator_tag)
 
1081
            GLib.source_remove(self.disable_initiator_tag)
649
1082
            self.disable_initiator_tag = None
650
1083
        if getattr(self, "enabled", False):
651
 
            self.disable_initiator_tag = (gobject.timeout_add
652
 
                                          (int(timeout.total_seconds()
653
 
                                               * 1000), self.disable))
 
1084
            self.disable_initiator_tag = GLib.timeout_add(
 
1085
                int(timeout.total_seconds() * 1000), self.disable)
654
1086
            self.expires = datetime.datetime.utcnow() + timeout
655
 
    
 
1087
 
656
1088
    def need_approval(self):
657
1089
        self.last_approval_request = datetime.datetime.utcnow()
658
 
    
 
1090
 
659
1091
    def start_checker(self):
660
1092
        """Start a new checker subprocess if one is not running.
661
 
        
 
1093
 
662
1094
        If a checker already exists, leave it running and do
663
1095
        nothing."""
664
1096
        # The reason for not killing a running checker is that if we
669
1101
        # checkers alone, the checker would have to take more time
670
1102
        # than 'timeout' for the client to be disabled, which is as it
671
1103
        # should be.
672
 
        
673
 
        # If a checker exists, make sure it is not a zombie
674
 
        try:
675
 
            pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
676
 
        except AttributeError:
677
 
            pass
678
 
        except OSError as error:
679
 
            if error.errno != errno.ECHILD:
680
 
                raise
681
 
        else:
682
 
            if pid:
683
 
                logger.warning("Checker was a zombie")
684
 
                gobject.source_remove(self.checker_callback_tag)
685
 
                self.checker_callback(pid, status,
686
 
                                      self.current_checker_command)
 
1104
 
 
1105
        if self.checker is not None and not self.checker.is_alive():
 
1106
            logger.warning("Checker was not alive; joining")
 
1107
            self.checker.join()
 
1108
            self.checker = None
687
1109
        # Start a new checker if needed
688
1110
        if self.checker is None:
689
1111
            # Escape attributes for the shell
690
 
            escaped_attrs = { attr:
691
 
                                  re.escape(str(getattr(self, attr)))
692
 
                              for attr in self.runtime_expansions }
 
1112
            escaped_attrs = {
 
1113
                attr: re.escape(str(getattr(self, attr)))
 
1114
                for attr in self.runtime_expansions}
693
1115
            try:
694
1116
                command = self.checker_command % escaped_attrs
695
1117
            except TypeError as error:
696
1118
                logger.error('Could not format string "%s"',
697
 
                             self.checker_command, exc_info=error)
698
 
                return True # Try again later
 
1119
                             self.checker_command,
 
1120
                             exc_info=error)
 
1121
                return True     # Try again later
699
1122
            self.current_checker_command = command
700
 
            try:
701
 
                logger.info("Starting checker %r for %s",
702
 
                            command, self.name)
703
 
                # We don't need to redirect stdout and stderr, since
704
 
                # in normal mode, that is already done by daemon(),
705
 
                # and in debug mode we don't want to.  (Stdin is
706
 
                # always replaced by /dev/null.)
707
 
                # The exception is when not debugging but nevertheless
708
 
                # running in the foreground; use the previously
709
 
                # created wnull.
710
 
                popen_args = {}
711
 
                if (not self.server_settings["debug"]
712
 
                    and self.server_settings["foreground"]):
713
 
                    popen_args.update({"stdout": wnull,
714
 
                                       "stderr": wnull })
715
 
                self.checker = subprocess.Popen(command,
716
 
                                                close_fds=True,
717
 
                                                shell=True, cwd="/",
718
 
                                                **popen_args)
719
 
            except OSError as error:
720
 
                logger.error("Failed to start subprocess",
721
 
                             exc_info=error)
722
 
                return True
723
 
            self.checker_callback_tag = (gobject.child_watch_add
724
 
                                         (self.checker.pid,
725
 
                                          self.checker_callback,
726
 
                                          data=command))
727
 
            # The checker may have completed before the gobject
728
 
            # watch was added.  Check for this.
729
 
            try:
730
 
                pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
731
 
            except OSError as error:
732
 
                if error.errno == errno.ECHILD:
733
 
                    # This should never happen
734
 
                    logger.error("Child process vanished",
735
 
                                 exc_info=error)
736
 
                    return True
737
 
                raise
738
 
            if pid:
739
 
                gobject.source_remove(self.checker_callback_tag)
740
 
                self.checker_callback(pid, status, command)
741
 
        # Re-run this periodically if run by gobject.timeout_add
 
1123
            logger.info("Starting checker %r for %s", command,
 
1124
                        self.name)
 
1125
            # We don't need to redirect stdout and stderr, since
 
1126
            # in normal mode, that is already done by daemon(),
 
1127
            # and in debug mode we don't want to.  (Stdin is
 
1128
            # always replaced by /dev/null.)
 
1129
            # The exception is when not debugging but nevertheless
 
1130
            # running in the foreground; use the previously
 
1131
            # created wnull.
 
1132
            popen_args = {"close_fds": True,
 
1133
                          "shell": True,
 
1134
                          "cwd": "/"}
 
1135
            if (not self.server_settings["debug"]
 
1136
                and self.server_settings["foreground"]):
 
1137
                popen_args.update({"stdout": wnull,
 
1138
                                   "stderr": wnull})
 
1139
            pipe = multiprocessing.Pipe(duplex=False)
 
1140
            self.checker = multiprocessing.Process(
 
1141
                target=call_pipe,
 
1142
                args=(pipe[1], subprocess.call, command),
 
1143
                kwargs=popen_args)
 
1144
            self.checker.start()
 
1145
            self.checker_callback_tag = GLib.io_add_watch(
 
1146
                pipe[0].fileno(), GLib.IO_IN,
 
1147
                self.checker_callback, pipe[0], command)
 
1148
        # Re-run this periodically if run by GLib.timeout_add
742
1149
        return True
743
 
    
 
1150
 
744
1151
    def stop_checker(self):
745
1152
        """Force the checker process, if any, to stop."""
746
1153
        if self.checker_callback_tag:
747
 
            gobject.source_remove(self.checker_callback_tag)
 
1154
            GLib.source_remove(self.checker_callback_tag)
748
1155
            self.checker_callback_tag = None
749
1156
        if getattr(self, "checker", None) is None:
750
1157
            return
751
1158
        logger.debug("Stopping checker for %(name)s", vars(self))
752
 
        try:
753
 
            self.checker.terminate()
754
 
            #time.sleep(0.5)
755
 
            #if self.checker.poll() is None:
756
 
            #    self.checker.kill()
757
 
        except OSError as error:
758
 
            if error.errno != errno.ESRCH: # No such process
759
 
                raise
 
1159
        self.checker.terminate()
760
1160
        self.checker = None
761
1161
 
762
1162
 
763
 
def dbus_service_property(dbus_interface, signature="v",
764
 
                          access="readwrite", byte_arrays=False):
 
1163
def dbus_service_property(dbus_interface,
 
1164
                          signature="v",
 
1165
                          access="readwrite",
 
1166
                          byte_arrays=False):
765
1167
    """Decorators for marking methods of a DBusObjectWithProperties to
766
1168
    become properties on the D-Bus.
767
 
    
 
1169
 
768
1170
    The decorated method will be called with no arguments by "Get"
769
1171
    and with one argument by "Set".
770
 
    
 
1172
 
771
1173
    The parameters, where they are supported, are the same as
772
1174
    dbus.service.method, except there is only "signature", since the
773
1175
    type from Get() and the type sent to Set() is the same.
777
1179
    if byte_arrays and signature != "ay":
778
1180
        raise ValueError("Byte arrays not supported for non-'ay'"
779
1181
                         " signature {!r}".format(signature))
 
1182
 
780
1183
    def decorator(func):
781
1184
        func._dbus_is_property = True
782
1185
        func._dbus_interface = dbus_interface
785
1188
        func._dbus_name = func.__name__
786
1189
        if func._dbus_name.endswith("_dbus_property"):
787
1190
            func._dbus_name = func._dbus_name[:-14]
788
 
        func._dbus_get_args_options = {'byte_arrays': byte_arrays }
 
1191
        func._dbus_get_args_options = {'byte_arrays': byte_arrays}
789
1192
        return func
 
1193
 
790
1194
    return decorator
791
1195
 
792
1196
 
793
1197
def dbus_interface_annotations(dbus_interface):
794
1198
    """Decorator for marking functions returning interface annotations
795
 
    
 
1199
 
796
1200
    Usage:
797
 
    
 
1201
 
798
1202
    @dbus_interface_annotations("org.example.Interface")
799
1203
    def _foo(self):  # Function name does not matter
800
1204
        return {"org.freedesktop.DBus.Deprecated": "true",
801
1205
                "org.freedesktop.DBus.Property.EmitsChangedSignal":
802
1206
                    "false"}
803
1207
    """
 
1208
 
804
1209
    def decorator(func):
805
1210
        func._dbus_is_interface = True
806
1211
        func._dbus_interface = dbus_interface
807
1212
        func._dbus_name = dbus_interface
808
1213
        return func
 
1214
 
809
1215
    return decorator
810
1216
 
811
1217
 
812
1218
def dbus_annotations(annotations):
813
1219
    """Decorator to annotate D-Bus methods, signals or properties
814
1220
    Usage:
815
 
    
 
1221
 
 
1222
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",
 
1223
                       "org.freedesktop.DBus.Property."
 
1224
                       "EmitsChangedSignal": "false"})
816
1225
    @dbus_service_property("org.example.Interface", signature="b",
817
1226
                           access="r")
818
 
    @dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",
819
 
                        "org.freedesktop.DBus.Property."
820
 
                        "EmitsChangedSignal": "false"})
821
1227
    def Property_dbus_property(self):
822
1228
        return dbus.Boolean(False)
 
1229
 
 
1230
    See also the DBusObjectWithAnnotations class.
823
1231
    """
 
1232
 
824
1233
    def decorator(func):
825
1234
        func._dbus_annotations = annotations
826
1235
        return func
 
1236
 
827
1237
    return decorator
828
1238
 
829
1239
 
832
1242
    """
833
1243
    pass
834
1244
 
 
1245
 
835
1246
class DBusPropertyAccessException(DBusPropertyException):
836
1247
    """A property's access permissions disallows an operation.
837
1248
    """
844
1255
    pass
845
1256
 
846
1257
 
847
 
class DBusObjectWithProperties(dbus.service.Object):
848
 
    """A D-Bus object with properties.
849
 
    
850
 
    Classes inheriting from this can use the dbus_service_property
851
 
    decorator to expose methods as D-Bus properties.  It exposes the
852
 
    standard Get(), Set(), and GetAll() methods on the D-Bus.
 
1258
class DBusObjectWithAnnotations(dbus.service.Object):
 
1259
    """A D-Bus object with annotations.
 
1260
 
 
1261
    Classes inheriting from this can use the dbus_annotations
 
1262
    decorator to add annotations to methods or signals.
853
1263
    """
854
 
    
 
1264
 
855
1265
    @staticmethod
856
1266
    def _is_dbus_thing(thing):
857
1267
        """Returns a function testing if an attribute is a D-Bus thing
858
 
        
 
1268
 
859
1269
        If called like _is_dbus_thing("method") it returns a function
860
1270
        suitable for use as predicate to inspect.getmembers().
861
1271
        """
862
1272
        return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
863
1273
                                   False)
864
 
    
 
1274
 
865
1275
    def _get_all_dbus_things(self, thing):
866
1276
        """Returns a generator of (name, attribute) pairs
867
1277
        """
868
 
        return ((getattr(athing.__get__(self), "_dbus_name",
869
 
                         name),
 
1278
        return ((getattr(athing.__get__(self), "_dbus_name", name),
870
1279
                 athing.__get__(self))
871
1280
                for cls in self.__class__.__mro__
872
1281
                for name, athing in
873
 
                inspect.getmembers(cls,
874
 
                                   self._is_dbus_thing(thing)))
875
 
    
 
1282
                inspect.getmembers(cls, self._is_dbus_thing(thing)))
 
1283
 
 
1284
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
 
1285
                         out_signature="s",
 
1286
                         path_keyword='object_path',
 
1287
                         connection_keyword='connection')
 
1288
    def Introspect(self, object_path, connection):
 
1289
        """Overloading of standard D-Bus method.
 
1290
 
 
1291
        Inserts annotation tags on methods and signals.
 
1292
        """
 
1293
        xmlstring = dbus.service.Object.Introspect(self, object_path,
 
1294
                                                   connection)
 
1295
        try:
 
1296
            document = xml.dom.minidom.parseString(xmlstring)
 
1297
 
 
1298
            for if_tag in document.getElementsByTagName("interface"):
 
1299
                # Add annotation tags
 
1300
                for typ in ("method", "signal"):
 
1301
                    for tag in if_tag.getElementsByTagName(typ):
 
1302
                        annots = dict()
 
1303
                        for name, prop in (self.
 
1304
                                           _get_all_dbus_things(typ)):
 
1305
                            if (name == tag.getAttribute("name")
 
1306
                                and prop._dbus_interface
 
1307
                                == if_tag.getAttribute("name")):
 
1308
                                annots.update(getattr(
 
1309
                                    prop, "_dbus_annotations", {}))
 
1310
                        for name, value in annots.items():
 
1311
                            ann_tag = document.createElement(
 
1312
                                "annotation")
 
1313
                            ann_tag.setAttribute("name", name)
 
1314
                            ann_tag.setAttribute("value", value)
 
1315
                            tag.appendChild(ann_tag)
 
1316
                # Add interface annotation tags
 
1317
                for annotation, value in dict(
 
1318
                    itertools.chain.from_iterable(
 
1319
                        annotations().items()
 
1320
                        for name, annotations
 
1321
                        in self._get_all_dbus_things("interface")
 
1322
                        if name == if_tag.getAttribute("name")
 
1323
                        )).items():
 
1324
                    ann_tag = document.createElement("annotation")
 
1325
                    ann_tag.setAttribute("name", annotation)
 
1326
                    ann_tag.setAttribute("value", value)
 
1327
                    if_tag.appendChild(ann_tag)
 
1328
                # Fix argument name for the Introspect method itself
 
1329
                if (if_tag.getAttribute("name")
 
1330
                    == dbus.INTROSPECTABLE_IFACE):
 
1331
                    for cn in if_tag.getElementsByTagName("method"):
 
1332
                        if cn.getAttribute("name") == "Introspect":
 
1333
                            for arg in cn.getElementsByTagName("arg"):
 
1334
                                if (arg.getAttribute("direction")
 
1335
                                    == "out"):
 
1336
                                    arg.setAttribute("name",
 
1337
                                                     "xml_data")
 
1338
            xmlstring = document.toxml("utf-8")
 
1339
            document.unlink()
 
1340
        except (AttributeError, xml.dom.DOMException,
 
1341
                xml.parsers.expat.ExpatError) as error:
 
1342
            logger.error("Failed to override Introspection method",
 
1343
                         exc_info=error)
 
1344
        return xmlstring
 
1345
 
 
1346
 
 
1347
class DBusObjectWithProperties(DBusObjectWithAnnotations):
 
1348
    """A D-Bus object with properties.
 
1349
 
 
1350
    Classes inheriting from this can use the dbus_service_property
 
1351
    decorator to expose methods as D-Bus properties.  It exposes the
 
1352
    standard Get(), Set(), and GetAll() methods on the D-Bus.
 
1353
    """
 
1354
 
876
1355
    def _get_dbus_property(self, interface_name, property_name):
877
1356
        """Returns a bound method if one exists which is a D-Bus
878
1357
        property with the specified name and interface.
879
1358
        """
880
 
        for cls in  self.__class__.__mro__:
881
 
            for name, value in (inspect.getmembers
882
 
                                (cls,
883
 
                                 self._is_dbus_thing("property"))):
 
1359
        for cls in self.__class__.__mro__:
 
1360
            for name, value in inspect.getmembers(
 
1361
                    cls, self._is_dbus_thing("property")):
884
1362
                if (value._dbus_name == property_name
885
1363
                    and value._dbus_interface == interface_name):
886
1364
                    return value.__get__(self)
887
 
        
 
1365
 
888
1366
        # No such property
889
 
        raise DBusPropertyNotFound(self.dbus_object_path + ":"
890
 
                                   + interface_name + "."
891
 
                                   + property_name)
892
 
    
893
 
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
 
1367
        raise DBusPropertyNotFound("{}:{}.{}".format(
 
1368
            self.dbus_object_path, interface_name, property_name))
 
1369
 
 
1370
    @classmethod
 
1371
    def _get_all_interface_names(cls):
 
1372
        """Get a sequence of all interfaces supported by an object"""
 
1373
        return (name for name in set(getattr(getattr(x, attr),
 
1374
                                             "_dbus_interface", None)
 
1375
                                     for x in (inspect.getmro(cls))
 
1376
                                     for attr in dir(x))
 
1377
                if name is not None)
 
1378
 
 
1379
    @dbus.service.method(dbus.PROPERTIES_IFACE,
 
1380
                         in_signature="ss",
894
1381
                         out_signature="v")
895
1382
    def Get(self, interface_name, property_name):
896
1383
        """Standard D-Bus property Get() method, see D-Bus standard.
902
1389
        if not hasattr(value, "variant_level"):
903
1390
            return value
904
1391
        return type(value)(value, variant_level=value.variant_level+1)
905
 
    
 
1392
 
906
1393
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
907
1394
    def Set(self, interface_name, property_name, value):
908
1395
        """Standard D-Bus property Set() method, see D-Bus standard.
920
1407
            value = dbus.ByteArray(b''.join(chr(byte)
921
1408
                                            for byte in value))
922
1409
        prop(value)
923
 
    
924
 
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
 
1410
 
 
1411
    @dbus.service.method(dbus.PROPERTIES_IFACE,
 
1412
                         in_signature="s",
925
1413
                         out_signature="a{sv}")
926
1414
    def GetAll(self, interface_name):
927
1415
        """Standard D-Bus property GetAll() method, see D-Bus
928
1416
        standard.
929
 
        
 
1417
 
930
1418
        Note: Will not include properties with access="write".
931
1419
        """
932
1420
        properties = {}
942
1430
            if not hasattr(value, "variant_level"):
943
1431
                properties[name] = value
944
1432
                continue
945
 
            properties[name] = type(value)(value, variant_level=
946
 
                                           value.variant_level+1)
 
1433
            properties[name] = type(value)(
 
1434
                value, variant_level=value.variant_level + 1)
947
1435
        return dbus.Dictionary(properties, signature="sv")
948
 
    
 
1436
 
 
1437
    @dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")
 
1438
    def PropertiesChanged(self, interface_name, changed_properties,
 
1439
                          invalidated_properties):
 
1440
        """Standard D-Bus PropertiesChanged() signal, see D-Bus
 
1441
        standard.
 
1442
        """
 
1443
        pass
 
1444
 
949
1445
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
950
1446
                         out_signature="s",
951
1447
                         path_keyword='object_path',
952
1448
                         connection_keyword='connection')
953
1449
    def Introspect(self, object_path, connection):
954
1450
        """Overloading of standard D-Bus method.
955
 
        
 
1451
 
956
1452
        Inserts property tags and interface annotation tags.
957
1453
        """
958
 
        xmlstring = dbus.service.Object.Introspect(self, object_path,
959
 
                                                   connection)
 
1454
        xmlstring = DBusObjectWithAnnotations.Introspect(self,
 
1455
                                                         object_path,
 
1456
                                                         connection)
960
1457
        try:
961
1458
            document = xml.dom.minidom.parseString(xmlstring)
 
1459
 
962
1460
            def make_tag(document, name, prop):
963
1461
                e = document.createElement("property")
964
1462
                e.setAttribute("name", name)
965
1463
                e.setAttribute("type", prop._dbus_signature)
966
1464
                e.setAttribute("access", prop._dbus_access)
967
1465
                return e
 
1466
 
968
1467
            for if_tag in document.getElementsByTagName("interface"):
969
1468
                # Add property tags
970
1469
                for tag in (make_tag(document, name, prop)
973
1472
                            if prop._dbus_interface
974
1473
                            == if_tag.getAttribute("name")):
975
1474
                    if_tag.appendChild(tag)
976
 
                # Add annotation tags
977
 
                for typ in ("method", "signal", "property"):
978
 
                    for tag in if_tag.getElementsByTagName(typ):
979
 
                        annots = dict()
980
 
                        for name, prop in (self.
981
 
                                           _get_all_dbus_things(typ)):
982
 
                            if (name == tag.getAttribute("name")
983
 
                                and prop._dbus_interface
984
 
                                == if_tag.getAttribute("name")):
985
 
                                annots.update(getattr
986
 
                                              (prop,
987
 
                                               "_dbus_annotations",
988
 
                                               {}))
989
 
                        for name, value in annots.items():
990
 
                            ann_tag = document.createElement(
991
 
                                "annotation")
992
 
                            ann_tag.setAttribute("name", name)
993
 
                            ann_tag.setAttribute("value", value)
994
 
                            tag.appendChild(ann_tag)
995
 
                # Add interface annotation tags
996
 
                for annotation, value in dict(
997
 
                    itertools.chain.from_iterable(
998
 
                        annotations().items()
999
 
                        for name, annotations in
1000
 
                        self._get_all_dbus_things("interface")
1001
 
                        if name == if_tag.getAttribute("name")
1002
 
                        )).items():
1003
 
                    ann_tag = document.createElement("annotation")
1004
 
                    ann_tag.setAttribute("name", annotation)
1005
 
                    ann_tag.setAttribute("value", value)
1006
 
                    if_tag.appendChild(ann_tag)
 
1475
                # Add annotation tags for properties
 
1476
                for tag in if_tag.getElementsByTagName("property"):
 
1477
                    annots = dict()
 
1478
                    for name, prop in self._get_all_dbus_things(
 
1479
                            "property"):
 
1480
                        if (name == tag.getAttribute("name")
 
1481
                            and prop._dbus_interface
 
1482
                            == if_tag.getAttribute("name")):
 
1483
                            annots.update(getattr(
 
1484
                                prop, "_dbus_annotations", {}))
 
1485
                    for name, value in annots.items():
 
1486
                        ann_tag = document.createElement(
 
1487
                            "annotation")
 
1488
                        ann_tag.setAttribute("name", name)
 
1489
                        ann_tag.setAttribute("value", value)
 
1490
                        tag.appendChild(ann_tag)
1007
1491
                # Add the names to the return values for the
1008
1492
                # "org.freedesktop.DBus.Properties" methods
1009
1493
                if (if_tag.getAttribute("name")
1028
1512
        return xmlstring
1029
1513
 
1030
1514
 
 
1515
try:
 
1516
    dbus.OBJECT_MANAGER_IFACE
 
1517
except AttributeError:
 
1518
    dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
 
1519
 
 
1520
 
 
1521
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
 
1522
    """A D-Bus object with an ObjectManager.
 
1523
 
 
1524
    Classes inheriting from this exposes the standard
 
1525
    GetManagedObjects call and the InterfacesAdded and
 
1526
    InterfacesRemoved signals on the standard
 
1527
    "org.freedesktop.DBus.ObjectManager" interface.
 
1528
 
 
1529
    Note: No signals are sent automatically; they must be sent
 
1530
    manually.
 
1531
    """
 
1532
    @dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
 
1533
                         out_signature="a{oa{sa{sv}}}")
 
1534
    def GetManagedObjects(self):
 
1535
        """This function must be overridden"""
 
1536
        raise NotImplementedError()
 
1537
 
 
1538
    @dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
 
1539
                         signature="oa{sa{sv}}")
 
1540
    def InterfacesAdded(self, object_path, interfaces_and_properties):
 
1541
        pass
 
1542
 
 
1543
    @dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature="oas")
 
1544
    def InterfacesRemoved(self, object_path, interfaces):
 
1545
        pass
 
1546
 
 
1547
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
 
1548
                         out_signature="s",
 
1549
                         path_keyword='object_path',
 
1550
                         connection_keyword='connection')
 
1551
    def Introspect(self, object_path, connection):
 
1552
        """Overloading of standard D-Bus method.
 
1553
 
 
1554
        Override return argument name of GetManagedObjects to be
 
1555
        "objpath_interfaces_and_properties"
 
1556
        """
 
1557
        xmlstring = DBusObjectWithAnnotations.Introspect(self,
 
1558
                                                         object_path,
 
1559
                                                         connection)
 
1560
        try:
 
1561
            document = xml.dom.minidom.parseString(xmlstring)
 
1562
 
 
1563
            for if_tag in document.getElementsByTagName("interface"):
 
1564
                # Fix argument name for the GetManagedObjects method
 
1565
                if (if_tag.getAttribute("name")
 
1566
                    == dbus.OBJECT_MANAGER_IFACE):
 
1567
                    for cn in if_tag.getElementsByTagName("method"):
 
1568
                        if (cn.getAttribute("name")
 
1569
                            == "GetManagedObjects"):
 
1570
                            for arg in cn.getElementsByTagName("arg"):
 
1571
                                if (arg.getAttribute("direction")
 
1572
                                    == "out"):
 
1573
                                    arg.setAttribute(
 
1574
                                        "name",
 
1575
                                        "objpath_interfaces"
 
1576
                                        "_and_properties")
 
1577
            xmlstring = document.toxml("utf-8")
 
1578
            document.unlink()
 
1579
        except (AttributeError, xml.dom.DOMException,
 
1580
                xml.parsers.expat.ExpatError) as error:
 
1581
            logger.error("Failed to override Introspection method",
 
1582
                         exc_info=error)
 
1583
        return xmlstring
 
1584
 
 
1585
 
1031
1586
def datetime_to_dbus(dt, variant_level=0):
1032
1587
    """Convert a UTC datetime.datetime() to a D-Bus type."""
1033
1588
    if dt is None:
1034
 
        return dbus.String("", variant_level = variant_level)
1035
 
    return dbus.String(dt.isoformat(),
1036
 
                       variant_level=variant_level)
 
1589
        return dbus.String("", variant_level=variant_level)
 
1590
    return dbus.String(dt.isoformat(), variant_level=variant_level)
1037
1591
 
1038
1592
 
1039
1593
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
1041
1595
    dbus.service.Object, it will add alternate D-Bus attributes with
1042
1596
    interface names according to the "alt_interface_names" mapping.
1043
1597
    Usage:
1044
 
    
 
1598
 
1045
1599
    @alternate_dbus_interfaces({"org.example.Interface":
1046
1600
                                    "net.example.AlternateInterface"})
1047
1601
    class SampleDBusObject(dbus.service.Object):
1048
1602
        @dbus.service.method("org.example.Interface")
1049
1603
        def SampleDBusMethod():
1050
1604
            pass
1051
 
    
 
1605
 
1052
1606
    The above "SampleDBusMethod" on "SampleDBusObject" will be
1053
1607
    reachable via two interfaces: "org.example.Interface" and
1054
1608
    "net.example.AlternateInterface", the latter of which will have
1055
1609
    its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
1056
1610
    "true", unless "deprecate" is passed with a False value.
1057
 
    
 
1611
 
1058
1612
    This works for methods and signals, and also for D-Bus properties
1059
1613
    (from DBusObjectWithProperties) and interfaces (from the
1060
1614
    dbus_interface_annotations decorator).
1061
1615
    """
 
1616
 
1062
1617
    def wrapper(cls):
1063
1618
        for orig_interface_name, alt_interface_name in (
1064
 
            alt_interface_names.items()):
 
1619
                alt_interface_names.items()):
1065
1620
            attr = {}
1066
1621
            interface_names = set()
1067
1622
            # Go though all attributes of the class
1069
1624
                # Ignore non-D-Bus attributes, and D-Bus attributes
1070
1625
                # with the wrong interface name
1071
1626
                if (not hasattr(attribute, "_dbus_interface")
1072
 
                    or not attribute._dbus_interface
1073
 
                    .startswith(orig_interface_name)):
 
1627
                    or not attribute._dbus_interface.startswith(
 
1628
                        orig_interface_name)):
1074
1629
                    continue
1075
1630
                # Create an alternate D-Bus interface name based on
1076
1631
                # the current name
1077
 
                alt_interface = (attribute._dbus_interface
1078
 
                                 .replace(orig_interface_name,
1079
 
                                          alt_interface_name))
 
1632
                alt_interface = attribute._dbus_interface.replace(
 
1633
                    orig_interface_name, alt_interface_name)
1080
1634
                interface_names.add(alt_interface)
1081
1635
                # Is this a D-Bus signal?
1082
1636
                if getattr(attribute, "_dbus_is_signal", False):
1083
1637
                    # Extract the original non-method undecorated
1084
1638
                    # function by black magic
1085
 
                    nonmethod_func = (dict(
 
1639
                    if sys.version_info.major == 2:
 
1640
                        nonmethod_func = (dict(
1086
1641
                            zip(attribute.func_code.co_freevars,
1087
 
                                attribute.__closure__))["func"]
1088
 
                                      .cell_contents)
 
1642
                                attribute.__closure__))
 
1643
                                          ["func"].cell_contents)
 
1644
                    else:
 
1645
                        nonmethod_func = (dict(
 
1646
                            zip(attribute.__code__.co_freevars,
 
1647
                                attribute.__closure__))
 
1648
                                          ["func"].cell_contents)
1089
1649
                    # Create a new, but exactly alike, function
1090
1650
                    # object, and decorate it to be a new D-Bus signal
1091
1651
                    # with the alternate D-Bus interface name
1092
 
                    new_function = (dbus.service.signal
1093
 
                                    (alt_interface,
1094
 
                                     attribute._dbus_signature)
1095
 
                                    (types.FunctionType(
1096
 
                                nonmethod_func.func_code,
1097
 
                                nonmethod_func.func_globals,
1098
 
                                nonmethod_func.func_name,
1099
 
                                nonmethod_func.func_defaults,
1100
 
                                nonmethod_func.func_closure)))
 
1652
                    new_function = copy_function(nonmethod_func)
 
1653
                    new_function = (dbus.service.signal(
 
1654
                        alt_interface,
 
1655
                        attribute._dbus_signature)(new_function))
1101
1656
                    # Copy annotations, if any
1102
1657
                    try:
1103
 
                        new_function._dbus_annotations = (
1104
 
                            dict(attribute._dbus_annotations))
 
1658
                        new_function._dbus_annotations = dict(
 
1659
                            attribute._dbus_annotations)
1105
1660
                    except AttributeError:
1106
1661
                        pass
 
1662
 
1107
1663
                    # Define a creator of a function to call both the
1108
1664
                    # original and alternate functions, so both the
1109
1665
                    # original and alternate signals gets sent when
1112
1668
                        """This function is a scope container to pass
1113
1669
                        func1 and func2 to the "call_both" function
1114
1670
                        outside of its arguments"""
 
1671
 
 
1672
                        @functools.wraps(func2)
1115
1673
                        def call_both(*args, **kwargs):
1116
1674
                            """This function will emit two D-Bus
1117
1675
                            signals by calling func1 and func2"""
1118
1676
                            func1(*args, **kwargs)
1119
1677
                            func2(*args, **kwargs)
 
1678
                        # Make wrapper function look like a D-Bus
 
1679
                        # signal
 
1680
                        for name, attr in inspect.getmembers(func2):
 
1681
                            if name.startswith("_dbus_"):
 
1682
                                setattr(call_both, name, attr)
 
1683
 
1120
1684
                        return call_both
1121
1685
                    # Create the "call_both" function and add it to
1122
1686
                    # the class
1127
1691
                    # object.  Decorate it to be a new D-Bus method
1128
1692
                    # with the alternate D-Bus interface name.  Add it
1129
1693
                    # to the class.
1130
 
                    attr[attrname] = (dbus.service.method
1131
 
                                      (alt_interface,
1132
 
                                       attribute._dbus_in_signature,
1133
 
                                       attribute._dbus_out_signature)
1134
 
                                      (types.FunctionType
1135
 
                                       (attribute.func_code,
1136
 
                                        attribute.func_globals,
1137
 
                                        attribute.func_name,
1138
 
                                        attribute.func_defaults,
1139
 
                                        attribute.func_closure)))
 
1694
                    attr[attrname] = (
 
1695
                        dbus.service.method(
 
1696
                            alt_interface,
 
1697
                            attribute._dbus_in_signature,
 
1698
                            attribute._dbus_out_signature)
 
1699
                        (copy_function(attribute)))
1140
1700
                    # Copy annotations, if any
1141
1701
                    try:
1142
 
                        attr[attrname]._dbus_annotations = (
1143
 
                            dict(attribute._dbus_annotations))
 
1702
                        attr[attrname]._dbus_annotations = dict(
 
1703
                            attribute._dbus_annotations)
1144
1704
                    except AttributeError:
1145
1705
                        pass
1146
1706
                # Is this a D-Bus property?
1149
1709
                    # object, and decorate it to be a new D-Bus
1150
1710
                    # property with the alternate D-Bus interface
1151
1711
                    # name.  Add it to the class.
1152
 
                    attr[attrname] = (dbus_service_property
1153
 
                                      (alt_interface,
1154
 
                                       attribute._dbus_signature,
1155
 
                                       attribute._dbus_access,
1156
 
                                       attribute
1157
 
                                       ._dbus_get_args_options
1158
 
                                       ["byte_arrays"])
1159
 
                                      (types.FunctionType
1160
 
                                       (attribute.func_code,
1161
 
                                        attribute.func_globals,
1162
 
                                        attribute.func_name,
1163
 
                                        attribute.func_defaults,
1164
 
                                        attribute.func_closure)))
 
1712
                    attr[attrname] = (dbus_service_property(
 
1713
                        alt_interface, attribute._dbus_signature,
 
1714
                        attribute._dbus_access,
 
1715
                        attribute._dbus_get_args_options
 
1716
                        ["byte_arrays"])
 
1717
                                      (copy_function(attribute)))
1165
1718
                    # Copy annotations, if any
1166
1719
                    try:
1167
 
                        attr[attrname]._dbus_annotations = (
1168
 
                            dict(attribute._dbus_annotations))
 
1720
                        attr[attrname]._dbus_annotations = dict(
 
1721
                            attribute._dbus_annotations)
1169
1722
                    except AttributeError:
1170
1723
                        pass
1171
1724
                # Is this a D-Bus interface?
1174
1727
                    # object.  Decorate it to be a new D-Bus interface
1175
1728
                    # with the alternate D-Bus interface name.  Add it
1176
1729
                    # to the class.
1177
 
                    attr[attrname] = (dbus_interface_annotations
1178
 
                                      (alt_interface)
1179
 
                                      (types.FunctionType
1180
 
                                       (attribute.func_code,
1181
 
                                        attribute.func_globals,
1182
 
                                        attribute.func_name,
1183
 
                                        attribute.func_defaults,
1184
 
                                        attribute.func_closure)))
 
1730
                    attr[attrname] = (
 
1731
                        dbus_interface_annotations(alt_interface)
 
1732
                        (copy_function(attribute)))
1185
1733
            if deprecate:
1186
1734
                # Deprecate all alternate interfaces
1187
 
                iname="_AlternateDBusNames_interface_annotation{}"
 
1735
                iname = "_AlternateDBusNames_interface_annotation{}"
1188
1736
                for interface_name in interface_names:
 
1737
 
1189
1738
                    @dbus_interface_annotations(interface_name)
1190
1739
                    def func(self):
1191
 
                        return { "org.freedesktop.DBus.Deprecated":
1192
 
                                     "true" }
 
1740
                        return {"org.freedesktop.DBus.Deprecated":
 
1741
                                "true"}
1193
1742
                    # Find an unused name
1194
1743
                    for aname in (iname.format(i)
1195
1744
                                  for i in itertools.count()):
1199
1748
            if interface_names:
1200
1749
                # Replace the class with a new subclass of it with
1201
1750
                # methods, signals, etc. as created above.
1202
 
                cls = type(b"{}Alternate".format(cls.__name__),
1203
 
                           (cls,), attr)
 
1751
                if sys.version_info.major == 2:
 
1752
                    cls = type(b"{}Alternate".format(cls.__name__),
 
1753
                               (cls, ), attr)
 
1754
                else:
 
1755
                    cls = type("{}Alternate".format(cls.__name__),
 
1756
                               (cls, ), attr)
1204
1757
        return cls
 
1758
 
1205
1759
    return wrapper
1206
1760
 
1207
1761
 
1208
1762
@alternate_dbus_interfaces({"se.recompile.Mandos":
1209
 
                                "se.bsnet.fukt.Mandos"})
 
1763
                            "se.bsnet.fukt.Mandos"})
1210
1764
class ClientDBus(Client, DBusObjectWithProperties):
1211
1765
    """A Client class using D-Bus
1212
 
    
 
1766
 
1213
1767
    Attributes:
1214
1768
    dbus_object_path: dbus.ObjectPath
1215
1769
    bus: dbus.SystemBus()
1216
1770
    """
1217
 
    
 
1771
 
1218
1772
    runtime_expansions = (Client.runtime_expansions
1219
 
                          + ("dbus_object_path",))
1220
 
    
 
1773
                          + ("dbus_object_path", ))
 
1774
 
 
1775
    _interface = "se.recompile.Mandos.Client"
 
1776
 
1221
1777
    # dbus.service.Object doesn't use super(), so we can't either.
1222
 
    
1223
 
    def __init__(self, bus = None, *args, **kwargs):
 
1778
 
 
1779
    def __init__(self, bus=None, *args, **kwargs):
1224
1780
        self.bus = bus
1225
1781
        Client.__init__(self, *args, **kwargs)
1226
1782
        # Only now, when this client is initialized, can it show up on
1228
1784
        client_object_name = str(self.name).translate(
1229
1785
            {ord("."): ord("_"),
1230
1786
             ord("-"): ord("_")})
1231
 
        self.dbus_object_path = (dbus.ObjectPath
1232
 
                                 ("/clients/" + client_object_name))
 
1787
        self.dbus_object_path = dbus.ObjectPath(
 
1788
            "/clients/" + client_object_name)
1233
1789
        DBusObjectWithProperties.__init__(self, self.bus,
1234
1790
                                          self.dbus_object_path)
1235
 
    
1236
 
    def notifychangeproperty(transform_func,
1237
 
                             dbus_name, type_func=lambda x: x,
1238
 
                             variant_level=1):
 
1791
 
 
1792
    def notifychangeproperty(transform_func, dbus_name,
 
1793
                             type_func=lambda x: x,
 
1794
                             variant_level=1,
 
1795
                             invalidate_only=False,
 
1796
                             _interface=_interface):
1239
1797
        """ Modify a variable so that it's a property which announces
1240
1798
        its changes to DBus.
1241
 
        
 
1799
 
1242
1800
        transform_fun: Function that takes a value and a variant_level
1243
1801
                       and transforms it to a D-Bus type.
1244
1802
        dbus_name: D-Bus name of the variable
1247
1805
        variant_level: D-Bus variant level.  Default: 1
1248
1806
        """
1249
1807
        attrname = "_{}".format(dbus_name)
 
1808
 
1250
1809
        def setter(self, value):
1251
1810
            if hasattr(self, "dbus_object_path"):
1252
1811
                if (not hasattr(self, attrname) or
1253
1812
                    type_func(getattr(self, attrname, None))
1254
1813
                    != type_func(value)):
1255
 
                    dbus_value = transform_func(type_func(value),
1256
 
                                                variant_level
1257
 
                                                =variant_level)
1258
 
                    self.PropertyChanged(dbus.String(dbus_name),
1259
 
                                         dbus_value)
 
1814
                    if invalidate_only:
 
1815
                        self.PropertiesChanged(
 
1816
                            _interface, dbus.Dictionary(),
 
1817
                            dbus.Array((dbus_name, )))
 
1818
                    else:
 
1819
                        dbus_value = transform_func(
 
1820
                            type_func(value),
 
1821
                            variant_level=variant_level)
 
1822
                        self.PropertyChanged(dbus.String(dbus_name),
 
1823
                                             dbus_value)
 
1824
                        self.PropertiesChanged(
 
1825
                            _interface,
 
1826
                            dbus.Dictionary({dbus.String(dbus_name):
 
1827
                                             dbus_value}),
 
1828
                            dbus.Array())
1260
1829
            setattr(self, attrname, value)
1261
 
        
 
1830
 
1262
1831
        return property(lambda self: getattr(self, attrname), setter)
1263
 
    
 
1832
 
1264
1833
    expires = notifychangeproperty(datetime_to_dbus, "Expires")
1265
1834
    approvals_pending = notifychangeproperty(dbus.Boolean,
1266
1835
                                             "ApprovalPending",
1267
 
                                             type_func = bool)
 
1836
                                             type_func=bool)
1268
1837
    enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1269
1838
    last_enabled = notifychangeproperty(datetime_to_dbus,
1270
1839
                                        "LastEnabled")
1271
 
    checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",
1272
 
                                   type_func = lambda checker:
1273
 
                                       checker is not None)
 
1840
    checker = notifychangeproperty(
 
1841
        dbus.Boolean, "CheckerRunning",
 
1842
        type_func=lambda checker: checker is not None)
1274
1843
    last_checked_ok = notifychangeproperty(datetime_to_dbus,
1275
1844
                                           "LastCheckedOK")
1276
1845
    last_checker_status = notifychangeproperty(dbus.Int16,
1279
1848
        datetime_to_dbus, "LastApprovalRequest")
1280
1849
    approved_by_default = notifychangeproperty(dbus.Boolean,
1281
1850
                                               "ApprovedByDefault")
1282
 
    approval_delay = notifychangeproperty(dbus.UInt64,
1283
 
                                          "ApprovalDelay",
1284
 
                                          type_func =
1285
 
                                          lambda td: td.total_seconds()
1286
 
                                          * 1000)
 
1851
    approval_delay = notifychangeproperty(
 
1852
        dbus.UInt64, "ApprovalDelay",
 
1853
        type_func=lambda td: td.total_seconds() * 1000)
1287
1854
    approval_duration = notifychangeproperty(
1288
1855
        dbus.UInt64, "ApprovalDuration",
1289
 
        type_func = lambda td: td.total_seconds() * 1000)
 
1856
        type_func=lambda td: td.total_seconds() * 1000)
1290
1857
    host = notifychangeproperty(dbus.String, "Host")
1291
 
    timeout = notifychangeproperty(dbus.UInt64, "Timeout",
1292
 
                                   type_func = lambda td:
1293
 
                                       td.total_seconds() * 1000)
 
1858
    timeout = notifychangeproperty(
 
1859
        dbus.UInt64, "Timeout",
 
1860
        type_func=lambda td: td.total_seconds() * 1000)
1294
1861
    extended_timeout = notifychangeproperty(
1295
1862
        dbus.UInt64, "ExtendedTimeout",
1296
 
        type_func = lambda td: td.total_seconds() * 1000)
1297
 
    interval = notifychangeproperty(dbus.UInt64,
1298
 
                                    "Interval",
1299
 
                                    type_func =
1300
 
                                    lambda td: td.total_seconds()
1301
 
                                    * 1000)
 
1863
        type_func=lambda td: td.total_seconds() * 1000)
 
1864
    interval = notifychangeproperty(
 
1865
        dbus.UInt64, "Interval",
 
1866
        type_func=lambda td: td.total_seconds() * 1000)
1302
1867
    checker_command = notifychangeproperty(dbus.String, "Checker")
1303
 
    
 
1868
    secret = notifychangeproperty(dbus.ByteArray, "Secret",
 
1869
                                  invalidate_only=True)
 
1870
 
1304
1871
    del notifychangeproperty
1305
 
    
 
1872
 
1306
1873
    def __del__(self, *args, **kwargs):
1307
1874
        try:
1308
1875
            self.remove_from_connection()
1311
1878
        if hasattr(DBusObjectWithProperties, "__del__"):
1312
1879
            DBusObjectWithProperties.__del__(self, *args, **kwargs)
1313
1880
        Client.__del__(self, *args, **kwargs)
1314
 
    
1315
 
    def checker_callback(self, pid, condition, command,
1316
 
                         *args, **kwargs):
1317
 
        self.checker_callback_tag = None
1318
 
        self.checker = None
1319
 
        if os.WIFEXITED(condition):
1320
 
            exitstatus = os.WEXITSTATUS(condition)
 
1881
 
 
1882
    def checker_callback(self, source, condition,
 
1883
                         connection, command, *args, **kwargs):
 
1884
        ret = Client.checker_callback(self, source, condition,
 
1885
                                      connection, command, *args,
 
1886
                                      **kwargs)
 
1887
        exitstatus = self.last_checker_status
 
1888
        if exitstatus >= 0:
1321
1889
            # Emit D-Bus signal
1322
1890
            self.CheckerCompleted(dbus.Int16(exitstatus),
1323
 
                                  dbus.Int64(condition),
 
1891
                                  # This is specific to GNU libC
 
1892
                                  dbus.Int64(exitstatus << 8),
1324
1893
                                  dbus.String(command))
1325
1894
        else:
1326
1895
            # Emit D-Bus signal
1327
1896
            self.CheckerCompleted(dbus.Int16(-1),
1328
 
                                  dbus.Int64(condition),
 
1897
                                  dbus.Int64(
 
1898
                                      # This is specific to GNU libC
 
1899
                                      (exitstatus << 8)
 
1900
                                      | self.last_checker_signal),
1329
1901
                                  dbus.String(command))
1330
 
        
1331
 
        return Client.checker_callback(self, pid, condition, command,
1332
 
                                       *args, **kwargs)
1333
 
    
 
1902
        return ret
 
1903
 
1334
1904
    def start_checker(self, *args, **kwargs):
1335
1905
        old_checker_pid = getattr(self.checker, "pid", None)
1336
1906
        r = Client.start_checker(self, *args, **kwargs)
1340
1910
            # Emit D-Bus signal
1341
1911
            self.CheckerStarted(self.current_checker_command)
1342
1912
        return r
1343
 
    
 
1913
 
1344
1914
    def _reset_approved(self):
1345
1915
        self.approved = None
1346
1916
        return False
1347
 
    
 
1917
 
1348
1918
    def approve(self, value=True):
1349
1919
        self.approved = value
1350
 
        gobject.timeout_add(int(self.approval_duration.total_seconds()
1351
 
                                * 1000), self._reset_approved)
 
1920
        GLib.timeout_add(int(self.approval_duration.total_seconds()
 
1921
                             * 1000), self._reset_approved)
1352
1922
        self.send_changedstate()
1353
 
    
1354
 
    ## D-Bus methods, signals & properties
1355
 
    _interface = "se.recompile.Mandos.Client"
1356
 
    
1357
 
    ## Interfaces
1358
 
    
1359
 
    @dbus_interface_annotations(_interface)
1360
 
    def _foo(self):
1361
 
        return { "org.freedesktop.DBus.Property.EmitsChangedSignal":
1362
 
                     "false"}
1363
 
    
1364
 
    ## Signals
1365
 
    
 
1923
 
 
1924
    #  D-Bus methods, signals & properties
 
1925
 
 
1926
    #  Interfaces
 
1927
 
 
1928
    #  Signals
 
1929
 
1366
1930
    # CheckerCompleted - signal
1367
1931
    @dbus.service.signal(_interface, signature="nxs")
1368
1932
    def CheckerCompleted(self, exitcode, waitstatus, command):
1369
1933
        "D-Bus signal"
1370
1934
        pass
1371
 
    
 
1935
 
1372
1936
    # CheckerStarted - signal
1373
1937
    @dbus.service.signal(_interface, signature="s")
1374
1938
    def CheckerStarted(self, command):
1375
1939
        "D-Bus signal"
1376
1940
        pass
1377
 
    
 
1941
 
1378
1942
    # PropertyChanged - signal
 
1943
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1379
1944
    @dbus.service.signal(_interface, signature="sv")
1380
1945
    def PropertyChanged(self, property, value):
1381
1946
        "D-Bus signal"
1382
1947
        pass
1383
 
    
 
1948
 
1384
1949
    # GotSecret - signal
1385
1950
    @dbus.service.signal(_interface)
1386
1951
    def GotSecret(self):
1389
1954
        server to mandos-client
1390
1955
        """
1391
1956
        pass
1392
 
    
 
1957
 
1393
1958
    # Rejected - signal
1394
1959
    @dbus.service.signal(_interface, signature="s")
1395
1960
    def Rejected(self, reason):
1396
1961
        "D-Bus signal"
1397
1962
        pass
1398
 
    
 
1963
 
1399
1964
    # NeedApproval - signal
1400
1965
    @dbus.service.signal(_interface, signature="tb")
1401
1966
    def NeedApproval(self, timeout, default):
1402
1967
        "D-Bus signal"
1403
1968
        return self.need_approval()
1404
 
    
1405
 
    ## Methods
1406
 
    
 
1969
 
 
1970
    #  Methods
 
1971
 
1407
1972
    # Approve - method
1408
1973
    @dbus.service.method(_interface, in_signature="b")
1409
1974
    def Approve(self, value):
1410
1975
        self.approve(value)
1411
 
    
 
1976
 
1412
1977
    # CheckedOK - method
1413
1978
    @dbus.service.method(_interface)
1414
1979
    def CheckedOK(self):
1415
1980
        self.checked_ok()
1416
 
    
 
1981
 
1417
1982
    # Enable - method
 
1983
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1418
1984
    @dbus.service.method(_interface)
1419
1985
    def Enable(self):
1420
1986
        "D-Bus method"
1421
1987
        self.enable()
1422
 
    
 
1988
 
1423
1989
    # StartChecker - method
 
1990
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1424
1991
    @dbus.service.method(_interface)
1425
1992
    def StartChecker(self):
1426
1993
        "D-Bus method"
1427
1994
        self.start_checker()
1428
 
    
 
1995
 
1429
1996
    # Disable - method
 
1997
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1430
1998
    @dbus.service.method(_interface)
1431
1999
    def Disable(self):
1432
2000
        "D-Bus method"
1433
2001
        self.disable()
1434
 
    
 
2002
 
1435
2003
    # StopChecker - method
 
2004
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1436
2005
    @dbus.service.method(_interface)
1437
2006
    def StopChecker(self):
1438
2007
        self.stop_checker()
1439
 
    
1440
 
    ## Properties
1441
 
    
 
2008
 
 
2009
    #  Properties
 
2010
 
1442
2011
    # ApprovalPending - property
1443
2012
    @dbus_service_property(_interface, signature="b", access="read")
1444
2013
    def ApprovalPending_dbus_property(self):
1445
2014
        return dbus.Boolean(bool(self.approvals_pending))
1446
 
    
 
2015
 
1447
2016
    # ApprovedByDefault - property
1448
 
    @dbus_service_property(_interface, signature="b",
 
2017
    @dbus_service_property(_interface,
 
2018
                           signature="b",
1449
2019
                           access="readwrite")
1450
2020
    def ApprovedByDefault_dbus_property(self, value=None):
1451
2021
        if value is None:       # get
1452
2022
            return dbus.Boolean(self.approved_by_default)
1453
2023
        self.approved_by_default = bool(value)
1454
 
    
 
2024
 
1455
2025
    # ApprovalDelay - property
1456
 
    @dbus_service_property(_interface, signature="t",
 
2026
    @dbus_service_property(_interface,
 
2027
                           signature="t",
1457
2028
                           access="readwrite")
1458
2029
    def ApprovalDelay_dbus_property(self, value=None):
1459
2030
        if value is None:       # get
1460
2031
            return dbus.UInt64(self.approval_delay.total_seconds()
1461
2032
                               * 1000)
1462
2033
        self.approval_delay = datetime.timedelta(0, 0, 0, value)
1463
 
    
 
2034
 
1464
2035
    # ApprovalDuration - property
1465
 
    @dbus_service_property(_interface, signature="t",
 
2036
    @dbus_service_property(_interface,
 
2037
                           signature="t",
1466
2038
                           access="readwrite")
1467
2039
    def ApprovalDuration_dbus_property(self, value=None):
1468
2040
        if value is None:       # get
1469
2041
            return dbus.UInt64(self.approval_duration.total_seconds()
1470
2042
                               * 1000)
1471
2043
        self.approval_duration = datetime.timedelta(0, 0, 0, value)
1472
 
    
 
2044
 
1473
2045
    # Name - property
 
2046
    @dbus_annotations(
 
2047
        {"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1474
2048
    @dbus_service_property(_interface, signature="s", access="read")
1475
2049
    def Name_dbus_property(self):
1476
2050
        return dbus.String(self.name)
1477
 
    
 
2051
 
 
2052
    # KeyID - property
 
2053
    @dbus_annotations(
 
2054
        {"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
 
2055
    @dbus_service_property(_interface, signature="s", access="read")
 
2056
    def KeyID_dbus_property(self):
 
2057
        return dbus.String(self.key_id)
 
2058
 
1478
2059
    # Fingerprint - property
 
2060
    @dbus_annotations(
 
2061
        {"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1479
2062
    @dbus_service_property(_interface, signature="s", access="read")
1480
2063
    def Fingerprint_dbus_property(self):
1481
2064
        return dbus.String(self.fingerprint)
1482
 
    
 
2065
 
1483
2066
    # Host - property
1484
 
    @dbus_service_property(_interface, signature="s",
 
2067
    @dbus_service_property(_interface,
 
2068
                           signature="s",
1485
2069
                           access="readwrite")
1486
2070
    def Host_dbus_property(self, value=None):
1487
2071
        if value is None:       # get
1488
2072
            return dbus.String(self.host)
1489
2073
        self.host = str(value)
1490
 
    
 
2074
 
1491
2075
    # Created - property
 
2076
    @dbus_annotations(
 
2077
        {"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1492
2078
    @dbus_service_property(_interface, signature="s", access="read")
1493
2079
    def Created_dbus_property(self):
1494
2080
        return datetime_to_dbus(self.created)
1495
 
    
 
2081
 
1496
2082
    # LastEnabled - property
1497
2083
    @dbus_service_property(_interface, signature="s", access="read")
1498
2084
    def LastEnabled_dbus_property(self):
1499
2085
        return datetime_to_dbus(self.last_enabled)
1500
 
    
 
2086
 
1501
2087
    # Enabled - property
1502
 
    @dbus_service_property(_interface, signature="b",
 
2088
    @dbus_service_property(_interface,
 
2089
                           signature="b",
1503
2090
                           access="readwrite")
1504
2091
    def Enabled_dbus_property(self, value=None):
1505
2092
        if value is None:       # get
1508
2095
            self.enable()
1509
2096
        else:
1510
2097
            self.disable()
1511
 
    
 
2098
 
1512
2099
    # LastCheckedOK - property
1513
 
    @dbus_service_property(_interface, signature="s",
 
2100
    @dbus_service_property(_interface,
 
2101
                           signature="s",
1514
2102
                           access="readwrite")
1515
2103
    def LastCheckedOK_dbus_property(self, value=None):
1516
2104
        if value is not None:
1517
2105
            self.checked_ok()
1518
2106
            return
1519
2107
        return datetime_to_dbus(self.last_checked_ok)
1520
 
    
 
2108
 
1521
2109
    # LastCheckerStatus - property
1522
 
    @dbus_service_property(_interface, signature="n",
1523
 
                           access="read")
 
2110
    @dbus_service_property(_interface, signature="n", access="read")
1524
2111
    def LastCheckerStatus_dbus_property(self):
1525
2112
        return dbus.Int16(self.last_checker_status)
1526
 
    
 
2113
 
1527
2114
    # Expires - property
1528
2115
    @dbus_service_property(_interface, signature="s", access="read")
1529
2116
    def Expires_dbus_property(self):
1530
2117
        return datetime_to_dbus(self.expires)
1531
 
    
 
2118
 
1532
2119
    # LastApprovalRequest - property
1533
2120
    @dbus_service_property(_interface, signature="s", access="read")
1534
2121
    def LastApprovalRequest_dbus_property(self):
1535
2122
        return datetime_to_dbus(self.last_approval_request)
1536
 
    
 
2123
 
1537
2124
    # Timeout - property
1538
 
    @dbus_service_property(_interface, signature="t",
 
2125
    @dbus_service_property(_interface,
 
2126
                           signature="t",
1539
2127
                           access="readwrite")
1540
2128
    def Timeout_dbus_property(self, value=None):
1541
2129
        if value is None:       # get
1553
2141
                if (getattr(self, "disable_initiator_tag", None)
1554
2142
                    is None):
1555
2143
                    return
1556
 
                gobject.source_remove(self.disable_initiator_tag)
1557
 
                self.disable_initiator_tag = (
1558
 
                    gobject.timeout_add(
1559
 
                        int((self.expires - now).total_seconds()
1560
 
                            * 1000), self.disable))
1561
 
    
 
2144
                GLib.source_remove(self.disable_initiator_tag)
 
2145
                self.disable_initiator_tag = GLib.timeout_add(
 
2146
                    int((self.expires - now).total_seconds() * 1000),
 
2147
                    self.disable)
 
2148
 
1562
2149
    # ExtendedTimeout - property
1563
 
    @dbus_service_property(_interface, signature="t",
 
2150
    @dbus_service_property(_interface,
 
2151
                           signature="t",
1564
2152
                           access="readwrite")
1565
2153
    def ExtendedTimeout_dbus_property(self, value=None):
1566
2154
        if value is None:       # get
1567
2155
            return dbus.UInt64(self.extended_timeout.total_seconds()
1568
2156
                               * 1000)
1569
2157
        self.extended_timeout = datetime.timedelta(0, 0, 0, value)
1570
 
    
 
2158
 
1571
2159
    # Interval - property
1572
 
    @dbus_service_property(_interface, signature="t",
 
2160
    @dbus_service_property(_interface,
 
2161
                           signature="t",
1573
2162
                           access="readwrite")
1574
2163
    def Interval_dbus_property(self, value=None):
1575
2164
        if value is None:       # get
1579
2168
            return
1580
2169
        if self.enabled:
1581
2170
            # Reschedule checker run
1582
 
            gobject.source_remove(self.checker_initiator_tag)
1583
 
            self.checker_initiator_tag = (gobject.timeout_add
1584
 
                                          (value, self.start_checker))
1585
 
            self.start_checker()    # Start one now, too
1586
 
    
 
2171
            GLib.source_remove(self.checker_initiator_tag)
 
2172
            self.checker_initiator_tag = GLib.timeout_add(
 
2173
                value, self.start_checker)
 
2174
            self.start_checker()  # Start one now, too
 
2175
 
1587
2176
    # Checker - property
1588
 
    @dbus_service_property(_interface, signature="s",
 
2177
    @dbus_service_property(_interface,
 
2178
                           signature="s",
1589
2179
                           access="readwrite")
1590
2180
    def Checker_dbus_property(self, value=None):
1591
2181
        if value is None:       # get
1592
2182
            return dbus.String(self.checker_command)
1593
2183
        self.checker_command = str(value)
1594
 
    
 
2184
 
1595
2185
    # CheckerRunning - property
1596
 
    @dbus_service_property(_interface, signature="b",
 
2186
    @dbus_service_property(_interface,
 
2187
                           signature="b",
1597
2188
                           access="readwrite")
1598
2189
    def CheckerRunning_dbus_property(self, value=None):
1599
2190
        if value is None:       # get
1602
2193
            self.start_checker()
1603
2194
        else:
1604
2195
            self.stop_checker()
1605
 
    
 
2196
 
1606
2197
    # ObjectPath - property
 
2198
    @dbus_annotations(
 
2199
        {"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",
 
2200
         "org.freedesktop.DBus.Deprecated": "true"})
1607
2201
    @dbus_service_property(_interface, signature="o", access="read")
1608
2202
    def ObjectPath_dbus_property(self):
1609
 
        return self.dbus_object_path # is already a dbus.ObjectPath
1610
 
    
 
2203
        return self.dbus_object_path  # is already a dbus.ObjectPath
 
2204
 
1611
2205
    # Secret = property
1612
 
    @dbus_service_property(_interface, signature="ay",
1613
 
                           access="write", byte_arrays=True)
 
2206
    @dbus_annotations(
 
2207
        {"org.freedesktop.DBus.Property.EmitsChangedSignal":
 
2208
         "invalidates"})
 
2209
    @dbus_service_property(_interface,
 
2210
                           signature="ay",
 
2211
                           access="write",
 
2212
                           byte_arrays=True)
1614
2213
    def Secret_dbus_property(self, value):
1615
2214
        self.secret = bytes(value)
1616
 
    
 
2215
 
1617
2216
    del _interface
1618
2217
 
1619
2218
 
1620
 
class ProxyClient(object):
1621
 
    def __init__(self, child_pipe, fpr, address):
 
2219
class ProxyClient:
 
2220
    def __init__(self, child_pipe, key_id, fpr, address):
1622
2221
        self._pipe = child_pipe
1623
 
        self._pipe.send(('init', fpr, address))
 
2222
        self._pipe.send(('init', key_id, fpr, address))
1624
2223
        if not self._pipe.recv():
1625
 
            raise KeyError()
1626
 
    
 
2224
            raise KeyError(key_id or fpr)
 
2225
 
1627
2226
    def __getattribute__(self, name):
1628
2227
        if name == '_pipe':
1629
2228
            return super(ProxyClient, self).__getattribute__(name)
1632
2231
        if data[0] == 'data':
1633
2232
            return data[1]
1634
2233
        if data[0] == 'function':
 
2234
 
1635
2235
            def func(*args, **kwargs):
1636
2236
                self._pipe.send(('funcall', name, args, kwargs))
1637
2237
                return self._pipe.recv()[1]
 
2238
 
1638
2239
            return func
1639
 
    
 
2240
 
1640
2241
    def __setattr__(self, name, value):
1641
2242
        if name == '_pipe':
1642
2243
            return super(ProxyClient, self).__setattr__(name, value)
1645
2246
 
1646
2247
class ClientHandler(socketserver.BaseRequestHandler, object):
1647
2248
    """A class to handle client connections.
1648
 
    
 
2249
 
1649
2250
    Instantiated once for each connection to handle it.
1650
2251
    Note: This will run in its own forked process."""
1651
 
    
 
2252
 
1652
2253
    def handle(self):
1653
2254
        with contextlib.closing(self.server.child_pipe) as child_pipe:
1654
2255
            logger.info("TCP connection from: %s",
1655
2256
                        str(self.client_address))
1656
2257
            logger.debug("Pipe FD: %d",
1657
2258
                         self.server.child_pipe.fileno())
1658
 
            
1659
 
            session = (gnutls.connection
1660
 
                       .ClientSession(self.request,
1661
 
                                      gnutls.connection
1662
 
                                      .X509Credentials()))
1663
 
            
1664
 
            # Note: gnutls.connection.X509Credentials is really a
1665
 
            # generic GnuTLS certificate credentials object so long as
1666
 
            # no X.509 keys are added to it.  Therefore, we can use it
1667
 
            # here despite using OpenPGP certificates.
1668
 
            
1669
 
            #priority = ':'.join(("NONE", "+VERS-TLS1.1",
1670
 
            #                      "+AES-256-CBC", "+SHA1",
1671
 
            #                      "+COMP-NULL", "+CTYPE-OPENPGP",
1672
 
            #                      "+DHE-DSS"))
 
2259
 
 
2260
            session = gnutls.ClientSession(self.request)
 
2261
 
 
2262
            # priority = ':'.join(("NONE", "+VERS-TLS1.1",
 
2263
            #                       "+AES-256-CBC", "+SHA1",
 
2264
            #                       "+COMP-NULL", "+CTYPE-OPENPGP",
 
2265
            #                       "+DHE-DSS"))
1673
2266
            # Use a fallback default, since this MUST be set.
1674
2267
            priority = self.server.gnutls_priority
1675
2268
            if priority is None:
1676
2269
                priority = "NORMAL"
1677
 
            (gnutls.library.functions
1678
 
             .gnutls_priority_set_direct(session._c_object,
1679
 
                                         priority, None))
1680
 
            
 
2270
            gnutls.priority_set_direct(session._c_object,
 
2271
                                       priority.encode("utf-8"),
 
2272
                                       None)
 
2273
 
1681
2274
            # Start communication using the Mandos protocol
1682
2275
            # Get protocol number
1683
2276
            line = self.request.makefile().readline()
1688
2281
            except (ValueError, IndexError, RuntimeError) as error:
1689
2282
                logger.error("Unknown protocol version: %s", error)
1690
2283
                return
1691
 
            
 
2284
 
1692
2285
            # Start GnuTLS connection
1693
2286
            try:
1694
2287
                session.handshake()
1695
 
            except gnutls.errors.GNUTLSError as error:
 
2288
            except gnutls.Error as error:
1696
2289
                logger.warning("Handshake failed: %s", error)
1697
2290
                # Do not run session.bye() here: the session is not
1698
2291
                # established.  Just abandon the request.
1699
2292
                return
1700
2293
            logger.debug("Handshake succeeded")
1701
 
            
 
2294
 
1702
2295
            approval_required = False
1703
2296
            try:
1704
 
                try:
1705
 
                    fpr = self.fingerprint(self.peer_certificate
1706
 
                                           (session))
1707
 
                except (TypeError,
1708
 
                        gnutls.errors.GNUTLSError) as error:
1709
 
                    logger.warning("Bad certificate: %s", error)
1710
 
                    return
1711
 
                logger.debug("Fingerprint: %s", fpr)
1712
 
                
1713
 
                try:
1714
 
                    client = ProxyClient(child_pipe, fpr,
 
2297
                if gnutls.has_rawpk:
 
2298
                    fpr = b""
 
2299
                    try:
 
2300
                        key_id = self.key_id(
 
2301
                            self.peer_certificate(session))
 
2302
                    except (TypeError, gnutls.Error) as error:
 
2303
                        logger.warning("Bad certificate: %s", error)
 
2304
                        return
 
2305
                    logger.debug("Key ID: %s", key_id)
 
2306
 
 
2307
                else:
 
2308
                    key_id = b""
 
2309
                    try:
 
2310
                        fpr = self.fingerprint(
 
2311
                            self.peer_certificate(session))
 
2312
                    except (TypeError, gnutls.Error) as error:
 
2313
                        logger.warning("Bad certificate: %s", error)
 
2314
                        return
 
2315
                    logger.debug("Fingerprint: %s", fpr)
 
2316
 
 
2317
                try:
 
2318
                    client = ProxyClient(child_pipe, key_id, fpr,
1715
2319
                                         self.client_address)
1716
2320
                except KeyError:
1717
2321
                    return
1718
 
                
 
2322
 
1719
2323
                if client.approval_delay:
1720
2324
                    delay = client.approval_delay
1721
2325
                    client.approvals_pending += 1
1722
2326
                    approval_required = True
1723
 
                
 
2327
 
1724
2328
                while True:
1725
2329
                    if not client.enabled:
1726
2330
                        logger.info("Client %s is disabled",
1727
 
                                       client.name)
 
2331
                                    client.name)
1728
2332
                        if self.server.use_dbus:
1729
2333
                            # Emit D-Bus signal
1730
2334
                            client.Rejected("Disabled")
1731
2335
                        return
1732
 
                    
 
2336
 
1733
2337
                    if client.approved or not client.approval_delay:
1734
 
                        #We are approved or approval is disabled
 
2338
                        # We are approved or approval is disabled
1735
2339
                        break
1736
2340
                    elif client.approved is None:
1737
2341
                        logger.info("Client %s needs approval",
1748
2352
                            # Emit D-Bus signal
1749
2353
                            client.Rejected("Denied")
1750
2354
                        return
1751
 
                    
1752
 
                    #wait until timeout or approved
 
2355
 
 
2356
                    # wait until timeout or approved
1753
2357
                    time = datetime.datetime.now()
1754
2358
                    client.changedstate.acquire()
1755
2359
                    client.changedstate.wait(delay.total_seconds())
1768
2372
                            break
1769
2373
                    else:
1770
2374
                        delay -= time2 - time
1771
 
                
1772
 
                sent_size = 0
1773
 
                while sent_size < len(client.secret):
1774
 
                    try:
1775
 
                        sent = session.send(client.secret[sent_size:])
1776
 
                    except gnutls.errors.GNUTLSError as error:
1777
 
                        logger.warning("gnutls send failed",
1778
 
                                       exc_info=error)
1779
 
                        return
1780
 
                    logger.debug("Sent: %d, remaining: %d",
1781
 
                                 sent, len(client.secret)
1782
 
                                 - (sent_size + sent))
1783
 
                    sent_size += sent
1784
 
                
 
2375
 
 
2376
                try:
 
2377
                    session.send(client.secret)
 
2378
                except gnutls.Error as error:
 
2379
                    logger.warning("gnutls send failed",
 
2380
                                   exc_info=error)
 
2381
                    return
 
2382
 
1785
2383
                logger.info("Sending secret to %s", client.name)
1786
2384
                # bump the timeout using extended_timeout
1787
2385
                client.bump_timeout(client.extended_timeout)
1788
2386
                if self.server.use_dbus:
1789
2387
                    # Emit D-Bus signal
1790
2388
                    client.GotSecret()
1791
 
            
 
2389
 
1792
2390
            finally:
1793
2391
                if approval_required:
1794
2392
                    client.approvals_pending -= 1
1795
2393
                try:
1796
2394
                    session.bye()
1797
 
                except gnutls.errors.GNUTLSError as error:
 
2395
                except gnutls.Error as error:
1798
2396
                    logger.warning("GnuTLS bye failed",
1799
2397
                                   exc_info=error)
1800
 
    
 
2398
 
1801
2399
    @staticmethod
1802
2400
    def peer_certificate(session):
1803
 
        "Return the peer's OpenPGP certificate as a bytestring"
1804
 
        # If not an OpenPGP certificate...
1805
 
        if (gnutls.library.functions
1806
 
            .gnutls_certificate_type_get(session._c_object)
1807
 
            != gnutls.library.constants.GNUTLS_CRT_OPENPGP):
1808
 
            # ...do the normal thing
1809
 
            return session.peer_certificate
 
2401
        "Return the peer's certificate as a bytestring"
 
2402
        try:
 
2403
            cert_type = gnutls.certificate_type_get2(session._c_object,
 
2404
                                                     gnutls.CTYPE_PEERS)
 
2405
        except AttributeError:
 
2406
            cert_type = gnutls.certificate_type_get(session._c_object)
 
2407
        if gnutls.has_rawpk:
 
2408
            valid_cert_types = frozenset((gnutls.CRT_RAWPK,))
 
2409
        else:
 
2410
            valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))
 
2411
        # If not a valid certificate type...
 
2412
        if cert_type not in valid_cert_types:
 
2413
            logger.info("Cert type %r not in %r", cert_type,
 
2414
                        valid_cert_types)
 
2415
            # ...return invalid data
 
2416
            return b""
1810
2417
        list_size = ctypes.c_uint(1)
1811
 
        cert_list = (gnutls.library.functions
1812
 
                     .gnutls_certificate_get_peers
 
2418
        cert_list = (gnutls.certificate_get_peers
1813
2419
                     (session._c_object, ctypes.byref(list_size)))
1814
2420
        if not bool(cert_list) and list_size.value != 0:
1815
 
            raise gnutls.errors.GNUTLSError("error getting peer"
1816
 
                                            " certificate")
 
2421
            raise gnutls.Error("error getting peer certificate")
1817
2422
        if list_size.value == 0:
1818
2423
            return None
1819
2424
        cert = cert_list[0]
1820
2425
        return ctypes.string_at(cert.data, cert.size)
1821
 
    
 
2426
 
 
2427
    @staticmethod
 
2428
    def key_id(certificate):
 
2429
        "Convert a certificate bytestring to a hexdigit key ID"
 
2430
        # New GnuTLS "datum" with the public key
 
2431
        datum = gnutls.datum_t(
 
2432
            ctypes.cast(ctypes.c_char_p(certificate),
 
2433
                        ctypes.POINTER(ctypes.c_ubyte)),
 
2434
            ctypes.c_uint(len(certificate)))
 
2435
        # XXX all these need to be created in the gnutls "module"
 
2436
        # New empty GnuTLS certificate
 
2437
        pubkey = gnutls.pubkey_t()
 
2438
        gnutls.pubkey_init(ctypes.byref(pubkey))
 
2439
        # Import the raw public key into the certificate
 
2440
        gnutls.pubkey_import(pubkey,
 
2441
                             ctypes.byref(datum),
 
2442
                             gnutls.X509_FMT_DER)
 
2443
        # New buffer for the key ID
 
2444
        buf = ctypes.create_string_buffer(32)
 
2445
        buf_len = ctypes.c_size_t(len(buf))
 
2446
        # Get the key ID from the raw public key into the buffer
 
2447
        gnutls.pubkey_get_key_id(pubkey,
 
2448
                                 gnutls.KEYID_USE_SHA256,
 
2449
                                 ctypes.cast(ctypes.byref(buf),
 
2450
                                             ctypes.POINTER(ctypes.c_ubyte)),
 
2451
                                 ctypes.byref(buf_len))
 
2452
        # Deinit the certificate
 
2453
        gnutls.pubkey_deinit(pubkey)
 
2454
 
 
2455
        # Convert the buffer to a Python bytestring
 
2456
        key_id = ctypes.string_at(buf, buf_len.value)
 
2457
        # Convert the bytestring to hexadecimal notation
 
2458
        hex_key_id = binascii.hexlify(key_id).upper()
 
2459
        return hex_key_id
 
2460
 
1822
2461
    @staticmethod
1823
2462
    def fingerprint(openpgp):
1824
2463
        "Convert an OpenPGP bytestring to a hexdigit fingerprint"
1825
2464
        # New GnuTLS "datum" with the OpenPGP public key
1826
 
        datum = (gnutls.library.types
1827
 
                 .gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
1828
 
                                             ctypes.POINTER
1829
 
                                             (ctypes.c_ubyte)),
1830
 
                                 ctypes.c_uint(len(openpgp))))
 
2465
        datum = gnutls.datum_t(
 
2466
            ctypes.cast(ctypes.c_char_p(openpgp),
 
2467
                        ctypes.POINTER(ctypes.c_ubyte)),
 
2468
            ctypes.c_uint(len(openpgp)))
1831
2469
        # New empty GnuTLS certificate
1832
 
        crt = gnutls.library.types.gnutls_openpgp_crt_t()
1833
 
        (gnutls.library.functions
1834
 
         .gnutls_openpgp_crt_init(ctypes.byref(crt)))
 
2470
        crt = gnutls.openpgp_crt_t()
 
2471
        gnutls.openpgp_crt_init(ctypes.byref(crt))
1835
2472
        # Import the OpenPGP public key into the certificate
1836
 
        (gnutls.library.functions
1837
 
         .gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
1838
 
                                    gnutls.library.constants
1839
 
                                    .GNUTLS_OPENPGP_FMT_RAW))
 
2473
        gnutls.openpgp_crt_import(crt, ctypes.byref(datum),
 
2474
                                  gnutls.OPENPGP_FMT_RAW)
1840
2475
        # Verify the self signature in the key
1841
2476
        crtverify = ctypes.c_uint()
1842
 
        (gnutls.library.functions
1843
 
         .gnutls_openpgp_crt_verify_self(crt, 0,
1844
 
                                         ctypes.byref(crtverify)))
 
2477
        gnutls.openpgp_crt_verify_self(crt, 0,
 
2478
                                       ctypes.byref(crtverify))
1845
2479
        if crtverify.value != 0:
1846
 
            gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1847
 
            raise (gnutls.errors.CertificateSecurityError
1848
 
                   ("Verify failed"))
 
2480
            gnutls.openpgp_crt_deinit(crt)
 
2481
            raise gnutls.CertificateSecurityError(code
 
2482
                                                  =crtverify.value)
1849
2483
        # New buffer for the fingerprint
1850
2484
        buf = ctypes.create_string_buffer(20)
1851
2485
        buf_len = ctypes.c_size_t()
1852
2486
        # Get the fingerprint from the certificate into the buffer
1853
 
        (gnutls.library.functions
1854
 
         .gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
1855
 
                                             ctypes.byref(buf_len)))
 
2487
        gnutls.openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
 
2488
                                           ctypes.byref(buf_len))
1856
2489
        # Deinit the certificate
1857
 
        gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
 
2490
        gnutls.openpgp_crt_deinit(crt)
1858
2491
        # Convert the buffer to a Python bytestring
1859
2492
        fpr = ctypes.string_at(buf, buf_len.value)
1860
2493
        # Convert the bytestring to hexadecimal notation
1862
2495
        return hex_fpr
1863
2496
 
1864
2497
 
1865
 
class MultiprocessingMixIn(object):
 
2498
class MultiprocessingMixIn:
1866
2499
    """Like socketserver.ThreadingMixIn, but with multiprocessing"""
 
2500
 
1867
2501
    def sub_process_main(self, request, address):
1868
2502
        try:
1869
2503
            self.finish_request(request, address)
1870
2504
        except Exception:
1871
2505
            self.handle_error(request, address)
1872
2506
        self.close_request(request)
1873
 
    
 
2507
 
1874
2508
    def process_request(self, request, address):
1875
2509
        """Start a new process to process the request."""
1876
 
        proc = multiprocessing.Process(target = self.sub_process_main,
1877
 
                                       args = (request, address))
 
2510
        proc = multiprocessing.Process(target=self.sub_process_main,
 
2511
                                       args=(request, address))
1878
2512
        proc.start()
1879
2513
        return proc
1880
2514
 
1881
2515
 
1882
 
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
 
2516
class MultiprocessingMixInWithPipe(MultiprocessingMixIn):
1883
2517
    """ adds a pipe to the MixIn """
 
2518
 
1884
2519
    def process_request(self, request, client_address):
1885
2520
        """Overrides and wraps the original process_request().
1886
 
        
 
2521
 
1887
2522
        This function creates a new pipe in self.pipe
1888
2523
        """
1889
2524
        parent_pipe, self.child_pipe = multiprocessing.Pipe()
1890
 
        
 
2525
 
1891
2526
        proc = MultiprocessingMixIn.process_request(self, request,
1892
2527
                                                    client_address)
1893
2528
        self.child_pipe.close()
1894
2529
        self.add_pipe(parent_pipe, proc)
1895
 
    
 
2530
 
1896
2531
    def add_pipe(self, parent_pipe, proc):
1897
2532
        """Dummy function; override as necessary"""
1898
2533
        raise NotImplementedError()
1899
2534
 
1900
2535
 
1901
2536
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
1902
 
                     socketserver.TCPServer, object):
 
2537
                     socketserver.TCPServer):
1903
2538
    """IPv6-capable TCP server.  Accepts 'None' as address and/or port
1904
 
    
 
2539
 
1905
2540
    Attributes:
1906
2541
        enabled:        Boolean; whether this server is activated yet
1907
2542
        interface:      None or a network interface name (string)
1908
2543
        use_ipv6:       Boolean; to use IPv6 or not
1909
2544
    """
 
2545
 
1910
2546
    def __init__(self, server_address, RequestHandlerClass,
1911
 
                 interface=None, use_ipv6=True, socketfd=None):
 
2547
                 interface=None,
 
2548
                 use_ipv6=True,
 
2549
                 socketfd=None):
1912
2550
        """If socketfd is set, use that file descriptor instead of
1913
2551
        creating a new one with socket.socket().
1914
2552
        """
1920
2558
            self.socketfd = socketfd
1921
2559
            # Save the original socket.socket() function
1922
2560
            self.socket_socket = socket.socket
 
2561
 
1923
2562
            # To implement --socket, we monkey patch socket.socket.
1924
 
            # 
 
2563
            #
1925
2564
            # (When socketserver.TCPServer is a new-style class, we
1926
2565
            # could make self.socket into a property instead of monkey
1927
2566
            # patching socket.socket.)
1928
 
            # 
 
2567
            #
1929
2568
            # Create a one-time-only replacement for socket.socket()
1930
2569
            @functools.wraps(socket.socket)
1931
2570
            def socket_wrapper(*args, **kwargs):
1943
2582
        # socket_wrapper(), if socketfd was set.
1944
2583
        socketserver.TCPServer.__init__(self, server_address,
1945
2584
                                        RequestHandlerClass)
1946
 
    
 
2585
 
1947
2586
    def server_bind(self):
1948
2587
        """This overrides the normal server_bind() function
1949
2588
        to bind to an interface if one was specified, and also NOT to
1950
2589
        bind to an address or port if they were not specified."""
 
2590
        global SO_BINDTODEVICE
1951
2591
        if self.interface is not None:
1952
2592
            if SO_BINDTODEVICE is None:
1953
 
                logger.error("SO_BINDTODEVICE does not exist;"
1954
 
                             " cannot bind to interface %s",
1955
 
                             self.interface)
1956
 
            else:
1957
 
                try:
1958
 
                    self.socket.setsockopt(socket.SOL_SOCKET,
1959
 
                                           SO_BINDTODEVICE,
1960
 
                                           (self.interface + "\0")
1961
 
                                           .encode("utf-8"))
1962
 
                except socket.error as error:
1963
 
                    if error.errno == errno.EPERM:
1964
 
                        logger.error("No permission to bind to"
1965
 
                                     " interface %s", self.interface)
1966
 
                    elif error.errno == errno.ENOPROTOOPT:
1967
 
                        logger.error("SO_BINDTODEVICE not available;"
1968
 
                                     " cannot bind to interface %s",
1969
 
                                     self.interface)
1970
 
                    elif error.errno == errno.ENODEV:
1971
 
                        logger.error("Interface %s does not exist,"
1972
 
                                     " cannot bind", self.interface)
1973
 
                    else:
1974
 
                        raise
 
2593
                # Fall back to a hard-coded value which seems to be
 
2594
                # common enough.
 
2595
                logger.warning("SO_BINDTODEVICE not found, trying 25")
 
2596
                SO_BINDTODEVICE = 25
 
2597
            try:
 
2598
                self.socket.setsockopt(
 
2599
                    socket.SOL_SOCKET, SO_BINDTODEVICE,
 
2600
                    (self.interface + "\0").encode("utf-8"))
 
2601
            except socket.error as error:
 
2602
                if error.errno == errno.EPERM:
 
2603
                    logger.error("No permission to bind to"
 
2604
                                 " interface %s", self.interface)
 
2605
                elif error.errno == errno.ENOPROTOOPT:
 
2606
                    logger.error("SO_BINDTODEVICE not available;"
 
2607
                                 " cannot bind to interface %s",
 
2608
                                 self.interface)
 
2609
                elif error.errno == errno.ENODEV:
 
2610
                    logger.error("Interface %s does not exist,"
 
2611
                                 " cannot bind", self.interface)
 
2612
                else:
 
2613
                    raise
1975
2614
        # Only bind(2) the socket if we really need to.
1976
2615
        if self.server_address[0] or self.server_address[1]:
 
2616
            if self.server_address[1]:
 
2617
                self.allow_reuse_address = True
1977
2618
            if not self.server_address[0]:
1978
2619
                if self.address_family == socket.AF_INET6:
1979
 
                    any_address = "::" # in6addr_any
 
2620
                    any_address = "::"  # in6addr_any
1980
2621
                else:
1981
 
                    any_address = "0.0.0.0" # INADDR_ANY
 
2622
                    any_address = "0.0.0.0"  # INADDR_ANY
1982
2623
                self.server_address = (any_address,
1983
2624
                                       self.server_address[1])
1984
2625
            elif not self.server_address[1]:
1985
 
                self.server_address = (self.server_address[0],
1986
 
                                       0)
 
2626
                self.server_address = (self.server_address[0], 0)
1987
2627
#                 if self.interface:
1988
2628
#                     self.server_address = (self.server_address[0],
1989
2629
#                                            0, # port
1995
2635
 
1996
2636
class MandosServer(IPv6_TCPServer):
1997
2637
    """Mandos server.
1998
 
    
 
2638
 
1999
2639
    Attributes:
2000
2640
        clients:        set of Client objects
2001
2641
        gnutls_priority GnuTLS priority string
2002
2642
        use_dbus:       Boolean; to emit D-Bus signals or not
2003
 
    
2004
 
    Assumes a gobject.MainLoop event loop.
 
2643
 
 
2644
    Assumes a GLib.MainLoop event loop.
2005
2645
    """
 
2646
 
2006
2647
    def __init__(self, server_address, RequestHandlerClass,
2007
 
                 interface=None, use_ipv6=True, clients=None,
2008
 
                 gnutls_priority=None, use_dbus=True, socketfd=None):
 
2648
                 interface=None,
 
2649
                 use_ipv6=True,
 
2650
                 clients=None,
 
2651
                 gnutls_priority=None,
 
2652
                 use_dbus=True,
 
2653
                 socketfd=None):
2009
2654
        self.enabled = False
2010
2655
        self.clients = clients
2011
2656
        if self.clients is None:
2014
2659
        self.gnutls_priority = gnutls_priority
2015
2660
        IPv6_TCPServer.__init__(self, server_address,
2016
2661
                                RequestHandlerClass,
2017
 
                                interface = interface,
2018
 
                                use_ipv6 = use_ipv6,
2019
 
                                socketfd = socketfd)
 
2662
                                interface=interface,
 
2663
                                use_ipv6=use_ipv6,
 
2664
                                socketfd=socketfd)
 
2665
 
2020
2666
    def server_activate(self):
2021
2667
        if self.enabled:
2022
2668
            return socketserver.TCPServer.server_activate(self)
2023
 
    
 
2669
 
2024
2670
    def enable(self):
2025
2671
        self.enabled = True
2026
 
    
 
2672
 
2027
2673
    def add_pipe(self, parent_pipe, proc):
2028
2674
        # Call "handle_ipc" for both data and EOF events
2029
 
        gobject.io_add_watch(parent_pipe.fileno(),
2030
 
                             gobject.IO_IN | gobject.IO_HUP,
2031
 
                             functools.partial(self.handle_ipc,
2032
 
                                               parent_pipe =
2033
 
                                               parent_pipe,
2034
 
                                               proc = proc))
2035
 
    
2036
 
    def handle_ipc(self, source, condition, parent_pipe=None,
2037
 
                   proc = None, client_object=None):
 
2675
        GLib.io_add_watch(
 
2676
            parent_pipe.fileno(),
 
2677
            GLib.IO_IN | GLib.IO_HUP,
 
2678
            functools.partial(self.handle_ipc,
 
2679
                              parent_pipe=parent_pipe,
 
2680
                              proc=proc))
 
2681
 
 
2682
    def handle_ipc(self, source, condition,
 
2683
                   parent_pipe=None,
 
2684
                   proc=None,
 
2685
                   client_object=None):
2038
2686
        # error, or the other end of multiprocessing.Pipe has closed
2039
 
        if condition & (gobject.IO_ERR | gobject.IO_HUP):
 
2687
        if condition & (GLib.IO_ERR | GLib.IO_HUP):
2040
2688
            # Wait for other process to exit
2041
2689
            proc.join()
2042
2690
            return False
2043
 
        
 
2691
 
2044
2692
        # Read a request from the child
2045
2693
        request = parent_pipe.recv()
2046
2694
        command = request[0]
2047
 
        
 
2695
 
2048
2696
        if command == 'init':
2049
 
            fpr = request[1]
2050
 
            address = request[2]
2051
 
            
2052
 
            for c in self.clients.itervalues():
2053
 
                if c.fingerprint == fpr:
 
2697
            key_id = request[1].decode("ascii")
 
2698
            fpr = request[2].decode("ascii")
 
2699
            address = request[3]
 
2700
 
 
2701
            for c in self.clients.values():
 
2702
                if key_id == "E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855":
 
2703
                    continue
 
2704
                if key_id and c.key_id == key_id:
 
2705
                    client = c
 
2706
                    break
 
2707
                if fpr and c.fingerprint == fpr:
2054
2708
                    client = c
2055
2709
                    break
2056
2710
            else:
2057
 
                logger.info("Client not found for fingerprint: %s, ad"
2058
 
                            "dress: %s", fpr, address)
 
2711
                logger.info("Client not found for key ID: %s, address"
 
2712
                            ": %s", key_id or fpr, address)
2059
2713
                if self.use_dbus:
2060
2714
                    # Emit D-Bus signal
2061
 
                    mandos_dbus_service.ClientNotFound(fpr,
 
2715
                    mandos_dbus_service.ClientNotFound(key_id or fpr,
2062
2716
                                                       address[0])
2063
2717
                parent_pipe.send(False)
2064
2718
                return False
2065
 
            
2066
 
            gobject.io_add_watch(parent_pipe.fileno(),
2067
 
                                 gobject.IO_IN | gobject.IO_HUP,
2068
 
                                 functools.partial(self.handle_ipc,
2069
 
                                                   parent_pipe =
2070
 
                                                   parent_pipe,
2071
 
                                                   proc = proc,
2072
 
                                                   client_object =
2073
 
                                                   client))
 
2719
 
 
2720
            GLib.io_add_watch(
 
2721
                parent_pipe.fileno(),
 
2722
                GLib.IO_IN | GLib.IO_HUP,
 
2723
                functools.partial(self.handle_ipc,
 
2724
                                  parent_pipe=parent_pipe,
 
2725
                                  proc=proc,
 
2726
                                  client_object=client))
2074
2727
            parent_pipe.send(True)
2075
2728
            # remove the old hook in favor of the new above hook on
2076
2729
            # same fileno
2079
2732
            funcname = request[1]
2080
2733
            args = request[2]
2081
2734
            kwargs = request[3]
2082
 
            
 
2735
 
2083
2736
            parent_pipe.send(('data', getattr(client_object,
2084
2737
                                              funcname)(*args,
2085
 
                                                         **kwargs)))
2086
 
        
 
2738
                                                        **kwargs)))
 
2739
 
2087
2740
        if command == 'getattr':
2088
2741
            attrname = request[1]
2089
 
            if callable(client_object.__getattribute__(attrname)):
2090
 
                parent_pipe.send(('function',))
 
2742
            if isinstance(client_object.__getattribute__(attrname),
 
2743
                          collections.Callable):
 
2744
                parent_pipe.send(('function', ))
2091
2745
            else:
2092
 
                parent_pipe.send(('data', client_object
2093
 
                                  .__getattribute__(attrname)))
2094
 
        
 
2746
                parent_pipe.send((
 
2747
                    'data', client_object.__getattribute__(attrname)))
 
2748
 
2095
2749
        if command == 'setattr':
2096
2750
            attrname = request[1]
2097
2751
            value = request[2]
2098
2752
            setattr(client_object, attrname, value)
2099
 
        
 
2753
 
2100
2754
        return True
2101
2755
 
2102
2756
 
2103
2757
def rfc3339_duration_to_delta(duration):
2104
2758
    """Parse an RFC 3339 "duration" and return a datetime.timedelta
2105
 
    
 
2759
 
2106
2760
    >>> rfc3339_duration_to_delta("P7D")
2107
2761
    datetime.timedelta(7)
2108
2762
    >>> rfc3339_duration_to_delta("PT60S")
2118
2772
    >>> rfc3339_duration_to_delta("P1DT3M20S")
2119
2773
    datetime.timedelta(1, 200)
2120
2774
    """
2121
 
    
 
2775
 
2122
2776
    # Parsing an RFC 3339 duration with regular expressions is not
2123
2777
    # possible - there would have to be multiple places for the same
2124
2778
    # values, like seconds.  The current code, while more esoteric, is
2125
2779
    # cleaner without depending on a parsing library.  If Python had a
2126
2780
    # built-in library for parsing we would use it, but we'd like to
2127
2781
    # avoid excessive use of external libraries.
2128
 
    
 
2782
 
2129
2783
    # New type for defining tokens, syntax, and semantics all-in-one
2130
 
    Token = collections.namedtuple("Token",
2131
 
                                   ("regexp", # To match token; if
2132
 
                                              # "value" is not None,
2133
 
                                              # must have a "group"
2134
 
                                              # containing digits
2135
 
                                    "value",  # datetime.timedelta or
2136
 
                                              # None
2137
 
                                    "followers")) # Tokens valid after
2138
 
                                                  # this token
 
2784
    Token = collections.namedtuple("Token", (
 
2785
        "regexp",  # To match token; if "value" is not None, must have
 
2786
                   # a "group" containing digits
 
2787
        "value",   # datetime.timedelta or None
 
2788
        "followers"))           # Tokens valid after this token
2139
2789
    # RFC 3339 "duration" tokens, syntax, and semantics; taken from
2140
2790
    # the "duration" ABNF definition in RFC 3339, Appendix A.
2141
2791
    token_end = Token(re.compile(r"$"), None, frozenset())
2142
2792
    token_second = Token(re.compile(r"(\d+)S"),
2143
2793
                         datetime.timedelta(seconds=1),
2144
 
                         frozenset((token_end,)))
 
2794
                         frozenset((token_end, )))
2145
2795
    token_minute = Token(re.compile(r"(\d+)M"),
2146
2796
                         datetime.timedelta(minutes=1),
2147
2797
                         frozenset((token_second, token_end)))
2163
2813
                       frozenset((token_month, token_end)))
2164
2814
    token_week = Token(re.compile(r"(\d+)W"),
2165
2815
                       datetime.timedelta(weeks=1),
2166
 
                       frozenset((token_end,)))
 
2816
                       frozenset((token_end, )))
2167
2817
    token_duration = Token(re.compile(r"P"), None,
2168
2818
                           frozenset((token_year, token_month,
2169
2819
                                      token_day, token_time,
2170
2820
                                      token_week)))
2171
 
    # Define starting values
2172
 
    value = datetime.timedelta() # Value so far
 
2821
    # Define starting values:
 
2822
    # Value so far
 
2823
    value = datetime.timedelta()
2173
2824
    found_token = None
2174
 
    followers = frozenset((token_duration,)) # Following valid tokens
2175
 
    s = duration                # String left to parse
 
2825
    # Following valid tokens
 
2826
    followers = frozenset((token_duration, ))
 
2827
    # String left to parse
 
2828
    s = duration
2176
2829
    # Loop until end token is found
2177
2830
    while found_token is not token_end:
2178
2831
        # Search for any currently valid tokens
2194
2847
                break
2195
2848
        else:
2196
2849
            # No currently valid tokens were found
2197
 
            raise ValueError("Invalid RFC 3339 duration")
 
2850
            raise ValueError("Invalid RFC 3339 duration: {!r}"
 
2851
                             .format(duration))
2198
2852
    # End token found
2199
2853
    return value
2200
2854
 
2201
2855
 
2202
2856
def string_to_delta(interval):
2203
2857
    """Parse a string and return a datetime.timedelta
2204
 
    
 
2858
 
2205
2859
    >>> string_to_delta('7d')
2206
2860
    datetime.timedelta(7)
2207
2861
    >>> string_to_delta('60s')
2215
2869
    >>> string_to_delta('5m 30s')
2216
2870
    datetime.timedelta(0, 330)
2217
2871
    """
2218
 
    
 
2872
 
2219
2873
    try:
2220
2874
        return rfc3339_duration_to_delta(interval)
2221
2875
    except ValueError:
2222
2876
        pass
2223
 
    
 
2877
 
2224
2878
    timevalue = datetime.timedelta(0)
2225
2879
    for s in interval.split():
2226
2880
        try:
2237
2891
            elif suffix == "w":
2238
2892
                delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
2239
2893
            else:
2240
 
                raise ValueError("Unknown suffix {!r}"
2241
 
                                 .format(suffix))
 
2894
                raise ValueError("Unknown suffix {!r}".format(suffix))
2242
2895
        except IndexError as e:
2243
2896
            raise ValueError(*(e.args))
2244
2897
        timevalue += delta
2245
2898
    return timevalue
2246
2899
 
2247
2900
 
2248
 
def daemon(nochdir = False, noclose = False):
 
2901
def daemon(nochdir=False, noclose=False):
2249
2902
    """See daemon(3).  Standard BSD Unix function.
2250
 
    
 
2903
 
2251
2904
    This should really exist as os.daemon, but it doesn't (yet)."""
2252
2905
    if os.fork():
2253
2906
        sys.exit()
2260
2913
        # Close all standard open file descriptors
2261
2914
        null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2262
2915
        if not stat.S_ISCHR(os.fstat(null).st_mode):
2263
 
            raise OSError(errno.ENODEV, "{} not a character device"
 
2916
            raise OSError(errno.ENODEV,
 
2917
                          "{} not a character device"
2264
2918
                          .format(os.devnull))
2265
2919
        os.dup2(null, sys.stdin.fileno())
2266
2920
        os.dup2(null, sys.stdout.fileno())
2270
2924
 
2271
2925
 
2272
2926
def main():
2273
 
    
 
2927
 
2274
2928
    ##################################################################
2275
2929
    # Parsing of options, both command line and config file
2276
 
    
 
2930
 
2277
2931
    parser = argparse.ArgumentParser()
2278
2932
    parser.add_argument("-v", "--version", action="version",
2279
 
                        version = "%(prog)s {}".format(version),
 
2933
                        version="%(prog)s {}".format(version),
2280
2934
                        help="show version number and exit")
2281
2935
    parser.add_argument("-i", "--interface", metavar="IF",
2282
2936
                        help="Bind to interface IF")
2318
2972
    parser.add_argument("--no-zeroconf", action="store_false",
2319
2973
                        dest="zeroconf", help="Do not use Zeroconf",
2320
2974
                        default=None)
2321
 
    
 
2975
 
2322
2976
    options = parser.parse_args()
2323
 
    
 
2977
 
2324
2978
    if options.check:
2325
2979
        import doctest
2326
2980
        fail_count, test_count = doctest.testmod()
2327
2981
        sys.exit(os.EX_OK if fail_count == 0 else 1)
2328
 
    
 
2982
 
2329
2983
    # Default values for config file for server-global settings
2330
 
    server_defaults = { "interface": "",
2331
 
                        "address": "",
2332
 
                        "port": "",
2333
 
                        "debug": "False",
2334
 
                        "priority":
2335
 
                        "SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",
2336
 
                        "servicename": "Mandos",
2337
 
                        "use_dbus": "True",
2338
 
                        "use_ipv6": "True",
2339
 
                        "debuglevel": "",
2340
 
                        "restore": "True",
2341
 
                        "socket": "",
2342
 
                        "statedir": "/var/lib/mandos",
2343
 
                        "foreground": "False",
2344
 
                        "zeroconf": "True",
2345
 
                        }
2346
 
    
 
2984
    if gnutls.has_rawpk:
 
2985
        priority = ("SECURE128:!CTYPE-X.509:+CTYPE-RAWPK:!RSA"
 
2986
                    ":!VERS-ALL:+VERS-TLS1.3:%PROFILE_ULTRA")
 
2987
    else:
 
2988
        priority = ("SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
 
2989
                    ":+SIGN-DSA-SHA256")
 
2990
    server_defaults = {"interface": "",
 
2991
                       "address": "",
 
2992
                       "port": "",
 
2993
                       "debug": "False",
 
2994
                       "priority": priority,
 
2995
                       "servicename": "Mandos",
 
2996
                       "use_dbus": "True",
 
2997
                       "use_ipv6": "True",
 
2998
                       "debuglevel": "",
 
2999
                       "restore": "True",
 
3000
                       "socket": "",
 
3001
                       "statedir": "/var/lib/mandos",
 
3002
                       "foreground": "False",
 
3003
                       "zeroconf": "True",
 
3004
                       }
 
3005
    del priority
 
3006
 
2347
3007
    # Parse config file for server-global settings
2348
 
    server_config = configparser.SafeConfigParser(server_defaults)
 
3008
    server_config = configparser.ConfigParser(server_defaults)
2349
3009
    del server_defaults
2350
 
    server_config.read(os.path.join(options.configdir,
2351
 
                                    "mandos.conf"))
2352
 
    # Convert the SafeConfigParser object to a dict
 
3010
    server_config.read(os.path.join(options.configdir, "mandos.conf"))
 
3011
    # Convert the ConfigParser object to a dict
2353
3012
    server_settings = server_config.defaults()
2354
3013
    # Use the appropriate methods on the non-string config options
2355
 
    for option in ("debug", "use_dbus", "use_ipv6", "foreground"):
 
3014
    for option in ("debug", "use_dbus", "use_ipv6", "restore",
 
3015
                   "foreground", "zeroconf"):
2356
3016
        server_settings[option] = server_config.getboolean("DEFAULT",
2357
3017
                                                           option)
2358
3018
    if server_settings["port"]:
2368
3028
            server_settings["socket"] = os.dup(server_settings
2369
3029
                                               ["socket"])
2370
3030
    del server_config
2371
 
    
 
3031
 
2372
3032
    # Override the settings from the config file with command line
2373
3033
    # options, if set.
2374
3034
    for option in ("interface", "address", "port", "debug",
2375
 
                   "priority", "servicename", "configdir",
2376
 
                   "use_dbus", "use_ipv6", "debuglevel", "restore",
2377
 
                   "statedir", "socket", "foreground", "zeroconf"):
 
3035
                   "priority", "servicename", "configdir", "use_dbus",
 
3036
                   "use_ipv6", "debuglevel", "restore", "statedir",
 
3037
                   "socket", "foreground", "zeroconf"):
2378
3038
        value = getattr(options, option)
2379
3039
        if value is not None:
2380
3040
            server_settings[option] = value
2392
3052
    if server_settings["debug"]:
2393
3053
        server_settings["foreground"] = True
2394
3054
    # Now we have our good server settings in "server_settings"
2395
 
    
 
3055
 
2396
3056
    ##################################################################
2397
 
    
2398
 
    if (not server_settings["zeroconf"] and
2399
 
        not (server_settings["port"]
2400
 
             or server_settings["socket"] != "")):
2401
 
            parser.error("Needs port or socket to work without"
2402
 
                         " Zeroconf")
2403
 
    
 
3057
 
 
3058
    if (not server_settings["zeroconf"]
 
3059
        and not (server_settings["port"]
 
3060
                 or server_settings["socket"] != "")):
 
3061
        parser.error("Needs port or socket to work without Zeroconf")
 
3062
 
2404
3063
    # For convenience
2405
3064
    debug = server_settings["debug"]
2406
3065
    debuglevel = server_settings["debuglevel"]
2410
3069
                                     stored_state_file)
2411
3070
    foreground = server_settings["foreground"]
2412
3071
    zeroconf = server_settings["zeroconf"]
2413
 
    
 
3072
 
2414
3073
    if debug:
2415
3074
        initlogger(debug, logging.DEBUG)
2416
3075
    else:
2419
3078
        else:
2420
3079
            level = getattr(logging, debuglevel.upper())
2421
3080
            initlogger(debug, level)
2422
 
    
 
3081
 
2423
3082
    if server_settings["servicename"] != "Mandos":
2424
 
        syslogger.setFormatter(logging.Formatter
2425
 
                               ('Mandos ({}) [%(process)d]:'
2426
 
                                ' %(levelname)s: %(message)s'
2427
 
                                .format(server_settings
2428
 
                                        ["servicename"])))
2429
 
    
 
3083
        syslogger.setFormatter(
 
3084
            logging.Formatter('Mandos ({}) [%(process)d]:'
 
3085
                              ' %(levelname)s: %(message)s'.format(
 
3086
                                  server_settings["servicename"])))
 
3087
 
2430
3088
    # Parse config file with clients
2431
 
    client_config = configparser.SafeConfigParser(Client
2432
 
                                                  .client_defaults)
 
3089
    client_config = configparser.ConfigParser(Client.client_defaults)
2433
3090
    client_config.read(os.path.join(server_settings["configdir"],
2434
3091
                                    "clients.conf"))
2435
 
    
 
3092
 
2436
3093
    global mandos_dbus_service
2437
3094
    mandos_dbus_service = None
2438
 
    
 
3095
 
2439
3096
    socketfd = None
2440
3097
    if server_settings["socket"] != "":
2441
3098
        socketfd = server_settings["socket"]
2442
 
    tcp_server = MandosServer((server_settings["address"],
2443
 
                               server_settings["port"]),
2444
 
                              ClientHandler,
2445
 
                              interface=(server_settings["interface"]
2446
 
                                         or None),
2447
 
                              use_ipv6=use_ipv6,
2448
 
                              gnutls_priority=
2449
 
                              server_settings["priority"],
2450
 
                              use_dbus=use_dbus,
2451
 
                              socketfd=socketfd)
 
3099
    tcp_server = MandosServer(
 
3100
        (server_settings["address"], server_settings["port"]),
 
3101
        ClientHandler,
 
3102
        interface=(server_settings["interface"] or None),
 
3103
        use_ipv6=use_ipv6,
 
3104
        gnutls_priority=server_settings["priority"],
 
3105
        use_dbus=use_dbus,
 
3106
        socketfd=socketfd)
2452
3107
    if not foreground:
2453
3108
        pidfilename = "/run/mandos.pid"
2454
3109
        if not os.path.isdir("/run/."):
2455
3110
            pidfilename = "/var/run/mandos.pid"
2456
3111
        pidfile = None
2457
3112
        try:
2458
 
            pidfile = open(pidfilename, "w")
 
3113
            pidfile = codecs.open(pidfilename, "w", encoding="utf-8")
2459
3114
        except IOError as e:
2460
3115
            logger.error("Could not open file %r", pidfilename,
2461
3116
                         exc_info=e)
2462
 
    
2463
 
    for name in ("_mandos", "mandos", "nobody"):
 
3117
 
 
3118
    for name, group in (("_mandos", "_mandos"),
 
3119
                        ("mandos", "mandos"),
 
3120
                        ("nobody", "nogroup")):
2464
3121
        try:
2465
3122
            uid = pwd.getpwnam(name).pw_uid
2466
 
            gid = pwd.getpwnam(name).pw_gid
 
3123
            gid = pwd.getpwnam(group).pw_gid
2467
3124
            break
2468
3125
        except KeyError:
2469
3126
            continue
2473
3130
    try:
2474
3131
        os.setgid(gid)
2475
3132
        os.setuid(uid)
 
3133
        if debug:
 
3134
            logger.debug("Did setuid/setgid to {}:{}".format(uid,
 
3135
                                                             gid))
2476
3136
    except OSError as error:
 
3137
        logger.warning("Failed to setuid/setgid to {}:{}: {}"
 
3138
                       .format(uid, gid, os.strerror(error.errno)))
2477
3139
        if error.errno != errno.EPERM:
2478
3140
            raise
2479
 
    
 
3141
 
2480
3142
    if debug:
2481
3143
        # Enable all possible GnuTLS debugging
2482
 
        
 
3144
 
2483
3145
        # "Use a log level over 10 to enable all debugging options."
2484
3146
        # - GnuTLS manual
2485
 
        gnutls.library.functions.gnutls_global_set_log_level(11)
2486
 
        
2487
 
        @gnutls.library.types.gnutls_log_func
 
3147
        gnutls.global_set_log_level(11)
 
3148
 
 
3149
        @gnutls.log_func
2488
3150
        def debug_gnutls(level, string):
2489
3151
            logger.debug("GnuTLS: %s", string[:-1])
2490
 
        
2491
 
        (gnutls.library.functions
2492
 
         .gnutls_global_set_log_function(debug_gnutls))
2493
 
        
 
3152
 
 
3153
        gnutls.global_set_log_function(debug_gnutls)
 
3154
 
2494
3155
        # Redirect stdin so all checkers get /dev/null
2495
3156
        null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2496
3157
        os.dup2(null, sys.stdin.fileno())
2497
3158
        if null > 2:
2498
3159
            os.close(null)
2499
 
    
 
3160
 
2500
3161
    # Need to fork before connecting to D-Bus
2501
3162
    if not foreground:
2502
3163
        # Close all input and output, do double fork, etc.
2503
3164
        daemon()
2504
 
    
2505
 
    # multiprocessing will use threads, so before we use gobject we
2506
 
    # need to inform gobject that threads will be used.
2507
 
    gobject.threads_init()
2508
 
    
 
3165
 
 
3166
    if gi.version_info < (3, 10, 2):
 
3167
        # multiprocessing will use threads, so before we use GLib we
 
3168
        # need to inform GLib that threads will be used.
 
3169
        GLib.threads_init()
 
3170
 
2509
3171
    global main_loop
2510
3172
    # From the Avahi example code
2511
3173
    DBusGMainLoop(set_as_default=True)
2512
 
    main_loop = gobject.MainLoop()
 
3174
    main_loop = GLib.MainLoop()
2513
3175
    bus = dbus.SystemBus()
2514
3176
    # End of Avahi example code
2515
3177
    if use_dbus:
2516
3178
        try:
2517
3179
            bus_name = dbus.service.BusName("se.recompile.Mandos",
2518
 
                                            bus, do_not_queue=True)
2519
 
            old_bus_name = (dbus.service.BusName
2520
 
                            ("se.bsnet.fukt.Mandos", bus,
2521
 
                             do_not_queue=True))
2522
 
        except dbus.exceptions.NameExistsException as e:
 
3180
                                            bus,
 
3181
                                            do_not_queue=True)
 
3182
            old_bus_name = dbus.service.BusName(
 
3183
                "se.bsnet.fukt.Mandos", bus,
 
3184
                do_not_queue=True)
 
3185
        except dbus.exceptions.DBusException as e:
2523
3186
            logger.error("Disabling D-Bus:", exc_info=e)
2524
3187
            use_dbus = False
2525
3188
            server_settings["use_dbus"] = False
2526
3189
            tcp_server.use_dbus = False
2527
3190
    if zeroconf:
2528
3191
        protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2529
 
        service = AvahiServiceToSyslog(name =
2530
 
                                       server_settings["servicename"],
2531
 
                                       servicetype = "_mandos._tcp",
2532
 
                                       protocol = protocol, bus = bus)
 
3192
        service = AvahiServiceToSyslog(
 
3193
            name=server_settings["servicename"],
 
3194
            servicetype="_mandos._tcp",
 
3195
            protocol=protocol,
 
3196
            bus=bus)
2533
3197
        if server_settings["interface"]:
2534
 
            service.interface = (if_nametoindex
2535
 
                                 (server_settings["interface"]
2536
 
                                  .encode("utf-8")))
2537
 
    
 
3198
            service.interface = if_nametoindex(
 
3199
                server_settings["interface"].encode("utf-8"))
 
3200
 
2538
3201
    global multiprocessing_manager
2539
3202
    multiprocessing_manager = multiprocessing.Manager()
2540
 
    
 
3203
 
2541
3204
    client_class = Client
2542
3205
    if use_dbus:
2543
 
        client_class = functools.partial(ClientDBus, bus = bus)
2544
 
    
 
3206
        client_class = functools.partial(ClientDBus, bus=bus)
 
3207
 
2545
3208
    client_settings = Client.config_parser(client_config)
2546
3209
    old_client_settings = {}
2547
3210
    clients_data = {}
2548
 
    
 
3211
 
2549
3212
    # This is used to redirect stdout and stderr for checker processes
2550
3213
    global wnull
2551
 
    wnull = open(os.devnull, "w") # A writable /dev/null
 
3214
    wnull = open(os.devnull, "w")  # A writable /dev/null
2552
3215
    # Only used if server is running in foreground but not in debug
2553
3216
    # mode
2554
3217
    if debug or not foreground:
2555
3218
        wnull.close()
2556
 
    
 
3219
 
2557
3220
    # Get client data and settings from last running state.
2558
3221
    if server_settings["restore"]:
2559
3222
        try:
2560
3223
            with open(stored_state_path, "rb") as stored_state:
2561
 
                clients_data, old_client_settings = (pickle.load
2562
 
                                                     (stored_state))
 
3224
                if sys.version_info.major == 2:
 
3225
                    clients_data, old_client_settings = pickle.load(
 
3226
                        stored_state)
 
3227
                else:
 
3228
                    bytes_clients_data, bytes_old_client_settings = (
 
3229
                        pickle.load(stored_state, encoding="bytes"))
 
3230
                    #   Fix bytes to strings
 
3231
                    #  clients_data
 
3232
                    # .keys()
 
3233
                    clients_data = {(key.decode("utf-8")
 
3234
                                     if isinstance(key, bytes)
 
3235
                                     else key): value
 
3236
                                    for key, value in
 
3237
                                    bytes_clients_data.items()}
 
3238
                    del bytes_clients_data
 
3239
                    for key in clients_data:
 
3240
                        value = {(k.decode("utf-8")
 
3241
                                  if isinstance(k, bytes) else k): v
 
3242
                                 for k, v in
 
3243
                                 clients_data[key].items()}
 
3244
                        clients_data[key] = value
 
3245
                        # .client_structure
 
3246
                        value["client_structure"] = [
 
3247
                            (s.decode("utf-8")
 
3248
                             if isinstance(s, bytes)
 
3249
                             else s) for s in
 
3250
                            value["client_structure"]]
 
3251
                        # .name & .host
 
3252
                        for k in ("name", "host"):
 
3253
                            if isinstance(value[k], bytes):
 
3254
                                value[k] = value[k].decode("utf-8")
 
3255
                        if "key_id" not in value:
 
3256
                            value["key_id"] = ""
 
3257
                        elif "fingerprint" not in value:
 
3258
                            value["fingerprint"] = ""
 
3259
                    #  old_client_settings
 
3260
                    # .keys()
 
3261
                    old_client_settings = {
 
3262
                        (key.decode("utf-8")
 
3263
                         if isinstance(key, bytes)
 
3264
                         else key): value
 
3265
                        for key, value in
 
3266
                        bytes_old_client_settings.items()}
 
3267
                    del bytes_old_client_settings
 
3268
                    # .host
 
3269
                    for value in old_client_settings.values():
 
3270
                        if isinstance(value["host"], bytes):
 
3271
                            value["host"] = (value["host"]
 
3272
                                             .decode("utf-8"))
2563
3273
            os.remove(stored_state_path)
2564
3274
        except IOError as e:
2565
3275
            if e.errno == errno.ENOENT:
2566
 
                logger.warning("Could not load persistent state: {}"
2567
 
                                .format(os.strerror(e.errno)))
 
3276
                logger.warning("Could not load persistent state:"
 
3277
                               " {}".format(os.strerror(e.errno)))
2568
3278
            else:
2569
3279
                logger.critical("Could not load persistent state:",
2570
3280
                                exc_info=e)
2571
3281
                raise
2572
3282
        except EOFError as e:
2573
3283
            logger.warning("Could not load persistent state: "
2574
 
                           "EOFError:", exc_info=e)
2575
 
    
 
3284
                           "EOFError:",
 
3285
                           exc_info=e)
 
3286
 
2576
3287
    with PGPEngine() as pgp:
2577
3288
        for client_name, client in clients_data.items():
2578
3289
            # Skip removed clients
2579
3290
            if client_name not in client_settings:
2580
3291
                continue
2581
 
            
 
3292
 
2582
3293
            # Decide which value to use after restoring saved state.
2583
3294
            # We have three different values: Old config file,
2584
3295
            # new config file, and saved state.
2589
3300
                    # For each value in new config, check if it
2590
3301
                    # differs from the old config value (Except for
2591
3302
                    # the "secret" attribute)
2592
 
                    if (name != "secret" and
2593
 
                        value != old_client_settings[client_name]
2594
 
                        [name]):
 
3303
                    if (name != "secret"
 
3304
                        and (value !=
 
3305
                             old_client_settings[client_name][name])):
2595
3306
                        client[name] = value
2596
3307
                except KeyError:
2597
3308
                    pass
2598
 
            
 
3309
 
2599
3310
            # Clients who has passed its expire date can still be
2600
 
            # enabled if its last checker was successful.  Clients
 
3311
            # enabled if its last checker was successful.  A Client
2601
3312
            # whose checker succeeded before we stored its state is
2602
3313
            # assumed to have successfully run all checkers during
2603
3314
            # downtime.
2606
3317
                    if not client["last_checked_ok"]:
2607
3318
                        logger.warning(
2608
3319
                            "disabling client {} - Client never "
2609
 
                            "performed a successful checker"
2610
 
                            .format(client_name))
 
3320
                            "performed a successful checker".format(
 
3321
                                client_name))
2611
3322
                        client["enabled"] = False
2612
3323
                    elif client["last_checker_status"] != 0:
2613
3324
                        logger.warning(
2614
3325
                            "disabling client {} - Client last"
2615
 
                            " checker failed with error code {}"
2616
 
                            .format(client_name,
2617
 
                                    client["last_checker_status"]))
 
3326
                            " checker failed with error code"
 
3327
                            " {}".format(
 
3328
                                client_name,
 
3329
                                client["last_checker_status"]))
2618
3330
                        client["enabled"] = False
2619
3331
                    else:
2620
 
                        client["expires"] = (datetime.datetime
2621
 
                                             .utcnow()
2622
 
                                             + client["timeout"])
 
3332
                        client["expires"] = (
 
3333
                            datetime.datetime.utcnow()
 
3334
                            + client["timeout"])
2623
3335
                        logger.debug("Last checker succeeded,"
2624
 
                                     " keeping {} enabled"
2625
 
                                     .format(client_name))
 
3336
                                     " keeping {} enabled".format(
 
3337
                                         client_name))
2626
3338
            try:
2627
 
                client["secret"] = (
2628
 
                    pgp.decrypt(client["encrypted_secret"],
2629
 
                                client_settings[client_name]
2630
 
                                ["secret"]))
 
3339
                client["secret"] = pgp.decrypt(
 
3340
                    client["encrypted_secret"],
 
3341
                    client_settings[client_name]["secret"])
2631
3342
            except PGPError:
2632
3343
                # If decryption fails, we use secret from new settings
2633
 
                logger.debug("Failed to decrypt {} old secret"
2634
 
                             .format(client_name))
2635
 
                client["secret"] = (
2636
 
                    client_settings[client_name]["secret"])
2637
 
    
 
3344
                logger.debug("Failed to decrypt {} old secret".format(
 
3345
                    client_name))
 
3346
                client["secret"] = (client_settings[client_name]
 
3347
                                    ["secret"])
 
3348
 
2638
3349
    # Add/remove clients based on new changes made to config
2639
3350
    for client_name in (set(old_client_settings)
2640
3351
                        - set(client_settings)):
2642
3353
    for client_name in (set(client_settings)
2643
3354
                        - set(old_client_settings)):
2644
3355
        clients_data[client_name] = client_settings[client_name]
2645
 
    
 
3356
 
2646
3357
    # Create all client objects
2647
3358
    for client_name, client in clients_data.items():
2648
3359
        tcp_server.clients[client_name] = client_class(
2649
 
            name = client_name, settings = client,
2650
 
            server_settings = server_settings)
2651
 
    
 
3360
            name=client_name,
 
3361
            settings=client,
 
3362
            server_settings=server_settings)
 
3363
 
2652
3364
    if not tcp_server.clients:
2653
3365
        logger.warning("No clients defined")
2654
 
    
 
3366
 
2655
3367
    if not foreground:
2656
3368
        if pidfile is not None:
 
3369
            pid = os.getpid()
2657
3370
            try:
2658
3371
                with pidfile:
2659
 
                    pid = os.getpid()
2660
 
                    pidfile.write("{}\n".format(pid).encode("utf-8"))
 
3372
                    print(pid, file=pidfile)
2661
3373
            except IOError:
2662
3374
                logger.error("Could not write to file %r with PID %d",
2663
3375
                             pidfilename, pid)
2664
3376
        del pidfile
2665
3377
        del pidfilename
2666
 
    
2667
 
    signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2668
 
    signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
2669
 
    
 
3378
 
 
3379
    for termsig in (signal.SIGHUP, signal.SIGTERM):
 
3380
        GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,
 
3381
                             lambda: main_loop.quit() and False)
 
3382
 
2670
3383
    if use_dbus:
2671
 
        @alternate_dbus_interfaces({"se.recompile.Mandos":
2672
 
                                        "se.bsnet.fukt.Mandos"})
2673
 
        class MandosDBusService(DBusObjectWithProperties):
 
3384
 
 
3385
        @alternate_dbus_interfaces(
 
3386
            {"se.recompile.Mandos": "se.bsnet.fukt.Mandos"})
 
3387
        class MandosDBusService(DBusObjectWithObjectManager):
2674
3388
            """A D-Bus proxy object"""
 
3389
 
2675
3390
            def __init__(self):
2676
3391
                dbus.service.Object.__init__(self, bus, "/")
 
3392
 
2677
3393
            _interface = "se.recompile.Mandos"
2678
 
            
2679
 
            @dbus_interface_annotations(_interface)
2680
 
            def _foo(self):
2681
 
                return { "org.freedesktop.DBus.Property"
2682
 
                         ".EmitsChangedSignal":
2683
 
                             "false"}
2684
 
            
 
3394
 
2685
3395
            @dbus.service.signal(_interface, signature="o")
2686
3396
            def ClientAdded(self, objpath):
2687
3397
                "D-Bus signal"
2688
3398
                pass
2689
 
            
 
3399
 
2690
3400
            @dbus.service.signal(_interface, signature="ss")
2691
 
            def ClientNotFound(self, fingerprint, address):
 
3401
            def ClientNotFound(self, key_id, address):
2692
3402
                "D-Bus signal"
2693
3403
                pass
2694
 
            
 
3404
 
 
3405
            @dbus_annotations({"org.freedesktop.DBus.Deprecated":
 
3406
                               "true"})
2695
3407
            @dbus.service.signal(_interface, signature="os")
2696
3408
            def ClientRemoved(self, objpath, name):
2697
3409
                "D-Bus signal"
2698
3410
                pass
2699
 
            
 
3411
 
 
3412
            @dbus_annotations({"org.freedesktop.DBus.Deprecated":
 
3413
                               "true"})
2700
3414
            @dbus.service.method(_interface, out_signature="ao")
2701
3415
            def GetAllClients(self):
2702
3416
                "D-Bus method"
2703
 
                return dbus.Array(c.dbus_object_path
2704
 
                                  for c in
2705
 
                                  tcp_server.clients.itervalues())
2706
 
            
 
3417
                return dbus.Array(c.dbus_object_path for c in
 
3418
                                  tcp_server.clients.values())
 
3419
 
 
3420
            @dbus_annotations({"org.freedesktop.DBus.Deprecated":
 
3421
                               "true"})
2707
3422
            @dbus.service.method(_interface,
2708
3423
                                 out_signature="a{oa{sv}}")
2709
3424
            def GetAllClientsWithProperties(self):
2710
3425
                "D-Bus method"
2711
3426
                return dbus.Dictionary(
2712
 
                    ((c.dbus_object_path, c.GetAll(""))
2713
 
                     for c in tcp_server.clients.itervalues()),
 
3427
                    {c.dbus_object_path: c.GetAll(
 
3428
                        "se.recompile.Mandos.Client")
 
3429
                     for c in tcp_server.clients.values()},
2714
3430
                    signature="oa{sv}")
2715
 
            
 
3431
 
2716
3432
            @dbus.service.method(_interface, in_signature="o")
2717
3433
            def RemoveClient(self, object_path):
2718
3434
                "D-Bus method"
2719
 
                for c in tcp_server.clients.itervalues():
 
3435
                for c in tcp_server.clients.values():
2720
3436
                    if c.dbus_object_path == object_path:
2721
3437
                        del tcp_server.clients[c.name]
2722
3438
                        c.remove_from_connection()
2723
 
                        # Don't signal anything except ClientRemoved
 
3439
                        # Don't signal the disabling
2724
3440
                        c.disable(quiet=True)
2725
 
                        # Emit D-Bus signal
2726
 
                        self.ClientRemoved(object_path, c.name)
 
3441
                        # Emit D-Bus signal for removal
 
3442
                        self.client_removed_signal(c)
2727
3443
                        return
2728
3444
                raise KeyError(object_path)
2729
 
            
 
3445
 
2730
3446
            del _interface
2731
 
        
 
3447
 
 
3448
            @dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
 
3449
                                 out_signature="a{oa{sa{sv}}}")
 
3450
            def GetManagedObjects(self):
 
3451
                """D-Bus method"""
 
3452
                return dbus.Dictionary(
 
3453
                    {client.dbus_object_path:
 
3454
                     dbus.Dictionary(
 
3455
                         {interface: client.GetAll(interface)
 
3456
                          for interface in
 
3457
                          client._get_all_interface_names()})
 
3458
                     for client in tcp_server.clients.values()})
 
3459
 
 
3460
            def client_added_signal(self, client):
 
3461
                """Send the new standard signal and the old signal"""
 
3462
                if use_dbus:
 
3463
                    # New standard signal
 
3464
                    self.InterfacesAdded(
 
3465
                        client.dbus_object_path,
 
3466
                        dbus.Dictionary(
 
3467
                            {interface: client.GetAll(interface)
 
3468
                             for interface in
 
3469
                             client._get_all_interface_names()}))
 
3470
                    # Old signal
 
3471
                    self.ClientAdded(client.dbus_object_path)
 
3472
 
 
3473
            def client_removed_signal(self, client):
 
3474
                """Send the new standard signal and the old signal"""
 
3475
                if use_dbus:
 
3476
                    # New standard signal
 
3477
                    self.InterfacesRemoved(
 
3478
                        client.dbus_object_path,
 
3479
                        client._get_all_interface_names())
 
3480
                    # Old signal
 
3481
                    self.ClientRemoved(client.dbus_object_path,
 
3482
                                       client.name)
 
3483
 
2732
3484
        mandos_dbus_service = MandosDBusService()
2733
 
    
 
3485
 
 
3486
    # Save modules to variables to exempt the modules from being
 
3487
    # unloaded before the function registered with atexit() is run.
 
3488
    mp = multiprocessing
 
3489
    wn = wnull
 
3490
 
2734
3491
    def cleanup():
2735
3492
        "Cleanup function; run on exit"
2736
3493
        if zeroconf:
2737
3494
            service.cleanup()
2738
 
        
2739
 
        multiprocessing.active_children()
2740
 
        wnull.close()
 
3495
 
 
3496
        mp.active_children()
 
3497
        wn.close()
2741
3498
        if not (tcp_server.clients or client_settings):
2742
3499
            return
2743
 
        
 
3500
 
2744
3501
        # Store client before exiting. Secrets are encrypted with key
2745
3502
        # based on what config file has. If config file is
2746
3503
        # removed/edited, old secret will thus be unrecovable.
2747
3504
        clients = {}
2748
3505
        with PGPEngine() as pgp:
2749
 
            for client in tcp_server.clients.itervalues():
 
3506
            for client in tcp_server.clients.values():
2750
3507
                key = client_settings[client.name]["secret"]
2751
3508
                client.encrypted_secret = pgp.encrypt(client.secret,
2752
3509
                                                      key)
2753
3510
                client_dict = {}
2754
 
                
 
3511
 
2755
3512
                # A list of attributes that can not be pickled
2756
3513
                # + secret.
2757
 
                exclude = { "bus", "changedstate", "secret",
2758
 
                            "checker", "server_settings" }
2759
 
                for name, typ in (inspect.getmembers
2760
 
                                  (dbus.service.Object)):
 
3514
                exclude = {"bus", "changedstate", "secret",
 
3515
                           "checker", "server_settings"}
 
3516
                for name, typ in inspect.getmembers(dbus.service
 
3517
                                                    .Object):
2761
3518
                    exclude.add(name)
2762
 
                
 
3519
 
2763
3520
                client_dict["encrypted_secret"] = (client
2764
3521
                                                   .encrypted_secret)
2765
3522
                for attr in client.client_structure:
2766
3523
                    if attr not in exclude:
2767
3524
                        client_dict[attr] = getattr(client, attr)
2768
 
                
 
3525
 
2769
3526
                clients[client.name] = client_dict
2770
3527
                del client_settings[client.name]["secret"]
2771
 
        
 
3528
 
2772
3529
        try:
2773
 
            with (tempfile.NamedTemporaryFile
2774
 
                  (mode='wb', suffix=".pickle", prefix='clients-',
2775
 
                   dir=os.path.dirname(stored_state_path),
2776
 
                   delete=False)) as stored_state:
2777
 
                pickle.dump((clients, client_settings), stored_state)
2778
 
                tempname=stored_state.name
 
3530
            with tempfile.NamedTemporaryFile(
 
3531
                    mode='wb',
 
3532
                    suffix=".pickle",
 
3533
                    prefix='clients-',
 
3534
                    dir=os.path.dirname(stored_state_path),
 
3535
                    delete=False) as stored_state:
 
3536
                pickle.dump((clients, client_settings), stored_state,
 
3537
                            protocol=2)
 
3538
                tempname = stored_state.name
2779
3539
            os.rename(tempname, stored_state_path)
2780
3540
        except (IOError, OSError) as e:
2781
3541
            if not debug:
2790
3550
                logger.warning("Could not save persistent state:",
2791
3551
                               exc_info=e)
2792
3552
                raise
2793
 
        
 
3553
 
2794
3554
        # Delete all clients, and settings from config
2795
3555
        while tcp_server.clients:
2796
3556
            name, client = tcp_server.clients.popitem()
2797
3557
            if use_dbus:
2798
3558
                client.remove_from_connection()
2799
 
            # Don't signal anything except ClientRemoved
 
3559
            # Don't signal the disabling
2800
3560
            client.disable(quiet=True)
 
3561
            # Emit D-Bus signal for removal
2801
3562
            if use_dbus:
2802
 
                # Emit D-Bus signal
2803
 
                mandos_dbus_service.ClientRemoved(client
2804
 
                                                  .dbus_object_path,
2805
 
                                                  client.name)
 
3563
                mandos_dbus_service.client_removed_signal(client)
2806
3564
        client_settings.clear()
2807
 
    
 
3565
 
2808
3566
    atexit.register(cleanup)
2809
 
    
2810
 
    for client in tcp_server.clients.itervalues():
 
3567
 
 
3568
    for client in tcp_server.clients.values():
2811
3569
        if use_dbus:
2812
 
            # Emit D-Bus signal
2813
 
            mandos_dbus_service.ClientAdded(client.dbus_object_path)
 
3570
            # Emit D-Bus signal for adding
 
3571
            mandos_dbus_service.client_added_signal(client)
2814
3572
        # Need to initiate checking of clients
2815
3573
        if client.enabled:
2816
3574
            client.init_checker()
2817
 
    
 
3575
 
2818
3576
    tcp_server.enable()
2819
3577
    tcp_server.server_activate()
2820
 
    
 
3578
 
2821
3579
    # Find out what port we got
2822
3580
    if zeroconf:
2823
3581
        service.port = tcp_server.socket.getsockname()[1]
2828
3586
    else:                       # IPv4
2829
3587
        logger.info("Now listening on address %r, port %d",
2830
3588
                    *tcp_server.socket.getsockname())
2831
 
    
2832
 
    #service.interface = tcp_server.socket.getsockname()[3]
2833
 
    
 
3589
 
 
3590
    # service.interface = tcp_server.socket.getsockname()[3]
 
3591
 
2834
3592
    try:
2835
3593
        if zeroconf:
2836
3594
            # From the Avahi example code
2841
3599
                cleanup()
2842
3600
                sys.exit(1)
2843
3601
            # End of Avahi example code
2844
 
        
2845
 
        gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
2846
 
                             lambda *args, **kwargs:
2847
 
                             (tcp_server.handle_request
2848
 
                              (*args[2:], **kwargs) or True))
2849
 
        
 
3602
 
 
3603
        GLib.io_add_watch(tcp_server.fileno(), GLib.IO_IN,
 
3604
                          lambda *args, **kwargs:
 
3605
                          (tcp_server.handle_request
 
3606
                           (*args[2:], **kwargs) or True))
 
3607
 
2850
3608
        logger.debug("Starting main loop")
2851
3609
        main_loop.run()
2852
3610
    except AvahiError as error:
2861
3619
    # Must run before the D-Bus bus name gets deregistered
2862
3620
    cleanup()
2863
3621
 
 
3622
 
2864
3623
if __name__ == '__main__':
2865
3624
    main()