/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos

  • Committer: Teddy Hogeborn
  • Date: 2019-08-18 00:42:22 UTC
  • Revision ID: teddy@recompile.se-20190818004222-lfrgtnmqz766a08e
Client: Use the systemd sysusers.d mechanism, if present

* Makefile (install-client-nokey): Also install sysusers.d file, if
                                   $(SYSUSERS) exists.
* sysusers.d-mandos.conf: Adjust comment to match reality.

Show diffs side-by-side

added added

removed removed

Lines of Context:
mandos
1
 
#!/usr/bin/python2.7
 
1
#!/usr/bin/python
2
2
# -*- mode: python; coding: utf-8 -*-
3
 
# 
 
3
#
4
4
# Mandos server - give out binary blobs to connecting clients.
5
 
# 
 
5
#
6
6
# This program is partly derived from an example program for an Avahi
7
7
# service publisher, downloaded from
8
8
# <http://avahi.org/wiki/PythonPublishExample>.  This includes the
9
9
# methods "add", "remove", "server_state_changed",
10
10
# "entry_group_state_changed", "cleanup", and "activate" in the
11
11
# "AvahiService" class, and some lines in "main".
12
 
# 
 
12
#
13
13
# Everything else is
14
 
# Copyright © 2008-2014 Teddy Hogeborn
15
 
# Copyright © 2008-2014 Björn Påhlsson
16
 
# 
17
 
# This program is free software: you can redistribute it and/or modify
18
 
# it under the terms of the GNU General Public License as published by
 
14
# Copyright © 2008-2019 Teddy Hogeborn
 
15
# Copyright © 2008-2019 Björn Påhlsson
 
16
#
 
17
# This file is part of Mandos.
 
18
#
 
19
# Mandos is free software: you can redistribute it and/or modify it
 
20
# under the terms of the GNU General Public License as published by
19
21
# the Free Software Foundation, either version 3 of the License, or
20
22
# (at your option) any later version.
21
23
#
22
 
#     This program is distributed in the hope that it will be useful,
23
 
#     but WITHOUT ANY WARRANTY; without even the implied warranty of
 
24
#     Mandos is distributed in the hope that it will be useful, but
 
25
#     WITHOUT ANY WARRANTY; without even the implied warranty of
24
26
#     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
25
27
#     GNU General Public License for more details.
26
 
# 
 
28
#
27
29
# You should have received a copy of the GNU General Public License
28
 
# along with this program.  If not, see
29
 
# <http://www.gnu.org/licenses/>.
30
 
# 
 
30
# along with Mandos.  If not, see <http://www.gnu.org/licenses/>.
 
31
#
31
32
# Contact the authors at <mandos@recompile.se>.
32
 
# 
 
33
#
33
34
 
34
35
from __future__ import (division, absolute_import, print_function,
35
36
                        unicode_literals)
36
37
 
37
 
from future_builtins import *
 
38
try:
 
39
    from future_builtins import *
 
40
except ImportError:
 
41
    pass
38
42
 
39
 
import SocketServer as socketserver
 
43
try:
 
44
    import SocketServer as socketserver
 
45
except ImportError:
 
46
    import socketserver
40
47
import socket
41
48
import argparse
42
49
import datetime
43
50
import errno
44
 
import gnutls.crypto
45
 
import gnutls.connection
46
 
import gnutls.errors
47
 
import gnutls.library.functions
48
 
import gnutls.library.constants
49
 
import gnutls.library.types
50
 
import ConfigParser as configparser
 
51
try:
 
52
    import ConfigParser as configparser
 
53
except ImportError:
 
54
    import configparser
51
55
import sys
52
56
import re
53
57
import os
62
66
import struct
63
67
import fcntl
64
68
import functools
65
 
import cPickle as pickle
 
69
try:
 
70
    import cPickle as pickle
 
71
except ImportError:
 
72
    import pickle
66
73
import multiprocessing
67
74
import types
68
75
import binascii
69
76
import tempfile
70
77
import itertools
71
78
import collections
 
79
import codecs
72
80
 
73
81
import dbus
74
82
import dbus.service
75
 
import gobject
76
 
import avahi
 
83
import gi
 
84
from gi.repository import GLib
77
85
from dbus.mainloop.glib import DBusGMainLoop
78
86
import ctypes
79
87
import ctypes.util
80
88
import xml.dom.minidom
81
89
import inspect
82
90
 
 
91
if sys.version_info.major == 2:
 
92
    __metaclass__ = type
 
93
 
 
94
# Try to find the value of SO_BINDTODEVICE:
83
95
try:
 
96
    # This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and
 
97
    # newer, and it is also the most natural place for it:
84
98
    SO_BINDTODEVICE = socket.SO_BINDTODEVICE
85
99
except AttributeError:
86
100
    try:
 
101
        # This is where SO_BINDTODEVICE was up to and including Python
 
102
        # 2.6, and also 3.2:
87
103
        from IN import SO_BINDTODEVICE
88
104
    except ImportError:
89
 
        SO_BINDTODEVICE = None
 
105
        # In Python 2.7 it seems to have been removed entirely.
 
106
        # Try running the C preprocessor:
 
107
        try:
 
108
            cc = subprocess.Popen(["cc", "--language=c", "-E",
 
109
                                   "/dev/stdin"],
 
110
                                  stdin=subprocess.PIPE,
 
111
                                  stdout=subprocess.PIPE)
 
112
            stdout = cc.communicate(
 
113
                "#include <sys/socket.h>\nSO_BINDTODEVICE\n")[0]
 
114
            SO_BINDTODEVICE = int(stdout.splitlines()[-1])
 
115
        except (OSError, ValueError, IndexError):
 
116
            # No value found
 
117
            SO_BINDTODEVICE = None
90
118
 
91
119
if sys.version_info.major == 2:
92
120
    str = unicode
93
121
 
94
 
version = "1.6.9"
 
122
if sys.version_info < (3, 2):
 
123
    configparser.Configparser = configparser.SafeConfigParser
 
124
 
 
125
version = "1.8.7"
95
126
stored_state_file = "clients.pickle"
96
127
 
97
128
logger = logging.getLogger()
98
129
syslogger = None
99
130
 
100
131
try:
101
 
    if_nametoindex = (ctypes.cdll.LoadLibrary
102
 
                      (ctypes.util.find_library("c"))
103
 
                      .if_nametoindex)
 
132
    if_nametoindex = ctypes.cdll.LoadLibrary(
 
133
        ctypes.util.find_library("c")).if_nametoindex
104
134
except (OSError, AttributeError):
 
135
 
105
136
    def if_nametoindex(interface):
106
137
        "Get an interface index the hard way, i.e. using fcntl()"
107
138
        SIOCGIFINDEX = 0x8933  # From /usr/include/linux/sockios.h
112
143
        return interface_index
113
144
 
114
145
 
 
146
def copy_function(func):
 
147
    """Make a copy of a function"""
 
148
    if sys.version_info.major == 2:
 
149
        return types.FunctionType(func.func_code,
 
150
                                  func.func_globals,
 
151
                                  func.func_name,
 
152
                                  func.func_defaults,
 
153
                                  func.func_closure)
 
154
    else:
 
155
        return types.FunctionType(func.__code__,
 
156
                                  func.__globals__,
 
157
                                  func.__name__,
 
158
                                  func.__defaults__,
 
159
                                  func.__closure__)
 
160
 
 
161
 
115
162
def initlogger(debug, level=logging.WARNING):
116
163
    """init logger and add loglevel"""
117
 
    
 
164
 
118
165
    global syslogger
119
 
    syslogger = (logging.handlers.SysLogHandler
120
 
                 (facility =
121
 
                  logging.handlers.SysLogHandler.LOG_DAEMON,
122
 
                  address = "/dev/log"))
 
166
    syslogger = (logging.handlers.SysLogHandler(
 
167
        facility=logging.handlers.SysLogHandler.LOG_DAEMON,
 
168
        address="/dev/log"))
123
169
    syslogger.setFormatter(logging.Formatter
124
170
                           ('Mandos [%(process)d]: %(levelname)s:'
125
171
                            ' %(message)s'))
126
172
    logger.addHandler(syslogger)
127
 
    
 
173
 
128
174
    if debug:
129
175
        console = logging.StreamHandler()
130
176
        console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
140
186
    pass
141
187
 
142
188
 
143
 
class PGPEngine(object):
 
189
class PGPEngine:
144
190
    """A simple class for OpenPGP symmetric encryption & decryption"""
 
191
 
145
192
    def __init__(self):
146
193
        self.tempdir = tempfile.mkdtemp(prefix="mandos-")
 
194
        self.gpg = "gpg"
 
195
        try:
 
196
            output = subprocess.check_output(["gpgconf"])
 
197
            for line in output.splitlines():
 
198
                name, text, path = line.split(b":")
 
199
                if name == "gpg":
 
200
                    self.gpg = path
 
201
                    break
 
202
        except OSError as e:
 
203
            if e.errno != errno.ENOENT:
 
204
                raise
147
205
        self.gnupgargs = ['--batch',
148
 
                          '--home', self.tempdir,
 
206
                          '--homedir', self.tempdir,
149
207
                          '--force-mdc',
150
 
                          '--quiet',
151
 
                          '--no-use-agent']
152
 
    
 
208
                          '--quiet']
 
209
        # Only GPG version 1 has the --no-use-agent option.
 
210
        if self.gpg == "gpg" or self.gpg.endswith("/gpg"):
 
211
            self.gnupgargs.append("--no-use-agent")
 
212
 
153
213
    def __enter__(self):
154
214
        return self
155
 
    
 
215
 
156
216
    def __exit__(self, exc_type, exc_value, traceback):
157
217
        self._cleanup()
158
218
        return False
159
 
    
 
219
 
160
220
    def __del__(self):
161
221
        self._cleanup()
162
 
    
 
222
 
163
223
    def _cleanup(self):
164
224
        if self.tempdir is not None:
165
225
            # Delete contents of tempdir
166
226
            for root, dirs, files in os.walk(self.tempdir,
167
 
                                             topdown = False):
 
227
                                             topdown=False):
168
228
                for filename in files:
169
229
                    os.remove(os.path.join(root, filename))
170
230
                for dirname in dirs:
172
232
            # Remove tempdir
173
233
            os.rmdir(self.tempdir)
174
234
            self.tempdir = None
175
 
    
 
235
 
176
236
    def password_encode(self, password):
177
237
        # Passphrase can not be empty and can not contain newlines or
178
238
        # NUL bytes.  So we prefix it and hex encode it.
183
243
                       .replace(b"\n", b"\\n")
184
244
                       .replace(b"\0", b"\\x00"))
185
245
        return encoded
186
 
    
 
246
 
187
247
    def encrypt(self, data, password):
188
248
        passphrase = self.password_encode(password)
189
 
        with tempfile.NamedTemporaryFile(dir=self.tempdir
190
 
                                         ) as passfile:
 
249
        with tempfile.NamedTemporaryFile(
 
250
                dir=self.tempdir) as passfile:
191
251
            passfile.write(passphrase)
192
252
            passfile.flush()
193
 
            proc = subprocess.Popen(['gpg', '--symmetric',
 
253
            proc = subprocess.Popen([self.gpg, '--symmetric',
194
254
                                     '--passphrase-file',
195
255
                                     passfile.name]
196
256
                                    + self.gnupgargs,
197
 
                                    stdin = subprocess.PIPE,
198
 
                                    stdout = subprocess.PIPE,
199
 
                                    stderr = subprocess.PIPE)
200
 
            ciphertext, err = proc.communicate(input = data)
 
257
                                    stdin=subprocess.PIPE,
 
258
                                    stdout=subprocess.PIPE,
 
259
                                    stderr=subprocess.PIPE)
 
260
            ciphertext, err = proc.communicate(input=data)
201
261
        if proc.returncode != 0:
202
262
            raise PGPError(err)
203
263
        return ciphertext
204
 
    
 
264
 
205
265
    def decrypt(self, data, password):
206
266
        passphrase = self.password_encode(password)
207
 
        with tempfile.NamedTemporaryFile(dir = self.tempdir
208
 
                                         ) as passfile:
 
267
        with tempfile.NamedTemporaryFile(
 
268
                dir=self.tempdir) as passfile:
209
269
            passfile.write(passphrase)
210
270
            passfile.flush()
211
 
            proc = subprocess.Popen(['gpg', '--decrypt',
 
271
            proc = subprocess.Popen([self.gpg, '--decrypt',
212
272
                                     '--passphrase-file',
213
273
                                     passfile.name]
214
274
                                    + self.gnupgargs,
215
 
                                    stdin = subprocess.PIPE,
216
 
                                    stdout = subprocess.PIPE,
217
 
                                    stderr = subprocess.PIPE)
218
 
            decrypted_plaintext, err = proc.communicate(input
219
 
                                                        = data)
 
275
                                    stdin=subprocess.PIPE,
 
276
                                    stdout=subprocess.PIPE,
 
277
                                    stderr=subprocess.PIPE)
 
278
            decrypted_plaintext, err = proc.communicate(input=data)
220
279
        if proc.returncode != 0:
221
280
            raise PGPError(err)
222
281
        return decrypted_plaintext
223
282
 
224
283
 
 
284
# Pretend that we have an Avahi module
 
285
class avahi:
 
286
    """This isn't so much a class as it is a module-like namespace."""
 
287
    IF_UNSPEC = -1               # avahi-common/address.h
 
288
    PROTO_UNSPEC = -1            # avahi-common/address.h
 
289
    PROTO_INET = 0               # avahi-common/address.h
 
290
    PROTO_INET6 = 1              # avahi-common/address.h
 
291
    DBUS_NAME = "org.freedesktop.Avahi"
 
292
    DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"
 
293
    DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"
 
294
    DBUS_PATH_SERVER = "/"
 
295
 
 
296
    @staticmethod
 
297
    def string_array_to_txt_array(t):
 
298
        return dbus.Array((dbus.ByteArray(s.encode("utf-8"))
 
299
                           for s in t), signature="ay")
 
300
    ENTRY_GROUP_ESTABLISHED = 2  # avahi-common/defs.h
 
301
    ENTRY_GROUP_COLLISION = 3    # avahi-common/defs.h
 
302
    ENTRY_GROUP_FAILURE = 4      # avahi-common/defs.h
 
303
    SERVER_INVALID = 0           # avahi-common/defs.h
 
304
    SERVER_REGISTERING = 1       # avahi-common/defs.h
 
305
    SERVER_RUNNING = 2           # avahi-common/defs.h
 
306
    SERVER_COLLISION = 3         # avahi-common/defs.h
 
307
    SERVER_FAILURE = 4           # avahi-common/defs.h
 
308
 
 
309
 
225
310
class AvahiError(Exception):
226
311
    def __init__(self, value, *args, **kwargs):
227
312
        self.value = value
228
313
        return super(AvahiError, self).__init__(value, *args,
229
314
                                                **kwargs)
230
315
 
 
316
 
231
317
class AvahiServiceError(AvahiError):
232
318
    pass
233
319
 
 
320
 
234
321
class AvahiGroupError(AvahiError):
235
322
    pass
236
323
 
237
324
 
238
 
class AvahiService(object):
 
325
class AvahiService:
239
326
    """An Avahi (Zeroconf) service.
240
 
    
 
327
 
241
328
    Attributes:
242
329
    interface: integer; avahi.IF_UNSPEC or an interface index.
243
330
               Used to optionally bind to the specified interface.
255
342
    server: D-Bus Server
256
343
    bus: dbus.SystemBus()
257
344
    """
258
 
    
259
 
    def __init__(self, interface = avahi.IF_UNSPEC, name = None,
260
 
                 servicetype = None, port = None, TXT = None,
261
 
                 domain = "", host = "", max_renames = 32768,
262
 
                 protocol = avahi.PROTO_UNSPEC, bus = None):
 
345
 
 
346
    def __init__(self,
 
347
                 interface=avahi.IF_UNSPEC,
 
348
                 name=None,
 
349
                 servicetype=None,
 
350
                 port=None,
 
351
                 TXT=None,
 
352
                 domain="",
 
353
                 host="",
 
354
                 max_renames=32768,
 
355
                 protocol=avahi.PROTO_UNSPEC,
 
356
                 bus=None):
263
357
        self.interface = interface
264
358
        self.name = name
265
359
        self.type = servicetype
274
368
        self.server = None
275
369
        self.bus = bus
276
370
        self.entry_group_state_changed_match = None
277
 
    
 
371
 
278
372
    def rename(self, remove=True):
279
373
        """Derived from the Avahi example code"""
280
374
        if self.rename_count >= self.max_renames:
282
376
                            " after %i retries, exiting.",
283
377
                            self.rename_count)
284
378
            raise AvahiServiceError("Too many renames")
285
 
        self.name = str(self.server
286
 
                        .GetAlternativeServiceName(self.name))
 
379
        self.name = str(
 
380
            self.server.GetAlternativeServiceName(self.name))
287
381
        self.rename_count += 1
288
382
        logger.info("Changing Zeroconf service name to %r ...",
289
383
                    self.name)
300
394
                logger.critical("D-Bus Exception", exc_info=error)
301
395
                self.cleanup()
302
396
                os._exit(1)
303
 
    
 
397
 
304
398
    def remove(self):
305
399
        """Derived from the Avahi example code"""
306
400
        if self.entry_group_state_changed_match is not None:
308
402
            self.entry_group_state_changed_match = None
309
403
        if self.group is not None:
310
404
            self.group.Reset()
311
 
    
 
405
 
312
406
    def add(self):
313
407
        """Derived from the Avahi example code"""
314
408
        self.remove()
331
425
            dbus.UInt16(self.port),
332
426
            avahi.string_array_to_txt_array(self.TXT))
333
427
        self.group.Commit()
334
 
    
 
428
 
335
429
    def entry_group_state_changed(self, state, error):
336
430
        """Derived from the Avahi example code"""
337
431
        logger.debug("Avahi entry group state change: %i", state)
338
 
        
 
432
 
339
433
        if state == avahi.ENTRY_GROUP_ESTABLISHED:
340
434
            logger.debug("Zeroconf service established.")
341
435
        elif state == avahi.ENTRY_GROUP_COLLISION:
344
438
        elif state == avahi.ENTRY_GROUP_FAILURE:
345
439
            logger.critical("Avahi: Error in group state changed %s",
346
440
                            str(error))
347
 
            raise AvahiGroupError("State changed: {!s}"
348
 
                                  .format(error))
349
 
    
 
441
            raise AvahiGroupError("State changed: {!s}".format(error))
 
442
 
350
443
    def cleanup(self):
351
444
        """Derived from the Avahi example code"""
352
445
        if self.group is not None:
357
450
                pass
358
451
            self.group = None
359
452
        self.remove()
360
 
    
 
453
 
361
454
    def server_state_changed(self, state, error=None):
362
455
        """Derived from the Avahi example code"""
363
456
        logger.debug("Avahi server state change: %i", state)
364
 
        bad_states = { avahi.SERVER_INVALID:
365
 
                           "Zeroconf server invalid",
366
 
                       avahi.SERVER_REGISTERING: None,
367
 
                       avahi.SERVER_COLLISION:
368
 
                           "Zeroconf server name collision",
369
 
                       avahi.SERVER_FAILURE:
370
 
                           "Zeroconf server failure" }
 
457
        bad_states = {
 
458
            avahi.SERVER_INVALID: "Zeroconf server invalid",
 
459
            avahi.SERVER_REGISTERING: None,
 
460
            avahi.SERVER_COLLISION: "Zeroconf server name collision",
 
461
            avahi.SERVER_FAILURE: "Zeroconf server failure",
 
462
        }
371
463
        if state in bad_states:
372
464
            if bad_states[state] is not None:
373
465
                if error is None:
376
468
                    logger.error(bad_states[state] + ": %r", error)
377
469
            self.cleanup()
378
470
        elif state == avahi.SERVER_RUNNING:
379
 
            self.add()
 
471
            try:
 
472
                self.add()
 
473
            except dbus.exceptions.DBusException as error:
 
474
                if (error.get_dbus_name()
 
475
                    == "org.freedesktop.Avahi.CollisionError"):
 
476
                    logger.info("Local Zeroconf service name"
 
477
                                " collision.")
 
478
                    return self.rename(remove=False)
 
479
                else:
 
480
                    logger.critical("D-Bus Exception", exc_info=error)
 
481
                    self.cleanup()
 
482
                    os._exit(1)
380
483
        else:
381
484
            if error is None:
382
485
                logger.debug("Unknown state: %r", state)
383
486
            else:
384
487
                logger.debug("Unknown state: %r: %r", state, error)
385
 
    
 
488
 
386
489
    def activate(self):
387
490
        """Derived from the Avahi example code"""
388
491
        if self.server is None:
392
495
                                    follow_name_owner_changes=True),
393
496
                avahi.DBUS_INTERFACE_SERVER)
394
497
        self.server.connect_to_signal("StateChanged",
395
 
                                 self.server_state_changed)
 
498
                                      self.server_state_changed)
396
499
        self.server_state_changed(self.server.GetState())
397
500
 
398
501
 
399
502
class AvahiServiceToSyslog(AvahiService):
400
503
    def rename(self, *args, **kwargs):
401
504
        """Add the new name to the syslog messages"""
402
 
        ret = AvahiService.rename(self, *args, **kwargs)
403
 
        syslogger.setFormatter(logging.Formatter
404
 
                               ('Mandos ({}) [%(process)d]:'
405
 
                                ' %(levelname)s: %(message)s'
406
 
                                .format(self.name)))
 
505
        ret = super(AvahiServiceToSyslog, self).rename(*args, **kwargs)
 
506
        syslogger.setFormatter(logging.Formatter(
 
507
            'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
 
508
            .format(self.name)))
407
509
        return ret
408
510
 
409
511
 
410
 
class Client(object):
 
512
# Pretend that we have a GnuTLS module
 
513
class gnutls:
 
514
    """This isn't so much a class as it is a module-like namespace."""
 
515
 
 
516
    library = ctypes.util.find_library("gnutls")
 
517
    if library is None:
 
518
        library = ctypes.util.find_library("gnutls-deb0")
 
519
    _library = ctypes.cdll.LoadLibrary(library)
 
520
    del library
 
521
 
 
522
    # Unless otherwise indicated, the constants and types below are
 
523
    # all from the gnutls/gnutls.h C header file.
 
524
 
 
525
    # Constants
 
526
    E_SUCCESS = 0
 
527
    E_INTERRUPTED = -52
 
528
    E_AGAIN = -28
 
529
    CRT_OPENPGP = 2
 
530
    CRT_RAWPK = 3
 
531
    CLIENT = 2
 
532
    SHUT_RDWR = 0
 
533
    CRD_CERTIFICATE = 1
 
534
    E_NO_CERTIFICATE_FOUND = -49
 
535
    X509_FMT_DER = 0
 
536
    NO_TICKETS = 1<<10
 
537
    ENABLE_RAWPK = 1<<18
 
538
    CTYPE_PEERS = 3
 
539
    KEYID_USE_SHA256 = 1        # gnutls/x509.h
 
540
    OPENPGP_FMT_RAW = 0         # gnutls/openpgp.h
 
541
 
 
542
    # Types
 
543
    class session_int(ctypes.Structure):
 
544
        _fields_ = []
 
545
    session_t = ctypes.POINTER(session_int)
 
546
 
 
547
    class certificate_credentials_st(ctypes.Structure):
 
548
        _fields_ = []
 
549
    certificate_credentials_t = ctypes.POINTER(
 
550
        certificate_credentials_st)
 
551
    certificate_type_t = ctypes.c_int
 
552
 
 
553
    class datum_t(ctypes.Structure):
 
554
        _fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
 
555
                    ('size', ctypes.c_uint)]
 
556
 
 
557
    class openpgp_crt_int(ctypes.Structure):
 
558
        _fields_ = []
 
559
    openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
 
560
    openpgp_crt_fmt_t = ctypes.c_int  # gnutls/openpgp.h
 
561
    log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
 
562
    credentials_type_t = ctypes.c_int
 
563
    transport_ptr_t = ctypes.c_void_p
 
564
    close_request_t = ctypes.c_int
 
565
 
 
566
    # Exceptions
 
567
    class Error(Exception):
 
568
        def __init__(self, message=None, code=None, args=()):
 
569
            # Default usage is by a message string, but if a return
 
570
            # code is passed, convert it to a string with
 
571
            # gnutls.strerror()
 
572
            self.code = code
 
573
            if message is None and code is not None:
 
574
                message = gnutls.strerror(code)
 
575
            return super(gnutls.Error, self).__init__(
 
576
                message, *args)
 
577
 
 
578
    class CertificateSecurityError(Error):
 
579
        pass
 
580
 
 
581
    # Classes
 
582
    class Credentials:
 
583
        def __init__(self):
 
584
            self._c_object = gnutls.certificate_credentials_t()
 
585
            gnutls.certificate_allocate_credentials(
 
586
                ctypes.byref(self._c_object))
 
587
            self.type = gnutls.CRD_CERTIFICATE
 
588
 
 
589
        def __del__(self):
 
590
            gnutls.certificate_free_credentials(self._c_object)
 
591
 
 
592
    class ClientSession:
 
593
        def __init__(self, socket, credentials=None):
 
594
            self._c_object = gnutls.session_t()
 
595
            gnutls_flags = gnutls.CLIENT
 
596
            if gnutls.check_version(b"3.5.6"):
 
597
                gnutls_flags |= gnutls.NO_TICKETS
 
598
            if gnutls.has_rawpk:
 
599
                gnutls_flags |= gnutls.ENABLE_RAWPK
 
600
            gnutls.init(ctypes.byref(self._c_object), gnutls_flags)
 
601
            del gnutls_flags
 
602
            gnutls.set_default_priority(self._c_object)
 
603
            gnutls.transport_set_ptr(self._c_object, socket.fileno())
 
604
            gnutls.handshake_set_private_extensions(self._c_object,
 
605
                                                    True)
 
606
            self.socket = socket
 
607
            if credentials is None:
 
608
                credentials = gnutls.Credentials()
 
609
            gnutls.credentials_set(self._c_object, credentials.type,
 
610
                                   ctypes.cast(credentials._c_object,
 
611
                                               ctypes.c_void_p))
 
612
            self.credentials = credentials
 
613
 
 
614
        def __del__(self):
 
615
            gnutls.deinit(self._c_object)
 
616
 
 
617
        def handshake(self):
 
618
            return gnutls.handshake(self._c_object)
 
619
 
 
620
        def send(self, data):
 
621
            data = bytes(data)
 
622
            data_len = len(data)
 
623
            while data_len > 0:
 
624
                data_len -= gnutls.record_send(self._c_object,
 
625
                                               data[-data_len:],
 
626
                                               data_len)
 
627
 
 
628
        def bye(self):
 
629
            return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
 
630
 
 
631
    # Error handling functions
 
632
    def _error_code(result):
 
633
        """A function to raise exceptions on errors, suitable
 
634
        for the 'restype' attribute on ctypes functions"""
 
635
        if result >= 0:
 
636
            return result
 
637
        if result == gnutls.E_NO_CERTIFICATE_FOUND:
 
638
            raise gnutls.CertificateSecurityError(code=result)
 
639
        raise gnutls.Error(code=result)
 
640
 
 
641
    def _retry_on_error(result, func, arguments):
 
642
        """A function to retry on some errors, suitable
 
643
        for the 'errcheck' attribute on ctypes functions"""
 
644
        while result < 0:
 
645
            if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
 
646
                return _error_code(result)
 
647
            result = func(*arguments)
 
648
        return result
 
649
 
 
650
    # Unless otherwise indicated, the function declarations below are
 
651
    # all from the gnutls/gnutls.h C header file.
 
652
 
 
653
    # Functions
 
654
    priority_set_direct = _library.gnutls_priority_set_direct
 
655
    priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
 
656
                                    ctypes.POINTER(ctypes.c_char_p)]
 
657
    priority_set_direct.restype = _error_code
 
658
 
 
659
    init = _library.gnutls_init
 
660
    init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
 
661
    init.restype = _error_code
 
662
 
 
663
    set_default_priority = _library.gnutls_set_default_priority
 
664
    set_default_priority.argtypes = [session_t]
 
665
    set_default_priority.restype = _error_code
 
666
 
 
667
    record_send = _library.gnutls_record_send
 
668
    record_send.argtypes = [session_t, ctypes.c_void_p,
 
669
                            ctypes.c_size_t]
 
670
    record_send.restype = ctypes.c_ssize_t
 
671
    record_send.errcheck = _retry_on_error
 
672
 
 
673
    certificate_allocate_credentials = (
 
674
        _library.gnutls_certificate_allocate_credentials)
 
675
    certificate_allocate_credentials.argtypes = [
 
676
        ctypes.POINTER(certificate_credentials_t)]
 
677
    certificate_allocate_credentials.restype = _error_code
 
678
 
 
679
    certificate_free_credentials = (
 
680
        _library.gnutls_certificate_free_credentials)
 
681
    certificate_free_credentials.argtypes = [
 
682
        certificate_credentials_t]
 
683
    certificate_free_credentials.restype = None
 
684
 
 
685
    handshake_set_private_extensions = (
 
686
        _library.gnutls_handshake_set_private_extensions)
 
687
    handshake_set_private_extensions.argtypes = [session_t,
 
688
                                                 ctypes.c_int]
 
689
    handshake_set_private_extensions.restype = None
 
690
 
 
691
    credentials_set = _library.gnutls_credentials_set
 
692
    credentials_set.argtypes = [session_t, credentials_type_t,
 
693
                                ctypes.c_void_p]
 
694
    credentials_set.restype = _error_code
 
695
 
 
696
    strerror = _library.gnutls_strerror
 
697
    strerror.argtypes = [ctypes.c_int]
 
698
    strerror.restype = ctypes.c_char_p
 
699
 
 
700
    certificate_type_get = _library.gnutls_certificate_type_get
 
701
    certificate_type_get.argtypes = [session_t]
 
702
    certificate_type_get.restype = _error_code
 
703
 
 
704
    certificate_get_peers = _library.gnutls_certificate_get_peers
 
705
    certificate_get_peers.argtypes = [session_t,
 
706
                                      ctypes.POINTER(ctypes.c_uint)]
 
707
    certificate_get_peers.restype = ctypes.POINTER(datum_t)
 
708
 
 
709
    global_set_log_level = _library.gnutls_global_set_log_level
 
710
    global_set_log_level.argtypes = [ctypes.c_int]
 
711
    global_set_log_level.restype = None
 
712
 
 
713
    global_set_log_function = _library.gnutls_global_set_log_function
 
714
    global_set_log_function.argtypes = [log_func]
 
715
    global_set_log_function.restype = None
 
716
 
 
717
    deinit = _library.gnutls_deinit
 
718
    deinit.argtypes = [session_t]
 
719
    deinit.restype = None
 
720
 
 
721
    handshake = _library.gnutls_handshake
 
722
    handshake.argtypes = [session_t]
 
723
    handshake.restype = _error_code
 
724
    handshake.errcheck = _retry_on_error
 
725
 
 
726
    transport_set_ptr = _library.gnutls_transport_set_ptr
 
727
    transport_set_ptr.argtypes = [session_t, transport_ptr_t]
 
728
    transport_set_ptr.restype = None
 
729
 
 
730
    bye = _library.gnutls_bye
 
731
    bye.argtypes = [session_t, close_request_t]
 
732
    bye.restype = _error_code
 
733
    bye.errcheck = _retry_on_error
 
734
 
 
735
    check_version = _library.gnutls_check_version
 
736
    check_version.argtypes = [ctypes.c_char_p]
 
737
    check_version.restype = ctypes.c_char_p
 
738
 
 
739
    _need_version = b"3.3.0"
 
740
    if check_version(_need_version) is None:
 
741
        raise self.Error("Needs GnuTLS {} or later"
 
742
                         .format(_need_version))
 
743
 
 
744
    _tls_rawpk_version = b"3.6.6"
 
745
    has_rawpk = bool(check_version(_tls_rawpk_version))
 
746
 
 
747
    if has_rawpk:
 
748
        # Types
 
749
        class pubkey_st(ctypes.Structure):
 
750
            _fields = []
 
751
        pubkey_t = ctypes.POINTER(pubkey_st)
 
752
 
 
753
        x509_crt_fmt_t = ctypes.c_int
 
754
 
 
755
        # All the function declarations below are from gnutls/abstract.h
 
756
        pubkey_init = _library.gnutls_pubkey_init
 
757
        pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]
 
758
        pubkey_init.restype = _error_code
 
759
 
 
760
        pubkey_import = _library.gnutls_pubkey_import
 
761
        pubkey_import.argtypes = [pubkey_t, ctypes.POINTER(datum_t),
 
762
                                  x509_crt_fmt_t]
 
763
        pubkey_import.restype = _error_code
 
764
 
 
765
        pubkey_get_key_id = _library.gnutls_pubkey_get_key_id
 
766
        pubkey_get_key_id.argtypes = [pubkey_t, ctypes.c_int,
 
767
                                      ctypes.POINTER(ctypes.c_ubyte),
 
768
                                      ctypes.POINTER(ctypes.c_size_t)]
 
769
        pubkey_get_key_id.restype = _error_code
 
770
 
 
771
        pubkey_deinit = _library.gnutls_pubkey_deinit
 
772
        pubkey_deinit.argtypes = [pubkey_t]
 
773
        pubkey_deinit.restype = None
 
774
    else:
 
775
        # All the function declarations below are from gnutls/openpgp.h
 
776
 
 
777
        openpgp_crt_init = _library.gnutls_openpgp_crt_init
 
778
        openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
 
779
        openpgp_crt_init.restype = _error_code
 
780
 
 
781
        openpgp_crt_import = _library.gnutls_openpgp_crt_import
 
782
        openpgp_crt_import.argtypes = [openpgp_crt_t,
 
783
                                       ctypes.POINTER(datum_t),
 
784
                                       openpgp_crt_fmt_t]
 
785
        openpgp_crt_import.restype = _error_code
 
786
 
 
787
        openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
 
788
        openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
 
789
                                            ctypes.POINTER(ctypes.c_uint)]
 
790
        openpgp_crt_verify_self.restype = _error_code
 
791
 
 
792
        openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
 
793
        openpgp_crt_deinit.argtypes = [openpgp_crt_t]
 
794
        openpgp_crt_deinit.restype = None
 
795
 
 
796
        openpgp_crt_get_fingerprint = (
 
797
            _library.gnutls_openpgp_crt_get_fingerprint)
 
798
        openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
 
799
                                                ctypes.c_void_p,
 
800
                                                ctypes.POINTER(
 
801
                                                    ctypes.c_size_t)]
 
802
        openpgp_crt_get_fingerprint.restype = _error_code
 
803
 
 
804
    if check_version(b"3.6.4"):
 
805
        certificate_type_get2 = _library.gnutls_certificate_type_get2
 
806
        certificate_type_get2.argtypes = [session_t, ctypes.c_int]
 
807
        certificate_type_get2.restype = _error_code
 
808
 
 
809
    # Remove non-public functions
 
810
    del _error_code, _retry_on_error
 
811
 
 
812
 
 
813
def call_pipe(connection,       # : multiprocessing.Connection
 
814
              func, *args, **kwargs):
 
815
    """This function is meant to be called by multiprocessing.Process
 
816
 
 
817
    This function runs func(*args, **kwargs), and writes the resulting
 
818
    return value on the provided multiprocessing.Connection.
 
819
    """
 
820
    connection.send(func(*args, **kwargs))
 
821
    connection.close()
 
822
 
 
823
 
 
824
class Client:
411
825
    """A representation of a client host served by this server.
412
 
    
 
826
 
413
827
    Attributes:
414
828
    approved:   bool(); 'None' if not yet approved/disapproved
415
829
    approval_delay: datetime.timedelta(); Time to wait for approval
416
830
    approval_duration: datetime.timedelta(); Duration of one approval
417
 
    checker:    subprocess.Popen(); a running checker process used
418
 
                                    to see if the client lives.
419
 
                                    'None' if no process is running.
420
 
    checker_callback_tag: a gobject event source tag, or None
 
831
    checker: multiprocessing.Process(); a running checker process used
 
832
             to see if the client lives. 'None' if no process is
 
833
             running.
 
834
    checker_callback_tag: a GLib event source tag, or None
421
835
    checker_command: string; External command which is run to check
422
836
                     if client lives.  %() expansions are done at
423
837
                     runtime with vars(self) as dict, so that for
424
838
                     instance %(name)s can be used in the command.
425
 
    checker_initiator_tag: a gobject event source tag, or None
 
839
    checker_initiator_tag: a GLib event source tag, or None
426
840
    created:    datetime.datetime(); (UTC) object creation
427
841
    client_structure: Object describing what attributes a client has
428
842
                      and is used for storing the client at exit
429
843
    current_checker_command: string; current running checker_command
430
 
    disable_initiator_tag: a gobject event source tag, or None
 
844
    disable_initiator_tag: a GLib event source tag, or None
431
845
    enabled:    bool()
432
846
    fingerprint: string (40 or 32 hexadecimal digits); used to
433
 
                 uniquely identify the client
 
847
                 uniquely identify an OpenPGP client
 
848
    key_id: string (64 hexadecimal digits); used to uniquely identify
 
849
            a client using raw public keys
434
850
    host:       string; available for use by the checker command
435
851
    interval:   datetime.timedelta(); How often to start a new checker
436
852
    last_approval_request: datetime.datetime(); (UTC) or None
438
854
    last_checker_status: integer between 0 and 255 reflecting exit
439
855
                         status of last checker. -1 reflects crashed
440
856
                         checker, -2 means no checker completed yet.
 
857
    last_checker_signal: The signal which killed the last checker, if
 
858
                         last_checker_status is -1
441
859
    last_enabled: datetime.datetime(); (UTC) or None
442
860
    name:       string; from the config file, used in log messages and
443
861
                        D-Bus identifiers
450
868
                disabled, or None
451
869
    server_settings: The server_settings dict from main()
452
870
    """
453
 
    
 
871
 
454
872
    runtime_expansions = ("approval_delay", "approval_duration",
455
 
                          "created", "enabled", "expires",
 
873
                          "created", "enabled", "expires", "key_id",
456
874
                          "fingerprint", "host", "interval",
457
875
                          "last_approval_request", "last_checked_ok",
458
876
                          "last_enabled", "name", "timeout")
459
 
    client_defaults = { "timeout": "PT5M",
460
 
                        "extended_timeout": "PT15M",
461
 
                        "interval": "PT2M",
462
 
                        "checker": "fping -q -- %%(host)s",
463
 
                        "host": "",
464
 
                        "approval_delay": "PT0S",
465
 
                        "approval_duration": "PT1S",
466
 
                        "approved_by_default": "True",
467
 
                        "enabled": "True",
468
 
                        }
469
 
    
 
877
    client_defaults = {
 
878
        "timeout": "PT5M",
 
879
        "extended_timeout": "PT15M",
 
880
        "interval": "PT2M",
 
881
        "checker": "fping -q -- %%(host)s",
 
882
        "host": "",
 
883
        "approval_delay": "PT0S",
 
884
        "approval_duration": "PT1S",
 
885
        "approved_by_default": "True",
 
886
        "enabled": "True",
 
887
    }
 
888
 
470
889
    @staticmethod
471
890
    def config_parser(config):
472
891
        """Construct a new dict of client settings of this form:
479
898
        for client_name in config.sections():
480
899
            section = dict(config.items(client_name))
481
900
            client = settings[client_name] = {}
482
 
            
 
901
 
483
902
            client["host"] = section["host"]
484
903
            # Reformat values from string types to Python types
485
904
            client["approved_by_default"] = config.getboolean(
486
905
                client_name, "approved_by_default")
487
906
            client["enabled"] = config.getboolean(client_name,
488
907
                                                  "enabled")
489
 
            
 
908
 
 
909
            # Uppercase and remove spaces from key_id and fingerprint
 
910
            # for later comparison purposes with return value from the
 
911
            # key_id() and fingerprint() functions
 
912
            client["key_id"] = (section.get("key_id", "").upper()
 
913
                                .replace(" ", ""))
490
914
            client["fingerprint"] = (section["fingerprint"].upper()
491
915
                                     .replace(" ", ""))
492
916
            if "secret" in section:
493
 
                client["secret"] = section["secret"].decode("base64")
 
917
                client["secret"] = codecs.decode(section["secret"]
 
918
                                                 .encode("utf-8"),
 
919
                                                 "base64")
494
920
            elif "secfile" in section:
495
921
                with open(os.path.expanduser(os.path.expandvars
496
922
                                             (section["secfile"])),
511
937
            client["last_approval_request"] = None
512
938
            client["last_checked_ok"] = None
513
939
            client["last_checker_status"] = -2
514
 
        
 
940
 
515
941
        return settings
516
 
    
517
 
    def __init__(self, settings, name = None, server_settings=None):
 
942
 
 
943
    def __init__(self, settings, name=None, server_settings=None):
518
944
        self.name = name
519
945
        if server_settings is None:
520
946
            server_settings = {}
522
948
        # adding all client settings
523
949
        for setting, value in settings.items():
524
950
            setattr(self, setting, value)
525
 
        
 
951
 
526
952
        if self.enabled:
527
953
            if not hasattr(self, "last_enabled"):
528
954
                self.last_enabled = datetime.datetime.utcnow()
532
958
        else:
533
959
            self.last_enabled = None
534
960
            self.expires = None
535
 
        
 
961
 
536
962
        logger.debug("Creating client %r", self.name)
537
 
        # Uppercase and remove spaces from fingerprint for later
538
 
        # comparison purposes with return value from the fingerprint()
539
 
        # function
 
963
        logger.debug("  Key ID: %s", self.key_id)
540
964
        logger.debug("  Fingerprint: %s", self.fingerprint)
541
965
        self.created = settings.get("created",
542
966
                                    datetime.datetime.utcnow())
543
 
        
 
967
 
544
968
        # attributes specific for this server instance
545
969
        self.checker = None
546
970
        self.checker_initiator_tag = None
549
973
        self.current_checker_command = None
550
974
        self.approved = None
551
975
        self.approvals_pending = 0
552
 
        self.changedstate = (multiprocessing_manager
553
 
                             .Condition(multiprocessing_manager
554
 
                                        .Lock()))
555
 
        self.client_structure = [attr for attr in
556
 
                                 self.__dict__.iterkeys()
 
976
        self.changedstate = multiprocessing_manager.Condition(
 
977
            multiprocessing_manager.Lock())
 
978
        self.client_structure = [attr
 
979
                                 for attr in self.__dict__.keys()
557
980
                                 if not attr.startswith("_")]
558
981
        self.client_structure.append("client_structure")
559
 
        
560
 
        for name, t in inspect.getmembers(type(self),
561
 
                                          lambda obj:
562
 
                                              isinstance(obj,
563
 
                                                         property)):
 
982
 
 
983
        for name, t in inspect.getmembers(
 
984
                type(self), lambda obj: isinstance(obj, property)):
564
985
            if not name.startswith("_"):
565
986
                self.client_structure.append(name)
566
 
    
 
987
 
567
988
    # Send notice to process children that client state has changed
568
989
    def send_changedstate(self):
569
990
        with self.changedstate:
570
991
            self.changedstate.notify_all()
571
 
    
 
992
 
572
993
    def enable(self):
573
994
        """Start this client's checker and timeout hooks"""
574
995
        if getattr(self, "enabled", False):
579
1000
        self.last_enabled = datetime.datetime.utcnow()
580
1001
        self.init_checker()
581
1002
        self.send_changedstate()
582
 
    
 
1003
 
583
1004
    def disable(self, quiet=True):
584
1005
        """Disable this client."""
585
1006
        if not getattr(self, "enabled", False):
587
1008
        if not quiet:
588
1009
            logger.info("Disabling client %s", self.name)
589
1010
        if getattr(self, "disable_initiator_tag", None) is not None:
590
 
            gobject.source_remove(self.disable_initiator_tag)
 
1011
            GLib.source_remove(self.disable_initiator_tag)
591
1012
            self.disable_initiator_tag = None
592
1013
        self.expires = None
593
1014
        if getattr(self, "checker_initiator_tag", None) is not None:
594
 
            gobject.source_remove(self.checker_initiator_tag)
 
1015
            GLib.source_remove(self.checker_initiator_tag)
595
1016
            self.checker_initiator_tag = None
596
1017
        self.stop_checker()
597
1018
        self.enabled = False
598
1019
        if not quiet:
599
1020
            self.send_changedstate()
600
 
        # Do not run this again if called by a gobject.timeout_add
 
1021
        # Do not run this again if called by a GLib.timeout_add
601
1022
        return False
602
 
    
 
1023
 
603
1024
    def __del__(self):
604
1025
        self.disable()
605
 
    
 
1026
 
606
1027
    def init_checker(self):
607
1028
        # Schedule a new checker to be started an 'interval' from now,
608
1029
        # and every interval from then on.
609
1030
        if self.checker_initiator_tag is not None:
610
 
            gobject.source_remove(self.checker_initiator_tag)
611
 
        self.checker_initiator_tag = (gobject.timeout_add
612
 
                                      (int(self.interval
613
 
                                           .total_seconds() * 1000),
614
 
                                       self.start_checker))
 
1031
            GLib.source_remove(self.checker_initiator_tag)
 
1032
        self.checker_initiator_tag = GLib.timeout_add(
 
1033
            int(self.interval.total_seconds() * 1000),
 
1034
            self.start_checker)
615
1035
        # Schedule a disable() when 'timeout' has passed
616
1036
        if self.disable_initiator_tag is not None:
617
 
            gobject.source_remove(self.disable_initiator_tag)
618
 
        self.disable_initiator_tag = (gobject.timeout_add
619
 
                                      (int(self.timeout
620
 
                                           .total_seconds() * 1000),
621
 
                                       self.disable))
 
1037
            GLib.source_remove(self.disable_initiator_tag)
 
1038
        self.disable_initiator_tag = GLib.timeout_add(
 
1039
            int(self.timeout.total_seconds() * 1000), self.disable)
622
1040
        # Also start a new checker *right now*.
623
1041
        self.start_checker()
624
 
    
625
 
    def checker_callback(self, pid, condition, command):
 
1042
 
 
1043
    def checker_callback(self, source, condition, connection,
 
1044
                         command):
626
1045
        """The checker has completed, so take appropriate actions."""
 
1046
        # Read return code from connection (see call_pipe)
 
1047
        returncode = connection.recv()
 
1048
        connection.close()
 
1049
        self.checker.join()
627
1050
        self.checker_callback_tag = None
628
1051
        self.checker = None
629
 
        if os.WIFEXITED(condition):
630
 
            self.last_checker_status = os.WEXITSTATUS(condition)
 
1052
 
 
1053
        if returncode >= 0:
 
1054
            self.last_checker_status = returncode
 
1055
            self.last_checker_signal = None
631
1056
            if self.last_checker_status == 0:
632
1057
                logger.info("Checker for %(name)s succeeded",
633
1058
                            vars(self))
634
1059
                self.checked_ok()
635
1060
            else:
636
 
                logger.info("Checker for %(name)s failed",
637
 
                            vars(self))
 
1061
                logger.info("Checker for %(name)s failed", vars(self))
638
1062
        else:
639
1063
            self.last_checker_status = -1
 
1064
            self.last_checker_signal = -returncode
640
1065
            logger.warning("Checker for %(name)s crashed?",
641
1066
                           vars(self))
642
 
    
 
1067
        return False
 
1068
 
643
1069
    def checked_ok(self):
644
1070
        """Assert that the client has been seen, alive and well."""
645
1071
        self.last_checked_ok = datetime.datetime.utcnow()
646
1072
        self.last_checker_status = 0
 
1073
        self.last_checker_signal = None
647
1074
        self.bump_timeout()
648
 
    
 
1075
 
649
1076
    def bump_timeout(self, timeout=None):
650
1077
        """Bump up the timeout for this client."""
651
1078
        if timeout is None:
652
1079
            timeout = self.timeout
653
1080
        if self.disable_initiator_tag is not None:
654
 
            gobject.source_remove(self.disable_initiator_tag)
 
1081
            GLib.source_remove(self.disable_initiator_tag)
655
1082
            self.disable_initiator_tag = None
656
1083
        if getattr(self, "enabled", False):
657
 
            self.disable_initiator_tag = (gobject.timeout_add
658
 
                                          (int(timeout.total_seconds()
659
 
                                               * 1000), self.disable))
 
1084
            self.disable_initiator_tag = GLib.timeout_add(
 
1085
                int(timeout.total_seconds() * 1000), self.disable)
660
1086
            self.expires = datetime.datetime.utcnow() + timeout
661
 
    
 
1087
 
662
1088
    def need_approval(self):
663
1089
        self.last_approval_request = datetime.datetime.utcnow()
664
 
    
 
1090
 
665
1091
    def start_checker(self):
666
1092
        """Start a new checker subprocess if one is not running.
667
 
        
 
1093
 
668
1094
        If a checker already exists, leave it running and do
669
1095
        nothing."""
670
1096
        # The reason for not killing a running checker is that if we
675
1101
        # checkers alone, the checker would have to take more time
676
1102
        # than 'timeout' for the client to be disabled, which is as it
677
1103
        # should be.
678
 
        
679
 
        # If a checker exists, make sure it is not a zombie
680
 
        try:
681
 
            pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
682
 
        except AttributeError:
683
 
            pass
684
 
        except OSError as error:
685
 
            if error.errno != errno.ECHILD:
686
 
                raise
687
 
        else:
688
 
            if pid:
689
 
                logger.warning("Checker was a zombie")
690
 
                gobject.source_remove(self.checker_callback_tag)
691
 
                self.checker_callback(pid, status,
692
 
                                      self.current_checker_command)
 
1104
 
 
1105
        if self.checker is not None and not self.checker.is_alive():
 
1106
            logger.warning("Checker was not alive; joining")
 
1107
            self.checker.join()
 
1108
            self.checker = None
693
1109
        # Start a new checker if needed
694
1110
        if self.checker is None:
695
1111
            # Escape attributes for the shell
696
 
            escaped_attrs = { attr:
697
 
                                  re.escape(str(getattr(self, attr)))
698
 
                              for attr in self.runtime_expansions }
 
1112
            escaped_attrs = {
 
1113
                attr: re.escape(str(getattr(self, attr)))
 
1114
                for attr in self.runtime_expansions}
699
1115
            try:
700
1116
                command = self.checker_command % escaped_attrs
701
1117
            except TypeError as error:
702
1118
                logger.error('Could not format string "%s"',
703
 
                             self.checker_command, exc_info=error)
704
 
                return True # Try again later
 
1119
                             self.checker_command,
 
1120
                             exc_info=error)
 
1121
                return True     # Try again later
705
1122
            self.current_checker_command = command
706
 
            try:
707
 
                logger.info("Starting checker %r for %s",
708
 
                            command, self.name)
709
 
                # We don't need to redirect stdout and stderr, since
710
 
                # in normal mode, that is already done by daemon(),
711
 
                # and in debug mode we don't want to.  (Stdin is
712
 
                # always replaced by /dev/null.)
713
 
                # The exception is when not debugging but nevertheless
714
 
                # running in the foreground; use the previously
715
 
                # created wnull.
716
 
                popen_args = {}
717
 
                if (not self.server_settings["debug"]
718
 
                    and self.server_settings["foreground"]):
719
 
                    popen_args.update({"stdout": wnull,
720
 
                                       "stderr": wnull })
721
 
                self.checker = subprocess.Popen(command,
722
 
                                                close_fds=True,
723
 
                                                shell=True, cwd="/",
724
 
                                                **popen_args)
725
 
            except OSError as error:
726
 
                logger.error("Failed to start subprocess",
727
 
                             exc_info=error)
728
 
                return True
729
 
            self.checker_callback_tag = (gobject.child_watch_add
730
 
                                         (self.checker.pid,
731
 
                                          self.checker_callback,
732
 
                                          data=command))
733
 
            # The checker may have completed before the gobject
734
 
            # watch was added.  Check for this.
735
 
            try:
736
 
                pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
737
 
            except OSError as error:
738
 
                if error.errno == errno.ECHILD:
739
 
                    # This should never happen
740
 
                    logger.error("Child process vanished",
741
 
                                 exc_info=error)
742
 
                    return True
743
 
                raise
744
 
            if pid:
745
 
                gobject.source_remove(self.checker_callback_tag)
746
 
                self.checker_callback(pid, status, command)
747
 
        # Re-run this periodically if run by gobject.timeout_add
 
1123
            logger.info("Starting checker %r for %s", command,
 
1124
                        self.name)
 
1125
            # We don't need to redirect stdout and stderr, since
 
1126
            # in normal mode, that is already done by daemon(),
 
1127
            # and in debug mode we don't want to.  (Stdin is
 
1128
            # always replaced by /dev/null.)
 
1129
            # The exception is when not debugging but nevertheless
 
1130
            # running in the foreground; use the previously
 
1131
            # created wnull.
 
1132
            popen_args = {"close_fds": True,
 
1133
                          "shell": True,
 
1134
                          "cwd": "/"}
 
1135
            if (not self.server_settings["debug"]
 
1136
                and self.server_settings["foreground"]):
 
1137
                popen_args.update({"stdout": wnull,
 
1138
                                   "stderr": wnull})
 
1139
            pipe = multiprocessing.Pipe(duplex=False)
 
1140
            self.checker = multiprocessing.Process(
 
1141
                target=call_pipe,
 
1142
                args=(pipe[1], subprocess.call, command),
 
1143
                kwargs=popen_args)
 
1144
            self.checker.start()
 
1145
            self.checker_callback_tag = GLib.io_add_watch(
 
1146
                pipe[0].fileno(), GLib.IO_IN,
 
1147
                self.checker_callback, pipe[0], command)
 
1148
        # Re-run this periodically if run by GLib.timeout_add
748
1149
        return True
749
 
    
 
1150
 
750
1151
    def stop_checker(self):
751
1152
        """Force the checker process, if any, to stop."""
752
1153
        if self.checker_callback_tag:
753
 
            gobject.source_remove(self.checker_callback_tag)
 
1154
            GLib.source_remove(self.checker_callback_tag)
754
1155
            self.checker_callback_tag = None
755
1156
        if getattr(self, "checker", None) is None:
756
1157
            return
757
1158
        logger.debug("Stopping checker for %(name)s", vars(self))
758
 
        try:
759
 
            self.checker.terminate()
760
 
            #time.sleep(0.5)
761
 
            #if self.checker.poll() is None:
762
 
            #    self.checker.kill()
763
 
        except OSError as error:
764
 
            if error.errno != errno.ESRCH: # No such process
765
 
                raise
 
1159
        self.checker.terminate()
766
1160
        self.checker = None
767
1161
 
768
1162
 
769
 
def dbus_service_property(dbus_interface, signature="v",
770
 
                          access="readwrite", byte_arrays=False):
 
1163
def dbus_service_property(dbus_interface,
 
1164
                          signature="v",
 
1165
                          access="readwrite",
 
1166
                          byte_arrays=False):
771
1167
    """Decorators for marking methods of a DBusObjectWithProperties to
772
1168
    become properties on the D-Bus.
773
 
    
 
1169
 
774
1170
    The decorated method will be called with no arguments by "Get"
775
1171
    and with one argument by "Set".
776
 
    
 
1172
 
777
1173
    The parameters, where they are supported, are the same as
778
1174
    dbus.service.method, except there is only "signature", since the
779
1175
    type from Get() and the type sent to Set() is the same.
783
1179
    if byte_arrays and signature != "ay":
784
1180
        raise ValueError("Byte arrays not supported for non-'ay'"
785
1181
                         " signature {!r}".format(signature))
 
1182
 
786
1183
    def decorator(func):
787
1184
        func._dbus_is_property = True
788
1185
        func._dbus_interface = dbus_interface
791
1188
        func._dbus_name = func.__name__
792
1189
        if func._dbus_name.endswith("_dbus_property"):
793
1190
            func._dbus_name = func._dbus_name[:-14]
794
 
        func._dbus_get_args_options = {'byte_arrays': byte_arrays }
 
1191
        func._dbus_get_args_options = {'byte_arrays': byte_arrays}
795
1192
        return func
 
1193
 
796
1194
    return decorator
797
1195
 
798
1196
 
799
1197
def dbus_interface_annotations(dbus_interface):
800
1198
    """Decorator for marking functions returning interface annotations
801
 
    
 
1199
 
802
1200
    Usage:
803
 
    
 
1201
 
804
1202
    @dbus_interface_annotations("org.example.Interface")
805
1203
    def _foo(self):  # Function name does not matter
806
1204
        return {"org.freedesktop.DBus.Deprecated": "true",
807
1205
                "org.freedesktop.DBus.Property.EmitsChangedSignal":
808
1206
                    "false"}
809
1207
    """
 
1208
 
810
1209
    def decorator(func):
811
1210
        func._dbus_is_interface = True
812
1211
        func._dbus_interface = dbus_interface
813
1212
        func._dbus_name = dbus_interface
814
1213
        return func
 
1214
 
815
1215
    return decorator
816
1216
 
817
1217
 
818
1218
def dbus_annotations(annotations):
819
1219
    """Decorator to annotate D-Bus methods, signals or properties
820
1220
    Usage:
821
 
    
 
1221
 
822
1222
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",
823
1223
                       "org.freedesktop.DBus.Property."
824
1224
                       "EmitsChangedSignal": "false"})
826
1226
                           access="r")
827
1227
    def Property_dbus_property(self):
828
1228
        return dbus.Boolean(False)
 
1229
 
 
1230
    See also the DBusObjectWithAnnotations class.
829
1231
    """
 
1232
 
830
1233
    def decorator(func):
831
1234
        func._dbus_annotations = annotations
832
1235
        return func
 
1236
 
833
1237
    return decorator
834
1238
 
835
1239
 
838
1242
    """
839
1243
    pass
840
1244
 
 
1245
 
841
1246
class DBusPropertyAccessException(DBusPropertyException):
842
1247
    """A property's access permissions disallows an operation.
843
1248
    """
850
1255
    pass
851
1256
 
852
1257
 
853
 
class DBusObjectWithProperties(dbus.service.Object):
854
 
    """A D-Bus object with properties.
855
 
    
856
 
    Classes inheriting from this can use the dbus_service_property
857
 
    decorator to expose methods as D-Bus properties.  It exposes the
858
 
    standard Get(), Set(), and GetAll() methods on the D-Bus.
 
1258
class DBusObjectWithAnnotations(dbus.service.Object):
 
1259
    """A D-Bus object with annotations.
 
1260
 
 
1261
    Classes inheriting from this can use the dbus_annotations
 
1262
    decorator to add annotations to methods or signals.
859
1263
    """
860
 
    
 
1264
 
861
1265
    @staticmethod
862
1266
    def _is_dbus_thing(thing):
863
1267
        """Returns a function testing if an attribute is a D-Bus thing
864
 
        
 
1268
 
865
1269
        If called like _is_dbus_thing("method") it returns a function
866
1270
        suitable for use as predicate to inspect.getmembers().
867
1271
        """
868
1272
        return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
869
1273
                                   False)
870
 
    
 
1274
 
871
1275
    def _get_all_dbus_things(self, thing):
872
1276
        """Returns a generator of (name, attribute) pairs
873
1277
        """
874
 
        return ((getattr(athing.__get__(self), "_dbus_name",
875
 
                         name),
 
1278
        return ((getattr(athing.__get__(self), "_dbus_name", name),
876
1279
                 athing.__get__(self))
877
1280
                for cls in self.__class__.__mro__
878
1281
                for name, athing in
879
 
                inspect.getmembers(cls,
880
 
                                   self._is_dbus_thing(thing)))
881
 
    
 
1282
                inspect.getmembers(cls, self._is_dbus_thing(thing)))
 
1283
 
 
1284
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
 
1285
                         out_signature="s",
 
1286
                         path_keyword='object_path',
 
1287
                         connection_keyword='connection')
 
1288
    def Introspect(self, object_path, connection):
 
1289
        """Overloading of standard D-Bus method.
 
1290
 
 
1291
        Inserts annotation tags on methods and signals.
 
1292
        """
 
1293
        xmlstring = dbus.service.Object.Introspect(self, object_path,
 
1294
                                                   connection)
 
1295
        try:
 
1296
            document = xml.dom.minidom.parseString(xmlstring)
 
1297
 
 
1298
            for if_tag in document.getElementsByTagName("interface"):
 
1299
                # Add annotation tags
 
1300
                for typ in ("method", "signal"):
 
1301
                    for tag in if_tag.getElementsByTagName(typ):
 
1302
                        annots = dict()
 
1303
                        for name, prop in (self.
 
1304
                                           _get_all_dbus_things(typ)):
 
1305
                            if (name == tag.getAttribute("name")
 
1306
                                and prop._dbus_interface
 
1307
                                == if_tag.getAttribute("name")):
 
1308
                                annots.update(getattr(
 
1309
                                    prop, "_dbus_annotations", {}))
 
1310
                        for name, value in annots.items():
 
1311
                            ann_tag = document.createElement(
 
1312
                                "annotation")
 
1313
                            ann_tag.setAttribute("name", name)
 
1314
                            ann_tag.setAttribute("value", value)
 
1315
                            tag.appendChild(ann_tag)
 
1316
                # Add interface annotation tags
 
1317
                for annotation, value in dict(
 
1318
                    itertools.chain.from_iterable(
 
1319
                        annotations().items()
 
1320
                        for name, annotations
 
1321
                        in self._get_all_dbus_things("interface")
 
1322
                        if name == if_tag.getAttribute("name")
 
1323
                        )).items():
 
1324
                    ann_tag = document.createElement("annotation")
 
1325
                    ann_tag.setAttribute("name", annotation)
 
1326
                    ann_tag.setAttribute("value", value)
 
1327
                    if_tag.appendChild(ann_tag)
 
1328
                # Fix argument name for the Introspect method itself
 
1329
                if (if_tag.getAttribute("name")
 
1330
                    == dbus.INTROSPECTABLE_IFACE):
 
1331
                    for cn in if_tag.getElementsByTagName("method"):
 
1332
                        if cn.getAttribute("name") == "Introspect":
 
1333
                            for arg in cn.getElementsByTagName("arg"):
 
1334
                                if (arg.getAttribute("direction")
 
1335
                                    == "out"):
 
1336
                                    arg.setAttribute("name",
 
1337
                                                     "xml_data")
 
1338
            xmlstring = document.toxml("utf-8")
 
1339
            document.unlink()
 
1340
        except (AttributeError, xml.dom.DOMException,
 
1341
                xml.parsers.expat.ExpatError) as error:
 
1342
            logger.error("Failed to override Introspection method",
 
1343
                         exc_info=error)
 
1344
        return xmlstring
 
1345
 
 
1346
 
 
1347
class DBusObjectWithProperties(DBusObjectWithAnnotations):
 
1348
    """A D-Bus object with properties.
 
1349
 
 
1350
    Classes inheriting from this can use the dbus_service_property
 
1351
    decorator to expose methods as D-Bus properties.  It exposes the
 
1352
    standard Get(), Set(), and GetAll() methods on the D-Bus.
 
1353
    """
 
1354
 
882
1355
    def _get_dbus_property(self, interface_name, property_name):
883
1356
        """Returns a bound method if one exists which is a D-Bus
884
1357
        property with the specified name and interface.
885
1358
        """
886
 
        for cls in  self.__class__.__mro__:
887
 
            for name, value in (inspect.getmembers
888
 
                                (cls,
889
 
                                 self._is_dbus_thing("property"))):
 
1359
        for cls in self.__class__.__mro__:
 
1360
            for name, value in inspect.getmembers(
 
1361
                    cls, self._is_dbus_thing("property")):
890
1362
                if (value._dbus_name == property_name
891
1363
                    and value._dbus_interface == interface_name):
892
1364
                    return value.__get__(self)
893
 
        
 
1365
 
894
1366
        # No such property
895
 
        raise DBusPropertyNotFound(self.dbus_object_path + ":"
896
 
                                   + interface_name + "."
897
 
                                   + property_name)
898
 
    
899
 
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
 
1367
        raise DBusPropertyNotFound("{}:{}.{}".format(
 
1368
            self.dbus_object_path, interface_name, property_name))
 
1369
 
 
1370
    @classmethod
 
1371
    def _get_all_interface_names(cls):
 
1372
        """Get a sequence of all interfaces supported by an object"""
 
1373
        return (name for name in set(getattr(getattr(x, attr),
 
1374
                                             "_dbus_interface", None)
 
1375
                                     for x in (inspect.getmro(cls))
 
1376
                                     for attr in dir(x))
 
1377
                if name is not None)
 
1378
 
 
1379
    @dbus.service.method(dbus.PROPERTIES_IFACE,
 
1380
                         in_signature="ss",
900
1381
                         out_signature="v")
901
1382
    def Get(self, interface_name, property_name):
902
1383
        """Standard D-Bus property Get() method, see D-Bus standard.
908
1389
        if not hasattr(value, "variant_level"):
909
1390
            return value
910
1391
        return type(value)(value, variant_level=value.variant_level+1)
911
 
    
 
1392
 
912
1393
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
913
1394
    def Set(self, interface_name, property_name, value):
914
1395
        """Standard D-Bus property Set() method, see D-Bus standard.
926
1407
            value = dbus.ByteArray(b''.join(chr(byte)
927
1408
                                            for byte in value))
928
1409
        prop(value)
929
 
    
930
 
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
 
1410
 
 
1411
    @dbus.service.method(dbus.PROPERTIES_IFACE,
 
1412
                         in_signature="s",
931
1413
                         out_signature="a{sv}")
932
1414
    def GetAll(self, interface_name):
933
1415
        """Standard D-Bus property GetAll() method, see D-Bus
934
1416
        standard.
935
 
        
 
1417
 
936
1418
        Note: Will not include properties with access="write".
937
1419
        """
938
1420
        properties = {}
948
1430
            if not hasattr(value, "variant_level"):
949
1431
                properties[name] = value
950
1432
                continue
951
 
            properties[name] = type(value)(value, variant_level=
952
 
                                           value.variant_level+1)
 
1433
            properties[name] = type(value)(
 
1434
                value, variant_level=value.variant_level + 1)
953
1435
        return dbus.Dictionary(properties, signature="sv")
954
 
    
 
1436
 
955
1437
    @dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")
956
1438
    def PropertiesChanged(self, interface_name, changed_properties,
957
1439
                          invalidated_properties):
959
1441
        standard.
960
1442
        """
961
1443
        pass
962
 
    
 
1444
 
963
1445
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
964
1446
                         out_signature="s",
965
1447
                         path_keyword='object_path',
966
1448
                         connection_keyword='connection')
967
1449
    def Introspect(self, object_path, connection):
968
1450
        """Overloading of standard D-Bus method.
969
 
        
 
1451
 
970
1452
        Inserts property tags and interface annotation tags.
971
1453
        """
972
 
        xmlstring = dbus.service.Object.Introspect(self, object_path,
973
 
                                                   connection)
 
1454
        xmlstring = DBusObjectWithAnnotations.Introspect(self,
 
1455
                                                         object_path,
 
1456
                                                         connection)
974
1457
        try:
975
1458
            document = xml.dom.minidom.parseString(xmlstring)
 
1459
 
976
1460
            def make_tag(document, name, prop):
977
1461
                e = document.createElement("property")
978
1462
                e.setAttribute("name", name)
979
1463
                e.setAttribute("type", prop._dbus_signature)
980
1464
                e.setAttribute("access", prop._dbus_access)
981
1465
                return e
 
1466
 
982
1467
            for if_tag in document.getElementsByTagName("interface"):
983
1468
                # Add property tags
984
1469
                for tag in (make_tag(document, name, prop)
987
1472
                            if prop._dbus_interface
988
1473
                            == if_tag.getAttribute("name")):
989
1474
                    if_tag.appendChild(tag)
990
 
                # Add annotation tags
991
 
                for typ in ("method", "signal", "property"):
992
 
                    for tag in if_tag.getElementsByTagName(typ):
993
 
                        annots = dict()
994
 
                        for name, prop in (self.
995
 
                                           _get_all_dbus_things(typ)):
996
 
                            if (name == tag.getAttribute("name")
997
 
                                and prop._dbus_interface
998
 
                                == if_tag.getAttribute("name")):
999
 
                                annots.update(getattr
1000
 
                                              (prop,
1001
 
                                               "_dbus_annotations",
1002
 
                                               {}))
1003
 
                        for name, value in annots.items():
1004
 
                            ann_tag = document.createElement(
1005
 
                                "annotation")
1006
 
                            ann_tag.setAttribute("name", name)
1007
 
                            ann_tag.setAttribute("value", value)
1008
 
                            tag.appendChild(ann_tag)
1009
 
                # Add interface annotation tags
1010
 
                for annotation, value in dict(
1011
 
                    itertools.chain.from_iterable(
1012
 
                        annotations().items()
1013
 
                        for name, annotations in
1014
 
                        self._get_all_dbus_things("interface")
1015
 
                        if name == if_tag.getAttribute("name")
1016
 
                        )).items():
1017
 
                    ann_tag = document.createElement("annotation")
1018
 
                    ann_tag.setAttribute("name", annotation)
1019
 
                    ann_tag.setAttribute("value", value)
1020
 
                    if_tag.appendChild(ann_tag)
 
1475
                # Add annotation tags for properties
 
1476
                for tag in if_tag.getElementsByTagName("property"):
 
1477
                    annots = dict()
 
1478
                    for name, prop in self._get_all_dbus_things(
 
1479
                            "property"):
 
1480
                        if (name == tag.getAttribute("name")
 
1481
                            and prop._dbus_interface
 
1482
                            == if_tag.getAttribute("name")):
 
1483
                            annots.update(getattr(
 
1484
                                prop, "_dbus_annotations", {}))
 
1485
                    for name, value in annots.items():
 
1486
                        ann_tag = document.createElement(
 
1487
                            "annotation")
 
1488
                        ann_tag.setAttribute("name", name)
 
1489
                        ann_tag.setAttribute("value", value)
 
1490
                        tag.appendChild(ann_tag)
1021
1491
                # Add the names to the return values for the
1022
1492
                # "org.freedesktop.DBus.Properties" methods
1023
1493
                if (if_tag.getAttribute("name")
1042
1512
        return xmlstring
1043
1513
 
1044
1514
 
 
1515
try:
 
1516
    dbus.OBJECT_MANAGER_IFACE
 
1517
except AttributeError:
 
1518
    dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
 
1519
 
 
1520
 
 
1521
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
 
1522
    """A D-Bus object with an ObjectManager.
 
1523
 
 
1524
    Classes inheriting from this exposes the standard
 
1525
    GetManagedObjects call and the InterfacesAdded and
 
1526
    InterfacesRemoved signals on the standard
 
1527
    "org.freedesktop.DBus.ObjectManager" interface.
 
1528
 
 
1529
    Note: No signals are sent automatically; they must be sent
 
1530
    manually.
 
1531
    """
 
1532
    @dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
 
1533
                         out_signature="a{oa{sa{sv}}}")
 
1534
    def GetManagedObjects(self):
 
1535
        """This function must be overridden"""
 
1536
        raise NotImplementedError()
 
1537
 
 
1538
    @dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
 
1539
                         signature="oa{sa{sv}}")
 
1540
    def InterfacesAdded(self, object_path, interfaces_and_properties):
 
1541
        pass
 
1542
 
 
1543
    @dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature="oas")
 
1544
    def InterfacesRemoved(self, object_path, interfaces):
 
1545
        pass
 
1546
 
 
1547
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
 
1548
                         out_signature="s",
 
1549
                         path_keyword='object_path',
 
1550
                         connection_keyword='connection')
 
1551
    def Introspect(self, object_path, connection):
 
1552
        """Overloading of standard D-Bus method.
 
1553
 
 
1554
        Override return argument name of GetManagedObjects to be
 
1555
        "objpath_interfaces_and_properties"
 
1556
        """
 
1557
        xmlstring = DBusObjectWithAnnotations.Introspect(self,
 
1558
                                                         object_path,
 
1559
                                                         connection)
 
1560
        try:
 
1561
            document = xml.dom.minidom.parseString(xmlstring)
 
1562
 
 
1563
            for if_tag in document.getElementsByTagName("interface"):
 
1564
                # Fix argument name for the GetManagedObjects method
 
1565
                if (if_tag.getAttribute("name")
 
1566
                    == dbus.OBJECT_MANAGER_IFACE):
 
1567
                    for cn in if_tag.getElementsByTagName("method"):
 
1568
                        if (cn.getAttribute("name")
 
1569
                            == "GetManagedObjects"):
 
1570
                            for arg in cn.getElementsByTagName("arg"):
 
1571
                                if (arg.getAttribute("direction")
 
1572
                                    == "out"):
 
1573
                                    arg.setAttribute(
 
1574
                                        "name",
 
1575
                                        "objpath_interfaces"
 
1576
                                        "_and_properties")
 
1577
            xmlstring = document.toxml("utf-8")
 
1578
            document.unlink()
 
1579
        except (AttributeError, xml.dom.DOMException,
 
1580
                xml.parsers.expat.ExpatError) as error:
 
1581
            logger.error("Failed to override Introspection method",
 
1582
                         exc_info=error)
 
1583
        return xmlstring
 
1584
 
 
1585
 
1045
1586
def datetime_to_dbus(dt, variant_level=0):
1046
1587
    """Convert a UTC datetime.datetime() to a D-Bus type."""
1047
1588
    if dt is None:
1048
 
        return dbus.String("", variant_level = variant_level)
1049
 
    return dbus.String(dt.isoformat(),
1050
 
                       variant_level=variant_level)
 
1589
        return dbus.String("", variant_level=variant_level)
 
1590
    return dbus.String(dt.isoformat(), variant_level=variant_level)
1051
1591
 
1052
1592
 
1053
1593
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
1055
1595
    dbus.service.Object, it will add alternate D-Bus attributes with
1056
1596
    interface names according to the "alt_interface_names" mapping.
1057
1597
    Usage:
1058
 
    
 
1598
 
1059
1599
    @alternate_dbus_interfaces({"org.example.Interface":
1060
1600
                                    "net.example.AlternateInterface"})
1061
1601
    class SampleDBusObject(dbus.service.Object):
1062
1602
        @dbus.service.method("org.example.Interface")
1063
1603
        def SampleDBusMethod():
1064
1604
            pass
1065
 
    
 
1605
 
1066
1606
    The above "SampleDBusMethod" on "SampleDBusObject" will be
1067
1607
    reachable via two interfaces: "org.example.Interface" and
1068
1608
    "net.example.AlternateInterface", the latter of which will have
1069
1609
    its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
1070
1610
    "true", unless "deprecate" is passed with a False value.
1071
 
    
 
1611
 
1072
1612
    This works for methods and signals, and also for D-Bus properties
1073
1613
    (from DBusObjectWithProperties) and interfaces (from the
1074
1614
    dbus_interface_annotations decorator).
1075
1615
    """
 
1616
 
1076
1617
    def wrapper(cls):
1077
1618
        for orig_interface_name, alt_interface_name in (
1078
 
            alt_interface_names.items()):
 
1619
                alt_interface_names.items()):
1079
1620
            attr = {}
1080
1621
            interface_names = set()
1081
1622
            # Go though all attributes of the class
1083
1624
                # Ignore non-D-Bus attributes, and D-Bus attributes
1084
1625
                # with the wrong interface name
1085
1626
                if (not hasattr(attribute, "_dbus_interface")
1086
 
                    or not attribute._dbus_interface
1087
 
                    .startswith(orig_interface_name)):
 
1627
                    or not attribute._dbus_interface.startswith(
 
1628
                        orig_interface_name)):
1088
1629
                    continue
1089
1630
                # Create an alternate D-Bus interface name based on
1090
1631
                # the current name
1091
 
                alt_interface = (attribute._dbus_interface
1092
 
                                 .replace(orig_interface_name,
1093
 
                                          alt_interface_name))
 
1632
                alt_interface = attribute._dbus_interface.replace(
 
1633
                    orig_interface_name, alt_interface_name)
1094
1634
                interface_names.add(alt_interface)
1095
1635
                # Is this a D-Bus signal?
1096
1636
                if getattr(attribute, "_dbus_is_signal", False):
1097
1637
                    # Extract the original non-method undecorated
1098
1638
                    # function by black magic
1099
 
                    nonmethod_func = (dict(
 
1639
                    if sys.version_info.major == 2:
 
1640
                        nonmethod_func = (dict(
1100
1641
                            zip(attribute.func_code.co_freevars,
1101
 
                                attribute.__closure__))["func"]
1102
 
                                      .cell_contents)
 
1642
                                attribute.__closure__))
 
1643
                                          ["func"].cell_contents)
 
1644
                    else:
 
1645
                        nonmethod_func = (dict(
 
1646
                            zip(attribute.__code__.co_freevars,
 
1647
                                attribute.__closure__))
 
1648
                                          ["func"].cell_contents)
1103
1649
                    # Create a new, but exactly alike, function
1104
1650
                    # object, and decorate it to be a new D-Bus signal
1105
1651
                    # with the alternate D-Bus interface name
1106
 
                    new_function = (dbus.service.signal
1107
 
                                    (alt_interface,
1108
 
                                     attribute._dbus_signature)
1109
 
                                    (types.FunctionType(
1110
 
                                nonmethod_func.func_code,
1111
 
                                nonmethod_func.func_globals,
1112
 
                                nonmethod_func.func_name,
1113
 
                                nonmethod_func.func_defaults,
1114
 
                                nonmethod_func.func_closure)))
 
1652
                    new_function = copy_function(nonmethod_func)
 
1653
                    new_function = (dbus.service.signal(
 
1654
                        alt_interface,
 
1655
                        attribute._dbus_signature)(new_function))
1115
1656
                    # Copy annotations, if any
1116
1657
                    try:
1117
 
                        new_function._dbus_annotations = (
1118
 
                            dict(attribute._dbus_annotations))
 
1658
                        new_function._dbus_annotations = dict(
 
1659
                            attribute._dbus_annotations)
1119
1660
                    except AttributeError:
1120
1661
                        pass
 
1662
 
1121
1663
                    # Define a creator of a function to call both the
1122
1664
                    # original and alternate functions, so both the
1123
1665
                    # original and alternate signals gets sent when
1126
1668
                        """This function is a scope container to pass
1127
1669
                        func1 and func2 to the "call_both" function
1128
1670
                        outside of its arguments"""
 
1671
 
 
1672
                        @functools.wraps(func2)
1129
1673
                        def call_both(*args, **kwargs):
1130
1674
                            """This function will emit two D-Bus
1131
1675
                            signals by calling func1 and func2"""
1132
1676
                            func1(*args, **kwargs)
1133
1677
                            func2(*args, **kwargs)
 
1678
                        # Make wrapper function look like a D-Bus
 
1679
                        # signal
 
1680
                        for name, attr in inspect.getmembers(func2):
 
1681
                            if name.startswith("_dbus_"):
 
1682
                                setattr(call_both, name, attr)
 
1683
 
1134
1684
                        return call_both
1135
1685
                    # Create the "call_both" function and add it to
1136
1686
                    # the class
1141
1691
                    # object.  Decorate it to be a new D-Bus method
1142
1692
                    # with the alternate D-Bus interface name.  Add it
1143
1693
                    # to the class.
1144
 
                    attr[attrname] = (dbus.service.method
1145
 
                                      (alt_interface,
1146
 
                                       attribute._dbus_in_signature,
1147
 
                                       attribute._dbus_out_signature)
1148
 
                                      (types.FunctionType
1149
 
                                       (attribute.func_code,
1150
 
                                        attribute.func_globals,
1151
 
                                        attribute.func_name,
1152
 
                                        attribute.func_defaults,
1153
 
                                        attribute.func_closure)))
 
1694
                    attr[attrname] = (
 
1695
                        dbus.service.method(
 
1696
                            alt_interface,
 
1697
                            attribute._dbus_in_signature,
 
1698
                            attribute._dbus_out_signature)
 
1699
                        (copy_function(attribute)))
1154
1700
                    # Copy annotations, if any
1155
1701
                    try:
1156
 
                        attr[attrname]._dbus_annotations = (
1157
 
                            dict(attribute._dbus_annotations))
 
1702
                        attr[attrname]._dbus_annotations = dict(
 
1703
                            attribute._dbus_annotations)
1158
1704
                    except AttributeError:
1159
1705
                        pass
1160
1706
                # Is this a D-Bus property?
1163
1709
                    # object, and decorate it to be a new D-Bus
1164
1710
                    # property with the alternate D-Bus interface
1165
1711
                    # name.  Add it to the class.
1166
 
                    attr[attrname] = (dbus_service_property
1167
 
                                      (alt_interface,
1168
 
                                       attribute._dbus_signature,
1169
 
                                       attribute._dbus_access,
1170
 
                                       attribute
1171
 
                                       ._dbus_get_args_options
1172
 
                                       ["byte_arrays"])
1173
 
                                      (types.FunctionType
1174
 
                                       (attribute.func_code,
1175
 
                                        attribute.func_globals,
1176
 
                                        attribute.func_name,
1177
 
                                        attribute.func_defaults,
1178
 
                                        attribute.func_closure)))
 
1712
                    attr[attrname] = (dbus_service_property(
 
1713
                        alt_interface, attribute._dbus_signature,
 
1714
                        attribute._dbus_access,
 
1715
                        attribute._dbus_get_args_options
 
1716
                        ["byte_arrays"])
 
1717
                                      (copy_function(attribute)))
1179
1718
                    # Copy annotations, if any
1180
1719
                    try:
1181
 
                        attr[attrname]._dbus_annotations = (
1182
 
                            dict(attribute._dbus_annotations))
 
1720
                        attr[attrname]._dbus_annotations = dict(
 
1721
                            attribute._dbus_annotations)
1183
1722
                    except AttributeError:
1184
1723
                        pass
1185
1724
                # Is this a D-Bus interface?
1188
1727
                    # object.  Decorate it to be a new D-Bus interface
1189
1728
                    # with the alternate D-Bus interface name.  Add it
1190
1729
                    # to the class.
1191
 
                    attr[attrname] = (dbus_interface_annotations
1192
 
                                      (alt_interface)
1193
 
                                      (types.FunctionType
1194
 
                                       (attribute.func_code,
1195
 
                                        attribute.func_globals,
1196
 
                                        attribute.func_name,
1197
 
                                        attribute.func_defaults,
1198
 
                                        attribute.func_closure)))
 
1730
                    attr[attrname] = (
 
1731
                        dbus_interface_annotations(alt_interface)
 
1732
                        (copy_function(attribute)))
1199
1733
            if deprecate:
1200
1734
                # Deprecate all alternate interfaces
1201
 
                iname="_AlternateDBusNames_interface_annotation{}"
 
1735
                iname = "_AlternateDBusNames_interface_annotation{}"
1202
1736
                for interface_name in interface_names:
 
1737
 
1203
1738
                    @dbus_interface_annotations(interface_name)
1204
1739
                    def func(self):
1205
 
                        return { "org.freedesktop.DBus.Deprecated":
1206
 
                                     "true" }
 
1740
                        return {"org.freedesktop.DBus.Deprecated":
 
1741
                                "true"}
1207
1742
                    # Find an unused name
1208
1743
                    for aname in (iname.format(i)
1209
1744
                                  for i in itertools.count()):
1213
1748
            if interface_names:
1214
1749
                # Replace the class with a new subclass of it with
1215
1750
                # methods, signals, etc. as created above.
1216
 
                cls = type(b"{}Alternate".format(cls.__name__),
1217
 
                           (cls,), attr)
 
1751
                if sys.version_info.major == 2:
 
1752
                    cls = type(b"{}Alternate".format(cls.__name__),
 
1753
                               (cls, ), attr)
 
1754
                else:
 
1755
                    cls = type("{}Alternate".format(cls.__name__),
 
1756
                               (cls, ), attr)
1218
1757
        return cls
 
1758
 
1219
1759
    return wrapper
1220
1760
 
1221
1761
 
1222
1762
@alternate_dbus_interfaces({"se.recompile.Mandos":
1223
 
                                "se.bsnet.fukt.Mandos"})
 
1763
                            "se.bsnet.fukt.Mandos"})
1224
1764
class ClientDBus(Client, DBusObjectWithProperties):
1225
1765
    """A Client class using D-Bus
1226
 
    
 
1766
 
1227
1767
    Attributes:
1228
1768
    dbus_object_path: dbus.ObjectPath
1229
1769
    bus: dbus.SystemBus()
1230
1770
    """
1231
 
    
 
1771
 
1232
1772
    runtime_expansions = (Client.runtime_expansions
1233
 
                          + ("dbus_object_path",))
1234
 
    
 
1773
                          + ("dbus_object_path", ))
 
1774
 
1235
1775
    _interface = "se.recompile.Mandos.Client"
1236
 
    
 
1776
 
1237
1777
    # dbus.service.Object doesn't use super(), so we can't either.
1238
 
    
1239
 
    def __init__(self, bus = None, *args, **kwargs):
 
1778
 
 
1779
    def __init__(self, bus=None, *args, **kwargs):
1240
1780
        self.bus = bus
1241
1781
        Client.__init__(self, *args, **kwargs)
1242
1782
        # Only now, when this client is initialized, can it show up on
1244
1784
        client_object_name = str(self.name).translate(
1245
1785
            {ord("."): ord("_"),
1246
1786
             ord("-"): ord("_")})
1247
 
        self.dbus_object_path = (dbus.ObjectPath
1248
 
                                 ("/clients/" + client_object_name))
 
1787
        self.dbus_object_path = dbus.ObjectPath(
 
1788
            "/clients/" + client_object_name)
1249
1789
        DBusObjectWithProperties.__init__(self, self.bus,
1250
1790
                                          self.dbus_object_path)
1251
 
    
1252
 
    def notifychangeproperty(transform_func,
1253
 
                             dbus_name, type_func=lambda x: x,
1254
 
                             variant_level=1, invalidate_only=False,
 
1791
 
 
1792
    def notifychangeproperty(transform_func, dbus_name,
 
1793
                             type_func=lambda x: x,
 
1794
                             variant_level=1,
 
1795
                             invalidate_only=False,
1255
1796
                             _interface=_interface):
1256
1797
        """ Modify a variable so that it's a property which announces
1257
1798
        its changes to DBus.
1258
 
        
 
1799
 
1259
1800
        transform_fun: Function that takes a value and a variant_level
1260
1801
                       and transforms it to a D-Bus type.
1261
1802
        dbus_name: D-Bus name of the variable
1264
1805
        variant_level: D-Bus variant level.  Default: 1
1265
1806
        """
1266
1807
        attrname = "_{}".format(dbus_name)
 
1808
 
1267
1809
        def setter(self, value):
1268
1810
            if hasattr(self, "dbus_object_path"):
1269
1811
                if (not hasattr(self, attrname) or
1270
1812
                    type_func(getattr(self, attrname, None))
1271
1813
                    != type_func(value)):
1272
1814
                    if invalidate_only:
1273
 
                        self.PropertiesChanged(_interface,
1274
 
                                               dbus.Dictionary(),
1275
 
                                               dbus.Array
1276
 
                                               ((dbus_name,)))
 
1815
                        self.PropertiesChanged(
 
1816
                            _interface, dbus.Dictionary(),
 
1817
                            dbus.Array((dbus_name, )))
1277
1818
                    else:
1278
 
                        dbus_value = transform_func(type_func(value),
1279
 
                                                    variant_level
1280
 
                                                    =variant_level)
 
1819
                        dbus_value = transform_func(
 
1820
                            type_func(value),
 
1821
                            variant_level=variant_level)
1281
1822
                        self.PropertyChanged(dbus.String(dbus_name),
1282
1823
                                             dbus_value)
1283
 
                        self.PropertiesChanged(_interface,
1284
 
                                               dbus.Dictionary({
1285
 
                                    dbus.String(dbus_name):
1286
 
                                        dbus_value }), dbus.Array())
 
1824
                        self.PropertiesChanged(
 
1825
                            _interface,
 
1826
                            dbus.Dictionary({dbus.String(dbus_name):
 
1827
                                             dbus_value}),
 
1828
                            dbus.Array())
1287
1829
            setattr(self, attrname, value)
1288
 
        
 
1830
 
1289
1831
        return property(lambda self: getattr(self, attrname), setter)
1290
 
    
 
1832
 
1291
1833
    expires = notifychangeproperty(datetime_to_dbus, "Expires")
1292
1834
    approvals_pending = notifychangeproperty(dbus.Boolean,
1293
1835
                                             "ApprovalPending",
1294
 
                                             type_func = bool)
 
1836
                                             type_func=bool)
1295
1837
    enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1296
1838
    last_enabled = notifychangeproperty(datetime_to_dbus,
1297
1839
                                        "LastEnabled")
1298
 
    checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",
1299
 
                                   type_func = lambda checker:
1300
 
                                       checker is not None)
 
1840
    checker = notifychangeproperty(
 
1841
        dbus.Boolean, "CheckerRunning",
 
1842
        type_func=lambda checker: checker is not None)
1301
1843
    last_checked_ok = notifychangeproperty(datetime_to_dbus,
1302
1844
                                           "LastCheckedOK")
1303
1845
    last_checker_status = notifychangeproperty(dbus.Int16,
1306
1848
        datetime_to_dbus, "LastApprovalRequest")
1307
1849
    approved_by_default = notifychangeproperty(dbus.Boolean,
1308
1850
                                               "ApprovedByDefault")
1309
 
    approval_delay = notifychangeproperty(dbus.UInt64,
1310
 
                                          "ApprovalDelay",
1311
 
                                          type_func =
1312
 
                                          lambda td: td.total_seconds()
1313
 
                                          * 1000)
 
1851
    approval_delay = notifychangeproperty(
 
1852
        dbus.UInt64, "ApprovalDelay",
 
1853
        type_func=lambda td: td.total_seconds() * 1000)
1314
1854
    approval_duration = notifychangeproperty(
1315
1855
        dbus.UInt64, "ApprovalDuration",
1316
 
        type_func = lambda td: td.total_seconds() * 1000)
 
1856
        type_func=lambda td: td.total_seconds() * 1000)
1317
1857
    host = notifychangeproperty(dbus.String, "Host")
1318
 
    timeout = notifychangeproperty(dbus.UInt64, "Timeout",
1319
 
                                   type_func = lambda td:
1320
 
                                       td.total_seconds() * 1000)
 
1858
    timeout = notifychangeproperty(
 
1859
        dbus.UInt64, "Timeout",
 
1860
        type_func=lambda td: td.total_seconds() * 1000)
1321
1861
    extended_timeout = notifychangeproperty(
1322
1862
        dbus.UInt64, "ExtendedTimeout",
1323
 
        type_func = lambda td: td.total_seconds() * 1000)
1324
 
    interval = notifychangeproperty(dbus.UInt64,
1325
 
                                    "Interval",
1326
 
                                    type_func =
1327
 
                                    lambda td: td.total_seconds()
1328
 
                                    * 1000)
 
1863
        type_func=lambda td: td.total_seconds() * 1000)
 
1864
    interval = notifychangeproperty(
 
1865
        dbus.UInt64, "Interval",
 
1866
        type_func=lambda td: td.total_seconds() * 1000)
1329
1867
    checker_command = notifychangeproperty(dbus.String, "Checker")
1330
1868
    secret = notifychangeproperty(dbus.ByteArray, "Secret",
1331
1869
                                  invalidate_only=True)
1332
 
    
 
1870
 
1333
1871
    del notifychangeproperty
1334
 
    
 
1872
 
1335
1873
    def __del__(self, *args, **kwargs):
1336
1874
        try:
1337
1875
            self.remove_from_connection()
1340
1878
        if hasattr(DBusObjectWithProperties, "__del__"):
1341
1879
            DBusObjectWithProperties.__del__(self, *args, **kwargs)
1342
1880
        Client.__del__(self, *args, **kwargs)
1343
 
    
1344
 
    def checker_callback(self, pid, condition, command,
1345
 
                         *args, **kwargs):
1346
 
        self.checker_callback_tag = None
1347
 
        self.checker = None
1348
 
        if os.WIFEXITED(condition):
1349
 
            exitstatus = os.WEXITSTATUS(condition)
 
1881
 
 
1882
    def checker_callback(self, source, condition,
 
1883
                         connection, command, *args, **kwargs):
 
1884
        ret = Client.checker_callback(self, source, condition,
 
1885
                                      connection, command, *args,
 
1886
                                      **kwargs)
 
1887
        exitstatus = self.last_checker_status
 
1888
        if exitstatus >= 0:
1350
1889
            # Emit D-Bus signal
1351
1890
            self.CheckerCompleted(dbus.Int16(exitstatus),
1352
 
                                  dbus.Int64(condition),
 
1891
                                  # This is specific to GNU libC
 
1892
                                  dbus.Int64(exitstatus << 8),
1353
1893
                                  dbus.String(command))
1354
1894
        else:
1355
1895
            # Emit D-Bus signal
1356
1896
            self.CheckerCompleted(dbus.Int16(-1),
1357
 
                                  dbus.Int64(condition),
 
1897
                                  dbus.Int64(
 
1898
                                      # This is specific to GNU libC
 
1899
                                      (exitstatus << 8)
 
1900
                                      | self.last_checker_signal),
1358
1901
                                  dbus.String(command))
1359
 
        
1360
 
        return Client.checker_callback(self, pid, condition, command,
1361
 
                                       *args, **kwargs)
1362
 
    
 
1902
        return ret
 
1903
 
1363
1904
    def start_checker(self, *args, **kwargs):
1364
1905
        old_checker_pid = getattr(self.checker, "pid", None)
1365
1906
        r = Client.start_checker(self, *args, **kwargs)
1369
1910
            # Emit D-Bus signal
1370
1911
            self.CheckerStarted(self.current_checker_command)
1371
1912
        return r
1372
 
    
 
1913
 
1373
1914
    def _reset_approved(self):
1374
1915
        self.approved = None
1375
1916
        return False
1376
 
    
 
1917
 
1377
1918
    def approve(self, value=True):
1378
1919
        self.approved = value
1379
 
        gobject.timeout_add(int(self.approval_duration.total_seconds()
1380
 
                                * 1000), self._reset_approved)
 
1920
        GLib.timeout_add(int(self.approval_duration.total_seconds()
 
1921
                             * 1000), self._reset_approved)
1381
1922
        self.send_changedstate()
1382
 
    
1383
 
    ## D-Bus methods, signals & properties
1384
 
    
1385
 
    ## Interfaces
1386
 
    
1387
 
    ## Signals
1388
 
    
 
1923
 
 
1924
    #  D-Bus methods, signals & properties
 
1925
 
 
1926
    #  Interfaces
 
1927
 
 
1928
    #  Signals
 
1929
 
1389
1930
    # CheckerCompleted - signal
1390
1931
    @dbus.service.signal(_interface, signature="nxs")
1391
1932
    def CheckerCompleted(self, exitcode, waitstatus, command):
1392
1933
        "D-Bus signal"
1393
1934
        pass
1394
 
    
 
1935
 
1395
1936
    # CheckerStarted - signal
1396
1937
    @dbus.service.signal(_interface, signature="s")
1397
1938
    def CheckerStarted(self, command):
1398
1939
        "D-Bus signal"
1399
1940
        pass
1400
 
    
 
1941
 
1401
1942
    # PropertyChanged - signal
1402
1943
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1403
1944
    @dbus.service.signal(_interface, signature="sv")
1404
1945
    def PropertyChanged(self, property, value):
1405
1946
        "D-Bus signal"
1406
1947
        pass
1407
 
    
 
1948
 
1408
1949
    # GotSecret - signal
1409
1950
    @dbus.service.signal(_interface)
1410
1951
    def GotSecret(self):
1413
1954
        server to mandos-client
1414
1955
        """
1415
1956
        pass
1416
 
    
 
1957
 
1417
1958
    # Rejected - signal
1418
1959
    @dbus.service.signal(_interface, signature="s")
1419
1960
    def Rejected(self, reason):
1420
1961
        "D-Bus signal"
1421
1962
        pass
1422
 
    
 
1963
 
1423
1964
    # NeedApproval - signal
1424
1965
    @dbus.service.signal(_interface, signature="tb")
1425
1966
    def NeedApproval(self, timeout, default):
1426
1967
        "D-Bus signal"
1427
1968
        return self.need_approval()
1428
 
    
1429
 
    ## Methods
1430
 
    
 
1969
 
 
1970
    #  Methods
 
1971
 
1431
1972
    # Approve - method
1432
1973
    @dbus.service.method(_interface, in_signature="b")
1433
1974
    def Approve(self, value):
1434
1975
        self.approve(value)
1435
 
    
 
1976
 
1436
1977
    # CheckedOK - method
1437
1978
    @dbus.service.method(_interface)
1438
1979
    def CheckedOK(self):
1439
1980
        self.checked_ok()
1440
 
    
 
1981
 
1441
1982
    # Enable - method
 
1983
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1442
1984
    @dbus.service.method(_interface)
1443
1985
    def Enable(self):
1444
1986
        "D-Bus method"
1445
1987
        self.enable()
1446
 
    
 
1988
 
1447
1989
    # StartChecker - method
 
1990
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1448
1991
    @dbus.service.method(_interface)
1449
1992
    def StartChecker(self):
1450
1993
        "D-Bus method"
1451
1994
        self.start_checker()
1452
 
    
 
1995
 
1453
1996
    # Disable - method
 
1997
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1454
1998
    @dbus.service.method(_interface)
1455
1999
    def Disable(self):
1456
2000
        "D-Bus method"
1457
2001
        self.disable()
1458
 
    
 
2002
 
1459
2003
    # StopChecker - method
 
2004
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1460
2005
    @dbus.service.method(_interface)
1461
2006
    def StopChecker(self):
1462
2007
        self.stop_checker()
1463
 
    
1464
 
    ## Properties
1465
 
    
 
2008
 
 
2009
    #  Properties
 
2010
 
1466
2011
    # ApprovalPending - property
1467
2012
    @dbus_service_property(_interface, signature="b", access="read")
1468
2013
    def ApprovalPending_dbus_property(self):
1469
2014
        return dbus.Boolean(bool(self.approvals_pending))
1470
 
    
 
2015
 
1471
2016
    # ApprovedByDefault - property
1472
 
    @dbus_service_property(_interface, signature="b",
 
2017
    @dbus_service_property(_interface,
 
2018
                           signature="b",
1473
2019
                           access="readwrite")
1474
2020
    def ApprovedByDefault_dbus_property(self, value=None):
1475
2021
        if value is None:       # get
1476
2022
            return dbus.Boolean(self.approved_by_default)
1477
2023
        self.approved_by_default = bool(value)
1478
 
    
 
2024
 
1479
2025
    # ApprovalDelay - property
1480
 
    @dbus_service_property(_interface, signature="t",
 
2026
    @dbus_service_property(_interface,
 
2027
                           signature="t",
1481
2028
                           access="readwrite")
1482
2029
    def ApprovalDelay_dbus_property(self, value=None):
1483
2030
        if value is None:       # get
1484
2031
            return dbus.UInt64(self.approval_delay.total_seconds()
1485
2032
                               * 1000)
1486
2033
        self.approval_delay = datetime.timedelta(0, 0, 0, value)
1487
 
    
 
2034
 
1488
2035
    # ApprovalDuration - property
1489
 
    @dbus_service_property(_interface, signature="t",
 
2036
    @dbus_service_property(_interface,
 
2037
                           signature="t",
1490
2038
                           access="readwrite")
1491
2039
    def ApprovalDuration_dbus_property(self, value=None):
1492
2040
        if value is None:       # get
1493
2041
            return dbus.UInt64(self.approval_duration.total_seconds()
1494
2042
                               * 1000)
1495
2043
        self.approval_duration = datetime.timedelta(0, 0, 0, value)
1496
 
    
 
2044
 
1497
2045
    # Name - property
 
2046
    @dbus_annotations(
 
2047
        {"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1498
2048
    @dbus_service_property(_interface, signature="s", access="read")
1499
2049
    def Name_dbus_property(self):
1500
2050
        return dbus.String(self.name)
1501
 
    
 
2051
 
 
2052
    # KeyID - property
 
2053
    @dbus_annotations(
 
2054
        {"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
 
2055
    @dbus_service_property(_interface, signature="s", access="read")
 
2056
    def KeyID_dbus_property(self):
 
2057
        return dbus.String(self.key_id)
 
2058
 
1502
2059
    # Fingerprint - property
 
2060
    @dbus_annotations(
 
2061
        {"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1503
2062
    @dbus_service_property(_interface, signature="s", access="read")
1504
2063
    def Fingerprint_dbus_property(self):
1505
2064
        return dbus.String(self.fingerprint)
1506
 
    
 
2065
 
1507
2066
    # Host - property
1508
 
    @dbus_service_property(_interface, signature="s",
 
2067
    @dbus_service_property(_interface,
 
2068
                           signature="s",
1509
2069
                           access="readwrite")
1510
2070
    def Host_dbus_property(self, value=None):
1511
2071
        if value is None:       # get
1512
2072
            return dbus.String(self.host)
1513
2073
        self.host = str(value)
1514
 
    
 
2074
 
1515
2075
    # Created - property
 
2076
    @dbus_annotations(
 
2077
        {"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1516
2078
    @dbus_service_property(_interface, signature="s", access="read")
1517
2079
    def Created_dbus_property(self):
1518
2080
        return datetime_to_dbus(self.created)
1519
 
    
 
2081
 
1520
2082
    # LastEnabled - property
1521
2083
    @dbus_service_property(_interface, signature="s", access="read")
1522
2084
    def LastEnabled_dbus_property(self):
1523
2085
        return datetime_to_dbus(self.last_enabled)
1524
 
    
 
2086
 
1525
2087
    # Enabled - property
1526
 
    @dbus_service_property(_interface, signature="b",
 
2088
    @dbus_service_property(_interface,
 
2089
                           signature="b",
1527
2090
                           access="readwrite")
1528
2091
    def Enabled_dbus_property(self, value=None):
1529
2092
        if value is None:       # get
1532
2095
            self.enable()
1533
2096
        else:
1534
2097
            self.disable()
1535
 
    
 
2098
 
1536
2099
    # LastCheckedOK - property
1537
 
    @dbus_service_property(_interface, signature="s",
 
2100
    @dbus_service_property(_interface,
 
2101
                           signature="s",
1538
2102
                           access="readwrite")
1539
2103
    def LastCheckedOK_dbus_property(self, value=None):
1540
2104
        if value is not None:
1541
2105
            self.checked_ok()
1542
2106
            return
1543
2107
        return datetime_to_dbus(self.last_checked_ok)
1544
 
    
 
2108
 
1545
2109
    # LastCheckerStatus - property
1546
 
    @dbus_service_property(_interface, signature="n",
1547
 
                           access="read")
 
2110
    @dbus_service_property(_interface, signature="n", access="read")
1548
2111
    def LastCheckerStatus_dbus_property(self):
1549
2112
        return dbus.Int16(self.last_checker_status)
1550
 
    
 
2113
 
1551
2114
    # Expires - property
1552
2115
    @dbus_service_property(_interface, signature="s", access="read")
1553
2116
    def Expires_dbus_property(self):
1554
2117
        return datetime_to_dbus(self.expires)
1555
 
    
 
2118
 
1556
2119
    # LastApprovalRequest - property
1557
2120
    @dbus_service_property(_interface, signature="s", access="read")
1558
2121
    def LastApprovalRequest_dbus_property(self):
1559
2122
        return datetime_to_dbus(self.last_approval_request)
1560
 
    
 
2123
 
1561
2124
    # Timeout - property
1562
 
    @dbus_service_property(_interface, signature="t",
 
2125
    @dbus_service_property(_interface,
 
2126
                           signature="t",
1563
2127
                           access="readwrite")
1564
2128
    def Timeout_dbus_property(self, value=None):
1565
2129
        if value is None:       # get
1577
2141
                if (getattr(self, "disable_initiator_tag", None)
1578
2142
                    is None):
1579
2143
                    return
1580
 
                gobject.source_remove(self.disable_initiator_tag)
1581
 
                self.disable_initiator_tag = (
1582
 
                    gobject.timeout_add(
1583
 
                        int((self.expires - now).total_seconds()
1584
 
                            * 1000), self.disable))
1585
 
    
 
2144
                GLib.source_remove(self.disable_initiator_tag)
 
2145
                self.disable_initiator_tag = GLib.timeout_add(
 
2146
                    int((self.expires - now).total_seconds() * 1000),
 
2147
                    self.disable)
 
2148
 
1586
2149
    # ExtendedTimeout - property
1587
 
    @dbus_service_property(_interface, signature="t",
 
2150
    @dbus_service_property(_interface,
 
2151
                           signature="t",
1588
2152
                           access="readwrite")
1589
2153
    def ExtendedTimeout_dbus_property(self, value=None):
1590
2154
        if value is None:       # get
1591
2155
            return dbus.UInt64(self.extended_timeout.total_seconds()
1592
2156
                               * 1000)
1593
2157
        self.extended_timeout = datetime.timedelta(0, 0, 0, value)
1594
 
    
 
2158
 
1595
2159
    # Interval - property
1596
 
    @dbus_service_property(_interface, signature="t",
 
2160
    @dbus_service_property(_interface,
 
2161
                           signature="t",
1597
2162
                           access="readwrite")
1598
2163
    def Interval_dbus_property(self, value=None):
1599
2164
        if value is None:       # get
1603
2168
            return
1604
2169
        if self.enabled:
1605
2170
            # Reschedule checker run
1606
 
            gobject.source_remove(self.checker_initiator_tag)
1607
 
            self.checker_initiator_tag = (gobject.timeout_add
1608
 
                                          (value, self.start_checker))
1609
 
            self.start_checker()    # Start one now, too
1610
 
    
 
2171
            GLib.source_remove(self.checker_initiator_tag)
 
2172
            self.checker_initiator_tag = GLib.timeout_add(
 
2173
                value, self.start_checker)
 
2174
            self.start_checker()  # Start one now, too
 
2175
 
1611
2176
    # Checker - property
1612
 
    @dbus_service_property(_interface, signature="s",
 
2177
    @dbus_service_property(_interface,
 
2178
                           signature="s",
1613
2179
                           access="readwrite")
1614
2180
    def Checker_dbus_property(self, value=None):
1615
2181
        if value is None:       # get
1616
2182
            return dbus.String(self.checker_command)
1617
2183
        self.checker_command = str(value)
1618
 
    
 
2184
 
1619
2185
    # CheckerRunning - property
1620
 
    @dbus_service_property(_interface, signature="b",
 
2186
    @dbus_service_property(_interface,
 
2187
                           signature="b",
1621
2188
                           access="readwrite")
1622
2189
    def CheckerRunning_dbus_property(self, value=None):
1623
2190
        if value is None:       # get
1626
2193
            self.start_checker()
1627
2194
        else:
1628
2195
            self.stop_checker()
1629
 
    
 
2196
 
1630
2197
    # ObjectPath - property
 
2198
    @dbus_annotations(
 
2199
        {"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",
 
2200
         "org.freedesktop.DBus.Deprecated": "true"})
1631
2201
    @dbus_service_property(_interface, signature="o", access="read")
1632
2202
    def ObjectPath_dbus_property(self):
1633
 
        return self.dbus_object_path # is already a dbus.ObjectPath
1634
 
    
 
2203
        return self.dbus_object_path  # is already a dbus.ObjectPath
 
2204
 
1635
2205
    # Secret = property
1636
 
    @dbus_service_property(_interface, signature="ay",
1637
 
                           access="write", byte_arrays=True)
 
2206
    @dbus_annotations(
 
2207
        {"org.freedesktop.DBus.Property.EmitsChangedSignal":
 
2208
         "invalidates"})
 
2209
    @dbus_service_property(_interface,
 
2210
                           signature="ay",
 
2211
                           access="write",
 
2212
                           byte_arrays=True)
1638
2213
    def Secret_dbus_property(self, value):
1639
2214
        self.secret = bytes(value)
1640
 
    
 
2215
 
1641
2216
    del _interface
1642
2217
 
1643
2218
 
1644
 
class ProxyClient(object):
1645
 
    def __init__(self, child_pipe, fpr, address):
 
2219
class ProxyClient:
 
2220
    def __init__(self, child_pipe, key_id, fpr, address):
1646
2221
        self._pipe = child_pipe
1647
 
        self._pipe.send(('init', fpr, address))
 
2222
        self._pipe.send(('init', key_id, fpr, address))
1648
2223
        if not self._pipe.recv():
1649
 
            raise KeyError()
1650
 
    
 
2224
            raise KeyError(key_id or fpr)
 
2225
 
1651
2226
    def __getattribute__(self, name):
1652
2227
        if name == '_pipe':
1653
2228
            return super(ProxyClient, self).__getattribute__(name)
1656
2231
        if data[0] == 'data':
1657
2232
            return data[1]
1658
2233
        if data[0] == 'function':
 
2234
 
1659
2235
            def func(*args, **kwargs):
1660
2236
                self._pipe.send(('funcall', name, args, kwargs))
1661
2237
                return self._pipe.recv()[1]
 
2238
 
1662
2239
            return func
1663
 
    
 
2240
 
1664
2241
    def __setattr__(self, name, value):
1665
2242
        if name == '_pipe':
1666
2243
            return super(ProxyClient, self).__setattr__(name, value)
1669
2246
 
1670
2247
class ClientHandler(socketserver.BaseRequestHandler, object):
1671
2248
    """A class to handle client connections.
1672
 
    
 
2249
 
1673
2250
    Instantiated once for each connection to handle it.
1674
2251
    Note: This will run in its own forked process."""
1675
 
    
 
2252
 
1676
2253
    def handle(self):
1677
2254
        with contextlib.closing(self.server.child_pipe) as child_pipe:
1678
2255
            logger.info("TCP connection from: %s",
1679
2256
                        str(self.client_address))
1680
2257
            logger.debug("Pipe FD: %d",
1681
2258
                         self.server.child_pipe.fileno())
1682
 
            
1683
 
            session = (gnutls.connection
1684
 
                       .ClientSession(self.request,
1685
 
                                      gnutls.connection
1686
 
                                      .X509Credentials()))
1687
 
            
1688
 
            # Note: gnutls.connection.X509Credentials is really a
1689
 
            # generic GnuTLS certificate credentials object so long as
1690
 
            # no X.509 keys are added to it.  Therefore, we can use it
1691
 
            # here despite using OpenPGP certificates.
1692
 
            
1693
 
            #priority = ':'.join(("NONE", "+VERS-TLS1.1",
1694
 
            #                      "+AES-256-CBC", "+SHA1",
1695
 
            #                      "+COMP-NULL", "+CTYPE-OPENPGP",
1696
 
            #                      "+DHE-DSS"))
 
2259
 
 
2260
            session = gnutls.ClientSession(self.request)
 
2261
 
 
2262
            # priority = ':'.join(("NONE", "+VERS-TLS1.1",
 
2263
            #                       "+AES-256-CBC", "+SHA1",
 
2264
            #                       "+COMP-NULL", "+CTYPE-OPENPGP",
 
2265
            #                       "+DHE-DSS"))
1697
2266
            # Use a fallback default, since this MUST be set.
1698
2267
            priority = self.server.gnutls_priority
1699
2268
            if priority is None:
1700
2269
                priority = "NORMAL"
1701
 
            (gnutls.library.functions
1702
 
             .gnutls_priority_set_direct(session._c_object,
1703
 
                                         priority, None))
1704
 
            
 
2270
            gnutls.priority_set_direct(session._c_object,
 
2271
                                       priority.encode("utf-8"),
 
2272
                                       None)
 
2273
 
1705
2274
            # Start communication using the Mandos protocol
1706
2275
            # Get protocol number
1707
2276
            line = self.request.makefile().readline()
1712
2281
            except (ValueError, IndexError, RuntimeError) as error:
1713
2282
                logger.error("Unknown protocol version: %s", error)
1714
2283
                return
1715
 
            
 
2284
 
1716
2285
            # Start GnuTLS connection
1717
2286
            try:
1718
2287
                session.handshake()
1719
 
            except gnutls.errors.GNUTLSError as error:
 
2288
            except gnutls.Error as error:
1720
2289
                logger.warning("Handshake failed: %s", error)
1721
2290
                # Do not run session.bye() here: the session is not
1722
2291
                # established.  Just abandon the request.
1723
2292
                return
1724
2293
            logger.debug("Handshake succeeded")
1725
 
            
 
2294
 
1726
2295
            approval_required = False
1727
2296
            try:
1728
 
                try:
1729
 
                    fpr = self.fingerprint(self.peer_certificate
1730
 
                                           (session))
1731
 
                except (TypeError,
1732
 
                        gnutls.errors.GNUTLSError) as error:
1733
 
                    logger.warning("Bad certificate: %s", error)
1734
 
                    return
1735
 
                logger.debug("Fingerprint: %s", fpr)
1736
 
                
1737
 
                try:
1738
 
                    client = ProxyClient(child_pipe, fpr,
 
2297
                if gnutls.has_rawpk:
 
2298
                    fpr = b""
 
2299
                    try:
 
2300
                        key_id = self.key_id(
 
2301
                            self.peer_certificate(session))
 
2302
                    except (TypeError, gnutls.Error) as error:
 
2303
                        logger.warning("Bad certificate: %s", error)
 
2304
                        return
 
2305
                    logger.debug("Key ID: %s", key_id)
 
2306
 
 
2307
                else:
 
2308
                    key_id = b""
 
2309
                    try:
 
2310
                        fpr = self.fingerprint(
 
2311
                            self.peer_certificate(session))
 
2312
                    except (TypeError, gnutls.Error) as error:
 
2313
                        logger.warning("Bad certificate: %s", error)
 
2314
                        return
 
2315
                    logger.debug("Fingerprint: %s", fpr)
 
2316
 
 
2317
                try:
 
2318
                    client = ProxyClient(child_pipe, key_id, fpr,
1739
2319
                                         self.client_address)
1740
2320
                except KeyError:
1741
2321
                    return
1742
 
                
 
2322
 
1743
2323
                if client.approval_delay:
1744
2324
                    delay = client.approval_delay
1745
2325
                    client.approvals_pending += 1
1746
2326
                    approval_required = True
1747
 
                
 
2327
 
1748
2328
                while True:
1749
2329
                    if not client.enabled:
1750
2330
                        logger.info("Client %s is disabled",
1751
 
                                       client.name)
 
2331
                                    client.name)
1752
2332
                        if self.server.use_dbus:
1753
2333
                            # Emit D-Bus signal
1754
2334
                            client.Rejected("Disabled")
1755
2335
                        return
1756
 
                    
 
2336
 
1757
2337
                    if client.approved or not client.approval_delay:
1758
 
                        #We are approved or approval is disabled
 
2338
                        # We are approved or approval is disabled
1759
2339
                        break
1760
2340
                    elif client.approved is None:
1761
2341
                        logger.info("Client %s needs approval",
1772
2352
                            # Emit D-Bus signal
1773
2353
                            client.Rejected("Denied")
1774
2354
                        return
1775
 
                    
1776
 
                    #wait until timeout or approved
 
2355
 
 
2356
                    # wait until timeout or approved
1777
2357
                    time = datetime.datetime.now()
1778
2358
                    client.changedstate.acquire()
1779
2359
                    client.changedstate.wait(delay.total_seconds())
1792
2372
                            break
1793
2373
                    else:
1794
2374
                        delay -= time2 - time
1795
 
                
1796
 
                sent_size = 0
1797
 
                while sent_size < len(client.secret):
1798
 
                    try:
1799
 
                        sent = session.send(client.secret[sent_size:])
1800
 
                    except gnutls.errors.GNUTLSError as error:
1801
 
                        logger.warning("gnutls send failed",
1802
 
                                       exc_info=error)
1803
 
                        return
1804
 
                    logger.debug("Sent: %d, remaining: %d",
1805
 
                                 sent, len(client.secret)
1806
 
                                 - (sent_size + sent))
1807
 
                    sent_size += sent
1808
 
                
 
2375
 
 
2376
                try:
 
2377
                    session.send(client.secret)
 
2378
                except gnutls.Error as error:
 
2379
                    logger.warning("gnutls send failed",
 
2380
                                   exc_info=error)
 
2381
                    return
 
2382
 
1809
2383
                logger.info("Sending secret to %s", client.name)
1810
2384
                # bump the timeout using extended_timeout
1811
2385
                client.bump_timeout(client.extended_timeout)
1812
2386
                if self.server.use_dbus:
1813
2387
                    # Emit D-Bus signal
1814
2388
                    client.GotSecret()
1815
 
            
 
2389
 
1816
2390
            finally:
1817
2391
                if approval_required:
1818
2392
                    client.approvals_pending -= 1
1819
2393
                try:
1820
2394
                    session.bye()
1821
 
                except gnutls.errors.GNUTLSError as error:
 
2395
                except gnutls.Error as error:
1822
2396
                    logger.warning("GnuTLS bye failed",
1823
2397
                                   exc_info=error)
1824
 
    
 
2398
 
1825
2399
    @staticmethod
1826
2400
    def peer_certificate(session):
1827
 
        "Return the peer's OpenPGP certificate as a bytestring"
1828
 
        # If not an OpenPGP certificate...
1829
 
        if (gnutls.library.functions
1830
 
            .gnutls_certificate_type_get(session._c_object)
1831
 
            != gnutls.library.constants.GNUTLS_CRT_OPENPGP):
1832
 
            # ...do the normal thing
1833
 
            return session.peer_certificate
 
2401
        "Return the peer's certificate as a bytestring"
 
2402
        try:
 
2403
            cert_type = gnutls.certificate_type_get2(session._c_object,
 
2404
                                                     gnutls.CTYPE_PEERS)
 
2405
        except AttributeError:
 
2406
            cert_type = gnutls.certificate_type_get(session._c_object)
 
2407
        if gnutls.has_rawpk:
 
2408
            valid_cert_types = frozenset((gnutls.CRT_RAWPK,))
 
2409
        else:
 
2410
            valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))
 
2411
        # If not a valid certificate type...
 
2412
        if cert_type not in valid_cert_types:
 
2413
            logger.info("Cert type %r not in %r", cert_type,
 
2414
                        valid_cert_types)
 
2415
            # ...return invalid data
 
2416
            return b""
1834
2417
        list_size = ctypes.c_uint(1)
1835
 
        cert_list = (gnutls.library.functions
1836
 
                     .gnutls_certificate_get_peers
 
2418
        cert_list = (gnutls.certificate_get_peers
1837
2419
                     (session._c_object, ctypes.byref(list_size)))
1838
2420
        if not bool(cert_list) and list_size.value != 0:
1839
 
            raise gnutls.errors.GNUTLSError("error getting peer"
1840
 
                                            " certificate")
 
2421
            raise gnutls.Error("error getting peer certificate")
1841
2422
        if list_size.value == 0:
1842
2423
            return None
1843
2424
        cert = cert_list[0]
1844
2425
        return ctypes.string_at(cert.data, cert.size)
1845
 
    
 
2426
 
 
2427
    @staticmethod
 
2428
    def key_id(certificate):
 
2429
        "Convert a certificate bytestring to a hexdigit key ID"
 
2430
        # New GnuTLS "datum" with the public key
 
2431
        datum = gnutls.datum_t(
 
2432
            ctypes.cast(ctypes.c_char_p(certificate),
 
2433
                        ctypes.POINTER(ctypes.c_ubyte)),
 
2434
            ctypes.c_uint(len(certificate)))
 
2435
        # XXX all these need to be created in the gnutls "module"
 
2436
        # New empty GnuTLS certificate
 
2437
        pubkey = gnutls.pubkey_t()
 
2438
        gnutls.pubkey_init(ctypes.byref(pubkey))
 
2439
        # Import the raw public key into the certificate
 
2440
        gnutls.pubkey_import(pubkey,
 
2441
                             ctypes.byref(datum),
 
2442
                             gnutls.X509_FMT_DER)
 
2443
        # New buffer for the key ID
 
2444
        buf = ctypes.create_string_buffer(32)
 
2445
        buf_len = ctypes.c_size_t(len(buf))
 
2446
        # Get the key ID from the raw public key into the buffer
 
2447
        gnutls.pubkey_get_key_id(pubkey,
 
2448
                                 gnutls.KEYID_USE_SHA256,
 
2449
                                 ctypes.cast(ctypes.byref(buf),
 
2450
                                             ctypes.POINTER(ctypes.c_ubyte)),
 
2451
                                 ctypes.byref(buf_len))
 
2452
        # Deinit the certificate
 
2453
        gnutls.pubkey_deinit(pubkey)
 
2454
 
 
2455
        # Convert the buffer to a Python bytestring
 
2456
        key_id = ctypes.string_at(buf, buf_len.value)
 
2457
        # Convert the bytestring to hexadecimal notation
 
2458
        hex_key_id = binascii.hexlify(key_id).upper()
 
2459
        return hex_key_id
 
2460
 
1846
2461
    @staticmethod
1847
2462
    def fingerprint(openpgp):
1848
2463
        "Convert an OpenPGP bytestring to a hexdigit fingerprint"
1849
2464
        # New GnuTLS "datum" with the OpenPGP public key
1850
 
        datum = (gnutls.library.types
1851
 
                 .gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
1852
 
                                             ctypes.POINTER
1853
 
                                             (ctypes.c_ubyte)),
1854
 
                                 ctypes.c_uint(len(openpgp))))
 
2465
        datum = gnutls.datum_t(
 
2466
            ctypes.cast(ctypes.c_char_p(openpgp),
 
2467
                        ctypes.POINTER(ctypes.c_ubyte)),
 
2468
            ctypes.c_uint(len(openpgp)))
1855
2469
        # New empty GnuTLS certificate
1856
 
        crt = gnutls.library.types.gnutls_openpgp_crt_t()
1857
 
        (gnutls.library.functions
1858
 
         .gnutls_openpgp_crt_init(ctypes.byref(crt)))
 
2470
        crt = gnutls.openpgp_crt_t()
 
2471
        gnutls.openpgp_crt_init(ctypes.byref(crt))
1859
2472
        # Import the OpenPGP public key into the certificate
1860
 
        (gnutls.library.functions
1861
 
         .gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
1862
 
                                    gnutls.library.constants
1863
 
                                    .GNUTLS_OPENPGP_FMT_RAW))
 
2473
        gnutls.openpgp_crt_import(crt, ctypes.byref(datum),
 
2474
                                  gnutls.OPENPGP_FMT_RAW)
1864
2475
        # Verify the self signature in the key
1865
2476
        crtverify = ctypes.c_uint()
1866
 
        (gnutls.library.functions
1867
 
         .gnutls_openpgp_crt_verify_self(crt, 0,
1868
 
                                         ctypes.byref(crtverify)))
 
2477
        gnutls.openpgp_crt_verify_self(crt, 0,
 
2478
                                       ctypes.byref(crtverify))
1869
2479
        if crtverify.value != 0:
1870
 
            gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1871
 
            raise (gnutls.errors.CertificateSecurityError
1872
 
                   ("Verify failed"))
 
2480
            gnutls.openpgp_crt_deinit(crt)
 
2481
            raise gnutls.CertificateSecurityError(code
 
2482
                                                  =crtverify.value)
1873
2483
        # New buffer for the fingerprint
1874
2484
        buf = ctypes.create_string_buffer(20)
1875
2485
        buf_len = ctypes.c_size_t()
1876
2486
        # Get the fingerprint from the certificate into the buffer
1877
 
        (gnutls.library.functions
1878
 
         .gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
1879
 
                                             ctypes.byref(buf_len)))
 
2487
        gnutls.openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
 
2488
                                           ctypes.byref(buf_len))
1880
2489
        # Deinit the certificate
1881
 
        gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
 
2490
        gnutls.openpgp_crt_deinit(crt)
1882
2491
        # Convert the buffer to a Python bytestring
1883
2492
        fpr = ctypes.string_at(buf, buf_len.value)
1884
2493
        # Convert the bytestring to hexadecimal notation
1886
2495
        return hex_fpr
1887
2496
 
1888
2497
 
1889
 
class MultiprocessingMixIn(object):
 
2498
class MultiprocessingMixIn:
1890
2499
    """Like socketserver.ThreadingMixIn, but with multiprocessing"""
 
2500
 
1891
2501
    def sub_process_main(self, request, address):
1892
2502
        try:
1893
2503
            self.finish_request(request, address)
1894
2504
        except Exception:
1895
2505
            self.handle_error(request, address)
1896
2506
        self.close_request(request)
1897
 
    
 
2507
 
1898
2508
    def process_request(self, request, address):
1899
2509
        """Start a new process to process the request."""
1900
 
        proc = multiprocessing.Process(target = self.sub_process_main,
1901
 
                                       args = (request, address))
 
2510
        proc = multiprocessing.Process(target=self.sub_process_main,
 
2511
                                       args=(request, address))
1902
2512
        proc.start()
1903
2513
        return proc
1904
2514
 
1905
2515
 
1906
 
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
 
2516
class MultiprocessingMixInWithPipe(MultiprocessingMixIn):
1907
2517
    """ adds a pipe to the MixIn """
 
2518
 
1908
2519
    def process_request(self, request, client_address):
1909
2520
        """Overrides and wraps the original process_request().
1910
 
        
 
2521
 
1911
2522
        This function creates a new pipe in self.pipe
1912
2523
        """
1913
2524
        parent_pipe, self.child_pipe = multiprocessing.Pipe()
1914
 
        
 
2525
 
1915
2526
        proc = MultiprocessingMixIn.process_request(self, request,
1916
2527
                                                    client_address)
1917
2528
        self.child_pipe.close()
1918
2529
        self.add_pipe(parent_pipe, proc)
1919
 
    
 
2530
 
1920
2531
    def add_pipe(self, parent_pipe, proc):
1921
2532
        """Dummy function; override as necessary"""
1922
2533
        raise NotImplementedError()
1923
2534
 
1924
2535
 
1925
2536
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
1926
 
                     socketserver.TCPServer, object):
 
2537
                     socketserver.TCPServer):
1927
2538
    """IPv6-capable TCP server.  Accepts 'None' as address and/or port
1928
 
    
 
2539
 
1929
2540
    Attributes:
1930
2541
        enabled:        Boolean; whether this server is activated yet
1931
2542
        interface:      None or a network interface name (string)
1932
2543
        use_ipv6:       Boolean; to use IPv6 or not
1933
2544
    """
 
2545
 
1934
2546
    def __init__(self, server_address, RequestHandlerClass,
1935
 
                 interface=None, use_ipv6=True, socketfd=None):
 
2547
                 interface=None,
 
2548
                 use_ipv6=True,
 
2549
                 socketfd=None):
1936
2550
        """If socketfd is set, use that file descriptor instead of
1937
2551
        creating a new one with socket.socket().
1938
2552
        """
1944
2558
            self.socketfd = socketfd
1945
2559
            # Save the original socket.socket() function
1946
2560
            self.socket_socket = socket.socket
 
2561
 
1947
2562
            # To implement --socket, we monkey patch socket.socket.
1948
 
            # 
 
2563
            #
1949
2564
            # (When socketserver.TCPServer is a new-style class, we
1950
2565
            # could make self.socket into a property instead of monkey
1951
2566
            # patching socket.socket.)
1952
 
            # 
 
2567
            #
1953
2568
            # Create a one-time-only replacement for socket.socket()
1954
2569
            @functools.wraps(socket.socket)
1955
2570
            def socket_wrapper(*args, **kwargs):
1967
2582
        # socket_wrapper(), if socketfd was set.
1968
2583
        socketserver.TCPServer.__init__(self, server_address,
1969
2584
                                        RequestHandlerClass)
1970
 
    
 
2585
 
1971
2586
    def server_bind(self):
1972
2587
        """This overrides the normal server_bind() function
1973
2588
        to bind to an interface if one was specified, and also NOT to
1974
2589
        bind to an address or port if they were not specified."""
 
2590
        global SO_BINDTODEVICE
1975
2591
        if self.interface is not None:
1976
2592
            if SO_BINDTODEVICE is None:
1977
 
                logger.error("SO_BINDTODEVICE does not exist;"
1978
 
                             " cannot bind to interface %s",
1979
 
                             self.interface)
1980
 
            else:
1981
 
                try:
1982
 
                    self.socket.setsockopt(socket.SOL_SOCKET,
1983
 
                                           SO_BINDTODEVICE,
1984
 
                                           (self.interface + "\0")
1985
 
                                           .encode("utf-8"))
1986
 
                except socket.error as error:
1987
 
                    if error.errno == errno.EPERM:
1988
 
                        logger.error("No permission to bind to"
1989
 
                                     " interface %s", self.interface)
1990
 
                    elif error.errno == errno.ENOPROTOOPT:
1991
 
                        logger.error("SO_BINDTODEVICE not available;"
1992
 
                                     " cannot bind to interface %s",
1993
 
                                     self.interface)
1994
 
                    elif error.errno == errno.ENODEV:
1995
 
                        logger.error("Interface %s does not exist,"
1996
 
                                     " cannot bind", self.interface)
1997
 
                    else:
1998
 
                        raise
 
2593
                # Fall back to a hard-coded value which seems to be
 
2594
                # common enough.
 
2595
                logger.warning("SO_BINDTODEVICE not found, trying 25")
 
2596
                SO_BINDTODEVICE = 25
 
2597
            try:
 
2598
                self.socket.setsockopt(
 
2599
                    socket.SOL_SOCKET, SO_BINDTODEVICE,
 
2600
                    (self.interface + "\0").encode("utf-8"))
 
2601
            except socket.error as error:
 
2602
                if error.errno == errno.EPERM:
 
2603
                    logger.error("No permission to bind to"
 
2604
                                 " interface %s", self.interface)
 
2605
                elif error.errno == errno.ENOPROTOOPT:
 
2606
                    logger.error("SO_BINDTODEVICE not available;"
 
2607
                                 " cannot bind to interface %s",
 
2608
                                 self.interface)
 
2609
                elif error.errno == errno.ENODEV:
 
2610
                    logger.error("Interface %s does not exist,"
 
2611
                                 " cannot bind", self.interface)
 
2612
                else:
 
2613
                    raise
1999
2614
        # Only bind(2) the socket if we really need to.
2000
2615
        if self.server_address[0] or self.server_address[1]:
 
2616
            if self.server_address[1]:
 
2617
                self.allow_reuse_address = True
2001
2618
            if not self.server_address[0]:
2002
2619
                if self.address_family == socket.AF_INET6:
2003
 
                    any_address = "::" # in6addr_any
 
2620
                    any_address = "::"  # in6addr_any
2004
2621
                else:
2005
 
                    any_address = "0.0.0.0" # INADDR_ANY
 
2622
                    any_address = "0.0.0.0"  # INADDR_ANY
2006
2623
                self.server_address = (any_address,
2007
2624
                                       self.server_address[1])
2008
2625
            elif not self.server_address[1]:
2009
 
                self.server_address = (self.server_address[0],
2010
 
                                       0)
 
2626
                self.server_address = (self.server_address[0], 0)
2011
2627
#                 if self.interface:
2012
2628
#                     self.server_address = (self.server_address[0],
2013
2629
#                                            0, # port
2019
2635
 
2020
2636
class MandosServer(IPv6_TCPServer):
2021
2637
    """Mandos server.
2022
 
    
 
2638
 
2023
2639
    Attributes:
2024
2640
        clients:        set of Client objects
2025
2641
        gnutls_priority GnuTLS priority string
2026
2642
        use_dbus:       Boolean; to emit D-Bus signals or not
2027
 
    
2028
 
    Assumes a gobject.MainLoop event loop.
 
2643
 
 
2644
    Assumes a GLib.MainLoop event loop.
2029
2645
    """
 
2646
 
2030
2647
    def __init__(self, server_address, RequestHandlerClass,
2031
 
                 interface=None, use_ipv6=True, clients=None,
2032
 
                 gnutls_priority=None, use_dbus=True, socketfd=None):
 
2648
                 interface=None,
 
2649
                 use_ipv6=True,
 
2650
                 clients=None,
 
2651
                 gnutls_priority=None,
 
2652
                 use_dbus=True,
 
2653
                 socketfd=None):
2033
2654
        self.enabled = False
2034
2655
        self.clients = clients
2035
2656
        if self.clients is None:
2038
2659
        self.gnutls_priority = gnutls_priority
2039
2660
        IPv6_TCPServer.__init__(self, server_address,
2040
2661
                                RequestHandlerClass,
2041
 
                                interface = interface,
2042
 
                                use_ipv6 = use_ipv6,
2043
 
                                socketfd = socketfd)
 
2662
                                interface=interface,
 
2663
                                use_ipv6=use_ipv6,
 
2664
                                socketfd=socketfd)
 
2665
 
2044
2666
    def server_activate(self):
2045
2667
        if self.enabled:
2046
2668
            return socketserver.TCPServer.server_activate(self)
2047
 
    
 
2669
 
2048
2670
    def enable(self):
2049
2671
        self.enabled = True
2050
 
    
 
2672
 
2051
2673
    def add_pipe(self, parent_pipe, proc):
2052
2674
        # Call "handle_ipc" for both data and EOF events
2053
 
        gobject.io_add_watch(parent_pipe.fileno(),
2054
 
                             gobject.IO_IN | gobject.IO_HUP,
2055
 
                             functools.partial(self.handle_ipc,
2056
 
                                               parent_pipe =
2057
 
                                               parent_pipe,
2058
 
                                               proc = proc))
2059
 
    
2060
 
    def handle_ipc(self, source, condition, parent_pipe=None,
2061
 
                   proc = None, client_object=None):
 
2675
        GLib.io_add_watch(
 
2676
            parent_pipe.fileno(),
 
2677
            GLib.IO_IN | GLib.IO_HUP,
 
2678
            functools.partial(self.handle_ipc,
 
2679
                              parent_pipe=parent_pipe,
 
2680
                              proc=proc))
 
2681
 
 
2682
    def handle_ipc(self, source, condition,
 
2683
                   parent_pipe=None,
 
2684
                   proc=None,
 
2685
                   client_object=None):
2062
2686
        # error, or the other end of multiprocessing.Pipe has closed
2063
 
        if condition & (gobject.IO_ERR | gobject.IO_HUP):
 
2687
        if condition & (GLib.IO_ERR | GLib.IO_HUP):
2064
2688
            # Wait for other process to exit
2065
2689
            proc.join()
2066
2690
            return False
2067
 
        
 
2691
 
2068
2692
        # Read a request from the child
2069
2693
        request = parent_pipe.recv()
2070
2694
        command = request[0]
2071
 
        
 
2695
 
2072
2696
        if command == 'init':
2073
 
            fpr = request[1]
2074
 
            address = request[2]
2075
 
            
2076
 
            for c in self.clients.itervalues():
2077
 
                if c.fingerprint == fpr:
 
2697
            key_id = request[1].decode("ascii")
 
2698
            fpr = request[2].decode("ascii")
 
2699
            address = request[3]
 
2700
 
 
2701
            for c in self.clients.values():
 
2702
                if key_id == "E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855":
 
2703
                    continue
 
2704
                if key_id and c.key_id == key_id:
 
2705
                    client = c
 
2706
                    break
 
2707
                if fpr and c.fingerprint == fpr:
2078
2708
                    client = c
2079
2709
                    break
2080
2710
            else:
2081
 
                logger.info("Client not found for fingerprint: %s, ad"
2082
 
                            "dress: %s", fpr, address)
 
2711
                logger.info("Client not found for key ID: %s, address"
 
2712
                            ": %s", key_id or fpr, address)
2083
2713
                if self.use_dbus:
2084
2714
                    # Emit D-Bus signal
2085
 
                    mandos_dbus_service.ClientNotFound(fpr,
 
2715
                    mandos_dbus_service.ClientNotFound(key_id or fpr,
2086
2716
                                                       address[0])
2087
2717
                parent_pipe.send(False)
2088
2718
                return False
2089
 
            
2090
 
            gobject.io_add_watch(parent_pipe.fileno(),
2091
 
                                 gobject.IO_IN | gobject.IO_HUP,
2092
 
                                 functools.partial(self.handle_ipc,
2093
 
                                                   parent_pipe =
2094
 
                                                   parent_pipe,
2095
 
                                                   proc = proc,
2096
 
                                                   client_object =
2097
 
                                                   client))
 
2719
 
 
2720
            GLib.io_add_watch(
 
2721
                parent_pipe.fileno(),
 
2722
                GLib.IO_IN | GLib.IO_HUP,
 
2723
                functools.partial(self.handle_ipc,
 
2724
                                  parent_pipe=parent_pipe,
 
2725
                                  proc=proc,
 
2726
                                  client_object=client))
2098
2727
            parent_pipe.send(True)
2099
2728
            # remove the old hook in favor of the new above hook on
2100
2729
            # same fileno
2103
2732
            funcname = request[1]
2104
2733
            args = request[2]
2105
2734
            kwargs = request[3]
2106
 
            
 
2735
 
2107
2736
            parent_pipe.send(('data', getattr(client_object,
2108
2737
                                              funcname)(*args,
2109
 
                                                         **kwargs)))
2110
 
        
 
2738
                                                        **kwargs)))
 
2739
 
2111
2740
        if command == 'getattr':
2112
2741
            attrname = request[1]
2113
 
            if callable(client_object.__getattribute__(attrname)):
2114
 
                parent_pipe.send(('function',))
 
2742
            if isinstance(client_object.__getattribute__(attrname),
 
2743
                          collections.Callable):
 
2744
                parent_pipe.send(('function', ))
2115
2745
            else:
2116
 
                parent_pipe.send(('data', client_object
2117
 
                                  .__getattribute__(attrname)))
2118
 
        
 
2746
                parent_pipe.send((
 
2747
                    'data', client_object.__getattribute__(attrname)))
 
2748
 
2119
2749
        if command == 'setattr':
2120
2750
            attrname = request[1]
2121
2751
            value = request[2]
2122
2752
            setattr(client_object, attrname, value)
2123
 
        
 
2753
 
2124
2754
        return True
2125
2755
 
2126
2756
 
2127
2757
def rfc3339_duration_to_delta(duration):
2128
2758
    """Parse an RFC 3339 "duration" and return a datetime.timedelta
2129
 
    
 
2759
 
2130
2760
    >>> rfc3339_duration_to_delta("P7D")
2131
2761
    datetime.timedelta(7)
2132
2762
    >>> rfc3339_duration_to_delta("PT60S")
2142
2772
    >>> rfc3339_duration_to_delta("P1DT3M20S")
2143
2773
    datetime.timedelta(1, 200)
2144
2774
    """
2145
 
    
 
2775
 
2146
2776
    # Parsing an RFC 3339 duration with regular expressions is not
2147
2777
    # possible - there would have to be multiple places for the same
2148
2778
    # values, like seconds.  The current code, while more esoteric, is
2149
2779
    # cleaner without depending on a parsing library.  If Python had a
2150
2780
    # built-in library for parsing we would use it, but we'd like to
2151
2781
    # avoid excessive use of external libraries.
2152
 
    
 
2782
 
2153
2783
    # New type for defining tokens, syntax, and semantics all-in-one
2154
 
    Token = collections.namedtuple("Token",
2155
 
                                   ("regexp", # To match token; if
2156
 
                                              # "value" is not None,
2157
 
                                              # must have a "group"
2158
 
                                              # containing digits
2159
 
                                    "value",  # datetime.timedelta or
2160
 
                                              # None
2161
 
                                    "followers")) # Tokens valid after
2162
 
                                                  # this token
 
2784
    Token = collections.namedtuple("Token", (
 
2785
        "regexp",  # To match token; if "value" is not None, must have
 
2786
                   # a "group" containing digits
 
2787
        "value",   # datetime.timedelta or None
 
2788
        "followers"))           # Tokens valid after this token
2163
2789
    # RFC 3339 "duration" tokens, syntax, and semantics; taken from
2164
2790
    # the "duration" ABNF definition in RFC 3339, Appendix A.
2165
2791
    token_end = Token(re.compile(r"$"), None, frozenset())
2166
2792
    token_second = Token(re.compile(r"(\d+)S"),
2167
2793
                         datetime.timedelta(seconds=1),
2168
 
                         frozenset((token_end,)))
 
2794
                         frozenset((token_end, )))
2169
2795
    token_minute = Token(re.compile(r"(\d+)M"),
2170
2796
                         datetime.timedelta(minutes=1),
2171
2797
                         frozenset((token_second, token_end)))
2187
2813
                       frozenset((token_month, token_end)))
2188
2814
    token_week = Token(re.compile(r"(\d+)W"),
2189
2815
                       datetime.timedelta(weeks=1),
2190
 
                       frozenset((token_end,)))
 
2816
                       frozenset((token_end, )))
2191
2817
    token_duration = Token(re.compile(r"P"), None,
2192
2818
                           frozenset((token_year, token_month,
2193
2819
                                      token_day, token_time,
2194
2820
                                      token_week)))
2195
 
    # Define starting values
2196
 
    value = datetime.timedelta() # Value so far
 
2821
    # Define starting values:
 
2822
    # Value so far
 
2823
    value = datetime.timedelta()
2197
2824
    found_token = None
2198
 
    followers = frozenset((token_duration,)) # Following valid tokens
2199
 
    s = duration                # String left to parse
 
2825
    # Following valid tokens
 
2826
    followers = frozenset((token_duration, ))
 
2827
    # String left to parse
 
2828
    s = duration
2200
2829
    # Loop until end token is found
2201
2830
    while found_token is not token_end:
2202
2831
        # Search for any currently valid tokens
2218
2847
                break
2219
2848
        else:
2220
2849
            # No currently valid tokens were found
2221
 
            raise ValueError("Invalid RFC 3339 duration")
 
2850
            raise ValueError("Invalid RFC 3339 duration: {!r}"
 
2851
                             .format(duration))
2222
2852
    # End token found
2223
2853
    return value
2224
2854
 
2225
2855
 
2226
2856
def string_to_delta(interval):
2227
2857
    """Parse a string and return a datetime.timedelta
2228
 
    
 
2858
 
2229
2859
    >>> string_to_delta('7d')
2230
2860
    datetime.timedelta(7)
2231
2861
    >>> string_to_delta('60s')
2239
2869
    >>> string_to_delta('5m 30s')
2240
2870
    datetime.timedelta(0, 330)
2241
2871
    """
2242
 
    
 
2872
 
2243
2873
    try:
2244
2874
        return rfc3339_duration_to_delta(interval)
2245
2875
    except ValueError:
2246
2876
        pass
2247
 
    
 
2877
 
2248
2878
    timevalue = datetime.timedelta(0)
2249
2879
    for s in interval.split():
2250
2880
        try:
2261
2891
            elif suffix == "w":
2262
2892
                delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
2263
2893
            else:
2264
 
                raise ValueError("Unknown suffix {!r}"
2265
 
                                 .format(suffix))
 
2894
                raise ValueError("Unknown suffix {!r}".format(suffix))
2266
2895
        except IndexError as e:
2267
2896
            raise ValueError(*(e.args))
2268
2897
        timevalue += delta
2269
2898
    return timevalue
2270
2899
 
2271
2900
 
2272
 
def daemon(nochdir = False, noclose = False):
 
2901
def daemon(nochdir=False, noclose=False):
2273
2902
    """See daemon(3).  Standard BSD Unix function.
2274
 
    
 
2903
 
2275
2904
    This should really exist as os.daemon, but it doesn't (yet)."""
2276
2905
    if os.fork():
2277
2906
        sys.exit()
2284
2913
        # Close all standard open file descriptors
2285
2914
        null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2286
2915
        if not stat.S_ISCHR(os.fstat(null).st_mode):
2287
 
            raise OSError(errno.ENODEV, "{} not a character device"
 
2916
            raise OSError(errno.ENODEV,
 
2917
                          "{} not a character device"
2288
2918
                          .format(os.devnull))
2289
2919
        os.dup2(null, sys.stdin.fileno())
2290
2920
        os.dup2(null, sys.stdout.fileno())
2294
2924
 
2295
2925
 
2296
2926
def main():
2297
 
    
 
2927
 
2298
2928
    ##################################################################
2299
2929
    # Parsing of options, both command line and config file
2300
 
    
 
2930
 
2301
2931
    parser = argparse.ArgumentParser()
2302
2932
    parser.add_argument("-v", "--version", action="version",
2303
 
                        version = "%(prog)s {}".format(version),
 
2933
                        version="%(prog)s {}".format(version),
2304
2934
                        help="show version number and exit")
2305
2935
    parser.add_argument("-i", "--interface", metavar="IF",
2306
2936
                        help="Bind to interface IF")
2342
2972
    parser.add_argument("--no-zeroconf", action="store_false",
2343
2973
                        dest="zeroconf", help="Do not use Zeroconf",
2344
2974
                        default=None)
2345
 
    
 
2975
 
2346
2976
    options = parser.parse_args()
2347
 
    
 
2977
 
2348
2978
    if options.check:
2349
2979
        import doctest
2350
2980
        fail_count, test_count = doctest.testmod()
2351
2981
        sys.exit(os.EX_OK if fail_count == 0 else 1)
2352
 
    
 
2982
 
2353
2983
    # Default values for config file for server-global settings
2354
 
    server_defaults = { "interface": "",
2355
 
                        "address": "",
2356
 
                        "port": "",
2357
 
                        "debug": "False",
2358
 
                        "priority":
2359
 
                        "SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",
2360
 
                        "servicename": "Mandos",
2361
 
                        "use_dbus": "True",
2362
 
                        "use_ipv6": "True",
2363
 
                        "debuglevel": "",
2364
 
                        "restore": "True",
2365
 
                        "socket": "",
2366
 
                        "statedir": "/var/lib/mandos",
2367
 
                        "foreground": "False",
2368
 
                        "zeroconf": "True",
2369
 
                        }
2370
 
    
 
2984
    if gnutls.has_rawpk:
 
2985
        priority = ("SECURE128:!CTYPE-X.509:+CTYPE-RAWPK:!RSA"
 
2986
                    ":!VERS-ALL:+VERS-TLS1.3:%PROFILE_ULTRA")
 
2987
    else:
 
2988
        priority = ("SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
 
2989
                    ":+SIGN-DSA-SHA256")
 
2990
    server_defaults = {"interface": "",
 
2991
                       "address": "",
 
2992
                       "port": "",
 
2993
                       "debug": "False",
 
2994
                       "priority": priority,
 
2995
                       "servicename": "Mandos",
 
2996
                       "use_dbus": "True",
 
2997
                       "use_ipv6": "True",
 
2998
                       "debuglevel": "",
 
2999
                       "restore": "True",
 
3000
                       "socket": "",
 
3001
                       "statedir": "/var/lib/mandos",
 
3002
                       "foreground": "False",
 
3003
                       "zeroconf": "True",
 
3004
                       }
 
3005
    del priority
 
3006
 
2371
3007
    # Parse config file for server-global settings
2372
 
    server_config = configparser.SafeConfigParser(server_defaults)
 
3008
    server_config = configparser.ConfigParser(server_defaults)
2373
3009
    del server_defaults
2374
 
    server_config.read(os.path.join(options.configdir,
2375
 
                                    "mandos.conf"))
2376
 
    # Convert the SafeConfigParser object to a dict
 
3010
    server_config.read(os.path.join(options.configdir, "mandos.conf"))
 
3011
    # Convert the ConfigParser object to a dict
2377
3012
    server_settings = server_config.defaults()
2378
3013
    # Use the appropriate methods on the non-string config options
2379
 
    for option in ("debug", "use_dbus", "use_ipv6", "foreground"):
 
3014
    for option in ("debug", "use_dbus", "use_ipv6", "restore",
 
3015
                   "foreground", "zeroconf"):
2380
3016
        server_settings[option] = server_config.getboolean("DEFAULT",
2381
3017
                                                           option)
2382
3018
    if server_settings["port"]:
2392
3028
            server_settings["socket"] = os.dup(server_settings
2393
3029
                                               ["socket"])
2394
3030
    del server_config
2395
 
    
 
3031
 
2396
3032
    # Override the settings from the config file with command line
2397
3033
    # options, if set.
2398
3034
    for option in ("interface", "address", "port", "debug",
2399
 
                   "priority", "servicename", "configdir",
2400
 
                   "use_dbus", "use_ipv6", "debuglevel", "restore",
2401
 
                   "statedir", "socket", "foreground", "zeroconf"):
 
3035
                   "priority", "servicename", "configdir", "use_dbus",
 
3036
                   "use_ipv6", "debuglevel", "restore", "statedir",
 
3037
                   "socket", "foreground", "zeroconf"):
2402
3038
        value = getattr(options, option)
2403
3039
        if value is not None:
2404
3040
            server_settings[option] = value
2416
3052
    if server_settings["debug"]:
2417
3053
        server_settings["foreground"] = True
2418
3054
    # Now we have our good server settings in "server_settings"
2419
 
    
 
3055
 
2420
3056
    ##################################################################
2421
 
    
2422
 
    if (not server_settings["zeroconf"] and
2423
 
        not (server_settings["port"]
2424
 
             or server_settings["socket"] != "")):
2425
 
            parser.error("Needs port or socket to work without"
2426
 
                         " Zeroconf")
2427
 
    
 
3057
 
 
3058
    if (not server_settings["zeroconf"]
 
3059
        and not (server_settings["port"]
 
3060
                 or server_settings["socket"] != "")):
 
3061
        parser.error("Needs port or socket to work without Zeroconf")
 
3062
 
2428
3063
    # For convenience
2429
3064
    debug = server_settings["debug"]
2430
3065
    debuglevel = server_settings["debuglevel"]
2434
3069
                                     stored_state_file)
2435
3070
    foreground = server_settings["foreground"]
2436
3071
    zeroconf = server_settings["zeroconf"]
2437
 
    
 
3072
 
2438
3073
    if debug:
2439
3074
        initlogger(debug, logging.DEBUG)
2440
3075
    else:
2443
3078
        else:
2444
3079
            level = getattr(logging, debuglevel.upper())
2445
3080
            initlogger(debug, level)
2446
 
    
 
3081
 
2447
3082
    if server_settings["servicename"] != "Mandos":
2448
 
        syslogger.setFormatter(logging.Formatter
2449
 
                               ('Mandos ({}) [%(process)d]:'
2450
 
                                ' %(levelname)s: %(message)s'
2451
 
                                .format(server_settings
2452
 
                                        ["servicename"])))
2453
 
    
 
3083
        syslogger.setFormatter(
 
3084
            logging.Formatter('Mandos ({}) [%(process)d]:'
 
3085
                              ' %(levelname)s: %(message)s'.format(
 
3086
                                  server_settings["servicename"])))
 
3087
 
2454
3088
    # Parse config file with clients
2455
 
    client_config = configparser.SafeConfigParser(Client
2456
 
                                                  .client_defaults)
 
3089
    client_config = configparser.ConfigParser(Client.client_defaults)
2457
3090
    client_config.read(os.path.join(server_settings["configdir"],
2458
3091
                                    "clients.conf"))
2459
 
    
 
3092
 
2460
3093
    global mandos_dbus_service
2461
3094
    mandos_dbus_service = None
2462
 
    
 
3095
 
2463
3096
    socketfd = None
2464
3097
    if server_settings["socket"] != "":
2465
3098
        socketfd = server_settings["socket"]
2466
 
    tcp_server = MandosServer((server_settings["address"],
2467
 
                               server_settings["port"]),
2468
 
                              ClientHandler,
2469
 
                              interface=(server_settings["interface"]
2470
 
                                         or None),
2471
 
                              use_ipv6=use_ipv6,
2472
 
                              gnutls_priority=
2473
 
                              server_settings["priority"],
2474
 
                              use_dbus=use_dbus,
2475
 
                              socketfd=socketfd)
 
3099
    tcp_server = MandosServer(
 
3100
        (server_settings["address"], server_settings["port"]),
 
3101
        ClientHandler,
 
3102
        interface=(server_settings["interface"] or None),
 
3103
        use_ipv6=use_ipv6,
 
3104
        gnutls_priority=server_settings["priority"],
 
3105
        use_dbus=use_dbus,
 
3106
        socketfd=socketfd)
2476
3107
    if not foreground:
2477
3108
        pidfilename = "/run/mandos.pid"
2478
3109
        if not os.path.isdir("/run/."):
2479
3110
            pidfilename = "/var/run/mandos.pid"
2480
3111
        pidfile = None
2481
3112
        try:
2482
 
            pidfile = open(pidfilename, "w")
 
3113
            pidfile = codecs.open(pidfilename, "w", encoding="utf-8")
2483
3114
        except IOError as e:
2484
3115
            logger.error("Could not open file %r", pidfilename,
2485
3116
                         exc_info=e)
2486
 
    
2487
 
    for name in ("_mandos", "mandos", "nobody"):
 
3117
 
 
3118
    for name, group in (("_mandos", "_mandos"),
 
3119
                        ("mandos", "mandos"),
 
3120
                        ("nobody", "nogroup")):
2488
3121
        try:
2489
3122
            uid = pwd.getpwnam(name).pw_uid
2490
 
            gid = pwd.getpwnam(name).pw_gid
 
3123
            gid = pwd.getpwnam(group).pw_gid
2491
3124
            break
2492
3125
        except KeyError:
2493
3126
            continue
2497
3130
    try:
2498
3131
        os.setgid(gid)
2499
3132
        os.setuid(uid)
 
3133
        if debug:
 
3134
            logger.debug("Did setuid/setgid to {}:{}".format(uid,
 
3135
                                                             gid))
2500
3136
    except OSError as error:
 
3137
        logger.warning("Failed to setuid/setgid to {}:{}: {}"
 
3138
                       .format(uid, gid, os.strerror(error.errno)))
2501
3139
        if error.errno != errno.EPERM:
2502
3140
            raise
2503
 
    
 
3141
 
2504
3142
    if debug:
2505
3143
        # Enable all possible GnuTLS debugging
2506
 
        
 
3144
 
2507
3145
        # "Use a log level over 10 to enable all debugging options."
2508
3146
        # - GnuTLS manual
2509
 
        gnutls.library.functions.gnutls_global_set_log_level(11)
2510
 
        
2511
 
        @gnutls.library.types.gnutls_log_func
 
3147
        gnutls.global_set_log_level(11)
 
3148
 
 
3149
        @gnutls.log_func
2512
3150
        def debug_gnutls(level, string):
2513
3151
            logger.debug("GnuTLS: %s", string[:-1])
2514
 
        
2515
 
        (gnutls.library.functions
2516
 
         .gnutls_global_set_log_function(debug_gnutls))
2517
 
        
 
3152
 
 
3153
        gnutls.global_set_log_function(debug_gnutls)
 
3154
 
2518
3155
        # Redirect stdin so all checkers get /dev/null
2519
3156
        null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2520
3157
        os.dup2(null, sys.stdin.fileno())
2521
3158
        if null > 2:
2522
3159
            os.close(null)
2523
 
    
 
3160
 
2524
3161
    # Need to fork before connecting to D-Bus
2525
3162
    if not foreground:
2526
3163
        # Close all input and output, do double fork, etc.
2527
3164
        daemon()
2528
 
    
2529
 
    # multiprocessing will use threads, so before we use gobject we
2530
 
    # need to inform gobject that threads will be used.
2531
 
    gobject.threads_init()
2532
 
    
 
3165
 
 
3166
    if gi.version_info < (3, 10, 2):
 
3167
        # multiprocessing will use threads, so before we use GLib we
 
3168
        # need to inform GLib that threads will be used.
 
3169
        GLib.threads_init()
 
3170
 
2533
3171
    global main_loop
2534
3172
    # From the Avahi example code
2535
3173
    DBusGMainLoop(set_as_default=True)
2536
 
    main_loop = gobject.MainLoop()
 
3174
    main_loop = GLib.MainLoop()
2537
3175
    bus = dbus.SystemBus()
2538
3176
    # End of Avahi example code
2539
3177
    if use_dbus:
2540
3178
        try:
2541
3179
            bus_name = dbus.service.BusName("se.recompile.Mandos",
2542
 
                                            bus, do_not_queue=True)
2543
 
            old_bus_name = (dbus.service.BusName
2544
 
                            ("se.bsnet.fukt.Mandos", bus,
2545
 
                             do_not_queue=True))
2546
 
        except dbus.exceptions.NameExistsException as e:
 
3180
                                            bus,
 
3181
                                            do_not_queue=True)
 
3182
            old_bus_name = dbus.service.BusName(
 
3183
                "se.bsnet.fukt.Mandos", bus,
 
3184
                do_not_queue=True)
 
3185
        except dbus.exceptions.DBusException as e:
2547
3186
            logger.error("Disabling D-Bus:", exc_info=e)
2548
3187
            use_dbus = False
2549
3188
            server_settings["use_dbus"] = False
2550
3189
            tcp_server.use_dbus = False
2551
3190
    if zeroconf:
2552
3191
        protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2553
 
        service = AvahiServiceToSyslog(name =
2554
 
                                       server_settings["servicename"],
2555
 
                                       servicetype = "_mandos._tcp",
2556
 
                                       protocol = protocol, bus = bus)
 
3192
        service = AvahiServiceToSyslog(
 
3193
            name=server_settings["servicename"],
 
3194
            servicetype="_mandos._tcp",
 
3195
            protocol=protocol,
 
3196
            bus=bus)
2557
3197
        if server_settings["interface"]:
2558
 
            service.interface = (if_nametoindex
2559
 
                                 (server_settings["interface"]
2560
 
                                  .encode("utf-8")))
2561
 
    
 
3198
            service.interface = if_nametoindex(
 
3199
                server_settings["interface"].encode("utf-8"))
 
3200
 
2562
3201
    global multiprocessing_manager
2563
3202
    multiprocessing_manager = multiprocessing.Manager()
2564
 
    
 
3203
 
2565
3204
    client_class = Client
2566
3205
    if use_dbus:
2567
 
        client_class = functools.partial(ClientDBus, bus = bus)
2568
 
    
 
3206
        client_class = functools.partial(ClientDBus, bus=bus)
 
3207
 
2569
3208
    client_settings = Client.config_parser(client_config)
2570
3209
    old_client_settings = {}
2571
3210
    clients_data = {}
2572
 
    
 
3211
 
2573
3212
    # This is used to redirect stdout and stderr for checker processes
2574
3213
    global wnull
2575
 
    wnull = open(os.devnull, "w") # A writable /dev/null
 
3214
    wnull = open(os.devnull, "w")  # A writable /dev/null
2576
3215
    # Only used if server is running in foreground but not in debug
2577
3216
    # mode
2578
3217
    if debug or not foreground:
2579
3218
        wnull.close()
2580
 
    
 
3219
 
2581
3220
    # Get client data and settings from last running state.
2582
3221
    if server_settings["restore"]:
2583
3222
        try:
2584
3223
            with open(stored_state_path, "rb") as stored_state:
2585
 
                clients_data, old_client_settings = (pickle.load
2586
 
                                                     (stored_state))
 
3224
                if sys.version_info.major == 2:
 
3225
                    clients_data, old_client_settings = pickle.load(
 
3226
                        stored_state)
 
3227
                else:
 
3228
                    bytes_clients_data, bytes_old_client_settings = (
 
3229
                        pickle.load(stored_state, encoding="bytes"))
 
3230
                    #   Fix bytes to strings
 
3231
                    #  clients_data
 
3232
                    # .keys()
 
3233
                    clients_data = {(key.decode("utf-8")
 
3234
                                     if isinstance(key, bytes)
 
3235
                                     else key): value
 
3236
                                    for key, value in
 
3237
                                    bytes_clients_data.items()}
 
3238
                    del bytes_clients_data
 
3239
                    for key in clients_data:
 
3240
                        value = {(k.decode("utf-8")
 
3241
                                  if isinstance(k, bytes) else k): v
 
3242
                                 for k, v in
 
3243
                                 clients_data[key].items()}
 
3244
                        clients_data[key] = value
 
3245
                        # .client_structure
 
3246
                        value["client_structure"] = [
 
3247
                            (s.decode("utf-8")
 
3248
                             if isinstance(s, bytes)
 
3249
                             else s) for s in
 
3250
                            value["client_structure"]]
 
3251
                        # .name & .host
 
3252
                        for k in ("name", "host"):
 
3253
                            if isinstance(value[k], bytes):
 
3254
                                value[k] = value[k].decode("utf-8")
 
3255
                        if "key_id" not in value:
 
3256
                            value["key_id"] = ""
 
3257
                        elif "fingerprint" not in value:
 
3258
                            value["fingerprint"] = ""
 
3259
                    #  old_client_settings
 
3260
                    # .keys()
 
3261
                    old_client_settings = {
 
3262
                        (key.decode("utf-8")
 
3263
                         if isinstance(key, bytes)
 
3264
                         else key): value
 
3265
                        for key, value in
 
3266
                        bytes_old_client_settings.items()}
 
3267
                    del bytes_old_client_settings
 
3268
                    # .host
 
3269
                    for value in old_client_settings.values():
 
3270
                        if isinstance(value["host"], bytes):
 
3271
                            value["host"] = (value["host"]
 
3272
                                             .decode("utf-8"))
2587
3273
            os.remove(stored_state_path)
2588
3274
        except IOError as e:
2589
3275
            if e.errno == errno.ENOENT:
2590
 
                logger.warning("Could not load persistent state: {}"
2591
 
                                .format(os.strerror(e.errno)))
 
3276
                logger.warning("Could not load persistent state:"
 
3277
                               " {}".format(os.strerror(e.errno)))
2592
3278
            else:
2593
3279
                logger.critical("Could not load persistent state:",
2594
3280
                                exc_info=e)
2595
3281
                raise
2596
3282
        except EOFError as e:
2597
3283
            logger.warning("Could not load persistent state: "
2598
 
                           "EOFError:", exc_info=e)
2599
 
    
 
3284
                           "EOFError:",
 
3285
                           exc_info=e)
 
3286
 
2600
3287
    with PGPEngine() as pgp:
2601
3288
        for client_name, client in clients_data.items():
2602
3289
            # Skip removed clients
2603
3290
            if client_name not in client_settings:
2604
3291
                continue
2605
 
            
 
3292
 
2606
3293
            # Decide which value to use after restoring saved state.
2607
3294
            # We have three different values: Old config file,
2608
3295
            # new config file, and saved state.
2613
3300
                    # For each value in new config, check if it
2614
3301
                    # differs from the old config value (Except for
2615
3302
                    # the "secret" attribute)
2616
 
                    if (name != "secret" and
2617
 
                        value != old_client_settings[client_name]
2618
 
                        [name]):
 
3303
                    if (name != "secret"
 
3304
                        and (value !=
 
3305
                             old_client_settings[client_name][name])):
2619
3306
                        client[name] = value
2620
3307
                except KeyError:
2621
3308
                    pass
2622
 
            
 
3309
 
2623
3310
            # Clients who has passed its expire date can still be
2624
 
            # enabled if its last checker was successful.  Clients
 
3311
            # enabled if its last checker was successful.  A Client
2625
3312
            # whose checker succeeded before we stored its state is
2626
3313
            # assumed to have successfully run all checkers during
2627
3314
            # downtime.
2630
3317
                    if not client["last_checked_ok"]:
2631
3318
                        logger.warning(
2632
3319
                            "disabling client {} - Client never "
2633
 
                            "performed a successful checker"
2634
 
                            .format(client_name))
 
3320
                            "performed a successful checker".format(
 
3321
                                client_name))
2635
3322
                        client["enabled"] = False
2636
3323
                    elif client["last_checker_status"] != 0:
2637
3324
                        logger.warning(
2638
3325
                            "disabling client {} - Client last"
2639
 
                            " checker failed with error code {}"
2640
 
                            .format(client_name,
2641
 
                                    client["last_checker_status"]))
 
3326
                            " checker failed with error code"
 
3327
                            " {}".format(
 
3328
                                client_name,
 
3329
                                client["last_checker_status"]))
2642
3330
                        client["enabled"] = False
2643
3331
                    else:
2644
 
                        client["expires"] = (datetime.datetime
2645
 
                                             .utcnow()
2646
 
                                             + client["timeout"])
 
3332
                        client["expires"] = (
 
3333
                            datetime.datetime.utcnow()
 
3334
                            + client["timeout"])
2647
3335
                        logger.debug("Last checker succeeded,"
2648
 
                                     " keeping {} enabled"
2649
 
                                     .format(client_name))
 
3336
                                     " keeping {} enabled".format(
 
3337
                                         client_name))
2650
3338
            try:
2651
 
                client["secret"] = (
2652
 
                    pgp.decrypt(client["encrypted_secret"],
2653
 
                                client_settings[client_name]
2654
 
                                ["secret"]))
 
3339
                client["secret"] = pgp.decrypt(
 
3340
                    client["encrypted_secret"],
 
3341
                    client_settings[client_name]["secret"])
2655
3342
            except PGPError:
2656
3343
                # If decryption fails, we use secret from new settings
2657
 
                logger.debug("Failed to decrypt {} old secret"
2658
 
                             .format(client_name))
2659
 
                client["secret"] = (
2660
 
                    client_settings[client_name]["secret"])
2661
 
    
 
3344
                logger.debug("Failed to decrypt {} old secret".format(
 
3345
                    client_name))
 
3346
                client["secret"] = (client_settings[client_name]
 
3347
                                    ["secret"])
 
3348
 
2662
3349
    # Add/remove clients based on new changes made to config
2663
3350
    for client_name in (set(old_client_settings)
2664
3351
                        - set(client_settings)):
2666
3353
    for client_name in (set(client_settings)
2667
3354
                        - set(old_client_settings)):
2668
3355
        clients_data[client_name] = client_settings[client_name]
2669
 
    
 
3356
 
2670
3357
    # Create all client objects
2671
3358
    for client_name, client in clients_data.items():
2672
3359
        tcp_server.clients[client_name] = client_class(
2673
 
            name = client_name, settings = client,
2674
 
            server_settings = server_settings)
2675
 
    
 
3360
            name=client_name,
 
3361
            settings=client,
 
3362
            server_settings=server_settings)
 
3363
 
2676
3364
    if not tcp_server.clients:
2677
3365
        logger.warning("No clients defined")
2678
 
    
 
3366
 
2679
3367
    if not foreground:
2680
3368
        if pidfile is not None:
 
3369
            pid = os.getpid()
2681
3370
            try:
2682
3371
                with pidfile:
2683
 
                    pid = os.getpid()
2684
 
                    pidfile.write("{}\n".format(pid).encode("utf-8"))
 
3372
                    print(pid, file=pidfile)
2685
3373
            except IOError:
2686
3374
                logger.error("Could not write to file %r with PID %d",
2687
3375
                             pidfilename, pid)
2688
3376
        del pidfile
2689
3377
        del pidfilename
2690
 
    
2691
 
    signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2692
 
    signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
2693
 
    
 
3378
 
 
3379
    for termsig in (signal.SIGHUP, signal.SIGTERM):
 
3380
        GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,
 
3381
                             lambda: main_loop.quit() and False)
 
3382
 
2694
3383
    if use_dbus:
2695
 
        @alternate_dbus_interfaces({"se.recompile.Mandos":
2696
 
                                        "se.bsnet.fukt.Mandos"})
2697
 
        class MandosDBusService(DBusObjectWithProperties):
 
3384
 
 
3385
        @alternate_dbus_interfaces(
 
3386
            {"se.recompile.Mandos": "se.bsnet.fukt.Mandos"})
 
3387
        class MandosDBusService(DBusObjectWithObjectManager):
2698
3388
            """A D-Bus proxy object"""
 
3389
 
2699
3390
            def __init__(self):
2700
3391
                dbus.service.Object.__init__(self, bus, "/")
 
3392
 
2701
3393
            _interface = "se.recompile.Mandos"
2702
 
            
2703
 
            @dbus_interface_annotations(_interface)
2704
 
            def _foo(self):
2705
 
                return { "org.freedesktop.DBus.Property"
2706
 
                         ".EmitsChangedSignal":
2707
 
                             "false"}
2708
 
            
 
3394
 
2709
3395
            @dbus.service.signal(_interface, signature="o")
2710
3396
            def ClientAdded(self, objpath):
2711
3397
                "D-Bus signal"
2712
3398
                pass
2713
 
            
 
3399
 
2714
3400
            @dbus.service.signal(_interface, signature="ss")
2715
 
            def ClientNotFound(self, fingerprint, address):
 
3401
            def ClientNotFound(self, key_id, address):
2716
3402
                "D-Bus signal"
2717
3403
                pass
2718
 
            
 
3404
 
 
3405
            @dbus_annotations({"org.freedesktop.DBus.Deprecated":
 
3406
                               "true"})
2719
3407
            @dbus.service.signal(_interface, signature="os")
2720
3408
            def ClientRemoved(self, objpath, name):
2721
3409
                "D-Bus signal"
2722
3410
                pass
2723
 
            
 
3411
 
 
3412
            @dbus_annotations({"org.freedesktop.DBus.Deprecated":
 
3413
                               "true"})
2724
3414
            @dbus.service.method(_interface, out_signature="ao")
2725
3415
            def GetAllClients(self):
2726
3416
                "D-Bus method"
2727
 
                return dbus.Array(c.dbus_object_path
2728
 
                                  for c in
2729
 
                                  tcp_server.clients.itervalues())
2730
 
            
 
3417
                return dbus.Array(c.dbus_object_path for c in
 
3418
                                  tcp_server.clients.values())
 
3419
 
 
3420
            @dbus_annotations({"org.freedesktop.DBus.Deprecated":
 
3421
                               "true"})
2731
3422
            @dbus.service.method(_interface,
2732
3423
                                 out_signature="a{oa{sv}}")
2733
3424
            def GetAllClientsWithProperties(self):
2734
3425
                "D-Bus method"
2735
3426
                return dbus.Dictionary(
2736
 
                    { c.dbus_object_path: c.GetAll("")
2737
 
                      for c in tcp_server.clients.itervalues() },
 
3427
                    {c.dbus_object_path: c.GetAll(
 
3428
                        "se.recompile.Mandos.Client")
 
3429
                     for c in tcp_server.clients.values()},
2738
3430
                    signature="oa{sv}")
2739
 
            
 
3431
 
2740
3432
            @dbus.service.method(_interface, in_signature="o")
2741
3433
            def RemoveClient(self, object_path):
2742
3434
                "D-Bus method"
2743
 
                for c in tcp_server.clients.itervalues():
 
3435
                for c in tcp_server.clients.values():
2744
3436
                    if c.dbus_object_path == object_path:
2745
3437
                        del tcp_server.clients[c.name]
2746
3438
                        c.remove_from_connection()
2747
 
                        # Don't signal anything except ClientRemoved
 
3439
                        # Don't signal the disabling
2748
3440
                        c.disable(quiet=True)
2749
 
                        # Emit D-Bus signal
2750
 
                        self.ClientRemoved(object_path, c.name)
 
3441
                        # Emit D-Bus signal for removal
 
3442
                        self.client_removed_signal(c)
2751
3443
                        return
2752
3444
                raise KeyError(object_path)
2753
 
            
 
3445
 
2754
3446
            del _interface
2755
 
        
 
3447
 
 
3448
            @dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
 
3449
                                 out_signature="a{oa{sa{sv}}}")
 
3450
            def GetManagedObjects(self):
 
3451
                """D-Bus method"""
 
3452
                return dbus.Dictionary(
 
3453
                    {client.dbus_object_path:
 
3454
                     dbus.Dictionary(
 
3455
                         {interface: client.GetAll(interface)
 
3456
                          for interface in
 
3457
                          client._get_all_interface_names()})
 
3458
                     for client in tcp_server.clients.values()})
 
3459
 
 
3460
            def client_added_signal(self, client):
 
3461
                """Send the new standard signal and the old signal"""
 
3462
                if use_dbus:
 
3463
                    # New standard signal
 
3464
                    self.InterfacesAdded(
 
3465
                        client.dbus_object_path,
 
3466
                        dbus.Dictionary(
 
3467
                            {interface: client.GetAll(interface)
 
3468
                             for interface in
 
3469
                             client._get_all_interface_names()}))
 
3470
                    # Old signal
 
3471
                    self.ClientAdded(client.dbus_object_path)
 
3472
 
 
3473
            def client_removed_signal(self, client):
 
3474
                """Send the new standard signal and the old signal"""
 
3475
                if use_dbus:
 
3476
                    # New standard signal
 
3477
                    self.InterfacesRemoved(
 
3478
                        client.dbus_object_path,
 
3479
                        client._get_all_interface_names())
 
3480
                    # Old signal
 
3481
                    self.ClientRemoved(client.dbus_object_path,
 
3482
                                       client.name)
 
3483
 
2756
3484
        mandos_dbus_service = MandosDBusService()
2757
 
    
 
3485
 
 
3486
    # Save modules to variables to exempt the modules from being
 
3487
    # unloaded before the function registered with atexit() is run.
 
3488
    mp = multiprocessing
 
3489
    wn = wnull
 
3490
 
2758
3491
    def cleanup():
2759
3492
        "Cleanup function; run on exit"
2760
3493
        if zeroconf:
2761
3494
            service.cleanup()
2762
 
        
2763
 
        multiprocessing.active_children()
2764
 
        wnull.close()
 
3495
 
 
3496
        mp.active_children()
 
3497
        wn.close()
2765
3498
        if not (tcp_server.clients or client_settings):
2766
3499
            return
2767
 
        
 
3500
 
2768
3501
        # Store client before exiting. Secrets are encrypted with key
2769
3502
        # based on what config file has. If config file is
2770
3503
        # removed/edited, old secret will thus be unrecovable.
2771
3504
        clients = {}
2772
3505
        with PGPEngine() as pgp:
2773
 
            for client in tcp_server.clients.itervalues():
 
3506
            for client in tcp_server.clients.values():
2774
3507
                key = client_settings[client.name]["secret"]
2775
3508
                client.encrypted_secret = pgp.encrypt(client.secret,
2776
3509
                                                      key)
2777
3510
                client_dict = {}
2778
 
                
 
3511
 
2779
3512
                # A list of attributes that can not be pickled
2780
3513
                # + secret.
2781
 
                exclude = { "bus", "changedstate", "secret",
2782
 
                            "checker", "server_settings" }
2783
 
                for name, typ in (inspect.getmembers
2784
 
                                  (dbus.service.Object)):
 
3514
                exclude = {"bus", "changedstate", "secret",
 
3515
                           "checker", "server_settings"}
 
3516
                for name, typ in inspect.getmembers(dbus.service
 
3517
                                                    .Object):
2785
3518
                    exclude.add(name)
2786
 
                
 
3519
 
2787
3520
                client_dict["encrypted_secret"] = (client
2788
3521
                                                   .encrypted_secret)
2789
3522
                for attr in client.client_structure:
2790
3523
                    if attr not in exclude:
2791
3524
                        client_dict[attr] = getattr(client, attr)
2792
 
                
 
3525
 
2793
3526
                clients[client.name] = client_dict
2794
3527
                del client_settings[client.name]["secret"]
2795
 
        
 
3528
 
2796
3529
        try:
2797
 
            with (tempfile.NamedTemporaryFile
2798
 
                  (mode='wb', suffix=".pickle", prefix='clients-',
2799
 
                   dir=os.path.dirname(stored_state_path),
2800
 
                   delete=False)) as stored_state:
2801
 
                pickle.dump((clients, client_settings), stored_state)
2802
 
                tempname=stored_state.name
 
3530
            with tempfile.NamedTemporaryFile(
 
3531
                    mode='wb',
 
3532
                    suffix=".pickle",
 
3533
                    prefix='clients-',
 
3534
                    dir=os.path.dirname(stored_state_path),
 
3535
                    delete=False) as stored_state:
 
3536
                pickle.dump((clients, client_settings), stored_state,
 
3537
                            protocol=2)
 
3538
                tempname = stored_state.name
2803
3539
            os.rename(tempname, stored_state_path)
2804
3540
        except (IOError, OSError) as e:
2805
3541
            if not debug:
2814
3550
                logger.warning("Could not save persistent state:",
2815
3551
                               exc_info=e)
2816
3552
                raise
2817
 
        
 
3553
 
2818
3554
        # Delete all clients, and settings from config
2819
3555
        while tcp_server.clients:
2820
3556
            name, client = tcp_server.clients.popitem()
2821
3557
            if use_dbus:
2822
3558
                client.remove_from_connection()
2823
 
            # Don't signal anything except ClientRemoved
 
3559
            # Don't signal the disabling
2824
3560
            client.disable(quiet=True)
 
3561
            # Emit D-Bus signal for removal
2825
3562
            if use_dbus:
2826
 
                # Emit D-Bus signal
2827
 
                mandos_dbus_service.ClientRemoved(client
2828
 
                                                  .dbus_object_path,
2829
 
                                                  client.name)
 
3563
                mandos_dbus_service.client_removed_signal(client)
2830
3564
        client_settings.clear()
2831
 
    
 
3565
 
2832
3566
    atexit.register(cleanup)
2833
 
    
2834
 
    for client in tcp_server.clients.itervalues():
 
3567
 
 
3568
    for client in tcp_server.clients.values():
2835
3569
        if use_dbus:
2836
 
            # Emit D-Bus signal
2837
 
            mandos_dbus_service.ClientAdded(client.dbus_object_path)
 
3570
            # Emit D-Bus signal for adding
 
3571
            mandos_dbus_service.client_added_signal(client)
2838
3572
        # Need to initiate checking of clients
2839
3573
        if client.enabled:
2840
3574
            client.init_checker()
2841
 
    
 
3575
 
2842
3576
    tcp_server.enable()
2843
3577
    tcp_server.server_activate()
2844
 
    
 
3578
 
2845
3579
    # Find out what port we got
2846
3580
    if zeroconf:
2847
3581
        service.port = tcp_server.socket.getsockname()[1]
2852
3586
    else:                       # IPv4
2853
3587
        logger.info("Now listening on address %r, port %d",
2854
3588
                    *tcp_server.socket.getsockname())
2855
 
    
2856
 
    #service.interface = tcp_server.socket.getsockname()[3]
2857
 
    
 
3589
 
 
3590
    # service.interface = tcp_server.socket.getsockname()[3]
 
3591
 
2858
3592
    try:
2859
3593
        if zeroconf:
2860
3594
            # From the Avahi example code
2865
3599
                cleanup()
2866
3600
                sys.exit(1)
2867
3601
            # End of Avahi example code
2868
 
        
2869
 
        gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
2870
 
                             lambda *args, **kwargs:
2871
 
                             (tcp_server.handle_request
2872
 
                              (*args[2:], **kwargs) or True))
2873
 
        
 
3602
 
 
3603
        GLib.io_add_watch(tcp_server.fileno(), GLib.IO_IN,
 
3604
                          lambda *args, **kwargs:
 
3605
                          (tcp_server.handle_request
 
3606
                           (*args[2:], **kwargs) or True))
 
3607
 
2874
3608
        logger.debug("Starting main loop")
2875
3609
        main_loop.run()
2876
3610
    except AvahiError as error:
2885
3619
    # Must run before the D-Bus bus name gets deregistered
2886
3620
    cleanup()
2887
3621
 
 
3622
 
2888
3623
if __name__ == '__main__':
2889
3624
    main()