/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos

  • Committer: Teddy Hogeborn
  • Date: 2022-04-24 16:54:30 UTC
  • Revision ID: teddy@recompile.se-20220424165430-m687snug7o7vz4ok
Update copyright year

* debian/copyright: Update copyright year to 2022.
* dracut-module/password-agent.c: - '' -
* dracut-module/password-agent.xml: Revert copyright year to 2020.
* intro.xml: - '' -
* mandos: Update copyright year to 2022.
* mandos-ctl: - '' -
* plugin-helpers/mandos-client-iprouteadddel.c: - '' -
* plugin-runner.c: - '' -
* plugins.d/mandos-client.c: - '' -
* plugins.d/password-prompt.c: - '' -
* plugins.d/plymouth.c: - '' -
* plugins.d/splashy.c: - '' -
* plugins.d/usplash.c: - '' -

Show diffs side-by-side

added added

removed removed

Lines of Context:
1
 
#!/usr/bin/python
2
 
# -*- mode: python; coding: utf-8 -*-
3
 
 
1
#!/usr/bin/python3 -bI
 
2
# -*- coding: utf-8; lexical-binding: t -*-
 
3
#
4
4
# Mandos server - give out binary blobs to connecting clients.
5
 
 
5
#
6
6
# This program is partly derived from an example program for an Avahi
7
7
# service publisher, downloaded from
8
8
# <http://avahi.org/wiki/PythonPublishExample>.  This includes the
9
9
# methods "add", "remove", "server_state_changed",
10
10
# "entry_group_state_changed", "cleanup", and "activate" in the
11
11
# "AvahiService" class, and some lines in "main".
12
 
 
12
#
13
13
# Everything else is
14
 
# Copyright © 2008-2013 Teddy Hogeborn
15
 
# Copyright © 2008-2013 Björn Påhlsson
16
 
17
 
# This program is free software: you can redistribute it and/or modify
18
 
# it under the terms of the GNU General Public License as published by
 
14
# Copyright © 2008-2022 Teddy Hogeborn
 
15
# Copyright © 2008-2022 Björn Påhlsson
 
16
#
 
17
# This file is part of Mandos.
 
18
#
 
19
# Mandos is free software: you can redistribute it and/or modify it
 
20
# under the terms of the GNU General Public License as published by
19
21
# the Free Software Foundation, either version 3 of the License, or
20
22
# (at your option) any later version.
21
23
#
22
 
#     This program is distributed in the hope that it will be useful,
23
 
#     but WITHOUT ANY WARRANTY; without even the implied warranty of
 
24
#     Mandos is distributed in the hope that it will be useful, but
 
25
#     WITHOUT ANY WARRANTY; without even the implied warranty of
24
26
#     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
25
27
#     GNU General Public License for more details.
26
 
 
28
#
27
29
# You should have received a copy of the GNU General Public License
28
 
# along with this program.  If not, see
29
 
# <http://www.gnu.org/licenses/>.
30
 
 
30
# along with Mandos.  If not, see <http://www.gnu.org/licenses/>.
 
31
#
31
32
# Contact the authors at <mandos@recompile.se>.
32
 
33
 
 
 
33
#
34
34
from __future__ import (division, absolute_import, print_function,
35
35
                        unicode_literals)
36
36
 
37
 
from future_builtins import *
 
37
try:
 
38
    from future_builtins import *
 
39
except ImportError:
 
40
    pass
38
41
 
39
 
import SocketServer as socketserver
 
42
import sys
 
43
import unittest
 
44
import argparse
 
45
import logging
 
46
import os
 
47
try:
 
48
    import SocketServer as socketserver
 
49
except ImportError:
 
50
    import socketserver
40
51
import socket
41
 
import argparse
42
52
import datetime
43
53
import errno
44
 
import gnutls.crypto
45
 
import gnutls.connection
46
 
import gnutls.errors
47
 
import gnutls.library.functions
48
 
import gnutls.library.constants
49
 
import gnutls.library.types
50
 
import ConfigParser as configparser
51
 
import sys
 
54
try:
 
55
    import ConfigParser as configparser
 
56
except ImportError:
 
57
    import configparser
52
58
import re
53
 
import os
54
59
import signal
55
60
import subprocess
56
61
import atexit
57
62
import stat
58
 
import logging
59
63
import logging.handlers
60
64
import pwd
61
65
import contextlib
62
66
import struct
63
67
import fcntl
64
68
import functools
65
 
import cPickle as pickle
 
69
try:
 
70
    import cPickle as pickle
 
71
except ImportError:
 
72
    import pickle
66
73
import multiprocessing
67
74
import types
68
75
import binascii
69
76
import tempfile
70
77
import itertools
71
78
import collections
 
79
import codecs
 
80
import random
 
81
import shlex
72
82
 
73
83
import dbus
74
84
import dbus.service
75
 
import gobject
76
 
import avahi
 
85
import gi
 
86
from gi.repository import GLib
77
87
from dbus.mainloop.glib import DBusGMainLoop
78
88
import ctypes
79
89
import ctypes.util
80
90
import xml.dom.minidom
81
91
import inspect
82
92
 
83
 
try:
 
93
if sys.version_info.major == 2:
 
94
    __metaclass__ = type
 
95
    str = unicode
 
96
    input = raw_input
 
97
 
 
98
# Add collections.abc.Callable if it does not exist
 
99
try:
 
100
    collections.abc.Callable
 
101
except AttributeError:
 
102
    class abc:
 
103
        Callable = collections.Callable
 
104
    collections.abc = abc
 
105
    del abc
 
106
 
 
107
# Add shlex.quote if it does not exist
 
108
try:
 
109
    shlex.quote
 
110
except AttributeError:
 
111
    shlex.quote = re.escape
 
112
 
 
113
# Show warnings by default
 
114
if not sys.warnoptions:
 
115
    import warnings
 
116
    warnings.simplefilter("default")
 
117
 
 
118
# Try to find the value of SO_BINDTODEVICE:
 
119
try:
 
120
    # This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and
 
121
    # newer, and it is also the most natural place for it:
84
122
    SO_BINDTODEVICE = socket.SO_BINDTODEVICE
85
123
except AttributeError:
86
124
    try:
 
125
        # This is where SO_BINDTODEVICE was up to and including Python
 
126
        # 2.6, and also 3.2:
87
127
        from IN import SO_BINDTODEVICE
88
128
    except ImportError:
89
 
        SO_BINDTODEVICE = None
90
 
 
91
 
version = "1.6.1"
 
129
        # In Python 2.7 it seems to have been removed entirely.
 
130
        # Try running the C preprocessor:
 
131
        try:
 
132
            cc = subprocess.Popen(["cc", "--language=c", "-E",
 
133
                                   "/dev/stdin"],
 
134
                                  stdin=subprocess.PIPE,
 
135
                                  stdout=subprocess.PIPE)
 
136
            stdout = cc.communicate(
 
137
                "#include <sys/socket.h>\nSO_BINDTODEVICE\n")[0]
 
138
            SO_BINDTODEVICE = int(stdout.splitlines()[-1])
 
139
        except (OSError, ValueError, IndexError):
 
140
            # No value found
 
141
            SO_BINDTODEVICE = None
 
142
 
 
143
if sys.version_info < (3, 2):
 
144
    configparser.Configparser = configparser.SafeConfigParser
 
145
 
 
146
version = "1.8.14"
92
147
stored_state_file = "clients.pickle"
93
148
 
94
 
logger = logging.getLogger()
95
 
syslogger = (logging.handlers.SysLogHandler
96
 
             (facility = logging.handlers.SysLogHandler.LOG_DAEMON,
97
 
              address = str("/dev/log")))
 
149
log = logging.getLogger(os.path.basename(sys.argv[0]))
 
150
logging.captureWarnings(True)   # Show warnings via the logging system
 
151
syslogger = None
98
152
 
99
153
try:
100
 
    if_nametoindex = (ctypes.cdll.LoadLibrary
101
 
                      (ctypes.util.find_library("c"))
102
 
                      .if_nametoindex)
 
154
    if_nametoindex = ctypes.cdll.LoadLibrary(
 
155
        ctypes.util.find_library("c")).if_nametoindex
103
156
except (OSError, AttributeError):
 
157
 
104
158
    def if_nametoindex(interface):
105
159
        "Get an interface index the hard way, i.e. using fcntl()"
106
160
        SIOCGIFINDEX = 0x8933  # From /usr/include/linux/sockios.h
107
161
        with contextlib.closing(socket.socket()) as s:
108
162
            ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
109
 
                                struct.pack(str("16s16x"),
110
 
                                            interface))
111
 
        interface_index = struct.unpack(str("I"),
112
 
                                        ifreq[16:20])[0]
 
163
                                struct.pack(b"16s16x", interface))
 
164
        interface_index = struct.unpack("I", ifreq[16:20])[0]
113
165
        return interface_index
114
166
 
115
167
 
 
168
def copy_function(func):
 
169
    """Make a copy of a function"""
 
170
    if sys.version_info.major == 2:
 
171
        return types.FunctionType(func.func_code,
 
172
                                  func.func_globals,
 
173
                                  func.func_name,
 
174
                                  func.func_defaults,
 
175
                                  func.func_closure)
 
176
    else:
 
177
        return types.FunctionType(func.__code__,
 
178
                                  func.__globals__,
 
179
                                  func.__name__,
 
180
                                  func.__defaults__,
 
181
                                  func.__closure__)
 
182
 
 
183
 
116
184
def initlogger(debug, level=logging.WARNING):
117
185
    """init logger and add loglevel"""
118
 
    
 
186
 
 
187
    global syslogger
 
188
    syslogger = (logging.handlers.SysLogHandler(
 
189
        facility=logging.handlers.SysLogHandler.LOG_DAEMON,
 
190
        address="/dev/log"))
119
191
    syslogger.setFormatter(logging.Formatter
120
 
                           ('Mandos [%(process)d]: %(levelname)s:'
121
 
                            ' %(message)s'))
122
 
    logger.addHandler(syslogger)
123
 
    
 
192
                           ("Mandos [%(process)d]: %(levelname)s:"
 
193
                            " %(message)s"))
 
194
    log.addHandler(syslogger)
 
195
 
124
196
    if debug:
125
197
        console = logging.StreamHandler()
126
 
        console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
127
 
                                               ' [%(process)d]:'
128
 
                                               ' %(levelname)s:'
129
 
                                               ' %(message)s'))
130
 
        logger.addHandler(console)
131
 
    logger.setLevel(level)
 
198
        console.setFormatter(logging.Formatter("%(asctime)s %(name)s"
 
199
                                               " [%(process)d]:"
 
200
                                               " %(levelname)s:"
 
201
                                               " %(message)s"))
 
202
        log.addHandler(console)
 
203
    log.setLevel(level)
132
204
 
133
205
 
134
206
class PGPError(Exception):
136
208
    pass
137
209
 
138
210
 
139
 
class PGPEngine(object):
 
211
class PGPEngine:
140
212
    """A simple class for OpenPGP symmetric encryption & decryption"""
 
213
 
141
214
    def __init__(self):
142
215
        self.tempdir = tempfile.mkdtemp(prefix="mandos-")
143
 
        self.gnupgargs = ['--batch',
144
 
                          '--home', self.tempdir,
145
 
                          '--force-mdc',
146
 
                          '--quiet',
147
 
                          '--no-use-agent']
148
 
    
 
216
        self.gpg = "gpg"
 
217
        try:
 
218
            output = subprocess.check_output(["gpgconf"])
 
219
            for line in output.splitlines():
 
220
                name, text, path = line.split(b":")
 
221
                if name == b"gpg":
 
222
                    self.gpg = path
 
223
                    break
 
224
        except OSError as e:
 
225
            if e.errno != errno.ENOENT:
 
226
                raise
 
227
        self.gnupgargs = ["--batch",
 
228
                          "--homedir", self.tempdir,
 
229
                          "--force-mdc",
 
230
                          "--quiet"]
 
231
        # Only GPG version 1 has the --no-use-agent option.
 
232
        if self.gpg == b"gpg" or self.gpg.endswith(b"/gpg"):
 
233
            self.gnupgargs.append("--no-use-agent")
 
234
 
149
235
    def __enter__(self):
150
236
        return self
151
 
    
 
237
 
152
238
    def __exit__(self, exc_type, exc_value, traceback):
153
239
        self._cleanup()
154
240
        return False
155
 
    
 
241
 
156
242
    def __del__(self):
157
243
        self._cleanup()
158
 
    
 
244
 
159
245
    def _cleanup(self):
160
246
        if self.tempdir is not None:
161
247
            # Delete contents of tempdir
162
248
            for root, dirs, files in os.walk(self.tempdir,
163
 
                                             topdown = False):
 
249
                                             topdown=False):
164
250
                for filename in files:
165
251
                    os.remove(os.path.join(root, filename))
166
252
                for dirname in dirs:
168
254
            # Remove tempdir
169
255
            os.rmdir(self.tempdir)
170
256
            self.tempdir = None
171
 
    
 
257
 
172
258
    def password_encode(self, password):
173
259
        # Passphrase can not be empty and can not contain newlines or
174
260
        # NUL bytes.  So we prefix it and hex encode it.
179
265
                       .replace(b"\n", b"\\n")
180
266
                       .replace(b"\0", b"\\x00"))
181
267
        return encoded
182
 
    
 
268
 
183
269
    def encrypt(self, data, password):
184
270
        passphrase = self.password_encode(password)
185
 
        with tempfile.NamedTemporaryFile(dir=self.tempdir
186
 
                                         ) as passfile:
 
271
        with tempfile.NamedTemporaryFile(
 
272
                dir=self.tempdir) as passfile:
187
273
            passfile.write(passphrase)
188
274
            passfile.flush()
189
 
            proc = subprocess.Popen(['gpg', '--symmetric',
190
 
                                     '--passphrase-file',
 
275
            proc = subprocess.Popen([self.gpg, "--symmetric",
 
276
                                     "--passphrase-file",
191
277
                                     passfile.name]
192
278
                                    + self.gnupgargs,
193
 
                                    stdin = subprocess.PIPE,
194
 
                                    stdout = subprocess.PIPE,
195
 
                                    stderr = subprocess.PIPE)
196
 
            ciphertext, err = proc.communicate(input = data)
 
279
                                    stdin=subprocess.PIPE,
 
280
                                    stdout=subprocess.PIPE,
 
281
                                    stderr=subprocess.PIPE)
 
282
            ciphertext, err = proc.communicate(input=data)
197
283
        if proc.returncode != 0:
198
284
            raise PGPError(err)
199
285
        return ciphertext
200
 
    
 
286
 
201
287
    def decrypt(self, data, password):
202
288
        passphrase = self.password_encode(password)
203
 
        with tempfile.NamedTemporaryFile(dir = self.tempdir
204
 
                                         ) as passfile:
 
289
        with tempfile.NamedTemporaryFile(
 
290
                dir=self.tempdir) as passfile:
205
291
            passfile.write(passphrase)
206
292
            passfile.flush()
207
 
            proc = subprocess.Popen(['gpg', '--decrypt',
208
 
                                     '--passphrase-file',
 
293
            proc = subprocess.Popen([self.gpg, "--decrypt",
 
294
                                     "--passphrase-file",
209
295
                                     passfile.name]
210
296
                                    + self.gnupgargs,
211
 
                                    stdin = subprocess.PIPE,
212
 
                                    stdout = subprocess.PIPE,
213
 
                                    stderr = subprocess.PIPE)
214
 
            decrypted_plaintext, err = proc.communicate(input
215
 
                                                        = data)
 
297
                                    stdin=subprocess.PIPE,
 
298
                                    stdout=subprocess.PIPE,
 
299
                                    stderr=subprocess.PIPE)
 
300
            decrypted_plaintext, err = proc.communicate(input=data)
216
301
        if proc.returncode != 0:
217
302
            raise PGPError(err)
218
303
        return decrypted_plaintext
219
304
 
220
305
 
 
306
# Pretend that we have an Avahi module
 
307
class avahi:
 
308
    """This isn't so much a class as it is a module-like namespace."""
 
309
    IF_UNSPEC = -1               # avahi-common/address.h
 
310
    PROTO_UNSPEC = -1            # avahi-common/address.h
 
311
    PROTO_INET = 0               # avahi-common/address.h
 
312
    PROTO_INET6 = 1              # avahi-common/address.h
 
313
    DBUS_NAME = "org.freedesktop.Avahi"
 
314
    DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"
 
315
    DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"
 
316
    DBUS_PATH_SERVER = "/"
 
317
 
 
318
    @staticmethod
 
319
    def string_array_to_txt_array(t):
 
320
        return dbus.Array((dbus.ByteArray(s.encode("utf-8"))
 
321
                           for s in t), signature="ay")
 
322
    ENTRY_GROUP_ESTABLISHED = 2  # avahi-common/defs.h
 
323
    ENTRY_GROUP_COLLISION = 3    # avahi-common/defs.h
 
324
    ENTRY_GROUP_FAILURE = 4      # avahi-common/defs.h
 
325
    SERVER_INVALID = 0           # avahi-common/defs.h
 
326
    SERVER_REGISTERING = 1       # avahi-common/defs.h
 
327
    SERVER_RUNNING = 2           # avahi-common/defs.h
 
328
    SERVER_COLLISION = 3         # avahi-common/defs.h
 
329
    SERVER_FAILURE = 4           # avahi-common/defs.h
 
330
 
 
331
 
221
332
class AvahiError(Exception):
222
333
    def __init__(self, value, *args, **kwargs):
223
334
        self.value = value
224
 
        super(AvahiError, self).__init__(value, *args, **kwargs)
225
 
    def __unicode__(self):
226
 
        return unicode(repr(self.value))
 
335
        return super(AvahiError, self).__init__(value, *args,
 
336
                                                **kwargs)
 
337
 
227
338
 
228
339
class AvahiServiceError(AvahiError):
229
340
    pass
230
341
 
 
342
 
231
343
class AvahiGroupError(AvahiError):
232
344
    pass
233
345
 
234
346
 
235
 
class AvahiService(object):
 
347
class AvahiService:
236
348
    """An Avahi (Zeroconf) service.
237
 
    
 
349
 
238
350
    Attributes:
239
351
    interface: integer; avahi.IF_UNSPEC or an interface index.
240
352
               Used to optionally bind to the specified interface.
241
 
    name: string; Example: 'Mandos'
242
 
    type: string; Example: '_mandos._tcp'.
 
353
    name: string; Example: "Mandos"
 
354
    type: string; Example: "_mandos._tcp".
243
355
     See <https://www.iana.org/assignments/service-names-port-numbers>
244
356
    port: integer; what port to announce
245
357
    TXT: list of strings; TXT record for the service
252
364
    server: D-Bus Server
253
365
    bus: dbus.SystemBus()
254
366
    """
255
 
    
256
 
    def __init__(self, interface = avahi.IF_UNSPEC, name = None,
257
 
                 servicetype = None, port = None, TXT = None,
258
 
                 domain = "", host = "", max_renames = 32768,
259
 
                 protocol = avahi.PROTO_UNSPEC, bus = None):
 
367
 
 
368
    def __init__(self,
 
369
                 interface=avahi.IF_UNSPEC,
 
370
                 name=None,
 
371
                 servicetype=None,
 
372
                 port=None,
 
373
                 TXT=None,
 
374
                 domain="",
 
375
                 host="",
 
376
                 max_renames=32768,
 
377
                 protocol=avahi.PROTO_UNSPEC,
 
378
                 bus=None):
260
379
        self.interface = interface
261
380
        self.name = name
262
381
        self.type = servicetype
271
390
        self.server = None
272
391
        self.bus = bus
273
392
        self.entry_group_state_changed_match = None
274
 
    
275
 
    def rename(self):
 
393
 
 
394
    def rename(self, remove=True):
276
395
        """Derived from the Avahi example code"""
277
396
        if self.rename_count >= self.max_renames:
278
 
            logger.critical("No suitable Zeroconf service name found"
279
 
                            " after %i retries, exiting.",
280
 
                            self.rename_count)
 
397
            log.critical("No suitable Zeroconf service name found"
 
398
                         " after %i retries, exiting.",
 
399
                         self.rename_count)
281
400
            raise AvahiServiceError("Too many renames")
282
 
        self.name = unicode(self.server
283
 
                            .GetAlternativeServiceName(self.name))
284
 
        logger.info("Changing Zeroconf service name to %r ...",
285
 
                    self.name)
286
 
        self.remove()
287
 
        try:
288
 
            self.add()
289
 
        except dbus.exceptions.DBusException as error:
290
 
            logger.critical("D-Bus Exception", exc_info=error)
291
 
            self.cleanup()
292
 
            os._exit(1)
 
401
        self.name = str(
 
402
            self.server.GetAlternativeServiceName(self.name))
293
403
        self.rename_count += 1
294
 
    
 
404
        log.info("Changing Zeroconf service name to %r ...",
 
405
                 self.name)
 
406
        if remove:
 
407
            self.remove()
 
408
        try:
 
409
            self.add()
 
410
        except dbus.exceptions.DBusException as error:
 
411
            if (error.get_dbus_name()
 
412
                == "org.freedesktop.Avahi.CollisionError"):
 
413
                log.info("Local Zeroconf service name collision.")
 
414
                return self.rename(remove=False)
 
415
            else:
 
416
                log.critical("D-Bus Exception", exc_info=error)
 
417
                self.cleanup()
 
418
                os._exit(1)
 
419
 
295
420
    def remove(self):
296
421
        """Derived from the Avahi example code"""
297
422
        if self.entry_group_state_changed_match is not None:
299
424
            self.entry_group_state_changed_match = None
300
425
        if self.group is not None:
301
426
            self.group.Reset()
302
 
    
 
427
 
303
428
    def add(self):
304
429
        """Derived from the Avahi example code"""
305
430
        self.remove()
310
435
                avahi.DBUS_INTERFACE_ENTRY_GROUP)
311
436
        self.entry_group_state_changed_match = (
312
437
            self.group.connect_to_signal(
313
 
                'StateChanged', self.entry_group_state_changed))
314
 
        logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
315
 
                     self.name, self.type)
 
438
                "StateChanged", self.entry_group_state_changed))
 
439
        log.debug("Adding Zeroconf service '%s' of type '%s' ...",
 
440
                  self.name, self.type)
316
441
        self.group.AddService(
317
442
            self.interface,
318
443
            self.protocol,
322
447
            dbus.UInt16(self.port),
323
448
            avahi.string_array_to_txt_array(self.TXT))
324
449
        self.group.Commit()
325
 
    
 
450
 
326
451
    def entry_group_state_changed(self, state, error):
327
452
        """Derived from the Avahi example code"""
328
 
        logger.debug("Avahi entry group state change: %i", state)
329
 
        
 
453
        log.debug("Avahi entry group state change: %i", state)
 
454
 
330
455
        if state == avahi.ENTRY_GROUP_ESTABLISHED:
331
 
            logger.debug("Zeroconf service established.")
 
456
            log.debug("Zeroconf service established.")
332
457
        elif state == avahi.ENTRY_GROUP_COLLISION:
333
 
            logger.info("Zeroconf service name collision.")
 
458
            log.info("Zeroconf service name collision.")
334
459
            self.rename()
335
460
        elif state == avahi.ENTRY_GROUP_FAILURE:
336
 
            logger.critical("Avahi: Error in group state changed %s",
337
 
                            unicode(error))
338
 
            raise AvahiGroupError("State changed: {0!s}"
339
 
                                  .format(error))
340
 
    
 
461
            log.critical("Avahi: Error in group state changed %s",
 
462
                         str(error))
 
463
            raise AvahiGroupError("State changed: {!s}".format(error))
 
464
 
341
465
    def cleanup(self):
342
466
        """Derived from the Avahi example code"""
343
467
        if self.group is not None:
348
472
                pass
349
473
            self.group = None
350
474
        self.remove()
351
 
    
 
475
 
352
476
    def server_state_changed(self, state, error=None):
353
477
        """Derived from the Avahi example code"""
354
 
        logger.debug("Avahi server state change: %i", state)
355
 
        bad_states = { avahi.SERVER_INVALID:
356
 
                           "Zeroconf server invalid",
357
 
                       avahi.SERVER_REGISTERING: None,
358
 
                       avahi.SERVER_COLLISION:
359
 
                           "Zeroconf server name collision",
360
 
                       avahi.SERVER_FAILURE:
361
 
                           "Zeroconf server failure" }
 
478
        log.debug("Avahi server state change: %i", state)
 
479
        bad_states = {
 
480
            avahi.SERVER_INVALID: "Zeroconf server invalid",
 
481
            avahi.SERVER_REGISTERING: None,
 
482
            avahi.SERVER_COLLISION: "Zeroconf server name collision",
 
483
            avahi.SERVER_FAILURE: "Zeroconf server failure",
 
484
        }
362
485
        if state in bad_states:
363
486
            if bad_states[state] is not None:
364
487
                if error is None:
365
 
                    logger.error(bad_states[state])
 
488
                    log.error(bad_states[state])
366
489
                else:
367
 
                    logger.error(bad_states[state] + ": %r", error)
 
490
                    log.error(bad_states[state] + ": %r", error)
368
491
            self.cleanup()
369
492
        elif state == avahi.SERVER_RUNNING:
370
 
            self.add()
 
493
            try:
 
494
                self.add()
 
495
            except dbus.exceptions.DBusException as error:
 
496
                if (error.get_dbus_name()
 
497
                    == "org.freedesktop.Avahi.CollisionError"):
 
498
                    log.info("Local Zeroconf service name collision.")
 
499
                    return self.rename(remove=False)
 
500
                else:
 
501
                    log.critical("D-Bus Exception", exc_info=error)
 
502
                    self.cleanup()
 
503
                    os._exit(1)
371
504
        else:
372
505
            if error is None:
373
 
                logger.debug("Unknown state: %r", state)
 
506
                log.debug("Unknown state: %r", state)
374
507
            else:
375
 
                logger.debug("Unknown state: %r: %r", state, error)
376
 
    
 
508
                log.debug("Unknown state: %r: %r", state, error)
 
509
 
377
510
    def activate(self):
378
511
        """Derived from the Avahi example code"""
379
512
        if self.server is None:
383
516
                                    follow_name_owner_changes=True),
384
517
                avahi.DBUS_INTERFACE_SERVER)
385
518
        self.server.connect_to_signal("StateChanged",
386
 
                                 self.server_state_changed)
 
519
                                      self.server_state_changed)
387
520
        self.server_state_changed(self.server.GetState())
388
521
 
389
522
 
390
523
class AvahiServiceToSyslog(AvahiService):
391
 
    def rename(self):
 
524
    def rename(self, *args, **kwargs):
392
525
        """Add the new name to the syslog messages"""
393
 
        ret = AvahiService.rename(self)
394
 
        syslogger.setFormatter(logging.Formatter
395
 
                               ('Mandos ({0}) [%(process)d]:'
396
 
                                ' %(levelname)s: %(message)s'
397
 
                                .format(self.name)))
 
526
        ret = super(AvahiServiceToSyslog, self).rename(*args,
 
527
                                                       **kwargs)
 
528
        syslogger.setFormatter(logging.Formatter(
 
529
            "Mandos ({}) [%(process)d]: %(levelname)s: %(message)s"
 
530
            .format(self.name)))
398
531
        return ret
399
532
 
400
533
 
401
 
def timedelta_to_milliseconds(td):
402
 
    "Convert a datetime.timedelta() to milliseconds"
403
 
    return ((td.days * 24 * 60 * 60 * 1000)
404
 
            + (td.seconds * 1000)
405
 
            + (td.microseconds // 1000))
406
 
 
407
 
 
408
 
class Client(object):
 
534
# Pretend that we have a GnuTLS module
 
535
class gnutls:
 
536
    """This isn't so much a class as it is a module-like namespace."""
 
537
 
 
538
    library = ctypes.util.find_library("gnutls")
 
539
    if library is None:
 
540
        library = ctypes.util.find_library("gnutls-deb0")
 
541
    _library = ctypes.cdll.LoadLibrary(library)
 
542
    del library
 
543
 
 
544
    # Unless otherwise indicated, the constants and types below are
 
545
    # all from the gnutls/gnutls.h C header file.
 
546
 
 
547
    # Constants
 
548
    E_SUCCESS = 0
 
549
    E_INTERRUPTED = -52
 
550
    E_AGAIN = -28
 
551
    CRT_OPENPGP = 2
 
552
    CRT_RAWPK = 3
 
553
    CLIENT = 2
 
554
    SHUT_RDWR = 0
 
555
    CRD_CERTIFICATE = 1
 
556
    E_NO_CERTIFICATE_FOUND = -49
 
557
    X509_FMT_DER = 0
 
558
    NO_TICKETS = 1<<10
 
559
    ENABLE_RAWPK = 1<<18
 
560
    CTYPE_PEERS = 3
 
561
    KEYID_USE_SHA256 = 1        # gnutls/x509.h
 
562
    OPENPGP_FMT_RAW = 0         # gnutls/openpgp.h
 
563
 
 
564
    # Types
 
565
    class _session_int(ctypes.Structure):
 
566
        _fields_ = []
 
567
    session_t = ctypes.POINTER(_session_int)
 
568
 
 
569
    class certificate_credentials_st(ctypes.Structure):
 
570
        _fields_ = []
 
571
    certificate_credentials_t = ctypes.POINTER(
 
572
        certificate_credentials_st)
 
573
    certificate_type_t = ctypes.c_int
 
574
 
 
575
    class datum_t(ctypes.Structure):
 
576
        _fields_ = [("data", ctypes.POINTER(ctypes.c_ubyte)),
 
577
                    ("size", ctypes.c_uint)]
 
578
 
 
579
    class _openpgp_crt_int(ctypes.Structure):
 
580
        _fields_ = []
 
581
    openpgp_crt_t = ctypes.POINTER(_openpgp_crt_int)
 
582
    openpgp_crt_fmt_t = ctypes.c_int  # gnutls/openpgp.h
 
583
    log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
 
584
    credentials_type_t = ctypes.c_int
 
585
    transport_ptr_t = ctypes.c_void_p
 
586
    close_request_t = ctypes.c_int
 
587
 
 
588
    # Exceptions
 
589
    class Error(Exception):
 
590
        def __init__(self, message=None, code=None, args=()):
 
591
            # Default usage is by a message string, but if a return
 
592
            # code is passed, convert it to a string with
 
593
            # gnutls.strerror()
 
594
            self.code = code
 
595
            if message is None and code is not None:
 
596
                message = gnutls.strerror(code).decode(
 
597
                    "utf-8", errors="replace")
 
598
            return super(gnutls.Error, self).__init__(
 
599
                message, *args)
 
600
 
 
601
    class CertificateSecurityError(Error):
 
602
        pass
 
603
 
 
604
    class PointerTo:
 
605
        def __init__(self, cls):
 
606
            self.cls = cls
 
607
 
 
608
        def from_param(self, obj):
 
609
            if not isinstance(obj, self.cls):
 
610
                raise TypeError("Not of type {}: {!r}"
 
611
                                .format(self.cls.__name__, obj))
 
612
            return ctypes.byref(obj.from_param(obj))
 
613
 
 
614
    class CastToVoidPointer:
 
615
        def __init__(self, cls):
 
616
            self.cls = cls
 
617
 
 
618
        def from_param(self, obj):
 
619
            if not isinstance(obj, self.cls):
 
620
                raise TypeError("Not of type {}: {!r}"
 
621
                                .format(self.cls.__name__, obj))
 
622
            return ctypes.cast(obj.from_param(obj), ctypes.c_void_p)
 
623
 
 
624
    class With_from_param:
 
625
        @classmethod
 
626
        def from_param(cls, obj):
 
627
            return obj._as_parameter_
 
628
 
 
629
    # Classes
 
630
    class Credentials(With_from_param):
 
631
        def __init__(self):
 
632
            self._as_parameter_ = gnutls.certificate_credentials_t()
 
633
            gnutls.certificate_allocate_credentials(self)
 
634
            self.type = gnutls.CRD_CERTIFICATE
 
635
 
 
636
        def __del__(self):
 
637
            gnutls.certificate_free_credentials(self)
 
638
 
 
639
    class ClientSession(With_from_param):
 
640
        def __init__(self, socket, credentials=None):
 
641
            self._as_parameter_ = gnutls.session_t()
 
642
            gnutls_flags = gnutls.CLIENT
 
643
            if gnutls.check_version(b"3.5.6"):
 
644
                gnutls_flags |= gnutls.NO_TICKETS
 
645
            if gnutls.has_rawpk:
 
646
                gnutls_flags |= gnutls.ENABLE_RAWPK
 
647
            gnutls.init(self, gnutls_flags)
 
648
            del gnutls_flags
 
649
            gnutls.set_default_priority(self)
 
650
            gnutls.transport_set_ptr(self, socket.fileno())
 
651
            gnutls.handshake_set_private_extensions(self, True)
 
652
            self.socket = socket
 
653
            if credentials is None:
 
654
                credentials = gnutls.Credentials()
 
655
            gnutls.credentials_set(self, credentials.type,
 
656
                                   credentials)
 
657
            self.credentials = credentials
 
658
 
 
659
        def __del__(self):
 
660
            gnutls.deinit(self)
 
661
 
 
662
        def handshake(self):
 
663
            return gnutls.handshake(self)
 
664
 
 
665
        def send(self, data):
 
666
            data = bytes(data)
 
667
            data_len = len(data)
 
668
            while data_len > 0:
 
669
                data_len -= gnutls.record_send(self, data[-data_len:],
 
670
                                               data_len)
 
671
 
 
672
        def bye(self):
 
673
            return gnutls.bye(self, gnutls.SHUT_RDWR)
 
674
 
 
675
    # Error handling functions
 
676
    def _error_code(result):
 
677
        """A function to raise exceptions on errors, suitable
 
678
        for the "restype" attribute on ctypes functions"""
 
679
        if result >= gnutls.E_SUCCESS:
 
680
            return result
 
681
        if result == gnutls.E_NO_CERTIFICATE_FOUND:
 
682
            raise gnutls.CertificateSecurityError(code=result)
 
683
        raise gnutls.Error(code=result)
 
684
 
 
685
    def _retry_on_error(result, func, arguments,
 
686
                        _error_code=_error_code):
 
687
        """A function to retry on some errors, suitable
 
688
        for the "errcheck" attribute on ctypes functions"""
 
689
        while result < gnutls.E_SUCCESS:
 
690
            if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
 
691
                return _error_code(result)
 
692
            result = func(*arguments)
 
693
        return result
 
694
 
 
695
    # Unless otherwise indicated, the function declarations below are
 
696
    # all from the gnutls/gnutls.h C header file.
 
697
 
 
698
    # Functions
 
699
    priority_set_direct = _library.gnutls_priority_set_direct
 
700
    priority_set_direct.argtypes = [ClientSession, ctypes.c_char_p,
 
701
                                    ctypes.POINTER(ctypes.c_char_p)]
 
702
    priority_set_direct.restype = _error_code
 
703
 
 
704
    init = _library.gnutls_init
 
705
    init.argtypes = [PointerTo(ClientSession), ctypes.c_int]
 
706
    init.restype = _error_code
 
707
 
 
708
    set_default_priority = _library.gnutls_set_default_priority
 
709
    set_default_priority.argtypes = [ClientSession]
 
710
    set_default_priority.restype = _error_code
 
711
 
 
712
    record_send = _library.gnutls_record_send
 
713
    record_send.argtypes = [ClientSession, ctypes.c_void_p,
 
714
                            ctypes.c_size_t]
 
715
    record_send.restype = ctypes.c_ssize_t
 
716
    record_send.errcheck = _retry_on_error
 
717
 
 
718
    certificate_allocate_credentials = (
 
719
        _library.gnutls_certificate_allocate_credentials)
 
720
    certificate_allocate_credentials.argtypes = [
 
721
        PointerTo(Credentials)]
 
722
    certificate_allocate_credentials.restype = _error_code
 
723
 
 
724
    certificate_free_credentials = (
 
725
        _library.gnutls_certificate_free_credentials)
 
726
    certificate_free_credentials.argtypes = [Credentials]
 
727
    certificate_free_credentials.restype = None
 
728
 
 
729
    handshake_set_private_extensions = (
 
730
        _library.gnutls_handshake_set_private_extensions)
 
731
    handshake_set_private_extensions.argtypes = [ClientSession,
 
732
                                                 ctypes.c_int]
 
733
    handshake_set_private_extensions.restype = None
 
734
 
 
735
    credentials_set = _library.gnutls_credentials_set
 
736
    credentials_set.argtypes = [ClientSession, credentials_type_t,
 
737
                                CastToVoidPointer(Credentials)]
 
738
    credentials_set.restype = _error_code
 
739
 
 
740
    strerror = _library.gnutls_strerror
 
741
    strerror.argtypes = [ctypes.c_int]
 
742
    strerror.restype = ctypes.c_char_p
 
743
 
 
744
    certificate_type_get = _library.gnutls_certificate_type_get
 
745
    certificate_type_get.argtypes = [ClientSession]
 
746
    certificate_type_get.restype = _error_code
 
747
 
 
748
    certificate_get_peers = _library.gnutls_certificate_get_peers
 
749
    certificate_get_peers.argtypes = [ClientSession,
 
750
                                      ctypes.POINTER(ctypes.c_uint)]
 
751
    certificate_get_peers.restype = ctypes.POINTER(datum_t)
 
752
 
 
753
    global_set_log_level = _library.gnutls_global_set_log_level
 
754
    global_set_log_level.argtypes = [ctypes.c_int]
 
755
    global_set_log_level.restype = None
 
756
 
 
757
    global_set_log_function = _library.gnutls_global_set_log_function
 
758
    global_set_log_function.argtypes = [log_func]
 
759
    global_set_log_function.restype = None
 
760
 
 
761
    deinit = _library.gnutls_deinit
 
762
    deinit.argtypes = [ClientSession]
 
763
    deinit.restype = None
 
764
 
 
765
    handshake = _library.gnutls_handshake
 
766
    handshake.argtypes = [ClientSession]
 
767
    handshake.restype = ctypes.c_int
 
768
    handshake.errcheck = _retry_on_error
 
769
 
 
770
    transport_set_ptr = _library.gnutls_transport_set_ptr
 
771
    transport_set_ptr.argtypes = [ClientSession, transport_ptr_t]
 
772
    transport_set_ptr.restype = None
 
773
 
 
774
    bye = _library.gnutls_bye
 
775
    bye.argtypes = [ClientSession, close_request_t]
 
776
    bye.restype = ctypes.c_int
 
777
    bye.errcheck = _retry_on_error
 
778
 
 
779
    check_version = _library.gnutls_check_version
 
780
    check_version.argtypes = [ctypes.c_char_p]
 
781
    check_version.restype = ctypes.c_char_p
 
782
 
 
783
    _need_version = b"3.3.0"
 
784
    if check_version(_need_version) is None:
 
785
        raise self.Error("Needs GnuTLS {} or later"
 
786
                         .format(_need_version))
 
787
 
 
788
    _tls_rawpk_version = b"3.6.6"
 
789
    has_rawpk = bool(check_version(_tls_rawpk_version))
 
790
 
 
791
    if has_rawpk:
 
792
        # Types
 
793
        class pubkey_st(ctypes.Structure):
 
794
            _fields = []
 
795
        pubkey_t = ctypes.POINTER(pubkey_st)
 
796
 
 
797
        x509_crt_fmt_t = ctypes.c_int
 
798
 
 
799
        # All the function declarations below are from
 
800
        # gnutls/abstract.h
 
801
        pubkey_init = _library.gnutls_pubkey_init
 
802
        pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]
 
803
        pubkey_init.restype = _error_code
 
804
 
 
805
        pubkey_import = _library.gnutls_pubkey_import
 
806
        pubkey_import.argtypes = [pubkey_t, ctypes.POINTER(datum_t),
 
807
                                  x509_crt_fmt_t]
 
808
        pubkey_import.restype = _error_code
 
809
 
 
810
        pubkey_get_key_id = _library.gnutls_pubkey_get_key_id
 
811
        pubkey_get_key_id.argtypes = [pubkey_t, ctypes.c_int,
 
812
                                      ctypes.POINTER(ctypes.c_ubyte),
 
813
                                      ctypes.POINTER(ctypes.c_size_t)]
 
814
        pubkey_get_key_id.restype = _error_code
 
815
 
 
816
        pubkey_deinit = _library.gnutls_pubkey_deinit
 
817
        pubkey_deinit.argtypes = [pubkey_t]
 
818
        pubkey_deinit.restype = None
 
819
    else:
 
820
        # All the function declarations below are from
 
821
        # gnutls/openpgp.h
 
822
 
 
823
        openpgp_crt_init = _library.gnutls_openpgp_crt_init
 
824
        openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
 
825
        openpgp_crt_init.restype = _error_code
 
826
 
 
827
        openpgp_crt_import = _library.gnutls_openpgp_crt_import
 
828
        openpgp_crt_import.argtypes = [openpgp_crt_t,
 
829
                                       ctypes.POINTER(datum_t),
 
830
                                       openpgp_crt_fmt_t]
 
831
        openpgp_crt_import.restype = _error_code
 
832
 
 
833
        openpgp_crt_verify_self = \
 
834
            _library.gnutls_openpgp_crt_verify_self
 
835
        openpgp_crt_verify_self.argtypes = [
 
836
            openpgp_crt_t,
 
837
            ctypes.c_uint,
 
838
            ctypes.POINTER(ctypes.c_uint),
 
839
        ]
 
840
        openpgp_crt_verify_self.restype = _error_code
 
841
 
 
842
        openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
 
843
        openpgp_crt_deinit.argtypes = [openpgp_crt_t]
 
844
        openpgp_crt_deinit.restype = None
 
845
 
 
846
        openpgp_crt_get_fingerprint = (
 
847
            _library.gnutls_openpgp_crt_get_fingerprint)
 
848
        openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
 
849
                                                ctypes.c_void_p,
 
850
                                                ctypes.POINTER(
 
851
                                                    ctypes.c_size_t)]
 
852
        openpgp_crt_get_fingerprint.restype = _error_code
 
853
 
 
854
    if check_version(b"3.6.4"):
 
855
        certificate_type_get2 = _library.gnutls_certificate_type_get2
 
856
        certificate_type_get2.argtypes = [ClientSession, ctypes.c_int]
 
857
        certificate_type_get2.restype = _error_code
 
858
 
 
859
    # Remove non-public functions
 
860
    del _error_code, _retry_on_error
 
861
 
 
862
 
 
863
def call_pipe(connection,       # : multiprocessing.Connection
 
864
              func, *args, **kwargs):
 
865
    """This function is meant to be called by multiprocessing.Process
 
866
 
 
867
    This function runs func(*args, **kwargs), and writes the resulting
 
868
    return value on the provided multiprocessing.Connection.
 
869
    """
 
870
    connection.send(func(*args, **kwargs))
 
871
    connection.close()
 
872
 
 
873
 
 
874
class Client:
409
875
    """A representation of a client host served by this server.
410
 
    
 
876
 
411
877
    Attributes:
412
 
    approved:   bool(); 'None' if not yet approved/disapproved
 
878
    approved:   bool(); None if not yet approved/disapproved
413
879
    approval_delay: datetime.timedelta(); Time to wait for approval
414
880
    approval_duration: datetime.timedelta(); Duration of one approval
415
 
    checker:    subprocess.Popen(); a running checker process used
416
 
                                    to see if the client lives.
417
 
                                    'None' if no process is running.
418
 
    checker_callback_tag: a gobject event source tag, or None
 
881
    checker: multiprocessing.Process(); a running checker process used
 
882
             to see if the client lives. None if no process is
 
883
             running.
 
884
    checker_callback_tag: a GLib event source tag, or None
419
885
    checker_command: string; External command which is run to check
420
886
                     if client lives.  %() expansions are done at
421
887
                     runtime with vars(self) as dict, so that for
422
888
                     instance %(name)s can be used in the command.
423
 
    checker_initiator_tag: a gobject event source tag, or None
 
889
    checker_initiator_tag: a GLib event source tag, or None
424
890
    created:    datetime.datetime(); (UTC) object creation
425
891
    client_structure: Object describing what attributes a client has
426
892
                      and is used for storing the client at exit
427
893
    current_checker_command: string; current running checker_command
428
 
    disable_initiator_tag: a gobject event source tag, or None
 
894
    disable_initiator_tag: a GLib event source tag, or None
429
895
    enabled:    bool()
430
896
    fingerprint: string (40 or 32 hexadecimal digits); used to
431
 
                 uniquely identify the client
 
897
                 uniquely identify an OpenPGP client
 
898
    key_id: string (64 hexadecimal digits); used to uniquely identify
 
899
            a client using raw public keys
432
900
    host:       string; available for use by the checker command
433
901
    interval:   datetime.timedelta(); How often to start a new checker
434
902
    last_approval_request: datetime.datetime(); (UTC) or None
436
904
    last_checker_status: integer between 0 and 255 reflecting exit
437
905
                         status of last checker. -1 reflects crashed
438
906
                         checker, -2 means no checker completed yet.
 
907
    last_checker_signal: The signal which killed the last checker, if
 
908
                         last_checker_status is -1
439
909
    last_enabled: datetime.datetime(); (UTC) or None
440
910
    name:       string; from the config file, used in log messages and
441
911
                        D-Bus identifiers
448
918
                disabled, or None
449
919
    server_settings: The server_settings dict from main()
450
920
    """
451
 
    
 
921
 
452
922
    runtime_expansions = ("approval_delay", "approval_duration",
453
 
                          "created", "enabled", "expires",
 
923
                          "created", "enabled", "expires", "key_id",
454
924
                          "fingerprint", "host", "interval",
455
925
                          "last_approval_request", "last_checked_ok",
456
926
                          "last_enabled", "name", "timeout")
457
 
    client_defaults = { "timeout": "PT5M",
458
 
                        "extended_timeout": "PT15M",
459
 
                        "interval": "PT2M",
460
 
                        "checker": "fping -q -- %%(host)s",
461
 
                        "host": "",
462
 
                        "approval_delay": "PT0S",
463
 
                        "approval_duration": "PT1S",
464
 
                        "approved_by_default": "True",
465
 
                        "enabled": "True",
466
 
                        }
467
 
    
468
 
    def timeout_milliseconds(self):
469
 
        "Return the 'timeout' attribute in milliseconds"
470
 
        return timedelta_to_milliseconds(self.timeout)
471
 
    
472
 
    def extended_timeout_milliseconds(self):
473
 
        "Return the 'extended_timeout' attribute in milliseconds"
474
 
        return timedelta_to_milliseconds(self.extended_timeout)
475
 
    
476
 
    def interval_milliseconds(self):
477
 
        "Return the 'interval' attribute in milliseconds"
478
 
        return timedelta_to_milliseconds(self.interval)
479
 
    
480
 
    def approval_delay_milliseconds(self):
481
 
        return timedelta_to_milliseconds(self.approval_delay)
482
 
    
 
927
    client_defaults = {
 
928
        "timeout": "PT5M",
 
929
        "extended_timeout": "PT15M",
 
930
        "interval": "PT2M",
 
931
        "checker": "fping -q -- %%(host)s",
 
932
        "host": "",
 
933
        "approval_delay": "PT0S",
 
934
        "approval_duration": "PT1S",
 
935
        "approved_by_default": "True",
 
936
        "enabled": "True",
 
937
    }
 
938
 
483
939
    @staticmethod
484
940
    def config_parser(config):
485
941
        """Construct a new dict of client settings of this form:
492
948
        for client_name in config.sections():
493
949
            section = dict(config.items(client_name))
494
950
            client = settings[client_name] = {}
495
 
            
 
951
 
496
952
            client["host"] = section["host"]
497
953
            # Reformat values from string types to Python types
498
954
            client["approved_by_default"] = config.getboolean(
499
955
                client_name, "approved_by_default")
500
956
            client["enabled"] = config.getboolean(client_name,
501
957
                                                  "enabled")
502
 
            
 
958
 
 
959
            # Uppercase and remove spaces from key_id and fingerprint
 
960
            # for later comparison purposes with return value from the
 
961
            # key_id() and fingerprint() functions
 
962
            client["key_id"] = (section.get("key_id", "").upper()
 
963
                                .replace(" ", ""))
503
964
            client["fingerprint"] = (section["fingerprint"].upper()
504
965
                                     .replace(" ", ""))
505
966
            if "secret" in section:
506
 
                client["secret"] = section["secret"].decode("base64")
 
967
                client["secret"] = codecs.decode(section["secret"]
 
968
                                                 .encode("utf-8"),
 
969
                                                 "base64")
507
970
            elif "secfile" in section:
508
971
                with open(os.path.expanduser(os.path.expandvars
509
972
                                             (section["secfile"])),
510
973
                          "rb") as secfile:
511
974
                    client["secret"] = secfile.read()
512
975
            else:
513
 
                raise TypeError("No secret or secfile for section {0}"
 
976
                raise TypeError("No secret or secfile for section {}"
514
977
                                .format(section))
515
978
            client["timeout"] = string_to_delta(section["timeout"])
516
979
            client["extended_timeout"] = string_to_delta(
524
987
            client["last_approval_request"] = None
525
988
            client["last_checked_ok"] = None
526
989
            client["last_checker_status"] = -2
527
 
        
 
990
 
528
991
        return settings
529
 
    
530
 
    def __init__(self, settings, name = None, server_settings=None):
 
992
 
 
993
    def __init__(self, settings, name=None, server_settings=None):
531
994
        self.name = name
532
995
        if server_settings is None:
533
996
            server_settings = {}
534
997
        self.server_settings = server_settings
535
998
        # adding all client settings
536
 
        for setting, value in settings.iteritems():
 
999
        for setting, value in settings.items():
537
1000
            setattr(self, setting, value)
538
 
        
 
1001
 
539
1002
        if self.enabled:
540
1003
            if not hasattr(self, "last_enabled"):
541
1004
                self.last_enabled = datetime.datetime.utcnow()
545
1008
        else:
546
1009
            self.last_enabled = None
547
1010
            self.expires = None
548
 
        
549
 
        logger.debug("Creating client %r", self.name)
550
 
        # Uppercase and remove spaces from fingerprint for later
551
 
        # comparison purposes with return value from the fingerprint()
552
 
        # function
553
 
        logger.debug("  Fingerprint: %s", self.fingerprint)
 
1011
 
 
1012
        log.debug("Creating client %r", self.name)
 
1013
        log.debug("  Key ID: %s", self.key_id)
 
1014
        log.debug("  Fingerprint: %s", self.fingerprint)
554
1015
        self.created = settings.get("created",
555
1016
                                    datetime.datetime.utcnow())
556
 
        
 
1017
 
557
1018
        # attributes specific for this server instance
558
1019
        self.checker = None
559
1020
        self.checker_initiator_tag = None
562
1023
        self.current_checker_command = None
563
1024
        self.approved = None
564
1025
        self.approvals_pending = 0
565
 
        self.changedstate = (multiprocessing_manager
566
 
                             .Condition(multiprocessing_manager
567
 
                                        .Lock()))
568
 
        self.client_structure = [attr for attr in
569
 
                                 self.__dict__.iterkeys()
 
1026
        self.changedstate = multiprocessing_manager.Condition(
 
1027
            multiprocessing_manager.Lock())
 
1028
        self.client_structure = [attr
 
1029
                                 for attr in self.__dict__.keys()
570
1030
                                 if not attr.startswith("_")]
571
1031
        self.client_structure.append("client_structure")
572
 
        
573
 
        for name, t in inspect.getmembers(type(self),
574
 
                                          lambda obj:
575
 
                                              isinstance(obj,
576
 
                                                         property)):
 
1032
 
 
1033
        for name, t in inspect.getmembers(
 
1034
                type(self), lambda obj: isinstance(obj, property)):
577
1035
            if not name.startswith("_"):
578
1036
                self.client_structure.append(name)
579
 
    
 
1037
 
580
1038
    # Send notice to process children that client state has changed
581
1039
    def send_changedstate(self):
582
1040
        with self.changedstate:
583
1041
            self.changedstate.notify_all()
584
 
    
 
1042
 
585
1043
    def enable(self):
586
1044
        """Start this client's checker and timeout hooks"""
587
1045
        if getattr(self, "enabled", False):
592
1050
        self.last_enabled = datetime.datetime.utcnow()
593
1051
        self.init_checker()
594
1052
        self.send_changedstate()
595
 
    
 
1053
 
596
1054
    def disable(self, quiet=True):
597
1055
        """Disable this client."""
598
1056
        if not getattr(self, "enabled", False):
599
1057
            return False
600
1058
        if not quiet:
601
 
            logger.info("Disabling client %s", self.name)
 
1059
            log.info("Disabling client %s", self.name)
602
1060
        if getattr(self, "disable_initiator_tag", None) is not None:
603
 
            gobject.source_remove(self.disable_initiator_tag)
 
1061
            GLib.source_remove(self.disable_initiator_tag)
604
1062
            self.disable_initiator_tag = None
605
1063
        self.expires = None
606
1064
        if getattr(self, "checker_initiator_tag", None) is not None:
607
 
            gobject.source_remove(self.checker_initiator_tag)
 
1065
            GLib.source_remove(self.checker_initiator_tag)
608
1066
            self.checker_initiator_tag = None
609
1067
        self.stop_checker()
610
1068
        self.enabled = False
611
1069
        if not quiet:
612
1070
            self.send_changedstate()
613
 
        # Do not run this again if called by a gobject.timeout_add
 
1071
        # Do not run this again if called by a GLib.timeout_add
614
1072
        return False
615
 
    
 
1073
 
616
1074
    def __del__(self):
617
1075
        self.disable()
618
 
    
 
1076
 
619
1077
    def init_checker(self):
620
1078
        # Schedule a new checker to be started an 'interval' from now,
621
1079
        # and every interval from then on.
622
1080
        if self.checker_initiator_tag is not None:
623
 
            gobject.source_remove(self.checker_initiator_tag)
624
 
        self.checker_initiator_tag = (gobject.timeout_add
625
 
                                      (self.interval_milliseconds(),
626
 
                                       self.start_checker))
 
1081
            GLib.source_remove(self.checker_initiator_tag)
 
1082
        self.checker_initiator_tag = GLib.timeout_add(
 
1083
            random.randrange(int(self.interval.total_seconds() * 1000
 
1084
                                 + 1)),
 
1085
            self.start_checker)
627
1086
        # Schedule a disable() when 'timeout' has passed
628
1087
        if self.disable_initiator_tag is not None:
629
 
            gobject.source_remove(self.disable_initiator_tag)
630
 
        self.disable_initiator_tag = (gobject.timeout_add
631
 
                                   (self.timeout_milliseconds(),
632
 
                                    self.disable))
 
1088
            GLib.source_remove(self.disable_initiator_tag)
 
1089
        self.disable_initiator_tag = GLib.timeout_add(
 
1090
            int(self.timeout.total_seconds() * 1000), self.disable)
633
1091
        # Also start a new checker *right now*.
634
1092
        self.start_checker()
635
 
    
636
 
    def checker_callback(self, pid, condition, command):
 
1093
 
 
1094
    def checker_callback(self, source, condition, connection,
 
1095
                         command):
637
1096
        """The checker has completed, so take appropriate actions."""
 
1097
        # Read return code from connection (see call_pipe)
 
1098
        returncode = connection.recv()
 
1099
        connection.close()
 
1100
        if self.checker is not None:
 
1101
            self.checker.join()
638
1102
        self.checker_callback_tag = None
639
1103
        self.checker = None
640
 
        if os.WIFEXITED(condition):
641
 
            self.last_checker_status = os.WEXITSTATUS(condition)
 
1104
 
 
1105
        if returncode >= 0:
 
1106
            self.last_checker_status = returncode
 
1107
            self.last_checker_signal = None
642
1108
            if self.last_checker_status == 0:
643
 
                logger.info("Checker for %(name)s succeeded",
644
 
                            vars(self))
 
1109
                log.info("Checker for %(name)s succeeded", vars(self))
645
1110
                self.checked_ok()
646
1111
            else:
647
 
                logger.info("Checker for %(name)s failed",
648
 
                            vars(self))
 
1112
                log.info("Checker for %(name)s failed", vars(self))
649
1113
        else:
650
1114
            self.last_checker_status = -1
651
 
            logger.warning("Checker for %(name)s crashed?",
652
 
                           vars(self))
653
 
    
 
1115
            self.last_checker_signal = -returncode
 
1116
            log.warning("Checker for %(name)s crashed?", vars(self))
 
1117
        return False
 
1118
 
654
1119
    def checked_ok(self):
655
1120
        """Assert that the client has been seen, alive and well."""
656
1121
        self.last_checked_ok = datetime.datetime.utcnow()
657
1122
        self.last_checker_status = 0
 
1123
        self.last_checker_signal = None
658
1124
        self.bump_timeout()
659
 
    
 
1125
 
660
1126
    def bump_timeout(self, timeout=None):
661
1127
        """Bump up the timeout for this client."""
662
1128
        if timeout is None:
663
1129
            timeout = self.timeout
664
1130
        if self.disable_initiator_tag is not None:
665
 
            gobject.source_remove(self.disable_initiator_tag)
 
1131
            GLib.source_remove(self.disable_initiator_tag)
666
1132
            self.disable_initiator_tag = None
667
1133
        if getattr(self, "enabled", False):
668
 
            self.disable_initiator_tag = (gobject.timeout_add
669
 
                                          (timedelta_to_milliseconds
670
 
                                           (timeout), self.disable))
 
1134
            self.disable_initiator_tag = GLib.timeout_add(
 
1135
                int(timeout.total_seconds() * 1000), self.disable)
671
1136
            self.expires = datetime.datetime.utcnow() + timeout
672
 
    
 
1137
 
673
1138
    def need_approval(self):
674
1139
        self.last_approval_request = datetime.datetime.utcnow()
675
 
    
 
1140
 
676
1141
    def start_checker(self):
677
1142
        """Start a new checker subprocess if one is not running.
678
 
        
 
1143
 
679
1144
        If a checker already exists, leave it running and do
680
1145
        nothing."""
681
1146
        # The reason for not killing a running checker is that if we
686
1151
        # checkers alone, the checker would have to take more time
687
1152
        # than 'timeout' for the client to be disabled, which is as it
688
1153
        # should be.
689
 
        
690
 
        # If a checker exists, make sure it is not a zombie
691
 
        try:
692
 
            pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
693
 
        except (AttributeError, OSError) as error:
694
 
            if (isinstance(error, OSError)
695
 
                and error.errno != errno.ECHILD):
696
 
                raise error
697
 
        else:
698
 
            if pid:
699
 
                logger.warning("Checker was a zombie")
700
 
                gobject.source_remove(self.checker_callback_tag)
701
 
                self.checker_callback(pid, status,
702
 
                                      self.current_checker_command)
 
1154
 
 
1155
        if self.checker is not None and not self.checker.is_alive():
 
1156
            log.warning("Checker was not alive; joining")
 
1157
            self.checker.join()
 
1158
            self.checker = None
703
1159
        # Start a new checker if needed
704
1160
        if self.checker is None:
705
1161
            # Escape attributes for the shell
706
 
            escaped_attrs = dict(
707
 
                (attr, re.escape(unicode(getattr(self, attr))))
708
 
                for attr in
709
 
                self.runtime_expansions)
 
1162
            escaped_attrs = {
 
1163
                attr: shlex.quote(str(getattr(self, attr)))
 
1164
                for attr in self.runtime_expansions}
710
1165
            try:
711
1166
                command = self.checker_command % escaped_attrs
712
1167
            except TypeError as error:
713
 
                logger.error('Could not format string "%s"',
714
 
                             self.checker_command, exc_info=error)
715
 
                return True # Try again later
 
1168
                log.error('Could not format string "%s"',
 
1169
                          self.checker_command, exc_info=error)
 
1170
                return True     # Try again later
716
1171
            self.current_checker_command = command
717
 
            try:
718
 
                logger.info("Starting checker %r for %s",
719
 
                            command, self.name)
720
 
                # We don't need to redirect stdout and stderr, since
721
 
                # in normal mode, that is already done by daemon(),
722
 
                # and in debug mode we don't want to.  (Stdin is
723
 
                # always replaced by /dev/null.)
724
 
                # The exception is when not debugging but nevertheless
725
 
                # running in the foreground; use the previously
726
 
                # created wnull.
727
 
                popen_args = {}
728
 
                if (not self.server_settings["debug"]
729
 
                    and self.server_settings["foreground"]):
730
 
                    popen_args.update({"stdout": wnull,
731
 
                                       "stderr": wnull })
732
 
                self.checker = subprocess.Popen(command,
733
 
                                                close_fds=True,
734
 
                                                shell=True, cwd="/",
735
 
                                                **popen_args)
736
 
            except OSError as error:
737
 
                logger.error("Failed to start subprocess",
738
 
                             exc_info=error)
739
 
                return True
740
 
            self.checker_callback_tag = (gobject.child_watch_add
741
 
                                         (self.checker.pid,
742
 
                                          self.checker_callback,
743
 
                                          data=command))
744
 
            # The checker may have completed before the gobject
745
 
            # watch was added.  Check for this.
746
 
            try:
747
 
                pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
748
 
            except OSError as error:
749
 
                if error.errno == errno.ECHILD:
750
 
                    # This should never happen
751
 
                    logger.error("Child process vanished",
752
 
                                 exc_info=error)
753
 
                    return True
754
 
                raise
755
 
            if pid:
756
 
                gobject.source_remove(self.checker_callback_tag)
757
 
                self.checker_callback(pid, status, command)
758
 
        # Re-run this periodically if run by gobject.timeout_add
 
1172
            log.info("Starting checker %r for %s", command, self.name)
 
1173
            # We don't need to redirect stdout and stderr, since
 
1174
            # in normal mode, that is already done by daemon(),
 
1175
            # and in debug mode we don't want to.  (Stdin is
 
1176
            # always replaced by /dev/null.)
 
1177
            # The exception is when not debugging but nevertheless
 
1178
            # running in the foreground; use the previously
 
1179
            # created wnull.
 
1180
            popen_args = {"close_fds": True,
 
1181
                          "shell": True,
 
1182
                          "cwd": "/"}
 
1183
            if (not self.server_settings["debug"]
 
1184
                and self.server_settings["foreground"]):
 
1185
                popen_args.update({"stdout": wnull,
 
1186
                                   "stderr": wnull})
 
1187
            pipe = multiprocessing.Pipe(duplex=False)
 
1188
            self.checker = multiprocessing.Process(
 
1189
                target=call_pipe,
 
1190
                args=(pipe[1], subprocess.call, command),
 
1191
                kwargs=popen_args)
 
1192
            self.checker.start()
 
1193
            self.checker_callback_tag = GLib.io_add_watch(
 
1194
                GLib.IOChannel.unix_new(pipe[0].fileno()),
 
1195
                GLib.PRIORITY_DEFAULT, GLib.IO_IN,
 
1196
                self.checker_callback, pipe[0], command)
 
1197
        # Re-run this periodically if run by GLib.timeout_add
759
1198
        return True
760
 
    
 
1199
 
761
1200
    def stop_checker(self):
762
1201
        """Force the checker process, if any, to stop."""
763
1202
        if self.checker_callback_tag:
764
 
            gobject.source_remove(self.checker_callback_tag)
 
1203
            GLib.source_remove(self.checker_callback_tag)
765
1204
            self.checker_callback_tag = None
766
1205
        if getattr(self, "checker", None) is None:
767
1206
            return
768
 
        logger.debug("Stopping checker for %(name)s", vars(self))
769
 
        try:
770
 
            self.checker.terminate()
771
 
            #time.sleep(0.5)
772
 
            #if self.checker.poll() is None:
773
 
            #    self.checker.kill()
774
 
        except OSError as error:
775
 
            if error.errno != errno.ESRCH: # No such process
776
 
                raise
 
1207
        log.debug("Stopping checker for %(name)s", vars(self))
 
1208
        self.checker.terminate()
777
1209
        self.checker = None
778
1210
 
779
1211
 
780
 
def dbus_service_property(dbus_interface, signature="v",
781
 
                          access="readwrite", byte_arrays=False):
 
1212
def dbus_service_property(dbus_interface,
 
1213
                          signature="v",
 
1214
                          access="readwrite",
 
1215
                          byte_arrays=False):
782
1216
    """Decorators for marking methods of a DBusObjectWithProperties to
783
1217
    become properties on the D-Bus.
784
 
    
 
1218
 
785
1219
    The decorated method will be called with no arguments by "Get"
786
1220
    and with one argument by "Set".
787
 
    
 
1221
 
788
1222
    The parameters, where they are supported, are the same as
789
1223
    dbus.service.method, except there is only "signature", since the
790
1224
    type from Get() and the type sent to Set() is the same.
793
1227
    # "Set" method, so we fail early here:
794
1228
    if byte_arrays and signature != "ay":
795
1229
        raise ValueError("Byte arrays not supported for non-'ay'"
796
 
                         " signature {0!r}".format(signature))
 
1230
                         " signature {!r}".format(signature))
 
1231
 
797
1232
    def decorator(func):
798
1233
        func._dbus_is_property = True
799
1234
        func._dbus_interface = dbus_interface
802
1237
        func._dbus_name = func.__name__
803
1238
        if func._dbus_name.endswith("_dbus_property"):
804
1239
            func._dbus_name = func._dbus_name[:-14]
805
 
        func._dbus_get_args_options = {'byte_arrays': byte_arrays }
 
1240
        func._dbus_get_args_options = {"byte_arrays": byte_arrays}
806
1241
        return func
 
1242
 
807
1243
    return decorator
808
1244
 
809
1245
 
810
1246
def dbus_interface_annotations(dbus_interface):
811
1247
    """Decorator for marking functions returning interface annotations
812
 
    
 
1248
 
813
1249
    Usage:
814
 
    
 
1250
 
815
1251
    @dbus_interface_annotations("org.example.Interface")
816
1252
    def _foo(self):  # Function name does not matter
817
1253
        return {"org.freedesktop.DBus.Deprecated": "true",
818
1254
                "org.freedesktop.DBus.Property.EmitsChangedSignal":
819
1255
                    "false"}
820
1256
    """
 
1257
 
821
1258
    def decorator(func):
822
1259
        func._dbus_is_interface = True
823
1260
        func._dbus_interface = dbus_interface
824
1261
        func._dbus_name = dbus_interface
825
1262
        return func
 
1263
 
826
1264
    return decorator
827
1265
 
828
1266
 
829
1267
def dbus_annotations(annotations):
830
1268
    """Decorator to annotate D-Bus methods, signals or properties
831
1269
    Usage:
832
 
    
 
1270
 
 
1271
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",
 
1272
                       "org.freedesktop.DBus.Property."
 
1273
                       "EmitsChangedSignal": "false"})
833
1274
    @dbus_service_property("org.example.Interface", signature="b",
834
1275
                           access="r")
835
 
    @dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",
836
 
                        "org.freedesktop.DBus.Property."
837
 
                        "EmitsChangedSignal": "false"})
838
1276
    def Property_dbus_property(self):
839
1277
        return dbus.Boolean(False)
 
1278
 
 
1279
    See also the DBusObjectWithAnnotations class.
840
1280
    """
 
1281
 
841
1282
    def decorator(func):
842
1283
        func._dbus_annotations = annotations
843
1284
        return func
 
1285
 
844
1286
    return decorator
845
1287
 
846
1288
 
847
1289
class DBusPropertyException(dbus.exceptions.DBusException):
848
1290
    """A base class for D-Bus property-related exceptions
849
1291
    """
850
 
    def __unicode__(self):
851
 
        return unicode(str(self))
 
1292
    pass
852
1293
 
853
1294
 
854
1295
class DBusPropertyAccessException(DBusPropertyException):
863
1304
    pass
864
1305
 
865
1306
 
866
 
class DBusObjectWithProperties(dbus.service.Object):
867
 
    """A D-Bus object with properties.
868
 
    
869
 
    Classes inheriting from this can use the dbus_service_property
870
 
    decorator to expose methods as D-Bus properties.  It exposes the
871
 
    standard Get(), Set(), and GetAll() methods on the D-Bus.
 
1307
class DBusObjectWithAnnotations(dbus.service.Object):
 
1308
    """A D-Bus object with annotations.
 
1309
 
 
1310
    Classes inheriting from this can use the dbus_annotations
 
1311
    decorator to add annotations to methods or signals.
872
1312
    """
873
 
    
 
1313
 
874
1314
    @staticmethod
875
1315
    def _is_dbus_thing(thing):
876
1316
        """Returns a function testing if an attribute is a D-Bus thing
877
 
        
 
1317
 
878
1318
        If called like _is_dbus_thing("method") it returns a function
879
1319
        suitable for use as predicate to inspect.getmembers().
880
1320
        """
881
 
        return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),
 
1321
        return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
882
1322
                                   False)
883
 
    
 
1323
 
884
1324
    def _get_all_dbus_things(self, thing):
885
1325
        """Returns a generator of (name, attribute) pairs
886
1326
        """
887
 
        return ((getattr(athing.__get__(self), "_dbus_name",
888
 
                         name),
 
1327
        return ((getattr(athing.__get__(self), "_dbus_name", name),
889
1328
                 athing.__get__(self))
890
1329
                for cls in self.__class__.__mro__
891
1330
                for name, athing in
892
 
                inspect.getmembers(cls,
893
 
                                   self._is_dbus_thing(thing)))
894
 
    
 
1331
                inspect.getmembers(cls, self._is_dbus_thing(thing)))
 
1332
 
 
1333
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
 
1334
                         out_signature="s",
 
1335
                         path_keyword="object_path",
 
1336
                         connection_keyword="connection")
 
1337
    def Introspect(self, object_path, connection):
 
1338
        """Overloading of standard D-Bus method.
 
1339
 
 
1340
        Inserts annotation tags on methods and signals.
 
1341
        """
 
1342
        xmlstring = dbus.service.Object.Introspect(self, object_path,
 
1343
                                                   connection)
 
1344
        try:
 
1345
            document = xml.dom.minidom.parseString(xmlstring)
 
1346
 
 
1347
            for if_tag in document.getElementsByTagName("interface"):
 
1348
                # Add annotation tags
 
1349
                for typ in ("method", "signal"):
 
1350
                    for tag in if_tag.getElementsByTagName(typ):
 
1351
                        annots = dict()
 
1352
                        for name, prop in (self.
 
1353
                                           _get_all_dbus_things(typ)):
 
1354
                            if (name == tag.getAttribute("name")
 
1355
                                and prop._dbus_interface
 
1356
                                == if_tag.getAttribute("name")):
 
1357
                                annots.update(getattr(
 
1358
                                    prop, "_dbus_annotations", {}))
 
1359
                        for name, value in annots.items():
 
1360
                            ann_tag = document.createElement(
 
1361
                                "annotation")
 
1362
                            ann_tag.setAttribute("name", name)
 
1363
                            ann_tag.setAttribute("value", value)
 
1364
                            tag.appendChild(ann_tag)
 
1365
                # Add interface annotation tags
 
1366
                for annotation, value in dict(
 
1367
                    itertools.chain.from_iterable(
 
1368
                        annotations().items()
 
1369
                        for name, annotations
 
1370
                        in self._get_all_dbus_things("interface")
 
1371
                        if name == if_tag.getAttribute("name")
 
1372
                        )).items():
 
1373
                    ann_tag = document.createElement("annotation")
 
1374
                    ann_tag.setAttribute("name", annotation)
 
1375
                    ann_tag.setAttribute("value", value)
 
1376
                    if_tag.appendChild(ann_tag)
 
1377
                # Fix argument name for the Introspect method itself
 
1378
                if (if_tag.getAttribute("name")
 
1379
                    == dbus.INTROSPECTABLE_IFACE):
 
1380
                    for cn in if_tag.getElementsByTagName("method"):
 
1381
                        if cn.getAttribute("name") == "Introspect":
 
1382
                            for arg in cn.getElementsByTagName("arg"):
 
1383
                                if (arg.getAttribute("direction")
 
1384
                                    == "out"):
 
1385
                                    arg.setAttribute("name",
 
1386
                                                     "xml_data")
 
1387
            xmlstring = document.toxml("utf-8")
 
1388
            document.unlink()
 
1389
        except (AttributeError, xml.dom.DOMException,
 
1390
                xml.parsers.expat.ExpatError) as error:
 
1391
            log.error("Failed to override Introspection method",
 
1392
                      exc_info=error)
 
1393
        return xmlstring
 
1394
 
 
1395
 
 
1396
class DBusObjectWithProperties(DBusObjectWithAnnotations):
 
1397
    """A D-Bus object with properties.
 
1398
 
 
1399
    Classes inheriting from this can use the dbus_service_property
 
1400
    decorator to expose methods as D-Bus properties.  It exposes the
 
1401
    standard Get(), Set(), and GetAll() methods on the D-Bus.
 
1402
    """
 
1403
 
895
1404
    def _get_dbus_property(self, interface_name, property_name):
896
1405
        """Returns a bound method if one exists which is a D-Bus
897
1406
        property with the specified name and interface.
898
1407
        """
899
 
        for cls in  self.__class__.__mro__:
900
 
            for name, value in (inspect.getmembers
901
 
                                (cls,
902
 
                                 self._is_dbus_thing("property"))):
 
1408
        for cls in self.__class__.__mro__:
 
1409
            for name, value in inspect.getmembers(
 
1410
                    cls, self._is_dbus_thing("property")):
903
1411
                if (value._dbus_name == property_name
904
1412
                    and value._dbus_interface == interface_name):
905
1413
                    return value.__get__(self)
906
 
        
 
1414
 
907
1415
        # No such property
908
 
        raise DBusPropertyNotFound(self.dbus_object_path + ":"
909
 
                                   + interface_name + "."
910
 
                                   + property_name)
911
 
    
912
 
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
 
1416
        raise DBusPropertyNotFound("{}:{}.{}".format(
 
1417
            self.dbus_object_path, interface_name, property_name))
 
1418
 
 
1419
    @classmethod
 
1420
    def _get_all_interface_names(cls):
 
1421
        """Get a sequence of all interfaces supported by an object"""
 
1422
        return (name for name in set(getattr(getattr(x, attr),
 
1423
                                             "_dbus_interface", None)
 
1424
                                     for x in (inspect.getmro(cls))
 
1425
                                     for attr in dir(x))
 
1426
                if name is not None)
 
1427
 
 
1428
    @dbus.service.method(dbus.PROPERTIES_IFACE,
 
1429
                         in_signature="ss",
913
1430
                         out_signature="v")
914
1431
    def Get(self, interface_name, property_name):
915
1432
        """Standard D-Bus property Get() method, see D-Bus standard.
921
1438
        if not hasattr(value, "variant_level"):
922
1439
            return value
923
1440
        return type(value)(value, variant_level=value.variant_level+1)
924
 
    
 
1441
 
925
1442
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
926
1443
    def Set(self, interface_name, property_name, value):
927
1444
        """Standard D-Bus property Set() method, see D-Bus standard.
933
1450
            # The byte_arrays option is not supported yet on
934
1451
            # signatures other than "ay".
935
1452
            if prop._dbus_signature != "ay":
936
 
                raise ValueError
937
 
            value = dbus.ByteArray(b''.join(chr(byte)
938
 
                                            for byte in value))
 
1453
                raise ValueError("Byte arrays not supported for non-"
 
1454
                                 "'ay' signature {!r}"
 
1455
                                 .format(prop._dbus_signature))
 
1456
            value = dbus.ByteArray(bytes(value))
939
1457
        prop(value)
940
 
    
941
 
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
 
1458
 
 
1459
    @dbus.service.method(dbus.PROPERTIES_IFACE,
 
1460
                         in_signature="s",
942
1461
                         out_signature="a{sv}")
943
1462
    def GetAll(self, interface_name):
944
1463
        """Standard D-Bus property GetAll() method, see D-Bus
945
1464
        standard.
946
 
        
 
1465
 
947
1466
        Note: Will not include properties with access="write".
948
1467
        """
949
1468
        properties = {}
959
1478
            if not hasattr(value, "variant_level"):
960
1479
                properties[name] = value
961
1480
                continue
962
 
            properties[name] = type(value)(value, variant_level=
963
 
                                           value.variant_level+1)
 
1481
            properties[name] = type(value)(
 
1482
                value, variant_level=value.variant_level + 1)
964
1483
        return dbus.Dictionary(properties, signature="sv")
965
 
    
 
1484
 
 
1485
    @dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")
 
1486
    def PropertiesChanged(self, interface_name, changed_properties,
 
1487
                          invalidated_properties):
 
1488
        """Standard D-Bus PropertiesChanged() signal, see D-Bus
 
1489
        standard.
 
1490
        """
 
1491
        pass
 
1492
 
966
1493
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
967
1494
                         out_signature="s",
968
 
                         path_keyword='object_path',
969
 
                         connection_keyword='connection')
 
1495
                         path_keyword="object_path",
 
1496
                         connection_keyword="connection")
970
1497
    def Introspect(self, object_path, connection):
971
1498
        """Overloading of standard D-Bus method.
972
 
        
 
1499
 
973
1500
        Inserts property tags and interface annotation tags.
974
1501
        """
975
 
        xmlstring = dbus.service.Object.Introspect(self, object_path,
976
 
                                                   connection)
 
1502
        xmlstring = DBusObjectWithAnnotations.Introspect(self,
 
1503
                                                         object_path,
 
1504
                                                         connection)
977
1505
        try:
978
1506
            document = xml.dom.minidom.parseString(xmlstring)
 
1507
 
979
1508
            def make_tag(document, name, prop):
980
1509
                e = document.createElement("property")
981
1510
                e.setAttribute("name", name)
982
1511
                e.setAttribute("type", prop._dbus_signature)
983
1512
                e.setAttribute("access", prop._dbus_access)
984
1513
                return e
 
1514
 
985
1515
            for if_tag in document.getElementsByTagName("interface"):
986
1516
                # Add property tags
987
1517
                for tag in (make_tag(document, name, prop)
990
1520
                            if prop._dbus_interface
991
1521
                            == if_tag.getAttribute("name")):
992
1522
                    if_tag.appendChild(tag)
993
 
                # Add annotation tags
994
 
                for typ in ("method", "signal", "property"):
995
 
                    for tag in if_tag.getElementsByTagName(typ):
996
 
                        annots = dict()
997
 
                        for name, prop in (self.
998
 
                                           _get_all_dbus_things(typ)):
999
 
                            if (name == tag.getAttribute("name")
1000
 
                                and prop._dbus_interface
1001
 
                                == if_tag.getAttribute("name")):
1002
 
                                annots.update(getattr
1003
 
                                              (prop,
1004
 
                                               "_dbus_annotations",
1005
 
                                               {}))
1006
 
                        for name, value in annots.iteritems():
1007
 
                            ann_tag = document.createElement(
1008
 
                                "annotation")
1009
 
                            ann_tag.setAttribute("name", name)
1010
 
                            ann_tag.setAttribute("value", value)
1011
 
                            tag.appendChild(ann_tag)
1012
 
                # Add interface annotation tags
1013
 
                for annotation, value in dict(
1014
 
                    itertools.chain.from_iterable(
1015
 
                        annotations().iteritems()
1016
 
                        for name, annotations in
1017
 
                        self._get_all_dbus_things("interface")
1018
 
                        if name == if_tag.getAttribute("name")
1019
 
                        )).iteritems():
1020
 
                    ann_tag = document.createElement("annotation")
1021
 
                    ann_tag.setAttribute("name", annotation)
1022
 
                    ann_tag.setAttribute("value", value)
1023
 
                    if_tag.appendChild(ann_tag)
 
1523
                # Add annotation tags for properties
 
1524
                for tag in if_tag.getElementsByTagName("property"):
 
1525
                    annots = dict()
 
1526
                    for name, prop in self._get_all_dbus_things(
 
1527
                            "property"):
 
1528
                        if (name == tag.getAttribute("name")
 
1529
                            and prop._dbus_interface
 
1530
                            == if_tag.getAttribute("name")):
 
1531
                            annots.update(getattr(
 
1532
                                prop, "_dbus_annotations", {}))
 
1533
                    for name, value in annots.items():
 
1534
                        ann_tag = document.createElement(
 
1535
                            "annotation")
 
1536
                        ann_tag.setAttribute("name", name)
 
1537
                        ann_tag.setAttribute("value", value)
 
1538
                        tag.appendChild(ann_tag)
1024
1539
                # Add the names to the return values for the
1025
1540
                # "org.freedesktop.DBus.Properties" methods
1026
1541
                if (if_tag.getAttribute("name")
1040
1555
            document.unlink()
1041
1556
        except (AttributeError, xml.dom.DOMException,
1042
1557
                xml.parsers.expat.ExpatError) as error:
1043
 
            logger.error("Failed to override Introspection method",
1044
 
                         exc_info=error)
 
1558
            log.error("Failed to override Introspection method",
 
1559
                      exc_info=error)
 
1560
        return xmlstring
 
1561
 
 
1562
 
 
1563
try:
 
1564
    dbus.OBJECT_MANAGER_IFACE
 
1565
except AttributeError:
 
1566
    dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
 
1567
 
 
1568
 
 
1569
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
 
1570
    """A D-Bus object with an ObjectManager.
 
1571
 
 
1572
    Classes inheriting from this exposes the standard
 
1573
    GetManagedObjects call and the InterfacesAdded and
 
1574
    InterfacesRemoved signals on the standard
 
1575
    "org.freedesktop.DBus.ObjectManager" interface.
 
1576
 
 
1577
    Note: No signals are sent automatically; they must be sent
 
1578
    manually.
 
1579
    """
 
1580
    @dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
 
1581
                         out_signature="a{oa{sa{sv}}}")
 
1582
    def GetManagedObjects(self):
 
1583
        """This function must be overridden"""
 
1584
        raise NotImplementedError()
 
1585
 
 
1586
    @dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
 
1587
                         signature="oa{sa{sv}}")
 
1588
    def InterfacesAdded(self, object_path, interfaces_and_properties):
 
1589
        pass
 
1590
 
 
1591
    @dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature="oas")
 
1592
    def InterfacesRemoved(self, object_path, interfaces):
 
1593
        pass
 
1594
 
 
1595
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
 
1596
                         out_signature="s",
 
1597
                         path_keyword="object_path",
 
1598
                         connection_keyword="connection")
 
1599
    def Introspect(self, object_path, connection):
 
1600
        """Overloading of standard D-Bus method.
 
1601
 
 
1602
        Override return argument name of GetManagedObjects to be
 
1603
        "objpath_interfaces_and_properties"
 
1604
        """
 
1605
        xmlstring = DBusObjectWithAnnotations.Introspect(self,
 
1606
                                                         object_path,
 
1607
                                                         connection)
 
1608
        try:
 
1609
            document = xml.dom.minidom.parseString(xmlstring)
 
1610
 
 
1611
            for if_tag in document.getElementsByTagName("interface"):
 
1612
                # Fix argument name for the GetManagedObjects method
 
1613
                if (if_tag.getAttribute("name")
 
1614
                    == dbus.OBJECT_MANAGER_IFACE):
 
1615
                    for cn in if_tag.getElementsByTagName("method"):
 
1616
                        if (cn.getAttribute("name")
 
1617
                            == "GetManagedObjects"):
 
1618
                            for arg in cn.getElementsByTagName("arg"):
 
1619
                                if (arg.getAttribute("direction")
 
1620
                                    == "out"):
 
1621
                                    arg.setAttribute(
 
1622
                                        "name",
 
1623
                                        "objpath_interfaces"
 
1624
                                        "_and_properties")
 
1625
            xmlstring = document.toxml("utf-8")
 
1626
            document.unlink()
 
1627
        except (AttributeError, xml.dom.DOMException,
 
1628
                xml.parsers.expat.ExpatError) as error:
 
1629
            log.error("Failed to override Introspection method",
 
1630
                      exc_info=error)
1045
1631
        return xmlstring
1046
1632
 
1047
1633
 
1048
1634
def datetime_to_dbus(dt, variant_level=0):
1049
1635
    """Convert a UTC datetime.datetime() to a D-Bus type."""
1050
1636
    if dt is None:
1051
 
        return dbus.String("", variant_level = variant_level)
1052
 
    return dbus.String(dt.isoformat(),
1053
 
                       variant_level=variant_level)
 
1637
        return dbus.String("", variant_level=variant_level)
 
1638
    return dbus.String(dt.isoformat(), variant_level=variant_level)
1054
1639
 
1055
1640
 
1056
1641
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
1058
1643
    dbus.service.Object, it will add alternate D-Bus attributes with
1059
1644
    interface names according to the "alt_interface_names" mapping.
1060
1645
    Usage:
1061
 
    
 
1646
 
1062
1647
    @alternate_dbus_interfaces({"org.example.Interface":
1063
1648
                                    "net.example.AlternateInterface"})
1064
1649
    class SampleDBusObject(dbus.service.Object):
1065
1650
        @dbus.service.method("org.example.Interface")
1066
1651
        def SampleDBusMethod():
1067
1652
            pass
1068
 
    
 
1653
 
1069
1654
    The above "SampleDBusMethod" on "SampleDBusObject" will be
1070
1655
    reachable via two interfaces: "org.example.Interface" and
1071
1656
    "net.example.AlternateInterface", the latter of which will have
1072
1657
    its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
1073
1658
    "true", unless "deprecate" is passed with a False value.
1074
 
    
 
1659
 
1075
1660
    This works for methods and signals, and also for D-Bus properties
1076
1661
    (from DBusObjectWithProperties) and interfaces (from the
1077
1662
    dbus_interface_annotations decorator).
1078
1663
    """
 
1664
 
1079
1665
    def wrapper(cls):
1080
1666
        for orig_interface_name, alt_interface_name in (
1081
 
            alt_interface_names.iteritems()):
 
1667
                alt_interface_names.items()):
1082
1668
            attr = {}
1083
1669
            interface_names = set()
1084
1670
            # Go though all attributes of the class
1086
1672
                # Ignore non-D-Bus attributes, and D-Bus attributes
1087
1673
                # with the wrong interface name
1088
1674
                if (not hasattr(attribute, "_dbus_interface")
1089
 
                    or not attribute._dbus_interface
1090
 
                    .startswith(orig_interface_name)):
 
1675
                    or not attribute._dbus_interface.startswith(
 
1676
                        orig_interface_name)):
1091
1677
                    continue
1092
1678
                # Create an alternate D-Bus interface name based on
1093
1679
                # the current name
1094
 
                alt_interface = (attribute._dbus_interface
1095
 
                                 .replace(orig_interface_name,
1096
 
                                          alt_interface_name))
 
1680
                alt_interface = attribute._dbus_interface.replace(
 
1681
                    orig_interface_name, alt_interface_name)
1097
1682
                interface_names.add(alt_interface)
1098
1683
                # Is this a D-Bus signal?
1099
1684
                if getattr(attribute, "_dbus_is_signal", False):
1100
1685
                    # Extract the original non-method undecorated
1101
1686
                    # function by black magic
1102
 
                    nonmethod_func = (dict(
 
1687
                    if sys.version_info.major == 2:
 
1688
                        nonmethod_func = (dict(
1103
1689
                            zip(attribute.func_code.co_freevars,
1104
 
                                attribute.__closure__))["func"]
1105
 
                                      .cell_contents)
 
1690
                                attribute.__closure__))
 
1691
                                          ["func"].cell_contents)
 
1692
                    else:
 
1693
                        nonmethod_func = (dict(
 
1694
                            zip(attribute.__code__.co_freevars,
 
1695
                                attribute.__closure__))
 
1696
                                          ["func"].cell_contents)
1106
1697
                    # Create a new, but exactly alike, function
1107
1698
                    # object, and decorate it to be a new D-Bus signal
1108
1699
                    # with the alternate D-Bus interface name
1109
 
                    new_function = (dbus.service.signal
1110
 
                                    (alt_interface,
1111
 
                                     attribute._dbus_signature)
1112
 
                                    (types.FunctionType(
1113
 
                                nonmethod_func.func_code,
1114
 
                                nonmethod_func.func_globals,
1115
 
                                nonmethod_func.func_name,
1116
 
                                nonmethod_func.func_defaults,
1117
 
                                nonmethod_func.func_closure)))
 
1700
                    new_function = copy_function(nonmethod_func)
 
1701
                    new_function = (dbus.service.signal(
 
1702
                        alt_interface,
 
1703
                        attribute._dbus_signature)(new_function))
1118
1704
                    # Copy annotations, if any
1119
1705
                    try:
1120
 
                        new_function._dbus_annotations = (
1121
 
                            dict(attribute._dbus_annotations))
 
1706
                        new_function._dbus_annotations = dict(
 
1707
                            attribute._dbus_annotations)
1122
1708
                    except AttributeError:
1123
1709
                        pass
 
1710
 
1124
1711
                    # Define a creator of a function to call both the
1125
1712
                    # original and alternate functions, so both the
1126
1713
                    # original and alternate signals gets sent when
1129
1716
                        """This function is a scope container to pass
1130
1717
                        func1 and func2 to the "call_both" function
1131
1718
                        outside of its arguments"""
 
1719
 
 
1720
                        @functools.wraps(func2)
1132
1721
                        def call_both(*args, **kwargs):
1133
1722
                            """This function will emit two D-Bus
1134
1723
                            signals by calling func1 and func2"""
1135
1724
                            func1(*args, **kwargs)
1136
1725
                            func2(*args, **kwargs)
 
1726
                        # Make wrapper function look like a D-Bus
 
1727
                        # signal
 
1728
                        for name, attr in inspect.getmembers(func2):
 
1729
                            if name.startswith("_dbus_"):
 
1730
                                setattr(call_both, name, attr)
 
1731
 
1137
1732
                        return call_both
1138
1733
                    # Create the "call_both" function and add it to
1139
1734
                    # the class
1144
1739
                    # object.  Decorate it to be a new D-Bus method
1145
1740
                    # with the alternate D-Bus interface name.  Add it
1146
1741
                    # to the class.
1147
 
                    attr[attrname] = (dbus.service.method
1148
 
                                      (alt_interface,
1149
 
                                       attribute._dbus_in_signature,
1150
 
                                       attribute._dbus_out_signature)
1151
 
                                      (types.FunctionType
1152
 
                                       (attribute.func_code,
1153
 
                                        attribute.func_globals,
1154
 
                                        attribute.func_name,
1155
 
                                        attribute.func_defaults,
1156
 
                                        attribute.func_closure)))
 
1742
                    attr[attrname] = (
 
1743
                        dbus.service.method(
 
1744
                            alt_interface,
 
1745
                            attribute._dbus_in_signature,
 
1746
                            attribute._dbus_out_signature)
 
1747
                        (copy_function(attribute)))
1157
1748
                    # Copy annotations, if any
1158
1749
                    try:
1159
 
                        attr[attrname]._dbus_annotations = (
1160
 
                            dict(attribute._dbus_annotations))
 
1750
                        attr[attrname]._dbus_annotations = dict(
 
1751
                            attribute._dbus_annotations)
1161
1752
                    except AttributeError:
1162
1753
                        pass
1163
1754
                # Is this a D-Bus property?
1166
1757
                    # object, and decorate it to be a new D-Bus
1167
1758
                    # property with the alternate D-Bus interface
1168
1759
                    # name.  Add it to the class.
1169
 
                    attr[attrname] = (dbus_service_property
1170
 
                                      (alt_interface,
1171
 
                                       attribute._dbus_signature,
1172
 
                                       attribute._dbus_access,
1173
 
                                       attribute
1174
 
                                       ._dbus_get_args_options
1175
 
                                       ["byte_arrays"])
1176
 
                                      (types.FunctionType
1177
 
                                       (attribute.func_code,
1178
 
                                        attribute.func_globals,
1179
 
                                        attribute.func_name,
1180
 
                                        attribute.func_defaults,
1181
 
                                        attribute.func_closure)))
 
1760
                    attr[attrname] = (dbus_service_property(
 
1761
                        alt_interface, attribute._dbus_signature,
 
1762
                        attribute._dbus_access,
 
1763
                        attribute._dbus_get_args_options
 
1764
                        ["byte_arrays"])
 
1765
                                      (copy_function(attribute)))
1182
1766
                    # Copy annotations, if any
1183
1767
                    try:
1184
 
                        attr[attrname]._dbus_annotations = (
1185
 
                            dict(attribute._dbus_annotations))
 
1768
                        attr[attrname]._dbus_annotations = dict(
 
1769
                            attribute._dbus_annotations)
1186
1770
                    except AttributeError:
1187
1771
                        pass
1188
1772
                # Is this a D-Bus interface?
1191
1775
                    # object.  Decorate it to be a new D-Bus interface
1192
1776
                    # with the alternate D-Bus interface name.  Add it
1193
1777
                    # to the class.
1194
 
                    attr[attrname] = (dbus_interface_annotations
1195
 
                                      (alt_interface)
1196
 
                                      (types.FunctionType
1197
 
                                       (attribute.func_code,
1198
 
                                        attribute.func_globals,
1199
 
                                        attribute.func_name,
1200
 
                                        attribute.func_defaults,
1201
 
                                        attribute.func_closure)))
 
1778
                    attr[attrname] = (
 
1779
                        dbus_interface_annotations(alt_interface)
 
1780
                        (copy_function(attribute)))
1202
1781
            if deprecate:
1203
1782
                # Deprecate all alternate interfaces
1204
 
                iname="_AlternateDBusNames_interface_annotation{0}"
 
1783
                iname = "_AlternateDBusNames_interface_annotation{}"
1205
1784
                for interface_name in interface_names:
 
1785
 
1206
1786
                    @dbus_interface_annotations(interface_name)
1207
1787
                    def func(self):
1208
 
                        return { "org.freedesktop.DBus.Deprecated":
1209
 
                                     "true" }
 
1788
                        return {"org.freedesktop.DBus.Deprecated":
 
1789
                                "true"}
1210
1790
                    # Find an unused name
1211
1791
                    for aname in (iname.format(i)
1212
1792
                                  for i in itertools.count()):
1216
1796
            if interface_names:
1217
1797
                # Replace the class with a new subclass of it with
1218
1798
                # methods, signals, etc. as created above.
1219
 
                cls = type(b"{0}Alternate".format(cls.__name__),
1220
 
                           (cls,), attr)
 
1799
                if sys.version_info.major == 2:
 
1800
                    cls = type(b"{}Alternate".format(cls.__name__),
 
1801
                               (cls, ), attr)
 
1802
                else:
 
1803
                    cls = type("{}Alternate".format(cls.__name__),
 
1804
                               (cls, ), attr)
1221
1805
        return cls
 
1806
 
1222
1807
    return wrapper
1223
1808
 
1224
1809
 
1225
1810
@alternate_dbus_interfaces({"se.recompile.Mandos":
1226
 
                                "se.bsnet.fukt.Mandos"})
 
1811
                            "se.bsnet.fukt.Mandos"})
1227
1812
class ClientDBus(Client, DBusObjectWithProperties):
1228
1813
    """A Client class using D-Bus
1229
 
    
 
1814
 
1230
1815
    Attributes:
1231
1816
    dbus_object_path: dbus.ObjectPath
1232
1817
    bus: dbus.SystemBus()
1233
1818
    """
1234
 
    
 
1819
 
1235
1820
    runtime_expansions = (Client.runtime_expansions
1236
 
                          + ("dbus_object_path",))
1237
 
    
 
1821
                          + ("dbus_object_path", ))
 
1822
 
 
1823
    _interface = "se.recompile.Mandos.Client"
 
1824
 
1238
1825
    # dbus.service.Object doesn't use super(), so we can't either.
1239
 
    
1240
 
    def __init__(self, bus = None, *args, **kwargs):
 
1826
 
 
1827
    def __init__(self, bus=None, *args, **kwargs):
1241
1828
        self.bus = bus
1242
1829
        Client.__init__(self, *args, **kwargs)
1243
1830
        # Only now, when this client is initialized, can it show up on
1244
1831
        # the D-Bus
1245
 
        client_object_name = unicode(self.name).translate(
 
1832
        client_object_name = str(self.name).translate(
1246
1833
            {ord("."): ord("_"),
1247
1834
             ord("-"): ord("_")})
1248
 
        self.dbus_object_path = (dbus.ObjectPath
1249
 
                                 ("/clients/" + client_object_name))
 
1835
        self.dbus_object_path = dbus.ObjectPath(
 
1836
            "/clients/" + client_object_name)
1250
1837
        DBusObjectWithProperties.__init__(self, self.bus,
1251
1838
                                          self.dbus_object_path)
1252
 
    
1253
 
    def notifychangeproperty(transform_func,
1254
 
                             dbus_name, type_func=lambda x: x,
1255
 
                             variant_level=1):
 
1839
 
 
1840
    def notifychangeproperty(transform_func, dbus_name,
 
1841
                             type_func=lambda x: x,
 
1842
                             variant_level=1,
 
1843
                             invalidate_only=False,
 
1844
                             _interface=_interface):
1256
1845
        """ Modify a variable so that it's a property which announces
1257
1846
        its changes to DBus.
1258
 
        
 
1847
 
1259
1848
        transform_fun: Function that takes a value and a variant_level
1260
1849
                       and transforms it to a D-Bus type.
1261
1850
        dbus_name: D-Bus name of the variable
1263
1852
                   to the D-Bus.  Default: no transform
1264
1853
        variant_level: D-Bus variant level.  Default: 1
1265
1854
        """
1266
 
        attrname = "_{0}".format(dbus_name)
 
1855
        attrname = "_{}".format(dbus_name)
 
1856
 
1267
1857
        def setter(self, value):
1268
1858
            if hasattr(self, "dbus_object_path"):
1269
1859
                if (not hasattr(self, attrname) or
1270
1860
                    type_func(getattr(self, attrname, None))
1271
1861
                    != type_func(value)):
1272
 
                    dbus_value = transform_func(type_func(value),
1273
 
                                                variant_level
1274
 
                                                =variant_level)
1275
 
                    self.PropertyChanged(dbus.String(dbus_name),
1276
 
                                         dbus_value)
 
1862
                    if invalidate_only:
 
1863
                        self.PropertiesChanged(
 
1864
                            _interface, dbus.Dictionary(),
 
1865
                            dbus.Array((dbus_name, )))
 
1866
                    else:
 
1867
                        dbus_value = transform_func(
 
1868
                            type_func(value),
 
1869
                            variant_level=variant_level)
 
1870
                        self.PropertyChanged(dbus.String(dbus_name),
 
1871
                                             dbus_value)
 
1872
                        self.PropertiesChanged(
 
1873
                            _interface,
 
1874
                            dbus.Dictionary({dbus.String(dbus_name):
 
1875
                                             dbus_value}),
 
1876
                            dbus.Array())
1277
1877
            setattr(self, attrname, value)
1278
 
        
 
1878
 
1279
1879
        return property(lambda self: getattr(self, attrname), setter)
1280
 
    
 
1880
 
1281
1881
    expires = notifychangeproperty(datetime_to_dbus, "Expires")
1282
1882
    approvals_pending = notifychangeproperty(dbus.Boolean,
1283
1883
                                             "ApprovalPending",
1284
 
                                             type_func = bool)
 
1884
                                             type_func=bool)
1285
1885
    enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1286
1886
    last_enabled = notifychangeproperty(datetime_to_dbus,
1287
1887
                                        "LastEnabled")
1288
 
    checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",
1289
 
                                   type_func = lambda checker:
1290
 
                                       checker is not None)
 
1888
    checker = notifychangeproperty(
 
1889
        dbus.Boolean, "CheckerRunning",
 
1890
        type_func=lambda checker: checker is not None)
1291
1891
    last_checked_ok = notifychangeproperty(datetime_to_dbus,
1292
1892
                                           "LastCheckedOK")
1293
1893
    last_checker_status = notifychangeproperty(dbus.Int16,
1296
1896
        datetime_to_dbus, "LastApprovalRequest")
1297
1897
    approved_by_default = notifychangeproperty(dbus.Boolean,
1298
1898
                                               "ApprovedByDefault")
1299
 
    approval_delay = notifychangeproperty(dbus.UInt64,
1300
 
                                          "ApprovalDelay",
1301
 
                                          type_func =
1302
 
                                          timedelta_to_milliseconds)
 
1899
    approval_delay = notifychangeproperty(
 
1900
        dbus.UInt64, "ApprovalDelay",
 
1901
        type_func=lambda td: td.total_seconds() * 1000)
1303
1902
    approval_duration = notifychangeproperty(
1304
1903
        dbus.UInt64, "ApprovalDuration",
1305
 
        type_func = timedelta_to_milliseconds)
 
1904
        type_func=lambda td: td.total_seconds() * 1000)
1306
1905
    host = notifychangeproperty(dbus.String, "Host")
1307
 
    timeout = notifychangeproperty(dbus.UInt64, "Timeout",
1308
 
                                   type_func =
1309
 
                                   timedelta_to_milliseconds)
 
1906
    timeout = notifychangeproperty(
 
1907
        dbus.UInt64, "Timeout",
 
1908
        type_func=lambda td: td.total_seconds() * 1000)
1310
1909
    extended_timeout = notifychangeproperty(
1311
1910
        dbus.UInt64, "ExtendedTimeout",
1312
 
        type_func = timedelta_to_milliseconds)
1313
 
    interval = notifychangeproperty(dbus.UInt64,
1314
 
                                    "Interval",
1315
 
                                    type_func =
1316
 
                                    timedelta_to_milliseconds)
 
1911
        type_func=lambda td: td.total_seconds() * 1000)
 
1912
    interval = notifychangeproperty(
 
1913
        dbus.UInt64, "Interval",
 
1914
        type_func=lambda td: td.total_seconds() * 1000)
1317
1915
    checker_command = notifychangeproperty(dbus.String, "Checker")
1318
 
    
 
1916
    secret = notifychangeproperty(dbus.ByteArray, "Secret",
 
1917
                                  invalidate_only=True)
 
1918
 
1319
1919
    del notifychangeproperty
1320
 
    
 
1920
 
1321
1921
    def __del__(self, *args, **kwargs):
1322
1922
        try:
1323
1923
            self.remove_from_connection()
1326
1926
        if hasattr(DBusObjectWithProperties, "__del__"):
1327
1927
            DBusObjectWithProperties.__del__(self, *args, **kwargs)
1328
1928
        Client.__del__(self, *args, **kwargs)
1329
 
    
1330
 
    def checker_callback(self, pid, condition, command,
1331
 
                         *args, **kwargs):
1332
 
        self.checker_callback_tag = None
1333
 
        self.checker = None
1334
 
        if os.WIFEXITED(condition):
1335
 
            exitstatus = os.WEXITSTATUS(condition)
 
1929
 
 
1930
    def checker_callback(self, source, condition,
 
1931
                         connection, command, *args, **kwargs):
 
1932
        ret = Client.checker_callback(self, source, condition,
 
1933
                                      connection, command, *args,
 
1934
                                      **kwargs)
 
1935
        exitstatus = self.last_checker_status
 
1936
        if exitstatus >= 0:
1336
1937
            # Emit D-Bus signal
1337
1938
            self.CheckerCompleted(dbus.Int16(exitstatus),
1338
 
                                  dbus.Int64(condition),
 
1939
                                  # This is specific to GNU libC
 
1940
                                  dbus.Int64(exitstatus << 8),
1339
1941
                                  dbus.String(command))
1340
1942
        else:
1341
1943
            # Emit D-Bus signal
1342
1944
            self.CheckerCompleted(dbus.Int16(-1),
1343
 
                                  dbus.Int64(condition),
 
1945
                                  dbus.Int64(
 
1946
                                      # This is specific to GNU libC
 
1947
                                      (exitstatus << 8)
 
1948
                                      | self.last_checker_signal),
1344
1949
                                  dbus.String(command))
1345
 
        
1346
 
        return Client.checker_callback(self, pid, condition, command,
1347
 
                                       *args, **kwargs)
1348
 
    
 
1950
        return ret
 
1951
 
1349
1952
    def start_checker(self, *args, **kwargs):
1350
 
        old_checker = self.checker
1351
 
        if self.checker is not None:
1352
 
            old_checker_pid = self.checker.pid
1353
 
        else:
1354
 
            old_checker_pid = None
 
1953
        old_checker_pid = getattr(self.checker, "pid", None)
1355
1954
        r = Client.start_checker(self, *args, **kwargs)
1356
1955
        # Only if new checker process was started
1357
1956
        if (self.checker is not None
1359
1958
            # Emit D-Bus signal
1360
1959
            self.CheckerStarted(self.current_checker_command)
1361
1960
        return r
1362
 
    
 
1961
 
1363
1962
    def _reset_approved(self):
1364
1963
        self.approved = None
1365
1964
        return False
1366
 
    
 
1965
 
1367
1966
    def approve(self, value=True):
1368
1967
        self.approved = value
1369
 
        gobject.timeout_add(timedelta_to_milliseconds
1370
 
                            (self.approval_duration),
1371
 
                            self._reset_approved)
 
1968
        GLib.timeout_add(int(self.approval_duration.total_seconds()
 
1969
                             * 1000), self._reset_approved)
1372
1970
        self.send_changedstate()
1373
 
    
1374
 
    ## D-Bus methods, signals & properties
1375
 
    _interface = "se.recompile.Mandos.Client"
1376
 
    
1377
 
    ## Interfaces
1378
 
    
1379
 
    @dbus_interface_annotations(_interface)
1380
 
    def _foo(self):
1381
 
        return { "org.freedesktop.DBus.Property.EmitsChangedSignal":
1382
 
                     "false"}
1383
 
    
1384
 
    ## Signals
1385
 
    
 
1971
 
 
1972
    #  D-Bus methods, signals & properties
 
1973
 
 
1974
    #  Interfaces
 
1975
 
 
1976
    #  Signals
 
1977
 
1386
1978
    # CheckerCompleted - signal
1387
1979
    @dbus.service.signal(_interface, signature="nxs")
1388
1980
    def CheckerCompleted(self, exitcode, waitstatus, command):
1389
1981
        "D-Bus signal"
1390
1982
        pass
1391
 
    
 
1983
 
1392
1984
    # CheckerStarted - signal
1393
1985
    @dbus.service.signal(_interface, signature="s")
1394
1986
    def CheckerStarted(self, command):
1395
1987
        "D-Bus signal"
1396
1988
        pass
1397
 
    
 
1989
 
1398
1990
    # PropertyChanged - signal
 
1991
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1399
1992
    @dbus.service.signal(_interface, signature="sv")
1400
1993
    def PropertyChanged(self, property, value):
1401
1994
        "D-Bus signal"
1402
1995
        pass
1403
 
    
 
1996
 
1404
1997
    # GotSecret - signal
1405
1998
    @dbus.service.signal(_interface)
1406
1999
    def GotSecret(self):
1409
2002
        server to mandos-client
1410
2003
        """
1411
2004
        pass
1412
 
    
 
2005
 
1413
2006
    # Rejected - signal
1414
2007
    @dbus.service.signal(_interface, signature="s")
1415
2008
    def Rejected(self, reason):
1416
2009
        "D-Bus signal"
1417
2010
        pass
1418
 
    
 
2011
 
1419
2012
    # NeedApproval - signal
1420
2013
    @dbus.service.signal(_interface, signature="tb")
1421
2014
    def NeedApproval(self, timeout, default):
1422
2015
        "D-Bus signal"
1423
2016
        return self.need_approval()
1424
 
    
1425
 
    ## Methods
1426
 
    
 
2017
 
 
2018
    #  Methods
 
2019
 
1427
2020
    # Approve - method
1428
2021
    @dbus.service.method(_interface, in_signature="b")
1429
2022
    def Approve(self, value):
1430
2023
        self.approve(value)
1431
 
    
 
2024
 
1432
2025
    # CheckedOK - method
1433
2026
    @dbus.service.method(_interface)
1434
2027
    def CheckedOK(self):
1435
2028
        self.checked_ok()
1436
 
    
 
2029
 
1437
2030
    # Enable - method
 
2031
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1438
2032
    @dbus.service.method(_interface)
1439
2033
    def Enable(self):
1440
2034
        "D-Bus method"
1441
2035
        self.enable()
1442
 
    
 
2036
 
1443
2037
    # StartChecker - method
 
2038
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1444
2039
    @dbus.service.method(_interface)
1445
2040
    def StartChecker(self):
1446
2041
        "D-Bus method"
1447
2042
        self.start_checker()
1448
 
    
 
2043
 
1449
2044
    # Disable - method
 
2045
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1450
2046
    @dbus.service.method(_interface)
1451
2047
    def Disable(self):
1452
2048
        "D-Bus method"
1453
2049
        self.disable()
1454
 
    
 
2050
 
1455
2051
    # StopChecker - method
 
2052
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1456
2053
    @dbus.service.method(_interface)
1457
2054
    def StopChecker(self):
1458
2055
        self.stop_checker()
1459
 
    
1460
 
    ## Properties
1461
 
    
 
2056
 
 
2057
    #  Properties
 
2058
 
1462
2059
    # ApprovalPending - property
1463
2060
    @dbus_service_property(_interface, signature="b", access="read")
1464
2061
    def ApprovalPending_dbus_property(self):
1465
2062
        return dbus.Boolean(bool(self.approvals_pending))
1466
 
    
 
2063
 
1467
2064
    # ApprovedByDefault - property
1468
 
    @dbus_service_property(_interface, signature="b",
 
2065
    @dbus_service_property(_interface,
 
2066
                           signature="b",
1469
2067
                           access="readwrite")
1470
2068
    def ApprovedByDefault_dbus_property(self, value=None):
1471
2069
        if value is None:       # get
1472
2070
            return dbus.Boolean(self.approved_by_default)
1473
2071
        self.approved_by_default = bool(value)
1474
 
    
 
2072
 
1475
2073
    # ApprovalDelay - property
1476
 
    @dbus_service_property(_interface, signature="t",
 
2074
    @dbus_service_property(_interface,
 
2075
                           signature="t",
1477
2076
                           access="readwrite")
1478
2077
    def ApprovalDelay_dbus_property(self, value=None):
1479
2078
        if value is None:       # get
1480
 
            return dbus.UInt64(self.approval_delay_milliseconds())
 
2079
            return dbus.UInt64(self.approval_delay.total_seconds()
 
2080
                               * 1000)
1481
2081
        self.approval_delay = datetime.timedelta(0, 0, 0, value)
1482
 
    
 
2082
 
1483
2083
    # ApprovalDuration - property
1484
 
    @dbus_service_property(_interface, signature="t",
 
2084
    @dbus_service_property(_interface,
 
2085
                           signature="t",
1485
2086
                           access="readwrite")
1486
2087
    def ApprovalDuration_dbus_property(self, value=None):
1487
2088
        if value is None:       # get
1488
 
            return dbus.UInt64(timedelta_to_milliseconds(
1489
 
                    self.approval_duration))
 
2089
            return dbus.UInt64(self.approval_duration.total_seconds()
 
2090
                               * 1000)
1490
2091
        self.approval_duration = datetime.timedelta(0, 0, 0, value)
1491
 
    
 
2092
 
1492
2093
    # Name - property
 
2094
    @dbus_annotations(
 
2095
        {"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1493
2096
    @dbus_service_property(_interface, signature="s", access="read")
1494
2097
    def Name_dbus_property(self):
1495
2098
        return dbus.String(self.name)
1496
 
    
 
2099
 
 
2100
    # KeyID - property
 
2101
    @dbus_annotations(
 
2102
        {"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
 
2103
    @dbus_service_property(_interface, signature="s", access="read")
 
2104
    def KeyID_dbus_property(self):
 
2105
        return dbus.String(self.key_id)
 
2106
 
1497
2107
    # Fingerprint - property
 
2108
    @dbus_annotations(
 
2109
        {"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1498
2110
    @dbus_service_property(_interface, signature="s", access="read")
1499
2111
    def Fingerprint_dbus_property(self):
1500
2112
        return dbus.String(self.fingerprint)
1501
 
    
 
2113
 
1502
2114
    # Host - property
1503
 
    @dbus_service_property(_interface, signature="s",
 
2115
    @dbus_service_property(_interface,
 
2116
                           signature="s",
1504
2117
                           access="readwrite")
1505
2118
    def Host_dbus_property(self, value=None):
1506
2119
        if value is None:       # get
1507
2120
            return dbus.String(self.host)
1508
 
        self.host = unicode(value)
1509
 
    
 
2121
        self.host = str(value)
 
2122
 
1510
2123
    # Created - property
 
2124
    @dbus_annotations(
 
2125
        {"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1511
2126
    @dbus_service_property(_interface, signature="s", access="read")
1512
2127
    def Created_dbus_property(self):
1513
2128
        return datetime_to_dbus(self.created)
1514
 
    
 
2129
 
1515
2130
    # LastEnabled - property
1516
2131
    @dbus_service_property(_interface, signature="s", access="read")
1517
2132
    def LastEnabled_dbus_property(self):
1518
2133
        return datetime_to_dbus(self.last_enabled)
1519
 
    
 
2134
 
1520
2135
    # Enabled - property
1521
 
    @dbus_service_property(_interface, signature="b",
 
2136
    @dbus_service_property(_interface,
 
2137
                           signature="b",
1522
2138
                           access="readwrite")
1523
2139
    def Enabled_dbus_property(self, value=None):
1524
2140
        if value is None:       # get
1527
2143
            self.enable()
1528
2144
        else:
1529
2145
            self.disable()
1530
 
    
 
2146
 
1531
2147
    # LastCheckedOK - property
1532
 
    @dbus_service_property(_interface, signature="s",
 
2148
    @dbus_service_property(_interface,
 
2149
                           signature="s",
1533
2150
                           access="readwrite")
1534
2151
    def LastCheckedOK_dbus_property(self, value=None):
1535
2152
        if value is not None:
1536
2153
            self.checked_ok()
1537
2154
            return
1538
2155
        return datetime_to_dbus(self.last_checked_ok)
1539
 
    
 
2156
 
1540
2157
    # LastCheckerStatus - property
1541
 
    @dbus_service_property(_interface, signature="n",
1542
 
                           access="read")
 
2158
    @dbus_service_property(_interface, signature="n", access="read")
1543
2159
    def LastCheckerStatus_dbus_property(self):
1544
2160
        return dbus.Int16(self.last_checker_status)
1545
 
    
 
2161
 
1546
2162
    # Expires - property
1547
2163
    @dbus_service_property(_interface, signature="s", access="read")
1548
2164
    def Expires_dbus_property(self):
1549
2165
        return datetime_to_dbus(self.expires)
1550
 
    
 
2166
 
1551
2167
    # LastApprovalRequest - property
1552
2168
    @dbus_service_property(_interface, signature="s", access="read")
1553
2169
    def LastApprovalRequest_dbus_property(self):
1554
2170
        return datetime_to_dbus(self.last_approval_request)
1555
 
    
 
2171
 
1556
2172
    # Timeout - property
1557
 
    @dbus_service_property(_interface, signature="t",
 
2173
    @dbus_service_property(_interface,
 
2174
                           signature="t",
1558
2175
                           access="readwrite")
1559
2176
    def Timeout_dbus_property(self, value=None):
1560
2177
        if value is None:       # get
1561
 
            return dbus.UInt64(self.timeout_milliseconds())
 
2178
            return dbus.UInt64(self.timeout.total_seconds() * 1000)
1562
2179
        old_timeout = self.timeout
1563
2180
        self.timeout = datetime.timedelta(0, 0, 0, value)
1564
2181
        # Reschedule disabling
1572
2189
                if (getattr(self, "disable_initiator_tag", None)
1573
2190
                    is None):
1574
2191
                    return
1575
 
                gobject.source_remove(self.disable_initiator_tag)
1576
 
                self.disable_initiator_tag = (
1577
 
                    gobject.timeout_add(
1578
 
                        timedelta_to_milliseconds(self.expires - now),
1579
 
                        self.disable))
1580
 
    
 
2192
                GLib.source_remove(self.disable_initiator_tag)
 
2193
                self.disable_initiator_tag = GLib.timeout_add(
 
2194
                    int((self.expires - now).total_seconds() * 1000),
 
2195
                    self.disable)
 
2196
 
1581
2197
    # ExtendedTimeout - property
1582
 
    @dbus_service_property(_interface, signature="t",
 
2198
    @dbus_service_property(_interface,
 
2199
                           signature="t",
1583
2200
                           access="readwrite")
1584
2201
    def ExtendedTimeout_dbus_property(self, value=None):
1585
2202
        if value is None:       # get
1586
 
            return dbus.UInt64(self.extended_timeout_milliseconds())
 
2203
            return dbus.UInt64(self.extended_timeout.total_seconds()
 
2204
                               * 1000)
1587
2205
        self.extended_timeout = datetime.timedelta(0, 0, 0, value)
1588
 
    
 
2206
 
1589
2207
    # Interval - property
1590
 
    @dbus_service_property(_interface, signature="t",
 
2208
    @dbus_service_property(_interface,
 
2209
                           signature="t",
1591
2210
                           access="readwrite")
1592
2211
    def Interval_dbus_property(self, value=None):
1593
2212
        if value is None:       # get
1594
 
            return dbus.UInt64(self.interval_milliseconds())
 
2213
            return dbus.UInt64(self.interval.total_seconds() * 1000)
1595
2214
        self.interval = datetime.timedelta(0, 0, 0, value)
1596
2215
        if getattr(self, "checker_initiator_tag", None) is None:
1597
2216
            return
1598
2217
        if self.enabled:
1599
2218
            # Reschedule checker run
1600
 
            gobject.source_remove(self.checker_initiator_tag)
1601
 
            self.checker_initiator_tag = (gobject.timeout_add
1602
 
                                          (value, self.start_checker))
1603
 
            self.start_checker()    # Start one now, too
1604
 
    
 
2219
            GLib.source_remove(self.checker_initiator_tag)
 
2220
            self.checker_initiator_tag = GLib.timeout_add(
 
2221
                value, self.start_checker)
 
2222
            self.start_checker()  # Start one now, too
 
2223
 
1605
2224
    # Checker - property
1606
 
    @dbus_service_property(_interface, signature="s",
 
2225
    @dbus_service_property(_interface,
 
2226
                           signature="s",
1607
2227
                           access="readwrite")
1608
2228
    def Checker_dbus_property(self, value=None):
1609
2229
        if value is None:       # get
1610
2230
            return dbus.String(self.checker_command)
1611
 
        self.checker_command = unicode(value)
1612
 
    
 
2231
        self.checker_command = str(value)
 
2232
 
1613
2233
    # CheckerRunning - property
1614
 
    @dbus_service_property(_interface, signature="b",
 
2234
    @dbus_service_property(_interface,
 
2235
                           signature="b",
1615
2236
                           access="readwrite")
1616
2237
    def CheckerRunning_dbus_property(self, value=None):
1617
2238
        if value is None:       # get
1620
2241
            self.start_checker()
1621
2242
        else:
1622
2243
            self.stop_checker()
1623
 
    
 
2244
 
1624
2245
    # ObjectPath - property
 
2246
    @dbus_annotations(
 
2247
        {"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",
 
2248
         "org.freedesktop.DBus.Deprecated": "true"})
1625
2249
    @dbus_service_property(_interface, signature="o", access="read")
1626
2250
    def ObjectPath_dbus_property(self):
1627
 
        return self.dbus_object_path # is already a dbus.ObjectPath
1628
 
    
 
2251
        return self.dbus_object_path  # is already a dbus.ObjectPath
 
2252
 
1629
2253
    # Secret = property
1630
 
    @dbus_service_property(_interface, signature="ay",
1631
 
                           access="write", byte_arrays=True)
 
2254
    @dbus_annotations(
 
2255
        {"org.freedesktop.DBus.Property.EmitsChangedSignal":
 
2256
         "invalidates"})
 
2257
    @dbus_service_property(_interface,
 
2258
                           signature="ay",
 
2259
                           access="write",
 
2260
                           byte_arrays=True)
1632
2261
    def Secret_dbus_property(self, value):
1633
 
        self.secret = str(value)
1634
 
    
 
2262
        self.secret = bytes(value)
 
2263
 
1635
2264
    del _interface
1636
2265
 
1637
2266
 
1638
 
class ProxyClient(object):
1639
 
    def __init__(self, child_pipe, fpr, address):
 
2267
class ProxyClient:
 
2268
    def __init__(self, child_pipe, key_id, fpr, address):
1640
2269
        self._pipe = child_pipe
1641
 
        self._pipe.send(('init', fpr, address))
 
2270
        self._pipe.send(("init", key_id, fpr, address))
1642
2271
        if not self._pipe.recv():
1643
 
            raise KeyError()
1644
 
    
 
2272
            raise KeyError(key_id or fpr)
 
2273
 
1645
2274
    def __getattribute__(self, name):
1646
 
        if name == '_pipe':
 
2275
        if name == "_pipe":
1647
2276
            return super(ProxyClient, self).__getattribute__(name)
1648
 
        self._pipe.send(('getattr', name))
 
2277
        self._pipe.send(("getattr", name))
1649
2278
        data = self._pipe.recv()
1650
 
        if data[0] == 'data':
 
2279
        if data[0] == "data":
1651
2280
            return data[1]
1652
 
        if data[0] == 'function':
 
2281
        if data[0] == "function":
 
2282
 
1653
2283
            def func(*args, **kwargs):
1654
 
                self._pipe.send(('funcall', name, args, kwargs))
 
2284
                self._pipe.send(("funcall", name, args, kwargs))
1655
2285
                return self._pipe.recv()[1]
 
2286
 
1656
2287
            return func
1657
 
    
 
2288
 
1658
2289
    def __setattr__(self, name, value):
1659
 
        if name == '_pipe':
 
2290
        if name == "_pipe":
1660
2291
            return super(ProxyClient, self).__setattr__(name, value)
1661
 
        self._pipe.send(('setattr', name, value))
 
2292
        self._pipe.send(("setattr", name, value))
1662
2293
 
1663
2294
 
1664
2295
class ClientHandler(socketserver.BaseRequestHandler, object):
1665
2296
    """A class to handle client connections.
1666
 
    
 
2297
 
1667
2298
    Instantiated once for each connection to handle it.
1668
2299
    Note: This will run in its own forked process."""
1669
 
    
 
2300
 
1670
2301
    def handle(self):
1671
2302
        with contextlib.closing(self.server.child_pipe) as child_pipe:
1672
 
            logger.info("TCP connection from: %s",
1673
 
                        unicode(self.client_address))
1674
 
            logger.debug("Pipe FD: %d",
1675
 
                         self.server.child_pipe.fileno())
1676
 
            
1677
 
            session = (gnutls.connection
1678
 
                       .ClientSession(self.request,
1679
 
                                      gnutls.connection
1680
 
                                      .X509Credentials()))
1681
 
            
1682
 
            # Note: gnutls.connection.X509Credentials is really a
1683
 
            # generic GnuTLS certificate credentials object so long as
1684
 
            # no X.509 keys are added to it.  Therefore, we can use it
1685
 
            # here despite using OpenPGP certificates.
1686
 
            
1687
 
            #priority = ':'.join(("NONE", "+VERS-TLS1.1",
1688
 
            #                      "+AES-256-CBC", "+SHA1",
1689
 
            #                      "+COMP-NULL", "+CTYPE-OPENPGP",
1690
 
            #                      "+DHE-DSS"))
 
2303
            log.info("TCP connection from: %s",
 
2304
                     str(self.client_address))
 
2305
            log.debug("Pipe FD: %d", self.server.child_pipe.fileno())
 
2306
 
 
2307
            session = gnutls.ClientSession(self.request)
 
2308
 
 
2309
            # priority = ":".join(("NONE", "+VERS-TLS1.1",
 
2310
            #                       "+AES-256-CBC", "+SHA1",
 
2311
            #                       "+COMP-NULL", "+CTYPE-OPENPGP",
 
2312
            #                       "+DHE-DSS"))
1691
2313
            # Use a fallback default, since this MUST be set.
1692
2314
            priority = self.server.gnutls_priority
1693
2315
            if priority is None:
1694
2316
                priority = "NORMAL"
1695
 
            (gnutls.library.functions
1696
 
             .gnutls_priority_set_direct(session._c_object,
1697
 
                                         priority, None))
1698
 
            
 
2317
            gnutls.priority_set_direct(session,
 
2318
                                       priority.encode("utf-8"), None)
 
2319
 
1699
2320
            # Start communication using the Mandos protocol
1700
2321
            # Get protocol number
1701
2322
            line = self.request.makefile().readline()
1702
 
            logger.debug("Protocol version: %r", line)
 
2323
            log.debug("Protocol version: %r", line)
1703
2324
            try:
1704
2325
                if int(line.strip().split()[0]) > 1:
1705
 
                    raise RuntimeError
 
2326
                    raise RuntimeError(line)
1706
2327
            except (ValueError, IndexError, RuntimeError) as error:
1707
 
                logger.error("Unknown protocol version: %s", error)
 
2328
                log.error("Unknown protocol version: %s", error)
1708
2329
                return
1709
 
            
 
2330
 
1710
2331
            # Start GnuTLS connection
1711
2332
            try:
1712
2333
                session.handshake()
1713
 
            except gnutls.errors.GNUTLSError as error:
1714
 
                logger.warning("Handshake failed: %s", error)
 
2334
            except gnutls.Error as error:
 
2335
                log.warning("Handshake failed: %s", error)
1715
2336
                # Do not run session.bye() here: the session is not
1716
2337
                # established.  Just abandon the request.
1717
2338
                return
1718
 
            logger.debug("Handshake succeeded")
1719
 
            
 
2339
            log.debug("Handshake succeeded")
 
2340
 
1720
2341
            approval_required = False
1721
2342
            try:
1722
 
                try:
1723
 
                    fpr = self.fingerprint(self.peer_certificate
1724
 
                                           (session))
1725
 
                except (TypeError,
1726
 
                        gnutls.errors.GNUTLSError) as error:
1727
 
                    logger.warning("Bad certificate: %s", error)
1728
 
                    return
1729
 
                logger.debug("Fingerprint: %s", fpr)
1730
 
                
1731
 
                try:
1732
 
                    client = ProxyClient(child_pipe, fpr,
 
2343
                if gnutls.has_rawpk:
 
2344
                    fpr = b""
 
2345
                    try:
 
2346
                        key_id = self.key_id(
 
2347
                            self.peer_certificate(session))
 
2348
                    except (TypeError, gnutls.Error) as error:
 
2349
                        log.warning("Bad certificate: %s", error)
 
2350
                        return
 
2351
                    log.debug("Key ID: %s",
 
2352
                              key_id.decode("utf-8",
 
2353
                                            errors="replace"))
 
2354
 
 
2355
                else:
 
2356
                    key_id = b""
 
2357
                    try:
 
2358
                        fpr = self.fingerprint(
 
2359
                            self.peer_certificate(session))
 
2360
                    except (TypeError, gnutls.Error) as error:
 
2361
                        log.warning("Bad certificate: %s", error)
 
2362
                        return
 
2363
                    log.debug("Fingerprint: %s", fpr)
 
2364
 
 
2365
                try:
 
2366
                    client = ProxyClient(child_pipe, key_id, fpr,
1733
2367
                                         self.client_address)
1734
2368
                except KeyError:
1735
2369
                    return
1736
 
                
 
2370
 
1737
2371
                if client.approval_delay:
1738
2372
                    delay = client.approval_delay
1739
2373
                    client.approvals_pending += 1
1740
2374
                    approval_required = True
1741
 
                
 
2375
 
1742
2376
                while True:
1743
2377
                    if not client.enabled:
1744
 
                        logger.info("Client %s is disabled",
1745
 
                                       client.name)
 
2378
                        log.info("Client %s is disabled", client.name)
1746
2379
                        if self.server.use_dbus:
1747
2380
                            # Emit D-Bus signal
1748
2381
                            client.Rejected("Disabled")
1749
2382
                        return
1750
 
                    
 
2383
 
1751
2384
                    if client.approved or not client.approval_delay:
1752
 
                        #We are approved or approval is disabled
 
2385
                        # We are approved or approval is disabled
1753
2386
                        break
1754
2387
                    elif client.approved is None:
1755
 
                        logger.info("Client %s needs approval",
 
2388
                        log.info("Client %s needs approval",
 
2389
                                 client.name)
 
2390
                        if self.server.use_dbus:
 
2391
                            # Emit D-Bus signal
 
2392
                            client.NeedApproval(
 
2393
                                client.approval_delay.total_seconds()
 
2394
                                * 1000, client.approved_by_default)
 
2395
                    else:
 
2396
                        log.warning("Client %s was not approved",
1756
2397
                                    client.name)
1757
2398
                        if self.server.use_dbus:
1758
2399
                            # Emit D-Bus signal
1759
 
                            client.NeedApproval(
1760
 
                                client.approval_delay_milliseconds(),
1761
 
                                client.approved_by_default)
1762
 
                    else:
1763
 
                        logger.warning("Client %s was not approved",
1764
 
                                       client.name)
1765
 
                        if self.server.use_dbus:
1766
 
                            # Emit D-Bus signal
1767
2400
                            client.Rejected("Denied")
1768
2401
                        return
1769
 
                    
1770
 
                    #wait until timeout or approved
 
2402
 
 
2403
                    # wait until timeout or approved
1771
2404
                    time = datetime.datetime.now()
1772
2405
                    client.changedstate.acquire()
1773
 
                    client.changedstate.wait(
1774
 
                        float(timedelta_to_milliseconds(delay)
1775
 
                              / 1000))
 
2406
                    client.changedstate.wait(delay.total_seconds())
1776
2407
                    client.changedstate.release()
1777
2408
                    time2 = datetime.datetime.now()
1778
2409
                    if (time2 - time) >= delay:
1779
2410
                        if not client.approved_by_default:
1780
 
                            logger.warning("Client %s timed out while"
1781
 
                                           " waiting for approval",
1782
 
                                           client.name)
 
2411
                            log.warning("Client %s timed out while"
 
2412
                                        " waiting for approval",
 
2413
                                        client.name)
1783
2414
                            if self.server.use_dbus:
1784
2415
                                # Emit D-Bus signal
1785
2416
                                client.Rejected("Approval timed out")
1788
2419
                            break
1789
2420
                    else:
1790
2421
                        delay -= time2 - time
1791
 
                
1792
 
                sent_size = 0
1793
 
                while sent_size < len(client.secret):
1794
 
                    try:
1795
 
                        sent = session.send(client.secret[sent_size:])
1796
 
                    except gnutls.errors.GNUTLSError as error:
1797
 
                        logger.warning("gnutls send failed",
1798
 
                                       exc_info=error)
1799
 
                        return
1800
 
                    logger.debug("Sent: %d, remaining: %d",
1801
 
                                 sent, len(client.secret)
1802
 
                                 - (sent_size + sent))
1803
 
                    sent_size += sent
1804
 
                
1805
 
                logger.info("Sending secret to %s", client.name)
 
2422
 
 
2423
                try:
 
2424
                    session.send(client.secret)
 
2425
                except gnutls.Error as error:
 
2426
                    log.warning("gnutls send failed", exc_info=error)
 
2427
                    return
 
2428
 
 
2429
                log.info("Sending secret to %s", client.name)
1806
2430
                # bump the timeout using extended_timeout
1807
2431
                client.bump_timeout(client.extended_timeout)
1808
2432
                if self.server.use_dbus:
1809
2433
                    # Emit D-Bus signal
1810
2434
                    client.GotSecret()
1811
 
            
 
2435
 
1812
2436
            finally:
1813
2437
                if approval_required:
1814
2438
                    client.approvals_pending -= 1
1815
2439
                try:
1816
2440
                    session.bye()
1817
 
                except gnutls.errors.GNUTLSError as error:
1818
 
                    logger.warning("GnuTLS bye failed",
1819
 
                                   exc_info=error)
1820
 
    
 
2441
                except gnutls.Error as error:
 
2442
                    log.warning("GnuTLS bye failed", exc_info=error)
 
2443
 
1821
2444
    @staticmethod
1822
2445
    def peer_certificate(session):
1823
 
        "Return the peer's OpenPGP certificate as a bytestring"
1824
 
        # If not an OpenPGP certificate...
1825
 
        if (gnutls.library.functions
1826
 
            .gnutls_certificate_type_get(session._c_object)
1827
 
            != gnutls.library.constants.GNUTLS_CRT_OPENPGP):
1828
 
            # ...do the normal thing
1829
 
            return session.peer_certificate
 
2446
        "Return the peer's certificate as a bytestring"
 
2447
        try:
 
2448
            cert_type = gnutls.certificate_type_get2(
 
2449
                session, gnutls.CTYPE_PEERS)
 
2450
        except AttributeError:
 
2451
            cert_type = gnutls.certificate_type_get(session)
 
2452
        if gnutls.has_rawpk:
 
2453
            valid_cert_types = frozenset((gnutls.CRT_RAWPK,))
 
2454
        else:
 
2455
            valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))
 
2456
        # If not a valid certificate type...
 
2457
        if cert_type not in valid_cert_types:
 
2458
            log.info("Cert type %r not in %r", cert_type,
 
2459
                     valid_cert_types)
 
2460
            # ...return invalid data
 
2461
            return b""
1830
2462
        list_size = ctypes.c_uint(1)
1831
 
        cert_list = (gnutls.library.functions
1832
 
                     .gnutls_certificate_get_peers
1833
 
                     (session._c_object, ctypes.byref(list_size)))
 
2463
        cert_list = (gnutls.certificate_get_peers
 
2464
                     (session, ctypes.byref(list_size)))
1834
2465
        if not bool(cert_list) and list_size.value != 0:
1835
 
            raise gnutls.errors.GNUTLSError("error getting peer"
1836
 
                                            " certificate")
 
2466
            raise gnutls.Error("error getting peer certificate")
1837
2467
        if list_size.value == 0:
1838
2468
            return None
1839
2469
        cert = cert_list[0]
1840
2470
        return ctypes.string_at(cert.data, cert.size)
1841
 
    
 
2471
 
 
2472
    @staticmethod
 
2473
    def key_id(certificate):
 
2474
        "Convert a certificate bytestring to a hexdigit key ID"
 
2475
        # New GnuTLS "datum" with the public key
 
2476
        datum = gnutls.datum_t(
 
2477
            ctypes.cast(ctypes.c_char_p(certificate),
 
2478
                        ctypes.POINTER(ctypes.c_ubyte)),
 
2479
            ctypes.c_uint(len(certificate)))
 
2480
        # XXX all these need to be created in the gnutls "module"
 
2481
        # New empty GnuTLS certificate
 
2482
        pubkey = gnutls.pubkey_t()
 
2483
        gnutls.pubkey_init(ctypes.byref(pubkey))
 
2484
        # Import the raw public key into the certificate
 
2485
        gnutls.pubkey_import(pubkey,
 
2486
                             ctypes.byref(datum),
 
2487
                             gnutls.X509_FMT_DER)
 
2488
        # New buffer for the key ID
 
2489
        buf = ctypes.create_string_buffer(32)
 
2490
        buf_len = ctypes.c_size_t(len(buf))
 
2491
        # Get the key ID from the raw public key into the buffer
 
2492
        gnutls.pubkey_get_key_id(
 
2493
            pubkey,
 
2494
            gnutls.KEYID_USE_SHA256,
 
2495
            ctypes.cast(ctypes.byref(buf),
 
2496
                        ctypes.POINTER(ctypes.c_ubyte)),
 
2497
            ctypes.byref(buf_len))
 
2498
        # Deinit the certificate
 
2499
        gnutls.pubkey_deinit(pubkey)
 
2500
 
 
2501
        # Convert the buffer to a Python bytestring
 
2502
        key_id = ctypes.string_at(buf, buf_len.value)
 
2503
        # Convert the bytestring to hexadecimal notation
 
2504
        hex_key_id = binascii.hexlify(key_id).upper()
 
2505
        return hex_key_id
 
2506
 
1842
2507
    @staticmethod
1843
2508
    def fingerprint(openpgp):
1844
2509
        "Convert an OpenPGP bytestring to a hexdigit fingerprint"
1845
2510
        # New GnuTLS "datum" with the OpenPGP public key
1846
 
        datum = (gnutls.library.types
1847
 
                 .gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
1848
 
                                             ctypes.POINTER
1849
 
                                             (ctypes.c_ubyte)),
1850
 
                                 ctypes.c_uint(len(openpgp))))
 
2511
        datum = gnutls.datum_t(
 
2512
            ctypes.cast(ctypes.c_char_p(openpgp),
 
2513
                        ctypes.POINTER(ctypes.c_ubyte)),
 
2514
            ctypes.c_uint(len(openpgp)))
1851
2515
        # New empty GnuTLS certificate
1852
 
        crt = gnutls.library.types.gnutls_openpgp_crt_t()
1853
 
        (gnutls.library.functions
1854
 
         .gnutls_openpgp_crt_init(ctypes.byref(crt)))
 
2516
        crt = gnutls.openpgp_crt_t()
 
2517
        gnutls.openpgp_crt_init(ctypes.byref(crt))
1855
2518
        # Import the OpenPGP public key into the certificate
1856
 
        (gnutls.library.functions
1857
 
         .gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
1858
 
                                    gnutls.library.constants
1859
 
                                    .GNUTLS_OPENPGP_FMT_RAW))
 
2519
        gnutls.openpgp_crt_import(crt, ctypes.byref(datum),
 
2520
                                  gnutls.OPENPGP_FMT_RAW)
1860
2521
        # Verify the self signature in the key
1861
2522
        crtverify = ctypes.c_uint()
1862
 
        (gnutls.library.functions
1863
 
         .gnutls_openpgp_crt_verify_self(crt, 0,
1864
 
                                         ctypes.byref(crtverify)))
 
2523
        gnutls.openpgp_crt_verify_self(crt, 0,
 
2524
                                       ctypes.byref(crtverify))
1865
2525
        if crtverify.value != 0:
1866
 
            gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1867
 
            raise (gnutls.errors.CertificateSecurityError
1868
 
                   ("Verify failed"))
 
2526
            gnutls.openpgp_crt_deinit(crt)
 
2527
            raise gnutls.CertificateSecurityError(code
 
2528
                                                  =crtverify.value)
1869
2529
        # New buffer for the fingerprint
1870
2530
        buf = ctypes.create_string_buffer(20)
1871
2531
        buf_len = ctypes.c_size_t()
1872
2532
        # Get the fingerprint from the certificate into the buffer
1873
 
        (gnutls.library.functions
1874
 
         .gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
1875
 
                                             ctypes.byref(buf_len)))
 
2533
        gnutls.openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
 
2534
                                           ctypes.byref(buf_len))
1876
2535
        # Deinit the certificate
1877
 
        gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
 
2536
        gnutls.openpgp_crt_deinit(crt)
1878
2537
        # Convert the buffer to a Python bytestring
1879
2538
        fpr = ctypes.string_at(buf, buf_len.value)
1880
2539
        # Convert the bytestring to hexadecimal notation
1882
2541
        return hex_fpr
1883
2542
 
1884
2543
 
1885
 
class MultiprocessingMixIn(object):
 
2544
class MultiprocessingMixIn:
1886
2545
    """Like socketserver.ThreadingMixIn, but with multiprocessing"""
 
2546
 
1887
2547
    def sub_process_main(self, request, address):
1888
2548
        try:
1889
2549
            self.finish_request(request, address)
1890
2550
        except Exception:
1891
2551
            self.handle_error(request, address)
1892
2552
        self.close_request(request)
1893
 
    
 
2553
 
1894
2554
    def process_request(self, request, address):
1895
2555
        """Start a new process to process the request."""
1896
 
        proc = multiprocessing.Process(target = self.sub_process_main,
1897
 
                                       args = (request, address))
 
2556
        proc = multiprocessing.Process(target=self.sub_process_main,
 
2557
                                       args=(request, address))
1898
2558
        proc.start()
1899
2559
        return proc
1900
2560
 
1901
2561
 
1902
 
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
 
2562
class MultiprocessingMixInWithPipe(MultiprocessingMixIn):
1903
2563
    """ adds a pipe to the MixIn """
 
2564
 
1904
2565
    def process_request(self, request, client_address):
1905
2566
        """Overrides and wraps the original process_request().
1906
 
        
 
2567
 
1907
2568
        This function creates a new pipe in self.pipe
1908
2569
        """
1909
2570
        parent_pipe, self.child_pipe = multiprocessing.Pipe()
1910
 
        
 
2571
 
1911
2572
        proc = MultiprocessingMixIn.process_request(self, request,
1912
2573
                                                    client_address)
1913
2574
        self.child_pipe.close()
1914
2575
        self.add_pipe(parent_pipe, proc)
1915
 
    
 
2576
 
1916
2577
    def add_pipe(self, parent_pipe, proc):
1917
2578
        """Dummy function; override as necessary"""
1918
 
        raise NotImplementedError
 
2579
        raise NotImplementedError()
1919
2580
 
1920
2581
 
1921
2582
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
1922
 
                     socketserver.TCPServer, object):
1923
 
    """IPv6-capable TCP server.  Accepts 'None' as address and/or port
1924
 
    
 
2583
                     socketserver.TCPServer):
 
2584
    """IPv6-capable TCP server.  Accepts None as address and/or port
 
2585
 
1925
2586
    Attributes:
1926
2587
        enabled:        Boolean; whether this server is activated yet
1927
2588
        interface:      None or a network interface name (string)
1928
2589
        use_ipv6:       Boolean; to use IPv6 or not
1929
2590
    """
 
2591
 
1930
2592
    def __init__(self, server_address, RequestHandlerClass,
1931
 
                 interface=None, use_ipv6=True, socketfd=None):
 
2593
                 interface=None,
 
2594
                 use_ipv6=True,
 
2595
                 socketfd=None):
1932
2596
        """If socketfd is set, use that file descriptor instead of
1933
2597
        creating a new one with socket.socket().
1934
2598
        """
1940
2604
            self.socketfd = socketfd
1941
2605
            # Save the original socket.socket() function
1942
2606
            self.socket_socket = socket.socket
 
2607
 
1943
2608
            # To implement --socket, we monkey patch socket.socket.
1944
 
            # 
 
2609
            #
1945
2610
            # (When socketserver.TCPServer is a new-style class, we
1946
2611
            # could make self.socket into a property instead of monkey
1947
2612
            # patching socket.socket.)
1948
 
            # 
 
2613
            #
1949
2614
            # Create a one-time-only replacement for socket.socket()
1950
2615
            @functools.wraps(socket.socket)
1951
2616
            def socket_wrapper(*args, **kwargs):
1963
2628
        # socket_wrapper(), if socketfd was set.
1964
2629
        socketserver.TCPServer.__init__(self, server_address,
1965
2630
                                        RequestHandlerClass)
1966
 
    
 
2631
 
1967
2632
    def server_bind(self):
1968
2633
        """This overrides the normal server_bind() function
1969
2634
        to bind to an interface if one was specified, and also NOT to
1970
2635
        bind to an address or port if they were not specified."""
 
2636
        global SO_BINDTODEVICE
1971
2637
        if self.interface is not None:
1972
2638
            if SO_BINDTODEVICE is None:
1973
 
                logger.error("SO_BINDTODEVICE does not exist;"
1974
 
                             " cannot bind to interface %s",
1975
 
                             self.interface)
1976
 
            else:
1977
 
                try:
1978
 
                    self.socket.setsockopt(socket.SOL_SOCKET,
1979
 
                                           SO_BINDTODEVICE,
1980
 
                                           str(self.interface + '\0'))
1981
 
                except socket.error as error:
1982
 
                    if error.errno == errno.EPERM:
1983
 
                        logger.error("No permission to bind to"
1984
 
                                     " interface %s", self.interface)
1985
 
                    elif error.errno == errno.ENOPROTOOPT:
1986
 
                        logger.error("SO_BINDTODEVICE not available;"
1987
 
                                     " cannot bind to interface %s",
1988
 
                                     self.interface)
1989
 
                    elif error.errno == errno.ENODEV:
1990
 
                        logger.error("Interface %s does not exist,"
1991
 
                                     " cannot bind", self.interface)
1992
 
                    else:
1993
 
                        raise
 
2639
                # Fall back to a hard-coded value which seems to be
 
2640
                # common enough.
 
2641
                log.warning("SO_BINDTODEVICE not found, trying 25")
 
2642
                SO_BINDTODEVICE = 25
 
2643
            try:
 
2644
                self.socket.setsockopt(
 
2645
                    socket.SOL_SOCKET, SO_BINDTODEVICE,
 
2646
                    (self.interface + "\0").encode("utf-8"))
 
2647
            except socket.error as error:
 
2648
                if error.errno == errno.EPERM:
 
2649
                    log.error("No permission to bind to interface %s",
 
2650
                              self.interface)
 
2651
                elif error.errno == errno.ENOPROTOOPT:
 
2652
                    log.error("SO_BINDTODEVICE not available; cannot"
 
2653
                              " bind to interface %s", self.interface)
 
2654
                elif error.errno == errno.ENODEV:
 
2655
                    log.error("Interface %s does not exist, cannot"
 
2656
                              " bind", self.interface)
 
2657
                else:
 
2658
                    raise
1994
2659
        # Only bind(2) the socket if we really need to.
1995
2660
        if self.server_address[0] or self.server_address[1]:
 
2661
            if self.server_address[1]:
 
2662
                self.allow_reuse_address = True
1996
2663
            if not self.server_address[0]:
1997
2664
                if self.address_family == socket.AF_INET6:
1998
 
                    any_address = "::" # in6addr_any
 
2665
                    any_address = "::"  # in6addr_any
1999
2666
                else:
2000
 
                    any_address = "0.0.0.0" # INADDR_ANY
 
2667
                    any_address = "0.0.0.0"  # INADDR_ANY
2001
2668
                self.server_address = (any_address,
2002
2669
                                       self.server_address[1])
2003
2670
            elif not self.server_address[1]:
2004
 
                self.server_address = (self.server_address[0],
2005
 
                                       0)
 
2671
                self.server_address = (self.server_address[0], 0)
2006
2672
#                 if self.interface:
2007
2673
#                     self.server_address = (self.server_address[0],
2008
2674
#                                            0, # port
2014
2680
 
2015
2681
class MandosServer(IPv6_TCPServer):
2016
2682
    """Mandos server.
2017
 
    
 
2683
 
2018
2684
    Attributes:
2019
2685
        clients:        set of Client objects
2020
2686
        gnutls_priority GnuTLS priority string
2021
2687
        use_dbus:       Boolean; to emit D-Bus signals or not
2022
 
    
2023
 
    Assumes a gobject.MainLoop event loop.
 
2688
 
 
2689
    Assumes a GLib.MainLoop event loop.
2024
2690
    """
 
2691
 
2025
2692
    def __init__(self, server_address, RequestHandlerClass,
2026
 
                 interface=None, use_ipv6=True, clients=None,
2027
 
                 gnutls_priority=None, use_dbus=True, socketfd=None):
 
2693
                 interface=None,
 
2694
                 use_ipv6=True,
 
2695
                 clients=None,
 
2696
                 gnutls_priority=None,
 
2697
                 use_dbus=True,
 
2698
                 socketfd=None):
2028
2699
        self.enabled = False
2029
2700
        self.clients = clients
2030
2701
        if self.clients is None:
2033
2704
        self.gnutls_priority = gnutls_priority
2034
2705
        IPv6_TCPServer.__init__(self, server_address,
2035
2706
                                RequestHandlerClass,
2036
 
                                interface = interface,
2037
 
                                use_ipv6 = use_ipv6,
2038
 
                                socketfd = socketfd)
 
2707
                                interface=interface,
 
2708
                                use_ipv6=use_ipv6,
 
2709
                                socketfd=socketfd)
 
2710
 
2039
2711
    def server_activate(self):
2040
2712
        if self.enabled:
2041
2713
            return socketserver.TCPServer.server_activate(self)
2042
 
    
 
2714
 
2043
2715
    def enable(self):
2044
2716
        self.enabled = True
2045
 
    
 
2717
 
2046
2718
    def add_pipe(self, parent_pipe, proc):
2047
2719
        # Call "handle_ipc" for both data and EOF events
2048
 
        gobject.io_add_watch(parent_pipe.fileno(),
2049
 
                             gobject.IO_IN | gobject.IO_HUP,
2050
 
                             functools.partial(self.handle_ipc,
2051
 
                                               parent_pipe =
2052
 
                                               parent_pipe,
2053
 
                                               proc = proc))
2054
 
    
2055
 
    def handle_ipc(self, source, condition, parent_pipe=None,
2056
 
                   proc = None, client_object=None):
 
2720
        GLib.io_add_watch(
 
2721
            GLib.IOChannel.unix_new(parent_pipe.fileno()),
 
2722
            GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
 
2723
            functools.partial(self.handle_ipc,
 
2724
                              parent_pipe=parent_pipe,
 
2725
                              proc=proc))
 
2726
 
 
2727
    def handle_ipc(self, source, condition,
 
2728
                   parent_pipe=None,
 
2729
                   proc=None,
 
2730
                   client_object=None):
2057
2731
        # error, or the other end of multiprocessing.Pipe has closed
2058
 
        if condition & (gobject.IO_ERR | gobject.IO_HUP):
 
2732
        if condition & (GLib.IO_ERR | GLib.IO_HUP):
2059
2733
            # Wait for other process to exit
2060
2734
            proc.join()
2061
2735
            return False
2062
 
        
 
2736
 
2063
2737
        # Read a request from the child
2064
2738
        request = parent_pipe.recv()
2065
2739
        command = request[0]
2066
 
        
2067
 
        if command == 'init':
2068
 
            fpr = request[1]
2069
 
            address = request[2]
2070
 
            
2071
 
            for c in self.clients.itervalues():
2072
 
                if c.fingerprint == fpr:
 
2740
 
 
2741
        if command == "init":
 
2742
            key_id = request[1].decode("ascii")
 
2743
            fpr = request[2].decode("ascii")
 
2744
            address = request[3]
 
2745
 
 
2746
            for c in self.clients.values():
 
2747
                if key_id == ("E3B0C44298FC1C149AFBF4C8996FB924"
 
2748
                              "27AE41E4649B934CA495991B7852B855"):
 
2749
                    continue
 
2750
                if key_id and c.key_id == key_id:
 
2751
                    client = c
 
2752
                    break
 
2753
                if fpr and c.fingerprint == fpr:
2073
2754
                    client = c
2074
2755
                    break
2075
2756
            else:
2076
 
                logger.info("Client not found for fingerprint: %s, ad"
2077
 
                            "dress: %s", fpr, address)
 
2757
                log.info("Client not found for key ID: %s, address:"
 
2758
                         " %s", key_id or fpr, address)
2078
2759
                if self.use_dbus:
2079
2760
                    # Emit D-Bus signal
2080
 
                    mandos_dbus_service.ClientNotFound(fpr,
 
2761
                    mandos_dbus_service.ClientNotFound(key_id or fpr,
2081
2762
                                                       address[0])
2082
2763
                parent_pipe.send(False)
2083
2764
                return False
2084
 
            
2085
 
            gobject.io_add_watch(parent_pipe.fileno(),
2086
 
                                 gobject.IO_IN | gobject.IO_HUP,
2087
 
                                 functools.partial(self.handle_ipc,
2088
 
                                                   parent_pipe =
2089
 
                                                   parent_pipe,
2090
 
                                                   proc = proc,
2091
 
                                                   client_object =
2092
 
                                                   client))
 
2765
 
 
2766
            GLib.io_add_watch(
 
2767
                GLib.IOChannel.unix_new(parent_pipe.fileno()),
 
2768
                GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
 
2769
                functools.partial(self.handle_ipc,
 
2770
                                  parent_pipe=parent_pipe,
 
2771
                                  proc=proc,
 
2772
                                  client_object=client))
2093
2773
            parent_pipe.send(True)
2094
2774
            # remove the old hook in favor of the new above hook on
2095
2775
            # same fileno
2096
2776
            return False
2097
 
        if command == 'funcall':
 
2777
        if command == "funcall":
2098
2778
            funcname = request[1]
2099
2779
            args = request[2]
2100
2780
            kwargs = request[3]
2101
 
            
2102
 
            parent_pipe.send(('data', getattr(client_object,
 
2781
 
 
2782
            parent_pipe.send(("data", getattr(client_object,
2103
2783
                                              funcname)(*args,
2104
 
                                                         **kwargs)))
2105
 
        
2106
 
        if command == 'getattr':
 
2784
                                                        **kwargs)))
 
2785
 
 
2786
        if command == "getattr":
2107
2787
            attrname = request[1]
2108
 
            if callable(client_object.__getattribute__(attrname)):
2109
 
                parent_pipe.send(('function',))
 
2788
            if isinstance(client_object.__getattribute__(attrname),
 
2789
                          collections.abc.Callable):
 
2790
                parent_pipe.send(("function", ))
2110
2791
            else:
2111
 
                parent_pipe.send(('data', client_object
2112
 
                                  .__getattribute__(attrname)))
2113
 
        
2114
 
        if command == 'setattr':
 
2792
                parent_pipe.send((
 
2793
                    "data", client_object.__getattribute__(attrname)))
 
2794
 
 
2795
        if command == "setattr":
2115
2796
            attrname = request[1]
2116
2797
            value = request[2]
2117
2798
            setattr(client_object, attrname, value)
2118
 
        
 
2799
 
2119
2800
        return True
2120
2801
 
2121
2802
 
2122
2803
def rfc3339_duration_to_delta(duration):
2123
2804
    """Parse an RFC 3339 "duration" and return a datetime.timedelta
2124
 
    
2125
 
    >>> rfc3339_duration_to_delta("P7D")
2126
 
    datetime.timedelta(7)
2127
 
    >>> rfc3339_duration_to_delta("PT60S")
2128
 
    datetime.timedelta(0, 60)
2129
 
    >>> rfc3339_duration_to_delta("PT60M")
2130
 
    datetime.timedelta(0, 3600)
2131
 
    >>> rfc3339_duration_to_delta("PT24H")
2132
 
    datetime.timedelta(1)
2133
 
    >>> rfc3339_duration_to_delta("P1W")
2134
 
    datetime.timedelta(7)
2135
 
    >>> rfc3339_duration_to_delta("PT5M30S")
2136
 
    datetime.timedelta(0, 330)
2137
 
    >>> rfc3339_duration_to_delta("P1DT3M20S")
2138
 
    datetime.timedelta(1, 200)
 
2805
 
 
2806
    >>> timedelta = datetime.timedelta
 
2807
    >>> rfc3339_duration_to_delta("P7D") == timedelta(7)
 
2808
    True
 
2809
    >>> rfc3339_duration_to_delta("PT60S") == timedelta(0, 60)
 
2810
    True
 
2811
    >>> rfc3339_duration_to_delta("PT60M") == timedelta(0, 3600)
 
2812
    True
 
2813
    >>> rfc3339_duration_to_delta("PT24H") == timedelta(1)
 
2814
    True
 
2815
    >>> rfc3339_duration_to_delta("P1W") == timedelta(7)
 
2816
    True
 
2817
    >>> rfc3339_duration_to_delta("PT5M30S") == timedelta(0, 330)
 
2818
    True
 
2819
    >>> rfc3339_duration_to_delta("P1DT3M20S") == timedelta(1, 200)
 
2820
    True
 
2821
    >>> del timedelta
2139
2822
    """
2140
 
    
 
2823
 
2141
2824
    # Parsing an RFC 3339 duration with regular expressions is not
2142
2825
    # possible - there would have to be multiple places for the same
2143
2826
    # values, like seconds.  The current code, while more esoteric, is
2144
2827
    # cleaner without depending on a parsing library.  If Python had a
2145
2828
    # built-in library for parsing we would use it, but we'd like to
2146
2829
    # avoid excessive use of external libraries.
2147
 
    
 
2830
 
2148
2831
    # New type for defining tokens, syntax, and semantics all-in-one
2149
 
    Token = collections.namedtuple("Token",
2150
 
                                   ("regexp", # To match token; if
2151
 
                                              # "value" is not None,
2152
 
                                              # must have a "group"
2153
 
                                              # containing digits
2154
 
                                    "value",  # datetime.timedelta or
2155
 
                                              # None
2156
 
                                    "followers")) # Tokens valid after
2157
 
                                                  # this token
 
2832
    Token = collections.namedtuple("Token", (
 
2833
        "regexp",  # To match token; if "value" is not None, must have
 
2834
                   # a "group" containing digits
 
2835
        "value",   # datetime.timedelta or None
 
2836
        "followers"))           # Tokens valid after this token
2158
2837
    # RFC 3339 "duration" tokens, syntax, and semantics; taken from
2159
2838
    # the "duration" ABNF definition in RFC 3339, Appendix A.
2160
2839
    token_end = Token(re.compile(r"$"), None, frozenset())
2161
2840
    token_second = Token(re.compile(r"(\d+)S"),
2162
2841
                         datetime.timedelta(seconds=1),
2163
 
                         frozenset((token_end,)))
 
2842
                         frozenset((token_end, )))
2164
2843
    token_minute = Token(re.compile(r"(\d+)M"),
2165
2844
                         datetime.timedelta(minutes=1),
2166
2845
                         frozenset((token_second, token_end)))
2182
2861
                       frozenset((token_month, token_end)))
2183
2862
    token_week = Token(re.compile(r"(\d+)W"),
2184
2863
                       datetime.timedelta(weeks=1),
2185
 
                       frozenset((token_end,)))
 
2864
                       frozenset((token_end, )))
2186
2865
    token_duration = Token(re.compile(r"P"), None,
2187
2866
                           frozenset((token_year, token_month,
2188
2867
                                      token_day, token_time,
2189
 
                                      token_week))),
2190
 
    # Define starting values
2191
 
    value = datetime.timedelta() # Value so far
 
2868
                                      token_week)))
 
2869
    # Define starting values:
 
2870
    # Value so far
 
2871
    value = datetime.timedelta()
2192
2872
    found_token = None
2193
 
    followers = frozenset(token_duration,) # Following valid tokens
2194
 
    s = duration                # String left to parse
 
2873
    # Following valid tokens
 
2874
    followers = frozenset((token_duration, ))
 
2875
    # String left to parse
 
2876
    s = duration
2195
2877
    # Loop until end token is found
2196
2878
    while found_token is not token_end:
2197
2879
        # Search for any currently valid tokens
2213
2895
                break
2214
2896
        else:
2215
2897
            # No currently valid tokens were found
2216
 
            raise ValueError("Invalid RFC 3339 duration")
 
2898
            raise ValueError("Invalid RFC 3339 duration: {!r}"
 
2899
                             .format(duration))
2217
2900
    # End token found
2218
2901
    return value
2219
2902
 
2220
2903
 
2221
2904
def string_to_delta(interval):
2222
2905
    """Parse a string and return a datetime.timedelta
2223
 
    
2224
 
    >>> string_to_delta('7d')
2225
 
    datetime.timedelta(7)
2226
 
    >>> string_to_delta('60s')
2227
 
    datetime.timedelta(0, 60)
2228
 
    >>> string_to_delta('60m')
2229
 
    datetime.timedelta(0, 3600)
2230
 
    >>> string_to_delta('24h')
2231
 
    datetime.timedelta(1)
2232
 
    >>> string_to_delta('1w')
2233
 
    datetime.timedelta(7)
2234
 
    >>> string_to_delta('5m 30s')
2235
 
    datetime.timedelta(0, 330)
 
2906
 
 
2907
    >>> string_to_delta("7d") == datetime.timedelta(7)
 
2908
    True
 
2909
    >>> string_to_delta("60s") == datetime.timedelta(0, 60)
 
2910
    True
 
2911
    >>> string_to_delta("60m") == datetime.timedelta(0, 3600)
 
2912
    True
 
2913
    >>> string_to_delta("24h") == datetime.timedelta(1)
 
2914
    True
 
2915
    >>> string_to_delta("1w") == datetime.timedelta(7)
 
2916
    True
 
2917
    >>> string_to_delta("5m 30s") == datetime.timedelta(0, 330)
 
2918
    True
2236
2919
    """
2237
 
    
 
2920
 
2238
2921
    try:
2239
2922
        return rfc3339_duration_to_delta(interval)
2240
2923
    except ValueError:
2241
2924
        pass
2242
 
    
 
2925
 
2243
2926
    timevalue = datetime.timedelta(0)
2244
2927
    for s in interval.split():
2245
2928
        try:
2246
 
            suffix = unicode(s[-1])
 
2929
            suffix = s[-1]
2247
2930
            value = int(s[:-1])
2248
2931
            if suffix == "d":
2249
2932
                delta = datetime.timedelta(value)
2256
2939
            elif suffix == "w":
2257
2940
                delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
2258
2941
            else:
2259
 
                raise ValueError("Unknown suffix {0!r}"
2260
 
                                 .format(suffix))
2261
 
        except (ValueError, IndexError) as e:
 
2942
                raise ValueError("Unknown suffix {!r}".format(suffix))
 
2943
        except IndexError as e:
2262
2944
            raise ValueError(*(e.args))
2263
2945
        timevalue += delta
2264
2946
    return timevalue
2265
2947
 
2266
2948
 
2267
 
def daemon(nochdir = False, noclose = False):
 
2949
def daemon(nochdir=False, noclose=False):
2268
2950
    """See daemon(3).  Standard BSD Unix function.
2269
 
    
 
2951
 
2270
2952
    This should really exist as os.daemon, but it doesn't (yet)."""
2271
2953
    if os.fork():
2272
2954
        sys.exit()
2280
2962
        null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2281
2963
        if not stat.S_ISCHR(os.fstat(null).st_mode):
2282
2964
            raise OSError(errno.ENODEV,
2283
 
                          "{0} not a character device"
 
2965
                          "{} not a character device"
2284
2966
                          .format(os.devnull))
2285
2967
        os.dup2(null, sys.stdin.fileno())
2286
2968
        os.dup2(null, sys.stdout.fileno())
2290
2972
 
2291
2973
 
2292
2974
def main():
2293
 
    
 
2975
 
2294
2976
    ##################################################################
2295
2977
    # Parsing of options, both command line and config file
2296
 
    
 
2978
 
2297
2979
    parser = argparse.ArgumentParser()
2298
2980
    parser.add_argument("-v", "--version", action="version",
2299
 
                        version = "%(prog)s {0}".format(version),
 
2981
                        version="%(prog)s {}".format(version),
2300
2982
                        help="show version number and exit")
2301
2983
    parser.add_argument("-i", "--interface", metavar="IF",
2302
2984
                        help="Bind to interface IF")
2335
3017
                        help="Directory to save/restore state in")
2336
3018
    parser.add_argument("--foreground", action="store_true",
2337
3019
                        help="Run in foreground", default=None)
2338
 
    
 
3020
    parser.add_argument("--no-zeroconf", action="store_false",
 
3021
                        dest="zeroconf", help="Do not use Zeroconf",
 
3022
                        default=None)
 
3023
 
2339
3024
    options = parser.parse_args()
2340
 
    
2341
 
    if options.check:
2342
 
        import doctest
2343
 
        doctest.testmod()
2344
 
        sys.exit()
2345
 
    
 
3025
 
2346
3026
    # Default values for config file for server-global settings
2347
 
    server_defaults = { "interface": "",
2348
 
                        "address": "",
2349
 
                        "port": "",
2350
 
                        "debug": "False",
2351
 
                        "priority":
2352
 
                        "SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",
2353
 
                        "servicename": "Mandos",
2354
 
                        "use_dbus": "True",
2355
 
                        "use_ipv6": "True",
2356
 
                        "debuglevel": "",
2357
 
                        "restore": "True",
2358
 
                        "socket": "",
2359
 
                        "statedir": "/var/lib/mandos",
2360
 
                        "foreground": "False",
2361
 
                        }
2362
 
    
 
3027
    if gnutls.has_rawpk:
 
3028
        priority = ("SECURE128:!CTYPE-X.509:+CTYPE-RAWPK:!RSA"
 
3029
                    ":!VERS-ALL:+VERS-TLS1.3:%PROFILE_ULTRA")
 
3030
    else:
 
3031
        priority = ("SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
 
3032
                    ":+SIGN-DSA-SHA256")
 
3033
    server_defaults = {"interface": "",
 
3034
                       "address": "",
 
3035
                       "port": "",
 
3036
                       "debug": "False",
 
3037
                       "priority": priority,
 
3038
                       "servicename": "Mandos",
 
3039
                       "use_dbus": "True",
 
3040
                       "use_ipv6": "True",
 
3041
                       "debuglevel": "",
 
3042
                       "restore": "True",
 
3043
                       "socket": "",
 
3044
                       "statedir": "/var/lib/mandos",
 
3045
                       "foreground": "False",
 
3046
                       "zeroconf": "True",
 
3047
                       }
 
3048
    del priority
 
3049
 
2363
3050
    # Parse config file for server-global settings
2364
 
    server_config = configparser.SafeConfigParser(server_defaults)
 
3051
    server_config = configparser.ConfigParser(server_defaults)
2365
3052
    del server_defaults
2366
 
    server_config.read(os.path.join(options.configdir,
2367
 
                                    "mandos.conf"))
2368
 
    # Convert the SafeConfigParser object to a dict
 
3053
    server_config.read(os.path.join(options.configdir, "mandos.conf"))
 
3054
    # Convert the ConfigParser object to a dict
2369
3055
    server_settings = server_config.defaults()
2370
3056
    # Use the appropriate methods on the non-string config options
2371
 
    for option in ("debug", "use_dbus", "use_ipv6", "foreground"):
 
3057
    for option in ("debug", "use_dbus", "use_ipv6", "restore",
 
3058
                   "foreground", "zeroconf"):
2372
3059
        server_settings[option] = server_config.getboolean("DEFAULT",
2373
3060
                                                           option)
2374
3061
    if server_settings["port"]:
2384
3071
            server_settings["socket"] = os.dup(server_settings
2385
3072
                                               ["socket"])
2386
3073
    del server_config
2387
 
    
 
3074
 
2388
3075
    # Override the settings from the config file with command line
2389
3076
    # options, if set.
2390
3077
    for option in ("interface", "address", "port", "debug",
2391
 
                   "priority", "servicename", "configdir",
2392
 
                   "use_dbus", "use_ipv6", "debuglevel", "restore",
2393
 
                   "statedir", "socket", "foreground"):
 
3078
                   "priority", "servicename", "configdir", "use_dbus",
 
3079
                   "use_ipv6", "debuglevel", "restore", "statedir",
 
3080
                   "socket", "foreground", "zeroconf"):
2394
3081
        value = getattr(options, option)
2395
3082
        if value is not None:
2396
3083
            server_settings[option] = value
2397
3084
    del options
2398
3085
    # Force all strings to be unicode
2399
3086
    for option in server_settings.keys():
2400
 
        if type(server_settings[option]) is str:
2401
 
            server_settings[option] = unicode(server_settings[option])
 
3087
        if isinstance(server_settings[option], bytes):
 
3088
            server_settings[option] = (server_settings[option]
 
3089
                                       .decode("utf-8"))
2402
3090
    # Force all boolean options to be boolean
2403
3091
    for option in ("debug", "use_dbus", "use_ipv6", "restore",
2404
 
                   "foreground"):
 
3092
                   "foreground", "zeroconf"):
2405
3093
        server_settings[option] = bool(server_settings[option])
2406
3094
    # Debug implies foreground
2407
3095
    if server_settings["debug"]:
2408
3096
        server_settings["foreground"] = True
2409
3097
    # Now we have our good server settings in "server_settings"
2410
 
    
 
3098
 
2411
3099
    ##################################################################
2412
 
    
 
3100
 
 
3101
    if (not server_settings["zeroconf"]
 
3102
        and not (server_settings["port"]
 
3103
                 or server_settings["socket"] != "")):
 
3104
        parser.error("Needs port or socket to work without Zeroconf")
 
3105
 
2413
3106
    # For convenience
2414
3107
    debug = server_settings["debug"]
2415
3108
    debuglevel = server_settings["debuglevel"]
2418
3111
    stored_state_path = os.path.join(server_settings["statedir"],
2419
3112
                                     stored_state_file)
2420
3113
    foreground = server_settings["foreground"]
2421
 
    
 
3114
    zeroconf = server_settings["zeroconf"]
 
3115
 
2422
3116
    if debug:
2423
3117
        initlogger(debug, logging.DEBUG)
2424
3118
    else:
2427
3121
        else:
2428
3122
            level = getattr(logging, debuglevel.upper())
2429
3123
            initlogger(debug, level)
2430
 
    
 
3124
 
2431
3125
    if server_settings["servicename"] != "Mandos":
2432
 
        syslogger.setFormatter(logging.Formatter
2433
 
                               ('Mandos ({0}) [%(process)d]:'
2434
 
                                ' %(levelname)s: %(message)s'
2435
 
                                .format(server_settings
2436
 
                                        ["servicename"])))
2437
 
    
 
3126
        syslogger.setFormatter(
 
3127
            logging.Formatter("Mandos ({}) [%(process)d]:"
 
3128
                              " %(levelname)s: %(message)s".format(
 
3129
                                  server_settings["servicename"])))
 
3130
 
2438
3131
    # Parse config file with clients
2439
 
    client_config = configparser.SafeConfigParser(Client
2440
 
                                                  .client_defaults)
 
3132
    client_config = configparser.ConfigParser(Client.client_defaults)
2441
3133
    client_config.read(os.path.join(server_settings["configdir"],
2442
3134
                                    "clients.conf"))
2443
 
    
 
3135
 
2444
3136
    global mandos_dbus_service
2445
3137
    mandos_dbus_service = None
2446
 
    
2447
 
    tcp_server = MandosServer((server_settings["address"],
2448
 
                               server_settings["port"]),
2449
 
                              ClientHandler,
2450
 
                              interface=(server_settings["interface"]
2451
 
                                         or None),
2452
 
                              use_ipv6=use_ipv6,
2453
 
                              gnutls_priority=
2454
 
                              server_settings["priority"],
2455
 
                              use_dbus=use_dbus,
2456
 
                              socketfd=(server_settings["socket"]
2457
 
                                        or None))
 
3138
 
 
3139
    socketfd = None
 
3140
    if server_settings["socket"] != "":
 
3141
        socketfd = server_settings["socket"]
 
3142
    tcp_server = MandosServer(
 
3143
        (server_settings["address"], server_settings["port"]),
 
3144
        ClientHandler,
 
3145
        interface=(server_settings["interface"] or None),
 
3146
        use_ipv6=use_ipv6,
 
3147
        gnutls_priority=server_settings["priority"],
 
3148
        use_dbus=use_dbus,
 
3149
        socketfd=socketfd)
2458
3150
    if not foreground:
2459
3151
        pidfilename = "/run/mandos.pid"
 
3152
        if not os.path.isdir("/run/."):
 
3153
            pidfilename = "/var/run/mandos.pid"
2460
3154
        pidfile = None
2461
3155
        try:
2462
 
            pidfile = open(pidfilename, "w")
 
3156
            pidfile = codecs.open(pidfilename, "w", encoding="utf-8")
2463
3157
        except IOError as e:
2464
 
            logger.error("Could not open file %r", pidfilename,
2465
 
                         exc_info=e)
2466
 
    
2467
 
    for name in ("_mandos", "mandos", "nobody"):
 
3158
            log.error("Could not open file %r", pidfilename,
 
3159
                      exc_info=e)
 
3160
 
 
3161
    for name, group in (("_mandos", "_mandos"),
 
3162
                        ("mandos", "mandos"),
 
3163
                        ("nobody", "nogroup")):
2468
3164
        try:
2469
3165
            uid = pwd.getpwnam(name).pw_uid
2470
 
            gid = pwd.getpwnam(name).pw_gid
 
3166
            gid = pwd.getpwnam(group).pw_gid
2471
3167
            break
2472
3168
        except KeyError:
2473
3169
            continue
2477
3173
    try:
2478
3174
        os.setgid(gid)
2479
3175
        os.setuid(uid)
 
3176
        log.debug("Did setuid/setgid to %s:%s", uid, gid)
2480
3177
    except OSError as error:
 
3178
        log.warning("Failed to setuid/setgid to %s:%s: %s", uid, gid,
 
3179
                    os.strerror(error.errno))
2481
3180
        if error.errno != errno.EPERM:
2482
 
            raise error
2483
 
    
 
3181
            raise
 
3182
 
2484
3183
    if debug:
2485
3184
        # Enable all possible GnuTLS debugging
2486
 
        
 
3185
 
2487
3186
        # "Use a log level over 10 to enable all debugging options."
2488
3187
        # - GnuTLS manual
2489
 
        gnutls.library.functions.gnutls_global_set_log_level(11)
2490
 
        
2491
 
        @gnutls.library.types.gnutls_log_func
 
3188
        gnutls.global_set_log_level(11)
 
3189
 
 
3190
        @gnutls.log_func
2492
3191
        def debug_gnutls(level, string):
2493
 
            logger.debug("GnuTLS: %s", string[:-1])
2494
 
        
2495
 
        (gnutls.library.functions
2496
 
         .gnutls_global_set_log_function(debug_gnutls))
2497
 
        
 
3192
            log.debug("GnuTLS: %s",
 
3193
                      string[:-1].decode("utf-8", errors="replace"))
 
3194
 
 
3195
        gnutls.global_set_log_function(debug_gnutls)
 
3196
 
2498
3197
        # Redirect stdin so all checkers get /dev/null
2499
3198
        null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2500
3199
        os.dup2(null, sys.stdin.fileno())
2501
3200
        if null > 2:
2502
3201
            os.close(null)
2503
 
    
 
3202
 
2504
3203
    # Need to fork before connecting to D-Bus
2505
3204
    if not foreground:
2506
3205
        # Close all input and output, do double fork, etc.
2507
3206
        daemon()
2508
 
    
2509
 
    # multiprocessing will use threads, so before we use gobject we
2510
 
    # need to inform gobject that threads will be used.
2511
 
    gobject.threads_init()
2512
 
    
 
3207
 
 
3208
    if gi.version_info < (3, 10, 2):
 
3209
        # multiprocessing will use threads, so before we use GLib we
 
3210
        # need to inform GLib that threads will be used.
 
3211
        GLib.threads_init()
 
3212
 
2513
3213
    global main_loop
2514
3214
    # From the Avahi example code
2515
3215
    DBusGMainLoop(set_as_default=True)
2516
 
    main_loop = gobject.MainLoop()
 
3216
    main_loop = GLib.MainLoop()
2517
3217
    bus = dbus.SystemBus()
2518
3218
    # End of Avahi example code
2519
3219
    if use_dbus:
2520
3220
        try:
2521
3221
            bus_name = dbus.service.BusName("se.recompile.Mandos",
2522
 
                                            bus, do_not_queue=True)
2523
 
            old_bus_name = (dbus.service.BusName
2524
 
                            ("se.bsnet.fukt.Mandos", bus,
2525
 
                             do_not_queue=True))
2526
 
        except dbus.exceptions.NameExistsException as e:
2527
 
            logger.error("Disabling D-Bus:", exc_info=e)
 
3222
                                            bus,
 
3223
                                            do_not_queue=True)
 
3224
            old_bus_name = dbus.service.BusName(
 
3225
                "se.bsnet.fukt.Mandos", bus,
 
3226
                do_not_queue=True)
 
3227
        except dbus.exceptions.DBusException as e:
 
3228
            log.error("Disabling D-Bus:", exc_info=e)
2528
3229
            use_dbus = False
2529
3230
            server_settings["use_dbus"] = False
2530
3231
            tcp_server.use_dbus = False
2531
 
    protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2532
 
    service = AvahiServiceToSyslog(name =
2533
 
                                   server_settings["servicename"],
2534
 
                                   servicetype = "_mandos._tcp",
2535
 
                                   protocol = protocol, bus = bus)
2536
 
    if server_settings["interface"]:
2537
 
        service.interface = (if_nametoindex
2538
 
                             (str(server_settings["interface"])))
2539
 
    
 
3232
    if zeroconf:
 
3233
        protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
 
3234
        service = AvahiServiceToSyslog(
 
3235
            name=server_settings["servicename"],
 
3236
            servicetype="_mandos._tcp",
 
3237
            protocol=protocol,
 
3238
            bus=bus)
 
3239
        if server_settings["interface"]:
 
3240
            service.interface = if_nametoindex(
 
3241
                server_settings["interface"].encode("utf-8"))
 
3242
 
2540
3243
    global multiprocessing_manager
2541
3244
    multiprocessing_manager = multiprocessing.Manager()
2542
 
    
 
3245
 
2543
3246
    client_class = Client
2544
3247
    if use_dbus:
2545
 
        client_class = functools.partial(ClientDBus, bus = bus)
2546
 
    
 
3248
        client_class = functools.partial(ClientDBus, bus=bus)
 
3249
 
2547
3250
    client_settings = Client.config_parser(client_config)
2548
3251
    old_client_settings = {}
2549
3252
    clients_data = {}
2550
 
    
 
3253
 
2551
3254
    # This is used to redirect stdout and stderr for checker processes
2552
3255
    global wnull
2553
 
    wnull = open(os.devnull, "w") # A writable /dev/null
 
3256
    wnull = open(os.devnull, "w")  # A writable /dev/null
2554
3257
    # Only used if server is running in foreground but not in debug
2555
3258
    # mode
2556
3259
    if debug or not foreground:
2557
3260
        wnull.close()
2558
 
    
 
3261
 
2559
3262
    # Get client data and settings from last running state.
2560
3263
    if server_settings["restore"]:
2561
3264
        try:
2562
3265
            with open(stored_state_path, "rb") as stored_state:
2563
 
                clients_data, old_client_settings = (pickle.load
2564
 
                                                     (stored_state))
 
3266
                if sys.version_info.major == 2:
 
3267
                    clients_data, old_client_settings = pickle.load(
 
3268
                        stored_state)
 
3269
                else:
 
3270
                    bytes_clients_data, bytes_old_client_settings = (
 
3271
                        pickle.load(stored_state, encoding="bytes"))
 
3272
                    #   Fix bytes to strings
 
3273
                    #  clients_data
 
3274
                    # .keys()
 
3275
                    clients_data = {(key.decode("utf-8")
 
3276
                                     if isinstance(key, bytes)
 
3277
                                     else key): value
 
3278
                                    for key, value in
 
3279
                                    bytes_clients_data.items()}
 
3280
                    del bytes_clients_data
 
3281
                    for key in clients_data:
 
3282
                        value = {(k.decode("utf-8")
 
3283
                                  if isinstance(k, bytes) else k): v
 
3284
                                 for k, v in
 
3285
                                 clients_data[key].items()}
 
3286
                        clients_data[key] = value
 
3287
                        # .client_structure
 
3288
                        value["client_structure"] = [
 
3289
                            (s.decode("utf-8")
 
3290
                             if isinstance(s, bytes)
 
3291
                             else s) for s in
 
3292
                            value["client_structure"]]
 
3293
                        # .name, .host, and .checker_command
 
3294
                        for k in ("name", "host", "checker_command"):
 
3295
                            if isinstance(value[k], bytes):
 
3296
                                value[k] = value[k].decode("utf-8")
 
3297
                        if "key_id" not in value:
 
3298
                            value["key_id"] = ""
 
3299
                        elif "fingerprint" not in value:
 
3300
                            value["fingerprint"] = ""
 
3301
                    #  old_client_settings
 
3302
                    # .keys()
 
3303
                    old_client_settings = {
 
3304
                        (key.decode("utf-8")
 
3305
                         if isinstance(key, bytes)
 
3306
                         else key): value
 
3307
                        for key, value in
 
3308
                        bytes_old_client_settings.items()}
 
3309
                    del bytes_old_client_settings
 
3310
                    # .host and .checker_command
 
3311
                    for value in old_client_settings.values():
 
3312
                        for attribute in ("host", "checker_command"):
 
3313
                            if isinstance(value[attribute], bytes):
 
3314
                                value[attribute] = (value[attribute]
 
3315
                                                    .decode("utf-8"))
2565
3316
            os.remove(stored_state_path)
2566
3317
        except IOError as e:
2567
3318
            if e.errno == errno.ENOENT:
2568
 
                logger.warning("Could not load persistent state: {0}"
2569
 
                                .format(os.strerror(e.errno)))
 
3319
                log.warning("Could not load persistent state:"
 
3320
                            " %s", os.strerror(e.errno))
2570
3321
            else:
2571
 
                logger.critical("Could not load persistent state:",
2572
 
                                exc_info=e)
 
3322
                log.critical("Could not load persistent state:",
 
3323
                             exc_info=e)
2573
3324
                raise
2574
3325
        except EOFError as e:
2575
 
            logger.warning("Could not load persistent state: "
2576
 
                           "EOFError:", exc_info=e)
2577
 
    
 
3326
            log.warning("Could not load persistent state: EOFError:",
 
3327
                        exc_info=e)
 
3328
 
2578
3329
    with PGPEngine() as pgp:
2579
 
        for client_name, client in clients_data.iteritems():
 
3330
        for client_name, client in clients_data.items():
2580
3331
            # Skip removed clients
2581
3332
            if client_name not in client_settings:
2582
3333
                continue
2583
 
            
 
3334
 
2584
3335
            # Decide which value to use after restoring saved state.
2585
3336
            # We have three different values: Old config file,
2586
3337
            # new config file, and saved state.
2591
3342
                    # For each value in new config, check if it
2592
3343
                    # differs from the old config value (Except for
2593
3344
                    # the "secret" attribute)
2594
 
                    if (name != "secret" and
2595
 
                        value != old_client_settings[client_name]
2596
 
                        [name]):
 
3345
                    if (name != "secret"
 
3346
                        and (value !=
 
3347
                             old_client_settings[client_name][name])):
2597
3348
                        client[name] = value
2598
3349
                except KeyError:
2599
3350
                    pass
2600
 
            
 
3351
 
2601
3352
            # Clients who has passed its expire date can still be
2602
 
            # enabled if its last checker was successful.  Clients
 
3353
            # enabled if its last checker was successful.  A Client
2603
3354
            # whose checker succeeded before we stored its state is
2604
3355
            # assumed to have successfully run all checkers during
2605
3356
            # downtime.
2606
3357
            if client["enabled"]:
2607
3358
                if datetime.datetime.utcnow() >= client["expires"]:
2608
3359
                    if not client["last_checked_ok"]:
2609
 
                        logger.warning(
2610
 
                            "disabling client {0} - Client never "
2611
 
                            "performed a successful checker"
2612
 
                            .format(client_name))
 
3360
                        log.warning("disabling client %s - Client"
 
3361
                                    " never performed a successful"
 
3362
                                    " checker", client_name)
2613
3363
                        client["enabled"] = False
2614
3364
                    elif client["last_checker_status"] != 0:
2615
 
                        logger.warning(
2616
 
                            "disabling client {0} - Client "
2617
 
                            "last checker failed with error code {1}"
2618
 
                            .format(client_name,
2619
 
                                    client["last_checker_status"]))
 
3365
                        log.warning("disabling client %s - Client"
 
3366
                                    " last checker failed with error"
 
3367
                                    " code %s", client_name,
 
3368
                                    client["last_checker_status"])
2620
3369
                        client["enabled"] = False
2621
3370
                    else:
2622
 
                        client["expires"] = (datetime.datetime
2623
 
                                             .utcnow()
2624
 
                                             + client["timeout"])
2625
 
                        logger.debug("Last checker succeeded,"
2626
 
                                     " keeping {0} enabled"
2627
 
                                     .format(client_name))
 
3371
                        client["expires"] = (
 
3372
                            datetime.datetime.utcnow()
 
3373
                            + client["timeout"])
 
3374
                        log.debug("Last checker succeeded, keeping %s"
 
3375
                                  " enabled", client_name)
2628
3376
            try:
2629
 
                client["secret"] = (
2630
 
                    pgp.decrypt(client["encrypted_secret"],
2631
 
                                client_settings[client_name]
2632
 
                                ["secret"]))
 
3377
                client["secret"] = pgp.decrypt(
 
3378
                    client["encrypted_secret"],
 
3379
                    client_settings[client_name]["secret"])
2633
3380
            except PGPError:
2634
3381
                # If decryption fails, we use secret from new settings
2635
 
                logger.debug("Failed to decrypt {0} old secret"
2636
 
                             .format(client_name))
2637
 
                client["secret"] = (
2638
 
                    client_settings[client_name]["secret"])
2639
 
    
 
3382
                log.debug("Failed to decrypt %s old secret",
 
3383
                          client_name)
 
3384
                client["secret"] = (client_settings[client_name]
 
3385
                                    ["secret"])
 
3386
 
2640
3387
    # Add/remove clients based on new changes made to config
2641
3388
    for client_name in (set(old_client_settings)
2642
3389
                        - set(client_settings)):
2644
3391
    for client_name in (set(client_settings)
2645
3392
                        - set(old_client_settings)):
2646
3393
        clients_data[client_name] = client_settings[client_name]
2647
 
    
 
3394
 
2648
3395
    # Create all client objects
2649
 
    for client_name, client in clients_data.iteritems():
 
3396
    for client_name, client in clients_data.items():
2650
3397
        tcp_server.clients[client_name] = client_class(
2651
 
            name = client_name, settings = client,
2652
 
            server_settings = server_settings)
2653
 
    
 
3398
            name=client_name,
 
3399
            settings=client,
 
3400
            server_settings=server_settings)
 
3401
 
2654
3402
    if not tcp_server.clients:
2655
 
        logger.warning("No clients defined")
2656
 
    
 
3403
        log.warning("No clients defined")
 
3404
 
2657
3405
    if not foreground:
2658
3406
        if pidfile is not None:
 
3407
            pid = os.getpid()
2659
3408
            try:
2660
3409
                with pidfile:
2661
 
                    pid = os.getpid()
2662
 
                    pidfile.write(str(pid) + "\n".encode("utf-8"))
 
3410
                    print(pid, file=pidfile)
2663
3411
            except IOError:
2664
 
                logger.error("Could not write to file %r with PID %d",
2665
 
                             pidfilename, pid)
 
3412
                log.error("Could not write to file %r with PID %d",
 
3413
                          pidfilename, pid)
2666
3414
        del pidfile
2667
3415
        del pidfilename
2668
 
    
2669
 
    signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2670
 
    signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
2671
 
    
 
3416
 
 
3417
    for termsig in (signal.SIGHUP, signal.SIGTERM):
 
3418
        GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,
 
3419
                             lambda: main_loop.quit() and False)
 
3420
 
2672
3421
    if use_dbus:
2673
 
        @alternate_dbus_interfaces({"se.recompile.Mandos":
2674
 
                                        "se.bsnet.fukt.Mandos"})
2675
 
        class MandosDBusService(DBusObjectWithProperties):
 
3422
 
 
3423
        @alternate_dbus_interfaces(
 
3424
            {"se.recompile.Mandos": "se.bsnet.fukt.Mandos"})
 
3425
        class MandosDBusService(DBusObjectWithObjectManager):
2676
3426
            """A D-Bus proxy object"""
 
3427
 
2677
3428
            def __init__(self):
2678
3429
                dbus.service.Object.__init__(self, bus, "/")
 
3430
 
2679
3431
            _interface = "se.recompile.Mandos"
2680
 
            
2681
 
            @dbus_interface_annotations(_interface)
2682
 
            def _foo(self):
2683
 
                return { "org.freedesktop.DBus.Property"
2684
 
                         ".EmitsChangedSignal":
2685
 
                             "false"}
2686
 
            
 
3432
 
2687
3433
            @dbus.service.signal(_interface, signature="o")
2688
3434
            def ClientAdded(self, objpath):
2689
3435
                "D-Bus signal"
2690
3436
                pass
2691
 
            
 
3437
 
2692
3438
            @dbus.service.signal(_interface, signature="ss")
2693
 
            def ClientNotFound(self, fingerprint, address):
 
3439
            def ClientNotFound(self, key_id, address):
2694
3440
                "D-Bus signal"
2695
3441
                pass
2696
 
            
 
3442
 
 
3443
            @dbus_annotations({"org.freedesktop.DBus.Deprecated":
 
3444
                               "true"})
2697
3445
            @dbus.service.signal(_interface, signature="os")
2698
3446
            def ClientRemoved(self, objpath, name):
2699
3447
                "D-Bus signal"
2700
3448
                pass
2701
 
            
 
3449
 
 
3450
            @dbus_annotations({"org.freedesktop.DBus.Deprecated":
 
3451
                               "true"})
2702
3452
            @dbus.service.method(_interface, out_signature="ao")
2703
3453
            def GetAllClients(self):
2704
3454
                "D-Bus method"
2705
 
                return dbus.Array(c.dbus_object_path
2706
 
                                  for c in
2707
 
                                  tcp_server.clients.itervalues())
2708
 
            
 
3455
                return dbus.Array(c.dbus_object_path for c in
 
3456
                                  tcp_server.clients.values())
 
3457
 
 
3458
            @dbus_annotations({"org.freedesktop.DBus.Deprecated":
 
3459
                               "true"})
2709
3460
            @dbus.service.method(_interface,
2710
3461
                                 out_signature="a{oa{sv}}")
2711
3462
            def GetAllClientsWithProperties(self):
2712
3463
                "D-Bus method"
2713
3464
                return dbus.Dictionary(
2714
 
                    ((c.dbus_object_path, c.GetAll(""))
2715
 
                     for c in tcp_server.clients.itervalues()),
 
3465
                    {c.dbus_object_path: c.GetAll(
 
3466
                        "se.recompile.Mandos.Client")
 
3467
                     for c in tcp_server.clients.values()},
2716
3468
                    signature="oa{sv}")
2717
 
            
 
3469
 
2718
3470
            @dbus.service.method(_interface, in_signature="o")
2719
3471
            def RemoveClient(self, object_path):
2720
3472
                "D-Bus method"
2721
 
                for c in tcp_server.clients.itervalues():
 
3473
                for c in tcp_server.clients.values():
2722
3474
                    if c.dbus_object_path == object_path:
2723
3475
                        del tcp_server.clients[c.name]
2724
3476
                        c.remove_from_connection()
2725
 
                        # Don't signal anything except ClientRemoved
 
3477
                        # Don't signal the disabling
2726
3478
                        c.disable(quiet=True)
2727
 
                        # Emit D-Bus signal
2728
 
                        self.ClientRemoved(object_path, c.name)
 
3479
                        # Emit D-Bus signal for removal
 
3480
                        self.client_removed_signal(c)
2729
3481
                        return
2730
3482
                raise KeyError(object_path)
2731
 
            
 
3483
 
2732
3484
            del _interface
2733
 
        
 
3485
 
 
3486
            @dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
 
3487
                                 out_signature="a{oa{sa{sv}}}")
 
3488
            def GetManagedObjects(self):
 
3489
                """D-Bus method"""
 
3490
                return dbus.Dictionary(
 
3491
                    {client.dbus_object_path:
 
3492
                     dbus.Dictionary(
 
3493
                         {interface: client.GetAll(interface)
 
3494
                          for interface in
 
3495
                          client._get_all_interface_names()})
 
3496
                     for client in tcp_server.clients.values()})
 
3497
 
 
3498
            def client_added_signal(self, client):
 
3499
                """Send the new standard signal and the old signal"""
 
3500
                if use_dbus:
 
3501
                    # New standard signal
 
3502
                    self.InterfacesAdded(
 
3503
                        client.dbus_object_path,
 
3504
                        dbus.Dictionary(
 
3505
                            {interface: client.GetAll(interface)
 
3506
                             for interface in
 
3507
                             client._get_all_interface_names()}))
 
3508
                    # Old signal
 
3509
                    self.ClientAdded(client.dbus_object_path)
 
3510
 
 
3511
            def client_removed_signal(self, client):
 
3512
                """Send the new standard signal and the old signal"""
 
3513
                if use_dbus:
 
3514
                    # New standard signal
 
3515
                    self.InterfacesRemoved(
 
3516
                        client.dbus_object_path,
 
3517
                        client._get_all_interface_names())
 
3518
                    # Old signal
 
3519
                    self.ClientRemoved(client.dbus_object_path,
 
3520
                                       client.name)
 
3521
 
2734
3522
        mandos_dbus_service = MandosDBusService()
2735
 
    
 
3523
 
 
3524
    # Save modules to variables to exempt the modules from being
 
3525
    # unloaded before the function registered with atexit() is run.
 
3526
    mp = multiprocessing
 
3527
    wn = wnull
 
3528
 
2736
3529
    def cleanup():
2737
3530
        "Cleanup function; run on exit"
2738
 
        service.cleanup()
2739
 
        
2740
 
        multiprocessing.active_children()
2741
 
        wnull.close()
 
3531
        if zeroconf:
 
3532
            service.cleanup()
 
3533
 
 
3534
        mp.active_children()
 
3535
        wn.close()
2742
3536
        if not (tcp_server.clients or client_settings):
2743
3537
            return
2744
 
        
 
3538
 
2745
3539
        # Store client before exiting. Secrets are encrypted with key
2746
3540
        # based on what config file has. If config file is
2747
3541
        # removed/edited, old secret will thus be unrecovable.
2748
3542
        clients = {}
2749
3543
        with PGPEngine() as pgp:
2750
 
            for client in tcp_server.clients.itervalues():
 
3544
            for client in tcp_server.clients.values():
2751
3545
                key = client_settings[client.name]["secret"]
2752
3546
                client.encrypted_secret = pgp.encrypt(client.secret,
2753
3547
                                                      key)
2754
3548
                client_dict = {}
2755
 
                
 
3549
 
2756
3550
                # A list of attributes that can not be pickled
2757
3551
                # + secret.
2758
 
                exclude = set(("bus", "changedstate", "secret",
2759
 
                               "checker", "server_settings"))
2760
 
                for name, typ in (inspect.getmembers
2761
 
                                  (dbus.service.Object)):
 
3552
                exclude = {"bus", "changedstate", "secret",
 
3553
                           "checker", "server_settings"}
 
3554
                for name, typ in inspect.getmembers(dbus.service
 
3555
                                                    .Object):
2762
3556
                    exclude.add(name)
2763
 
                
 
3557
 
2764
3558
                client_dict["encrypted_secret"] = (client
2765
3559
                                                   .encrypted_secret)
2766
3560
                for attr in client.client_structure:
2767
3561
                    if attr not in exclude:
2768
3562
                        client_dict[attr] = getattr(client, attr)
2769
 
                
 
3563
 
2770
3564
                clients[client.name] = client_dict
2771
3565
                del client_settings[client.name]["secret"]
2772
 
        
 
3566
 
2773
3567
        try:
2774
 
            with (tempfile.NamedTemporaryFile
2775
 
                  (mode='wb', suffix=".pickle", prefix='clients-',
2776
 
                   dir=os.path.dirname(stored_state_path),
2777
 
                   delete=False)) as stored_state:
2778
 
                pickle.dump((clients, client_settings), stored_state)
2779
 
                tempname=stored_state.name
 
3568
            with tempfile.NamedTemporaryFile(
 
3569
                    mode="wb",
 
3570
                    suffix=".pickle",
 
3571
                    prefix="clients-",
 
3572
                    dir=os.path.dirname(stored_state_path),
 
3573
                    delete=False) as stored_state:
 
3574
                pickle.dump((clients, client_settings), stored_state,
 
3575
                            protocol=2)
 
3576
                tempname = stored_state.name
2780
3577
            os.rename(tempname, stored_state_path)
2781
3578
        except (IOError, OSError) as e:
2782
3579
            if not debug:
2785
3582
                except NameError:
2786
3583
                    pass
2787
3584
            if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
2788
 
                logger.warning("Could not save persistent state: {0}"
2789
 
                               .format(os.strerror(e.errno)))
 
3585
                log.warning("Could not save persistent state: %s",
 
3586
                            os.strerror(e.errno))
2790
3587
            else:
2791
 
                logger.warning("Could not save persistent state:",
2792
 
                               exc_info=e)
2793
 
                raise e
2794
 
        
 
3588
                log.warning("Could not save persistent state:",
 
3589
                            exc_info=e)
 
3590
                raise
 
3591
 
2795
3592
        # Delete all clients, and settings from config
2796
3593
        while tcp_server.clients:
2797
3594
            name, client = tcp_server.clients.popitem()
2798
3595
            if use_dbus:
2799
3596
                client.remove_from_connection()
2800
 
            # Don't signal anything except ClientRemoved
 
3597
            # Don't signal the disabling
2801
3598
            client.disable(quiet=True)
 
3599
            # Emit D-Bus signal for removal
2802
3600
            if use_dbus:
2803
 
                # Emit D-Bus signal
2804
 
                mandos_dbus_service.ClientRemoved(client
2805
 
                                                  .dbus_object_path,
2806
 
                                                  client.name)
 
3601
                mandos_dbus_service.client_removed_signal(client)
2807
3602
        client_settings.clear()
2808
 
    
 
3603
 
2809
3604
    atexit.register(cleanup)
2810
 
    
2811
 
    for client in tcp_server.clients.itervalues():
 
3605
 
 
3606
    for client in tcp_server.clients.values():
2812
3607
        if use_dbus:
2813
 
            # Emit D-Bus signal
2814
 
            mandos_dbus_service.ClientAdded(client.dbus_object_path)
 
3608
            # Emit D-Bus signal for adding
 
3609
            mandos_dbus_service.client_added_signal(client)
2815
3610
        # Need to initiate checking of clients
2816
3611
        if client.enabled:
2817
3612
            client.init_checker()
2818
 
    
 
3613
 
2819
3614
    tcp_server.enable()
2820
3615
    tcp_server.server_activate()
2821
 
    
 
3616
 
2822
3617
    # Find out what port we got
2823
 
    service.port = tcp_server.socket.getsockname()[1]
 
3618
    if zeroconf:
 
3619
        service.port = tcp_server.socket.getsockname()[1]
2824
3620
    if use_ipv6:
2825
 
        logger.info("Now listening on address %r, port %d,"
2826
 
                    " flowinfo %d, scope_id %d",
2827
 
                    *tcp_server.socket.getsockname())
 
3621
        log.info("Now listening on address %r, port %d, flowinfo %d,"
 
3622
                 " scope_id %d", *tcp_server.socket.getsockname())
2828
3623
    else:                       # IPv4
2829
 
        logger.info("Now listening on address %r, port %d",
2830
 
                    *tcp_server.socket.getsockname())
2831
 
    
2832
 
    #service.interface = tcp_server.socket.getsockname()[3]
2833
 
    
 
3624
        log.info("Now listening on address %r, port %d",
 
3625
                 *tcp_server.socket.getsockname())
 
3626
 
 
3627
    # service.interface = tcp_server.socket.getsockname()[3]
 
3628
 
2834
3629
    try:
2835
 
        # From the Avahi example code
2836
 
        try:
2837
 
            service.activate()
2838
 
        except dbus.exceptions.DBusException as error:
2839
 
            logger.critical("D-Bus Exception", exc_info=error)
2840
 
            cleanup()
2841
 
            sys.exit(1)
2842
 
        # End of Avahi example code
2843
 
        
2844
 
        gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
2845
 
                             lambda *args, **kwargs:
2846
 
                             (tcp_server.handle_request
2847
 
                              (*args[2:], **kwargs) or True))
2848
 
        
2849
 
        logger.debug("Starting main loop")
 
3630
        if zeroconf:
 
3631
            # From the Avahi example code
 
3632
            try:
 
3633
                service.activate()
 
3634
            except dbus.exceptions.DBusException as error:
 
3635
                log.critical("D-Bus Exception", exc_info=error)
 
3636
                cleanup()
 
3637
                sys.exit(1)
 
3638
            # End of Avahi example code
 
3639
 
 
3640
        GLib.io_add_watch(
 
3641
            GLib.IOChannel.unix_new(tcp_server.fileno()),
 
3642
            GLib.PRIORITY_DEFAULT, GLib.IO_IN,
 
3643
            lambda *args, **kwargs: (tcp_server.handle_request
 
3644
                                     (*args[2:], **kwargs) or True))
 
3645
 
 
3646
        log.debug("Starting main loop")
2850
3647
        main_loop.run()
2851
3648
    except AvahiError as error:
2852
 
        logger.critical("Avahi Error", exc_info=error)
 
3649
        log.critical("Avahi Error", exc_info=error)
2853
3650
        cleanup()
2854
3651
        sys.exit(1)
2855
3652
    except KeyboardInterrupt:
2856
3653
        if debug:
2857
3654
            print("", file=sys.stderr)
2858
 
        logger.debug("Server received KeyboardInterrupt")
2859
 
    logger.debug("Server exiting")
 
3655
        log.debug("Server received KeyboardInterrupt")
 
3656
    log.debug("Server exiting")
2860
3657
    # Must run before the D-Bus bus name gets deregistered
2861
3658
    cleanup()
2862
3659
 
2863
 
if __name__ == '__main__':
2864
 
    main()
 
3660
 
 
3661
def parse_test_args():
 
3662
    # type: () -> argparse.Namespace
 
3663
    parser = argparse.ArgumentParser(add_help=False)
 
3664
    parser.add_argument("--check", action="store_true")
 
3665
    parser.add_argument("--prefix", )
 
3666
    args, unknown_args = parser.parse_known_args()
 
3667
    if args.check:
 
3668
        # Remove test options from sys.argv
 
3669
        sys.argv[1:] = unknown_args
 
3670
    return args
 
3671
 
 
3672
# Add all tests from doctest strings
 
3673
def load_tests(loader, tests, none):
 
3674
    import doctest
 
3675
    tests.addTests(doctest.DocTestSuite())
 
3676
    return tests
 
3677
 
 
3678
if __name__ == "__main__":
 
3679
    options = parse_test_args()
 
3680
    try:
 
3681
        if options.check:
 
3682
            extra_test_prefix = options.prefix
 
3683
            if extra_test_prefix is not None:
 
3684
                if not (unittest.main(argv=[""], exit=False)
 
3685
                        .result.wasSuccessful()):
 
3686
                    sys.exit(1)
 
3687
                class ExtraTestLoader(unittest.TestLoader):
 
3688
                    testMethodPrefix = extra_test_prefix
 
3689
                # Call using ./scriptname --test [--verbose]
 
3690
                unittest.main(argv=[""], testLoader=ExtraTestLoader())
 
3691
            else:
 
3692
                unittest.main(argv=[""])
 
3693
        else:
 
3694
            main()
 
3695
    finally:
 
3696
        logging.shutdown()
 
3697
 
 
3698
# Local Variables:
 
3699
# run-tests:
 
3700
# (lambda (&optional extra)
 
3701
#   (if (not (funcall run-tests-in-test-buffer default-directory
 
3702
#             extra))
 
3703
#       (funcall show-test-buffer-in-test-window)
 
3704
#     (funcall remove-test-window)
 
3705
#     (if extra (message "Extra tests run successfully!"))))
 
3706
# run-tests-in-test-buffer:
 
3707
# (lambda (dir &optional extra)
 
3708
#   (with-current-buffer (get-buffer-create "*Test*")
 
3709
#     (setq buffer-read-only nil
 
3710
#           default-directory dir)
 
3711
#     (erase-buffer)
 
3712
#     (compilation-mode))
 
3713
#   (let ((process-result
 
3714
#          (let ((inhibit-read-only t))
 
3715
#            (process-file-shell-command
 
3716
#             (funcall get-command-line extra) nil "*Test*"))))
 
3717
#     (and (numberp process-result)
 
3718
#          (= process-result 0))))
 
3719
# get-command-line:
 
3720
# (lambda (&optional extra)
 
3721
#   (let ((quoted-script
 
3722
#          (shell-quote-argument (funcall get-script-name))))
 
3723
#     (format
 
3724
#      (concat "%s --check" (if extra " --prefix=atest" ""))
 
3725
#      quoted-script)))
 
3726
# get-script-name:
 
3727
# (lambda ()
 
3728
#   (if (fboundp 'file-local-name)
 
3729
#       (file-local-name (buffer-file-name))
 
3730
#     (or (file-remote-p (buffer-file-name) 'localname)
 
3731
#         (buffer-file-name))))
 
3732
# remove-test-window:
 
3733
# (lambda ()
 
3734
#   (let ((test-window (get-buffer-window "*Test*")))
 
3735
#     (if test-window (delete-window test-window))))
 
3736
# show-test-buffer-in-test-window:
 
3737
# (lambda ()
 
3738
#   (when (not (get-buffer-window-list "*Test*"))
 
3739
#     (setq next-error-last-buffer (get-buffer "*Test*"))
 
3740
#     (let* ((side (if (>= (window-width) 146) 'right 'bottom))
 
3741
#            (display-buffer-overriding-action
 
3742
#             `((display-buffer-in-side-window) (side . ,side)
 
3743
#               (window-height . fit-window-to-buffer)
 
3744
#               (window-width . fit-window-to-buffer))))
 
3745
#       (display-buffer "*Test*"))))
 
3746
# eval:
 
3747
# (progn
 
3748
#   (let* ((run-extra-tests (lambda () (interactive)
 
3749
#                             (funcall run-tests t)))
 
3750
#          (inner-keymap `(keymap (116 . ,run-extra-tests))) ; t
 
3751
#          (outer-keymap `(keymap (3 . ,inner-keymap))))     ; C-c
 
3752
#     (setq minor-mode-overriding-map-alist
 
3753
#           (cons `(run-tests . ,outer-keymap)
 
3754
#                 minor-mode-overriding-map-alist)))
 
3755
#   (add-hook 'after-save-hook run-tests 90 t))
 
3756
# End: