/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos

  • Committer: Teddy Hogeborn
  • Date: 2012-05-20 13:17:37 UTC
  • mfrom: (585 trunk)
  • mto: (237.4.31 release)
  • mto: This revision was merged to the branch mainline in revision 586.
  • Revision ID: teddy@recompile.se-20120520131737-p1toj7kaxgs3wki3
mergeĀ fromĀ trunk

Show diffs side-by-side

added added

removed removed

Lines of Context:
34
34
from __future__ import (division, absolute_import, print_function,
35
35
                        unicode_literals)
36
36
 
 
37
from future_builtins import *
 
38
 
37
39
import SocketServer as socketserver
38
40
import socket
39
41
import argparse
65
67
import types
66
68
import binascii
67
69
import tempfile
 
70
import itertools
68
71
 
69
72
import dbus
70
73
import dbus.service
175
178
    
176
179
    def encrypt(self, data, password):
177
180
        self.gnupg.passphrase = self.password_encode(password)
178
 
        with open(os.devnull) as devnull:
 
181
        with open(os.devnull, "w") as devnull:
179
182
            try:
180
183
                proc = self.gnupg.run(['--symmetric'],
181
184
                                      create_fhs=['stdin', 'stdout'],
192
195
    
193
196
    def decrypt(self, data, password):
194
197
        self.gnupg.passphrase = self.password_encode(password)
195
 
        with open(os.devnull) as devnull:
 
198
        with open(os.devnull, "w") as devnull:
196
199
            try:
197
200
                proc = self.gnupg.run(['--decrypt'],
198
201
                                      create_fhs=['stdin', 'stdout'],
199
202
                                      attach_fhs={'stderr': devnull})
200
 
                with contextlib.closing(proc.handles['stdin'] ) as f:
 
203
                with contextlib.closing(proc.handles['stdin']) as f:
201
204
                    f.write(data)
202
205
                with contextlib.closing(proc.handles['stdout']) as f:
203
206
                    decrypted_plaintext = f.read()
208
211
        return decrypted_plaintext
209
212
 
210
213
 
211
 
 
212
214
class AvahiError(Exception):
213
215
    def __init__(self, value, *args, **kwargs):
214
216
        self.value = value
243
245
    server: D-Bus Server
244
246
    bus: dbus.SystemBus()
245
247
    """
 
248
    
246
249
    def __init__(self, interface = avahi.IF_UNSPEC, name = None,
247
250
                 servicetype = None, port = None, TXT = None,
248
251
                 domain = "", host = "", max_renames = 32768,
261
264
        self.server = None
262
265
        self.bus = bus
263
266
        self.entry_group_state_changed_match = None
 
267
    
264
268
    def rename(self):
265
269
        """Derived from the Avahi example code"""
266
270
        if self.rename_count >= self.max_renames:
276
280
        try:
277
281
            self.add()
278
282
        except dbus.exceptions.DBusException as error:
279
 
            logger.critical("DBusException: %s", error)
 
283
            logger.critical("D-Bus Exception", exc_info=error)
280
284
            self.cleanup()
281
285
            os._exit(1)
282
286
        self.rename_count += 1
 
287
    
283
288
    def remove(self):
284
289
        """Derived from the Avahi example code"""
285
290
        if self.entry_group_state_changed_match is not None:
287
292
            self.entry_group_state_changed_match = None
288
293
        if self.group is not None:
289
294
            self.group.Reset()
 
295
    
290
296
    def add(self):
291
297
        """Derived from the Avahi example code"""
292
298
        self.remove()
309
315
            dbus.UInt16(self.port),
310
316
            avahi.string_array_to_txt_array(self.TXT))
311
317
        self.group.Commit()
 
318
    
312
319
    def entry_group_state_changed(self, state, error):
313
320
        """Derived from the Avahi example code"""
314
321
        logger.debug("Avahi entry group state change: %i", state)
321
328
        elif state == avahi.ENTRY_GROUP_FAILURE:
322
329
            logger.critical("Avahi: Error in group state changed %s",
323
330
                            unicode(error))
324
 
            raise AvahiGroupError("State changed: %s"
325
 
                                  % unicode(error))
 
331
            raise AvahiGroupError("State changed: {0!s}"
 
332
                                  .format(error))
 
333
    
326
334
    def cleanup(self):
327
335
        """Derived from the Avahi example code"""
328
336
        if self.group is not None:
333
341
                pass
334
342
            self.group = None
335
343
        self.remove()
 
344
    
336
345
    def server_state_changed(self, state, error=None):
337
346
        """Derived from the Avahi example code"""
338
347
        logger.debug("Avahi server state change: %i", state)
357
366
                logger.debug("Unknown state: %r", state)
358
367
            else:
359
368
                logger.debug("Unknown state: %r: %r", state, error)
 
369
    
360
370
    def activate(self):
361
371
        """Derived from the Avahi example code"""
362
372
        if self.server is None:
369
379
                                 self.server_state_changed)
370
380
        self.server_state_changed(self.server.GetState())
371
381
 
 
382
 
372
383
class AvahiServiceToSyslog(AvahiService):
373
384
    def rename(self):
374
385
        """Add the new name to the syslog messages"""
375
386
        ret = AvahiService.rename(self)
376
387
        syslogger.setFormatter(logging.Formatter
377
 
                               ('Mandos (%s) [%%(process)d]:'
378
 
                                ' %%(levelname)s: %%(message)s'
379
 
                                % self.name))
 
388
                               ('Mandos ({0}) [%(process)d]:'
 
389
                                ' %(levelname)s: %(message)s'
 
390
                                .format(self.name)))
380
391
        return ret
381
392
 
 
393
 
382
394
def timedelta_to_milliseconds(td):
383
395
    "Convert a datetime.timedelta() to milliseconds"
384
396
    return ((td.days * 24 * 60 * 60 * 1000)
385
397
            + (td.seconds * 1000)
386
398
            + (td.microseconds // 1000))
387
 
        
 
399
 
 
400
 
388
401
class Client(object):
389
402
    """A representation of a client host served by this server.
390
403
    
429
442
    """
430
443
    
431
444
    runtime_expansions = ("approval_delay", "approval_duration",
432
 
                          "created", "enabled", "fingerprint",
433
 
                          "host", "interval", "last_checked_ok",
 
445
                          "created", "enabled", "expires",
 
446
                          "fingerprint", "host", "interval",
 
447
                          "last_approval_request", "last_checked_ok",
434
448
                          "last_enabled", "name", "timeout")
435
449
    client_defaults = { "timeout": "5m",
436
450
                        "extended_timeout": "15m",
457
471
    
458
472
    def approval_delay_milliseconds(self):
459
473
        return timedelta_to_milliseconds(self.approval_delay)
460
 
 
 
474
    
461
475
    @staticmethod
462
476
    def config_parser(config):
463
477
        """Construct a new dict of client settings of this form:
488
502
                          "rb") as secfile:
489
503
                    client["secret"] = secfile.read()
490
504
            else:
491
 
                raise TypeError("No secret or secfile for section %s"
492
 
                                % section)
 
505
                raise TypeError("No secret or secfile for section {0}"
 
506
                                .format(section))
493
507
            client["timeout"] = string_to_delta(section["timeout"])
494
508
            client["extended_timeout"] = string_to_delta(
495
509
                section["extended_timeout"])
504
518
            client["last_checker_status"] = -2
505
519
        
506
520
        return settings
507
 
        
508
 
        
 
521
    
509
522
    def __init__(self, settings, name = None):
510
 
        """Note: the 'checker' key in 'config' sets the
511
 
        'checker_command' attribute and *not* the 'checker'
512
 
        attribute."""
513
523
        self.name = name
514
524
        # adding all client settings
515
525
        for setting, value in settings.iteritems():
524
534
        else:
525
535
            self.last_enabled = None
526
536
            self.expires = None
527
 
       
 
537
        
528
538
        logger.debug("Creating client %r", self.name)
529
539
        # Uppercase and remove spaces from fingerprint for later
530
540
        # comparison purposes with return value from the fingerprint()
532
542
        logger.debug("  Fingerprint: %s", self.fingerprint)
533
543
        self.created = settings.get("created",
534
544
                                    datetime.datetime.utcnow())
535
 
 
 
545
        
536
546
        # attributes specific for this server instance
537
547
        self.checker = None
538
548
        self.checker_initiator_tag = None
566
576
        if getattr(self, "enabled", False):
567
577
            # Already enabled
568
578
            return
569
 
        self.send_changedstate()
570
579
        self.expires = datetime.datetime.utcnow() + self.timeout
571
580
        self.enabled = True
572
581
        self.last_enabled = datetime.datetime.utcnow()
573
582
        self.init_checker()
 
583
        self.send_changedstate()
574
584
    
575
585
    def disable(self, quiet=True):
576
586
        """Disable this client."""
577
587
        if not getattr(self, "enabled", False):
578
588
            return False
579
589
        if not quiet:
580
 
            self.send_changedstate()
581
 
        if not quiet:
582
590
            logger.info("Disabling client %s", self.name)
583
 
        if getattr(self, "disable_initiator_tag", False):
 
591
        if getattr(self, "disable_initiator_tag", None) is not None:
584
592
            gobject.source_remove(self.disable_initiator_tag)
585
593
            self.disable_initiator_tag = None
586
594
        self.expires = None
587
 
        if getattr(self, "checker_initiator_tag", False):
 
595
        if getattr(self, "checker_initiator_tag", None) is not None:
588
596
            gobject.source_remove(self.checker_initiator_tag)
589
597
            self.checker_initiator_tag = None
590
598
        self.stop_checker()
591
599
        self.enabled = False
 
600
        if not quiet:
 
601
            self.send_changedstate()
592
602
        # Do not run this again if called by a gobject.timeout_add
593
603
        return False
594
604
    
598
608
    def init_checker(self):
599
609
        # Schedule a new checker to be started an 'interval' from now,
600
610
        # and every interval from then on.
 
611
        if self.checker_initiator_tag is not None:
 
612
            gobject.source_remove(self.checker_initiator_tag)
601
613
        self.checker_initiator_tag = (gobject.timeout_add
602
614
                                      (self.interval_milliseconds(),
603
615
                                       self.start_checker))
604
616
        # Schedule a disable() when 'timeout' has passed
 
617
        if self.disable_initiator_tag is not None:
 
618
            gobject.source_remove(self.disable_initiator_tag)
605
619
        self.disable_initiator_tag = (gobject.timeout_add
606
620
                                   (self.timeout_milliseconds(),
607
621
                                    self.disable))
638
652
            timeout = self.timeout
639
653
        if self.disable_initiator_tag is not None:
640
654
            gobject.source_remove(self.disable_initiator_tag)
 
655
            self.disable_initiator_tag = None
641
656
        if getattr(self, "enabled", False):
642
657
            self.disable_initiator_tag = (gobject.timeout_add
643
658
                                          (timedelta_to_milliseconds
653
668
        If a checker already exists, leave it running and do
654
669
        nothing."""
655
670
        # The reason for not killing a running checker is that if we
656
 
        # did that, then if a checker (for some reason) started
657
 
        # running slowly and taking more than 'interval' time, the
658
 
        # client would inevitably timeout, since no checker would get
659
 
        # a chance to run to completion.  If we instead leave running
 
671
        # did that, and if a checker (for some reason) started running
 
672
        # slowly and taking more than 'interval' time, then the client
 
673
        # would inevitably timeout, since no checker would get a
 
674
        # chance to run to completion.  If we instead leave running
660
675
        # checkers alone, the checker would have to take more time
661
676
        # than 'timeout' for the client to be disabled, which is as it
662
677
        # should be.
676
691
                                      self.current_checker_command)
677
692
        # Start a new checker if needed
678
693
        if self.checker is None:
 
694
            # Escape attributes for the shell
 
695
            escaped_attrs = dict(
 
696
                (attr, re.escape(unicode(getattr(self, attr))))
 
697
                for attr in
 
698
                self.runtime_expansions)
679
699
            try:
680
 
                # In case checker_command has exactly one % operator
681
 
                command = self.checker_command % self.host
682
 
            except TypeError:
683
 
                # Escape attributes for the shell
684
 
                escaped_attrs = dict(
685
 
                    (attr,
686
 
                     re.escape(unicode(str(getattr(self, attr, "")),
687
 
                                       errors=
688
 
                                       'replace')))
689
 
                    for attr in
690
 
                    self.runtime_expansions)
691
 
                
692
 
                try:
693
 
                    command = self.checker_command % escaped_attrs
694
 
                except TypeError as error:
695
 
                    logger.error('Could not format string "%s":'
696
 
                                 ' %s', self.checker_command, error)
697
 
                    return True # Try again later
 
700
                command = self.checker_command % escaped_attrs
 
701
            except TypeError as error:
 
702
                logger.error('Could not format string "%s"',
 
703
                             self.checker_command, exc_info=error)
 
704
                return True # Try again later
698
705
            self.current_checker_command = command
699
706
            try:
700
707
                logger.info("Starting checker %r for %s",
706
713
                self.checker = subprocess.Popen(command,
707
714
                                                close_fds=True,
708
715
                                                shell=True, cwd="/")
709
 
                self.checker_callback_tag = (gobject.child_watch_add
710
 
                                             (self.checker.pid,
711
 
                                              self.checker_callback,
712
 
                                              data=command))
713
 
                # The checker may have completed before the gobject
714
 
                # watch was added.  Check for this.
715
 
                pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
716
 
                if pid:
717
 
                    gobject.source_remove(self.checker_callback_tag)
718
 
                    self.checker_callback(pid, status, command)
719
716
            except OSError as error:
720
 
                logger.error("Failed to start subprocess: %s",
721
 
                             error)
 
717
                logger.error("Failed to start subprocess",
 
718
                             exc_info=error)
 
719
            self.checker_callback_tag = (gobject.child_watch_add
 
720
                                         (self.checker.pid,
 
721
                                          self.checker_callback,
 
722
                                          data=command))
 
723
            # The checker may have completed before the gobject
 
724
            # watch was added.  Check for this.
 
725
            pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
 
726
            if pid:
 
727
                gobject.source_remove(self.checker_callback_tag)
 
728
                self.checker_callback(pid, status, command)
722
729
        # Re-run this periodically if run by gobject.timeout_add
723
730
        return True
724
731
    
731
738
            return
732
739
        logger.debug("Stopping checker for %(name)s", vars(self))
733
740
        try:
734
 
            os.kill(self.checker.pid, signal.SIGTERM)
 
741
            self.checker.terminate()
735
742
            #time.sleep(0.5)
736
743
            #if self.checker.poll() is None:
737
 
            #    os.kill(self.checker.pid, signal.SIGKILL)
 
744
            #    self.checker.kill()
738
745
        except OSError as error:
739
746
            if error.errno != errno.ESRCH: # No such process
740
747
                raise
757
764
    # "Set" method, so we fail early here:
758
765
    if byte_arrays and signature != "ay":
759
766
        raise ValueError("Byte arrays not supported for non-'ay'"
760
 
                         " signature %r" % signature)
 
767
                         " signature {0!r}".format(signature))
761
768
    def decorator(func):
762
769
        func._dbus_is_property = True
763
770
        func._dbus_interface = dbus_interface
771
778
    return decorator
772
779
 
773
780
 
 
781
def dbus_interface_annotations(dbus_interface):
 
782
    """Decorator for marking functions returning interface annotations
 
783
    
 
784
    Usage:
 
785
    
 
786
    @dbus_interface_annotations("org.example.Interface")
 
787
    def _foo(self):  # Function name does not matter
 
788
        return {"org.freedesktop.DBus.Deprecated": "true",
 
789
                "org.freedesktop.DBus.Property.EmitsChangedSignal":
 
790
                    "false"}
 
791
    """
 
792
    def decorator(func):
 
793
        func._dbus_is_interface = True
 
794
        func._dbus_interface = dbus_interface
 
795
        func._dbus_name = dbus_interface
 
796
        return func
 
797
    return decorator
 
798
 
 
799
 
 
800
def dbus_annotations(annotations):
 
801
    """Decorator to annotate D-Bus methods, signals or properties
 
802
    Usage:
 
803
    
 
804
    @dbus_service_property("org.example.Interface", signature="b",
 
805
                           access="r")
 
806
    @dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",
 
807
                        "org.freedesktop.DBus.Property."
 
808
                        "EmitsChangedSignal": "false"})
 
809
    def Property_dbus_property(self):
 
810
        return dbus.Boolean(False)
 
811
    """
 
812
    def decorator(func):
 
813
        func._dbus_annotations = annotations
 
814
        return func
 
815
    return decorator
 
816
 
 
817
 
774
818
class DBusPropertyException(dbus.exceptions.DBusException):
775
819
    """A base class for D-Bus property-related exceptions
776
820
    """
799
843
    """
800
844
    
801
845
    @staticmethod
802
 
    def _is_dbus_property(obj):
803
 
        return getattr(obj, "_dbus_is_property", False)
 
846
    def _is_dbus_thing(thing):
 
847
        """Returns a function testing if an attribute is a D-Bus thing
 
848
        
 
849
        If called like _is_dbus_thing("method") it returns a function
 
850
        suitable for use as predicate to inspect.getmembers().
 
851
        """
 
852
        return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),
 
853
                                   False)
804
854
    
805
 
    def _get_all_dbus_properties(self):
 
855
    def _get_all_dbus_things(self, thing):
806
856
        """Returns a generator of (name, attribute) pairs
807
857
        """
808
 
        return ((prop.__get__(self)._dbus_name, prop.__get__(self))
 
858
        return ((getattr(athing.__get__(self), "_dbus_name",
 
859
                         name),
 
860
                 athing.__get__(self))
809
861
                for cls in self.__class__.__mro__
810
 
                for name, prop in
811
 
                inspect.getmembers(cls, self._is_dbus_property))
 
862
                for name, athing in
 
863
                inspect.getmembers(cls,
 
864
                                   self._is_dbus_thing(thing)))
812
865
    
813
866
    def _get_dbus_property(self, interface_name, property_name):
814
867
        """Returns a bound method if one exists which is a D-Bus
816
869
        """
817
870
        for cls in  self.__class__.__mro__:
818
871
            for name, value in (inspect.getmembers
819
 
                                (cls, self._is_dbus_property)):
 
872
                                (cls,
 
873
                                 self._is_dbus_thing("property"))):
820
874
                if (value._dbus_name == property_name
821
875
                    and value._dbus_interface == interface_name):
822
876
                    return value.__get__(self)
864
918
        Note: Will not include properties with access="write".
865
919
        """
866
920
        properties = {}
867
 
        for name, prop in self._get_all_dbus_properties():
 
921
        for name, prop in self._get_all_dbus_things("property"):
868
922
            if (interface_name
869
923
                and interface_name != prop._dbus_interface):
870
924
                # Interface non-empty but did not match
885
939
                         path_keyword='object_path',
886
940
                         connection_keyword='connection')
887
941
    def Introspect(self, object_path, connection):
888
 
        """Standard D-Bus method, overloaded to insert property tags.
 
942
        """Overloading of standard D-Bus method.
 
943
        
 
944
        Inserts property tags and interface annotation tags.
889
945
        """
890
946
        xmlstring = dbus.service.Object.Introspect(self, object_path,
891
947
                                                   connection)
898
954
                e.setAttribute("access", prop._dbus_access)
899
955
                return e
900
956
            for if_tag in document.getElementsByTagName("interface"):
 
957
                # Add property tags
901
958
                for tag in (make_tag(document, name, prop)
902
959
                            for name, prop
903
 
                            in self._get_all_dbus_properties()
 
960
                            in self._get_all_dbus_things("property")
904
961
                            if prop._dbus_interface
905
962
                            == if_tag.getAttribute("name")):
906
963
                    if_tag.appendChild(tag)
 
964
                # Add annotation tags
 
965
                for typ in ("method", "signal", "property"):
 
966
                    for tag in if_tag.getElementsByTagName(typ):
 
967
                        annots = dict()
 
968
                        for name, prop in (self.
 
969
                                           _get_all_dbus_things(typ)):
 
970
                            if (name == tag.getAttribute("name")
 
971
                                and prop._dbus_interface
 
972
                                == if_tag.getAttribute("name")):
 
973
                                annots.update(getattr
 
974
                                              (prop,
 
975
                                               "_dbus_annotations",
 
976
                                               {}))
 
977
                        for name, value in annots.iteritems():
 
978
                            ann_tag = document.createElement(
 
979
                                "annotation")
 
980
                            ann_tag.setAttribute("name", name)
 
981
                            ann_tag.setAttribute("value", value)
 
982
                            tag.appendChild(ann_tag)
 
983
                # Add interface annotation tags
 
984
                for annotation, value in dict(
 
985
                    itertools.chain.from_iterable(
 
986
                        annotations().iteritems()
 
987
                        for name, annotations in
 
988
                        self._get_all_dbus_things("interface")
 
989
                        if name == if_tag.getAttribute("name")
 
990
                        )).iteritems():
 
991
                    ann_tag = document.createElement("annotation")
 
992
                    ann_tag.setAttribute("name", annotation)
 
993
                    ann_tag.setAttribute("value", value)
 
994
                    if_tag.appendChild(ann_tag)
907
995
                # Add the names to the return values for the
908
996
                # "org.freedesktop.DBus.Properties" methods
909
997
                if (if_tag.getAttribute("name")
924
1012
        except (AttributeError, xml.dom.DOMException,
925
1013
                xml.parsers.expat.ExpatError) as error:
926
1014
            logger.error("Failed to override Introspection method",
927
 
                         error)
 
1015
                         exc_info=error)
928
1016
        return xmlstring
929
1017
 
930
1018
 
936
1024
                       variant_level=variant_level)
937
1025
 
938
1026
 
939
 
class AlternateDBusNamesMetaclass(DBusObjectWithProperties
940
 
                                  .__metaclass__):
941
 
    """Applied to an empty subclass of a D-Bus object, this metaclass
942
 
    will add additional D-Bus attributes matching a certain pattern.
 
1027
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
 
1028
    """A class decorator; applied to a subclass of
 
1029
    dbus.service.Object, it will add alternate D-Bus attributes with
 
1030
    interface names according to the "alt_interface_names" mapping.
 
1031
    Usage:
 
1032
    
 
1033
    @alternate_dbus_names({"org.example.Interface":
 
1034
                               "net.example.AlternateInterface"})
 
1035
    class SampleDBusObject(dbus.service.Object):
 
1036
        @dbus.service.method("org.example.Interface")
 
1037
        def SampleDBusMethod():
 
1038
            pass
 
1039
    
 
1040
    The above "SampleDBusMethod" on "SampleDBusObject" will be
 
1041
    reachable via two interfaces: "org.example.Interface" and
 
1042
    "net.example.AlternateInterface", the latter of which will have
 
1043
    its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
 
1044
    "true", unless "deprecate" is passed with a False value.
 
1045
    
 
1046
    This works for methods and signals, and also for D-Bus properties
 
1047
    (from DBusObjectWithProperties) and interfaces (from the
 
1048
    dbus_interface_annotations decorator).
943
1049
    """
944
 
    def __new__(mcs, name, bases, attr):
945
 
        # Go through all the base classes which could have D-Bus
946
 
        # methods, signals, or properties in them
947
 
        for base in (b for b in bases
948
 
                     if issubclass(b, dbus.service.Object)):
949
 
            # Go though all attributes of the base class
950
 
            for attrname, attribute in inspect.getmembers(base):
 
1050
    def wrapper(cls):
 
1051
        for orig_interface_name, alt_interface_name in (
 
1052
            alt_interface_names.iteritems()):
 
1053
            attr = {}
 
1054
            interface_names = set()
 
1055
            # Go though all attributes of the class
 
1056
            for attrname, attribute in inspect.getmembers(cls):
951
1057
                # Ignore non-D-Bus attributes, and D-Bus attributes
952
1058
                # with the wrong interface name
953
1059
                if (not hasattr(attribute, "_dbus_interface")
954
1060
                    or not attribute._dbus_interface
955
 
                    .startswith("se.recompile.Mandos")):
 
1061
                    .startswith(orig_interface_name)):
956
1062
                    continue
957
1063
                # Create an alternate D-Bus interface name based on
958
1064
                # the current name
959
1065
                alt_interface = (attribute._dbus_interface
960
 
                                 .replace("se.recompile.Mandos",
961
 
                                          "se.bsnet.fukt.Mandos"))
 
1066
                                 .replace(orig_interface_name,
 
1067
                                          alt_interface_name))
 
1068
                interface_names.add(alt_interface)
962
1069
                # Is this a D-Bus signal?
963
1070
                if getattr(attribute, "_dbus_is_signal", False):
964
1071
                    # Extract the original non-method function by
979
1086
                                nonmethod_func.func_name,
980
1087
                                nonmethod_func.func_defaults,
981
1088
                                nonmethod_func.func_closure)))
 
1089
                    # Copy annotations, if any
 
1090
                    try:
 
1091
                        new_function._dbus_annotations = (
 
1092
                            dict(attribute._dbus_annotations))
 
1093
                    except AttributeError:
 
1094
                        pass
982
1095
                    # Define a creator of a function to call both the
983
 
                    # old and new functions, so both the old and new
984
 
                    # signals gets sent when the function is called
 
1096
                    # original and alternate functions, so both the
 
1097
                    # original and alternate signals gets sent when
 
1098
                    # the function is called
985
1099
                    def fixscope(func1, func2):
986
1100
                        """This function is a scope container to pass
987
1101
                        func1 and func2 to the "call_both" function
994
1108
                        return call_both
995
1109
                    # Create the "call_both" function and add it to
996
1110
                    # the class
997
 
                    attr[attrname] = fixscope(attribute,
998
 
                                              new_function)
 
1111
                    attr[attrname] = fixscope(attribute, new_function)
999
1112
                # Is this a D-Bus method?
1000
1113
                elif getattr(attribute, "_dbus_is_method", False):
1001
1114
                    # Create a new, but exactly alike, function
1012
1125
                                        attribute.func_name,
1013
1126
                                        attribute.func_defaults,
1014
1127
                                        attribute.func_closure)))
 
1128
                    # Copy annotations, if any
 
1129
                    try:
 
1130
                        attr[attrname]._dbus_annotations = (
 
1131
                            dict(attribute._dbus_annotations))
 
1132
                    except AttributeError:
 
1133
                        pass
1015
1134
                # Is this a D-Bus property?
1016
1135
                elif getattr(attribute, "_dbus_is_property", False):
1017
1136
                    # Create a new, but exactly alike, function
1031
1150
                                        attribute.func_name,
1032
1151
                                        attribute.func_defaults,
1033
1152
                                        attribute.func_closure)))
1034
 
        return type.__new__(mcs, name, bases, attr)
1035
 
 
1036
 
 
 
1153
                    # Copy annotations, if any
 
1154
                    try:
 
1155
                        attr[attrname]._dbus_annotations = (
 
1156
                            dict(attribute._dbus_annotations))
 
1157
                    except AttributeError:
 
1158
                        pass
 
1159
                # Is this a D-Bus interface?
 
1160
                elif getattr(attribute, "_dbus_is_interface", False):
 
1161
                    # Create a new, but exactly alike, function
 
1162
                    # object.  Decorate it to be a new D-Bus interface
 
1163
                    # with the alternate D-Bus interface name.  Add it
 
1164
                    # to the class.
 
1165
                    attr[attrname] = (dbus_interface_annotations
 
1166
                                      (alt_interface)
 
1167
                                      (types.FunctionType
 
1168
                                       (attribute.func_code,
 
1169
                                        attribute.func_globals,
 
1170
                                        attribute.func_name,
 
1171
                                        attribute.func_defaults,
 
1172
                                        attribute.func_closure)))
 
1173
            if deprecate:
 
1174
                # Deprecate all alternate interfaces
 
1175
                iname="_AlternateDBusNames_interface_annotation{0}"
 
1176
                for interface_name in interface_names:
 
1177
                    @dbus_interface_annotations(interface_name)
 
1178
                    def func(self):
 
1179
                        return { "org.freedesktop.DBus.Deprecated":
 
1180
                                     "true" }
 
1181
                    # Find an unused name
 
1182
                    for aname in (iname.format(i)
 
1183
                                  for i in itertools.count()):
 
1184
                        if aname not in attr:
 
1185
                            attr[aname] = func
 
1186
                            break
 
1187
            if interface_names:
 
1188
                # Replace the class with a new subclass of it with
 
1189
                # methods, signals, etc. as created above.
 
1190
                cls = type(b"{0}Alternate".format(cls.__name__),
 
1191
                           (cls,), attr)
 
1192
        return cls
 
1193
    return wrapper
 
1194
 
 
1195
 
 
1196
@alternate_dbus_interfaces({"se.recompile.Mandos":
 
1197
                                "se.bsnet.fukt.Mandos"})
1037
1198
class ClientDBus(Client, DBusObjectWithProperties):
1038
1199
    """A Client class using D-Bus
1039
1200
    
1059
1220
                                 ("/clients/" + client_object_name))
1060
1221
        DBusObjectWithProperties.__init__(self, self.bus,
1061
1222
                                          self.dbus_object_path)
1062
 
        
 
1223
    
1063
1224
    def notifychangeproperty(transform_func,
1064
1225
                             dbus_name, type_func=lambda x: x,
1065
1226
                             variant_level=1):
1088
1249
        
1089
1250
        return property(lambda self: getattr(self, attrname), setter)
1090
1251
    
1091
 
    
1092
1252
    expires = notifychangeproperty(datetime_to_dbus, "Expires")
1093
1253
    approvals_pending = notifychangeproperty(dbus.Boolean,
1094
1254
                                             "ApprovalPending",
1176
1336
        return False
1177
1337
    
1178
1338
    def approve(self, value=True):
1179
 
        self.send_changedstate()
1180
1339
        self.approved = value
1181
1340
        gobject.timeout_add(timedelta_to_milliseconds
1182
1341
                            (self.approval_duration),
1183
1342
                            self._reset_approved)
1184
 
    
 
1343
        self.send_changedstate()
1185
1344
    
1186
1345
    ## D-Bus methods, signals & properties
1187
1346
    _interface = "se.recompile.Mandos.Client"
1188
1347
    
 
1348
    ## Interfaces
 
1349
    
 
1350
    @dbus_interface_annotations(_interface)
 
1351
    def _foo(self):
 
1352
        return { "org.freedesktop.DBus.Property.EmitsChangedSignal":
 
1353
                     "false"}
 
1354
    
1189
1355
    ## Signals
1190
1356
    
1191
1357
    # CheckerCompleted - signal
1364
1530
    def Timeout_dbus_property(self, value=None):
1365
1531
        if value is None:       # get
1366
1532
            return dbus.UInt64(self.timeout_milliseconds())
 
1533
        old_timeout = self.timeout
1367
1534
        self.timeout = datetime.timedelta(0, 0, 0, value)
1368
 
        # Reschedule timeout
 
1535
        # Reschedule disabling
1369
1536
        if self.enabled:
1370
1537
            now = datetime.datetime.utcnow()
1371
 
            time_to_die = timedelta_to_milliseconds(
1372
 
                (self.last_checked_ok + self.timeout) - now)
1373
 
            if time_to_die <= 0:
 
1538
            self.expires += self.timeout - old_timeout
 
1539
            if self.expires <= now:
1374
1540
                # The timeout has passed
1375
1541
                self.disable()
1376
1542
            else:
1377
 
                self.expires = (now +
1378
 
                                datetime.timedelta(milliseconds =
1379
 
                                                   time_to_die))
1380
1543
                if (getattr(self, "disable_initiator_tag", None)
1381
1544
                    is None):
1382
1545
                    return
1383
1546
                gobject.source_remove(self.disable_initiator_tag)
1384
 
                self.disable_initiator_tag = (gobject.timeout_add
1385
 
                                              (time_to_die,
1386
 
                                               self.disable))
 
1547
                self.disable_initiator_tag = (
 
1548
                    gobject.timeout_add(
 
1549
                        timedelta_to_milliseconds(self.expires - now),
 
1550
                        self.disable))
1387
1551
    
1388
1552
    # ExtendedTimeout - property
1389
1553
    @dbus_service_property(_interface, signature="t",
1468
1632
        self._pipe.send(('setattr', name, value))
1469
1633
 
1470
1634
 
1471
 
class ClientDBusTransitional(ClientDBus):
1472
 
    __metaclass__ = AlternateDBusNamesMetaclass
1473
 
 
1474
 
 
1475
1635
class ClientHandler(socketserver.BaseRequestHandler, object):
1476
1636
    """A class to handle client connections.
1477
1637
    
1581
1741
                    #wait until timeout or approved
1582
1742
                    time = datetime.datetime.now()
1583
1743
                    client.changedstate.acquire()
1584
 
                    (client.changedstate.wait
1585
 
                     (float(client.timedelta_to_milliseconds(delay)
1586
 
                            / 1000)))
 
1744
                    client.changedstate.wait(
 
1745
                        float(timedelta_to_milliseconds(delay)
 
1746
                              / 1000))
1587
1747
                    client.changedstate.release()
1588
1748
                    time2 = datetime.datetime.now()
1589
1749
                    if (time2 - time) >= delay:
1605
1765
                    try:
1606
1766
                        sent = session.send(client.secret[sent_size:])
1607
1767
                    except gnutls.errors.GNUTLSError as error:
1608
 
                        logger.warning("gnutls send failed")
 
1768
                        logger.warning("gnutls send failed",
 
1769
                                       exc_info=error)
1609
1770
                        return
1610
1771
                    logger.debug("Sent: %d, remaining: %d",
1611
1772
                                 sent, len(client.secret)
1625
1786
                try:
1626
1787
                    session.bye()
1627
1788
                except gnutls.errors.GNUTLSError as error:
1628
 
                    logger.warning("GnuTLS bye failed")
 
1789
                    logger.warning("GnuTLS bye failed",
 
1790
                                   exc_info=error)
1629
1791
    
1630
1792
    @staticmethod
1631
1793
    def peer_certificate(session):
1703
1865
    def process_request(self, request, address):
1704
1866
        """Start a new process to process the request."""
1705
1867
        proc = multiprocessing.Process(target = self.sub_process_main,
1706
 
                                       args = (request,
1707
 
                                               address))
 
1868
                                       args = (request, address))
1708
1869
        proc.start()
1709
1870
        return proc
1710
1871
 
1760
1921
                                           str(self.interface
1761
1922
                                               + '\0'))
1762
1923
                except socket.error as error:
1763
 
                    if error[0] == errno.EPERM:
 
1924
                    if error.errno == errno.EPERM:
1764
1925
                        logger.error("No permission to"
1765
1926
                                     " bind to interface %s",
1766
1927
                                     self.interface)
1767
 
                    elif error[0] == errno.ENOPROTOOPT:
 
1928
                    elif error.errno == errno.ENOPROTOOPT:
1768
1929
                        logger.error("SO_BINDTODEVICE not available;"
1769
1930
                                     " cannot bind to interface %s",
1770
1931
                                     self.interface)
 
1932
                    elif error.errno == errno.ENODEV:
 
1933
                        logger.error("Interface %s does not"
 
1934
                                     " exist, cannot bind",
 
1935
                                     self.interface)
1771
1936
                    else:
1772
1937
                        raise
1773
1938
        # Only bind(2) the socket if we really need to.
1832
1997
    
1833
1998
    def handle_ipc(self, source, condition, parent_pipe=None,
1834
1999
                   proc = None, client_object=None):
1835
 
        condition_names = {
1836
 
            gobject.IO_IN: "IN",   # There is data to read.
1837
 
            gobject.IO_OUT: "OUT", # Data can be written (without
1838
 
                                    # blocking).
1839
 
            gobject.IO_PRI: "PRI", # There is urgent data to read.
1840
 
            gobject.IO_ERR: "ERR", # Error condition.
1841
 
            gobject.IO_HUP: "HUP"  # Hung up (the connection has been
1842
 
                                    # broken, usually for pipes and
1843
 
                                    # sockets).
1844
 
            }
1845
 
        conditions_string = ' | '.join(name
1846
 
                                       for cond, name in
1847
 
                                       condition_names.iteritems()
1848
 
                                       if cond & condition)
1849
2000
        # error, or the other end of multiprocessing.Pipe has closed
1850
 
        if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):
 
2001
        if condition & (gobject.IO_ERR | gobject.IO_HUP):
1851
2002
            # Wait for other process to exit
1852
2003
            proc.join()
1853
2004
            return False
1943
2094
            elif suffix == "w":
1944
2095
                delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
1945
2096
            else:
1946
 
                raise ValueError("Unknown suffix %r" % suffix)
 
2097
                raise ValueError("Unknown suffix {0!r}"
 
2098
                                 .format(suffix))
1947
2099
        except (ValueError, IndexError) as e:
1948
2100
            raise ValueError(*(e.args))
1949
2101
        timevalue += delta
1963
2115
        sys.exit()
1964
2116
    if not noclose:
1965
2117
        # Close all standard open file descriptors
1966
 
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
 
2118
        null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
1967
2119
        if not stat.S_ISCHR(os.fstat(null).st_mode):
1968
2120
            raise OSError(errno.ENODEV,
1969
 
                          "%s not a character device"
1970
 
                          % os.path.devnull)
 
2121
                          "{0} not a character device"
 
2122
                          .format(os.devnull))
1971
2123
        os.dup2(null, sys.stdin.fileno())
1972
2124
        os.dup2(null, sys.stdout.fileno())
1973
2125
        os.dup2(null, sys.stderr.fileno())
1982
2134
    
1983
2135
    parser = argparse.ArgumentParser()
1984
2136
    parser.add_argument("-v", "--version", action="version",
1985
 
                        version = "%%(prog)s %s" % version,
 
2137
                        version = "%(prog)s {0}".format(version),
1986
2138
                        help="show version number and exit")
1987
2139
    parser.add_argument("-i", "--interface", metavar="IF",
1988
2140
                        help="Bind to interface IF")
2091
2243
    
2092
2244
    if server_settings["servicename"] != "Mandos":
2093
2245
        syslogger.setFormatter(logging.Formatter
2094
 
                               ('Mandos (%s) [%%(process)d]:'
2095
 
                                ' %%(levelname)s: %%(message)s'
2096
 
                                % server_settings["servicename"]))
 
2246
                               ('Mandos ({0}) [%(process)d]:'
 
2247
                                ' %(levelname)s: %(message)s'
 
2248
                                .format(server_settings
 
2249
                                        ["servicename"])))
2097
2250
    
2098
2251
    # Parse config file with clients
2099
2252
    client_config = configparser.SafeConfigParser(Client
2117
2270
        pidfilename = "/var/run/mandos.pid"
2118
2271
        try:
2119
2272
            pidfile = open(pidfilename, "w")
2120
 
        except IOError:
2121
 
            logger.error("Could not open file %r", pidfilename)
 
2273
        except IOError as e:
 
2274
            logger.error("Could not open file %r", pidfilename,
 
2275
                         exc_info=e)
2122
2276
    
2123
 
    try:
2124
 
        uid = pwd.getpwnam("_mandos").pw_uid
2125
 
        gid = pwd.getpwnam("_mandos").pw_gid
2126
 
    except KeyError:
 
2277
    for name in ("_mandos", "mandos", "nobody"):
2127
2278
        try:
2128
 
            uid = pwd.getpwnam("mandos").pw_uid
2129
 
            gid = pwd.getpwnam("mandos").pw_gid
 
2279
            uid = pwd.getpwnam(name).pw_uid
 
2280
            gid = pwd.getpwnam(name).pw_gid
 
2281
            break
2130
2282
        except KeyError:
2131
 
            try:
2132
 
                uid = pwd.getpwnam("nobody").pw_uid
2133
 
                gid = pwd.getpwnam("nobody").pw_gid
2134
 
            except KeyError:
2135
 
                uid = 65534
2136
 
                gid = 65534
 
2283
            continue
 
2284
    else:
 
2285
        uid = 65534
 
2286
        gid = 65534
2137
2287
    try:
2138
2288
        os.setgid(gid)
2139
2289
        os.setuid(uid)
2140
2290
    except OSError as error:
2141
 
        if error[0] != errno.EPERM:
 
2291
        if error.errno != errno.EPERM:
2142
2292
            raise error
2143
2293
    
2144
2294
    if debug:
2156
2306
         .gnutls_global_set_log_function(debug_gnutls))
2157
2307
        
2158
2308
        # Redirect stdin so all checkers get /dev/null
2159
 
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
 
2309
        null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2160
2310
        os.dup2(null, sys.stdin.fileno())
2161
2311
        if null > 2:
2162
2312
            os.close(null)
2170
2320
    
2171
2321
    global main_loop
2172
2322
    # From the Avahi example code
2173
 
    DBusGMainLoop(set_as_default=True )
 
2323
    DBusGMainLoop(set_as_default=True)
2174
2324
    main_loop = gobject.MainLoop()
2175
2325
    bus = dbus.SystemBus()
2176
2326
    # End of Avahi example code
2182
2332
                            ("se.bsnet.fukt.Mandos", bus,
2183
2333
                             do_not_queue=True))
2184
2334
        except dbus.exceptions.NameExistsException as e:
2185
 
            logger.error(unicode(e) + ", disabling D-Bus")
 
2335
            logger.error("Disabling D-Bus:", exc_info=e)
2186
2336
            use_dbus = False
2187
2337
            server_settings["use_dbus"] = False
2188
2338
            tcp_server.use_dbus = False
2200
2350
    
2201
2351
    client_class = Client
2202
2352
    if use_dbus:
2203
 
        client_class = functools.partial(ClientDBusTransitional,
2204
 
                                         bus = bus)
 
2353
        client_class = functools.partial(ClientDBus, bus = bus)
2205
2354
    
2206
2355
    client_settings = Client.config_parser(client_config)
2207
2356
    old_client_settings = {}
2215
2364
                                                     (stored_state))
2216
2365
            os.remove(stored_state_path)
2217
2366
        except IOError as e:
2218
 
            logger.warning("Could not load persistent state: {0}"
2219
 
                           .format(e))
2220
 
            if e.errno != errno.ENOENT:
 
2367
            if e.errno == errno.ENOENT:
 
2368
                logger.warning("Could not load persistent state: {0}"
 
2369
                                .format(os.strerror(e.errno)))
 
2370
            else:
 
2371
                logger.critical("Could not load persistent state:",
 
2372
                                exc_info=e)
2221
2373
                raise
2222
2374
        except EOFError as e:
2223
2375
            logger.warning("Could not load persistent state: "
2224
 
                           "EOFError: {0}".format(e))
 
2376
                           "EOFError:", exc_info=e)
2225
2377
    
2226
2378
    with PGPEngine() as pgp:
2227
2379
        for client_name, client in clients_data.iteritems():
2280
2432
                             .format(client_name))
2281
2433
                client["secret"] = (
2282
2434
                    client_settings[client_name]["secret"])
2283
 
 
2284
2435
    
2285
2436
    # Add/remove clients based on new changes made to config
2286
2437
    for client_name in (set(old_client_settings)
2289
2440
    for client_name in (set(client_settings)
2290
2441
                        - set(old_client_settings)):
2291
2442
        clients_data[client_name] = client_settings[client_name]
2292
 
 
 
2443
    
2293
2444
    # Create all client objects
2294
2445
    for client_name, client in clients_data.iteritems():
2295
2446
        tcp_server.clients[client_name] = client_class(
2297
2448
    
2298
2449
    if not tcp_server.clients:
2299
2450
        logger.warning("No clients defined")
2300
 
        
 
2451
    
2301
2452
    if not debug:
2302
2453
        try:
2303
2454
            with pidfile:
2311
2462
            # "pidfile" was never created
2312
2463
            pass
2313
2464
        del pidfilename
2314
 
        signal.signal(signal.SIGINT, signal.SIG_IGN)
2315
2465
    
2316
2466
    signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2317
2467
    signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
2318
2468
    
2319
2469
    if use_dbus:
2320
 
        class MandosDBusService(dbus.service.Object):
 
2470
        @alternate_dbus_interfaces({"se.recompile.Mandos":
 
2471
                                        "se.bsnet.fukt.Mandos"})
 
2472
        class MandosDBusService(DBusObjectWithProperties):
2321
2473
            """A D-Bus proxy object"""
2322
2474
            def __init__(self):
2323
2475
                dbus.service.Object.__init__(self, bus, "/")
2324
2476
            _interface = "se.recompile.Mandos"
2325
2477
            
 
2478
            @dbus_interface_annotations(_interface)
 
2479
            def _foo(self):
 
2480
                return { "org.freedesktop.DBus.Property"
 
2481
                         ".EmitsChangedSignal":
 
2482
                             "false"}
 
2483
            
2326
2484
            @dbus.service.signal(_interface, signature="o")
2327
2485
            def ClientAdded(self, objpath):
2328
2486
                "D-Bus signal"
2370
2528
            
2371
2529
            del _interface
2372
2530
        
2373
 
        class MandosDBusServiceTransitional(MandosDBusService):
2374
 
            __metaclass__ = AlternateDBusNamesMetaclass
2375
 
        mandos_dbus_service = MandosDBusServiceTransitional()
 
2531
        mandos_dbus_service = MandosDBusService()
2376
2532
    
2377
2533
    def cleanup():
2378
2534
        "Cleanup function; run on exit"
2411
2567
                del client_settings[client.name]["secret"]
2412
2568
        
2413
2569
        try:
2414
 
            tempfd, tempname = tempfile.mkstemp(suffix=".pickle",
2415
 
                                                prefix="clients-",
2416
 
                                                dir=os.path.dirname
2417
 
                                                (stored_state_path))
2418
 
            with os.fdopen(tempfd, "wb") as stored_state:
 
2570
            with (tempfile.NamedTemporaryFile
 
2571
                  (mode='wb', suffix=".pickle", prefix='clients-',
 
2572
                   dir=os.path.dirname(stored_state_path),
 
2573
                   delete=False)) as stored_state:
2419
2574
                pickle.dump((clients, client_settings), stored_state)
 
2575
                tempname=stored_state.name
2420
2576
            os.rename(tempname, stored_state_path)
2421
2577
        except (IOError, OSError) as e:
2422
 
            logger.warning("Could not save persistent state: {0}"
2423
 
                           .format(e))
2424
2578
            if not debug:
2425
2579
                try:
2426
2580
                    os.remove(tempname)
2427
2581
                except NameError:
2428
2582
                    pass
2429
 
            if e.errno not in set((errno.ENOENT, errno.EACCES,
2430
 
                                   errno.EEXIST)):
 
2583
            if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
 
2584
                logger.warning("Could not save persistent state: {0}"
 
2585
                               .format(os.strerror(e.errno)))
 
2586
            else:
 
2587
                logger.warning("Could not save persistent state:",
 
2588
                               exc_info=e)
2431
2589
                raise e
2432
2590
        
2433
2591
        # Delete all clients, and settings from config
2461
2619
    service.port = tcp_server.socket.getsockname()[1]
2462
2620
    if use_ipv6:
2463
2621
        logger.info("Now listening on address %r, port %d,"
2464
 
                    " flowinfo %d, scope_id %d"
2465
 
                    % tcp_server.socket.getsockname())
 
2622
                    " flowinfo %d, scope_id %d",
 
2623
                    *tcp_server.socket.getsockname())
2466
2624
    else:                       # IPv4
2467
 
        logger.info("Now listening on address %r, port %d"
2468
 
                    % tcp_server.socket.getsockname())
 
2625
        logger.info("Now listening on address %r, port %d",
 
2626
                    *tcp_server.socket.getsockname())
2469
2627
    
2470
2628
    #service.interface = tcp_server.socket.getsockname()[3]
2471
2629
    
2474
2632
        try:
2475
2633
            service.activate()
2476
2634
        except dbus.exceptions.DBusException as error:
2477
 
            logger.critical("DBusException: %s", error)
 
2635
            logger.critical("D-Bus Exception", exc_info=error)
2478
2636
            cleanup()
2479
2637
            sys.exit(1)
2480
2638
        # End of Avahi example code
2487
2645
        logger.debug("Starting main loop")
2488
2646
        main_loop.run()
2489
2647
    except AvahiError as error:
2490
 
        logger.critical("AvahiError: %s", error)
 
2648
        logger.critical("Avahi Error", exc_info=error)
2491
2649
        cleanup()
2492
2650
        sys.exit(1)
2493
2651
    except KeyboardInterrupt: