/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos

  • Committer: Teddy Hogeborn
  • Date: 2012-05-20 13:17:37 UTC
  • mfrom: (585 trunk)
  • mto: (237.4.31 release)
  • mto: This revision was merged to the branch mainline in revision 586.
  • Revision ID: teddy@recompile.se-20120520131737-p1toj7kaxgs3wki3
merge from trunk

Show diffs side-by-side

added added

removed removed

Lines of Context:
11
11
# "AvahiService" class, and some lines in "main".
12
12
13
13
# Everything else is
14
 
# Copyright © 2008,2009 Teddy Hogeborn
15
 
# Copyright © 2008,2009 Björn Påhlsson
 
14
# Copyright © 2008-2012 Teddy Hogeborn
 
15
# Copyright © 2008-2012 Björn Påhlsson
16
16
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
28
28
# along with this program.  If not, see
29
29
# <http://www.gnu.org/licenses/>.
30
30
31
 
# Contact the authors at <mandos@fukt.bsnet.se>.
 
31
# Contact the authors at <mandos@recompile.se>.
32
32
33
33
 
34
 
from __future__ import division, with_statement, absolute_import
 
34
from __future__ import (division, absolute_import, print_function,
 
35
                        unicode_literals)
 
36
 
 
37
from future_builtins import *
35
38
 
36
39
import SocketServer as socketserver
37
40
import socket
38
 
import optparse
 
41
import argparse
39
42
import datetime
40
43
import errno
41
44
import gnutls.crypto
61
64
import functools
62
65
import cPickle as pickle
63
66
import multiprocessing
 
67
import types
 
68
import binascii
 
69
import tempfile
 
70
import itertools
64
71
 
65
72
import dbus
66
73
import dbus.service
71
78
import ctypes.util
72
79
import xml.dom.minidom
73
80
import inspect
 
81
import GnuPGInterface
74
82
 
75
83
try:
76
84
    SO_BINDTODEVICE = socket.SO_BINDTODEVICE
80
88
    except ImportError:
81
89
        SO_BINDTODEVICE = None
82
90
 
83
 
 
84
 
version = "1.0.14"
85
 
 
86
 
#logger = logging.getLogger(u'mandos')
87
 
logger = logging.Logger(u'mandos')
 
91
version = "1.5.3"
 
92
stored_state_file = "clients.pickle"
 
93
 
 
94
logger = logging.getLogger()
88
95
syslogger = (logging.handlers.SysLogHandler
89
96
             (facility = logging.handlers.SysLogHandler.LOG_DAEMON,
90
 
              address = "/dev/log"))
91
 
syslogger.setFormatter(logging.Formatter
92
 
                       (u'Mandos [%(process)d]: %(levelname)s:'
93
 
                        u' %(message)s'))
94
 
logger.addHandler(syslogger)
95
 
 
96
 
console = logging.StreamHandler()
97
 
console.setFormatter(logging.Formatter(u'%(name)s [%(process)d]:'
98
 
                                       u' %(levelname)s:'
99
 
                                       u' %(message)s'))
100
 
logger.addHandler(console)
 
97
              address = str("/dev/log")))
 
98
 
 
99
try:
 
100
    if_nametoindex = (ctypes.cdll.LoadLibrary
 
101
                      (ctypes.util.find_library("c"))
 
102
                      .if_nametoindex)
 
103
except (OSError, AttributeError):
 
104
    def if_nametoindex(interface):
 
105
        "Get an interface index the hard way, i.e. using fcntl()"
 
106
        SIOCGIFINDEX = 0x8933  # From /usr/include/linux/sockios.h
 
107
        with contextlib.closing(socket.socket()) as s:
 
108
            ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
 
109
                                struct.pack(str("16s16x"),
 
110
                                            interface))
 
111
        interface_index = struct.unpack(str("I"),
 
112
                                        ifreq[16:20])[0]
 
113
        return interface_index
 
114
 
 
115
 
 
116
def initlogger(debug, level=logging.WARNING):
 
117
    """init logger and add loglevel"""
 
118
    
 
119
    syslogger.setFormatter(logging.Formatter
 
120
                           ('Mandos [%(process)d]: %(levelname)s:'
 
121
                            ' %(message)s'))
 
122
    logger.addHandler(syslogger)
 
123
    
 
124
    if debug:
 
125
        console = logging.StreamHandler()
 
126
        console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
 
127
                                               ' [%(process)d]:'
 
128
                                               ' %(levelname)s:'
 
129
                                               ' %(message)s'))
 
130
        logger.addHandler(console)
 
131
    logger.setLevel(level)
 
132
 
 
133
 
 
134
class PGPError(Exception):
 
135
    """Exception if encryption/decryption fails"""
 
136
    pass
 
137
 
 
138
 
 
139
class PGPEngine(object):
 
140
    """A simple class for OpenPGP symmetric encryption & decryption"""
 
141
    def __init__(self):
 
142
        self.gnupg = GnuPGInterface.GnuPG()
 
143
        self.tempdir = tempfile.mkdtemp(prefix="mandos-")
 
144
        self.gnupg = GnuPGInterface.GnuPG()
 
145
        self.gnupg.options.meta_interactive = False
 
146
        self.gnupg.options.homedir = self.tempdir
 
147
        self.gnupg.options.extra_args.extend(['--force-mdc',
 
148
                                              '--quiet',
 
149
                                              '--no-use-agent'])
 
150
    
 
151
    def __enter__(self):
 
152
        return self
 
153
    
 
154
    def __exit__ (self, exc_type, exc_value, traceback):
 
155
        self._cleanup()
 
156
        return False
 
157
    
 
158
    def __del__(self):
 
159
        self._cleanup()
 
160
    
 
161
    def _cleanup(self):
 
162
        if self.tempdir is not None:
 
163
            # Delete contents of tempdir
 
164
            for root, dirs, files in os.walk(self.tempdir,
 
165
                                             topdown = False):
 
166
                for filename in files:
 
167
                    os.remove(os.path.join(root, filename))
 
168
                for dirname in dirs:
 
169
                    os.rmdir(os.path.join(root, dirname))
 
170
            # Remove tempdir
 
171
            os.rmdir(self.tempdir)
 
172
            self.tempdir = None
 
173
    
 
174
    def password_encode(self, password):
 
175
        # Passphrase can not be empty and can not contain newlines or
 
176
        # NUL bytes.  So we prefix it and hex encode it.
 
177
        return b"mandos" + binascii.hexlify(password)
 
178
    
 
179
    def encrypt(self, data, password):
 
180
        self.gnupg.passphrase = self.password_encode(password)
 
181
        with open(os.devnull, "w") as devnull:
 
182
            try:
 
183
                proc = self.gnupg.run(['--symmetric'],
 
184
                                      create_fhs=['stdin', 'stdout'],
 
185
                                      attach_fhs={'stderr': devnull})
 
186
                with contextlib.closing(proc.handles['stdin']) as f:
 
187
                    f.write(data)
 
188
                with contextlib.closing(proc.handles['stdout']) as f:
 
189
                    ciphertext = f.read()
 
190
                proc.wait()
 
191
            except IOError as e:
 
192
                raise PGPError(e)
 
193
        self.gnupg.passphrase = None
 
194
        return ciphertext
 
195
    
 
196
    def decrypt(self, data, password):
 
197
        self.gnupg.passphrase = self.password_encode(password)
 
198
        with open(os.devnull, "w") as devnull:
 
199
            try:
 
200
                proc = self.gnupg.run(['--decrypt'],
 
201
                                      create_fhs=['stdin', 'stdout'],
 
202
                                      attach_fhs={'stderr': devnull})
 
203
                with contextlib.closing(proc.handles['stdin']) as f:
 
204
                    f.write(data)
 
205
                with contextlib.closing(proc.handles['stdout']) as f:
 
206
                    decrypted_plaintext = f.read()
 
207
                proc.wait()
 
208
            except IOError as e:
 
209
                raise PGPError(e)
 
210
        self.gnupg.passphrase = None
 
211
        return decrypted_plaintext
 
212
 
101
213
 
102
214
class AvahiError(Exception):
103
215
    def __init__(self, value, *args, **kwargs):
119
231
    Attributes:
120
232
    interface: integer; avahi.IF_UNSPEC or an interface index.
121
233
               Used to optionally bind to the specified interface.
122
 
    name: string; Example: u'Mandos'
123
 
    type: string; Example: u'_mandos._tcp'.
 
234
    name: string; Example: 'Mandos'
 
235
    type: string; Example: '_mandos._tcp'.
124
236
                  See <http://www.dns-sd.org/ServiceTypes.html>
125
237
    port: integer; what port to announce
126
238
    TXT: list of strings; TXT record for the service
133
245
    server: D-Bus Server
134
246
    bus: dbus.SystemBus()
135
247
    """
 
248
    
136
249
    def __init__(self, interface = avahi.IF_UNSPEC, name = None,
137
250
                 servicetype = None, port = None, TXT = None,
138
 
                 domain = u"", host = u"", max_renames = 32768,
 
251
                 domain = "", host = "", max_renames = 32768,
139
252
                 protocol = avahi.PROTO_UNSPEC, bus = None):
140
253
        self.interface = interface
141
254
        self.name = name
150
263
        self.group = None       # our entry group
151
264
        self.server = None
152
265
        self.bus = bus
 
266
        self.entry_group_state_changed_match = None
 
267
    
153
268
    def rename(self):
154
269
        """Derived from the Avahi example code"""
155
270
        if self.rename_count >= self.max_renames:
156
 
            logger.critical(u"No suitable Zeroconf service name found"
157
 
                            u" after %i retries, exiting.",
 
271
            logger.critical("No suitable Zeroconf service name found"
 
272
                            " after %i retries, exiting.",
158
273
                            self.rename_count)
159
 
            raise AvahiServiceError(u"Too many renames")
160
 
        self.name = unicode(self.server.GetAlternativeServiceName(self.name))
161
 
        logger.info(u"Changing Zeroconf service name to %r ...",
 
274
            raise AvahiServiceError("Too many renames")
 
275
        self.name = unicode(self.server
 
276
                            .GetAlternativeServiceName(self.name))
 
277
        logger.info("Changing Zeroconf service name to %r ...",
162
278
                    self.name)
163
 
        syslogger.setFormatter(logging.Formatter
164
 
                               (u'Mandos (%s) [%%(process)d]:'
165
 
                                u' %%(levelname)s: %%(message)s'
166
 
                                % self.name))
167
279
        self.remove()
168
280
        try:
169
281
            self.add()
170
 
        except dbus.exceptions.DBusException, error:
171
 
            logger.critical(u"DBusException: %s", error)
 
282
        except dbus.exceptions.DBusException as error:
 
283
            logger.critical("D-Bus Exception", exc_info=error)
172
284
            self.cleanup()
173
285
            os._exit(1)
174
286
        self.rename_count += 1
 
287
    
175
288
    def remove(self):
176
289
        """Derived from the Avahi example code"""
 
290
        if self.entry_group_state_changed_match is not None:
 
291
            self.entry_group_state_changed_match.remove()
 
292
            self.entry_group_state_changed_match = None
177
293
        if self.group is not None:
178
294
            self.group.Reset()
 
295
    
179
296
    def add(self):
180
297
        """Derived from the Avahi example code"""
 
298
        self.remove()
181
299
        if self.group is None:
182
300
            self.group = dbus.Interface(
183
301
                self.bus.get_object(avahi.DBUS_NAME,
184
302
                                    self.server.EntryGroupNew()),
185
303
                avahi.DBUS_INTERFACE_ENTRY_GROUP)
186
 
            self.group.connect_to_signal('StateChanged',
187
 
                                         self
188
 
                                         .entry_group_state_changed)
189
 
        logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
 
304
        self.entry_group_state_changed_match = (
 
305
            self.group.connect_to_signal(
 
306
                'StateChanged', self.entry_group_state_changed))
 
307
        logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
190
308
                     self.name, self.type)
191
309
        self.group.AddService(
192
310
            self.interface,
197
315
            dbus.UInt16(self.port),
198
316
            avahi.string_array_to_txt_array(self.TXT))
199
317
        self.group.Commit()
 
318
    
200
319
    def entry_group_state_changed(self, state, error):
201
320
        """Derived from the Avahi example code"""
202
 
        logger.debug(u"Avahi entry group state change: %i", state)
 
321
        logger.debug("Avahi entry group state change: %i", state)
203
322
        
204
323
        if state == avahi.ENTRY_GROUP_ESTABLISHED:
205
 
            logger.debug(u"Zeroconf service established.")
 
324
            logger.debug("Zeroconf service established.")
206
325
        elif state == avahi.ENTRY_GROUP_COLLISION:
207
 
            logger.warning(u"Zeroconf service name collision.")
 
326
            logger.info("Zeroconf service name collision.")
208
327
            self.rename()
209
328
        elif state == avahi.ENTRY_GROUP_FAILURE:
210
 
            logger.critical(u"Avahi: Error in group state changed %s",
 
329
            logger.critical("Avahi: Error in group state changed %s",
211
330
                            unicode(error))
212
 
            raise AvahiGroupError(u"State changed: %s"
213
 
                                  % unicode(error))
 
331
            raise AvahiGroupError("State changed: {0!s}"
 
332
                                  .format(error))
 
333
    
214
334
    def cleanup(self):
215
335
        """Derived from the Avahi example code"""
216
336
        if self.group is not None:
217
 
            self.group.Free()
 
337
            try:
 
338
                self.group.Free()
 
339
            except (dbus.exceptions.UnknownMethodException,
 
340
                    dbus.exceptions.DBusException):
 
341
                pass
218
342
            self.group = None
219
 
    def server_state_changed(self, state):
 
343
        self.remove()
 
344
    
 
345
    def server_state_changed(self, state, error=None):
220
346
        """Derived from the Avahi example code"""
221
 
        logger.debug(u"Avahi server state change: %i", state)
222
 
        if state == avahi.SERVER_COLLISION:
223
 
            logger.error(u"Zeroconf server name collision")
224
 
            self.remove()
 
347
        logger.debug("Avahi server state change: %i", state)
 
348
        bad_states = { avahi.SERVER_INVALID:
 
349
                           "Zeroconf server invalid",
 
350
                       avahi.SERVER_REGISTERING: None,
 
351
                       avahi.SERVER_COLLISION:
 
352
                           "Zeroconf server name collision",
 
353
                       avahi.SERVER_FAILURE:
 
354
                           "Zeroconf server failure" }
 
355
        if state in bad_states:
 
356
            if bad_states[state] is not None:
 
357
                if error is None:
 
358
                    logger.error(bad_states[state])
 
359
                else:
 
360
                    logger.error(bad_states[state] + ": %r", error)
 
361
            self.cleanup()
225
362
        elif state == avahi.SERVER_RUNNING:
226
363
            self.add()
 
364
        else:
 
365
            if error is None:
 
366
                logger.debug("Unknown state: %r", state)
 
367
            else:
 
368
                logger.debug("Unknown state: %r: %r", state, error)
 
369
    
227
370
    def activate(self):
228
371
        """Derived from the Avahi example code"""
229
372
        if self.server is None:
230
373
            self.server = dbus.Interface(
231
374
                self.bus.get_object(avahi.DBUS_NAME,
232
 
                                    avahi.DBUS_PATH_SERVER),
 
375
                                    avahi.DBUS_PATH_SERVER,
 
376
                                    follow_name_owner_changes=True),
233
377
                avahi.DBUS_INTERFACE_SERVER)
234
 
        self.server.connect_to_signal(u"StateChanged",
 
378
        self.server.connect_to_signal("StateChanged",
235
379
                                 self.server_state_changed)
236
380
        self.server_state_changed(self.server.GetState())
237
381
 
238
382
 
 
383
class AvahiServiceToSyslog(AvahiService):
 
384
    def rename(self):
 
385
        """Add the new name to the syslog messages"""
 
386
        ret = AvahiService.rename(self)
 
387
        syslogger.setFormatter(logging.Formatter
 
388
                               ('Mandos ({0}) [%(process)d]:'
 
389
                                ' %(levelname)s: %(message)s'
 
390
                                .format(self.name)))
 
391
        return ret
 
392
 
 
393
 
 
394
def timedelta_to_milliseconds(td):
 
395
    "Convert a datetime.timedelta() to milliseconds"
 
396
    return ((td.days * 24 * 60 * 60 * 1000)
 
397
            + (td.seconds * 1000)
 
398
            + (td.microseconds // 1000))
 
399
 
 
400
 
239
401
class Client(object):
240
402
    """A representation of a client host served by this server.
241
403
    
242
404
    Attributes:
243
 
    name:       string; from the config file, used in log messages and
244
 
                        D-Bus identifiers
 
405
    approved:   bool(); 'None' if not yet approved/disapproved
 
406
    approval_delay: datetime.timedelta(); Time to wait for approval
 
407
    approval_duration: datetime.timedelta(); Duration of one approval
 
408
    checker:    subprocess.Popen(); a running checker process used
 
409
                                    to see if the client lives.
 
410
                                    'None' if no process is running.
 
411
    checker_callback_tag: a gobject event source tag, or None
 
412
    checker_command: string; External command which is run to check
 
413
                     if client lives.  %() expansions are done at
 
414
                     runtime with vars(self) as dict, so that for
 
415
                     instance %(name)s can be used in the command.
 
416
    checker_initiator_tag: a gobject event source tag, or None
 
417
    created:    datetime.datetime(); (UTC) object creation
 
418
    client_structure: Object describing what attributes a client has
 
419
                      and is used for storing the client at exit
 
420
    current_checker_command: string; current running checker_command
 
421
    disable_initiator_tag: a gobject event source tag, or None
 
422
    enabled:    bool()
245
423
    fingerprint: string (40 or 32 hexadecimal digits); used to
246
424
                 uniquely identify the client
247
 
    secret:     bytestring; sent verbatim (over TLS) to client
248
425
    host:       string; available for use by the checker command
249
 
    created:    datetime.datetime(); (UTC) object creation
250
 
    last_enabled: datetime.datetime(); (UTC)
251
 
    enabled:    bool()
 
426
    interval:   datetime.timedelta(); How often to start a new checker
 
427
    last_approval_request: datetime.datetime(); (UTC) or None
252
428
    last_checked_ok: datetime.datetime(); (UTC) or None
 
429
    last_checker_status: integer between 0 and 255 reflecting exit
 
430
                         status of last checker. -1 reflects crashed
 
431
                         checker, -2 means no checker completed yet.
 
432
    last_enabled: datetime.datetime(); (UTC) or None
 
433
    name:       string; from the config file, used in log messages and
 
434
                        D-Bus identifiers
 
435
    secret:     bytestring; sent verbatim (over TLS) to client
253
436
    timeout:    datetime.timedelta(); How long from last_checked_ok
254
437
                                      until this client is disabled
255
 
    interval:   datetime.timedelta(); How often to start a new checker
256
 
    disable_hook:  If set, called by disable() as disable_hook(self)
257
 
    checker:    subprocess.Popen(); a running checker process used
258
 
                                    to see if the client lives.
259
 
                                    'None' if no process is running.
260
 
    checker_initiator_tag: a gobject event source tag, or None
261
 
    disable_initiator_tag: - '' -
262
 
    checker_callback_tag:  - '' -
263
 
    checker_command: string; External command which is run to check if
264
 
                     client lives.  %() expansions are done at
265
 
                     runtime with vars(self) as dict, so that for
266
 
                     instance %(name)s can be used in the command.
267
 
    current_checker_command: string; current running checker_command
268
 
    approval_delay: datetime.timedelta(); Time to wait for approval
269
 
    _approved:   bool(); 'None' if not yet approved/disapproved
270
 
    approval_duration: datetime.timedelta(); Duration of one approval
 
438
    extended_timeout:   extra long timeout when secret has been sent
 
439
    runtime_expansions: Allowed attributes for runtime expansion.
 
440
    expires:    datetime.datetime(); time (UTC) when a client will be
 
441
                disabled, or None
271
442
    """
272
443
    
273
 
    @staticmethod
274
 
    def _timedelta_to_milliseconds(td):
275
 
        "Convert a datetime.timedelta() to milliseconds"
276
 
        return ((td.days * 24 * 60 * 60 * 1000)
277
 
                + (td.seconds * 1000)
278
 
                + (td.microseconds // 1000))
 
444
    runtime_expansions = ("approval_delay", "approval_duration",
 
445
                          "created", "enabled", "expires",
 
446
                          "fingerprint", "host", "interval",
 
447
                          "last_approval_request", "last_checked_ok",
 
448
                          "last_enabled", "name", "timeout")
 
449
    client_defaults = { "timeout": "5m",
 
450
                        "extended_timeout": "15m",
 
451
                        "interval": "2m",
 
452
                        "checker": "fping -q -- %%(host)s",
 
453
                        "host": "",
 
454
                        "approval_delay": "0s",
 
455
                        "approval_duration": "1s",
 
456
                        "approved_by_default": "True",
 
457
                        "enabled": "True",
 
458
                        }
279
459
    
280
460
    def timeout_milliseconds(self):
281
461
        "Return the 'timeout' attribute in milliseconds"
282
 
        return self._timedelta_to_milliseconds(self.timeout)
 
462
        return timedelta_to_milliseconds(self.timeout)
 
463
    
 
464
    def extended_timeout_milliseconds(self):
 
465
        "Return the 'extended_timeout' attribute in milliseconds"
 
466
        return timedelta_to_milliseconds(self.extended_timeout)
283
467
    
284
468
    def interval_milliseconds(self):
285
469
        "Return the 'interval' attribute in milliseconds"
286
 
        return self._timedelta_to_milliseconds(self.interval)
287
 
 
 
470
        return timedelta_to_milliseconds(self.interval)
 
471
    
288
472
    def approval_delay_milliseconds(self):
289
 
        return self._timedelta_to_milliseconds(self.approval_delay)
290
 
    
291
 
    def __init__(self, name = None, disable_hook=None, config=None):
292
 
        """Note: the 'checker' key in 'config' sets the
293
 
        'checker_command' attribute and *not* the 'checker'
294
 
        attribute."""
 
473
        return timedelta_to_milliseconds(self.approval_delay)
 
474
    
 
475
    @staticmethod
 
476
    def config_parser(config):
 
477
        """Construct a new dict of client settings of this form:
 
478
        { client_name: {setting_name: value, ...}, ...}
 
479
        with exceptions for any special settings as defined above.
 
480
        NOTE: Must be a pure function. Must return the same result
 
481
        value given the same arguments.
 
482
        """
 
483
        settings = {}
 
484
        for client_name in config.sections():
 
485
            section = dict(config.items(client_name))
 
486
            client = settings[client_name] = {}
 
487
            
 
488
            client["host"] = section["host"]
 
489
            # Reformat values from string types to Python types
 
490
            client["approved_by_default"] = config.getboolean(
 
491
                client_name, "approved_by_default")
 
492
            client["enabled"] = config.getboolean(client_name,
 
493
                                                  "enabled")
 
494
            
 
495
            client["fingerprint"] = (section["fingerprint"].upper()
 
496
                                     .replace(" ", ""))
 
497
            if "secret" in section:
 
498
                client["secret"] = section["secret"].decode("base64")
 
499
            elif "secfile" in section:
 
500
                with open(os.path.expanduser(os.path.expandvars
 
501
                                             (section["secfile"])),
 
502
                          "rb") as secfile:
 
503
                    client["secret"] = secfile.read()
 
504
            else:
 
505
                raise TypeError("No secret or secfile for section {0}"
 
506
                                .format(section))
 
507
            client["timeout"] = string_to_delta(section["timeout"])
 
508
            client["extended_timeout"] = string_to_delta(
 
509
                section["extended_timeout"])
 
510
            client["interval"] = string_to_delta(section["interval"])
 
511
            client["approval_delay"] = string_to_delta(
 
512
                section["approval_delay"])
 
513
            client["approval_duration"] = string_to_delta(
 
514
                section["approval_duration"])
 
515
            client["checker_command"] = section["checker"]
 
516
            client["last_approval_request"] = None
 
517
            client["last_checked_ok"] = None
 
518
            client["last_checker_status"] = -2
 
519
        
 
520
        return settings
 
521
    
 
522
    def __init__(self, settings, name = None):
295
523
        self.name = name
296
 
        if config is None:
297
 
            config = {}
298
 
        logger.debug(u"Creating client %r", self.name)
 
524
        # adding all client settings
 
525
        for setting, value in settings.iteritems():
 
526
            setattr(self, setting, value)
 
527
        
 
528
        if self.enabled:
 
529
            if not hasattr(self, "last_enabled"):
 
530
                self.last_enabled = datetime.datetime.utcnow()
 
531
            if not hasattr(self, "expires"):
 
532
                self.expires = (datetime.datetime.utcnow()
 
533
                                + self.timeout)
 
534
        else:
 
535
            self.last_enabled = None
 
536
            self.expires = None
 
537
        
 
538
        logger.debug("Creating client %r", self.name)
299
539
        # Uppercase and remove spaces from fingerprint for later
300
540
        # comparison purposes with return value from the fingerprint()
301
541
        # function
302
 
        self.fingerprint = (config[u"fingerprint"].upper()
303
 
                            .replace(u" ", u""))
304
 
        logger.debug(u"  Fingerprint: %s", self.fingerprint)
305
 
        if u"secret" in config:
306
 
            self.secret = config[u"secret"].decode(u"base64")
307
 
        elif u"secfile" in config:
308
 
            with open(os.path.expanduser(os.path.expandvars
309
 
                                         (config[u"secfile"])),
310
 
                      "rb") as secfile:
311
 
                self.secret = secfile.read()
312
 
        else:
313
 
            raise TypeError(u"No secret or secfile for client %s"
314
 
                            % self.name)
315
 
        self.host = config.get(u"host", u"")
316
 
        self.created = datetime.datetime.utcnow()
317
 
        self.enabled = False
318
 
        self.last_enabled = None
319
 
        self.last_checked_ok = None
320
 
        self.timeout = string_to_delta(config[u"timeout"])
321
 
        self.interval = string_to_delta(config[u"interval"])
322
 
        self.disable_hook = disable_hook
 
542
        logger.debug("  Fingerprint: %s", self.fingerprint)
 
543
        self.created = settings.get("created",
 
544
                                    datetime.datetime.utcnow())
 
545
        
 
546
        # attributes specific for this server instance
323
547
        self.checker = None
324
548
        self.checker_initiator_tag = None
325
549
        self.disable_initiator_tag = None
326
550
        self.checker_callback_tag = None
327
 
        self.checker_command = config[u"checker"]
328
551
        self.current_checker_command = None
329
 
        self.last_connect = None
330
 
        self._approved = None
331
 
        self.approved_by_default = config.get(u"approved_by_default",
332
 
                                              True)
 
552
        self.approved = None
333
553
        self.approvals_pending = 0
334
 
        self.approval_delay = string_to_delta(
335
 
            config[u"approval_delay"])
336
 
        self.approval_duration = string_to_delta(
337
 
            config[u"approval_duration"])
338
 
        self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())
 
554
        self.changedstate = (multiprocessing_manager
 
555
                             .Condition(multiprocessing_manager
 
556
                                        .Lock()))
 
557
        self.client_structure = [attr for attr in
 
558
                                 self.__dict__.iterkeys()
 
559
                                 if not attr.startswith("_")]
 
560
        self.client_structure.append("client_structure")
 
561
        
 
562
        for name, t in inspect.getmembers(type(self),
 
563
                                          lambda obj:
 
564
                                              isinstance(obj,
 
565
                                                         property)):
 
566
            if not name.startswith("_"):
 
567
                self.client_structure.append(name)
339
568
    
 
569
    # Send notice to process children that client state has changed
340
570
    def send_changedstate(self):
341
 
        self.changedstate.acquire()
342
 
        self.changedstate.notify_all()
343
 
        self.changedstate.release()
344
 
        
 
571
        with self.changedstate:
 
572
            self.changedstate.notify_all()
 
573
    
345
574
    def enable(self):
346
575
        """Start this client's checker and timeout hooks"""
347
 
        if getattr(self, u"enabled", False):
 
576
        if getattr(self, "enabled", False):
348
577
            # Already enabled
349
578
            return
350
 
        self.send_changedstate()
 
579
        self.expires = datetime.datetime.utcnow() + self.timeout
 
580
        self.enabled = True
351
581
        self.last_enabled = datetime.datetime.utcnow()
 
582
        self.init_checker()
 
583
        self.send_changedstate()
 
584
    
 
585
    def disable(self, quiet=True):
 
586
        """Disable this client."""
 
587
        if not getattr(self, "enabled", False):
 
588
            return False
 
589
        if not quiet:
 
590
            logger.info("Disabling client %s", self.name)
 
591
        if getattr(self, "disable_initiator_tag", None) is not None:
 
592
            gobject.source_remove(self.disable_initiator_tag)
 
593
            self.disable_initiator_tag = None
 
594
        self.expires = None
 
595
        if getattr(self, "checker_initiator_tag", None) is not None:
 
596
            gobject.source_remove(self.checker_initiator_tag)
 
597
            self.checker_initiator_tag = None
 
598
        self.stop_checker()
 
599
        self.enabled = False
 
600
        if not quiet:
 
601
            self.send_changedstate()
 
602
        # Do not run this again if called by a gobject.timeout_add
 
603
        return False
 
604
    
 
605
    def __del__(self):
 
606
        self.disable()
 
607
    
 
608
    def init_checker(self):
352
609
        # Schedule a new checker to be started an 'interval' from now,
353
610
        # and every interval from then on.
 
611
        if self.checker_initiator_tag is not None:
 
612
            gobject.source_remove(self.checker_initiator_tag)
354
613
        self.checker_initiator_tag = (gobject.timeout_add
355
614
                                      (self.interval_milliseconds(),
356
615
                                       self.start_checker))
357
616
        # Schedule a disable() when 'timeout' has passed
 
617
        if self.disable_initiator_tag is not None:
 
618
            gobject.source_remove(self.disable_initiator_tag)
358
619
        self.disable_initiator_tag = (gobject.timeout_add
359
620
                                   (self.timeout_milliseconds(),
360
621
                                    self.disable))
361
 
        self.enabled = True
362
622
        # Also start a new checker *right now*.
363
623
        self.start_checker()
364
624
    
365
 
    def disable(self, quiet=True):
366
 
        """Disable this client."""
367
 
        if not getattr(self, "enabled", False):
368
 
            return False
369
 
        if not quiet:
370
 
            self.send_changedstate()
371
 
        if not quiet:
372
 
            logger.info(u"Disabling client %s", self.name)
373
 
        if getattr(self, u"disable_initiator_tag", False):
374
 
            gobject.source_remove(self.disable_initiator_tag)
375
 
            self.disable_initiator_tag = None
376
 
        if getattr(self, u"checker_initiator_tag", False):
377
 
            gobject.source_remove(self.checker_initiator_tag)
378
 
            self.checker_initiator_tag = None
379
 
        self.stop_checker()
380
 
        if self.disable_hook:
381
 
            self.disable_hook(self)
382
 
        self.enabled = False
383
 
        # Do not run this again if called by a gobject.timeout_add
384
 
        return False
385
 
    
386
 
    def __del__(self):
387
 
        self.disable_hook = None
388
 
        self.disable()
389
 
    
390
625
    def checker_callback(self, pid, condition, command):
391
626
        """The checker has completed, so take appropriate actions."""
392
627
        self.checker_callback_tag = None
393
628
        self.checker = None
394
629
        if os.WIFEXITED(condition):
395
 
            exitstatus = os.WEXITSTATUS(condition)
396
 
            if exitstatus == 0:
397
 
                logger.info(u"Checker for %(name)s succeeded",
 
630
            self.last_checker_status = os.WEXITSTATUS(condition)
 
631
            if self.last_checker_status == 0:
 
632
                logger.info("Checker for %(name)s succeeded",
398
633
                            vars(self))
399
634
                self.checked_ok()
400
635
            else:
401
 
                logger.info(u"Checker for %(name)s failed",
 
636
                logger.info("Checker for %(name)s failed",
402
637
                            vars(self))
403
638
        else:
404
 
            logger.warning(u"Checker for %(name)s crashed?",
 
639
            self.last_checker_status = -1
 
640
            logger.warning("Checker for %(name)s crashed?",
405
641
                           vars(self))
406
642
    
407
643
    def checked_ok(self):
408
 
        """Bump up the timeout for this client.
409
 
        
410
 
        This should only be called when the client has been seen,
411
 
        alive and well.
412
 
        """
 
644
        """Assert that the client has been seen, alive and well."""
413
645
        self.last_checked_ok = datetime.datetime.utcnow()
414
 
        gobject.source_remove(self.disable_initiator_tag)
415
 
        self.disable_initiator_tag = (gobject.timeout_add
416
 
                                      (self.timeout_milliseconds(),
417
 
                                       self.disable))
 
646
        self.last_checker_status = 0
 
647
        self.bump_timeout()
 
648
    
 
649
    def bump_timeout(self, timeout=None):
 
650
        """Bump up the timeout for this client."""
 
651
        if timeout is None:
 
652
            timeout = self.timeout
 
653
        if self.disable_initiator_tag is not None:
 
654
            gobject.source_remove(self.disable_initiator_tag)
 
655
            self.disable_initiator_tag = None
 
656
        if getattr(self, "enabled", False):
 
657
            self.disable_initiator_tag = (gobject.timeout_add
 
658
                                          (timedelta_to_milliseconds
 
659
                                           (timeout), self.disable))
 
660
            self.expires = datetime.datetime.utcnow() + timeout
 
661
    
 
662
    def need_approval(self):
 
663
        self.last_approval_request = datetime.datetime.utcnow()
418
664
    
419
665
    def start_checker(self):
420
666
        """Start a new checker subprocess if one is not running.
422
668
        If a checker already exists, leave it running and do
423
669
        nothing."""
424
670
        # The reason for not killing a running checker is that if we
425
 
        # did that, then if a checker (for some reason) started
426
 
        # running slowly and taking more than 'interval' time, the
427
 
        # client would inevitably timeout, since no checker would get
428
 
        # a chance to run to completion.  If we instead leave running
 
671
        # did that, and if a checker (for some reason) started running
 
672
        # slowly and taking more than 'interval' time, then the client
 
673
        # would inevitably timeout, since no checker would get a
 
674
        # chance to run to completion.  If we instead leave running
429
675
        # checkers alone, the checker would have to take more time
430
676
        # than 'timeout' for the client to be disabled, which is as it
431
677
        # should be.
433
679
        # If a checker exists, make sure it is not a zombie
434
680
        try:
435
681
            pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
436
 
        except (AttributeError, OSError), error:
 
682
        except (AttributeError, OSError) as error:
437
683
            if (isinstance(error, OSError)
438
684
                and error.errno != errno.ECHILD):
439
685
                raise error
440
686
        else:
441
687
            if pid:
442
 
                logger.warning(u"Checker was a zombie")
 
688
                logger.warning("Checker was a zombie")
443
689
                gobject.source_remove(self.checker_callback_tag)
444
690
                self.checker_callback(pid, status,
445
691
                                      self.current_checker_command)
446
692
        # Start a new checker if needed
447
693
        if self.checker is None:
 
694
            # Escape attributes for the shell
 
695
            escaped_attrs = dict(
 
696
                (attr, re.escape(unicode(getattr(self, attr))))
 
697
                for attr in
 
698
                self.runtime_expansions)
448
699
            try:
449
 
                # In case checker_command has exactly one % operator
450
 
                command = self.checker_command % self.host
451
 
            except TypeError:
452
 
                # Escape attributes for the shell
453
 
                escaped_attrs = dict((key,
454
 
                                      re.escape(unicode(str(val),
455
 
                                                        errors=
456
 
                                                        u'replace')))
457
 
                                     for key, val in
458
 
                                     vars(self).iteritems())
459
 
                try:
460
 
                    command = self.checker_command % escaped_attrs
461
 
                except TypeError, error:
462
 
                    logger.error(u'Could not format string "%s":'
463
 
                                 u' %s', self.checker_command, error)
464
 
                    return True # Try again later
 
700
                command = self.checker_command % escaped_attrs
 
701
            except TypeError as error:
 
702
                logger.error('Could not format string "%s"',
 
703
                             self.checker_command, exc_info=error)
 
704
                return True # Try again later
465
705
            self.current_checker_command = command
466
706
            try:
467
 
                logger.info(u"Starting checker %r for %s",
 
707
                logger.info("Starting checker %r for %s",
468
708
                            command, self.name)
469
709
                # We don't need to redirect stdout and stderr, since
470
710
                # in normal mode, that is already done by daemon(),
472
712
                # always replaced by /dev/null.)
473
713
                self.checker = subprocess.Popen(command,
474
714
                                                close_fds=True,
475
 
                                                shell=True, cwd=u"/")
476
 
                self.checker_callback_tag = (gobject.child_watch_add
477
 
                                             (self.checker.pid,
478
 
                                              self.checker_callback,
479
 
                                              data=command))
480
 
                # The checker may have completed before the gobject
481
 
                # watch was added.  Check for this.
482
 
                pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
483
 
                if pid:
484
 
                    gobject.source_remove(self.checker_callback_tag)
485
 
                    self.checker_callback(pid, status, command)
486
 
            except OSError, error:
487
 
                logger.error(u"Failed to start subprocess: %s",
488
 
                             error)
 
715
                                                shell=True, cwd="/")
 
716
            except OSError as error:
 
717
                logger.error("Failed to start subprocess",
 
718
                             exc_info=error)
 
719
            self.checker_callback_tag = (gobject.child_watch_add
 
720
                                         (self.checker.pid,
 
721
                                          self.checker_callback,
 
722
                                          data=command))
 
723
            # The checker may have completed before the gobject
 
724
            # watch was added.  Check for this.
 
725
            pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
 
726
            if pid:
 
727
                gobject.source_remove(self.checker_callback_tag)
 
728
                self.checker_callback(pid, status, command)
489
729
        # Re-run this periodically if run by gobject.timeout_add
490
730
        return True
491
731
    
494
734
        if self.checker_callback_tag:
495
735
            gobject.source_remove(self.checker_callback_tag)
496
736
            self.checker_callback_tag = None
497
 
        if getattr(self, u"checker", None) is None:
 
737
        if getattr(self, "checker", None) is None:
498
738
            return
499
 
        logger.debug(u"Stopping checker for %(name)s", vars(self))
 
739
        logger.debug("Stopping checker for %(name)s", vars(self))
500
740
        try:
501
 
            os.kill(self.checker.pid, signal.SIGTERM)
 
741
            self.checker.terminate()
502
742
            #time.sleep(0.5)
503
743
            #if self.checker.poll() is None:
504
 
            #    os.kill(self.checker.pid, signal.SIGKILL)
505
 
        except OSError, error:
 
744
            #    self.checker.kill()
 
745
        except OSError as error:
506
746
            if error.errno != errno.ESRCH: # No such process
507
747
                raise
508
748
        self.checker = None
509
749
 
510
 
def dbus_service_property(dbus_interface, signature=u"v",
511
 
                          access=u"readwrite", byte_arrays=False):
 
750
 
 
751
def dbus_service_property(dbus_interface, signature="v",
 
752
                          access="readwrite", byte_arrays=False):
512
753
    """Decorators for marking methods of a DBusObjectWithProperties to
513
754
    become properties on the D-Bus.
514
755
    
521
762
    """
522
763
    # Encoding deeply encoded byte arrays is not supported yet by the
523
764
    # "Set" method, so we fail early here:
524
 
    if byte_arrays and signature != u"ay":
525
 
        raise ValueError(u"Byte arrays not supported for non-'ay'"
526
 
                         u" signature %r" % signature)
 
765
    if byte_arrays and signature != "ay":
 
766
        raise ValueError("Byte arrays not supported for non-'ay'"
 
767
                         " signature {0!r}".format(signature))
527
768
    def decorator(func):
528
769
        func._dbus_is_property = True
529
770
        func._dbus_interface = dbus_interface
530
771
        func._dbus_signature = signature
531
772
        func._dbus_access = access
532
773
        func._dbus_name = func.__name__
533
 
        if func._dbus_name.endswith(u"_dbus_property"):
 
774
        if func._dbus_name.endswith("_dbus_property"):
534
775
            func._dbus_name = func._dbus_name[:-14]
535
 
        func._dbus_get_args_options = {u'byte_arrays': byte_arrays }
 
776
        func._dbus_get_args_options = {'byte_arrays': byte_arrays }
 
777
        return func
 
778
    return decorator
 
779
 
 
780
 
 
781
def dbus_interface_annotations(dbus_interface):
 
782
    """Decorator for marking functions returning interface annotations
 
783
    
 
784
    Usage:
 
785
    
 
786
    @dbus_interface_annotations("org.example.Interface")
 
787
    def _foo(self):  # Function name does not matter
 
788
        return {"org.freedesktop.DBus.Deprecated": "true",
 
789
                "org.freedesktop.DBus.Property.EmitsChangedSignal":
 
790
                    "false"}
 
791
    """
 
792
    def decorator(func):
 
793
        func._dbus_is_interface = True
 
794
        func._dbus_interface = dbus_interface
 
795
        func._dbus_name = dbus_interface
 
796
        return func
 
797
    return decorator
 
798
 
 
799
 
 
800
def dbus_annotations(annotations):
 
801
    """Decorator to annotate D-Bus methods, signals or properties
 
802
    Usage:
 
803
    
 
804
    @dbus_service_property("org.example.Interface", signature="b",
 
805
                           access="r")
 
806
    @dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",
 
807
                        "org.freedesktop.DBus.Property."
 
808
                        "EmitsChangedSignal": "false"})
 
809
    def Property_dbus_property(self):
 
810
        return dbus.Boolean(False)
 
811
    """
 
812
    def decorator(func):
 
813
        func._dbus_annotations = annotations
536
814
        return func
537
815
    return decorator
538
816
 
558
836
 
559
837
class DBusObjectWithProperties(dbus.service.Object):
560
838
    """A D-Bus object with properties.
561
 
 
 
839
    
562
840
    Classes inheriting from this can use the dbus_service_property
563
841
    decorator to expose methods as D-Bus properties.  It exposes the
564
842
    standard Get(), Set(), and GetAll() methods on the D-Bus.
565
843
    """
566
844
    
567
845
    @staticmethod
568
 
    def _is_dbus_property(obj):
569
 
        return getattr(obj, u"_dbus_is_property", False)
 
846
    def _is_dbus_thing(thing):
 
847
        """Returns a function testing if an attribute is a D-Bus thing
 
848
        
 
849
        If called like _is_dbus_thing("method") it returns a function
 
850
        suitable for use as predicate to inspect.getmembers().
 
851
        """
 
852
        return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),
 
853
                                   False)
570
854
    
571
 
    def _get_all_dbus_properties(self):
 
855
    def _get_all_dbus_things(self, thing):
572
856
        """Returns a generator of (name, attribute) pairs
573
857
        """
574
 
        return ((prop._dbus_name, prop)
575
 
                for name, prop in
576
 
                inspect.getmembers(self, self._is_dbus_property))
 
858
        return ((getattr(athing.__get__(self), "_dbus_name",
 
859
                         name),
 
860
                 athing.__get__(self))
 
861
                for cls in self.__class__.__mro__
 
862
                for name, athing in
 
863
                inspect.getmembers(cls,
 
864
                                   self._is_dbus_thing(thing)))
577
865
    
578
866
    def _get_dbus_property(self, interface_name, property_name):
579
867
        """Returns a bound method if one exists which is a D-Bus
580
868
        property with the specified name and interface.
581
869
        """
582
 
        for name in (property_name,
583
 
                     property_name + u"_dbus_property"):
584
 
            prop = getattr(self, name, None)
585
 
            if (prop is None
586
 
                or not self._is_dbus_property(prop)
587
 
                or prop._dbus_name != property_name
588
 
                or (interface_name and prop._dbus_interface
589
 
                    and interface_name != prop._dbus_interface)):
590
 
                continue
591
 
            return prop
 
870
        for cls in  self.__class__.__mro__:
 
871
            for name, value in (inspect.getmembers
 
872
                                (cls,
 
873
                                 self._is_dbus_thing("property"))):
 
874
                if (value._dbus_name == property_name
 
875
                    and value._dbus_interface == interface_name):
 
876
                    return value.__get__(self)
 
877
        
592
878
        # No such property
593
 
        raise DBusPropertyNotFound(self.dbus_object_path + u":"
594
 
                                   + interface_name + u"."
 
879
        raise DBusPropertyNotFound(self.dbus_object_path + ":"
 
880
                                   + interface_name + "."
595
881
                                   + property_name)
596
882
    
597
 
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ss",
598
 
                         out_signature=u"v")
 
883
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
 
884
                         out_signature="v")
599
885
    def Get(self, interface_name, property_name):
600
886
        """Standard D-Bus property Get() method, see D-Bus standard.
601
887
        """
602
888
        prop = self._get_dbus_property(interface_name, property_name)
603
 
        if prop._dbus_access == u"write":
 
889
        if prop._dbus_access == "write":
604
890
            raise DBusPropertyAccessException(property_name)
605
891
        value = prop()
606
 
        if not hasattr(value, u"variant_level"):
 
892
        if not hasattr(value, "variant_level"):
607
893
            return value
608
894
        return type(value)(value, variant_level=value.variant_level+1)
609
895
    
610
 
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ssv")
 
896
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
611
897
    def Set(self, interface_name, property_name, value):
612
898
        """Standard D-Bus property Set() method, see D-Bus standard.
613
899
        """
614
900
        prop = self._get_dbus_property(interface_name, property_name)
615
 
        if prop._dbus_access == u"read":
 
901
        if prop._dbus_access == "read":
616
902
            raise DBusPropertyAccessException(property_name)
617
 
        if prop._dbus_get_args_options[u"byte_arrays"]:
 
903
        if prop._dbus_get_args_options["byte_arrays"]:
618
904
            # The byte_arrays option is not supported yet on
619
905
            # signatures other than "ay".
620
 
            if prop._dbus_signature != u"ay":
 
906
            if prop._dbus_signature != "ay":
621
907
                raise ValueError
622
 
            value = dbus.ByteArray(''.join(unichr(byte)
623
 
                                           for byte in value))
 
908
            value = dbus.ByteArray(b''.join(chr(byte)
 
909
                                            for byte in value))
624
910
        prop(value)
625
911
    
626
 
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"s",
627
 
                         out_signature=u"a{sv}")
 
912
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
 
913
                         out_signature="a{sv}")
628
914
    def GetAll(self, interface_name):
629
915
        """Standard D-Bus property GetAll() method, see D-Bus
630
916
        standard.
631
 
 
 
917
        
632
918
        Note: Will not include properties with access="write".
633
919
        """
634
 
        all = {}
635
 
        for name, prop in self._get_all_dbus_properties():
 
920
        properties = {}
 
921
        for name, prop in self._get_all_dbus_things("property"):
636
922
            if (interface_name
637
923
                and interface_name != prop._dbus_interface):
638
924
                # Interface non-empty but did not match
639
925
                continue
640
926
            # Ignore write-only properties
641
 
            if prop._dbus_access == u"write":
 
927
            if prop._dbus_access == "write":
642
928
                continue
643
929
            value = prop()
644
 
            if not hasattr(value, u"variant_level"):
645
 
                all[name] = value
 
930
            if not hasattr(value, "variant_level"):
 
931
                properties[name] = value
646
932
                continue
647
 
            all[name] = type(value)(value, variant_level=
648
 
                                    value.variant_level+1)
649
 
        return dbus.Dictionary(all, signature=u"sv")
 
933
            properties[name] = type(value)(value, variant_level=
 
934
                                           value.variant_level+1)
 
935
        return dbus.Dictionary(properties, signature="sv")
650
936
    
651
937
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
652
 
                         out_signature=u"s",
 
938
                         out_signature="s",
653
939
                         path_keyword='object_path',
654
940
                         connection_keyword='connection')
655
941
    def Introspect(self, object_path, connection):
656
 
        """Standard D-Bus method, overloaded to insert property tags.
 
942
        """Overloading of standard D-Bus method.
 
943
        
 
944
        Inserts property tags and interface annotation tags.
657
945
        """
658
946
        xmlstring = dbus.service.Object.Introspect(self, object_path,
659
947
                                                   connection)
660
948
        try:
661
949
            document = xml.dom.minidom.parseString(xmlstring)
662
950
            def make_tag(document, name, prop):
663
 
                e = document.createElement(u"property")
664
 
                e.setAttribute(u"name", name)
665
 
                e.setAttribute(u"type", prop._dbus_signature)
666
 
                e.setAttribute(u"access", prop._dbus_access)
 
951
                e = document.createElement("property")
 
952
                e.setAttribute("name", name)
 
953
                e.setAttribute("type", prop._dbus_signature)
 
954
                e.setAttribute("access", prop._dbus_access)
667
955
                return e
668
 
            for if_tag in document.getElementsByTagName(u"interface"):
 
956
            for if_tag in document.getElementsByTagName("interface"):
 
957
                # Add property tags
669
958
                for tag in (make_tag(document, name, prop)
670
959
                            for name, prop
671
 
                            in self._get_all_dbus_properties()
 
960
                            in self._get_all_dbus_things("property")
672
961
                            if prop._dbus_interface
673
 
                            == if_tag.getAttribute(u"name")):
 
962
                            == if_tag.getAttribute("name")):
674
963
                    if_tag.appendChild(tag)
 
964
                # Add annotation tags
 
965
                for typ in ("method", "signal", "property"):
 
966
                    for tag in if_tag.getElementsByTagName(typ):
 
967
                        annots = dict()
 
968
                        for name, prop in (self.
 
969
                                           _get_all_dbus_things(typ)):
 
970
                            if (name == tag.getAttribute("name")
 
971
                                and prop._dbus_interface
 
972
                                == if_tag.getAttribute("name")):
 
973
                                annots.update(getattr
 
974
                                              (prop,
 
975
                                               "_dbus_annotations",
 
976
                                               {}))
 
977
                        for name, value in annots.iteritems():
 
978
                            ann_tag = document.createElement(
 
979
                                "annotation")
 
980
                            ann_tag.setAttribute("name", name)
 
981
                            ann_tag.setAttribute("value", value)
 
982
                            tag.appendChild(ann_tag)
 
983
                # Add interface annotation tags
 
984
                for annotation, value in dict(
 
985
                    itertools.chain.from_iterable(
 
986
                        annotations().iteritems()
 
987
                        for name, annotations in
 
988
                        self._get_all_dbus_things("interface")
 
989
                        if name == if_tag.getAttribute("name")
 
990
                        )).iteritems():
 
991
                    ann_tag = document.createElement("annotation")
 
992
                    ann_tag.setAttribute("name", annotation)
 
993
                    ann_tag.setAttribute("value", value)
 
994
                    if_tag.appendChild(ann_tag)
675
995
                # Add the names to the return values for the
676
996
                # "org.freedesktop.DBus.Properties" methods
677
 
                if (if_tag.getAttribute(u"name")
678
 
                    == u"org.freedesktop.DBus.Properties"):
679
 
                    for cn in if_tag.getElementsByTagName(u"method"):
680
 
                        if cn.getAttribute(u"name") == u"Get":
681
 
                            for arg in cn.getElementsByTagName(u"arg"):
682
 
                                if (arg.getAttribute(u"direction")
683
 
                                    == u"out"):
684
 
                                    arg.setAttribute(u"name", u"value")
685
 
                        elif cn.getAttribute(u"name") == u"GetAll":
686
 
                            for arg in cn.getElementsByTagName(u"arg"):
687
 
                                if (arg.getAttribute(u"direction")
688
 
                                    == u"out"):
689
 
                                    arg.setAttribute(u"name", u"props")
690
 
            xmlstring = document.toxml(u"utf-8")
 
997
                if (if_tag.getAttribute("name")
 
998
                    == "org.freedesktop.DBus.Properties"):
 
999
                    for cn in if_tag.getElementsByTagName("method"):
 
1000
                        if cn.getAttribute("name") == "Get":
 
1001
                            for arg in cn.getElementsByTagName("arg"):
 
1002
                                if (arg.getAttribute("direction")
 
1003
                                    == "out"):
 
1004
                                    arg.setAttribute("name", "value")
 
1005
                        elif cn.getAttribute("name") == "GetAll":
 
1006
                            for arg in cn.getElementsByTagName("arg"):
 
1007
                                if (arg.getAttribute("direction")
 
1008
                                    == "out"):
 
1009
                                    arg.setAttribute("name", "props")
 
1010
            xmlstring = document.toxml("utf-8")
691
1011
            document.unlink()
692
1012
        except (AttributeError, xml.dom.DOMException,
693
 
                xml.parsers.expat.ExpatError), error:
694
 
            logger.error(u"Failed to override Introspection method",
695
 
                         error)
 
1013
                xml.parsers.expat.ExpatError) as error:
 
1014
            logger.error("Failed to override Introspection method",
 
1015
                         exc_info=error)
696
1016
        return xmlstring
697
1017
 
698
1018
 
 
1019
def datetime_to_dbus (dt, variant_level=0):
 
1020
    """Convert a UTC datetime.datetime() to a D-Bus type."""
 
1021
    if dt is None:
 
1022
        return dbus.String("", variant_level = variant_level)
 
1023
    return dbus.String(dt.isoformat(),
 
1024
                       variant_level=variant_level)
 
1025
 
 
1026
 
 
1027
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
 
1028
    """A class decorator; applied to a subclass of
 
1029
    dbus.service.Object, it will add alternate D-Bus attributes with
 
1030
    interface names according to the "alt_interface_names" mapping.
 
1031
    Usage:
 
1032
    
 
1033
    @alternate_dbus_names({"org.example.Interface":
 
1034
                               "net.example.AlternateInterface"})
 
1035
    class SampleDBusObject(dbus.service.Object):
 
1036
        @dbus.service.method("org.example.Interface")
 
1037
        def SampleDBusMethod():
 
1038
            pass
 
1039
    
 
1040
    The above "SampleDBusMethod" on "SampleDBusObject" will be
 
1041
    reachable via two interfaces: "org.example.Interface" and
 
1042
    "net.example.AlternateInterface", the latter of which will have
 
1043
    its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
 
1044
    "true", unless "deprecate" is passed with a False value.
 
1045
    
 
1046
    This works for methods and signals, and also for D-Bus properties
 
1047
    (from DBusObjectWithProperties) and interfaces (from the
 
1048
    dbus_interface_annotations decorator).
 
1049
    """
 
1050
    def wrapper(cls):
 
1051
        for orig_interface_name, alt_interface_name in (
 
1052
            alt_interface_names.iteritems()):
 
1053
            attr = {}
 
1054
            interface_names = set()
 
1055
            # Go though all attributes of the class
 
1056
            for attrname, attribute in inspect.getmembers(cls):
 
1057
                # Ignore non-D-Bus attributes, and D-Bus attributes
 
1058
                # with the wrong interface name
 
1059
                if (not hasattr(attribute, "_dbus_interface")
 
1060
                    or not attribute._dbus_interface
 
1061
                    .startswith(orig_interface_name)):
 
1062
                    continue
 
1063
                # Create an alternate D-Bus interface name based on
 
1064
                # the current name
 
1065
                alt_interface = (attribute._dbus_interface
 
1066
                                 .replace(orig_interface_name,
 
1067
                                          alt_interface_name))
 
1068
                interface_names.add(alt_interface)
 
1069
                # Is this a D-Bus signal?
 
1070
                if getattr(attribute, "_dbus_is_signal", False):
 
1071
                    # Extract the original non-method function by
 
1072
                    # black magic
 
1073
                    nonmethod_func = (dict(
 
1074
                            zip(attribute.func_code.co_freevars,
 
1075
                                attribute.__closure__))["func"]
 
1076
                                      .cell_contents)
 
1077
                    # Create a new, but exactly alike, function
 
1078
                    # object, and decorate it to be a new D-Bus signal
 
1079
                    # with the alternate D-Bus interface name
 
1080
                    new_function = (dbus.service.signal
 
1081
                                    (alt_interface,
 
1082
                                     attribute._dbus_signature)
 
1083
                                    (types.FunctionType(
 
1084
                                nonmethod_func.func_code,
 
1085
                                nonmethod_func.func_globals,
 
1086
                                nonmethod_func.func_name,
 
1087
                                nonmethod_func.func_defaults,
 
1088
                                nonmethod_func.func_closure)))
 
1089
                    # Copy annotations, if any
 
1090
                    try:
 
1091
                        new_function._dbus_annotations = (
 
1092
                            dict(attribute._dbus_annotations))
 
1093
                    except AttributeError:
 
1094
                        pass
 
1095
                    # Define a creator of a function to call both the
 
1096
                    # original and alternate functions, so both the
 
1097
                    # original and alternate signals gets sent when
 
1098
                    # the function is called
 
1099
                    def fixscope(func1, func2):
 
1100
                        """This function is a scope container to pass
 
1101
                        func1 and func2 to the "call_both" function
 
1102
                        outside of its arguments"""
 
1103
                        def call_both(*args, **kwargs):
 
1104
                            """This function will emit two D-Bus
 
1105
                            signals by calling func1 and func2"""
 
1106
                            func1(*args, **kwargs)
 
1107
                            func2(*args, **kwargs)
 
1108
                        return call_both
 
1109
                    # Create the "call_both" function and add it to
 
1110
                    # the class
 
1111
                    attr[attrname] = fixscope(attribute, new_function)
 
1112
                # Is this a D-Bus method?
 
1113
                elif getattr(attribute, "_dbus_is_method", False):
 
1114
                    # Create a new, but exactly alike, function
 
1115
                    # object.  Decorate it to be a new D-Bus method
 
1116
                    # with the alternate D-Bus interface name.  Add it
 
1117
                    # to the class.
 
1118
                    attr[attrname] = (dbus.service.method
 
1119
                                      (alt_interface,
 
1120
                                       attribute._dbus_in_signature,
 
1121
                                       attribute._dbus_out_signature)
 
1122
                                      (types.FunctionType
 
1123
                                       (attribute.func_code,
 
1124
                                        attribute.func_globals,
 
1125
                                        attribute.func_name,
 
1126
                                        attribute.func_defaults,
 
1127
                                        attribute.func_closure)))
 
1128
                    # Copy annotations, if any
 
1129
                    try:
 
1130
                        attr[attrname]._dbus_annotations = (
 
1131
                            dict(attribute._dbus_annotations))
 
1132
                    except AttributeError:
 
1133
                        pass
 
1134
                # Is this a D-Bus property?
 
1135
                elif getattr(attribute, "_dbus_is_property", False):
 
1136
                    # Create a new, but exactly alike, function
 
1137
                    # object, and decorate it to be a new D-Bus
 
1138
                    # property with the alternate D-Bus interface
 
1139
                    # name.  Add it to the class.
 
1140
                    attr[attrname] = (dbus_service_property
 
1141
                                      (alt_interface,
 
1142
                                       attribute._dbus_signature,
 
1143
                                       attribute._dbus_access,
 
1144
                                       attribute
 
1145
                                       ._dbus_get_args_options
 
1146
                                       ["byte_arrays"])
 
1147
                                      (types.FunctionType
 
1148
                                       (attribute.func_code,
 
1149
                                        attribute.func_globals,
 
1150
                                        attribute.func_name,
 
1151
                                        attribute.func_defaults,
 
1152
                                        attribute.func_closure)))
 
1153
                    # Copy annotations, if any
 
1154
                    try:
 
1155
                        attr[attrname]._dbus_annotations = (
 
1156
                            dict(attribute._dbus_annotations))
 
1157
                    except AttributeError:
 
1158
                        pass
 
1159
                # Is this a D-Bus interface?
 
1160
                elif getattr(attribute, "_dbus_is_interface", False):
 
1161
                    # Create a new, but exactly alike, function
 
1162
                    # object.  Decorate it to be a new D-Bus interface
 
1163
                    # with the alternate D-Bus interface name.  Add it
 
1164
                    # to the class.
 
1165
                    attr[attrname] = (dbus_interface_annotations
 
1166
                                      (alt_interface)
 
1167
                                      (types.FunctionType
 
1168
                                       (attribute.func_code,
 
1169
                                        attribute.func_globals,
 
1170
                                        attribute.func_name,
 
1171
                                        attribute.func_defaults,
 
1172
                                        attribute.func_closure)))
 
1173
            if deprecate:
 
1174
                # Deprecate all alternate interfaces
 
1175
                iname="_AlternateDBusNames_interface_annotation{0}"
 
1176
                for interface_name in interface_names:
 
1177
                    @dbus_interface_annotations(interface_name)
 
1178
                    def func(self):
 
1179
                        return { "org.freedesktop.DBus.Deprecated":
 
1180
                                     "true" }
 
1181
                    # Find an unused name
 
1182
                    for aname in (iname.format(i)
 
1183
                                  for i in itertools.count()):
 
1184
                        if aname not in attr:
 
1185
                            attr[aname] = func
 
1186
                            break
 
1187
            if interface_names:
 
1188
                # Replace the class with a new subclass of it with
 
1189
                # methods, signals, etc. as created above.
 
1190
                cls = type(b"{0}Alternate".format(cls.__name__),
 
1191
                           (cls,), attr)
 
1192
        return cls
 
1193
    return wrapper
 
1194
 
 
1195
 
 
1196
@alternate_dbus_interfaces({"se.recompile.Mandos":
 
1197
                                "se.bsnet.fukt.Mandos"})
699
1198
class ClientDBus(Client, DBusObjectWithProperties):
700
1199
    """A Client class using D-Bus
701
1200
    
703
1202
    dbus_object_path: dbus.ObjectPath
704
1203
    bus: dbus.SystemBus()
705
1204
    """
 
1205
    
 
1206
    runtime_expansions = (Client.runtime_expansions
 
1207
                          + ("dbus_object_path",))
 
1208
    
706
1209
    # dbus.service.Object doesn't use super(), so we can't either.
707
1210
    
708
1211
    def __init__(self, bus = None, *args, **kwargs):
709
 
        self._approvals_pending = 0
710
1212
        self.bus = bus
711
1213
        Client.__init__(self, *args, **kwargs)
712
1214
        # Only now, when this client is initialized, can it show up on
713
1215
        # the D-Bus
 
1216
        client_object_name = unicode(self.name).translate(
 
1217
            {ord("."): ord("_"),
 
1218
             ord("-"): ord("_")})
714
1219
        self.dbus_object_path = (dbus.ObjectPath
715
 
                                 (u"/clients/"
716
 
                                  + self.name.replace(u".", u"_")))
 
1220
                                 ("/clients/" + client_object_name))
717
1221
        DBusObjectWithProperties.__init__(self, self.bus,
718
1222
                                          self.dbus_object_path)
719
 
        
720
 
    def _get_approvals_pending(self):
721
 
        return self._approvals_pending
722
 
    def _set_approvals_pending(self, value):
723
 
        old_value = self._approvals_pending
724
 
        self._approvals_pending = value
725
 
        bval = bool(value)
726
 
        if (hasattr(self, "dbus_object_path")
727
 
            and bval is not bool(old_value)):
728
 
            dbus_bool = dbus.Boolean(bval, variant_level=1)
729
 
            self.PropertyChanged(dbus.String(u"ApprovalPending"),
730
 
                                 dbus_bool)
731
 
 
732
 
    approvals_pending = property(_get_approvals_pending,
733
 
                                 _set_approvals_pending)
734
 
    del _get_approvals_pending, _set_approvals_pending
735
 
    
736
 
    @staticmethod
737
 
    def _datetime_to_dbus(dt, variant_level=0):
738
 
        """Convert a UTC datetime.datetime() to a D-Bus type."""
739
 
        return dbus.String(dt.isoformat(),
740
 
                           variant_level=variant_level)
741
 
    
742
 
    def enable(self):
743
 
        oldstate = getattr(self, u"enabled", False)
744
 
        r = Client.enable(self)
745
 
        if oldstate != self.enabled:
746
 
            # Emit D-Bus signals
747
 
            self.PropertyChanged(dbus.String(u"Enabled"),
748
 
                                 dbus.Boolean(True, variant_level=1))
749
 
            self.PropertyChanged(
750
 
                dbus.String(u"LastEnabled"),
751
 
                self._datetime_to_dbus(self.last_enabled,
752
 
                                       variant_level=1))
753
 
        return r
754
 
    
755
 
    def disable(self, quiet = False):
756
 
        oldstate = getattr(self, u"enabled", False)
757
 
        r = Client.disable(self, quiet=quiet)
758
 
        if not quiet and oldstate != self.enabled:
759
 
            # Emit D-Bus signal
760
 
            self.PropertyChanged(dbus.String(u"Enabled"),
761
 
                                 dbus.Boolean(False, variant_level=1))
762
 
        return r
 
1223
    
 
1224
    def notifychangeproperty(transform_func,
 
1225
                             dbus_name, type_func=lambda x: x,
 
1226
                             variant_level=1):
 
1227
        """ Modify a variable so that it's a property which announces
 
1228
        its changes to DBus.
 
1229
        
 
1230
        transform_fun: Function that takes a value and a variant_level
 
1231
                       and transforms it to a D-Bus type.
 
1232
        dbus_name: D-Bus name of the variable
 
1233
        type_func: Function that transform the value before sending it
 
1234
                   to the D-Bus.  Default: no transform
 
1235
        variant_level: D-Bus variant level.  Default: 1
 
1236
        """
 
1237
        attrname = "_{0}".format(dbus_name)
 
1238
        def setter(self, value):
 
1239
            if hasattr(self, "dbus_object_path"):
 
1240
                if (not hasattr(self, attrname) or
 
1241
                    type_func(getattr(self, attrname, None))
 
1242
                    != type_func(value)):
 
1243
                    dbus_value = transform_func(type_func(value),
 
1244
                                                variant_level
 
1245
                                                =variant_level)
 
1246
                    self.PropertyChanged(dbus.String(dbus_name),
 
1247
                                         dbus_value)
 
1248
            setattr(self, attrname, value)
 
1249
        
 
1250
        return property(lambda self: getattr(self, attrname), setter)
 
1251
    
 
1252
    expires = notifychangeproperty(datetime_to_dbus, "Expires")
 
1253
    approvals_pending = notifychangeproperty(dbus.Boolean,
 
1254
                                             "ApprovalPending",
 
1255
                                             type_func = bool)
 
1256
    enabled = notifychangeproperty(dbus.Boolean, "Enabled")
 
1257
    last_enabled = notifychangeproperty(datetime_to_dbus,
 
1258
                                        "LastEnabled")
 
1259
    checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",
 
1260
                                   type_func = lambda checker:
 
1261
                                       checker is not None)
 
1262
    last_checked_ok = notifychangeproperty(datetime_to_dbus,
 
1263
                                           "LastCheckedOK")
 
1264
    last_checker_status = notifychangeproperty(dbus.Int16,
 
1265
                                               "LastCheckerStatus")
 
1266
    last_approval_request = notifychangeproperty(
 
1267
        datetime_to_dbus, "LastApprovalRequest")
 
1268
    approved_by_default = notifychangeproperty(dbus.Boolean,
 
1269
                                               "ApprovedByDefault")
 
1270
    approval_delay = notifychangeproperty(dbus.UInt64,
 
1271
                                          "ApprovalDelay",
 
1272
                                          type_func =
 
1273
                                          timedelta_to_milliseconds)
 
1274
    approval_duration = notifychangeproperty(
 
1275
        dbus.UInt64, "ApprovalDuration",
 
1276
        type_func = timedelta_to_milliseconds)
 
1277
    host = notifychangeproperty(dbus.String, "Host")
 
1278
    timeout = notifychangeproperty(dbus.UInt64, "Timeout",
 
1279
                                   type_func =
 
1280
                                   timedelta_to_milliseconds)
 
1281
    extended_timeout = notifychangeproperty(
 
1282
        dbus.UInt64, "ExtendedTimeout",
 
1283
        type_func = timedelta_to_milliseconds)
 
1284
    interval = notifychangeproperty(dbus.UInt64,
 
1285
                                    "Interval",
 
1286
                                    type_func =
 
1287
                                    timedelta_to_milliseconds)
 
1288
    checker_command = notifychangeproperty(dbus.String, "Checker")
 
1289
    
 
1290
    del notifychangeproperty
763
1291
    
764
1292
    def __del__(self, *args, **kwargs):
765
1293
        try:
766
1294
            self.remove_from_connection()
767
1295
        except LookupError:
768
1296
            pass
769
 
        if hasattr(DBusObjectWithProperties, u"__del__"):
 
1297
        if hasattr(DBusObjectWithProperties, "__del__"):
770
1298
            DBusObjectWithProperties.__del__(self, *args, **kwargs)
771
1299
        Client.__del__(self, *args, **kwargs)
772
1300
    
774
1302
                         *args, **kwargs):
775
1303
        self.checker_callback_tag = None
776
1304
        self.checker = None
777
 
        # Emit D-Bus signal
778
 
        self.PropertyChanged(dbus.String(u"CheckerRunning"),
779
 
                             dbus.Boolean(False, variant_level=1))
780
1305
        if os.WIFEXITED(condition):
781
1306
            exitstatus = os.WEXITSTATUS(condition)
782
1307
            # Emit D-Bus signal
792
1317
        return Client.checker_callback(self, pid, condition, command,
793
1318
                                       *args, **kwargs)
794
1319
    
795
 
    def checked_ok(self, *args, **kwargs):
796
 
        r = Client.checked_ok(self, *args, **kwargs)
797
 
        # Emit D-Bus signal
798
 
        self.PropertyChanged(
799
 
            dbus.String(u"LastCheckedOK"),
800
 
            (self._datetime_to_dbus(self.last_checked_ok,
801
 
                                    variant_level=1)))
802
 
        return r
803
 
    
804
1320
    def start_checker(self, *args, **kwargs):
805
1321
        old_checker = self.checker
806
1322
        if self.checker is not None:
813
1329
            and old_checker_pid != self.checker.pid):
814
1330
            # Emit D-Bus signal
815
1331
            self.CheckerStarted(self.current_checker_command)
816
 
            self.PropertyChanged(
817
 
                dbus.String(u"CheckerRunning"),
818
 
                dbus.Boolean(True, variant_level=1))
819
1332
        return r
820
1333
    
821
 
    def stop_checker(self, *args, **kwargs):
822
 
        old_checker = getattr(self, u"checker", None)
823
 
        r = Client.stop_checker(self, *args, **kwargs)
824
 
        if (old_checker is not None
825
 
            and getattr(self, u"checker", None) is None):
826
 
            self.PropertyChanged(dbus.String(u"CheckerRunning"),
827
 
                                 dbus.Boolean(False, variant_level=1))
828
 
        return r
829
 
 
830
1334
    def _reset_approved(self):
831
 
        self._approved = None
 
1335
        self.approved = None
832
1336
        return False
833
1337
    
834
1338
    def approve(self, value=True):
835
 
        self.send_changedstate()
836
 
        self._approved = value
837
 
        gobject.timeout_add(self._timedelta_to_milliseconds
 
1339
        self.approved = value
 
1340
        gobject.timeout_add(timedelta_to_milliseconds
838
1341
                            (self.approval_duration),
839
1342
                            self._reset_approved)
840
 
    
 
1343
        self.send_changedstate()
841
1344
    
842
1345
    ## D-Bus methods, signals & properties
843
 
    _interface = u"se.bsnet.fukt.Mandos.Client"
 
1346
    _interface = "se.recompile.Mandos.Client"
 
1347
    
 
1348
    ## Interfaces
 
1349
    
 
1350
    @dbus_interface_annotations(_interface)
 
1351
    def _foo(self):
 
1352
        return { "org.freedesktop.DBus.Property.EmitsChangedSignal":
 
1353
                     "false"}
844
1354
    
845
1355
    ## Signals
846
1356
    
847
1357
    # CheckerCompleted - signal
848
 
    @dbus.service.signal(_interface, signature=u"nxs")
 
1358
    @dbus.service.signal(_interface, signature="nxs")
849
1359
    def CheckerCompleted(self, exitcode, waitstatus, command):
850
1360
        "D-Bus signal"
851
1361
        pass
852
1362
    
853
1363
    # CheckerStarted - signal
854
 
    @dbus.service.signal(_interface, signature=u"s")
 
1364
    @dbus.service.signal(_interface, signature="s")
855
1365
    def CheckerStarted(self, command):
856
1366
        "D-Bus signal"
857
1367
        pass
858
1368
    
859
1369
    # PropertyChanged - signal
860
 
    @dbus.service.signal(_interface, signature=u"sv")
 
1370
    @dbus.service.signal(_interface, signature="sv")
861
1371
    def PropertyChanged(self, property, value):
862
1372
        "D-Bus signal"
863
1373
        pass
872
1382
        pass
873
1383
    
874
1384
    # Rejected - signal
875
 
    @dbus.service.signal(_interface, signature=u"s")
 
1385
    @dbus.service.signal(_interface, signature="s")
876
1386
    def Rejected(self, reason):
877
1387
        "D-Bus signal"
878
1388
        pass
879
1389
    
880
1390
    # NeedApproval - signal
881
 
    @dbus.service.signal(_interface, signature=u"tb")
 
1391
    @dbus.service.signal(_interface, signature="tb")
882
1392
    def NeedApproval(self, timeout, default):
883
1393
        "D-Bus signal"
884
 
        pass
 
1394
        return self.need_approval()
885
1395
    
886
1396
    ## Methods
887
 
 
 
1397
    
888
1398
    # Approve - method
889
 
    @dbus.service.method(_interface, in_signature=u"b")
 
1399
    @dbus.service.method(_interface, in_signature="b")
890
1400
    def Approve(self, value):
891
1401
        self.approve(value)
892
 
 
 
1402
    
893
1403
    # CheckedOK - method
894
1404
    @dbus.service.method(_interface)
895
1405
    def CheckedOK(self):
896
 
        return self.checked_ok()
 
1406
        self.checked_ok()
897
1407
    
898
1408
    # Enable - method
899
1409
    @dbus.service.method(_interface)
921
1431
    ## Properties
922
1432
    
923
1433
    # ApprovalPending - property
924
 
    @dbus_service_property(_interface, signature=u"b", access=u"read")
 
1434
    @dbus_service_property(_interface, signature="b", access="read")
925
1435
    def ApprovalPending_dbus_property(self):
926
1436
        return dbus.Boolean(bool(self.approvals_pending))
927
1437
    
928
1438
    # ApprovedByDefault - property
929
 
    @dbus_service_property(_interface, signature=u"b",
930
 
                           access=u"readwrite")
 
1439
    @dbus_service_property(_interface, signature="b",
 
1440
                           access="readwrite")
931
1441
    def ApprovedByDefault_dbus_property(self, value=None):
932
1442
        if value is None:       # get
933
1443
            return dbus.Boolean(self.approved_by_default)
934
1444
        self.approved_by_default = bool(value)
935
 
        # Emit D-Bus signal
936
 
        self.PropertyChanged(dbus.String(u"ApprovedByDefault"),
937
 
                             dbus.Boolean(value, variant_level=1))
938
1445
    
939
1446
    # ApprovalDelay - property
940
 
    @dbus_service_property(_interface, signature=u"t",
941
 
                           access=u"readwrite")
 
1447
    @dbus_service_property(_interface, signature="t",
 
1448
                           access="readwrite")
942
1449
    def ApprovalDelay_dbus_property(self, value=None):
943
1450
        if value is None:       # get
944
1451
            return dbus.UInt64(self.approval_delay_milliseconds())
945
1452
        self.approval_delay = datetime.timedelta(0, 0, 0, value)
946
 
        # Emit D-Bus signal
947
 
        self.PropertyChanged(dbus.String(u"ApprovalDelay"),
948
 
                             dbus.UInt64(value, variant_level=1))
949
1453
    
950
1454
    # ApprovalDuration - property
951
 
    @dbus_service_property(_interface, signature=u"t",
952
 
                           access=u"readwrite")
 
1455
    @dbus_service_property(_interface, signature="t",
 
1456
                           access="readwrite")
953
1457
    def ApprovalDuration_dbus_property(self, value=None):
954
1458
        if value is None:       # get
955
 
            return dbus.UInt64(self._timedelta_to_milliseconds(
 
1459
            return dbus.UInt64(timedelta_to_milliseconds(
956
1460
                    self.approval_duration))
957
1461
        self.approval_duration = datetime.timedelta(0, 0, 0, value)
958
 
        # Emit D-Bus signal
959
 
        self.PropertyChanged(dbus.String(u"ApprovalDuration"),
960
 
                             dbus.UInt64(value, variant_level=1))
961
1462
    
962
1463
    # Name - property
963
 
    @dbus_service_property(_interface, signature=u"s", access=u"read")
 
1464
    @dbus_service_property(_interface, signature="s", access="read")
964
1465
    def Name_dbus_property(self):
965
1466
        return dbus.String(self.name)
966
1467
    
967
1468
    # Fingerprint - property
968
 
    @dbus_service_property(_interface, signature=u"s", access=u"read")
 
1469
    @dbus_service_property(_interface, signature="s", access="read")
969
1470
    def Fingerprint_dbus_property(self):
970
1471
        return dbus.String(self.fingerprint)
971
1472
    
972
1473
    # Host - property
973
 
    @dbus_service_property(_interface, signature=u"s",
974
 
                           access=u"readwrite")
 
1474
    @dbus_service_property(_interface, signature="s",
 
1475
                           access="readwrite")
975
1476
    def Host_dbus_property(self, value=None):
976
1477
        if value is None:       # get
977
1478
            return dbus.String(self.host)
978
 
        self.host = value
979
 
        # Emit D-Bus signal
980
 
        self.PropertyChanged(dbus.String(u"Host"),
981
 
                             dbus.String(value, variant_level=1))
 
1479
        self.host = unicode(value)
982
1480
    
983
1481
    # Created - property
984
 
    @dbus_service_property(_interface, signature=u"s", access=u"read")
 
1482
    @dbus_service_property(_interface, signature="s", access="read")
985
1483
    def Created_dbus_property(self):
986
 
        return dbus.String(self._datetime_to_dbus(self.created))
 
1484
        return datetime_to_dbus(self.created)
987
1485
    
988
1486
    # LastEnabled - property
989
 
    @dbus_service_property(_interface, signature=u"s", access=u"read")
 
1487
    @dbus_service_property(_interface, signature="s", access="read")
990
1488
    def LastEnabled_dbus_property(self):
991
 
        if self.last_enabled is None:
992
 
            return dbus.String(u"")
993
 
        return dbus.String(self._datetime_to_dbus(self.last_enabled))
 
1489
        return datetime_to_dbus(self.last_enabled)
994
1490
    
995
1491
    # Enabled - property
996
 
    @dbus_service_property(_interface, signature=u"b",
997
 
                           access=u"readwrite")
 
1492
    @dbus_service_property(_interface, signature="b",
 
1493
                           access="readwrite")
998
1494
    def Enabled_dbus_property(self, value=None):
999
1495
        if value is None:       # get
1000
1496
            return dbus.Boolean(self.enabled)
1004
1500
            self.disable()
1005
1501
    
1006
1502
    # LastCheckedOK - property
1007
 
    @dbus_service_property(_interface, signature=u"s",
1008
 
                           access=u"readwrite")
 
1503
    @dbus_service_property(_interface, signature="s",
 
1504
                           access="readwrite")
1009
1505
    def LastCheckedOK_dbus_property(self, value=None):
1010
1506
        if value is not None:
1011
1507
            self.checked_ok()
1012
1508
            return
1013
 
        if self.last_checked_ok is None:
1014
 
            return dbus.String(u"")
1015
 
        return dbus.String(self._datetime_to_dbus(self
1016
 
                                                  .last_checked_ok))
 
1509
        return datetime_to_dbus(self.last_checked_ok)
 
1510
    
 
1511
    # LastCheckerStatus - property
 
1512
    @dbus_service_property(_interface, signature="n",
 
1513
                           access="read")
 
1514
    def LastCheckerStatus_dbus_property(self):
 
1515
        return dbus.Int16(self.last_checker_status)
 
1516
    
 
1517
    # Expires - property
 
1518
    @dbus_service_property(_interface, signature="s", access="read")
 
1519
    def Expires_dbus_property(self):
 
1520
        return datetime_to_dbus(self.expires)
 
1521
    
 
1522
    # LastApprovalRequest - property
 
1523
    @dbus_service_property(_interface, signature="s", access="read")
 
1524
    def LastApprovalRequest_dbus_property(self):
 
1525
        return datetime_to_dbus(self.last_approval_request)
1017
1526
    
1018
1527
    # Timeout - property
1019
 
    @dbus_service_property(_interface, signature=u"t",
1020
 
                           access=u"readwrite")
 
1528
    @dbus_service_property(_interface, signature="t",
 
1529
                           access="readwrite")
1021
1530
    def Timeout_dbus_property(self, value=None):
1022
1531
        if value is None:       # get
1023
1532
            return dbus.UInt64(self.timeout_milliseconds())
 
1533
        old_timeout = self.timeout
1024
1534
        self.timeout = datetime.timedelta(0, 0, 0, value)
1025
 
        # Emit D-Bus signal
1026
 
        self.PropertyChanged(dbus.String(u"Timeout"),
1027
 
                             dbus.UInt64(value, variant_level=1))
1028
 
        if getattr(self, u"disable_initiator_tag", None) is None:
1029
 
            return
1030
 
        # Reschedule timeout
1031
 
        gobject.source_remove(self.disable_initiator_tag)
1032
 
        self.disable_initiator_tag = None
1033
 
        time_to_die = (self.
1034
 
                       _timedelta_to_milliseconds((self
1035
 
                                                   .last_checked_ok
1036
 
                                                   + self.timeout)
1037
 
                                                  - datetime.datetime
1038
 
                                                  .utcnow()))
1039
 
        if time_to_die <= 0:
1040
 
            # The timeout has passed
1041
 
            self.disable()
1042
 
        else:
1043
 
            self.disable_initiator_tag = (gobject.timeout_add
1044
 
                                          (time_to_die, self.disable))
 
1535
        # Reschedule disabling
 
1536
        if self.enabled:
 
1537
            now = datetime.datetime.utcnow()
 
1538
            self.expires += self.timeout - old_timeout
 
1539
            if self.expires <= now:
 
1540
                # The timeout has passed
 
1541
                self.disable()
 
1542
            else:
 
1543
                if (getattr(self, "disable_initiator_tag", None)
 
1544
                    is None):
 
1545
                    return
 
1546
                gobject.source_remove(self.disable_initiator_tag)
 
1547
                self.disable_initiator_tag = (
 
1548
                    gobject.timeout_add(
 
1549
                        timedelta_to_milliseconds(self.expires - now),
 
1550
                        self.disable))
 
1551
    
 
1552
    # ExtendedTimeout - property
 
1553
    @dbus_service_property(_interface, signature="t",
 
1554
                           access="readwrite")
 
1555
    def ExtendedTimeout_dbus_property(self, value=None):
 
1556
        if value is None:       # get
 
1557
            return dbus.UInt64(self.extended_timeout_milliseconds())
 
1558
        self.extended_timeout = datetime.timedelta(0, 0, 0, value)
1045
1559
    
1046
1560
    # Interval - property
1047
 
    @dbus_service_property(_interface, signature=u"t",
1048
 
                           access=u"readwrite")
 
1561
    @dbus_service_property(_interface, signature="t",
 
1562
                           access="readwrite")
1049
1563
    def Interval_dbus_property(self, value=None):
1050
1564
        if value is None:       # get
1051
1565
            return dbus.UInt64(self.interval_milliseconds())
1052
1566
        self.interval = datetime.timedelta(0, 0, 0, value)
1053
 
        # Emit D-Bus signal
1054
 
        self.PropertyChanged(dbus.String(u"Interval"),
1055
 
                             dbus.UInt64(value, variant_level=1))
1056
 
        if getattr(self, u"checker_initiator_tag", None) is None:
 
1567
        if getattr(self, "checker_initiator_tag", None) is None:
1057
1568
            return
1058
 
        # Reschedule checker run
1059
 
        gobject.source_remove(self.checker_initiator_tag)
1060
 
        self.checker_initiator_tag = (gobject.timeout_add
1061
 
                                      (value, self.start_checker))
1062
 
        self.start_checker()    # Start one now, too
1063
 
 
 
1569
        if self.enabled:
 
1570
            # Reschedule checker run
 
1571
            gobject.source_remove(self.checker_initiator_tag)
 
1572
            self.checker_initiator_tag = (gobject.timeout_add
 
1573
                                          (value, self.start_checker))
 
1574
            self.start_checker()    # Start one now, too
 
1575
    
1064
1576
    # Checker - property
1065
 
    @dbus_service_property(_interface, signature=u"s",
1066
 
                           access=u"readwrite")
 
1577
    @dbus_service_property(_interface, signature="s",
 
1578
                           access="readwrite")
1067
1579
    def Checker_dbus_property(self, value=None):
1068
1580
        if value is None:       # get
1069
1581
            return dbus.String(self.checker_command)
1070
 
        self.checker_command = value
1071
 
        # Emit D-Bus signal
1072
 
        self.PropertyChanged(dbus.String(u"Checker"),
1073
 
                             dbus.String(self.checker_command,
1074
 
                                         variant_level=1))
 
1582
        self.checker_command = unicode(value)
1075
1583
    
1076
1584
    # CheckerRunning - property
1077
 
    @dbus_service_property(_interface, signature=u"b",
1078
 
                           access=u"readwrite")
 
1585
    @dbus_service_property(_interface, signature="b",
 
1586
                           access="readwrite")
1079
1587
    def CheckerRunning_dbus_property(self, value=None):
1080
1588
        if value is None:       # get
1081
1589
            return dbus.Boolean(self.checker is not None)
1085
1593
            self.stop_checker()
1086
1594
    
1087
1595
    # ObjectPath - property
1088
 
    @dbus_service_property(_interface, signature=u"o", access=u"read")
 
1596
    @dbus_service_property(_interface, signature="o", access="read")
1089
1597
    def ObjectPath_dbus_property(self):
1090
1598
        return self.dbus_object_path # is already a dbus.ObjectPath
1091
1599
    
1092
1600
    # Secret = property
1093
 
    @dbus_service_property(_interface, signature=u"ay",
1094
 
                           access=u"write", byte_arrays=True)
 
1601
    @dbus_service_property(_interface, signature="ay",
 
1602
                           access="write", byte_arrays=True)
1095
1603
    def Secret_dbus_property(self, value):
1096
1604
        self.secret = str(value)
1097
1605
    
1104
1612
        self._pipe.send(('init', fpr, address))
1105
1613
        if not self._pipe.recv():
1106
1614
            raise KeyError()
1107
 
 
 
1615
    
1108
1616
    def __getattribute__(self, name):
1109
 
        if(name == '_pipe'):
 
1617
        if name == '_pipe':
1110
1618
            return super(ProxyClient, self).__getattribute__(name)
1111
1619
        self._pipe.send(('getattr', name))
1112
1620
        data = self._pipe.recv()
1117
1625
                self._pipe.send(('funcall', name, args, kwargs))
1118
1626
                return self._pipe.recv()[1]
1119
1627
            return func
1120
 
 
 
1628
    
1121
1629
    def __setattr__(self, name, value):
1122
 
        if(name == '_pipe'):
 
1630
        if name == '_pipe':
1123
1631
            return super(ProxyClient, self).__setattr__(name, value)
1124
1632
        self._pipe.send(('setattr', name, value))
1125
1633
 
1132
1640
    
1133
1641
    def handle(self):
1134
1642
        with contextlib.closing(self.server.child_pipe) as child_pipe:
1135
 
            logger.info(u"TCP connection from: %s",
 
1643
            logger.info("TCP connection from: %s",
1136
1644
                        unicode(self.client_address))
1137
 
            logger.debug(u"Pipe FD: %d",
 
1645
            logger.debug("Pipe FD: %d",
1138
1646
                         self.server.child_pipe.fileno())
1139
 
 
 
1647
            
1140
1648
            session = (gnutls.connection
1141
1649
                       .ClientSession(self.request,
1142
1650
                                      gnutls.connection
1143
1651
                                      .X509Credentials()))
1144
 
 
 
1652
            
1145
1653
            # Note: gnutls.connection.X509Credentials is really a
1146
1654
            # generic GnuTLS certificate credentials object so long as
1147
1655
            # no X.509 keys are added to it.  Therefore, we can use it
1148
1656
            # here despite using OpenPGP certificates.
1149
 
 
1150
 
            #priority = u':'.join((u"NONE", u"+VERS-TLS1.1",
1151
 
            #                      u"+AES-256-CBC", u"+SHA1",
1152
 
            #                      u"+COMP-NULL", u"+CTYPE-OPENPGP",
1153
 
            #                      u"+DHE-DSS"))
 
1657
            
 
1658
            #priority = ':'.join(("NONE", "+VERS-TLS1.1",
 
1659
            #                      "+AES-256-CBC", "+SHA1",
 
1660
            #                      "+COMP-NULL", "+CTYPE-OPENPGP",
 
1661
            #                      "+DHE-DSS"))
1154
1662
            # Use a fallback default, since this MUST be set.
1155
1663
            priority = self.server.gnutls_priority
1156
1664
            if priority is None:
1157
 
                priority = u"NORMAL"
 
1665
                priority = "NORMAL"
1158
1666
            (gnutls.library.functions
1159
1667
             .gnutls_priority_set_direct(session._c_object,
1160
1668
                                         priority, None))
1161
 
 
 
1669
            
1162
1670
            # Start communication using the Mandos protocol
1163
1671
            # Get protocol number
1164
1672
            line = self.request.makefile().readline()
1165
 
            logger.debug(u"Protocol version: %r", line)
 
1673
            logger.debug("Protocol version: %r", line)
1166
1674
            try:
1167
1675
                if int(line.strip().split()[0]) > 1:
1168
1676
                    raise RuntimeError
1169
 
            except (ValueError, IndexError, RuntimeError), error:
1170
 
                logger.error(u"Unknown protocol version: %s", error)
 
1677
            except (ValueError, IndexError, RuntimeError) as error:
 
1678
                logger.error("Unknown protocol version: %s", error)
1171
1679
                return
1172
 
 
 
1680
            
1173
1681
            # Start GnuTLS connection
1174
1682
            try:
1175
1683
                session.handshake()
1176
 
            except gnutls.errors.GNUTLSError, error:
1177
 
                logger.warning(u"Handshake failed: %s", error)
 
1684
            except gnutls.errors.GNUTLSError as error:
 
1685
                logger.warning("Handshake failed: %s", error)
1178
1686
                # Do not run session.bye() here: the session is not
1179
1687
                # established.  Just abandon the request.
1180
1688
                return
1181
 
            logger.debug(u"Handshake succeeded")
1182
 
 
 
1689
            logger.debug("Handshake succeeded")
 
1690
            
1183
1691
            approval_required = False
1184
1692
            try:
1185
1693
                try:
1186
1694
                    fpr = self.fingerprint(self.peer_certificate
1187
1695
                                           (session))
1188
 
                except (TypeError, gnutls.errors.GNUTLSError), error:
1189
 
                    logger.warning(u"Bad certificate: %s", error)
 
1696
                except (TypeError,
 
1697
                        gnutls.errors.GNUTLSError) as error:
 
1698
                    logger.warning("Bad certificate: %s", error)
1190
1699
                    return
1191
 
                logger.debug(u"Fingerprint: %s", fpr)
1192
 
 
 
1700
                logger.debug("Fingerprint: %s", fpr)
 
1701
                
1193
1702
                try:
1194
1703
                    client = ProxyClient(child_pipe, fpr,
1195
1704
                                         self.client_address)
1203
1712
                
1204
1713
                while True:
1205
1714
                    if not client.enabled:
1206
 
                        logger.warning(u"Client %s is disabled",
 
1715
                        logger.info("Client %s is disabled",
1207
1716
                                       client.name)
1208
1717
                        if self.server.use_dbus:
1209
1718
                            # Emit D-Bus signal
1210
 
                            client.Rejected("Disabled")                    
 
1719
                            client.Rejected("Disabled")
1211
1720
                        return
1212
1721
                    
1213
 
                    if client._approved or not client.approval_delay:
 
1722
                    if client.approved or not client.approval_delay:
1214
1723
                        #We are approved or approval is disabled
1215
1724
                        break
1216
 
                    elif client._approved is None:
1217
 
                        logger.info(u"Client %s needs approval",
 
1725
                    elif client.approved is None:
 
1726
                        logger.info("Client %s needs approval",
1218
1727
                                    client.name)
1219
1728
                        if self.server.use_dbus:
1220
1729
                            # Emit D-Bus signal
1222
1731
                                client.approval_delay_milliseconds(),
1223
1732
                                client.approved_by_default)
1224
1733
                    else:
1225
 
                        logger.warning(u"Client %s was not approved",
 
1734
                        logger.warning("Client %s was not approved",
1226
1735
                                       client.name)
1227
1736
                        if self.server.use_dbus:
1228
1737
                            # Emit D-Bus signal
1230
1739
                        return
1231
1740
                    
1232
1741
                    #wait until timeout or approved
1233
 
                    #x = float(client._timedelta_to_milliseconds(delay))
1234
1742
                    time = datetime.datetime.now()
1235
1743
                    client.changedstate.acquire()
1236
 
                    client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))
 
1744
                    client.changedstate.wait(
 
1745
                        float(timedelta_to_milliseconds(delay)
 
1746
                              / 1000))
1237
1747
                    client.changedstate.release()
1238
1748
                    time2 = datetime.datetime.now()
1239
1749
                    if (time2 - time) >= delay:
1254
1764
                while sent_size < len(client.secret):
1255
1765
                    try:
1256
1766
                        sent = session.send(client.secret[sent_size:])
1257
 
                    except (gnutls.errors.GNUTLSError), error:
1258
 
                        logger.warning("gnutls send failed")
 
1767
                    except gnutls.errors.GNUTLSError as error:
 
1768
                        logger.warning("gnutls send failed",
 
1769
                                       exc_info=error)
1259
1770
                        return
1260
 
                    logger.debug(u"Sent: %d, remaining: %d",
 
1771
                    logger.debug("Sent: %d, remaining: %d",
1261
1772
                                 sent, len(client.secret)
1262
1773
                                 - (sent_size + sent))
1263
1774
                    sent_size += sent
1264
 
 
1265
 
                logger.info(u"Sending secret to %s", client.name)
1266
 
                # bump the timeout as if seen
1267
 
                client.checked_ok()
 
1775
                
 
1776
                logger.info("Sending secret to %s", client.name)
 
1777
                # bump the timeout using extended_timeout
 
1778
                client.bump_timeout(client.extended_timeout)
1268
1779
                if self.server.use_dbus:
1269
1780
                    # Emit D-Bus signal
1270
1781
                    client.GotSecret()
1274
1785
                    client.approvals_pending -= 1
1275
1786
                try:
1276
1787
                    session.bye()
1277
 
                except (gnutls.errors.GNUTLSError), error:
1278
 
                    logger.warning("GnuTLS bye failed")
 
1788
                except gnutls.errors.GNUTLSError as error:
 
1789
                    logger.warning("GnuTLS bye failed",
 
1790
                                   exc_info=error)
1279
1791
    
1280
1792
    @staticmethod
1281
1793
    def peer_certificate(session):
1291
1803
                     .gnutls_certificate_get_peers
1292
1804
                     (session._c_object, ctypes.byref(list_size)))
1293
1805
        if not bool(cert_list) and list_size.value != 0:
1294
 
            raise gnutls.errors.GNUTLSError(u"error getting peer"
1295
 
                                            u" certificate")
 
1806
            raise gnutls.errors.GNUTLSError("error getting peer"
 
1807
                                            " certificate")
1296
1808
        if list_size.value == 0:
1297
1809
            return None
1298
1810
        cert = cert_list[0]
1324
1836
        if crtverify.value != 0:
1325
1837
            gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1326
1838
            raise (gnutls.errors.CertificateSecurityError
1327
 
                   (u"Verify failed"))
 
1839
                   ("Verify failed"))
1328
1840
        # New buffer for the fingerprint
1329
1841
        buf = ctypes.create_string_buffer(20)
1330
1842
        buf_len = ctypes.c_size_t()
1337
1849
        # Convert the buffer to a Python bytestring
1338
1850
        fpr = ctypes.string_at(buf, buf_len.value)
1339
1851
        # Convert the bytestring to hexadecimal notation
1340
 
        hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
 
1852
        hex_fpr = binascii.hexlify(fpr).upper()
1341
1853
        return hex_fpr
1342
1854
 
1343
1855
 
1346
1858
    def sub_process_main(self, request, address):
1347
1859
        try:
1348
1860
            self.finish_request(request, address)
1349
 
        except:
 
1861
        except Exception:
1350
1862
            self.handle_error(request, address)
1351
1863
        self.close_request(request)
1352
 
            
 
1864
    
1353
1865
    def process_request(self, request, address):
1354
1866
        """Start a new process to process the request."""
1355
 
        multiprocessing.Process(target = self.sub_process_main,
1356
 
                                args = (request, address)).start()
 
1867
        proc = multiprocessing.Process(target = self.sub_process_main,
 
1868
                                       args = (request, address))
 
1869
        proc.start()
 
1870
        return proc
 
1871
 
1357
1872
 
1358
1873
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
1359
1874
    """ adds a pipe to the MixIn """
1363
1878
        This function creates a new pipe in self.pipe
1364
1879
        """
1365
1880
        parent_pipe, self.child_pipe = multiprocessing.Pipe()
1366
 
 
1367
 
        super(MultiprocessingMixInWithPipe,
1368
 
              self).process_request(request, client_address)
 
1881
        
 
1882
        proc = MultiprocessingMixIn.process_request(self, request,
 
1883
                                                    client_address)
1369
1884
        self.child_pipe.close()
1370
 
        self.add_pipe(parent_pipe)
1371
 
 
1372
 
    def add_pipe(self, parent_pipe):
 
1885
        self.add_pipe(parent_pipe, proc)
 
1886
    
 
1887
    def add_pipe(self, parent_pipe, proc):
1373
1888
        """Dummy function; override as necessary"""
1374
 
        pass
 
1889
        raise NotImplementedError
 
1890
 
1375
1891
 
1376
1892
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
1377
1893
                     socketserver.TCPServer, object):
1395
1911
        bind to an address or port if they were not specified."""
1396
1912
        if self.interface is not None:
1397
1913
            if SO_BINDTODEVICE is None:
1398
 
                logger.error(u"SO_BINDTODEVICE does not exist;"
1399
 
                             u" cannot bind to interface %s",
 
1914
                logger.error("SO_BINDTODEVICE does not exist;"
 
1915
                             " cannot bind to interface %s",
1400
1916
                             self.interface)
1401
1917
            else:
1402
1918
                try:
1403
1919
                    self.socket.setsockopt(socket.SOL_SOCKET,
1404
1920
                                           SO_BINDTODEVICE,
1405
1921
                                           str(self.interface
1406
 
                                               + u'\0'))
1407
 
                except socket.error, error:
1408
 
                    if error[0] == errno.EPERM:
1409
 
                        logger.error(u"No permission to"
1410
 
                                     u" bind to interface %s",
1411
 
                                     self.interface)
1412
 
                    elif error[0] == errno.ENOPROTOOPT:
1413
 
                        logger.error(u"SO_BINDTODEVICE not available;"
1414
 
                                     u" cannot bind to interface %s",
 
1922
                                               + '\0'))
 
1923
                except socket.error as error:
 
1924
                    if error.errno == errno.EPERM:
 
1925
                        logger.error("No permission to"
 
1926
                                     " bind to interface %s",
 
1927
                                     self.interface)
 
1928
                    elif error.errno == errno.ENOPROTOOPT:
 
1929
                        logger.error("SO_BINDTODEVICE not available;"
 
1930
                                     " cannot bind to interface %s",
 
1931
                                     self.interface)
 
1932
                    elif error.errno == errno.ENODEV:
 
1933
                        logger.error("Interface %s does not"
 
1934
                                     " exist, cannot bind",
1415
1935
                                     self.interface)
1416
1936
                    else:
1417
1937
                        raise
1419
1939
        if self.server_address[0] or self.server_address[1]:
1420
1940
            if not self.server_address[0]:
1421
1941
                if self.address_family == socket.AF_INET6:
1422
 
                    any_address = u"::" # in6addr_any
 
1942
                    any_address = "::" # in6addr_any
1423
1943
                else:
1424
1944
                    any_address = socket.INADDR_ANY
1425
1945
                self.server_address = (any_address,
1452
1972
        self.enabled = False
1453
1973
        self.clients = clients
1454
1974
        if self.clients is None:
1455
 
            self.clients = set()
 
1975
            self.clients = {}
1456
1976
        self.use_dbus = use_dbus
1457
1977
        self.gnutls_priority = gnutls_priority
1458
1978
        IPv6_TCPServer.__init__(self, server_address,
1462
1982
    def server_activate(self):
1463
1983
        if self.enabled:
1464
1984
            return socketserver.TCPServer.server_activate(self)
 
1985
    
1465
1986
    def enable(self):
1466
1987
        self.enabled = True
1467
 
    def add_pipe(self, parent_pipe):
 
1988
    
 
1989
    def add_pipe(self, parent_pipe, proc):
1468
1990
        # Call "handle_ipc" for both data and EOF events
1469
1991
        gobject.io_add_watch(parent_pipe.fileno(),
1470
1992
                             gobject.IO_IN | gobject.IO_HUP,
1471
1993
                             functools.partial(self.handle_ipc,
1472
 
                                               parent_pipe = parent_pipe))
1473
 
        
 
1994
                                               parent_pipe =
 
1995
                                               parent_pipe,
 
1996
                                               proc = proc))
 
1997
    
1474
1998
    def handle_ipc(self, source, condition, parent_pipe=None,
1475
 
                   client_object=None):
1476
 
        condition_names = {
1477
 
            gobject.IO_IN: u"IN",   # There is data to read.
1478
 
            gobject.IO_OUT: u"OUT", # Data can be written (without
1479
 
                                    # blocking).
1480
 
            gobject.IO_PRI: u"PRI", # There is urgent data to read.
1481
 
            gobject.IO_ERR: u"ERR", # Error condition.
1482
 
            gobject.IO_HUP: u"HUP"  # Hung up (the connection has been
1483
 
                                    # broken, usually for pipes and
1484
 
                                    # sockets).
1485
 
            }
1486
 
        conditions_string = ' | '.join(name
1487
 
                                       for cond, name in
1488
 
                                       condition_names.iteritems()
1489
 
                                       if cond & condition)
1490
 
        # error or the other end of multiprocessing.Pipe has closed
1491
 
        if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):
 
1999
                   proc = None, client_object=None):
 
2000
        # error, or the other end of multiprocessing.Pipe has closed
 
2001
        if condition & (gobject.IO_ERR | gobject.IO_HUP):
 
2002
            # Wait for other process to exit
 
2003
            proc.join()
1492
2004
            return False
1493
2005
        
1494
2006
        # Read a request from the child
1499
2011
            fpr = request[1]
1500
2012
            address = request[2]
1501
2013
            
1502
 
            for c in self.clients:
 
2014
            for c in self.clients.itervalues():
1503
2015
                if c.fingerprint == fpr:
1504
2016
                    client = c
1505
2017
                    break
1506
2018
            else:
1507
 
                logger.warning(u"Client not found for fingerprint: %s, ad"
1508
 
                               u"dress: %s", fpr, address)
 
2019
                logger.info("Client not found for fingerprint: %s, ad"
 
2020
                            "dress: %s", fpr, address)
1509
2021
                if self.use_dbus:
1510
2022
                    # Emit D-Bus signal
1511
 
                    mandos_dbus_service.ClientNotFound(fpr, address)
 
2023
                    mandos_dbus_service.ClientNotFound(fpr,
 
2024
                                                       address[0])
1512
2025
                parent_pipe.send(False)
1513
2026
                return False
1514
2027
            
1515
2028
            gobject.io_add_watch(parent_pipe.fileno(),
1516
2029
                                 gobject.IO_IN | gobject.IO_HUP,
1517
2030
                                 functools.partial(self.handle_ipc,
1518
 
                                                   parent_pipe = parent_pipe,
1519
 
                                                   client_object = client))
 
2031
                                                   parent_pipe =
 
2032
                                                   parent_pipe,
 
2033
                                                   proc = proc,
 
2034
                                                   client_object =
 
2035
                                                   client))
1520
2036
            parent_pipe.send(True)
1521
 
            # remove the old hook in favor of the new above hook on same fileno
 
2037
            # remove the old hook in favor of the new above hook on
 
2038
            # same fileno
1522
2039
            return False
1523
2040
        if command == 'funcall':
1524
2041
            funcname = request[1]
1525
2042
            args = request[2]
1526
2043
            kwargs = request[3]
1527
2044
            
1528
 
            parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))
1529
 
 
 
2045
            parent_pipe.send(('data', getattr(client_object,
 
2046
                                              funcname)(*args,
 
2047
                                                         **kwargs)))
 
2048
        
1530
2049
        if command == 'getattr':
1531
2050
            attrname = request[1]
1532
2051
            if callable(client_object.__getattribute__(attrname)):
1533
2052
                parent_pipe.send(('function',))
1534
2053
            else:
1535
 
                parent_pipe.send(('data', client_object.__getattribute__(attrname)))
 
2054
                parent_pipe.send(('data', client_object
 
2055
                                  .__getattribute__(attrname)))
1536
2056
        
1537
2057
        if command == 'setattr':
1538
2058
            attrname = request[1]
1539
2059
            value = request[2]
1540
2060
            setattr(client_object, attrname, value)
1541
 
 
 
2061
        
1542
2062
        return True
1543
2063
 
1544
2064
 
1545
2065
def string_to_delta(interval):
1546
2066
    """Parse a string and return a datetime.timedelta
1547
2067
    
1548
 
    >>> string_to_delta(u'7d')
 
2068
    >>> string_to_delta('7d')
1549
2069
    datetime.timedelta(7)
1550
 
    >>> string_to_delta(u'60s')
 
2070
    >>> string_to_delta('60s')
1551
2071
    datetime.timedelta(0, 60)
1552
 
    >>> string_to_delta(u'60m')
 
2072
    >>> string_to_delta('60m')
1553
2073
    datetime.timedelta(0, 3600)
1554
 
    >>> string_to_delta(u'24h')
 
2074
    >>> string_to_delta('24h')
1555
2075
    datetime.timedelta(1)
1556
 
    >>> string_to_delta(u'1w')
 
2076
    >>> string_to_delta('1w')
1557
2077
    datetime.timedelta(7)
1558
 
    >>> string_to_delta(u'5m 30s')
 
2078
    >>> string_to_delta('5m 30s')
1559
2079
    datetime.timedelta(0, 330)
1560
2080
    """
1561
2081
    timevalue = datetime.timedelta(0)
1563
2083
        try:
1564
2084
            suffix = unicode(s[-1])
1565
2085
            value = int(s[:-1])
1566
 
            if suffix == u"d":
 
2086
            if suffix == "d":
1567
2087
                delta = datetime.timedelta(value)
1568
 
            elif suffix == u"s":
 
2088
            elif suffix == "s":
1569
2089
                delta = datetime.timedelta(0, value)
1570
 
            elif suffix == u"m":
 
2090
            elif suffix == "m":
1571
2091
                delta = datetime.timedelta(0, 0, 0, 0, value)
1572
 
            elif suffix == u"h":
 
2092
            elif suffix == "h":
1573
2093
                delta = datetime.timedelta(0, 0, 0, 0, 0, value)
1574
 
            elif suffix == u"w":
 
2094
            elif suffix == "w":
1575
2095
                delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
1576
2096
            else:
1577
 
                raise ValueError(u"Unknown suffix %r" % suffix)
1578
 
        except (ValueError, IndexError), e:
1579
 
            raise ValueError(e.message)
 
2097
                raise ValueError("Unknown suffix {0!r}"
 
2098
                                 .format(suffix))
 
2099
        except (ValueError, IndexError) as e:
 
2100
            raise ValueError(*(e.args))
1580
2101
        timevalue += delta
1581
2102
    return timevalue
1582
2103
 
1583
2104
 
1584
 
def if_nametoindex(interface):
1585
 
    """Call the C function if_nametoindex(), or equivalent
1586
 
    
1587
 
    Note: This function cannot accept a unicode string."""
1588
 
    global if_nametoindex
1589
 
    try:
1590
 
        if_nametoindex = (ctypes.cdll.LoadLibrary
1591
 
                          (ctypes.util.find_library(u"c"))
1592
 
                          .if_nametoindex)
1593
 
    except (OSError, AttributeError):
1594
 
        logger.warning(u"Doing if_nametoindex the hard way")
1595
 
        def if_nametoindex(interface):
1596
 
            "Get an interface index the hard way, i.e. using fcntl()"
1597
 
            SIOCGIFINDEX = 0x8933  # From /usr/include/linux/sockios.h
1598
 
            with contextlib.closing(socket.socket()) as s:
1599
 
                ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
1600
 
                                    struct.pack(str(u"16s16x"),
1601
 
                                                interface))
1602
 
            interface_index = struct.unpack(str(u"I"),
1603
 
                                            ifreq[16:20])[0]
1604
 
            return interface_index
1605
 
    return if_nametoindex(interface)
1606
 
 
1607
 
 
1608
2105
def daemon(nochdir = False, noclose = False):
1609
2106
    """See daemon(3).  Standard BSD Unix function.
1610
2107
    
1613
2110
        sys.exit()
1614
2111
    os.setsid()
1615
2112
    if not nochdir:
1616
 
        os.chdir(u"/")
 
2113
        os.chdir("/")
1617
2114
    if os.fork():
1618
2115
        sys.exit()
1619
2116
    if not noclose:
1620
2117
        # Close all standard open file descriptors
1621
 
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
 
2118
        null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
1622
2119
        if not stat.S_ISCHR(os.fstat(null).st_mode):
1623
2120
            raise OSError(errno.ENODEV,
1624
 
                          u"%s not a character device"
1625
 
                          % os.path.devnull)
 
2121
                          "{0} not a character device"
 
2122
                          .format(os.devnull))
1626
2123
        os.dup2(null, sys.stdin.fileno())
1627
2124
        os.dup2(null, sys.stdout.fileno())
1628
2125
        os.dup2(null, sys.stderr.fileno())
1635
2132
    ##################################################################
1636
2133
    # Parsing of options, both command line and config file
1637
2134
    
1638
 
    parser = optparse.OptionParser(version = "%%prog %s" % version)
1639
 
    parser.add_option("-i", u"--interface", type=u"string",
1640
 
                      metavar="IF", help=u"Bind to interface IF")
1641
 
    parser.add_option("-a", u"--address", type=u"string",
1642
 
                      help=u"Address to listen for requests on")
1643
 
    parser.add_option("-p", u"--port", type=u"int",
1644
 
                      help=u"Port number to receive requests on")
1645
 
    parser.add_option("--check", action=u"store_true",
1646
 
                      help=u"Run self-test")
1647
 
    parser.add_option("--debug", action=u"store_true",
1648
 
                      help=u"Debug mode; run in foreground and log to"
1649
 
                      u" terminal")
1650
 
    parser.add_option("--debuglevel", type=u"string", metavar="Level",
1651
 
                      help=u"Debug level for stdout output")
1652
 
    parser.add_option("--priority", type=u"string", help=u"GnuTLS"
1653
 
                      u" priority string (see GnuTLS documentation)")
1654
 
    parser.add_option("--servicename", type=u"string",
1655
 
                      metavar=u"NAME", help=u"Zeroconf service name")
1656
 
    parser.add_option("--configdir", type=u"string",
1657
 
                      default=u"/etc/mandos", metavar=u"DIR",
1658
 
                      help=u"Directory to search for configuration"
1659
 
                      u" files")
1660
 
    parser.add_option("--no-dbus", action=u"store_false",
1661
 
                      dest=u"use_dbus", help=u"Do not provide D-Bus"
1662
 
                      u" system bus interface")
1663
 
    parser.add_option("--no-ipv6", action=u"store_false",
1664
 
                      dest=u"use_ipv6", help=u"Do not use IPv6")
1665
 
    options = parser.parse_args()[0]
 
2135
    parser = argparse.ArgumentParser()
 
2136
    parser.add_argument("-v", "--version", action="version",
 
2137
                        version = "%(prog)s {0}".format(version),
 
2138
                        help="show version number and exit")
 
2139
    parser.add_argument("-i", "--interface", metavar="IF",
 
2140
                        help="Bind to interface IF")
 
2141
    parser.add_argument("-a", "--address",
 
2142
                        help="Address to listen for requests on")
 
2143
    parser.add_argument("-p", "--port", type=int,
 
2144
                        help="Port number to receive requests on")
 
2145
    parser.add_argument("--check", action="store_true",
 
2146
                        help="Run self-test")
 
2147
    parser.add_argument("--debug", action="store_true",
 
2148
                        help="Debug mode; run in foreground and log"
 
2149
                        " to terminal")
 
2150
    parser.add_argument("--debuglevel", metavar="LEVEL",
 
2151
                        help="Debug level for stdout output")
 
2152
    parser.add_argument("--priority", help="GnuTLS"
 
2153
                        " priority string (see GnuTLS documentation)")
 
2154
    parser.add_argument("--servicename",
 
2155
                        metavar="NAME", help="Zeroconf service name")
 
2156
    parser.add_argument("--configdir",
 
2157
                        default="/etc/mandos", metavar="DIR",
 
2158
                        help="Directory to search for configuration"
 
2159
                        " files")
 
2160
    parser.add_argument("--no-dbus", action="store_false",
 
2161
                        dest="use_dbus", help="Do not provide D-Bus"
 
2162
                        " system bus interface")
 
2163
    parser.add_argument("--no-ipv6", action="store_false",
 
2164
                        dest="use_ipv6", help="Do not use IPv6")
 
2165
    parser.add_argument("--no-restore", action="store_false",
 
2166
                        dest="restore", help="Do not restore stored"
 
2167
                        " state")
 
2168
    parser.add_argument("--statedir", metavar="DIR",
 
2169
                        help="Directory to save/restore state in")
 
2170
    
 
2171
    options = parser.parse_args()
1666
2172
    
1667
2173
    if options.check:
1668
2174
        import doctest
1670
2176
        sys.exit()
1671
2177
    
1672
2178
    # Default values for config file for server-global settings
1673
 
    server_defaults = { u"interface": u"",
1674
 
                        u"address": u"",
1675
 
                        u"port": u"",
1676
 
                        u"debug": u"False",
1677
 
                        u"priority":
1678
 
                        u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
1679
 
                        u"servicename": u"Mandos",
1680
 
                        u"use_dbus": u"True",
1681
 
                        u"use_ipv6": u"True",
1682
 
                        u"debuglevel": u"",
 
2179
    server_defaults = { "interface": "",
 
2180
                        "address": "",
 
2181
                        "port": "",
 
2182
                        "debug": "False",
 
2183
                        "priority":
 
2184
                        "SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
 
2185
                        "servicename": "Mandos",
 
2186
                        "use_dbus": "True",
 
2187
                        "use_ipv6": "True",
 
2188
                        "debuglevel": "",
 
2189
                        "restore": "True",
 
2190
                        "statedir": "/var/lib/mandos"
1683
2191
                        }
1684
2192
    
1685
2193
    # Parse config file for server-global settings
1686
2194
    server_config = configparser.SafeConfigParser(server_defaults)
1687
2195
    del server_defaults
1688
2196
    server_config.read(os.path.join(options.configdir,
1689
 
                                    u"mandos.conf"))
 
2197
                                    "mandos.conf"))
1690
2198
    # Convert the SafeConfigParser object to a dict
1691
2199
    server_settings = server_config.defaults()
1692
2200
    # Use the appropriate methods on the non-string config options
1693
 
    for option in (u"debug", u"use_dbus", u"use_ipv6"):
1694
 
        server_settings[option] = server_config.getboolean(u"DEFAULT",
 
2201
    for option in ("debug", "use_dbus", "use_ipv6"):
 
2202
        server_settings[option] = server_config.getboolean("DEFAULT",
1695
2203
                                                           option)
1696
2204
    if server_settings["port"]:
1697
 
        server_settings["port"] = server_config.getint(u"DEFAULT",
1698
 
                                                       u"port")
 
2205
        server_settings["port"] = server_config.getint("DEFAULT",
 
2206
                                                       "port")
1699
2207
    del server_config
1700
2208
    
1701
2209
    # Override the settings from the config file with command line
1702
2210
    # options, if set.
1703
 
    for option in (u"interface", u"address", u"port", u"debug",
1704
 
                   u"priority", u"servicename", u"configdir",
1705
 
                   u"use_dbus", u"use_ipv6", u"debuglevel"):
 
2211
    for option in ("interface", "address", "port", "debug",
 
2212
                   "priority", "servicename", "configdir",
 
2213
                   "use_dbus", "use_ipv6", "debuglevel", "restore",
 
2214
                   "statedir"):
1706
2215
        value = getattr(options, option)
1707
2216
        if value is not None:
1708
2217
            server_settings[option] = value
1716
2225
    ##################################################################
1717
2226
    
1718
2227
    # For convenience
1719
 
    debug = server_settings[u"debug"]
1720
 
    debuglevel = server_settings[u"debuglevel"]
1721
 
    use_dbus = server_settings[u"use_dbus"]
1722
 
    use_ipv6 = server_settings[u"use_ipv6"]
1723
 
 
1724
 
    if server_settings[u"servicename"] != u"Mandos":
 
2228
    debug = server_settings["debug"]
 
2229
    debuglevel = server_settings["debuglevel"]
 
2230
    use_dbus = server_settings["use_dbus"]
 
2231
    use_ipv6 = server_settings["use_ipv6"]
 
2232
    stored_state_path = os.path.join(server_settings["statedir"],
 
2233
                                     stored_state_file)
 
2234
    
 
2235
    if debug:
 
2236
        initlogger(debug, logging.DEBUG)
 
2237
    else:
 
2238
        if not debuglevel:
 
2239
            initlogger(debug)
 
2240
        else:
 
2241
            level = getattr(logging, debuglevel.upper())
 
2242
            initlogger(debug, level)
 
2243
    
 
2244
    if server_settings["servicename"] != "Mandos":
1725
2245
        syslogger.setFormatter(logging.Formatter
1726
 
                               (u'Mandos (%s) [%%(process)d]:'
1727
 
                                u' %%(levelname)s: %%(message)s'
1728
 
                                % server_settings[u"servicename"]))
 
2246
                               ('Mandos ({0}) [%(process)d]:'
 
2247
                                ' %(levelname)s: %(message)s'
 
2248
                                .format(server_settings
 
2249
                                        ["servicename"])))
1729
2250
    
1730
2251
    # Parse config file with clients
1731
 
    client_defaults = { u"timeout": u"1h",
1732
 
                        u"interval": u"5m",
1733
 
                        u"checker": u"fping -q -- %%(host)s",
1734
 
                        u"host": u"",
1735
 
                        u"approval_delay": u"0s",
1736
 
                        u"approval_duration": u"1s",
1737
 
                        }
1738
 
    client_config = configparser.SafeConfigParser(client_defaults)
1739
 
    client_config.read(os.path.join(server_settings[u"configdir"],
1740
 
                                    u"clients.conf"))
 
2252
    client_config = configparser.SafeConfigParser(Client
 
2253
                                                  .client_defaults)
 
2254
    client_config.read(os.path.join(server_settings["configdir"],
 
2255
                                    "clients.conf"))
1741
2256
    
1742
2257
    global mandos_dbus_service
1743
2258
    mandos_dbus_service = None
1744
2259
    
1745
 
    tcp_server = MandosServer((server_settings[u"address"],
1746
 
                               server_settings[u"port"]),
 
2260
    tcp_server = MandosServer((server_settings["address"],
 
2261
                               server_settings["port"]),
1747
2262
                              ClientHandler,
1748
 
                              interface=(server_settings[u"interface"]
 
2263
                              interface=(server_settings["interface"]
1749
2264
                                         or None),
1750
2265
                              use_ipv6=use_ipv6,
1751
2266
                              gnutls_priority=
1752
 
                              server_settings[u"priority"],
 
2267
                              server_settings["priority"],
1753
2268
                              use_dbus=use_dbus)
1754
 
    pidfilename = u"/var/run/mandos.pid"
1755
 
    try:
1756
 
        pidfile = open(pidfilename, u"w")
1757
 
    except IOError:
1758
 
        logger.error(u"Could not open file %r", pidfilename)
 
2269
    if not debug:
 
2270
        pidfilename = "/var/run/mandos.pid"
 
2271
        try:
 
2272
            pidfile = open(pidfilename, "w")
 
2273
        except IOError as e:
 
2274
            logger.error("Could not open file %r", pidfilename,
 
2275
                         exc_info=e)
1759
2276
    
1760
 
    try:
1761
 
        uid = pwd.getpwnam(u"_mandos").pw_uid
1762
 
        gid = pwd.getpwnam(u"_mandos").pw_gid
1763
 
    except KeyError:
 
2277
    for name in ("_mandos", "mandos", "nobody"):
1764
2278
        try:
1765
 
            uid = pwd.getpwnam(u"mandos").pw_uid
1766
 
            gid = pwd.getpwnam(u"mandos").pw_gid
 
2279
            uid = pwd.getpwnam(name).pw_uid
 
2280
            gid = pwd.getpwnam(name).pw_gid
 
2281
            break
1767
2282
        except KeyError:
1768
 
            try:
1769
 
                uid = pwd.getpwnam(u"nobody").pw_uid
1770
 
                gid = pwd.getpwnam(u"nobody").pw_gid
1771
 
            except KeyError:
1772
 
                uid = 65534
1773
 
                gid = 65534
 
2283
            continue
 
2284
    else:
 
2285
        uid = 65534
 
2286
        gid = 65534
1774
2287
    try:
1775
2288
        os.setgid(gid)
1776
2289
        os.setuid(uid)
1777
 
    except OSError, error:
1778
 
        if error[0] != errno.EPERM:
 
2290
    except OSError as error:
 
2291
        if error.errno != errno.EPERM:
1779
2292
            raise error
1780
2293
    
1781
 
    if not debug and not debuglevel:
1782
 
        syslogger.setLevel(logging.WARNING)
1783
 
        console.setLevel(logging.WARNING)
1784
 
    if debuglevel:
1785
 
        level = getattr(logging, debuglevel.upper())
1786
 
        syslogger.setLevel(level)
1787
 
        console.setLevel(level)
1788
 
 
1789
2294
    if debug:
1790
2295
        # Enable all possible GnuTLS debugging
1791
2296
        
1795
2300
        
1796
2301
        @gnutls.library.types.gnutls_log_func
1797
2302
        def debug_gnutls(level, string):
1798
 
            logger.debug(u"GnuTLS: %s", string[:-1])
 
2303
            logger.debug("GnuTLS: %s", string[:-1])
1799
2304
        
1800
2305
        (gnutls.library.functions
1801
2306
         .gnutls_global_set_log_function(debug_gnutls))
1802
2307
        
1803
2308
        # Redirect stdin so all checkers get /dev/null
1804
 
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
 
2309
        null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
1805
2310
        os.dup2(null, sys.stdin.fileno())
1806
2311
        if null > 2:
1807
2312
            os.close(null)
1808
 
    else:
1809
 
        # No console logging
1810
 
        logger.removeHandler(console)
1811
 
    
 
2313
    
 
2314
    # Need to fork before connecting to D-Bus
 
2315
    if not debug:
 
2316
        # Close all input and output, do double fork, etc.
 
2317
        daemon()
 
2318
    
 
2319
    gobject.threads_init()
1812
2320
    
1813
2321
    global main_loop
1814
2322
    # From the Avahi example code
1815
 
    DBusGMainLoop(set_as_default=True )
 
2323
    DBusGMainLoop(set_as_default=True)
1816
2324
    main_loop = gobject.MainLoop()
1817
2325
    bus = dbus.SystemBus()
1818
2326
    # End of Avahi example code
1819
2327
    if use_dbus:
1820
2328
        try:
1821
 
            bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos",
 
2329
            bus_name = dbus.service.BusName("se.recompile.Mandos",
1822
2330
                                            bus, do_not_queue=True)
1823
 
        except dbus.exceptions.NameExistsException, e:
1824
 
            logger.error(unicode(e) + u", disabling D-Bus")
 
2331
            old_bus_name = (dbus.service.BusName
 
2332
                            ("se.bsnet.fukt.Mandos", bus,
 
2333
                             do_not_queue=True))
 
2334
        except dbus.exceptions.NameExistsException as e:
 
2335
            logger.error("Disabling D-Bus:", exc_info=e)
1825
2336
            use_dbus = False
1826
 
            server_settings[u"use_dbus"] = False
 
2337
            server_settings["use_dbus"] = False
1827
2338
            tcp_server.use_dbus = False
1828
2339
    protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
1829
 
    service = AvahiService(name = server_settings[u"servicename"],
1830
 
                           servicetype = u"_mandos._tcp",
1831
 
                           protocol = protocol, bus = bus)
 
2340
    service = AvahiServiceToSyslog(name =
 
2341
                                   server_settings["servicename"],
 
2342
                                   servicetype = "_mandos._tcp",
 
2343
                                   protocol = protocol, bus = bus)
1832
2344
    if server_settings["interface"]:
1833
2345
        service.interface = (if_nametoindex
1834
 
                             (str(server_settings[u"interface"])))
1835
 
 
1836
 
    if not debug:
1837
 
        # Close all input and output, do double fork, etc.
1838
 
        daemon()
1839
 
        
 
2346
                             (str(server_settings["interface"])))
 
2347
    
1840
2348
    global multiprocessing_manager
1841
2349
    multiprocessing_manager = multiprocessing.Manager()
1842
2350
    
1843
2351
    client_class = Client
1844
2352
    if use_dbus:
1845
2353
        client_class = functools.partial(ClientDBus, bus = bus)
1846
 
    def client_config_items(config, section):
1847
 
        special_settings = {
1848
 
            "approved_by_default":
1849
 
                lambda: config.getboolean(section,
1850
 
                                          "approved_by_default"),
1851
 
            }
1852
 
        for name, value in config.items(section):
 
2354
    
 
2355
    client_settings = Client.config_parser(client_config)
 
2356
    old_client_settings = {}
 
2357
    clients_data = {}
 
2358
    
 
2359
    # Get client data and settings from last running state.
 
2360
    if server_settings["restore"]:
 
2361
        try:
 
2362
            with open(stored_state_path, "rb") as stored_state:
 
2363
                clients_data, old_client_settings = (pickle.load
 
2364
                                                     (stored_state))
 
2365
            os.remove(stored_state_path)
 
2366
        except IOError as e:
 
2367
            if e.errno == errno.ENOENT:
 
2368
                logger.warning("Could not load persistent state: {0}"
 
2369
                                .format(os.strerror(e.errno)))
 
2370
            else:
 
2371
                logger.critical("Could not load persistent state:",
 
2372
                                exc_info=e)
 
2373
                raise
 
2374
        except EOFError as e:
 
2375
            logger.warning("Could not load persistent state: "
 
2376
                           "EOFError:", exc_info=e)
 
2377
    
 
2378
    with PGPEngine() as pgp:
 
2379
        for client_name, client in clients_data.iteritems():
 
2380
            # Decide which value to use after restoring saved state.
 
2381
            # We have three different values: Old config file,
 
2382
            # new config file, and saved state.
 
2383
            # New config value takes precedence if it differs from old
 
2384
            # config value, otherwise use saved state.
 
2385
            for name, value in client_settings[client_name].items():
 
2386
                try:
 
2387
                    # For each value in new config, check if it
 
2388
                    # differs from the old config value (Except for
 
2389
                    # the "secret" attribute)
 
2390
                    if (name != "secret" and
 
2391
                        value != old_client_settings[client_name]
 
2392
                        [name]):
 
2393
                        client[name] = value
 
2394
                except KeyError:
 
2395
                    pass
 
2396
            
 
2397
            # Clients who has passed its expire date can still be
 
2398
            # enabled if its last checker was successful.  Clients
 
2399
            # whose checker succeeded before we stored its state is
 
2400
            # assumed to have successfully run all checkers during
 
2401
            # downtime.
 
2402
            if client["enabled"]:
 
2403
                if datetime.datetime.utcnow() >= client["expires"]:
 
2404
                    if not client["last_checked_ok"]:
 
2405
                        logger.warning(
 
2406
                            "disabling client {0} - Client never "
 
2407
                            "performed a successful checker"
 
2408
                            .format(client_name))
 
2409
                        client["enabled"] = False
 
2410
                    elif client["last_checker_status"] != 0:
 
2411
                        logger.warning(
 
2412
                            "disabling client {0} - Client "
 
2413
                            "last checker failed with error code {1}"
 
2414
                            .format(client_name,
 
2415
                                    client["last_checker_status"]))
 
2416
                        client["enabled"] = False
 
2417
                    else:
 
2418
                        client["expires"] = (datetime.datetime
 
2419
                                             .utcnow()
 
2420
                                             + client["timeout"])
 
2421
                        logger.debug("Last checker succeeded,"
 
2422
                                     " keeping {0} enabled"
 
2423
                                     .format(client_name))
1853
2424
            try:
1854
 
                yield (name, special_settings[name]())
1855
 
            except KeyError:
1856
 
                yield (name, value)
1857
 
    
1858
 
    tcp_server.clients.update(set(
1859
 
            client_class(name = section,
1860
 
                         config= dict(client_config_items(
1861
 
                        client_config, section)))
1862
 
            for section in client_config.sections()))
 
2425
                client["secret"] = (
 
2426
                    pgp.decrypt(client["encrypted_secret"],
 
2427
                                client_settings[client_name]
 
2428
                                ["secret"]))
 
2429
            except PGPError:
 
2430
                # If decryption fails, we use secret from new settings
 
2431
                logger.debug("Failed to decrypt {0} old secret"
 
2432
                             .format(client_name))
 
2433
                client["secret"] = (
 
2434
                    client_settings[client_name]["secret"])
 
2435
    
 
2436
    # Add/remove clients based on new changes made to config
 
2437
    for client_name in (set(old_client_settings)
 
2438
                        - set(client_settings)):
 
2439
        del clients_data[client_name]
 
2440
    for client_name in (set(client_settings)
 
2441
                        - set(old_client_settings)):
 
2442
        clients_data[client_name] = client_settings[client_name]
 
2443
    
 
2444
    # Create all client objects
 
2445
    for client_name, client in clients_data.iteritems():
 
2446
        tcp_server.clients[client_name] = client_class(
 
2447
            name = client_name, settings = client)
 
2448
    
1863
2449
    if not tcp_server.clients:
1864
 
        logger.warning(u"No clients defined")
1865
 
        
1866
 
    try:
1867
 
        with pidfile:
1868
 
            pid = os.getpid()
1869
 
            pidfile.write(str(pid) + "\n")
1870
 
        del pidfile
1871
 
    except IOError:
1872
 
        logger.error(u"Could not write to file %r with PID %d",
1873
 
                     pidfilename, pid)
1874
 
    except NameError:
1875
 
        # "pidfile" was never created
1876
 
        pass
1877
 
    del pidfilename
 
2450
        logger.warning("No clients defined")
1878
2451
    
1879
2452
    if not debug:
1880
 
        signal.signal(signal.SIGINT, signal.SIG_IGN)
 
2453
        try:
 
2454
            with pidfile:
 
2455
                pid = os.getpid()
 
2456
                pidfile.write(str(pid) + "\n".encode("utf-8"))
 
2457
            del pidfile
 
2458
        except IOError:
 
2459
            logger.error("Could not write to file %r with PID %d",
 
2460
                         pidfilename, pid)
 
2461
        except NameError:
 
2462
            # "pidfile" was never created
 
2463
            pass
 
2464
        del pidfilename
 
2465
    
1881
2466
    signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
1882
2467
    signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
1883
2468
    
1884
2469
    if use_dbus:
1885
 
        class MandosDBusService(dbus.service.Object):
 
2470
        @alternate_dbus_interfaces({"se.recompile.Mandos":
 
2471
                                        "se.bsnet.fukt.Mandos"})
 
2472
        class MandosDBusService(DBusObjectWithProperties):
1886
2473
            """A D-Bus proxy object"""
1887
2474
            def __init__(self):
1888
 
                dbus.service.Object.__init__(self, bus, u"/")
1889
 
            _interface = u"se.bsnet.fukt.Mandos"
1890
 
            
1891
 
            @dbus.service.signal(_interface, signature=u"o")
 
2475
                dbus.service.Object.__init__(self, bus, "/")
 
2476
            _interface = "se.recompile.Mandos"
 
2477
            
 
2478
            @dbus_interface_annotations(_interface)
 
2479
            def _foo(self):
 
2480
                return { "org.freedesktop.DBus.Property"
 
2481
                         ".EmitsChangedSignal":
 
2482
                             "false"}
 
2483
            
 
2484
            @dbus.service.signal(_interface, signature="o")
1892
2485
            def ClientAdded(self, objpath):
1893
2486
                "D-Bus signal"
1894
2487
                pass
1895
2488
            
1896
 
            @dbus.service.signal(_interface, signature=u"ss")
 
2489
            @dbus.service.signal(_interface, signature="ss")
1897
2490
            def ClientNotFound(self, fingerprint, address):
1898
2491
                "D-Bus signal"
1899
2492
                pass
1900
2493
            
1901
 
            @dbus.service.signal(_interface, signature=u"os")
 
2494
            @dbus.service.signal(_interface, signature="os")
1902
2495
            def ClientRemoved(self, objpath, name):
1903
2496
                "D-Bus signal"
1904
2497
                pass
1905
2498
            
1906
 
            @dbus.service.method(_interface, out_signature=u"ao")
 
2499
            @dbus.service.method(_interface, out_signature="ao")
1907
2500
            def GetAllClients(self):
1908
2501
                "D-Bus method"
1909
2502
                return dbus.Array(c.dbus_object_path
1910
 
                                  for c in tcp_server.clients)
 
2503
                                  for c in
 
2504
                                  tcp_server.clients.itervalues())
1911
2505
            
1912
2506
            @dbus.service.method(_interface,
1913
 
                                 out_signature=u"a{oa{sv}}")
 
2507
                                 out_signature="a{oa{sv}}")
1914
2508
            def GetAllClientsWithProperties(self):
1915
2509
                "D-Bus method"
1916
2510
                return dbus.Dictionary(
1917
 
                    ((c.dbus_object_path, c.GetAll(u""))
1918
 
                     for c in tcp_server.clients),
1919
 
                    signature=u"oa{sv}")
 
2511
                    ((c.dbus_object_path, c.GetAll(""))
 
2512
                     for c in tcp_server.clients.itervalues()),
 
2513
                    signature="oa{sv}")
1920
2514
            
1921
 
            @dbus.service.method(_interface, in_signature=u"o")
 
2515
            @dbus.service.method(_interface, in_signature="o")
1922
2516
            def RemoveClient(self, object_path):
1923
2517
                "D-Bus method"
1924
 
                for c in tcp_server.clients:
 
2518
                for c in tcp_server.clients.itervalues():
1925
2519
                    if c.dbus_object_path == object_path:
1926
 
                        tcp_server.clients.remove(c)
 
2520
                        del tcp_server.clients[c.name]
1927
2521
                        c.remove_from_connection()
1928
2522
                        # Don't signal anything except ClientRemoved
1929
2523
                        c.disable(quiet=True)
1940
2534
        "Cleanup function; run on exit"
1941
2535
        service.cleanup()
1942
2536
        
 
2537
        multiprocessing.active_children()
 
2538
        if not (tcp_server.clients or client_settings):
 
2539
            return
 
2540
        
 
2541
        # Store client before exiting. Secrets are encrypted with key
 
2542
        # based on what config file has. If config file is
 
2543
        # removed/edited, old secret will thus be unrecovable.
 
2544
        clients = {}
 
2545
        with PGPEngine() as pgp:
 
2546
            for client in tcp_server.clients.itervalues():
 
2547
                key = client_settings[client.name]["secret"]
 
2548
                client.encrypted_secret = pgp.encrypt(client.secret,
 
2549
                                                      key)
 
2550
                client_dict = {}
 
2551
                
 
2552
                # A list of attributes that can not be pickled
 
2553
                # + secret.
 
2554
                exclude = set(("bus", "changedstate", "secret",
 
2555
                               "checker"))
 
2556
                for name, typ in (inspect.getmembers
 
2557
                                  (dbus.service.Object)):
 
2558
                    exclude.add(name)
 
2559
                
 
2560
                client_dict["encrypted_secret"] = (client
 
2561
                                                   .encrypted_secret)
 
2562
                for attr in client.client_structure:
 
2563
                    if attr not in exclude:
 
2564
                        client_dict[attr] = getattr(client, attr)
 
2565
                
 
2566
                clients[client.name] = client_dict
 
2567
                del client_settings[client.name]["secret"]
 
2568
        
 
2569
        try:
 
2570
            with (tempfile.NamedTemporaryFile
 
2571
                  (mode='wb', suffix=".pickle", prefix='clients-',
 
2572
                   dir=os.path.dirname(stored_state_path),
 
2573
                   delete=False)) as stored_state:
 
2574
                pickle.dump((clients, client_settings), stored_state)
 
2575
                tempname=stored_state.name
 
2576
            os.rename(tempname, stored_state_path)
 
2577
        except (IOError, OSError) as e:
 
2578
            if not debug:
 
2579
                try:
 
2580
                    os.remove(tempname)
 
2581
                except NameError:
 
2582
                    pass
 
2583
            if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
 
2584
                logger.warning("Could not save persistent state: {0}"
 
2585
                               .format(os.strerror(e.errno)))
 
2586
            else:
 
2587
                logger.warning("Could not save persistent state:",
 
2588
                               exc_info=e)
 
2589
                raise e
 
2590
        
 
2591
        # Delete all clients, and settings from config
1943
2592
        while tcp_server.clients:
1944
 
            client = tcp_server.clients.pop()
 
2593
            name, client = tcp_server.clients.popitem()
1945
2594
            if use_dbus:
1946
2595
                client.remove_from_connection()
1947
 
            client.disable_hook = None
1948
2596
            # Don't signal anything except ClientRemoved
1949
2597
            client.disable(quiet=True)
1950
2598
            if use_dbus:
1951
2599
                # Emit D-Bus signal
1952
 
                mandos_dbus_service.ClientRemoved(client.dbus_object_path,
 
2600
                mandos_dbus_service.ClientRemoved(client
 
2601
                                                  .dbus_object_path,
1953
2602
                                                  client.name)
 
2603
        client_settings.clear()
1954
2604
    
1955
2605
    atexit.register(cleanup)
1956
2606
    
1957
 
    for client in tcp_server.clients:
 
2607
    for client in tcp_server.clients.itervalues():
1958
2608
        if use_dbus:
1959
2609
            # Emit D-Bus signal
1960
2610
            mandos_dbus_service.ClientAdded(client.dbus_object_path)
1961
 
        client.enable()
 
2611
        # Need to initiate checking of clients
 
2612
        if client.enabled:
 
2613
            client.init_checker()
1962
2614
    
1963
2615
    tcp_server.enable()
1964
2616
    tcp_server.server_activate()
1966
2618
    # Find out what port we got
1967
2619
    service.port = tcp_server.socket.getsockname()[1]
1968
2620
    if use_ipv6:
1969
 
        logger.info(u"Now listening on address %r, port %d,"
1970
 
                    " flowinfo %d, scope_id %d"
1971
 
                    % tcp_server.socket.getsockname())
 
2621
        logger.info("Now listening on address %r, port %d,"
 
2622
                    " flowinfo %d, scope_id %d",
 
2623
                    *tcp_server.socket.getsockname())
1972
2624
    else:                       # IPv4
1973
 
        logger.info(u"Now listening on address %r, port %d"
1974
 
                    % tcp_server.socket.getsockname())
 
2625
        logger.info("Now listening on address %r, port %d",
 
2626
                    *tcp_server.socket.getsockname())
1975
2627
    
1976
2628
    #service.interface = tcp_server.socket.getsockname()[3]
1977
2629
    
1979
2631
        # From the Avahi example code
1980
2632
        try:
1981
2633
            service.activate()
1982
 
        except dbus.exceptions.DBusException, error:
1983
 
            logger.critical(u"DBusException: %s", error)
 
2634
        except dbus.exceptions.DBusException as error:
 
2635
            logger.critical("D-Bus Exception", exc_info=error)
1984
2636
            cleanup()
1985
2637
            sys.exit(1)
1986
2638
        # End of Avahi example code
1990
2642
                             (tcp_server.handle_request
1991
2643
                              (*args[2:], **kwargs) or True))
1992
2644
        
1993
 
        logger.debug(u"Starting main loop")
 
2645
        logger.debug("Starting main loop")
1994
2646
        main_loop.run()
1995
 
    except AvahiError, error:
1996
 
        logger.critical(u"AvahiError: %s", error)
 
2647
    except AvahiError as error:
 
2648
        logger.critical("Avahi Error", exc_info=error)
1997
2649
        cleanup()
1998
2650
        sys.exit(1)
1999
2651
    except KeyboardInterrupt:
2000
2652
        if debug:
2001
 
            print >> sys.stderr
2002
 
        logger.debug(u"Server received KeyboardInterrupt")
2003
 
    logger.debug(u"Server exiting")
 
2653
            print("", file=sys.stderr)
 
2654
        logger.debug("Server received KeyboardInterrupt")
 
2655
    logger.debug("Server exiting")
2004
2656
    # Must run before the D-Bus bus name gets deregistered
2005
2657
    cleanup()
2006
2658