/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos

  • Committer: Björn Påhlsson
  • Date: 2011-06-23 22:27:15 UTC
  • mto: This revision was merged to the branch mainline in revision 485.
  • Revision ID: belorn@fukt.bsnet.se-20110623222715-q5wro9ma9iyjl367
* Makefile (CFLAGS): Added "-lrt" to include real time library.
* plugins.d/mandos-client.c: use scandir(3) instead of readdir(3)
                             Prefix all debug output with "Mandos plugin " + program_invocation_short_name
                             Retry servers that failed to provide password.
                             New option --retry SECONDS that sets the interval between rechecking.
                             --retry also controls how often it retries a server when using --connect.
* plugins.d/splashy.c:  Prefix all debug output with "Mandos plugin " + program_invocation_short_name
* plugins.d/usplash.c: --||--
* plugins.d/askpass-fifo.c: --||--
* plugins.d/password-prompt.c: --||--
* plugins.d/plymouth.c: --||--
* mandos: Lower logger level from warning to info on failed client requests because client was disabled or unknown fingerprint.
* plugins.d/plymouth.c (get_pid): bug fix. Was not calling free on direntries. 

Show diffs side-by-side

added added

removed removed

Lines of Context:
11
11
# "AvahiService" class, and some lines in "main".
12
12
13
13
# Everything else is
14
 
# Copyright © 2008-2012 Teddy Hogeborn
15
 
# Copyright © 2008-2012 Björn Påhlsson
 
14
# Copyright © 2008-2011 Teddy Hogeborn
 
15
# Copyright © 2008-2011 Björn Påhlsson
16
16
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
28
28
# along with this program.  If not, see
29
29
# <http://www.gnu.org/licenses/>.
30
30
31
 
# Contact the authors at <mandos@recompile.se>.
 
31
# Contact the authors at <mandos@fukt.bsnet.se>.
32
32
33
33
 
34
34
from __future__ import (division, absolute_import, print_function,
35
35
                        unicode_literals)
36
36
 
37
 
from future_builtins import *
38
 
 
39
37
import SocketServer as socketserver
40
38
import socket
41
39
import argparse
64
62
import functools
65
63
import cPickle as pickle
66
64
import multiprocessing
67
 
import types
68
 
import binascii
69
 
import tempfile
70
 
import itertools
71
 
import collections
72
65
 
73
66
import dbus
74
67
import dbus.service
88
81
    except ImportError:
89
82
        SO_BINDTODEVICE = None
90
83
 
91
 
version = "1.6.0"
92
 
stored_state_file = "clients.pickle"
93
 
 
94
 
logger = logging.getLogger()
 
84
 
 
85
version = "1.3.0"
 
86
 
 
87
#logger = logging.getLogger('mandos')
 
88
logger = logging.Logger('mandos')
95
89
syslogger = (logging.handlers.SysLogHandler
96
90
             (facility = logging.handlers.SysLogHandler.LOG_DAEMON,
97
91
              address = str("/dev/log")))
98
 
 
99
 
try:
100
 
    if_nametoindex = (ctypes.cdll.LoadLibrary
101
 
                      (ctypes.util.find_library("c"))
102
 
                      .if_nametoindex)
103
 
except (OSError, AttributeError):
104
 
    def if_nametoindex(interface):
105
 
        "Get an interface index the hard way, i.e. using fcntl()"
106
 
        SIOCGIFINDEX = 0x8933  # From /usr/include/linux/sockios.h
107
 
        with contextlib.closing(socket.socket()) as s:
108
 
            ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
109
 
                                struct.pack(str("16s16x"),
110
 
                                            interface))
111
 
        interface_index = struct.unpack(str("I"),
112
 
                                        ifreq[16:20])[0]
113
 
        return interface_index
114
 
 
115
 
 
116
 
def initlogger(debug, level=logging.WARNING):
117
 
    """init logger and add loglevel"""
118
 
    
119
 
    syslogger.setFormatter(logging.Formatter
120
 
                           ('Mandos [%(process)d]: %(levelname)s:'
121
 
                            ' %(message)s'))
122
 
    logger.addHandler(syslogger)
123
 
    
124
 
    if debug:
125
 
        console = logging.StreamHandler()
126
 
        console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
127
 
                                               ' [%(process)d]:'
128
 
                                               ' %(levelname)s:'
129
 
                                               ' %(message)s'))
130
 
        logger.addHandler(console)
131
 
    logger.setLevel(level)
132
 
 
133
 
 
134
 
class PGPError(Exception):
135
 
    """Exception if encryption/decryption fails"""
136
 
    pass
137
 
 
138
 
 
139
 
class PGPEngine(object):
140
 
    """A simple class for OpenPGP symmetric encryption & decryption"""
141
 
    def __init__(self):
142
 
        self.tempdir = tempfile.mkdtemp(prefix="mandos-")
143
 
        self.gnupgargs = ['--batch',
144
 
                          '--home', self.tempdir,
145
 
                          '--force-mdc',
146
 
                          '--quiet',
147
 
                          '--no-use-agent']
148
 
    
149
 
    def __enter__(self):
150
 
        return self
151
 
    
152
 
    def __exit__(self, exc_type, exc_value, traceback):
153
 
        self._cleanup()
154
 
        return False
155
 
    
156
 
    def __del__(self):
157
 
        self._cleanup()
158
 
    
159
 
    def _cleanup(self):
160
 
        if self.tempdir is not None:
161
 
            # Delete contents of tempdir
162
 
            for root, dirs, files in os.walk(self.tempdir,
163
 
                                             topdown = False):
164
 
                for filename in files:
165
 
                    os.remove(os.path.join(root, filename))
166
 
                for dirname in dirs:
167
 
                    os.rmdir(os.path.join(root, dirname))
168
 
            # Remove tempdir
169
 
            os.rmdir(self.tempdir)
170
 
            self.tempdir = None
171
 
    
172
 
    def password_encode(self, password):
173
 
        # Passphrase can not be empty and can not contain newlines or
174
 
        # NUL bytes.  So we prefix it and hex encode it.
175
 
        return b"mandos" + binascii.hexlify(password)
176
 
    
177
 
    def encrypt(self, data, password):
178
 
        passphrase = self.password_encode(password)
179
 
        with tempfile.NamedTemporaryFile(dir=self.tempdir
180
 
                                         ) as passfile:
181
 
            passfile.write(passphrase)
182
 
            passfile.flush()
183
 
            proc = subprocess.Popen(['gpg', '--symmetric',
184
 
                                     '--passphrase-file',
185
 
                                     passfile.name]
186
 
                                    + self.gnupgargs,
187
 
                                    stdin = subprocess.PIPE,
188
 
                                    stdout = subprocess.PIPE,
189
 
                                    stderr = subprocess.PIPE)
190
 
            ciphertext, err = proc.communicate(input = data)
191
 
        if proc.returncode != 0:
192
 
            raise PGPError(err)
193
 
        return ciphertext
194
 
    
195
 
    def decrypt(self, data, password):
196
 
        passphrase = self.password_encode(password)
197
 
        with tempfile.NamedTemporaryFile(dir = self.tempdir
198
 
                                         ) as passfile:
199
 
            passfile.write(passphrase)
200
 
            passfile.flush()
201
 
            proc = subprocess.Popen(['gpg', '--decrypt',
202
 
                                     '--passphrase-file',
203
 
                                     passfile.name]
204
 
                                    + self.gnupgargs,
205
 
                                    stdin = subprocess.PIPE,
206
 
                                    stdout = subprocess.PIPE,
207
 
                                    stderr = subprocess.PIPE)
208
 
            decrypted_plaintext, err = proc.communicate(input
209
 
                                                        = data)
210
 
        if proc.returncode != 0:
211
 
            raise PGPError(err)
212
 
        return decrypted_plaintext
213
 
 
 
92
syslogger.setFormatter(logging.Formatter
 
93
                       ('Mandos [%(process)d]: %(levelname)s:'
 
94
                        ' %(message)s'))
 
95
logger.addHandler(syslogger)
 
96
 
 
97
console = logging.StreamHandler()
 
98
console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'
 
99
                                       ' %(levelname)s:'
 
100
                                       ' %(message)s'))
 
101
logger.addHandler(console)
214
102
 
215
103
class AvahiError(Exception):
216
104
    def __init__(self, value, *args, **kwargs):
234
122
               Used to optionally bind to the specified interface.
235
123
    name: string; Example: 'Mandos'
236
124
    type: string; Example: '_mandos._tcp'.
237
 
     See <https://www.iana.org/assignments/service-names-port-numbers>
 
125
                  See <http://www.dns-sd.org/ServiceTypes.html>
238
126
    port: integer; what port to announce
239
127
    TXT: list of strings; TXT record for the service
240
128
    domain: string; Domain to publish on, default to .local if empty.
246
134
    server: D-Bus Server
247
135
    bus: dbus.SystemBus()
248
136
    """
249
 
    
250
137
    def __init__(self, interface = avahi.IF_UNSPEC, name = None,
251
138
                 servicetype = None, port = None, TXT = None,
252
139
                 domain = "", host = "", max_renames = 32768,
265
152
        self.server = None
266
153
        self.bus = bus
267
154
        self.entry_group_state_changed_match = None
268
 
    
269
155
    def rename(self):
270
156
        """Derived from the Avahi example code"""
271
157
        if self.rename_count >= self.max_renames:
273
159
                            " after %i retries, exiting.",
274
160
                            self.rename_count)
275
161
            raise AvahiServiceError("Too many renames")
276
 
        self.name = unicode(self.server
277
 
                            .GetAlternativeServiceName(self.name))
 
162
        self.name = unicode(self.server.GetAlternativeServiceName(self.name))
278
163
        logger.info("Changing Zeroconf service name to %r ...",
279
164
                    self.name)
 
165
        syslogger.setFormatter(logging.Formatter
 
166
                               ('Mandos (%s) [%%(process)d]:'
 
167
                                ' %%(levelname)s: %%(message)s'
 
168
                                % self.name))
280
169
        self.remove()
281
170
        try:
282
171
            self.add()
283
172
        except dbus.exceptions.DBusException as error:
284
 
            logger.critical("D-Bus Exception", exc_info=error)
 
173
            logger.critical("DBusException: %s", error)
285
174
            self.cleanup()
286
175
            os._exit(1)
287
176
        self.rename_count += 1
288
 
    
289
177
    def remove(self):
290
178
        """Derived from the Avahi example code"""
291
179
        if self.entry_group_state_changed_match is not None:
293
181
            self.entry_group_state_changed_match = None
294
182
        if self.group is not None:
295
183
            self.group.Reset()
296
 
    
297
184
    def add(self):
298
185
        """Derived from the Avahi example code"""
299
186
        self.remove()
304
191
                avahi.DBUS_INTERFACE_ENTRY_GROUP)
305
192
        self.entry_group_state_changed_match = (
306
193
            self.group.connect_to_signal(
307
 
                'StateChanged', self.entry_group_state_changed))
 
194
                'StateChanged', self .entry_group_state_changed))
308
195
        logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
309
196
                     self.name, self.type)
310
197
        self.group.AddService(
316
203
            dbus.UInt16(self.port),
317
204
            avahi.string_array_to_txt_array(self.TXT))
318
205
        self.group.Commit()
319
 
    
320
206
    def entry_group_state_changed(self, state, error):
321
207
        """Derived from the Avahi example code"""
322
208
        logger.debug("Avahi entry group state change: %i", state)
329
215
        elif state == avahi.ENTRY_GROUP_FAILURE:
330
216
            logger.critical("Avahi: Error in group state changed %s",
331
217
                            unicode(error))
332
 
            raise AvahiGroupError("State changed: {0!s}"
333
 
                                  .format(error))
334
 
    
 
218
            raise AvahiGroupError("State changed: %s"
 
219
                                  % unicode(error))
335
220
    def cleanup(self):
336
221
        """Derived from the Avahi example code"""
337
222
        if self.group is not None:
338
223
            try:
339
224
                self.group.Free()
340
225
            except (dbus.exceptions.UnknownMethodException,
341
 
                    dbus.exceptions.DBusException):
 
226
                    dbus.exceptions.DBusException) as e:
342
227
                pass
343
228
            self.group = None
344
229
        self.remove()
345
 
    
346
230
    def server_state_changed(self, state, error=None):
347
231
        """Derived from the Avahi example code"""
348
232
        logger.debug("Avahi server state change: %i", state)
367
251
                logger.debug("Unknown state: %r", state)
368
252
            else:
369
253
                logger.debug("Unknown state: %r: %r", state, error)
370
 
    
371
254
    def activate(self):
372
255
        """Derived from the Avahi example code"""
373
256
        if self.server is None:
381
264
        self.server_state_changed(self.server.GetState())
382
265
 
383
266
 
384
 
class AvahiServiceToSyslog(AvahiService):
385
 
    def rename(self):
386
 
        """Add the new name to the syslog messages"""
387
 
        ret = AvahiService.rename(self)
388
 
        syslogger.setFormatter(logging.Formatter
389
 
                               ('Mandos ({0}) [%(process)d]:'
390
 
                                ' %(levelname)s: %(message)s'
391
 
                                .format(self.name)))
392
 
        return ret
393
 
 
394
 
 
395
 
def timedelta_to_milliseconds(td):
396
 
    "Convert a datetime.timedelta() to milliseconds"
397
 
    return ((td.days * 24 * 60 * 60 * 1000)
398
 
            + (td.seconds * 1000)
399
 
            + (td.microseconds // 1000))
400
 
 
401
 
 
402
267
class Client(object):
403
268
    """A representation of a client host served by this server.
404
269
    
405
270
    Attributes:
406
 
    approved:   bool(); 'None' if not yet approved/disapproved
 
271
    _approved:   bool(); 'None' if not yet approved/disapproved
407
272
    approval_delay: datetime.timedelta(); Time to wait for approval
408
273
    approval_duration: datetime.timedelta(); Duration of one approval
409
274
    checker:    subprocess.Popen(); a running checker process used
416
281
                     instance %(name)s can be used in the command.
417
282
    checker_initiator_tag: a gobject event source tag, or None
418
283
    created:    datetime.datetime(); (UTC) object creation
419
 
    client_structure: Object describing what attributes a client has
420
 
                      and is used for storing the client at exit
421
284
    current_checker_command: string; current running checker_command
 
285
    disable_hook:  If set, called by disable() as disable_hook(self)
422
286
    disable_initiator_tag: a gobject event source tag, or None
423
287
    enabled:    bool()
424
288
    fingerprint: string (40 or 32 hexadecimal digits); used to
427
291
    interval:   datetime.timedelta(); How often to start a new checker
428
292
    last_approval_request: datetime.datetime(); (UTC) or None
429
293
    last_checked_ok: datetime.datetime(); (UTC) or None
430
 
    last_checker_status: integer between 0 and 255 reflecting exit
431
 
                         status of last checker. -1 reflects crashed
432
 
                         checker, -2 means no checker completed yet.
433
 
    last_enabled: datetime.datetime(); (UTC) or None
 
294
    last_enabled: datetime.datetime(); (UTC)
434
295
    name:       string; from the config file, used in log messages and
435
296
                        D-Bus identifiers
436
297
    secret:     bytestring; sent verbatim (over TLS) to client
437
298
    timeout:    datetime.timedelta(); How long from last_checked_ok
438
299
                                      until this client is disabled
439
 
    extended_timeout:   extra long timeout when secret has been sent
440
300
    runtime_expansions: Allowed attributes for runtime expansion.
441
 
    expires:    datetime.datetime(); time (UTC) when a client will be
442
 
                disabled, or None
443
301
    """
444
302
    
445
303
    runtime_expansions = ("approval_delay", "approval_duration",
446
 
                          "created", "enabled", "expires",
447
 
                          "fingerprint", "host", "interval",
448
 
                          "last_approval_request", "last_checked_ok",
 
304
                          "created", "enabled", "fingerprint",
 
305
                          "host", "interval", "last_checked_ok",
449
306
                          "last_enabled", "name", "timeout")
450
 
    client_defaults = { "timeout": "PT5M",
451
 
                        "extended_timeout": "PT15M",
452
 
                        "interval": "PT2M",
453
 
                        "checker": "fping -q -- %%(host)s",
454
 
                        "host": "",
455
 
                        "approval_delay": "PT0S",
456
 
                        "approval_duration": "PT1S",
457
 
                        "approved_by_default": "True",
458
 
                        "enabled": "True",
459
 
                        }
 
307
    
 
308
    @staticmethod
 
309
    def _timedelta_to_milliseconds(td):
 
310
        "Convert a datetime.timedelta() to milliseconds"
 
311
        return ((td.days * 24 * 60 * 60 * 1000)
 
312
                + (td.seconds * 1000)
 
313
                + (td.microseconds // 1000))
460
314
    
461
315
    def timeout_milliseconds(self):
462
316
        "Return the 'timeout' attribute in milliseconds"
463
 
        return timedelta_to_milliseconds(self.timeout)
464
 
    
465
 
    def extended_timeout_milliseconds(self):
466
 
        "Return the 'extended_timeout' attribute in milliseconds"
467
 
        return timedelta_to_milliseconds(self.extended_timeout)
 
317
        return self._timedelta_to_milliseconds(self.timeout)
468
318
    
469
319
    def interval_milliseconds(self):
470
320
        "Return the 'interval' attribute in milliseconds"
471
 
        return timedelta_to_milliseconds(self.interval)
472
 
    
 
321
        return self._timedelta_to_milliseconds(self.interval)
 
322
 
473
323
    def approval_delay_milliseconds(self):
474
 
        return timedelta_to_milliseconds(self.approval_delay)
475
 
    
476
 
    @staticmethod
477
 
    def config_parser(config):
478
 
        """Construct a new dict of client settings of this form:
479
 
        { client_name: {setting_name: value, ...}, ...}
480
 
        with exceptions for any special settings as defined above.
481
 
        NOTE: Must be a pure function. Must return the same result
482
 
        value given the same arguments.
483
 
        """
484
 
        settings = {}
485
 
        for client_name in config.sections():
486
 
            section = dict(config.items(client_name))
487
 
            client = settings[client_name] = {}
488
 
            
489
 
            client["host"] = section["host"]
490
 
            # Reformat values from string types to Python types
491
 
            client["approved_by_default"] = config.getboolean(
492
 
                client_name, "approved_by_default")
493
 
            client["enabled"] = config.getboolean(client_name,
494
 
                                                  "enabled")
495
 
            
496
 
            client["fingerprint"] = (section["fingerprint"].upper()
497
 
                                     .replace(" ", ""))
498
 
            if "secret" in section:
499
 
                client["secret"] = section["secret"].decode("base64")
500
 
            elif "secfile" in section:
501
 
                with open(os.path.expanduser(os.path.expandvars
502
 
                                             (section["secfile"])),
503
 
                          "rb") as secfile:
504
 
                    client["secret"] = secfile.read()
505
 
            else:
506
 
                raise TypeError("No secret or secfile for section {0}"
507
 
                                .format(section))
508
 
            client["timeout"] = string_to_delta(section["timeout"])
509
 
            client["extended_timeout"] = string_to_delta(
510
 
                section["extended_timeout"])
511
 
            client["interval"] = string_to_delta(section["interval"])
512
 
            client["approval_delay"] = string_to_delta(
513
 
                section["approval_delay"])
514
 
            client["approval_duration"] = string_to_delta(
515
 
                section["approval_duration"])
516
 
            client["checker_command"] = section["checker"]
517
 
            client["last_approval_request"] = None
518
 
            client["last_checked_ok"] = None
519
 
            client["last_checker_status"] = -2
520
 
        
521
 
        return settings
522
 
    
523
 
    def __init__(self, settings, name = None):
 
324
        return self._timedelta_to_milliseconds(self.approval_delay)
 
325
    
 
326
    def __init__(self, name = None, disable_hook=None, config=None):
 
327
        """Note: the 'checker' key in 'config' sets the
 
328
        'checker_command' attribute and *not* the 'checker'
 
329
        attribute."""
524
330
        self.name = name
525
 
        # adding all client settings
526
 
        for setting, value in settings.iteritems():
527
 
            setattr(self, setting, value)
528
 
        
529
 
        if self.enabled:
530
 
            if not hasattr(self, "last_enabled"):
531
 
                self.last_enabled = datetime.datetime.utcnow()
532
 
            if not hasattr(self, "expires"):
533
 
                self.expires = (datetime.datetime.utcnow()
534
 
                                + self.timeout)
535
 
        else:
536
 
            self.last_enabled = None
537
 
            self.expires = None
538
 
        
 
331
        if config is None:
 
332
            config = {}
539
333
        logger.debug("Creating client %r", self.name)
540
334
        # Uppercase and remove spaces from fingerprint for later
541
335
        # comparison purposes with return value from the fingerprint()
542
336
        # function
 
337
        self.fingerprint = (config["fingerprint"].upper()
 
338
                            .replace(" ", ""))
543
339
        logger.debug("  Fingerprint: %s", self.fingerprint)
544
 
        self.created = settings.get("created",
545
 
                                    datetime.datetime.utcnow())
546
 
        
547
 
        # attributes specific for this server instance
 
340
        if "secret" in config:
 
341
            self.secret = config["secret"].decode("base64")
 
342
        elif "secfile" in config:
 
343
            with open(os.path.expanduser(os.path.expandvars
 
344
                                         (config["secfile"])),
 
345
                      "rb") as secfile:
 
346
                self.secret = secfile.read()
 
347
        else:
 
348
            raise TypeError("No secret or secfile for client %s"
 
349
                            % self.name)
 
350
        self.host = config.get("host", "")
 
351
        self.created = datetime.datetime.utcnow()
 
352
        self.enabled = False
 
353
        self.last_approval_request = None
 
354
        self.last_enabled = None
 
355
        self.last_checked_ok = None
 
356
        self.timeout = string_to_delta(config["timeout"])
 
357
        self.interval = string_to_delta(config["interval"])
 
358
        self.disable_hook = disable_hook
548
359
        self.checker = None
549
360
        self.checker_initiator_tag = None
550
361
        self.disable_initiator_tag = None
551
362
        self.checker_callback_tag = None
 
363
        self.checker_command = config["checker"]
552
364
        self.current_checker_command = None
553
 
        self.approved = None
 
365
        self.last_connect = None
 
366
        self._approved = None
 
367
        self.approved_by_default = config.get("approved_by_default",
 
368
                                              True)
554
369
        self.approvals_pending = 0
555
 
        self.changedstate = (multiprocessing_manager
556
 
                             .Condition(multiprocessing_manager
557
 
                                        .Lock()))
558
 
        self.client_structure = [attr for attr in
559
 
                                 self.__dict__.iterkeys()
560
 
                                 if not attr.startswith("_")]
561
 
        self.client_structure.append("client_structure")
562
 
        
563
 
        for name, t in inspect.getmembers(type(self),
564
 
                                          lambda obj:
565
 
                                              isinstance(obj,
566
 
                                                         property)):
567
 
            if not name.startswith("_"):
568
 
                self.client_structure.append(name)
 
370
        self.approval_delay = string_to_delta(
 
371
            config["approval_delay"])
 
372
        self.approval_duration = string_to_delta(
 
373
            config["approval_duration"])
 
374
        self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())
569
375
    
570
 
    # Send notice to process children that client state has changed
571
376
    def send_changedstate(self):
572
 
        with self.changedstate:
573
 
            self.changedstate.notify_all()
574
 
    
 
377
        self.changedstate.acquire()
 
378
        self.changedstate.notify_all()
 
379
        self.changedstate.release()
 
380
        
575
381
    def enable(self):
576
382
        """Start this client's checker and timeout hooks"""
577
383
        if getattr(self, "enabled", False):
578
384
            # Already enabled
579
385
            return
580
 
        self.expires = datetime.datetime.utcnow() + self.timeout
581
 
        self.enabled = True
 
386
        self.send_changedstate()
582
387
        self.last_enabled = datetime.datetime.utcnow()
583
 
        self.init_checker()
584
 
        self.send_changedstate()
585
 
    
586
 
    def disable(self, quiet=True):
587
 
        """Disable this client."""
588
 
        if not getattr(self, "enabled", False):
589
 
            return False
590
 
        if not quiet:
591
 
            logger.info("Disabling client %s", self.name)
592
 
        if getattr(self, "disable_initiator_tag", None) is not None:
593
 
            gobject.source_remove(self.disable_initiator_tag)
594
 
            self.disable_initiator_tag = None
595
 
        self.expires = None
596
 
        if getattr(self, "checker_initiator_tag", None) is not None:
597
 
            gobject.source_remove(self.checker_initiator_tag)
598
 
            self.checker_initiator_tag = None
599
 
        self.stop_checker()
600
 
        self.enabled = False
601
 
        if not quiet:
602
 
            self.send_changedstate()
603
 
        # Do not run this again if called by a gobject.timeout_add
604
 
        return False
605
 
    
606
 
    def __del__(self):
607
 
        self.disable()
608
 
    
609
 
    def init_checker(self):
610
388
        # Schedule a new checker to be started an 'interval' from now,
611
389
        # and every interval from then on.
612
 
        if self.checker_initiator_tag is not None:
613
 
            gobject.source_remove(self.checker_initiator_tag)
614
390
        self.checker_initiator_tag = (gobject.timeout_add
615
391
                                      (self.interval_milliseconds(),
616
392
                                       self.start_checker))
617
393
        # Schedule a disable() when 'timeout' has passed
618
 
        if self.disable_initiator_tag is not None:
619
 
            gobject.source_remove(self.disable_initiator_tag)
620
394
        self.disable_initiator_tag = (gobject.timeout_add
621
395
                                   (self.timeout_milliseconds(),
622
396
                                    self.disable))
 
397
        self.enabled = True
623
398
        # Also start a new checker *right now*.
624
399
        self.start_checker()
625
400
    
 
401
    def disable(self, quiet=True):
 
402
        """Disable this client."""
 
403
        if not getattr(self, "enabled", False):
 
404
            return False
 
405
        if not quiet:
 
406
            self.send_changedstate()
 
407
        if not quiet:
 
408
            logger.info("Disabling client %s", self.name)
 
409
        if getattr(self, "disable_initiator_tag", False):
 
410
            gobject.source_remove(self.disable_initiator_tag)
 
411
            self.disable_initiator_tag = None
 
412
        if getattr(self, "checker_initiator_tag", False):
 
413
            gobject.source_remove(self.checker_initiator_tag)
 
414
            self.checker_initiator_tag = None
 
415
        self.stop_checker()
 
416
        if self.disable_hook:
 
417
            self.disable_hook(self)
 
418
        self.enabled = False
 
419
        # Do not run this again if called by a gobject.timeout_add
 
420
        return False
 
421
    
 
422
    def __del__(self):
 
423
        self.disable_hook = None
 
424
        self.disable()
 
425
    
626
426
    def checker_callback(self, pid, condition, command):
627
427
        """The checker has completed, so take appropriate actions."""
628
428
        self.checker_callback_tag = None
629
429
        self.checker = None
630
430
        if os.WIFEXITED(condition):
631
 
            self.last_checker_status = os.WEXITSTATUS(condition)
632
 
            if self.last_checker_status == 0:
 
431
            exitstatus = os.WEXITSTATUS(condition)
 
432
            if exitstatus == 0:
633
433
                logger.info("Checker for %(name)s succeeded",
634
434
                            vars(self))
635
435
                self.checked_ok()
637
437
                logger.info("Checker for %(name)s failed",
638
438
                            vars(self))
639
439
        else:
640
 
            self.last_checker_status = -1
641
440
            logger.warning("Checker for %(name)s crashed?",
642
441
                           vars(self))
643
442
    
644
443
    def checked_ok(self):
645
 
        """Assert that the client has been seen, alive and well."""
 
444
        """Bump up the timeout for this client.
 
445
        
 
446
        This should only be called when the client has been seen,
 
447
        alive and well.
 
448
        """
646
449
        self.last_checked_ok = datetime.datetime.utcnow()
647
 
        self.last_checker_status = 0
648
 
        self.bump_timeout()
649
 
    
650
 
    def bump_timeout(self, timeout=None):
651
 
        """Bump up the timeout for this client."""
652
 
        if timeout is None:
653
 
            timeout = self.timeout
654
 
        if self.disable_initiator_tag is not None:
655
 
            gobject.source_remove(self.disable_initiator_tag)
656
 
            self.disable_initiator_tag = None
657
 
        if getattr(self, "enabled", False):
658
 
            self.disable_initiator_tag = (gobject.timeout_add
659
 
                                          (timedelta_to_milliseconds
660
 
                                           (timeout), self.disable))
661
 
            self.expires = datetime.datetime.utcnow() + timeout
 
450
        gobject.source_remove(self.disable_initiator_tag)
 
451
        self.disable_initiator_tag = (gobject.timeout_add
 
452
                                      (self.timeout_milliseconds(),
 
453
                                       self.disable))
662
454
    
663
455
    def need_approval(self):
664
456
        self.last_approval_request = datetime.datetime.utcnow()
669
461
        If a checker already exists, leave it running and do
670
462
        nothing."""
671
463
        # The reason for not killing a running checker is that if we
672
 
        # did that, and if a checker (for some reason) started running
673
 
        # slowly and taking more than 'interval' time, then the client
674
 
        # would inevitably timeout, since no checker would get a
675
 
        # chance to run to completion.  If we instead leave running
 
464
        # did that, then if a checker (for some reason) started
 
465
        # running slowly and taking more than 'interval' time, the
 
466
        # client would inevitably timeout, since no checker would get
 
467
        # a chance to run to completion.  If we instead leave running
676
468
        # checkers alone, the checker would have to take more time
677
469
        # than 'timeout' for the client to be disabled, which is as it
678
470
        # should be.
692
484
                                      self.current_checker_command)
693
485
        # Start a new checker if needed
694
486
        if self.checker is None:
695
 
            # Escape attributes for the shell
696
 
            escaped_attrs = dict(
697
 
                (attr, re.escape(unicode(getattr(self, attr))))
698
 
                for attr in
699
 
                self.runtime_expansions)
700
487
            try:
701
 
                command = self.checker_command % escaped_attrs
702
 
            except TypeError as error:
703
 
                logger.error('Could not format string "%s"',
704
 
                             self.checker_command, exc_info=error)
705
 
                return True # Try again later
 
488
                # In case checker_command has exactly one % operator
 
489
                command = self.checker_command % self.host
 
490
            except TypeError:
 
491
                # Escape attributes for the shell
 
492
                escaped_attrs = dict(
 
493
                    (attr,
 
494
                     re.escape(unicode(str(getattr(self, attr, "")),
 
495
                                       errors=
 
496
                                       'replace')))
 
497
                    for attr in
 
498
                    self.runtime_expansions)
 
499
 
 
500
                try:
 
501
                    command = self.checker_command % escaped_attrs
 
502
                except TypeError as error:
 
503
                    logger.error('Could not format string "%s":'
 
504
                                 ' %s', self.checker_command, error)
 
505
                    return True # Try again later
706
506
            self.current_checker_command = command
707
507
            try:
708
508
                logger.info("Starting checker %r for %s",
714
514
                self.checker = subprocess.Popen(command,
715
515
                                                close_fds=True,
716
516
                                                shell=True, cwd="/")
717
 
            except OSError as error:
718
 
                logger.error("Failed to start subprocess",
719
 
                             exc_info=error)
720
 
                return True
721
 
            self.checker_callback_tag = (gobject.child_watch_add
722
 
                                         (self.checker.pid,
723
 
                                          self.checker_callback,
724
 
                                          data=command))
725
 
            # The checker may have completed before the gobject
726
 
            # watch was added.  Check for this.
727
 
            try:
 
517
                self.checker_callback_tag = (gobject.child_watch_add
 
518
                                             (self.checker.pid,
 
519
                                              self.checker_callback,
 
520
                                              data=command))
 
521
                # The checker may have completed before the gobject
 
522
                # watch was added.  Check for this.
728
523
                pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
 
524
                if pid:
 
525
                    gobject.source_remove(self.checker_callback_tag)
 
526
                    self.checker_callback(pid, status, command)
729
527
            except OSError as error:
730
 
                if error.errno == errno.ECHILD:
731
 
                    # This should never happen
732
 
                    logger.error("Child process vanished",
733
 
                                 exc_info=error)
734
 
                    return True
735
 
                raise
736
 
            if pid:
737
 
                gobject.source_remove(self.checker_callback_tag)
738
 
                self.checker_callback(pid, status, command)
 
528
                logger.error("Failed to start subprocess: %s",
 
529
                             error)
739
530
        # Re-run this periodically if run by gobject.timeout_add
740
531
        return True
741
532
    
748
539
            return
749
540
        logger.debug("Stopping checker for %(name)s", vars(self))
750
541
        try:
751
 
            self.checker.terminate()
 
542
            os.kill(self.checker.pid, signal.SIGTERM)
752
543
            #time.sleep(0.5)
753
544
            #if self.checker.poll() is None:
754
 
            #    self.checker.kill()
 
545
            #    os.kill(self.checker.pid, signal.SIGKILL)
755
546
        except OSError as error:
756
547
            if error.errno != errno.ESRCH: # No such process
757
548
                raise
758
549
        self.checker = None
759
550
 
760
 
 
761
551
def dbus_service_property(dbus_interface, signature="v",
762
552
                          access="readwrite", byte_arrays=False):
763
553
    """Decorators for marking methods of a DBusObjectWithProperties to
774
564
    # "Set" method, so we fail early here:
775
565
    if byte_arrays and signature != "ay":
776
566
        raise ValueError("Byte arrays not supported for non-'ay'"
777
 
                         " signature {0!r}".format(signature))
 
567
                         " signature %r" % signature)
778
568
    def decorator(func):
779
569
        func._dbus_is_property = True
780
570
        func._dbus_interface = dbus_interface
788
578
    return decorator
789
579
 
790
580
 
791
 
def dbus_interface_annotations(dbus_interface):
792
 
    """Decorator for marking functions returning interface annotations
793
 
    
794
 
    Usage:
795
 
    
796
 
    @dbus_interface_annotations("org.example.Interface")
797
 
    def _foo(self):  # Function name does not matter
798
 
        return {"org.freedesktop.DBus.Deprecated": "true",
799
 
                "org.freedesktop.DBus.Property.EmitsChangedSignal":
800
 
                    "false"}
801
 
    """
802
 
    def decorator(func):
803
 
        func._dbus_is_interface = True
804
 
        func._dbus_interface = dbus_interface
805
 
        func._dbus_name = dbus_interface
806
 
        return func
807
 
    return decorator
808
 
 
809
 
 
810
 
def dbus_annotations(annotations):
811
 
    """Decorator to annotate D-Bus methods, signals or properties
812
 
    Usage:
813
 
    
814
 
    @dbus_service_property("org.example.Interface", signature="b",
815
 
                           access="r")
816
 
    @dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",
817
 
                        "org.freedesktop.DBus.Property."
818
 
                        "EmitsChangedSignal": "false"})
819
 
    def Property_dbus_property(self):
820
 
        return dbus.Boolean(False)
821
 
    """
822
 
    def decorator(func):
823
 
        func._dbus_annotations = annotations
824
 
        return func
825
 
    return decorator
826
 
 
827
 
 
828
581
class DBusPropertyException(dbus.exceptions.DBusException):
829
582
    """A base class for D-Bus property-related exceptions
830
583
    """
846
599
 
847
600
class DBusObjectWithProperties(dbus.service.Object):
848
601
    """A D-Bus object with properties.
849
 
    
 
602
 
850
603
    Classes inheriting from this can use the dbus_service_property
851
604
    decorator to expose methods as D-Bus properties.  It exposes the
852
605
    standard Get(), Set(), and GetAll() methods on the D-Bus.
853
606
    """
854
607
    
855
608
    @staticmethod
856
 
    def _is_dbus_thing(thing):
857
 
        """Returns a function testing if an attribute is a D-Bus thing
858
 
        
859
 
        If called like _is_dbus_thing("method") it returns a function
860
 
        suitable for use as predicate to inspect.getmembers().
861
 
        """
862
 
        return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),
863
 
                                   False)
 
609
    def _is_dbus_property(obj):
 
610
        return getattr(obj, "_dbus_is_property", False)
864
611
    
865
 
    def _get_all_dbus_things(self, thing):
 
612
    def _get_all_dbus_properties(self):
866
613
        """Returns a generator of (name, attribute) pairs
867
614
        """
868
 
        return ((getattr(athing.__get__(self), "_dbus_name",
869
 
                         name),
870
 
                 athing.__get__(self))
871
 
                for cls in self.__class__.__mro__
872
 
                for name, athing in
873
 
                inspect.getmembers(cls,
874
 
                                   self._is_dbus_thing(thing)))
 
615
        return ((prop._dbus_name, prop)
 
616
                for name, prop in
 
617
                inspect.getmembers(self, self._is_dbus_property))
875
618
    
876
619
    def _get_dbus_property(self, interface_name, property_name):
877
620
        """Returns a bound method if one exists which is a D-Bus
878
621
        property with the specified name and interface.
879
622
        """
880
 
        for cls in  self.__class__.__mro__:
881
 
            for name, value in (inspect.getmembers
882
 
                                (cls,
883
 
                                 self._is_dbus_thing("property"))):
884
 
                if (value._dbus_name == property_name
885
 
                    and value._dbus_interface == interface_name):
886
 
                    return value.__get__(self)
887
 
        
 
623
        for name in (property_name,
 
624
                     property_name + "_dbus_property"):
 
625
            prop = getattr(self, name, None)
 
626
            if (prop is None
 
627
                or not self._is_dbus_property(prop)
 
628
                or prop._dbus_name != property_name
 
629
                or (interface_name and prop._dbus_interface
 
630
                    and interface_name != prop._dbus_interface)):
 
631
                continue
 
632
            return prop
888
633
        # No such property
889
634
        raise DBusPropertyNotFound(self.dbus_object_path + ":"
890
635
                                   + interface_name + "."
915
660
            # signatures other than "ay".
916
661
            if prop._dbus_signature != "ay":
917
662
                raise ValueError
918
 
            value = dbus.ByteArray(b''.join(chr(byte)
919
 
                                            for byte in value))
 
663
            value = dbus.ByteArray(''.join(unichr(byte)
 
664
                                           for byte in value))
920
665
        prop(value)
921
666
    
922
667
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
924
669
    def GetAll(self, interface_name):
925
670
        """Standard D-Bus property GetAll() method, see D-Bus
926
671
        standard.
927
 
        
 
672
 
928
673
        Note: Will not include properties with access="write".
929
674
        """
930
 
        properties = {}
931
 
        for name, prop in self._get_all_dbus_things("property"):
 
675
        all = {}
 
676
        for name, prop in self._get_all_dbus_properties():
932
677
            if (interface_name
933
678
                and interface_name != prop._dbus_interface):
934
679
                # Interface non-empty but did not match
938
683
                continue
939
684
            value = prop()
940
685
            if not hasattr(value, "variant_level"):
941
 
                properties[name] = value
 
686
                all[name] = value
942
687
                continue
943
 
            properties[name] = type(value)(value, variant_level=
944
 
                                           value.variant_level+1)
945
 
        return dbus.Dictionary(properties, signature="sv")
 
688
            all[name] = type(value)(value, variant_level=
 
689
                                    value.variant_level+1)
 
690
        return dbus.Dictionary(all, signature="sv")
946
691
    
947
692
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
948
693
                         out_signature="s",
949
694
                         path_keyword='object_path',
950
695
                         connection_keyword='connection')
951
696
    def Introspect(self, object_path, connection):
952
 
        """Overloading of standard D-Bus method.
953
 
        
954
 
        Inserts property tags and interface annotation tags.
 
697
        """Standard D-Bus method, overloaded to insert property tags.
955
698
        """
956
699
        xmlstring = dbus.service.Object.Introspect(self, object_path,
957
700
                                                   connection)
964
707
                e.setAttribute("access", prop._dbus_access)
965
708
                return e
966
709
            for if_tag in document.getElementsByTagName("interface"):
967
 
                # Add property tags
968
710
                for tag in (make_tag(document, name, prop)
969
711
                            for name, prop
970
 
                            in self._get_all_dbus_things("property")
 
712
                            in self._get_all_dbus_properties()
971
713
                            if prop._dbus_interface
972
714
                            == if_tag.getAttribute("name")):
973
715
                    if_tag.appendChild(tag)
974
 
                # Add annotation tags
975
 
                for typ in ("method", "signal", "property"):
976
 
                    for tag in if_tag.getElementsByTagName(typ):
977
 
                        annots = dict()
978
 
                        for name, prop in (self.
979
 
                                           _get_all_dbus_things(typ)):
980
 
                            if (name == tag.getAttribute("name")
981
 
                                and prop._dbus_interface
982
 
                                == if_tag.getAttribute("name")):
983
 
                                annots.update(getattr
984
 
                                              (prop,
985
 
                                               "_dbus_annotations",
986
 
                                               {}))
987
 
                        for name, value in annots.iteritems():
988
 
                            ann_tag = document.createElement(
989
 
                                "annotation")
990
 
                            ann_tag.setAttribute("name", name)
991
 
                            ann_tag.setAttribute("value", value)
992
 
                            tag.appendChild(ann_tag)
993
 
                # Add interface annotation tags
994
 
                for annotation, value in dict(
995
 
                    itertools.chain.from_iterable(
996
 
                        annotations().iteritems()
997
 
                        for name, annotations in
998
 
                        self._get_all_dbus_things("interface")
999
 
                        if name == if_tag.getAttribute("name")
1000
 
                        )).iteritems():
1001
 
                    ann_tag = document.createElement("annotation")
1002
 
                    ann_tag.setAttribute("name", annotation)
1003
 
                    ann_tag.setAttribute("value", value)
1004
 
                    if_tag.appendChild(ann_tag)
1005
716
                # Add the names to the return values for the
1006
717
                # "org.freedesktop.DBus.Properties" methods
1007
718
                if (if_tag.getAttribute("name")
1022
733
        except (AttributeError, xml.dom.DOMException,
1023
734
                xml.parsers.expat.ExpatError) as error:
1024
735
            logger.error("Failed to override Introspection method",
1025
 
                         exc_info=error)
 
736
                         error)
1026
737
        return xmlstring
1027
738
 
1028
739
 
1029
 
def datetime_to_dbus(dt, variant_level=0):
1030
 
    """Convert a UTC datetime.datetime() to a D-Bus type."""
1031
 
    if dt is None:
1032
 
        return dbus.String("", variant_level = variant_level)
1033
 
    return dbus.String(dt.isoformat(),
1034
 
                       variant_level=variant_level)
1035
 
 
1036
 
 
1037
 
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
1038
 
    """A class decorator; applied to a subclass of
1039
 
    dbus.service.Object, it will add alternate D-Bus attributes with
1040
 
    interface names according to the "alt_interface_names" mapping.
1041
 
    Usage:
1042
 
    
1043
 
    @alternate_dbus_interfaces({"org.example.Interface":
1044
 
                                    "net.example.AlternateInterface"})
1045
 
    class SampleDBusObject(dbus.service.Object):
1046
 
        @dbus.service.method("org.example.Interface")
1047
 
        def SampleDBusMethod():
1048
 
            pass
1049
 
    
1050
 
    The above "SampleDBusMethod" on "SampleDBusObject" will be
1051
 
    reachable via two interfaces: "org.example.Interface" and
1052
 
    "net.example.AlternateInterface", the latter of which will have
1053
 
    its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
1054
 
    "true", unless "deprecate" is passed with a False value.
1055
 
    
1056
 
    This works for methods and signals, and also for D-Bus properties
1057
 
    (from DBusObjectWithProperties) and interfaces (from the
1058
 
    dbus_interface_annotations decorator).
1059
 
    """
1060
 
    def wrapper(cls):
1061
 
        for orig_interface_name, alt_interface_name in (
1062
 
            alt_interface_names.iteritems()):
1063
 
            attr = {}
1064
 
            interface_names = set()
1065
 
            # Go though all attributes of the class
1066
 
            for attrname, attribute in inspect.getmembers(cls):
1067
 
                # Ignore non-D-Bus attributes, and D-Bus attributes
1068
 
                # with the wrong interface name
1069
 
                if (not hasattr(attribute, "_dbus_interface")
1070
 
                    or not attribute._dbus_interface
1071
 
                    .startswith(orig_interface_name)):
1072
 
                    continue
1073
 
                # Create an alternate D-Bus interface name based on
1074
 
                # the current name
1075
 
                alt_interface = (attribute._dbus_interface
1076
 
                                 .replace(orig_interface_name,
1077
 
                                          alt_interface_name))
1078
 
                interface_names.add(alt_interface)
1079
 
                # Is this a D-Bus signal?
1080
 
                if getattr(attribute, "_dbus_is_signal", False):
1081
 
                    # Extract the original non-method undecorated
1082
 
                    # function by black magic
1083
 
                    nonmethod_func = (dict(
1084
 
                            zip(attribute.func_code.co_freevars,
1085
 
                                attribute.__closure__))["func"]
1086
 
                                      .cell_contents)
1087
 
                    # Create a new, but exactly alike, function
1088
 
                    # object, and decorate it to be a new D-Bus signal
1089
 
                    # with the alternate D-Bus interface name
1090
 
                    new_function = (dbus.service.signal
1091
 
                                    (alt_interface,
1092
 
                                     attribute._dbus_signature)
1093
 
                                    (types.FunctionType(
1094
 
                                nonmethod_func.func_code,
1095
 
                                nonmethod_func.func_globals,
1096
 
                                nonmethod_func.func_name,
1097
 
                                nonmethod_func.func_defaults,
1098
 
                                nonmethod_func.func_closure)))
1099
 
                    # Copy annotations, if any
1100
 
                    try:
1101
 
                        new_function._dbus_annotations = (
1102
 
                            dict(attribute._dbus_annotations))
1103
 
                    except AttributeError:
1104
 
                        pass
1105
 
                    # Define a creator of a function to call both the
1106
 
                    # original and alternate functions, so both the
1107
 
                    # original and alternate signals gets sent when
1108
 
                    # the function is called
1109
 
                    def fixscope(func1, func2):
1110
 
                        """This function is a scope container to pass
1111
 
                        func1 and func2 to the "call_both" function
1112
 
                        outside of its arguments"""
1113
 
                        def call_both(*args, **kwargs):
1114
 
                            """This function will emit two D-Bus
1115
 
                            signals by calling func1 and func2"""
1116
 
                            func1(*args, **kwargs)
1117
 
                            func2(*args, **kwargs)
1118
 
                        return call_both
1119
 
                    # Create the "call_both" function and add it to
1120
 
                    # the class
1121
 
                    attr[attrname] = fixscope(attribute, new_function)
1122
 
                # Is this a D-Bus method?
1123
 
                elif getattr(attribute, "_dbus_is_method", False):
1124
 
                    # Create a new, but exactly alike, function
1125
 
                    # object.  Decorate it to be a new D-Bus method
1126
 
                    # with the alternate D-Bus interface name.  Add it
1127
 
                    # to the class.
1128
 
                    attr[attrname] = (dbus.service.method
1129
 
                                      (alt_interface,
1130
 
                                       attribute._dbus_in_signature,
1131
 
                                       attribute._dbus_out_signature)
1132
 
                                      (types.FunctionType
1133
 
                                       (attribute.func_code,
1134
 
                                        attribute.func_globals,
1135
 
                                        attribute.func_name,
1136
 
                                        attribute.func_defaults,
1137
 
                                        attribute.func_closure)))
1138
 
                    # Copy annotations, if any
1139
 
                    try:
1140
 
                        attr[attrname]._dbus_annotations = (
1141
 
                            dict(attribute._dbus_annotations))
1142
 
                    except AttributeError:
1143
 
                        pass
1144
 
                # Is this a D-Bus property?
1145
 
                elif getattr(attribute, "_dbus_is_property", False):
1146
 
                    # Create a new, but exactly alike, function
1147
 
                    # object, and decorate it to be a new D-Bus
1148
 
                    # property with the alternate D-Bus interface
1149
 
                    # name.  Add it to the class.
1150
 
                    attr[attrname] = (dbus_service_property
1151
 
                                      (alt_interface,
1152
 
                                       attribute._dbus_signature,
1153
 
                                       attribute._dbus_access,
1154
 
                                       attribute
1155
 
                                       ._dbus_get_args_options
1156
 
                                       ["byte_arrays"])
1157
 
                                      (types.FunctionType
1158
 
                                       (attribute.func_code,
1159
 
                                        attribute.func_globals,
1160
 
                                        attribute.func_name,
1161
 
                                        attribute.func_defaults,
1162
 
                                        attribute.func_closure)))
1163
 
                    # Copy annotations, if any
1164
 
                    try:
1165
 
                        attr[attrname]._dbus_annotations = (
1166
 
                            dict(attribute._dbus_annotations))
1167
 
                    except AttributeError:
1168
 
                        pass
1169
 
                # Is this a D-Bus interface?
1170
 
                elif getattr(attribute, "_dbus_is_interface", False):
1171
 
                    # Create a new, but exactly alike, function
1172
 
                    # object.  Decorate it to be a new D-Bus interface
1173
 
                    # with the alternate D-Bus interface name.  Add it
1174
 
                    # to the class.
1175
 
                    attr[attrname] = (dbus_interface_annotations
1176
 
                                      (alt_interface)
1177
 
                                      (types.FunctionType
1178
 
                                       (attribute.func_code,
1179
 
                                        attribute.func_globals,
1180
 
                                        attribute.func_name,
1181
 
                                        attribute.func_defaults,
1182
 
                                        attribute.func_closure)))
1183
 
            if deprecate:
1184
 
                # Deprecate all alternate interfaces
1185
 
                iname="_AlternateDBusNames_interface_annotation{0}"
1186
 
                for interface_name in interface_names:
1187
 
                    @dbus_interface_annotations(interface_name)
1188
 
                    def func(self):
1189
 
                        return { "org.freedesktop.DBus.Deprecated":
1190
 
                                     "true" }
1191
 
                    # Find an unused name
1192
 
                    for aname in (iname.format(i)
1193
 
                                  for i in itertools.count()):
1194
 
                        if aname not in attr:
1195
 
                            attr[aname] = func
1196
 
                            break
1197
 
            if interface_names:
1198
 
                # Replace the class with a new subclass of it with
1199
 
                # methods, signals, etc. as created above.
1200
 
                cls = type(b"{0}Alternate".format(cls.__name__),
1201
 
                           (cls,), attr)
1202
 
        return cls
1203
 
    return wrapper
1204
 
 
1205
 
 
1206
 
@alternate_dbus_interfaces({"se.recompile.Mandos":
1207
 
                                "se.bsnet.fukt.Mandos"})
1208
740
class ClientDBus(Client, DBusObjectWithProperties):
1209
741
    """A Client class using D-Bus
1210
742
    
1219
751
    # dbus.service.Object doesn't use super(), so we can't either.
1220
752
    
1221
753
    def __init__(self, bus = None, *args, **kwargs):
 
754
        self._approvals_pending = 0
1222
755
        self.bus = bus
1223
756
        Client.__init__(self, *args, **kwargs)
1224
757
        # Only now, when this client is initialized, can it show up on
1230
763
                                 ("/clients/" + client_object_name))
1231
764
        DBusObjectWithProperties.__init__(self, self.bus,
1232
765
                                          self.dbus_object_path)
1233
 
    
1234
 
    def notifychangeproperty(transform_func,
1235
 
                             dbus_name, type_func=lambda x: x,
1236
 
                             variant_level=1):
1237
 
        """ Modify a variable so that it's a property which announces
1238
 
        its changes to DBus.
1239
 
        
1240
 
        transform_fun: Function that takes a value and a variant_level
1241
 
                       and transforms it to a D-Bus type.
1242
 
        dbus_name: D-Bus name of the variable
1243
 
        type_func: Function that transform the value before sending it
1244
 
                   to the D-Bus.  Default: no transform
1245
 
        variant_level: D-Bus variant level.  Default: 1
1246
 
        """
1247
 
        attrname = "_{0}".format(dbus_name)
1248
 
        def setter(self, value):
1249
 
            if hasattr(self, "dbus_object_path"):
1250
 
                if (not hasattr(self, attrname) or
1251
 
                    type_func(getattr(self, attrname, None))
1252
 
                    != type_func(value)):
1253
 
                    dbus_value = transform_func(type_func(value),
1254
 
                                                variant_level
1255
 
                                                =variant_level)
1256
 
                    self.PropertyChanged(dbus.String(dbus_name),
1257
 
                                         dbus_value)
1258
 
            setattr(self, attrname, value)
1259
 
        
1260
 
        return property(lambda self: getattr(self, attrname), setter)
1261
 
    
1262
 
    expires = notifychangeproperty(datetime_to_dbus, "Expires")
1263
 
    approvals_pending = notifychangeproperty(dbus.Boolean,
1264
 
                                             "ApprovalPending",
1265
 
                                             type_func = bool)
1266
 
    enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1267
 
    last_enabled = notifychangeproperty(datetime_to_dbus,
1268
 
                                        "LastEnabled")
1269
 
    checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",
1270
 
                                   type_func = lambda checker:
1271
 
                                       checker is not None)
1272
 
    last_checked_ok = notifychangeproperty(datetime_to_dbus,
1273
 
                                           "LastCheckedOK")
1274
 
    last_checker_status = notifychangeproperty(dbus.Int16,
1275
 
                                               "LastCheckerStatus")
1276
 
    last_approval_request = notifychangeproperty(
1277
 
        datetime_to_dbus, "LastApprovalRequest")
1278
 
    approved_by_default = notifychangeproperty(dbus.Boolean,
1279
 
                                               "ApprovedByDefault")
1280
 
    approval_delay = notifychangeproperty(dbus.UInt64,
1281
 
                                          "ApprovalDelay",
1282
 
                                          type_func =
1283
 
                                          timedelta_to_milliseconds)
1284
 
    approval_duration = notifychangeproperty(
1285
 
        dbus.UInt64, "ApprovalDuration",
1286
 
        type_func = timedelta_to_milliseconds)
1287
 
    host = notifychangeproperty(dbus.String, "Host")
1288
 
    timeout = notifychangeproperty(dbus.UInt64, "Timeout",
1289
 
                                   type_func =
1290
 
                                   timedelta_to_milliseconds)
1291
 
    extended_timeout = notifychangeproperty(
1292
 
        dbus.UInt64, "ExtendedTimeout",
1293
 
        type_func = timedelta_to_milliseconds)
1294
 
    interval = notifychangeproperty(dbus.UInt64,
1295
 
                                    "Interval",
1296
 
                                    type_func =
1297
 
                                    timedelta_to_milliseconds)
1298
 
    checker_command = notifychangeproperty(dbus.String, "Checker")
1299
 
    
1300
 
    del notifychangeproperty
 
766
        
 
767
    def _get_approvals_pending(self):
 
768
        return self._approvals_pending
 
769
    def _set_approvals_pending(self, value):
 
770
        old_value = self._approvals_pending
 
771
        self._approvals_pending = value
 
772
        bval = bool(value)
 
773
        if (hasattr(self, "dbus_object_path")
 
774
            and bval is not bool(old_value)):
 
775
            dbus_bool = dbus.Boolean(bval, variant_level=1)
 
776
            self.PropertyChanged(dbus.String("ApprovalPending"),
 
777
                                 dbus_bool)
 
778
 
 
779
    approvals_pending = property(_get_approvals_pending,
 
780
                                 _set_approvals_pending)
 
781
    del _get_approvals_pending, _set_approvals_pending
 
782
    
 
783
    @staticmethod
 
784
    def _datetime_to_dbus(dt, variant_level=0):
 
785
        """Convert a UTC datetime.datetime() to a D-Bus type."""
 
786
        return dbus.String(dt.isoformat(),
 
787
                           variant_level=variant_level)
 
788
    
 
789
    def enable(self):
 
790
        oldstate = getattr(self, "enabled", False)
 
791
        r = Client.enable(self)
 
792
        if oldstate != self.enabled:
 
793
            # Emit D-Bus signals
 
794
            self.PropertyChanged(dbus.String("Enabled"),
 
795
                                 dbus.Boolean(True, variant_level=1))
 
796
            self.PropertyChanged(
 
797
                dbus.String("LastEnabled"),
 
798
                self._datetime_to_dbus(self.last_enabled,
 
799
                                       variant_level=1))
 
800
        return r
 
801
    
 
802
    def disable(self, quiet = False):
 
803
        oldstate = getattr(self, "enabled", False)
 
804
        r = Client.disable(self, quiet=quiet)
 
805
        if not quiet and oldstate != self.enabled:
 
806
            # Emit D-Bus signal
 
807
            self.PropertyChanged(dbus.String("Enabled"),
 
808
                                 dbus.Boolean(False, variant_level=1))
 
809
        return r
1301
810
    
1302
811
    def __del__(self, *args, **kwargs):
1303
812
        try:
1312
821
                         *args, **kwargs):
1313
822
        self.checker_callback_tag = None
1314
823
        self.checker = None
 
824
        # Emit D-Bus signal
 
825
        self.PropertyChanged(dbus.String("CheckerRunning"),
 
826
                             dbus.Boolean(False, variant_level=1))
1315
827
        if os.WIFEXITED(condition):
1316
828
            exitstatus = os.WEXITSTATUS(condition)
1317
829
            # Emit D-Bus signal
1327
839
        return Client.checker_callback(self, pid, condition, command,
1328
840
                                       *args, **kwargs)
1329
841
    
 
842
    def checked_ok(self, *args, **kwargs):
 
843
        Client.checked_ok(self, *args, **kwargs)
 
844
        # Emit D-Bus signal
 
845
        self.PropertyChanged(
 
846
            dbus.String("LastCheckedOK"),
 
847
            (self._datetime_to_dbus(self.last_checked_ok,
 
848
                                    variant_level=1)))
 
849
    
 
850
    def need_approval(self, *args, **kwargs):
 
851
        r = Client.need_approval(self, *args, **kwargs)
 
852
        # Emit D-Bus signal
 
853
        self.PropertyChanged(
 
854
            dbus.String("LastApprovalRequest"),
 
855
            (self._datetime_to_dbus(self.last_approval_request,
 
856
                                    variant_level=1)))
 
857
        return r
 
858
    
1330
859
    def start_checker(self, *args, **kwargs):
1331
860
        old_checker = self.checker
1332
861
        if self.checker is not None:
1339
868
            and old_checker_pid != self.checker.pid):
1340
869
            # Emit D-Bus signal
1341
870
            self.CheckerStarted(self.current_checker_command)
 
871
            self.PropertyChanged(
 
872
                dbus.String("CheckerRunning"),
 
873
                dbus.Boolean(True, variant_level=1))
1342
874
        return r
1343
875
    
 
876
    def stop_checker(self, *args, **kwargs):
 
877
        old_checker = getattr(self, "checker", None)
 
878
        r = Client.stop_checker(self, *args, **kwargs)
 
879
        if (old_checker is not None
 
880
            and getattr(self, "checker", None) is None):
 
881
            self.PropertyChanged(dbus.String("CheckerRunning"),
 
882
                                 dbus.Boolean(False, variant_level=1))
 
883
        return r
 
884
 
1344
885
    def _reset_approved(self):
1345
 
        self.approved = None
 
886
        self._approved = None
1346
887
        return False
1347
888
    
1348
889
    def approve(self, value=True):
1349
 
        self.approved = value
1350
 
        gobject.timeout_add(timedelta_to_milliseconds
 
890
        self.send_changedstate()
 
891
        self._approved = value
 
892
        gobject.timeout_add(self._timedelta_to_milliseconds
1351
893
                            (self.approval_duration),
1352
894
                            self._reset_approved)
1353
 
        self.send_changedstate()
 
895
    
1354
896
    
1355
897
    ## D-Bus methods, signals & properties
1356
 
    _interface = "se.recompile.Mandos.Client"
1357
 
    
1358
 
    ## Interfaces
1359
 
    
1360
 
    @dbus_interface_annotations(_interface)
1361
 
    def _foo(self):
1362
 
        return { "org.freedesktop.DBus.Property.EmitsChangedSignal":
1363
 
                     "false"}
 
898
    _interface = "se.bsnet.fukt.Mandos.Client"
1364
899
    
1365
900
    ## Signals
1366
901
    
1452
987
        if value is None:       # get
1453
988
            return dbus.Boolean(self.approved_by_default)
1454
989
        self.approved_by_default = bool(value)
 
990
        # Emit D-Bus signal
 
991
        self.PropertyChanged(dbus.String("ApprovedByDefault"),
 
992
                             dbus.Boolean(value, variant_level=1))
1455
993
    
1456
994
    # ApprovalDelay - property
1457
995
    @dbus_service_property(_interface, signature="t",
1460
998
        if value is None:       # get
1461
999
            return dbus.UInt64(self.approval_delay_milliseconds())
1462
1000
        self.approval_delay = datetime.timedelta(0, 0, 0, value)
 
1001
        # Emit D-Bus signal
 
1002
        self.PropertyChanged(dbus.String("ApprovalDelay"),
 
1003
                             dbus.UInt64(value, variant_level=1))
1463
1004
    
1464
1005
    # ApprovalDuration - property
1465
1006
    @dbus_service_property(_interface, signature="t",
1466
1007
                           access="readwrite")
1467
1008
    def ApprovalDuration_dbus_property(self, value=None):
1468
1009
        if value is None:       # get
1469
 
            return dbus.UInt64(timedelta_to_milliseconds(
 
1010
            return dbus.UInt64(self._timedelta_to_milliseconds(
1470
1011
                    self.approval_duration))
1471
1012
        self.approval_duration = datetime.timedelta(0, 0, 0, value)
 
1013
        # Emit D-Bus signal
 
1014
        self.PropertyChanged(dbus.String("ApprovalDuration"),
 
1015
                             dbus.UInt64(value, variant_level=1))
1472
1016
    
1473
1017
    # Name - property
1474
1018
    @dbus_service_property(_interface, signature="s", access="read")
1486
1030
    def Host_dbus_property(self, value=None):
1487
1031
        if value is None:       # get
1488
1032
            return dbus.String(self.host)
1489
 
        self.host = unicode(value)
 
1033
        self.host = value
 
1034
        # Emit D-Bus signal
 
1035
        self.PropertyChanged(dbus.String("Host"),
 
1036
                             dbus.String(value, variant_level=1))
1490
1037
    
1491
1038
    # Created - property
1492
1039
    @dbus_service_property(_interface, signature="s", access="read")
1493
1040
    def Created_dbus_property(self):
1494
 
        return datetime_to_dbus(self.created)
 
1041
        return dbus.String(self._datetime_to_dbus(self.created))
1495
1042
    
1496
1043
    # LastEnabled - property
1497
1044
    @dbus_service_property(_interface, signature="s", access="read")
1498
1045
    def LastEnabled_dbus_property(self):
1499
 
        return datetime_to_dbus(self.last_enabled)
 
1046
        if self.last_enabled is None:
 
1047
            return dbus.String("")
 
1048
        return dbus.String(self._datetime_to_dbus(self.last_enabled))
1500
1049
    
1501
1050
    # Enabled - property
1502
1051
    @dbus_service_property(_interface, signature="b",
1516
1065
        if value is not None:
1517
1066
            self.checked_ok()
1518
1067
            return
1519
 
        return datetime_to_dbus(self.last_checked_ok)
1520
 
    
1521
 
    # LastCheckerStatus - property
1522
 
    @dbus_service_property(_interface, signature="n",
1523
 
                           access="read")
1524
 
    def LastCheckerStatus_dbus_property(self):
1525
 
        return dbus.Int16(self.last_checker_status)
1526
 
    
1527
 
    # Expires - property
1528
 
    @dbus_service_property(_interface, signature="s", access="read")
1529
 
    def Expires_dbus_property(self):
1530
 
        return datetime_to_dbus(self.expires)
 
1068
        if self.last_checked_ok is None:
 
1069
            return dbus.String("")
 
1070
        return dbus.String(self._datetime_to_dbus(self
 
1071
                                                  .last_checked_ok))
1531
1072
    
1532
1073
    # LastApprovalRequest - property
1533
1074
    @dbus_service_property(_interface, signature="s", access="read")
1534
1075
    def LastApprovalRequest_dbus_property(self):
1535
 
        return datetime_to_dbus(self.last_approval_request)
 
1076
        if self.last_approval_request is None:
 
1077
            return dbus.String("")
 
1078
        return dbus.String(self.
 
1079
                           _datetime_to_dbus(self
 
1080
                                             .last_approval_request))
1536
1081
    
1537
1082
    # Timeout - property
1538
1083
    @dbus_service_property(_interface, signature="t",
1540
1085
    def Timeout_dbus_property(self, value=None):
1541
1086
        if value is None:       # get
1542
1087
            return dbus.UInt64(self.timeout_milliseconds())
1543
 
        old_timeout = self.timeout
1544
1088
        self.timeout = datetime.timedelta(0, 0, 0, value)
1545
 
        # Reschedule disabling
1546
 
        if self.enabled:
1547
 
            now = datetime.datetime.utcnow()
1548
 
            self.expires += self.timeout - old_timeout
1549
 
            if self.expires <= now:
1550
 
                # The timeout has passed
1551
 
                self.disable()
1552
 
            else:
1553
 
                if (getattr(self, "disable_initiator_tag", None)
1554
 
                    is None):
1555
 
                    return
1556
 
                gobject.source_remove(self.disable_initiator_tag)
1557
 
                self.disable_initiator_tag = (
1558
 
                    gobject.timeout_add(
1559
 
                        timedelta_to_milliseconds(self.expires - now),
1560
 
                        self.disable))
1561
 
    
1562
 
    # ExtendedTimeout - property
1563
 
    @dbus_service_property(_interface, signature="t",
1564
 
                           access="readwrite")
1565
 
    def ExtendedTimeout_dbus_property(self, value=None):
1566
 
        if value is None:       # get
1567
 
            return dbus.UInt64(self.extended_timeout_milliseconds())
1568
 
        self.extended_timeout = datetime.timedelta(0, 0, 0, value)
 
1089
        # Emit D-Bus signal
 
1090
        self.PropertyChanged(dbus.String("Timeout"),
 
1091
                             dbus.UInt64(value, variant_level=1))
 
1092
        if getattr(self, "disable_initiator_tag", None) is None:
 
1093
            return
 
1094
        # Reschedule timeout
 
1095
        gobject.source_remove(self.disable_initiator_tag)
 
1096
        self.disable_initiator_tag = None
 
1097
        time_to_die = (self.
 
1098
                       _timedelta_to_milliseconds((self
 
1099
                                                   .last_checked_ok
 
1100
                                                   + self.timeout)
 
1101
                                                  - datetime.datetime
 
1102
                                                  .utcnow()))
 
1103
        if time_to_die <= 0:
 
1104
            # The timeout has passed
 
1105
            self.disable()
 
1106
        else:
 
1107
            self.disable_initiator_tag = (gobject.timeout_add
 
1108
                                          (time_to_die, self.disable))
1569
1109
    
1570
1110
    # Interval - property
1571
1111
    @dbus_service_property(_interface, signature="t",
1574
1114
        if value is None:       # get
1575
1115
            return dbus.UInt64(self.interval_milliseconds())
1576
1116
        self.interval = datetime.timedelta(0, 0, 0, value)
 
1117
        # Emit D-Bus signal
 
1118
        self.PropertyChanged(dbus.String("Interval"),
 
1119
                             dbus.UInt64(value, variant_level=1))
1577
1120
        if getattr(self, "checker_initiator_tag", None) is None:
1578
1121
            return
1579
 
        if self.enabled:
1580
 
            # Reschedule checker run
1581
 
            gobject.source_remove(self.checker_initiator_tag)
1582
 
            self.checker_initiator_tag = (gobject.timeout_add
1583
 
                                          (value, self.start_checker))
1584
 
            self.start_checker()    # Start one now, too
1585
 
    
 
1122
        # Reschedule checker run
 
1123
        gobject.source_remove(self.checker_initiator_tag)
 
1124
        self.checker_initiator_tag = (gobject.timeout_add
 
1125
                                      (value, self.start_checker))
 
1126
        self.start_checker()    # Start one now, too
 
1127
 
1586
1128
    # Checker - property
1587
1129
    @dbus_service_property(_interface, signature="s",
1588
1130
                           access="readwrite")
1589
1131
    def Checker_dbus_property(self, value=None):
1590
1132
        if value is None:       # get
1591
1133
            return dbus.String(self.checker_command)
1592
 
        self.checker_command = unicode(value)
 
1134
        self.checker_command = value
 
1135
        # Emit D-Bus signal
 
1136
        self.PropertyChanged(dbus.String("Checker"),
 
1137
                             dbus.String(self.checker_command,
 
1138
                                         variant_level=1))
1593
1139
    
1594
1140
    # CheckerRunning - property
1595
1141
    @dbus_service_property(_interface, signature="b",
1622
1168
        self._pipe.send(('init', fpr, address))
1623
1169
        if not self._pipe.recv():
1624
1170
            raise KeyError()
1625
 
    
 
1171
 
1626
1172
    def __getattribute__(self, name):
1627
 
        if name == '_pipe':
 
1173
        if(name == '_pipe'):
1628
1174
            return super(ProxyClient, self).__getattribute__(name)
1629
1175
        self._pipe.send(('getattr', name))
1630
1176
        data = self._pipe.recv()
1635
1181
                self._pipe.send(('funcall', name, args, kwargs))
1636
1182
                return self._pipe.recv()[1]
1637
1183
            return func
1638
 
    
 
1184
 
1639
1185
    def __setattr__(self, name, value):
1640
 
        if name == '_pipe':
 
1186
        if(name == '_pipe'):
1641
1187
            return super(ProxyClient, self).__setattr__(name, value)
1642
1188
        self._pipe.send(('setattr', name, value))
1643
1189
 
1654
1200
                        unicode(self.client_address))
1655
1201
            logger.debug("Pipe FD: %d",
1656
1202
                         self.server.child_pipe.fileno())
1657
 
            
 
1203
 
1658
1204
            session = (gnutls.connection
1659
1205
                       .ClientSession(self.request,
1660
1206
                                      gnutls.connection
1661
1207
                                      .X509Credentials()))
1662
 
            
 
1208
 
1663
1209
            # Note: gnutls.connection.X509Credentials is really a
1664
1210
            # generic GnuTLS certificate credentials object so long as
1665
1211
            # no X.509 keys are added to it.  Therefore, we can use it
1666
1212
            # here despite using OpenPGP certificates.
1667
 
            
 
1213
 
1668
1214
            #priority = ':'.join(("NONE", "+VERS-TLS1.1",
1669
1215
            #                      "+AES-256-CBC", "+SHA1",
1670
1216
            #                      "+COMP-NULL", "+CTYPE-OPENPGP",
1676
1222
            (gnutls.library.functions
1677
1223
             .gnutls_priority_set_direct(session._c_object,
1678
1224
                                         priority, None))
1679
 
            
 
1225
 
1680
1226
            # Start communication using the Mandos protocol
1681
1227
            # Get protocol number
1682
1228
            line = self.request.makefile().readline()
1687
1233
            except (ValueError, IndexError, RuntimeError) as error:
1688
1234
                logger.error("Unknown protocol version: %s", error)
1689
1235
                return
1690
 
            
 
1236
 
1691
1237
            # Start GnuTLS connection
1692
1238
            try:
1693
1239
                session.handshake()
1697
1243
                # established.  Just abandon the request.
1698
1244
                return
1699
1245
            logger.debug("Handshake succeeded")
1700
 
            
 
1246
 
1701
1247
            approval_required = False
1702
1248
            try:
1703
1249
                try:
1708
1254
                    logger.warning("Bad certificate: %s", error)
1709
1255
                    return
1710
1256
                logger.debug("Fingerprint: %s", fpr)
1711
 
                
 
1257
 
1712
1258
                try:
1713
1259
                    client = ProxyClient(child_pipe, fpr,
1714
1260
                                         self.client_address)
1726
1272
                                       client.name)
1727
1273
                        if self.server.use_dbus:
1728
1274
                            # Emit D-Bus signal
1729
 
                            client.Rejected("Disabled")
 
1275
                            client.Rejected("Disabled")                    
1730
1276
                        return
1731
1277
                    
1732
 
                    if client.approved or not client.approval_delay:
 
1278
                    if client._approved or not client.approval_delay:
1733
1279
                        #We are approved or approval is disabled
1734
1280
                        break
1735
 
                    elif client.approved is None:
 
1281
                    elif client._approved is None:
1736
1282
                        logger.info("Client %s needs approval",
1737
1283
                                    client.name)
1738
1284
                        if self.server.use_dbus:
1749
1295
                        return
1750
1296
                    
1751
1297
                    #wait until timeout or approved
 
1298
                    #x = float(client._timedelta_to_milliseconds(delay))
1752
1299
                    time = datetime.datetime.now()
1753
1300
                    client.changedstate.acquire()
1754
 
                    client.changedstate.wait(
1755
 
                        float(timedelta_to_milliseconds(delay)
1756
 
                              / 1000))
 
1301
                    client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))
1757
1302
                    client.changedstate.release()
1758
1303
                    time2 = datetime.datetime.now()
1759
1304
                    if (time2 - time) >= delay:
1775
1320
                    try:
1776
1321
                        sent = session.send(client.secret[sent_size:])
1777
1322
                    except gnutls.errors.GNUTLSError as error:
1778
 
                        logger.warning("gnutls send failed",
1779
 
                                       exc_info=error)
 
1323
                        logger.warning("gnutls send failed")
1780
1324
                        return
1781
1325
                    logger.debug("Sent: %d, remaining: %d",
1782
1326
                                 sent, len(client.secret)
1783
1327
                                 - (sent_size + sent))
1784
1328
                    sent_size += sent
1785
 
                
 
1329
 
1786
1330
                logger.info("Sending secret to %s", client.name)
1787
 
                # bump the timeout using extended_timeout
1788
 
                client.bump_timeout(client.extended_timeout)
 
1331
                # bump the timeout as if seen
 
1332
                client.checked_ok()
1789
1333
                if self.server.use_dbus:
1790
1334
                    # Emit D-Bus signal
1791
1335
                    client.GotSecret()
1796
1340
                try:
1797
1341
                    session.bye()
1798
1342
                except gnutls.errors.GNUTLSError as error:
1799
 
                    logger.warning("GnuTLS bye failed",
1800
 
                                   exc_info=error)
 
1343
                    logger.warning("GnuTLS bye failed")
1801
1344
    
1802
1345
    @staticmethod
1803
1346
    def peer_certificate(session):
1859
1402
        # Convert the buffer to a Python bytestring
1860
1403
        fpr = ctypes.string_at(buf, buf_len.value)
1861
1404
        # Convert the bytestring to hexadecimal notation
1862
 
        hex_fpr = binascii.hexlify(fpr).upper()
 
1405
        hex_fpr = ''.join("%02X" % ord(char) for char in fpr)
1863
1406
        return hex_fpr
1864
1407
 
1865
1408
 
1868
1411
    def sub_process_main(self, request, address):
1869
1412
        try:
1870
1413
            self.finish_request(request, address)
1871
 
        except Exception:
 
1414
        except:
1872
1415
            self.handle_error(request, address)
1873
1416
        self.close_request(request)
1874
 
    
 
1417
            
1875
1418
    def process_request(self, request, address):
1876
1419
        """Start a new process to process the request."""
1877
 
        proc = multiprocessing.Process(target = self.sub_process_main,
1878
 
                                       args = (request, address))
1879
 
        proc.start()
1880
 
        return proc
1881
 
 
 
1420
        multiprocessing.Process(target = self.sub_process_main,
 
1421
                                args = (request, address)).start()
1882
1422
 
1883
1423
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
1884
1424
    """ adds a pipe to the MixIn """
1888
1428
        This function creates a new pipe in self.pipe
1889
1429
        """
1890
1430
        parent_pipe, self.child_pipe = multiprocessing.Pipe()
1891
 
        
1892
 
        proc = MultiprocessingMixIn.process_request(self, request,
1893
 
                                                    client_address)
 
1431
 
 
1432
        super(MultiprocessingMixInWithPipe,
 
1433
              self).process_request(request, client_address)
1894
1434
        self.child_pipe.close()
1895
 
        self.add_pipe(parent_pipe, proc)
1896
 
    
1897
 
    def add_pipe(self, parent_pipe, proc):
 
1435
        self.add_pipe(parent_pipe)
 
1436
 
 
1437
    def add_pipe(self, parent_pipe):
1898
1438
        """Dummy function; override as necessary"""
1899
1439
        raise NotImplementedError
1900
1440
 
1901
 
 
1902
1441
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
1903
1442
                     socketserver.TCPServer, object):
1904
1443
    """IPv6-capable TCP server.  Accepts 'None' as address and/or port
1909
1448
        use_ipv6:       Boolean; to use IPv6 or not
1910
1449
    """
1911
1450
    def __init__(self, server_address, RequestHandlerClass,
1912
 
                 interface=None, use_ipv6=True, socketfd=None):
1913
 
        """If socketfd is set, use that file descriptor instead of
1914
 
        creating a new one with socket.socket().
1915
 
        """
 
1451
                 interface=None, use_ipv6=True):
1916
1452
        self.interface = interface
1917
1453
        if use_ipv6:
1918
1454
            self.address_family = socket.AF_INET6
1919
 
        if socketfd is not None:
1920
 
            # Save the file descriptor
1921
 
            self.socketfd = socketfd
1922
 
            # Save the original socket.socket() function
1923
 
            self.socket_socket = socket.socket
1924
 
            # To implement --socket, we monkey patch socket.socket.
1925
 
            # 
1926
 
            # (When socketserver.TCPServer is a new-style class, we
1927
 
            # could make self.socket into a property instead of monkey
1928
 
            # patching socket.socket.)
1929
 
            # 
1930
 
            # Create a one-time-only replacement for socket.socket()
1931
 
            @functools.wraps(socket.socket)
1932
 
            def socket_wrapper(*args, **kwargs):
1933
 
                # Restore original function so subsequent calls are
1934
 
                # not affected.
1935
 
                socket.socket = self.socket_socket
1936
 
                del self.socket_socket
1937
 
                # This time only, return a new socket object from the
1938
 
                # saved file descriptor.
1939
 
                return socket.fromfd(self.socketfd, *args, **kwargs)
1940
 
            # Replace socket.socket() function with wrapper
1941
 
            socket.socket = socket_wrapper
1942
 
        # The socketserver.TCPServer.__init__ will call
1943
 
        # socket.socket(), which might be our replacement,
1944
 
        # socket_wrapper(), if socketfd was set.
1945
1455
        socketserver.TCPServer.__init__(self, server_address,
1946
1456
                                        RequestHandlerClass)
1947
 
    
1948
1457
    def server_bind(self):
1949
1458
        """This overrides the normal server_bind() function
1950
1459
        to bind to an interface if one was specified, and also NOT to
1958
1467
                try:
1959
1468
                    self.socket.setsockopt(socket.SOL_SOCKET,
1960
1469
                                           SO_BINDTODEVICE,
1961
 
                                           str(self.interface + '\0'))
 
1470
                                           str(self.interface
 
1471
                                               + '\0'))
1962
1472
                except socket.error as error:
1963
 
                    if error.errno == errno.EPERM:
1964
 
                        logger.error("No permission to bind to"
1965
 
                                     " interface %s", self.interface)
1966
 
                    elif error.errno == errno.ENOPROTOOPT:
 
1473
                    if error[0] == errno.EPERM:
 
1474
                        logger.error("No permission to"
 
1475
                                     " bind to interface %s",
 
1476
                                     self.interface)
 
1477
                    elif error[0] == errno.ENOPROTOOPT:
1967
1478
                        logger.error("SO_BINDTODEVICE not available;"
1968
1479
                                     " cannot bind to interface %s",
1969
1480
                                     self.interface)
1970
 
                    elif error.errno == errno.ENODEV:
1971
 
                        logger.error("Interface %s does not exist,"
1972
 
                                     " cannot bind", self.interface)
1973
1481
                    else:
1974
1482
                        raise
1975
1483
        # Only bind(2) the socket if we really need to.
2005
1513
    """
2006
1514
    def __init__(self, server_address, RequestHandlerClass,
2007
1515
                 interface=None, use_ipv6=True, clients=None,
2008
 
                 gnutls_priority=None, use_dbus=True, socketfd=None):
 
1516
                 gnutls_priority=None, use_dbus=True):
2009
1517
        self.enabled = False
2010
1518
        self.clients = clients
2011
1519
        if self.clients is None:
2012
 
            self.clients = {}
 
1520
            self.clients = set()
2013
1521
        self.use_dbus = use_dbus
2014
1522
        self.gnutls_priority = gnutls_priority
2015
1523
        IPv6_TCPServer.__init__(self, server_address,
2016
1524
                                RequestHandlerClass,
2017
1525
                                interface = interface,
2018
 
                                use_ipv6 = use_ipv6,
2019
 
                                socketfd = socketfd)
 
1526
                                use_ipv6 = use_ipv6)
2020
1527
    def server_activate(self):
2021
1528
        if self.enabled:
2022
1529
            return socketserver.TCPServer.server_activate(self)
2023
 
    
2024
1530
    def enable(self):
2025
1531
        self.enabled = True
2026
 
    
2027
 
    def add_pipe(self, parent_pipe, proc):
 
1532
    def add_pipe(self, parent_pipe):
2028
1533
        # Call "handle_ipc" for both data and EOF events
2029
1534
        gobject.io_add_watch(parent_pipe.fileno(),
2030
1535
                             gobject.IO_IN | gobject.IO_HUP,
2031
1536
                             functools.partial(self.handle_ipc,
2032
 
                                               parent_pipe =
2033
 
                                               parent_pipe,
2034
 
                                               proc = proc))
2035
 
    
 
1537
                                               parent_pipe = parent_pipe))
 
1538
        
2036
1539
    def handle_ipc(self, source, condition, parent_pipe=None,
2037
 
                   proc = None, client_object=None):
2038
 
        # error, or the other end of multiprocessing.Pipe has closed
2039
 
        if condition & (gobject.IO_ERR | gobject.IO_HUP):
2040
 
            # Wait for other process to exit
2041
 
            proc.join()
 
1540
                   client_object=None):
 
1541
        condition_names = {
 
1542
            gobject.IO_IN: "IN",   # There is data to read.
 
1543
            gobject.IO_OUT: "OUT", # Data can be written (without
 
1544
                                    # blocking).
 
1545
            gobject.IO_PRI: "PRI", # There is urgent data to read.
 
1546
            gobject.IO_ERR: "ERR", # Error condition.
 
1547
            gobject.IO_HUP: "HUP"  # Hung up (the connection has been
 
1548
                                    # broken, usually for pipes and
 
1549
                                    # sockets).
 
1550
            }
 
1551
        conditions_string = ' | '.join(name
 
1552
                                       for cond, name in
 
1553
                                       condition_names.iteritems()
 
1554
                                       if cond & condition)
 
1555
        # error or the other end of multiprocessing.Pipe has closed
 
1556
        if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):
2042
1557
            return False
2043
1558
        
2044
1559
        # Read a request from the child
2049
1564
            fpr = request[1]
2050
1565
            address = request[2]
2051
1566
            
2052
 
            for c in self.clients.itervalues():
 
1567
            for c in self.clients:
2053
1568
                if c.fingerprint == fpr:
2054
1569
                    client = c
2055
1570
                    break
2058
1573
                            "dress: %s", fpr, address)
2059
1574
                if self.use_dbus:
2060
1575
                    # Emit D-Bus signal
2061
 
                    mandos_dbus_service.ClientNotFound(fpr,
2062
 
                                                       address[0])
 
1576
                    mandos_dbus_service.ClientNotFound(fpr, address[0])
2063
1577
                parent_pipe.send(False)
2064
1578
                return False
2065
1579
            
2066
1580
            gobject.io_add_watch(parent_pipe.fileno(),
2067
1581
                                 gobject.IO_IN | gobject.IO_HUP,
2068
1582
                                 functools.partial(self.handle_ipc,
2069
 
                                                   parent_pipe =
2070
 
                                                   parent_pipe,
2071
 
                                                   proc = proc,
2072
 
                                                   client_object =
2073
 
                                                   client))
 
1583
                                                   parent_pipe = parent_pipe,
 
1584
                                                   client_object = client))
2074
1585
            parent_pipe.send(True)
2075
 
            # remove the old hook in favor of the new above hook on
2076
 
            # same fileno
 
1586
            # remove the old hook in favor of the new above hook on same fileno
2077
1587
            return False
2078
1588
        if command == 'funcall':
2079
1589
            funcname = request[1]
2080
1590
            args = request[2]
2081
1591
            kwargs = request[3]
2082
1592
            
2083
 
            parent_pipe.send(('data', getattr(client_object,
2084
 
                                              funcname)(*args,
2085
 
                                                         **kwargs)))
2086
 
        
 
1593
            parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))
 
1594
 
2087
1595
        if command == 'getattr':
2088
1596
            attrname = request[1]
2089
1597
            if callable(client_object.__getattribute__(attrname)):
2090
1598
                parent_pipe.send(('function',))
2091
1599
            else:
2092
 
                parent_pipe.send(('data', client_object
2093
 
                                  .__getattribute__(attrname)))
 
1600
                parent_pipe.send(('data', client_object.__getattribute__(attrname)))
2094
1601
        
2095
1602
        if command == 'setattr':
2096
1603
            attrname = request[1]
2097
1604
            value = request[2]
2098
1605
            setattr(client_object, attrname, value)
2099
 
        
 
1606
 
2100
1607
        return True
2101
1608
 
2102
1609
 
2103
 
def rfc3339_duration_to_delta(duration):
2104
 
    """Parse an RFC 3339 "duration" and return a datetime.timedelta
2105
 
    
2106
 
    >>> rfc3339_duration_to_delta("P7D")
2107
 
    datetime.timedelta(7)
2108
 
    >>> rfc3339_duration_to_delta("PT60S")
2109
 
    datetime.timedelta(0, 60)
2110
 
    >>> rfc3339_duration_to_delta("PT60M")
2111
 
    datetime.timedelta(0, 3600)
2112
 
    >>> rfc3339_duration_to_delta("PT24H")
2113
 
    datetime.timedelta(1)
2114
 
    >>> rfc3339_duration_to_delta("P1W")
2115
 
    datetime.timedelta(7)
2116
 
    >>> rfc3339_duration_to_delta("PT5M30S")
2117
 
    datetime.timedelta(0, 330)
2118
 
    >>> rfc3339_duration_to_delta("P1DT3M20S")
2119
 
    datetime.timedelta(1, 200)
2120
 
    """
2121
 
    
2122
 
    # Parsing an RFC 3339 duration with regular expressions is not
2123
 
    # possible - there would have to be multiple places for the same
2124
 
    # values, like seconds.  The current code, while more esoteric, is
2125
 
    # cleaner without depending on a parsing library.  If Python had a
2126
 
    # built-in library for parsing we would use it, but we'd like to
2127
 
    # avoid excessive use of external libraries.
2128
 
    
2129
 
    # New type for defining tokens, syntax, and semantics all-in-one
2130
 
    Token = collections.namedtuple("Token",
2131
 
                                   ("regexp", # To match token; if
2132
 
                                              # "value" is not None,
2133
 
                                              # must have a "group"
2134
 
                                              # containing digits
2135
 
                                    "value",  # datetime.timedelta or
2136
 
                                              # None
2137
 
                                    "followers")) # Tokens valid after
2138
 
                                                  # this token
2139
 
    # RFC 3339 "duration" tokens, syntax, and semantics; taken from
2140
 
    # the "duration" ABNF definition in RFC 3339, Appendix A.
2141
 
    token_end = Token(re.compile(r"$"), None, frozenset())
2142
 
    token_second = Token(re.compile(r"(\d+)S"),
2143
 
                         datetime.timedelta(seconds=1),
2144
 
                         frozenset((token_end,)))
2145
 
    token_minute = Token(re.compile(r"(\d+)M"),
2146
 
                         datetime.timedelta(minutes=1),
2147
 
                         frozenset((token_second, token_end)))
2148
 
    token_hour = Token(re.compile(r"(\d+)H"),
2149
 
                       datetime.timedelta(hours=1),
2150
 
                       frozenset((token_minute, token_end)))
2151
 
    token_time = Token(re.compile(r"T"),
2152
 
                       None,
2153
 
                       frozenset((token_hour, token_minute,
2154
 
                                  token_second)))
2155
 
    token_day = Token(re.compile(r"(\d+)D"),
2156
 
                      datetime.timedelta(days=1),
2157
 
                      frozenset((token_time, token_end)))
2158
 
    token_month = Token(re.compile(r"(\d+)M"),
2159
 
                        datetime.timedelta(weeks=4),
2160
 
                        frozenset((token_day, token_end)))
2161
 
    token_year = Token(re.compile(r"(\d+)Y"),
2162
 
                       datetime.timedelta(weeks=52),
2163
 
                       frozenset((token_month, token_end)))
2164
 
    token_week = Token(re.compile(r"(\d+)W"),
2165
 
                       datetime.timedelta(weeks=1),
2166
 
                       frozenset((token_end,)))
2167
 
    token_duration = Token(re.compile(r"P"), None,
2168
 
                           frozenset((token_year, token_month,
2169
 
                                      token_day, token_time,
2170
 
                                      token_week))),
2171
 
    # Define starting values
2172
 
    value = datetime.timedelta() # Value so far
2173
 
    found_token = None
2174
 
    followers = frozenset(token_duration,) # Following valid tokens
2175
 
    s = duration                # String left to parse
2176
 
    # Loop until end token is found
2177
 
    while found_token is not token_end:
2178
 
        # Search for any currently valid tokens
2179
 
        for token in followers:
2180
 
            match = token.regexp.match(s)
2181
 
            if match is not None:
2182
 
                # Token found
2183
 
                if token.value is not None:
2184
 
                    # Value found, parse digits
2185
 
                    factor = int(match.group(1), 10)
2186
 
                    # Add to value so far
2187
 
                    value += factor * token.value
2188
 
                # Strip token from string
2189
 
                s = token.regexp.sub("", s, 1)
2190
 
                # Go to found token
2191
 
                found_token = token
2192
 
                # Set valid next tokens
2193
 
                followers = found_token.followers
2194
 
                break
2195
 
        else:
2196
 
            # No currently valid tokens were found
2197
 
            raise ValueError("Invalid RFC 3339 duration")
2198
 
    # End token found
2199
 
    return value
2200
 
 
2201
 
 
2202
1610
def string_to_delta(interval):
2203
1611
    """Parse a string and return a datetime.timedelta
2204
1612
    
2215
1623
    >>> string_to_delta('5m 30s')
2216
1624
    datetime.timedelta(0, 330)
2217
1625
    """
2218
 
    
2219
 
    try:
2220
 
        return rfc3339_duration_to_delta(interval)
2221
 
    except ValueError:
2222
 
        pass
2223
 
    
2224
1626
    timevalue = datetime.timedelta(0)
2225
1627
    for s in interval.split():
2226
1628
        try:
2237
1639
            elif suffix == "w":
2238
1640
                delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
2239
1641
            else:
2240
 
                raise ValueError("Unknown suffix {0!r}"
2241
 
                                 .format(suffix))
 
1642
                raise ValueError("Unknown suffix %r" % suffix)
2242
1643
        except (ValueError, IndexError) as e:
2243
1644
            raise ValueError(*(e.args))
2244
1645
        timevalue += delta
2245
1646
    return timevalue
2246
1647
 
2247
1648
 
 
1649
def if_nametoindex(interface):
 
1650
    """Call the C function if_nametoindex(), or equivalent
 
1651
    
 
1652
    Note: This function cannot accept a unicode string."""
 
1653
    global if_nametoindex
 
1654
    try:
 
1655
        if_nametoindex = (ctypes.cdll.LoadLibrary
 
1656
                          (ctypes.util.find_library("c"))
 
1657
                          .if_nametoindex)
 
1658
    except (OSError, AttributeError):
 
1659
        logger.warning("Doing if_nametoindex the hard way")
 
1660
        def if_nametoindex(interface):
 
1661
            "Get an interface index the hard way, i.e. using fcntl()"
 
1662
            SIOCGIFINDEX = 0x8933  # From /usr/include/linux/sockios.h
 
1663
            with contextlib.closing(socket.socket()) as s:
 
1664
                ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
 
1665
                                    struct.pack(str("16s16x"),
 
1666
                                                interface))
 
1667
            interface_index = struct.unpack(str("I"),
 
1668
                                            ifreq[16:20])[0]
 
1669
            return interface_index
 
1670
    return if_nametoindex(interface)
 
1671
 
 
1672
 
2248
1673
def daemon(nochdir = False, noclose = False):
2249
1674
    """See daemon(3).  Standard BSD Unix function.
2250
1675
    
2258
1683
        sys.exit()
2259
1684
    if not noclose:
2260
1685
        # Close all standard open file descriptors
2261
 
        null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
 
1686
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
2262
1687
        if not stat.S_ISCHR(os.fstat(null).st_mode):
2263
1688
            raise OSError(errno.ENODEV,
2264
 
                          "{0} not a character device"
2265
 
                          .format(os.devnull))
 
1689
                          "%s not a character device"
 
1690
                          % os.path.devnull)
2266
1691
        os.dup2(null, sys.stdin.fileno())
2267
1692
        os.dup2(null, sys.stdout.fileno())
2268
1693
        os.dup2(null, sys.stderr.fileno())
2277
1702
    
2278
1703
    parser = argparse.ArgumentParser()
2279
1704
    parser.add_argument("-v", "--version", action="version",
2280
 
                        version = "%(prog)s {0}".format(version),
 
1705
                        version = "%%(prog)s %s" % version,
2281
1706
                        help="show version number and exit")
2282
1707
    parser.add_argument("-i", "--interface", metavar="IF",
2283
1708
                        help="Bind to interface IF")
2305
1730
                        " system bus interface")
2306
1731
    parser.add_argument("--no-ipv6", action="store_false",
2307
1732
                        dest="use_ipv6", help="Do not use IPv6")
2308
 
    parser.add_argument("--no-restore", action="store_false",
2309
 
                        dest="restore", help="Do not restore stored"
2310
 
                        " state")
2311
 
    parser.add_argument("--socket", type=int,
2312
 
                        help="Specify a file descriptor to a network"
2313
 
                        " socket to use instead of creating one")
2314
 
    parser.add_argument("--statedir", metavar="DIR",
2315
 
                        help="Directory to save/restore state in")
2316
 
    parser.add_argument("--foreground", action="store_true",
2317
 
                        help="Run in foreground")
2318
 
    
2319
1733
    options = parser.parse_args()
2320
1734
    
2321
1735
    if options.check:
2334
1748
                        "use_dbus": "True",
2335
1749
                        "use_ipv6": "True",
2336
1750
                        "debuglevel": "",
2337
 
                        "restore": "True",
2338
 
                        "socket": "",
2339
 
                        "statedir": "/var/lib/mandos",
2340
 
                        "foreground": "False",
2341
1751
                        }
2342
1752
    
2343
1753
    # Parse config file for server-global settings
2348
1758
    # Convert the SafeConfigParser object to a dict
2349
1759
    server_settings = server_config.defaults()
2350
1760
    # Use the appropriate methods on the non-string config options
2351
 
    for option in ("debug", "use_dbus", "use_ipv6", "foreground"):
 
1761
    for option in ("debug", "use_dbus", "use_ipv6"):
2352
1762
        server_settings[option] = server_config.getboolean("DEFAULT",
2353
1763
                                                           option)
2354
1764
    if server_settings["port"]:
2355
1765
        server_settings["port"] = server_config.getint("DEFAULT",
2356
1766
                                                       "port")
2357
 
    if server_settings["socket"]:
2358
 
        server_settings["socket"] = server_config.getint("DEFAULT",
2359
 
                                                         "socket")
2360
 
        # Later, stdin will, and stdout and stderr might, be dup'ed
2361
 
        # over with an opened os.devnull.  But we don't want this to
2362
 
        # happen with a supplied network socket.
2363
 
        if 0 <= server_settings["socket"] <= 2:
2364
 
            server_settings["socket"] = os.dup(server_settings
2365
 
                                               ["socket"])
2366
1767
    del server_config
2367
1768
    
2368
1769
    # Override the settings from the config file with command line
2369
1770
    # options, if set.
2370
1771
    for option in ("interface", "address", "port", "debug",
2371
1772
                   "priority", "servicename", "configdir",
2372
 
                   "use_dbus", "use_ipv6", "debuglevel", "restore",
2373
 
                   "statedir", "socket", "foreground"):
 
1773
                   "use_dbus", "use_ipv6", "debuglevel"):
2374
1774
        value = getattr(options, option)
2375
1775
        if value is not None:
2376
1776
            server_settings[option] = value
2379
1779
    for option in server_settings.keys():
2380
1780
        if type(server_settings[option]) is str:
2381
1781
            server_settings[option] = unicode(server_settings[option])
2382
 
    # Debug implies foreground
2383
 
    if server_settings["debug"]:
2384
 
        server_settings["foreground"] = True
2385
1782
    # Now we have our good server settings in "server_settings"
2386
1783
    
2387
1784
    ##################################################################
2391
1788
    debuglevel = server_settings["debuglevel"]
2392
1789
    use_dbus = server_settings["use_dbus"]
2393
1790
    use_ipv6 = server_settings["use_ipv6"]
2394
 
    stored_state_path = os.path.join(server_settings["statedir"],
2395
 
                                     stored_state_file)
2396
 
    foreground = server_settings["foreground"]
2397
 
    
2398
 
    if debug:
2399
 
        initlogger(debug, logging.DEBUG)
2400
 
    else:
2401
 
        if not debuglevel:
2402
 
            initlogger(debug)
2403
 
        else:
2404
 
            level = getattr(logging, debuglevel.upper())
2405
 
            initlogger(debug, level)
2406
 
    
 
1791
 
2407
1792
    if server_settings["servicename"] != "Mandos":
2408
1793
        syslogger.setFormatter(logging.Formatter
2409
 
                               ('Mandos ({0}) [%(process)d]:'
2410
 
                                ' %(levelname)s: %(message)s'
2411
 
                                .format(server_settings
2412
 
                                        ["servicename"])))
 
1794
                               ('Mandos (%s) [%%(process)d]:'
 
1795
                                ' %%(levelname)s: %%(message)s'
 
1796
                                % server_settings["servicename"]))
2413
1797
    
2414
1798
    # Parse config file with clients
2415
 
    client_config = configparser.SafeConfigParser(Client
2416
 
                                                  .client_defaults)
 
1799
    client_defaults = { "timeout": "1h",
 
1800
                        "interval": "5m",
 
1801
                        "checker": "fping -q -- %%(host)s",
 
1802
                        "host": "",
 
1803
                        "approval_delay": "0s",
 
1804
                        "approval_duration": "1s",
 
1805
                        }
 
1806
    client_config = configparser.SafeConfigParser(client_defaults)
2417
1807
    client_config.read(os.path.join(server_settings["configdir"],
2418
1808
                                    "clients.conf"))
2419
1809
    
2428
1818
                              use_ipv6=use_ipv6,
2429
1819
                              gnutls_priority=
2430
1820
                              server_settings["priority"],
2431
 
                              use_dbus=use_dbus,
2432
 
                              socketfd=(server_settings["socket"]
2433
 
                                        or None))
2434
 
    if not foreground:
 
1821
                              use_dbus=use_dbus)
 
1822
    if not debug:
2435
1823
        pidfilename = "/var/run/mandos.pid"
2436
 
        pidfile = None
2437
1824
        try:
2438
1825
            pidfile = open(pidfilename, "w")
2439
 
        except IOError as e:
2440
 
            logger.error("Could not open file %r", pidfilename,
2441
 
                         exc_info=e)
 
1826
        except IOError:
 
1827
            logger.error("Could not open file %r", pidfilename)
2442
1828
    
2443
 
    for name in ("_mandos", "mandos", "nobody"):
 
1829
    try:
 
1830
        uid = pwd.getpwnam("_mandos").pw_uid
 
1831
        gid = pwd.getpwnam("_mandos").pw_gid
 
1832
    except KeyError:
2444
1833
        try:
2445
 
            uid = pwd.getpwnam(name).pw_uid
2446
 
            gid = pwd.getpwnam(name).pw_gid
2447
 
            break
 
1834
            uid = pwd.getpwnam("mandos").pw_uid
 
1835
            gid = pwd.getpwnam("mandos").pw_gid
2448
1836
        except KeyError:
2449
 
            continue
2450
 
    else:
2451
 
        uid = 65534
2452
 
        gid = 65534
 
1837
            try:
 
1838
                uid = pwd.getpwnam("nobody").pw_uid
 
1839
                gid = pwd.getpwnam("nobody").pw_gid
 
1840
            except KeyError:
 
1841
                uid = 65534
 
1842
                gid = 65534
2453
1843
    try:
2454
1844
        os.setgid(gid)
2455
1845
        os.setuid(uid)
2456
1846
    except OSError as error:
2457
 
        if error.errno != errno.EPERM:
 
1847
        if error[0] != errno.EPERM:
2458
1848
            raise error
2459
1849
    
 
1850
    if not debug and not debuglevel:
 
1851
        syslogger.setLevel(logging.WARNING)
 
1852
        console.setLevel(logging.WARNING)
 
1853
    if debuglevel:
 
1854
        level = getattr(logging, debuglevel.upper())
 
1855
        syslogger.setLevel(level)
 
1856
        console.setLevel(level)
 
1857
 
2460
1858
    if debug:
2461
1859
        # Enable all possible GnuTLS debugging
2462
1860
        
2472
1870
         .gnutls_global_set_log_function(debug_gnutls))
2473
1871
        
2474
1872
        # Redirect stdin so all checkers get /dev/null
2475
 
        null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
 
1873
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
2476
1874
        os.dup2(null, sys.stdin.fileno())
2477
1875
        if null > 2:
2478
1876
            os.close(null)
 
1877
    else:
 
1878
        # No console logging
 
1879
        logger.removeHandler(console)
2479
1880
    
2480
1881
    # Need to fork before connecting to D-Bus
2481
 
    if not foreground:
 
1882
    if not debug:
2482
1883
        # Close all input and output, do double fork, etc.
2483
1884
        daemon()
2484
1885
    
2485
 
    # multiprocessing will use threads, so before we use gobject we
2486
 
    # need to inform gobject that threads will be used.
2487
 
    gobject.threads_init()
2488
 
    
2489
1886
    global main_loop
2490
1887
    # From the Avahi example code
2491
 
    DBusGMainLoop(set_as_default=True)
 
1888
    DBusGMainLoop(set_as_default=True )
2492
1889
    main_loop = gobject.MainLoop()
2493
1890
    bus = dbus.SystemBus()
2494
1891
    # End of Avahi example code
2495
1892
    if use_dbus:
2496
1893
        try:
2497
 
            bus_name = dbus.service.BusName("se.recompile.Mandos",
 
1894
            bus_name = dbus.service.BusName("se.bsnet.fukt.Mandos",
2498
1895
                                            bus, do_not_queue=True)
2499
 
            old_bus_name = (dbus.service.BusName
2500
 
                            ("se.bsnet.fukt.Mandos", bus,
2501
 
                             do_not_queue=True))
2502
1896
        except dbus.exceptions.NameExistsException as e:
2503
 
            logger.error("Disabling D-Bus:", exc_info=e)
 
1897
            logger.error(unicode(e) + ", disabling D-Bus")
2504
1898
            use_dbus = False
2505
1899
            server_settings["use_dbus"] = False
2506
1900
            tcp_server.use_dbus = False
2507
1901
    protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2508
 
    service = AvahiServiceToSyslog(name =
2509
 
                                   server_settings["servicename"],
2510
 
                                   servicetype = "_mandos._tcp",
2511
 
                                   protocol = protocol, bus = bus)
 
1902
    service = AvahiService(name = server_settings["servicename"],
 
1903
                           servicetype = "_mandos._tcp",
 
1904
                           protocol = protocol, bus = bus)
2512
1905
    if server_settings["interface"]:
2513
1906
        service.interface = (if_nametoindex
2514
1907
                             (str(server_settings["interface"])))
2519
1912
    client_class = Client
2520
1913
    if use_dbus:
2521
1914
        client_class = functools.partial(ClientDBus, bus = bus)
2522
 
    
2523
 
    client_settings = Client.config_parser(client_config)
2524
 
    old_client_settings = {}
2525
 
    clients_data = {}
2526
 
    
2527
 
    # Get client data and settings from last running state.
2528
 
    if server_settings["restore"]:
2529
 
        try:
2530
 
            with open(stored_state_path, "rb") as stored_state:
2531
 
                clients_data, old_client_settings = (pickle.load
2532
 
                                                     (stored_state))
2533
 
            os.remove(stored_state_path)
2534
 
        except IOError as e:
2535
 
            if e.errno == errno.ENOENT:
2536
 
                logger.warning("Could not load persistent state: {0}"
2537
 
                                .format(os.strerror(e.errno)))
2538
 
            else:
2539
 
                logger.critical("Could not load persistent state:",
2540
 
                                exc_info=e)
2541
 
                raise
2542
 
        except EOFError as e:
2543
 
            logger.warning("Could not load persistent state: "
2544
 
                           "EOFError:", exc_info=e)
2545
 
    
2546
 
    with PGPEngine() as pgp:
2547
 
        for client_name, client in clients_data.iteritems():
2548
 
            # Decide which value to use after restoring saved state.
2549
 
            # We have three different values: Old config file,
2550
 
            # new config file, and saved state.
2551
 
            # New config value takes precedence if it differs from old
2552
 
            # config value, otherwise use saved state.
2553
 
            for name, value in client_settings[client_name].items():
2554
 
                try:
2555
 
                    # For each value in new config, check if it
2556
 
                    # differs from the old config value (Except for
2557
 
                    # the "secret" attribute)
2558
 
                    if (name != "secret" and
2559
 
                        value != old_client_settings[client_name]
2560
 
                        [name]):
2561
 
                        client[name] = value
2562
 
                except KeyError:
2563
 
                    pass
2564
 
            
2565
 
            # Clients who has passed its expire date can still be
2566
 
            # enabled if its last checker was successful.  Clients
2567
 
            # whose checker succeeded before we stored its state is
2568
 
            # assumed to have successfully run all checkers during
2569
 
            # downtime.
2570
 
            if client["enabled"]:
2571
 
                if datetime.datetime.utcnow() >= client["expires"]:
2572
 
                    if not client["last_checked_ok"]:
2573
 
                        logger.warning(
2574
 
                            "disabling client {0} - Client never "
2575
 
                            "performed a successful checker"
2576
 
                            .format(client_name))
2577
 
                        client["enabled"] = False
2578
 
                    elif client["last_checker_status"] != 0:
2579
 
                        logger.warning(
2580
 
                            "disabling client {0} - Client "
2581
 
                            "last checker failed with error code {1}"
2582
 
                            .format(client_name,
2583
 
                                    client["last_checker_status"]))
2584
 
                        client["enabled"] = False
2585
 
                    else:
2586
 
                        client["expires"] = (datetime.datetime
2587
 
                                             .utcnow()
2588
 
                                             + client["timeout"])
2589
 
                        logger.debug("Last checker succeeded,"
2590
 
                                     " keeping {0} enabled"
2591
 
                                     .format(client_name))
 
1915
    def client_config_items(config, section):
 
1916
        special_settings = {
 
1917
            "approved_by_default":
 
1918
                lambda: config.getboolean(section,
 
1919
                                          "approved_by_default"),
 
1920
            }
 
1921
        for name, value in config.items(section):
2592
1922
            try:
2593
 
                client["secret"] = (
2594
 
                    pgp.decrypt(client["encrypted_secret"],
2595
 
                                client_settings[client_name]
2596
 
                                ["secret"]))
2597
 
            except PGPError:
2598
 
                # If decryption fails, we use secret from new settings
2599
 
                logger.debug("Failed to decrypt {0} old secret"
2600
 
                             .format(client_name))
2601
 
                client["secret"] = (
2602
 
                    client_settings[client_name]["secret"])
2603
 
    
2604
 
    # Add/remove clients based on new changes made to config
2605
 
    for client_name in (set(old_client_settings)
2606
 
                        - set(client_settings)):
2607
 
        del clients_data[client_name]
2608
 
    for client_name in (set(client_settings)
2609
 
                        - set(old_client_settings)):
2610
 
        clients_data[client_name] = client_settings[client_name]
2611
 
    
2612
 
    # Create all client objects
2613
 
    for client_name, client in clients_data.iteritems():
2614
 
        tcp_server.clients[client_name] = client_class(
2615
 
            name = client_name, settings = client)
2616
 
    
 
1923
                yield (name, special_settings[name]())
 
1924
            except KeyError:
 
1925
                yield (name, value)
 
1926
    
 
1927
    tcp_server.clients.update(set(
 
1928
            client_class(name = section,
 
1929
                         config= dict(client_config_items(
 
1930
                        client_config, section)))
 
1931
            for section in client_config.sections()))
2617
1932
    if not tcp_server.clients:
2618
1933
        logger.warning("No clients defined")
2619
 
    
2620
 
    if not foreground:
2621
 
        if pidfile is not None:
2622
 
            try:
2623
 
                with pidfile:
2624
 
                    pid = os.getpid()
2625
 
                    pidfile.write(str(pid) + "\n".encode("utf-8"))
2626
 
            except IOError:
2627
 
                logger.error("Could not write to file %r with PID %d",
2628
 
                             pidfilename, pid)
2629
 
        del pidfile
 
1934
        
 
1935
    if not debug:
 
1936
        try:
 
1937
            with pidfile:
 
1938
                pid = os.getpid()
 
1939
                pidfile.write(str(pid) + "\n".encode("utf-8"))
 
1940
            del pidfile
 
1941
        except IOError:
 
1942
            logger.error("Could not write to file %r with PID %d",
 
1943
                         pidfilename, pid)
 
1944
        except NameError:
 
1945
            # "pidfile" was never created
 
1946
            pass
2630
1947
        del pidfilename
2631
 
    
 
1948
        
 
1949
        signal.signal(signal.SIGINT, signal.SIG_IGN)
 
1950
 
2632
1951
    signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2633
1952
    signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
2634
1953
    
2635
1954
    if use_dbus:
2636
 
        @alternate_dbus_interfaces({"se.recompile.Mandos":
2637
 
                                        "se.bsnet.fukt.Mandos"})
2638
 
        class MandosDBusService(DBusObjectWithProperties):
 
1955
        class MandosDBusService(dbus.service.Object):
2639
1956
            """A D-Bus proxy object"""
2640
1957
            def __init__(self):
2641
1958
                dbus.service.Object.__init__(self, bus, "/")
2642
 
            _interface = "se.recompile.Mandos"
2643
 
            
2644
 
            @dbus_interface_annotations(_interface)
2645
 
            def _foo(self):
2646
 
                return { "org.freedesktop.DBus.Property"
2647
 
                         ".EmitsChangedSignal":
2648
 
                             "false"}
 
1959
            _interface = "se.bsnet.fukt.Mandos"
2649
1960
            
2650
1961
            @dbus.service.signal(_interface, signature="o")
2651
1962
            def ClientAdded(self, objpath):
2666
1977
            def GetAllClients(self):
2667
1978
                "D-Bus method"
2668
1979
                return dbus.Array(c.dbus_object_path
2669
 
                                  for c in
2670
 
                                  tcp_server.clients.itervalues())
 
1980
                                  for c in tcp_server.clients)
2671
1981
            
2672
1982
            @dbus.service.method(_interface,
2673
1983
                                 out_signature="a{oa{sv}}")
2675
1985
                "D-Bus method"
2676
1986
                return dbus.Dictionary(
2677
1987
                    ((c.dbus_object_path, c.GetAll(""))
2678
 
                     for c in tcp_server.clients.itervalues()),
 
1988
                     for c in tcp_server.clients),
2679
1989
                    signature="oa{sv}")
2680
1990
            
2681
1991
            @dbus.service.method(_interface, in_signature="o")
2682
1992
            def RemoveClient(self, object_path):
2683
1993
                "D-Bus method"
2684
 
                for c in tcp_server.clients.itervalues():
 
1994
                for c in tcp_server.clients:
2685
1995
                    if c.dbus_object_path == object_path:
2686
 
                        del tcp_server.clients[c.name]
 
1996
                        tcp_server.clients.remove(c)
2687
1997
                        c.remove_from_connection()
2688
1998
                        # Don't signal anything except ClientRemoved
2689
1999
                        c.disable(quiet=True)
2700
2010
        "Cleanup function; run on exit"
2701
2011
        service.cleanup()
2702
2012
        
2703
 
        multiprocessing.active_children()
2704
 
        if not (tcp_server.clients or client_settings):
2705
 
            return
2706
 
        
2707
 
        # Store client before exiting. Secrets are encrypted with key
2708
 
        # based on what config file has. If config file is
2709
 
        # removed/edited, old secret will thus be unrecovable.
2710
 
        clients = {}
2711
 
        with PGPEngine() as pgp:
2712
 
            for client in tcp_server.clients.itervalues():
2713
 
                key = client_settings[client.name]["secret"]
2714
 
                client.encrypted_secret = pgp.encrypt(client.secret,
2715
 
                                                      key)
2716
 
                client_dict = {}
2717
 
                
2718
 
                # A list of attributes that can not be pickled
2719
 
                # + secret.
2720
 
                exclude = set(("bus", "changedstate", "secret",
2721
 
                               "checker"))
2722
 
                for name, typ in (inspect.getmembers
2723
 
                                  (dbus.service.Object)):
2724
 
                    exclude.add(name)
2725
 
                
2726
 
                client_dict["encrypted_secret"] = (client
2727
 
                                                   .encrypted_secret)
2728
 
                for attr in client.client_structure:
2729
 
                    if attr not in exclude:
2730
 
                        client_dict[attr] = getattr(client, attr)
2731
 
                
2732
 
                clients[client.name] = client_dict
2733
 
                del client_settings[client.name]["secret"]
2734
 
        
2735
 
        try:
2736
 
            with (tempfile.NamedTemporaryFile
2737
 
                  (mode='wb', suffix=".pickle", prefix='clients-',
2738
 
                   dir=os.path.dirname(stored_state_path),
2739
 
                   delete=False)) as stored_state:
2740
 
                pickle.dump((clients, client_settings), stored_state)
2741
 
                tempname=stored_state.name
2742
 
            os.rename(tempname, stored_state_path)
2743
 
        except (IOError, OSError) as e:
2744
 
            if not debug:
2745
 
                try:
2746
 
                    os.remove(tempname)
2747
 
                except NameError:
2748
 
                    pass
2749
 
            if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
2750
 
                logger.warning("Could not save persistent state: {0}"
2751
 
                               .format(os.strerror(e.errno)))
2752
 
            else:
2753
 
                logger.warning("Could not save persistent state:",
2754
 
                               exc_info=e)
2755
 
                raise e
2756
 
        
2757
 
        # Delete all clients, and settings from config
2758
2013
        while tcp_server.clients:
2759
 
            name, client = tcp_server.clients.popitem()
 
2014
            client = tcp_server.clients.pop()
2760
2015
            if use_dbus:
2761
2016
                client.remove_from_connection()
 
2017
            client.disable_hook = None
2762
2018
            # Don't signal anything except ClientRemoved
2763
2019
            client.disable(quiet=True)
2764
2020
            if use_dbus:
2765
2021
                # Emit D-Bus signal
2766
 
                mandos_dbus_service.ClientRemoved(client
2767
 
                                                  .dbus_object_path,
 
2022
                mandos_dbus_service.ClientRemoved(client.dbus_object_path,
2768
2023
                                                  client.name)
2769
 
        client_settings.clear()
2770
2024
    
2771
2025
    atexit.register(cleanup)
2772
2026
    
2773
 
    for client in tcp_server.clients.itervalues():
 
2027
    for client in tcp_server.clients:
2774
2028
        if use_dbus:
2775
2029
            # Emit D-Bus signal
2776
2030
            mandos_dbus_service.ClientAdded(client.dbus_object_path)
2777
 
        # Need to initiate checking of clients
2778
 
        if client.enabled:
2779
 
            client.init_checker()
 
2031
        client.enable()
2780
2032
    
2781
2033
    tcp_server.enable()
2782
2034
    tcp_server.server_activate()
2785
2037
    service.port = tcp_server.socket.getsockname()[1]
2786
2038
    if use_ipv6:
2787
2039
        logger.info("Now listening on address %r, port %d,"
2788
 
                    " flowinfo %d, scope_id %d",
2789
 
                    *tcp_server.socket.getsockname())
 
2040
                    " flowinfo %d, scope_id %d"
 
2041
                    % tcp_server.socket.getsockname())
2790
2042
    else:                       # IPv4
2791
 
        logger.info("Now listening on address %r, port %d",
2792
 
                    *tcp_server.socket.getsockname())
 
2043
        logger.info("Now listening on address %r, port %d"
 
2044
                    % tcp_server.socket.getsockname())
2793
2045
    
2794
2046
    #service.interface = tcp_server.socket.getsockname()[3]
2795
2047
    
2798
2050
        try:
2799
2051
            service.activate()
2800
2052
        except dbus.exceptions.DBusException as error:
2801
 
            logger.critical("D-Bus Exception", exc_info=error)
 
2053
            logger.critical("DBusException: %s", error)
2802
2054
            cleanup()
2803
2055
            sys.exit(1)
2804
2056
        # End of Avahi example code
2811
2063
        logger.debug("Starting main loop")
2812
2064
        main_loop.run()
2813
2065
    except AvahiError as error:
2814
 
        logger.critical("Avahi Error", exc_info=error)
 
2066
        logger.critical("AvahiError: %s", error)
2815
2067
        cleanup()
2816
2068
        sys.exit(1)
2817
2069
    except KeyboardInterrupt: