/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos

  • Committer: teddy at bsnet
  • Date: 2010-08-23 19:23:15 UTC
  • mto: (24.1.154 mandos)
  • mto: This revision was merged to the branch mainline in revision 421.
  • Revision ID: teddy@fukt.bsnet.se-20100823192315-pefgye0l6cavcejs
* debian/control (mandos/Depends): Added "python-urwid".
* mandos (Client.approved_by_default): Changed default to "True".
  (Client.approved_delay): Changed default to "0s".
  (ClientDBus.GotSecret, ClientDBus.Rejected,
  ClientDBus.NeedApproval): Emit "PropertyChanged" signal for the
                            "approved_pending" property.

Show diffs side-by-side

added added

removed removed

Lines of Context:
11
11
# "AvahiService" class, and some lines in "main".
12
12
13
13
# Everything else is
14
 
# Copyright © 2008-2011 Teddy Hogeborn
15
 
# Copyright © 2008-2011 Björn Påhlsson
 
14
# Copyright © 2008,2009 Teddy Hogeborn
 
15
# Copyright © 2008,2009 Björn Påhlsson
16
16
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
28
28
# along with this program.  If not, see
29
29
# <http://www.gnu.org/licenses/>.
30
30
31
 
# Contact the authors at <mandos@recompile.se>.
 
31
# Contact the authors at <mandos@fukt.bsnet.se>.
32
32
33
33
 
34
 
from __future__ import (division, absolute_import, print_function,
35
 
                        unicode_literals)
 
34
from __future__ import division, with_statement, absolute_import
36
35
 
37
36
import SocketServer as socketserver
38
37
import socket
39
 
import argparse
 
38
import optparse
40
39
import datetime
41
40
import errno
42
41
import gnutls.crypto
62
61
import functools
63
62
import cPickle as pickle
64
63
import multiprocessing
65
 
import types
66
 
import binascii
67
 
import tempfile
68
64
 
69
65
import dbus
70
66
import dbus.service
75
71
import ctypes.util
76
72
import xml.dom.minidom
77
73
import inspect
78
 
import GnuPGInterface
79
74
 
80
75
try:
81
76
    SO_BINDTODEVICE = socket.SO_BINDTODEVICE
85
80
    except ImportError:
86
81
        SO_BINDTODEVICE = None
87
82
 
88
 
version = "1.4.1"
89
 
stored_state_file = "clients.pickle"
90
 
 
91
 
logger = logging.getLogger()
 
83
 
 
84
version = "1.0.14"
 
85
 
 
86
logger = logging.Logger(u'mandos')
92
87
syslogger = (logging.handlers.SysLogHandler
93
88
             (facility = logging.handlers.SysLogHandler.LOG_DAEMON,
94
 
              address = str("/dev/log")))
95
 
 
96
 
try:
97
 
    if_nametoindex = (ctypes.cdll.LoadLibrary
98
 
                      (ctypes.util.find_library("c"))
99
 
                      .if_nametoindex)
100
 
except (OSError, AttributeError):
101
 
    def if_nametoindex(interface):
102
 
        "Get an interface index the hard way, i.e. using fcntl()"
103
 
        SIOCGIFINDEX = 0x8933  # From /usr/include/linux/sockios.h
104
 
        with contextlib.closing(socket.socket()) as s:
105
 
            ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
106
 
                                struct.pack(str("16s16x"),
107
 
                                            interface))
108
 
        interface_index = struct.unpack(str("I"),
109
 
                                        ifreq[16:20])[0]
110
 
        return interface_index
111
 
 
112
 
 
113
 
def initlogger(level=logging.WARNING):
114
 
    """init logger and add loglevel"""
115
 
    
116
 
    syslogger.setFormatter(logging.Formatter
117
 
                           ('Mandos [%(process)d]: %(levelname)s:'
118
 
                            ' %(message)s'))
119
 
    logger.addHandler(syslogger)
120
 
    
121
 
    console = logging.StreamHandler()
122
 
    console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
123
 
                                           ' [%(process)d]:'
124
 
                                           ' %(levelname)s:'
125
 
                                           ' %(message)s'))
126
 
    logger.addHandler(console)
127
 
    logger.setLevel(level)
128
 
 
129
 
 
130
 
class PGPError(Exception):
131
 
    """Exception if encryption/decryption fails"""
132
 
    pass
133
 
 
134
 
 
135
 
class PGPEngine(object):
136
 
    """A simple class for OpenPGP symmetric encryption & decryption"""
137
 
    def __init__(self):
138
 
        self.gnupg = GnuPGInterface.GnuPG()
139
 
        self.tempdir = tempfile.mkdtemp(prefix="mandos-")
140
 
        self.gnupg = GnuPGInterface.GnuPG()
141
 
        self.gnupg.options.meta_interactive = False
142
 
        self.gnupg.options.homedir = self.tempdir
143
 
        self.gnupg.options.extra_args.extend(['--force-mdc',
144
 
                                              '--quiet'])
145
 
    
146
 
    def __enter__(self):
147
 
        return self
148
 
    
149
 
    def __exit__ (self, exc_type, exc_value, traceback):
150
 
        self._cleanup()
151
 
        return False
152
 
    
153
 
    def __del__(self):
154
 
        self._cleanup()
155
 
    
156
 
    def _cleanup(self):
157
 
        if self.tempdir is not None:
158
 
            # Delete contents of tempdir
159
 
            for root, dirs, files in os.walk(self.tempdir,
160
 
                                             topdown = False):
161
 
                for filename in files:
162
 
                    os.remove(os.path.join(root, filename))
163
 
                for dirname in dirs:
164
 
                    os.rmdir(os.path.join(root, dirname))
165
 
            # Remove tempdir
166
 
            os.rmdir(self.tempdir)
167
 
            self.tempdir = None
168
 
    
169
 
    def password_encode(self, password):
170
 
        # Passphrase can not be empty and can not contain newlines or
171
 
        # NUL bytes.  So we prefix it and hex encode it.
172
 
        return b"mandos" + binascii.hexlify(password)
173
 
    
174
 
    def encrypt(self, data, password):
175
 
        self.gnupg.passphrase = self.password_encode(password)
176
 
        with open(os.devnull) as devnull:
177
 
            try:
178
 
                proc = self.gnupg.run(['--symmetric'],
179
 
                                      create_fhs=['stdin', 'stdout'],
180
 
                                      attach_fhs={'stderr': devnull})
181
 
                with contextlib.closing(proc.handles['stdin']) as f:
182
 
                    f.write(data)
183
 
                with contextlib.closing(proc.handles['stdout']) as f:
184
 
                    ciphertext = f.read()
185
 
                proc.wait()
186
 
            except IOError as e:
187
 
                raise PGPError(e)
188
 
        self.gnupg.passphrase = None
189
 
        return ciphertext
190
 
    
191
 
    def decrypt(self, data, password):
192
 
        self.gnupg.passphrase = self.password_encode(password)
193
 
        with open(os.devnull) as devnull:
194
 
            try:
195
 
                proc = self.gnupg.run(['--decrypt'],
196
 
                                      create_fhs=['stdin', 'stdout'],
197
 
                                      attach_fhs={'stderr': devnull})
198
 
                with contextlib.closing(proc.handles['stdin'] ) as f:
199
 
                    f.write(data)
200
 
                with contextlib.closing(proc.handles['stdout']) as f:
201
 
                    decrypted_plaintext = f.read()
202
 
                proc.wait()
203
 
            except IOError as e:
204
 
                raise PGPError(e)
205
 
        self.gnupg.passphrase = None
206
 
        return decrypted_plaintext
207
 
 
208
 
 
 
89
              address = "/dev/log"))
 
90
syslogger.setFormatter(logging.Formatter
 
91
                       (u'Mandos [%(process)d]: %(levelname)s:'
 
92
                        u' %(message)s'))
 
93
logger.addHandler(syslogger)
 
94
 
 
95
console = logging.StreamHandler()
 
96
console.setFormatter(logging.Formatter(u'%(name)s [%(process)d]:'
 
97
                                       u' %(levelname)s:'
 
98
                                       u' %(message)s'))
 
99
logger.addHandler(console)
 
100
 
 
101
multiprocessing_manager = multiprocessing.Manager()
209
102
 
210
103
class AvahiError(Exception):
211
104
    def __init__(self, value, *args, **kwargs):
227
120
    Attributes:
228
121
    interface: integer; avahi.IF_UNSPEC or an interface index.
229
122
               Used to optionally bind to the specified interface.
230
 
    name: string; Example: 'Mandos'
231
 
    type: string; Example: '_mandos._tcp'.
 
123
    name: string; Example: u'Mandos'
 
124
    type: string; Example: u'_mandos._tcp'.
232
125
                  See <http://www.dns-sd.org/ServiceTypes.html>
233
126
    port: integer; what port to announce
234
127
    TXT: list of strings; TXT record for the service
243
136
    """
244
137
    def __init__(self, interface = avahi.IF_UNSPEC, name = None,
245
138
                 servicetype = None, port = None, TXT = None,
246
 
                 domain = "", host = "", max_renames = 32768,
 
139
                 domain = u"", host = u"", max_renames = 32768,
247
140
                 protocol = avahi.PROTO_UNSPEC, bus = None):
248
141
        self.interface = interface
249
142
        self.name = name
258
151
        self.group = None       # our entry group
259
152
        self.server = None
260
153
        self.bus = bus
261
 
        self.entry_group_state_changed_match = None
262
154
    def rename(self):
263
155
        """Derived from the Avahi example code"""
264
156
        if self.rename_count >= self.max_renames:
265
 
            logger.critical("No suitable Zeroconf service name found"
266
 
                            " after %i retries, exiting.",
 
157
            logger.critical(u"No suitable Zeroconf service name found"
 
158
                            u" after %i retries, exiting.",
267
159
                            self.rename_count)
268
 
            raise AvahiServiceError("Too many renames")
269
 
        self.name = unicode(self.server
270
 
                            .GetAlternativeServiceName(self.name))
271
 
        logger.info("Changing Zeroconf service name to %r ...",
272
 
                    self.name)
 
160
            raise AvahiServiceError(u"Too many renames")
 
161
        self.name = self.server.GetAlternativeServiceName(self.name)
 
162
        logger.info(u"Changing Zeroconf service name to %r ...",
 
163
                    unicode(self.name))
 
164
        syslogger.setFormatter(logging.Formatter
 
165
                               (u'Mandos (%s) [%%(process)d]:'
 
166
                                u' %%(levelname)s: %%(message)s'
 
167
                                % self.name))
273
168
        self.remove()
274
 
        try:
275
 
            self.add()
276
 
        except dbus.exceptions.DBusException as error:
277
 
            logger.critical("DBusException: %s", error)
278
 
            self.cleanup()
279
 
            os._exit(1)
 
169
        self.add()
280
170
        self.rename_count += 1
281
171
    def remove(self):
282
172
        """Derived from the Avahi example code"""
283
 
        if self.entry_group_state_changed_match is not None:
284
 
            self.entry_group_state_changed_match.remove()
285
 
            self.entry_group_state_changed_match = None
286
173
        if self.group is not None:
287
174
            self.group.Reset()
288
175
    def add(self):
289
176
        """Derived from the Avahi example code"""
290
 
        self.remove()
291
177
        if self.group is None:
292
178
            self.group = dbus.Interface(
293
179
                self.bus.get_object(avahi.DBUS_NAME,
294
180
                                    self.server.EntryGroupNew()),
295
181
                avahi.DBUS_INTERFACE_ENTRY_GROUP)
296
 
        self.entry_group_state_changed_match = (
297
 
            self.group.connect_to_signal(
298
 
                'StateChanged', self.entry_group_state_changed))
299
 
        logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
 
182
            self.group.connect_to_signal('StateChanged',
 
183
                                         self
 
184
                                         .entry_group_state_changed)
 
185
        logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
300
186
                     self.name, self.type)
301
187
        self.group.AddService(
302
188
            self.interface,
309
195
        self.group.Commit()
310
196
    def entry_group_state_changed(self, state, error):
311
197
        """Derived from the Avahi example code"""
312
 
        logger.debug("Avahi entry group state change: %i", state)
 
198
        logger.debug(u"Avahi state change: %i", state)
313
199
        
314
200
        if state == avahi.ENTRY_GROUP_ESTABLISHED:
315
 
            logger.debug("Zeroconf service established.")
 
201
            logger.debug(u"Zeroconf service established.")
316
202
        elif state == avahi.ENTRY_GROUP_COLLISION:
317
 
            logger.info("Zeroconf service name collision.")
 
203
            logger.warning(u"Zeroconf service name collision.")
318
204
            self.rename()
319
205
        elif state == avahi.ENTRY_GROUP_FAILURE:
320
 
            logger.critical("Avahi: Error in group state changed %s",
 
206
            logger.critical(u"Avahi: Error in group state changed %s",
321
207
                            unicode(error))
322
 
            raise AvahiGroupError("State changed: %s"
 
208
            raise AvahiGroupError(u"State changed: %s"
323
209
                                  % unicode(error))
324
210
    def cleanup(self):
325
211
        """Derived from the Avahi example code"""
326
212
        if self.group is not None:
327
 
            try:
328
 
                self.group.Free()
329
 
            except (dbus.exceptions.UnknownMethodException,
330
 
                    dbus.exceptions.DBusException):
331
 
                pass
 
213
            self.group.Free()
332
214
            self.group = None
333
 
        self.remove()
334
 
    def server_state_changed(self, state, error=None):
 
215
    def server_state_changed(self, state):
335
216
        """Derived from the Avahi example code"""
336
 
        logger.debug("Avahi server state change: %i", state)
337
 
        bad_states = { avahi.SERVER_INVALID:
338
 
                           "Zeroconf server invalid",
339
 
                       avahi.SERVER_REGISTERING: None,
340
 
                       avahi.SERVER_COLLISION:
341
 
                           "Zeroconf server name collision",
342
 
                       avahi.SERVER_FAILURE:
343
 
                           "Zeroconf server failure" }
344
 
        if state in bad_states:
345
 
            if bad_states[state] is not None:
346
 
                if error is None:
347
 
                    logger.error(bad_states[state])
348
 
                else:
349
 
                    logger.error(bad_states[state] + ": %r", error)
350
 
            self.cleanup()
 
217
        if state == avahi.SERVER_COLLISION:
 
218
            logger.error(u"Zeroconf server name collision")
 
219
            self.remove()
351
220
        elif state == avahi.SERVER_RUNNING:
352
221
            self.add()
353
 
        else:
354
 
            if error is None:
355
 
                logger.debug("Unknown state: %r", state)
356
 
            else:
357
 
                logger.debug("Unknown state: %r: %r", state, error)
358
222
    def activate(self):
359
223
        """Derived from the Avahi example code"""
360
224
        if self.server is None:
361
225
            self.server = dbus.Interface(
362
226
                self.bus.get_object(avahi.DBUS_NAME,
363
 
                                    avahi.DBUS_PATH_SERVER,
364
 
                                    follow_name_owner_changes=True),
 
227
                                    avahi.DBUS_PATH_SERVER),
365
228
                avahi.DBUS_INTERFACE_SERVER)
366
 
        self.server.connect_to_signal("StateChanged",
 
229
        self.server.connect_to_signal(u"StateChanged",
367
230
                                 self.server_state_changed)
368
231
        self.server_state_changed(self.server.GetState())
369
232
 
370
 
class AvahiServiceToSyslog(AvahiService):
371
 
    def rename(self):
372
 
        """Add the new name to the syslog messages"""
373
 
        ret = AvahiService.rename(self)
374
 
        syslogger.setFormatter(logging.Formatter
375
 
                               ('Mandos (%s) [%%(process)d]:'
376
 
                                ' %%(levelname)s: %%(message)s'
377
 
                                % self.name))
378
 
        return ret
379
233
 
380
 
def timedelta_to_milliseconds(td):
381
 
    "Convert a datetime.timedelta() to milliseconds"
382
 
    return ((td.days * 24 * 60 * 60 * 1000)
383
 
            + (td.seconds * 1000)
384
 
            + (td.microseconds // 1000))
385
 
        
386
234
class Client(object):
387
235
    """A representation of a client host served by this server.
388
236
    
389
237
    Attributes:
390
 
    approved:   bool(); 'None' if not yet approved/disapproved
391
 
    approval_delay: datetime.timedelta(); Time to wait for approval
392
 
    approval_duration: datetime.timedelta(); Duration of one approval
 
238
    name:       string; from the config file, used in log messages and
 
239
                        D-Bus identifiers
 
240
    fingerprint: string (40 or 32 hexadecimal digits); used to
 
241
                 uniquely identify the client
 
242
    secret:     bytestring; sent verbatim (over TLS) to client
 
243
    host:       string; available for use by the checker command
 
244
    created:    datetime.datetime(); (UTC) object creation
 
245
    last_enabled: datetime.datetime(); (UTC)
 
246
    enabled:    bool()
 
247
    last_checked_ok: datetime.datetime(); (UTC) or None
 
248
    timeout:    datetime.timedelta(); How long from last_checked_ok
 
249
                                      until this client is disabled
 
250
    interval:   datetime.timedelta(); How often to start a new checker
 
251
    disable_hook:  If set, called by disable() as disable_hook(self)
393
252
    checker:    subprocess.Popen(); a running checker process used
394
253
                                    to see if the client lives.
395
254
                                    'None' if no process is running.
396
 
    checker_callback_tag: a gobject event source tag, or None
397
 
    checker_command: string; External command which is run to check
398
 
                     if client lives.  %() expansions are done at
 
255
    checker_initiator_tag: a gobject event source tag, or None
 
256
    disable_initiator_tag: - '' -
 
257
    checker_callback_tag:  - '' -
 
258
    checker_command: string; External command which is run to check if
 
259
                     client lives.  %() expansions are done at
399
260
                     runtime with vars(self) as dict, so that for
400
261
                     instance %(name)s can be used in the command.
401
 
    checker_initiator_tag: a gobject event source tag, or None
402
 
    created:    datetime.datetime(); (UTC) object creation
403
 
    client_structure: Object describing what attributes a client has
404
 
                      and is used for storing the client at exit
405
262
    current_checker_command: string; current running checker_command
406
 
    disable_initiator_tag: a gobject event source tag, or None
407
 
    enabled:    bool()
408
 
    fingerprint: string (40 or 32 hexadecimal digits); used to
409
 
                 uniquely identify the client
410
 
    host:       string; available for use by the checker command
411
 
    interval:   datetime.timedelta(); How often to start a new checker
412
 
    last_approval_request: datetime.datetime(); (UTC) or None
413
 
    last_checked_ok: datetime.datetime(); (UTC) or None
414
 
    last_checker_status: integer between 0 and 255 reflecting exit
415
 
                         status of last checker. -1 reflects crashed
416
 
                         checker, or None.
417
 
    last_enabled: datetime.datetime(); (UTC) or None
418
 
    name:       string; from the config file, used in log messages and
419
 
                        D-Bus identifiers
420
 
    secret:     bytestring; sent verbatim (over TLS) to client
421
 
    timeout:    datetime.timedelta(); How long from last_checked_ok
422
 
                                      until this client is disabled
423
 
    extended_timeout:   extra long timeout when password has been sent
424
 
    runtime_expansions: Allowed attributes for runtime expansion.
425
 
    expires:    datetime.datetime(); time (UTC) when a client will be
426
 
                disabled, or None
 
263
    approved_delay: datetime.timedelta(); Time to wait for approval
 
264
    _approved:   bool(); 'None' if not yet approved/disapproved
 
265
    approved_duration: datetime.timedelta(); Duration of one approval
427
266
    """
428
267
    
429
 
    runtime_expansions = ("approval_delay", "approval_duration",
430
 
                          "created", "enabled", "fingerprint",
431
 
                          "host", "interval", "last_checked_ok",
432
 
                          "last_enabled", "name", "timeout")
433
 
    client_defaults = { "timeout": "5m",
434
 
                        "extended_timeout": "15m",
435
 
                        "interval": "2m",
436
 
                        "checker": "fping -q -- %%(host)s",
437
 
                        "host": "",
438
 
                        "approval_delay": "0s",
439
 
                        "approval_duration": "1s",
440
 
                        "approved_by_default": "True",
441
 
                        "enabled": "True",
442
 
                        }
 
268
    @staticmethod
 
269
    def _timedelta_to_milliseconds(td):
 
270
        "Convert a datetime.timedelta() to milliseconds"
 
271
        return ((td.days * 24 * 60 * 60 * 1000)
 
272
                + (td.seconds * 1000)
 
273
                + (td.microseconds // 1000))
443
274
    
444
275
    def timeout_milliseconds(self):
445
276
        "Return the 'timeout' attribute in milliseconds"
446
 
        return timedelta_to_milliseconds(self.timeout)
447
 
    
448
 
    def extended_timeout_milliseconds(self):
449
 
        "Return the 'extended_timeout' attribute in milliseconds"
450
 
        return timedelta_to_milliseconds(self.extended_timeout)
 
277
        return self._timedelta_to_milliseconds(self.timeout)
451
278
    
452
279
    def interval_milliseconds(self):
453
280
        "Return the 'interval' attribute in milliseconds"
454
 
        return timedelta_to_milliseconds(self.interval)
 
281
        return self._timedelta_to_milliseconds(self.interval)
 
282
 
 
283
    def approved_delay_milliseconds(self):
 
284
        return self._timedelta_to_milliseconds(self.approved_delay)
455
285
    
456
 
    def approval_delay_milliseconds(self):
457
 
        return timedelta_to_milliseconds(self.approval_delay)
458
 
 
459
 
    @staticmethod
460
 
    def config_parser(config):
461
 
        """ Construct a new dict of client settings of this form:
462
 
        { client_name: {setting_name: value, ...}, ...}
463
 
        with exceptions for any special settings as defined above"""
464
 
        settings = {}
465
 
        for client_name in config.sections():
466
 
            section = dict(config.items(client_name))
467
 
            client = settings[client_name] = {}
468
 
            
469
 
            client["host"] = section["host"]
470
 
            # Reformat values from string types to Python types
471
 
            client["approved_by_default"] = config.getboolean(
472
 
                client_name, "approved_by_default")
473
 
            client["enabled"] = config.getboolean(client_name, "enabled")
474
 
            
475
 
            client["fingerprint"] = (section["fingerprint"].upper()
476
 
                                     .replace(" ", ""))
477
 
            if "secret" in section:
478
 
                client["secret"] = section["secret"].decode("base64")
479
 
            elif "secfile" in section:
480
 
                with open(os.path.expanduser(os.path.expandvars
481
 
                                             (section["secfile"])),
482
 
                          "rb") as secfile:
483
 
                    client["secret"] = secfile.read()
484
 
            else:
485
 
                raise TypeError("No secret or secfile for section %s"
486
 
                                % section)
487
 
            client["timeout"] = string_to_delta(section["timeout"])
488
 
            client["extended_timeout"] = string_to_delta(
489
 
                section["extended_timeout"])
490
 
            client["interval"] = string_to_delta(section["interval"])
491
 
            client["approval_delay"] = string_to_delta(
492
 
                section["approval_delay"])
493
 
            client["approval_duration"] = string_to_delta(
494
 
                section["approval_duration"])
495
 
            client["checker_command"] = section["checker"]
496
 
            client["last_approval_request"] = None
497
 
            client["last_checked_ok"] = None
498
 
            client["last_checker_status"] = None
499
 
            if client["enabled"]:
500
 
                client["last_enabled"] = datetime.datetime.utcnow()
501
 
                client["expires"] = (datetime.datetime.utcnow()
502
 
                                     + client["timeout"])
503
 
            else:
504
 
                client["last_enabled"] = None
505
 
                client["expires"] = None
506
 
 
507
 
        return settings
508
 
        
509
 
        
510
 
    def __init__(self, settings, name = None):
 
286
    def __init__(self, name = None, disable_hook=None, config=None):
511
287
        """Note: the 'checker' key in 'config' sets the
512
288
        'checker_command' attribute and *not* the 'checker'
513
289
        attribute."""
514
290
        self.name = name
515
 
        # adding all client settings
516
 
        for setting, value in settings.iteritems():
517
 
            setattr(self, setting, value)
518
 
        
519
 
        logger.debug("Creating client %r", self.name)
 
291
        if config is None:
 
292
            config = {}
 
293
        logger.debug(u"Creating client %r", self.name)
520
294
        # Uppercase and remove spaces from fingerprint for later
521
295
        # comparison purposes with return value from the fingerprint()
522
296
        # function
523
 
        logger.debug("  Fingerprint: %s", self.fingerprint)
524
 
        self.created = settings.get("created", datetime.datetime.utcnow())
525
 
 
526
 
        # attributes specific for this server instance
 
297
        self.fingerprint = (config[u"fingerprint"].upper()
 
298
                            .replace(u" ", u""))
 
299
        logger.debug(u"  Fingerprint: %s", self.fingerprint)
 
300
        if u"secret" in config:
 
301
            self.secret = config[u"secret"].decode(u"base64")
 
302
        elif u"secfile" in config:
 
303
            with open(os.path.expanduser(os.path.expandvars
 
304
                                         (config[u"secfile"])),
 
305
                      "rb") as secfile:
 
306
                self.secret = secfile.read()
 
307
        else:
 
308
            #XXX Need to allow secret on demand!
 
309
            raise TypeError(u"No secret or secfile for client %s"
 
310
                            % self.name)
 
311
        self.host = config.get(u"host", u"")
 
312
        self.created = datetime.datetime.utcnow()
 
313
        self.enabled = False
 
314
        self.last_enabled = None
 
315
        self.last_checked_ok = None
 
316
        self.timeout = string_to_delta(config[u"timeout"])
 
317
        self.interval = string_to_delta(config[u"interval"])
 
318
        self.disable_hook = disable_hook
527
319
        self.checker = None
528
320
        self.checker_initiator_tag = None
529
321
        self.disable_initiator_tag = None
530
322
        self.checker_callback_tag = None
 
323
        self.checker_command = config[u"checker"]
531
324
        self.current_checker_command = None
532
 
        self.approved = None
 
325
        self.last_connect = None
533
326
        self.approvals_pending = 0
534
 
        self.changedstate = (multiprocessing_manager
535
 
                             .Condition(multiprocessing_manager
536
 
                                        .Lock()))
537
 
        self.client_structure = [attr for attr in
538
 
                                 self.__dict__.iterkeys()
539
 
                                 if not attr.startswith("_")]
540
 
        self.client_structure.append("client_structure")
541
 
        
542
 
        for name, t in inspect.getmembers(type(self),
543
 
                                          lambda obj:
544
 
                                              isinstance(obj,
545
 
                                                         property)):
546
 
            if not name.startswith("_"):
547
 
                self.client_structure.append(name)
548
 
    
549
 
    # Send notice to process children that client state has changed
 
327
        self._approved = None
 
328
        self.approved_by_default = config.get(u"approved_by_default",
 
329
                                              True)
 
330
        self.approved_delay = string_to_delta(
 
331
            config[u"approved_delay"])
 
332
        self.approved_duration = string_to_delta(
 
333
            config[u"approved_duration"])
 
334
        self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())
 
335
 
550
336
    def send_changedstate(self):
551
 
        with self.changedstate:
552
 
            self.changedstate.notify_all()
553
 
    
 
337
        self.changedstate.acquire()
 
338
        self.changedstate.notify_all()
 
339
        self.changedstate.release()
 
340
        
554
341
    def enable(self):
555
342
        """Start this client's checker and timeout hooks"""
556
 
        if getattr(self, "enabled", False):
 
343
        if getattr(self, u"enabled", False):
557
344
            # Already enabled
558
345
            return
559
346
        self.send_changedstate()
560
 
        self.expires = datetime.datetime.utcnow() + self.timeout
561
 
        self.enabled = True
562
347
        self.last_enabled = datetime.datetime.utcnow()
563
 
        self.init_checker()
564
 
    
565
 
    def disable(self, quiet=True):
566
 
        """Disable this client."""
567
 
        if not getattr(self, "enabled", False):
568
 
            return False
569
 
        if not quiet:
570
 
            self.send_changedstate()
571
 
        if not quiet:
572
 
            logger.info("Disabling client %s", self.name)
573
 
        if getattr(self, "disable_initiator_tag", False):
574
 
            gobject.source_remove(self.disable_initiator_tag)
575
 
            self.disable_initiator_tag = None
576
 
        self.expires = None
577
 
        if getattr(self, "checker_initiator_tag", False):
578
 
            gobject.source_remove(self.checker_initiator_tag)
579
 
            self.checker_initiator_tag = None
580
 
        self.stop_checker()
581
 
        self.enabled = False
582
 
        # Do not run this again if called by a gobject.timeout_add
583
 
        return False
584
 
    
585
 
    def __del__(self):
586
 
        self.disable()
587
 
    
588
 
    def init_checker(self):
589
348
        # Schedule a new checker to be started an 'interval' from now,
590
349
        # and every interval from then on.
591
350
        self.checker_initiator_tag = (gobject.timeout_add
595
354
        self.disable_initiator_tag = (gobject.timeout_add
596
355
                                   (self.timeout_milliseconds(),
597
356
                                    self.disable))
 
357
        self.enabled = True
598
358
        # Also start a new checker *right now*.
599
359
        self.start_checker()
600
360
    
 
361
    def disable(self, quiet=True):
 
362
        """Disable this client."""
 
363
        if not getattr(self, "enabled", False):
 
364
            return False
 
365
        if not quiet:
 
366
            self.send_changedstate()
 
367
        if not quiet:
 
368
            logger.info(u"Disabling client %s", self.name)
 
369
        if getattr(self, u"disable_initiator_tag", False):
 
370
            gobject.source_remove(self.disable_initiator_tag)
 
371
            self.disable_initiator_tag = None
 
372
        if getattr(self, u"checker_initiator_tag", False):
 
373
            gobject.source_remove(self.checker_initiator_tag)
 
374
            self.checker_initiator_tag = None
 
375
        self.stop_checker()
 
376
        if self.disable_hook:
 
377
            self.disable_hook(self)
 
378
        self.enabled = False
 
379
        # Do not run this again if called by a gobject.timeout_add
 
380
        return False
 
381
    
 
382
    def __del__(self):
 
383
        self.disable_hook = None
 
384
        self.disable()
 
385
    
601
386
    def checker_callback(self, pid, condition, command):
602
387
        """The checker has completed, so take appropriate actions."""
603
388
        self.checker_callback_tag = None
604
389
        self.checker = None
605
390
        if os.WIFEXITED(condition):
606
 
            self.last_checker_status = os.WEXITSTATUS(condition)
607
 
            if self.last_checker_status == 0:
608
 
                logger.info("Checker for %(name)s succeeded",
 
391
            exitstatus = os.WEXITSTATUS(condition)
 
392
            if exitstatus == 0:
 
393
                logger.info(u"Checker for %(name)s succeeded",
609
394
                            vars(self))
610
395
                self.checked_ok()
611
396
            else:
612
 
                logger.info("Checker for %(name)s failed",
 
397
                logger.info(u"Checker for %(name)s failed",
613
398
                            vars(self))
614
399
        else:
615
 
            self.last_checker_status = -1
616
 
            logger.warning("Checker for %(name)s crashed?",
 
400
            logger.warning(u"Checker for %(name)s crashed?",
617
401
                           vars(self))
618
402
    
619
 
    def checked_ok(self, timeout=None):
 
403
    def checked_ok(self):
620
404
        """Bump up the timeout for this client.
621
405
        
622
406
        This should only be called when the client has been seen,
623
407
        alive and well.
624
408
        """
625
 
        if timeout is None:
626
 
            timeout = self.timeout
627
409
        self.last_checked_ok = datetime.datetime.utcnow()
628
 
        if self.disable_initiator_tag is not None:
629
 
            gobject.source_remove(self.disable_initiator_tag)
630
 
        if getattr(self, "enabled", False):
631
 
            self.disable_initiator_tag = (gobject.timeout_add
632
 
                                          (timedelta_to_milliseconds
633
 
                                           (timeout), self.disable))
634
 
            self.expires = datetime.datetime.utcnow() + timeout
635
 
    
636
 
    def need_approval(self):
637
 
        self.last_approval_request = datetime.datetime.utcnow()
 
410
        gobject.source_remove(self.disable_initiator_tag)
 
411
        self.disable_initiator_tag = (gobject.timeout_add
 
412
                                      (self.timeout_milliseconds(),
 
413
                                       self.disable))
638
414
    
639
415
    def start_checker(self):
640
416
        """Start a new checker subprocess if one is not running.
653
429
        # If a checker exists, make sure it is not a zombie
654
430
        try:
655
431
            pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
656
 
        except (AttributeError, OSError) as error:
 
432
        except (AttributeError, OSError), error:
657
433
            if (isinstance(error, OSError)
658
434
                and error.errno != errno.ECHILD):
659
435
                raise error
660
436
        else:
661
437
            if pid:
662
 
                logger.warning("Checker was a zombie")
 
438
                logger.warning(u"Checker was a zombie")
663
439
                gobject.source_remove(self.checker_callback_tag)
664
440
                self.checker_callback(pid, status,
665
441
                                      self.current_checker_command)
670
446
                command = self.checker_command % self.host
671
447
            except TypeError:
672
448
                # Escape attributes for the shell
673
 
                escaped_attrs = dict(
674
 
                    (attr,
675
 
                     re.escape(unicode(str(getattr(self, attr, "")),
676
 
                                       errors=
677
 
                                       'replace')))
678
 
                    for attr in
679
 
                    self.runtime_expansions)
680
 
                
 
449
                escaped_attrs = dict((key,
 
450
                                      re.escape(unicode(str(val),
 
451
                                                        errors=
 
452
                                                        u'replace')))
 
453
                                     for key, val in
 
454
                                     vars(self).iteritems())
681
455
                try:
682
456
                    command = self.checker_command % escaped_attrs
683
 
                except TypeError as error:
684
 
                    logger.error('Could not format string "%s":'
685
 
                                 ' %s', self.checker_command, error)
 
457
                except TypeError, error:
 
458
                    logger.error(u'Could not format string "%s":'
 
459
                                 u' %s', self.checker_command, error)
686
460
                    return True # Try again later
687
461
            self.current_checker_command = command
688
462
            try:
689
 
                logger.info("Starting checker %r for %s",
 
463
                logger.info(u"Starting checker %r for %s",
690
464
                            command, self.name)
691
465
                # We don't need to redirect stdout and stderr, since
692
466
                # in normal mode, that is already done by daemon(),
694
468
                # always replaced by /dev/null.)
695
469
                self.checker = subprocess.Popen(command,
696
470
                                                close_fds=True,
697
 
                                                shell=True, cwd="/")
 
471
                                                shell=True, cwd=u"/")
698
472
                self.checker_callback_tag = (gobject.child_watch_add
699
473
                                             (self.checker.pid,
700
474
                                              self.checker_callback,
705
479
                if pid:
706
480
                    gobject.source_remove(self.checker_callback_tag)
707
481
                    self.checker_callback(pid, status, command)
708
 
            except OSError as error:
709
 
                logger.error("Failed to start subprocess: %s",
 
482
            except OSError, error:
 
483
                logger.error(u"Failed to start subprocess: %s",
710
484
                             error)
711
485
        # Re-run this periodically if run by gobject.timeout_add
712
486
        return True
716
490
        if self.checker_callback_tag:
717
491
            gobject.source_remove(self.checker_callback_tag)
718
492
            self.checker_callback_tag = None
719
 
        if getattr(self, "checker", None) is None:
 
493
        if getattr(self, u"checker", None) is None:
720
494
            return
721
 
        logger.debug("Stopping checker for %(name)s", vars(self))
 
495
        logger.debug(u"Stopping checker for %(name)s", vars(self))
722
496
        try:
723
497
            os.kill(self.checker.pid, signal.SIGTERM)
724
498
            #time.sleep(0.5)
725
499
            #if self.checker.poll() is None:
726
500
            #    os.kill(self.checker.pid, signal.SIGKILL)
727
 
        except OSError as error:
 
501
        except OSError, error:
728
502
            if error.errno != errno.ESRCH: # No such process
729
503
                raise
730
504
        self.checker = None
731
505
 
732
 
 
733
 
def dbus_service_property(dbus_interface, signature="v",
734
 
                          access="readwrite", byte_arrays=False):
 
506
def dbus_service_property(dbus_interface, signature=u"v",
 
507
                          access=u"readwrite", byte_arrays=False):
735
508
    """Decorators for marking methods of a DBusObjectWithProperties to
736
509
    become properties on the D-Bus.
737
510
    
744
517
    """
745
518
    # Encoding deeply encoded byte arrays is not supported yet by the
746
519
    # "Set" method, so we fail early here:
747
 
    if byte_arrays and signature != "ay":
748
 
        raise ValueError("Byte arrays not supported for non-'ay'"
749
 
                         " signature %r" % signature)
 
520
    if byte_arrays and signature != u"ay":
 
521
        raise ValueError(u"Byte arrays not supported for non-'ay'"
 
522
                         u" signature %r" % signature)
750
523
    def decorator(func):
751
524
        func._dbus_is_property = True
752
525
        func._dbus_interface = dbus_interface
753
526
        func._dbus_signature = signature
754
527
        func._dbus_access = access
755
528
        func._dbus_name = func.__name__
756
 
        if func._dbus_name.endswith("_dbus_property"):
 
529
        if func._dbus_name.endswith(u"_dbus_property"):
757
530
            func._dbus_name = func._dbus_name[:-14]
758
 
        func._dbus_get_args_options = {'byte_arrays': byte_arrays }
 
531
        func._dbus_get_args_options = {u'byte_arrays': byte_arrays }
759
532
        return func
760
533
    return decorator
761
534
 
781
554
 
782
555
class DBusObjectWithProperties(dbus.service.Object):
783
556
    """A D-Bus object with properties.
784
 
    
 
557
 
785
558
    Classes inheriting from this can use the dbus_service_property
786
559
    decorator to expose methods as D-Bus properties.  It exposes the
787
560
    standard Get(), Set(), and GetAll() methods on the D-Bus.
789
562
    
790
563
    @staticmethod
791
564
    def _is_dbus_property(obj):
792
 
        return getattr(obj, "_dbus_is_property", False)
 
565
        return getattr(obj, u"_dbus_is_property", False)
793
566
    
794
567
    def _get_all_dbus_properties(self):
795
568
        """Returns a generator of (name, attribute) pairs
796
569
        """
797
 
        return ((prop.__get__(self)._dbus_name, prop.__get__(self))
798
 
                for cls in self.__class__.__mro__
 
570
        return ((prop._dbus_name, prop)
799
571
                for name, prop in
800
 
                inspect.getmembers(cls, self._is_dbus_property))
 
572
                inspect.getmembers(self, self._is_dbus_property))
801
573
    
802
574
    def _get_dbus_property(self, interface_name, property_name):
803
575
        """Returns a bound method if one exists which is a D-Bus
804
576
        property with the specified name and interface.
805
577
        """
806
 
        for cls in  self.__class__.__mro__:
807
 
            for name, value in (inspect.getmembers
808
 
                                (cls, self._is_dbus_property)):
809
 
                if (value._dbus_name == property_name
810
 
                    and value._dbus_interface == interface_name):
811
 
                    return value.__get__(self)
812
 
        
 
578
        for name in (property_name,
 
579
                     property_name + u"_dbus_property"):
 
580
            prop = getattr(self, name, None)
 
581
            if (prop is None
 
582
                or not self._is_dbus_property(prop)
 
583
                or prop._dbus_name != property_name
 
584
                or (interface_name and prop._dbus_interface
 
585
                    and interface_name != prop._dbus_interface)):
 
586
                continue
 
587
            return prop
813
588
        # No such property
814
 
        raise DBusPropertyNotFound(self.dbus_object_path + ":"
815
 
                                   + interface_name + "."
 
589
        raise DBusPropertyNotFound(self.dbus_object_path + u":"
 
590
                                   + interface_name + u"."
816
591
                                   + property_name)
817
592
    
818
 
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
819
 
                         out_signature="v")
 
593
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ss",
 
594
                         out_signature=u"v")
820
595
    def Get(self, interface_name, property_name):
821
596
        """Standard D-Bus property Get() method, see D-Bus standard.
822
597
        """
823
598
        prop = self._get_dbus_property(interface_name, property_name)
824
 
        if prop._dbus_access == "write":
 
599
        if prop._dbus_access == u"write":
825
600
            raise DBusPropertyAccessException(property_name)
826
601
        value = prop()
827
 
        if not hasattr(value, "variant_level"):
 
602
        if not hasattr(value, u"variant_level"):
828
603
            return value
829
604
        return type(value)(value, variant_level=value.variant_level+1)
830
605
    
831
 
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
 
606
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ssv")
832
607
    def Set(self, interface_name, property_name, value):
833
608
        """Standard D-Bus property Set() method, see D-Bus standard.
834
609
        """
835
610
        prop = self._get_dbus_property(interface_name, property_name)
836
 
        if prop._dbus_access == "read":
 
611
        if prop._dbus_access == u"read":
837
612
            raise DBusPropertyAccessException(property_name)
838
 
        if prop._dbus_get_args_options["byte_arrays"]:
 
613
        if prop._dbus_get_args_options[u"byte_arrays"]:
839
614
            # The byte_arrays option is not supported yet on
840
615
            # signatures other than "ay".
841
 
            if prop._dbus_signature != "ay":
 
616
            if prop._dbus_signature != u"ay":
842
617
                raise ValueError
843
618
            value = dbus.ByteArray(''.join(unichr(byte)
844
619
                                           for byte in value))
845
620
        prop(value)
846
621
    
847
 
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
848
 
                         out_signature="a{sv}")
 
622
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"s",
 
623
                         out_signature=u"a{sv}")
849
624
    def GetAll(self, interface_name):
850
625
        """Standard D-Bus property GetAll() method, see D-Bus
851
626
        standard.
852
 
        
 
627
 
853
628
        Note: Will not include properties with access="write".
854
629
        """
855
 
        properties = {}
 
630
        all = {}
856
631
        for name, prop in self._get_all_dbus_properties():
857
632
            if (interface_name
858
633
                and interface_name != prop._dbus_interface):
859
634
                # Interface non-empty but did not match
860
635
                continue
861
636
            # Ignore write-only properties
862
 
            if prop._dbus_access == "write":
 
637
            if prop._dbus_access == u"write":
863
638
                continue
864
639
            value = prop()
865
 
            if not hasattr(value, "variant_level"):
866
 
                properties[name] = value
 
640
            if not hasattr(value, u"variant_level"):
 
641
                all[name] = value
867
642
                continue
868
 
            properties[name] = type(value)(value, variant_level=
869
 
                                           value.variant_level+1)
870
 
        return dbus.Dictionary(properties, signature="sv")
 
643
            all[name] = type(value)(value, variant_level=
 
644
                                    value.variant_level+1)
 
645
        return dbus.Dictionary(all, signature=u"sv")
871
646
    
872
647
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
873
 
                         out_signature="s",
 
648
                         out_signature=u"s",
874
649
                         path_keyword='object_path',
875
650
                         connection_keyword='connection')
876
651
    def Introspect(self, object_path, connection):
881
656
        try:
882
657
            document = xml.dom.minidom.parseString(xmlstring)
883
658
            def make_tag(document, name, prop):
884
 
                e = document.createElement("property")
885
 
                e.setAttribute("name", name)
886
 
                e.setAttribute("type", prop._dbus_signature)
887
 
                e.setAttribute("access", prop._dbus_access)
 
659
                e = document.createElement(u"property")
 
660
                e.setAttribute(u"name", name)
 
661
                e.setAttribute(u"type", prop._dbus_signature)
 
662
                e.setAttribute(u"access", prop._dbus_access)
888
663
                return e
889
 
            for if_tag in document.getElementsByTagName("interface"):
 
664
            for if_tag in document.getElementsByTagName(u"interface"):
890
665
                for tag in (make_tag(document, name, prop)
891
666
                            for name, prop
892
667
                            in self._get_all_dbus_properties()
893
668
                            if prop._dbus_interface
894
 
                            == if_tag.getAttribute("name")):
 
669
                            == if_tag.getAttribute(u"name")):
895
670
                    if_tag.appendChild(tag)
896
671
                # Add the names to the return values for the
897
672
                # "org.freedesktop.DBus.Properties" methods
898
 
                if (if_tag.getAttribute("name")
899
 
                    == "org.freedesktop.DBus.Properties"):
900
 
                    for cn in if_tag.getElementsByTagName("method"):
901
 
                        if cn.getAttribute("name") == "Get":
902
 
                            for arg in cn.getElementsByTagName("arg"):
903
 
                                if (arg.getAttribute("direction")
904
 
                                    == "out"):
905
 
                                    arg.setAttribute("name", "value")
906
 
                        elif cn.getAttribute("name") == "GetAll":
907
 
                            for arg in cn.getElementsByTagName("arg"):
908
 
                                if (arg.getAttribute("direction")
909
 
                                    == "out"):
910
 
                                    arg.setAttribute("name", "props")
911
 
            xmlstring = document.toxml("utf-8")
 
673
                if (if_tag.getAttribute(u"name")
 
674
                    == u"org.freedesktop.DBus.Properties"):
 
675
                    for cn in if_tag.getElementsByTagName(u"method"):
 
676
                        if cn.getAttribute(u"name") == u"Get":
 
677
                            for arg in cn.getElementsByTagName(u"arg"):
 
678
                                if (arg.getAttribute(u"direction")
 
679
                                    == u"out"):
 
680
                                    arg.setAttribute(u"name", u"value")
 
681
                        elif cn.getAttribute(u"name") == u"GetAll":
 
682
                            for arg in cn.getElementsByTagName(u"arg"):
 
683
                                if (arg.getAttribute(u"direction")
 
684
                                    == u"out"):
 
685
                                    arg.setAttribute(u"name", u"props")
 
686
            xmlstring = document.toxml(u"utf-8")
912
687
            document.unlink()
913
688
        except (AttributeError, xml.dom.DOMException,
914
 
                xml.parsers.expat.ExpatError) as error:
915
 
            logger.error("Failed to override Introspection method",
 
689
                xml.parsers.expat.ExpatError), error:
 
690
            logger.error(u"Failed to override Introspection method",
916
691
                         error)
917
692
        return xmlstring
918
693
 
919
694
 
920
 
def datetime_to_dbus (dt, variant_level=0):
921
 
    """Convert a UTC datetime.datetime() to a D-Bus type."""
922
 
    if dt is None:
923
 
        return dbus.String("", variant_level = variant_level)
924
 
    return dbus.String(dt.isoformat(),
925
 
                       variant_level=variant_level)
926
 
 
927
 
 
928
 
class AlternateDBusNamesMetaclass(DBusObjectWithProperties
929
 
                                  .__metaclass__):
930
 
    """Applied to an empty subclass of a D-Bus object, this metaclass
931
 
    will add additional D-Bus attributes matching a certain pattern.
932
 
    """
933
 
    def __new__(mcs, name, bases, attr):
934
 
        # Go through all the base classes which could have D-Bus
935
 
        # methods, signals, or properties in them
936
 
        for base in (b for b in bases
937
 
                     if issubclass(b, dbus.service.Object)):
938
 
            # Go though all attributes of the base class
939
 
            for attrname, attribute in inspect.getmembers(base):
940
 
                # Ignore non-D-Bus attributes, and D-Bus attributes
941
 
                # with the wrong interface name
942
 
                if (not hasattr(attribute, "_dbus_interface")
943
 
                    or not attribute._dbus_interface
944
 
                    .startswith("se.recompile.Mandos")):
945
 
                    continue
946
 
                # Create an alternate D-Bus interface name based on
947
 
                # the current name
948
 
                alt_interface = (attribute._dbus_interface
949
 
                                 .replace("se.recompile.Mandos",
950
 
                                          "se.bsnet.fukt.Mandos"))
951
 
                # Is this a D-Bus signal?
952
 
                if getattr(attribute, "_dbus_is_signal", False):
953
 
                    # Extract the original non-method function by
954
 
                    # black magic
955
 
                    nonmethod_func = (dict(
956
 
                            zip(attribute.func_code.co_freevars,
957
 
                                attribute.__closure__))["func"]
958
 
                                      .cell_contents)
959
 
                    # Create a new, but exactly alike, function
960
 
                    # object, and decorate it to be a new D-Bus signal
961
 
                    # with the alternate D-Bus interface name
962
 
                    new_function = (dbus.service.signal
963
 
                                    (alt_interface,
964
 
                                     attribute._dbus_signature)
965
 
                                    (types.FunctionType(
966
 
                                nonmethod_func.func_code,
967
 
                                nonmethod_func.func_globals,
968
 
                                nonmethod_func.func_name,
969
 
                                nonmethod_func.func_defaults,
970
 
                                nonmethod_func.func_closure)))
971
 
                    # Define a creator of a function to call both the
972
 
                    # old and new functions, so both the old and new
973
 
                    # signals gets sent when the function is called
974
 
                    def fixscope(func1, func2):
975
 
                        """This function is a scope container to pass
976
 
                        func1 and func2 to the "call_both" function
977
 
                        outside of its arguments"""
978
 
                        def call_both(*args, **kwargs):
979
 
                            """This function will emit two D-Bus
980
 
                            signals by calling func1 and func2"""
981
 
                            func1(*args, **kwargs)
982
 
                            func2(*args, **kwargs)
983
 
                        return call_both
984
 
                    # Create the "call_both" function and add it to
985
 
                    # the class
986
 
                    attr[attrname] = fixscope(attribute,
987
 
                                              new_function)
988
 
                # Is this a D-Bus method?
989
 
                elif getattr(attribute, "_dbus_is_method", False):
990
 
                    # Create a new, but exactly alike, function
991
 
                    # object.  Decorate it to be a new D-Bus method
992
 
                    # with the alternate D-Bus interface name.  Add it
993
 
                    # to the class.
994
 
                    attr[attrname] = (dbus.service.method
995
 
                                      (alt_interface,
996
 
                                       attribute._dbus_in_signature,
997
 
                                       attribute._dbus_out_signature)
998
 
                                      (types.FunctionType
999
 
                                       (attribute.func_code,
1000
 
                                        attribute.func_globals,
1001
 
                                        attribute.func_name,
1002
 
                                        attribute.func_defaults,
1003
 
                                        attribute.func_closure)))
1004
 
                # Is this a D-Bus property?
1005
 
                elif getattr(attribute, "_dbus_is_property", False):
1006
 
                    # Create a new, but exactly alike, function
1007
 
                    # object, and decorate it to be a new D-Bus
1008
 
                    # property with the alternate D-Bus interface
1009
 
                    # name.  Add it to the class.
1010
 
                    attr[attrname] = (dbus_service_property
1011
 
                                      (alt_interface,
1012
 
                                       attribute._dbus_signature,
1013
 
                                       attribute._dbus_access,
1014
 
                                       attribute
1015
 
                                       ._dbus_get_args_options
1016
 
                                       ["byte_arrays"])
1017
 
                                      (types.FunctionType
1018
 
                                       (attribute.func_code,
1019
 
                                        attribute.func_globals,
1020
 
                                        attribute.func_name,
1021
 
                                        attribute.func_defaults,
1022
 
                                        attribute.func_closure)))
1023
 
        return type.__new__(mcs, name, bases, attr)
1024
 
 
1025
 
 
1026
695
class ClientDBus(Client, DBusObjectWithProperties):
1027
696
    """A Client class using D-Bus
1028
697
    
1030
699
    dbus_object_path: dbus.ObjectPath
1031
700
    bus: dbus.SystemBus()
1032
701
    """
1033
 
    
1034
 
    runtime_expansions = (Client.runtime_expansions
1035
 
                          + ("dbus_object_path",))
1036
 
    
1037
702
    # dbus.service.Object doesn't use super(), so we can't either.
1038
703
    
1039
704
    def __init__(self, bus = None, *args, **kwargs):
1040
705
        self.bus = bus
1041
706
        Client.__init__(self, *args, **kwargs)
1042
 
        self._approvals_pending = 0
1043
 
        
1044
 
        self._approvals_pending = 0
1045
707
        # Only now, when this client is initialized, can it show up on
1046
708
        # the D-Bus
1047
 
        client_object_name = unicode(self.name).translate(
1048
 
            {ord("."): ord("_"),
1049
 
             ord("-"): ord("_")})
1050
709
        self.dbus_object_path = (dbus.ObjectPath
1051
 
                                 ("/clients/" + client_object_name))
 
710
                                 (u"/clients/"
 
711
                                  + self.name.replace(u".", u"_")))
1052
712
        DBusObjectWithProperties.__init__(self, self.bus,
1053
713
                                          self.dbus_object_path)
1054
 
        
1055
 
    def notifychangeproperty(transform_func,
1056
 
                             dbus_name, type_func=lambda x: x,
1057
 
                             variant_level=1):
1058
 
        """ Modify a variable so that it's a property which announces
1059
 
        its changes to DBus.
1060
 
        
1061
 
        transform_fun: Function that takes a value and a variant_level
1062
 
                       and transforms it to a D-Bus type.
1063
 
        dbus_name: D-Bus name of the variable
1064
 
        type_func: Function that transform the value before sending it
1065
 
                   to the D-Bus.  Default: no transform
1066
 
        variant_level: D-Bus variant level.  Default: 1
1067
 
        """
1068
 
        attrname = "_{0}".format(dbus_name)
1069
 
        def setter(self, value):
1070
 
            if hasattr(self, "dbus_object_path"):
1071
 
                if (not hasattr(self, attrname) or
1072
 
                    type_func(getattr(self, attrname, None))
1073
 
                    != type_func(value)):
1074
 
                    dbus_value = transform_func(type_func(value),
1075
 
                                                variant_level
1076
 
                                                =variant_level)
1077
 
                    self.PropertyChanged(dbus.String(dbus_name),
1078
 
                                         dbus_value)
1079
 
            setattr(self, attrname, value)
1080
 
        
1081
 
        return property(lambda self: getattr(self, attrname), setter)
1082
 
    
1083
 
    
1084
 
    expires = notifychangeproperty(datetime_to_dbus, "Expires")
1085
 
    approvals_pending = notifychangeproperty(dbus.Boolean,
1086
 
                                             "ApprovalPending",
1087
 
                                             type_func = bool)
1088
 
    enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1089
 
    last_enabled = notifychangeproperty(datetime_to_dbus,
1090
 
                                        "LastEnabled")
1091
 
    checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",
1092
 
                                   type_func = lambda checker:
1093
 
                                       checker is not None)
1094
 
    last_checked_ok = notifychangeproperty(datetime_to_dbus,
1095
 
                                           "LastCheckedOK")
1096
 
    last_approval_request = notifychangeproperty(
1097
 
        datetime_to_dbus, "LastApprovalRequest")
1098
 
    approved_by_default = notifychangeproperty(dbus.Boolean,
1099
 
                                               "ApprovedByDefault")
1100
 
    approval_delay = notifychangeproperty(dbus.UInt64,
1101
 
                                          "ApprovalDelay",
1102
 
                                          type_func =
1103
 
                                          timedelta_to_milliseconds)
1104
 
    approval_duration = notifychangeproperty(
1105
 
        dbus.UInt64, "ApprovalDuration",
1106
 
        type_func = timedelta_to_milliseconds)
1107
 
    host = notifychangeproperty(dbus.String, "Host")
1108
 
    timeout = notifychangeproperty(dbus.UInt64, "Timeout",
1109
 
                                   type_func =
1110
 
                                   timedelta_to_milliseconds)
1111
 
    extended_timeout = notifychangeproperty(
1112
 
        dbus.UInt64, "ExtendedTimeout",
1113
 
        type_func = timedelta_to_milliseconds)
1114
 
    interval = notifychangeproperty(dbus.UInt64,
1115
 
                                    "Interval",
1116
 
                                    type_func =
1117
 
                                    timedelta_to_milliseconds)
1118
 
    checker_command = notifychangeproperty(dbus.String, "Checker")
1119
 
    
1120
 
    del notifychangeproperty
 
714
    
 
715
    @staticmethod
 
716
    def _datetime_to_dbus(dt, variant_level=0):
 
717
        """Convert a UTC datetime.datetime() to a D-Bus type."""
 
718
        return dbus.String(dt.isoformat(),
 
719
                           variant_level=variant_level)
 
720
    
 
721
    def enable(self):
 
722
        oldstate = getattr(self, u"enabled", False)
 
723
        r = Client.enable(self)
 
724
        if oldstate != self.enabled:
 
725
            # Emit D-Bus signals
 
726
            self.PropertyChanged(dbus.String(u"enabled"),
 
727
                                 dbus.Boolean(True, variant_level=1))
 
728
            self.PropertyChanged(
 
729
                dbus.String(u"last_enabled"),
 
730
                self._datetime_to_dbus(self.last_enabled,
 
731
                                       variant_level=1))
 
732
        return r
 
733
    
 
734
    def disable(self, quiet = False):
 
735
        oldstate = getattr(self, u"enabled", False)
 
736
        r = Client.disable(self, quiet=quiet)
 
737
        if not quiet and oldstate != self.enabled:
 
738
            # Emit D-Bus signal
 
739
            self.PropertyChanged(dbus.String(u"enabled"),
 
740
                                 dbus.Boolean(False, variant_level=1))
 
741
        return r
1121
742
    
1122
743
    def __del__(self, *args, **kwargs):
1123
744
        try:
1124
745
            self.remove_from_connection()
1125
746
        except LookupError:
1126
747
            pass
1127
 
        if hasattr(DBusObjectWithProperties, "__del__"):
 
748
        if hasattr(DBusObjectWithProperties, u"__del__"):
1128
749
            DBusObjectWithProperties.__del__(self, *args, **kwargs)
1129
750
        Client.__del__(self, *args, **kwargs)
1130
751
    
1132
753
                         *args, **kwargs):
1133
754
        self.checker_callback_tag = None
1134
755
        self.checker = None
 
756
        # Emit D-Bus signal
 
757
        self.PropertyChanged(dbus.String(u"checker_running"),
 
758
                             dbus.Boolean(False, variant_level=1))
1135
759
        if os.WIFEXITED(condition):
1136
760
            exitstatus = os.WEXITSTATUS(condition)
1137
761
            # Emit D-Bus signal
1147
771
        return Client.checker_callback(self, pid, condition, command,
1148
772
                                       *args, **kwargs)
1149
773
    
 
774
    def checked_ok(self, *args, **kwargs):
 
775
        r = Client.checked_ok(self, *args, **kwargs)
 
776
        # Emit D-Bus signal
 
777
        self.PropertyChanged(
 
778
            dbus.String(u"last_checked_ok"),
 
779
            (self._datetime_to_dbus(self.last_checked_ok,
 
780
                                    variant_level=1)))
 
781
        return r
 
782
    
1150
783
    def start_checker(self, *args, **kwargs):
1151
784
        old_checker = self.checker
1152
785
        if self.checker is not None:
1159
792
            and old_checker_pid != self.checker.pid):
1160
793
            # Emit D-Bus signal
1161
794
            self.CheckerStarted(self.current_checker_command)
 
795
            self.PropertyChanged(
 
796
                dbus.String(u"checker_running"),
 
797
                dbus.Boolean(True, variant_level=1))
1162
798
        return r
1163
799
    
 
800
    def stop_checker(self, *args, **kwargs):
 
801
        old_checker = getattr(self, u"checker", None)
 
802
        r = Client.stop_checker(self, *args, **kwargs)
 
803
        if (old_checker is not None
 
804
            and getattr(self, u"checker", None) is None):
 
805
            self.PropertyChanged(dbus.String(u"checker_running"),
 
806
                                 dbus.Boolean(False, variant_level=1))
 
807
        return r
 
808
 
1164
809
    def _reset_approved(self):
1165
 
        self.approved = None
 
810
        self._approved = None
1166
811
        return False
1167
812
    
1168
813
    def approve(self, value=True):
1169
 
        self.send_changedstate()
1170
 
        self.approved = value
1171
 
        gobject.timeout_add(timedelta_to_milliseconds
1172
 
                            (self.approval_duration),
1173
 
                            self._reset_approved)
 
814
        self._approved = value
 
815
        gobject.timeout_add(self._timedelta_to_milliseconds(self.approved_duration, self._reset_approved))
 
816
 
 
817
    def approved_pending(self):
 
818
        return self.approvals_pending > 0
1174
819
    
1175
820
    
1176
821
    ## D-Bus methods, signals & properties
1177
 
    _interface = "se.recompile.Mandos.Client"
 
822
    _interface = u"se.bsnet.fukt.Mandos.Client"
1178
823
    
1179
824
    ## Signals
1180
825
    
1181
826
    # CheckerCompleted - signal
1182
 
    @dbus.service.signal(_interface, signature="nxs")
 
827
    @dbus.service.signal(_interface, signature=u"nxs")
1183
828
    def CheckerCompleted(self, exitcode, waitstatus, command):
1184
829
        "D-Bus signal"
1185
830
        pass
1186
831
    
1187
832
    # CheckerStarted - signal
1188
 
    @dbus.service.signal(_interface, signature="s")
 
833
    @dbus.service.signal(_interface, signature=u"s")
1189
834
    def CheckerStarted(self, command):
1190
835
        "D-Bus signal"
1191
836
        pass
1192
837
    
1193
838
    # PropertyChanged - signal
1194
 
    @dbus.service.signal(_interface, signature="sv")
 
839
    @dbus.service.signal(_interface, signature=u"sv")
1195
840
    def PropertyChanged(self, property, value):
1196
841
        "D-Bus signal"
1197
842
        pass
1199
844
    # GotSecret - signal
1200
845
    @dbus.service.signal(_interface)
1201
846
    def GotSecret(self):
1202
 
        """D-Bus signal
1203
 
        Is sent after a successful transfer of secret from the Mandos
1204
 
        server to mandos-client
1205
 
        """
1206
 
        pass
 
847
        "D-Bus signal"
 
848
        if self.approved_pending():
 
849
            self.PropertyChanged(dbus.String(u"checker_running"),
 
850
                                 dbus.Boolean(False, variant_level=1))
1207
851
    
1208
852
    # Rejected - signal
1209
 
    @dbus.service.signal(_interface, signature="s")
 
853
    @dbus.service.signal(_interface, signature=u"s")
1210
854
    def Rejected(self, reason):
1211
855
        "D-Bus signal"
1212
 
        pass
 
856
        if self.approved_pending():
 
857
            self.PropertyChanged(dbus.String(u"checker_running"),
 
858
                                 dbus.Boolean(False, variant_level=1))
1213
859
    
1214
860
    # NeedApproval - signal
1215
 
    @dbus.service.signal(_interface, signature="tb")
 
861
    @dbus.service.signal(_interface, signature=u"db")
1216
862
    def NeedApproval(self, timeout, default):
1217
863
        "D-Bus signal"
1218
 
        return self.need_approval()
1219
 
    
1220
 
    # NeRwequest - signal
1221
 
    @dbus.service.signal(_interface, signature="s")
1222
 
    def NewRequest(self, ip):
1223
 
        """D-Bus signal
1224
 
        Is sent after a client request a password.
1225
 
        """
1226
 
        pass
 
864
        if not self.approved_pending():
 
865
            self.PropertyChanged(dbus.String(u"approved_pending"),
 
866
                                 dbus.Boolean(True, variant_level=1))
1227
867
    
1228
868
    ## Methods
1229
 
    
 
869
 
1230
870
    # Approve - method
1231
 
    @dbus.service.method(_interface, in_signature="b")
 
871
    @dbus.service.method(_interface, in_signature=u"b")
1232
872
    def Approve(self, value):
1233
873
        self.approve(value)
1234
 
    
 
874
 
1235
875
    # CheckedOK - method
1236
876
    @dbus.service.method(_interface)
1237
877
    def CheckedOK(self):
1238
 
        self.checked_ok()
 
878
        return self.checked_ok()
1239
879
    
1240
880
    # Enable - method
1241
881
    @dbus.service.method(_interface)
1262
902
    
1263
903
    ## Properties
1264
904
    
1265
 
    # ApprovalPending - property
1266
 
    @dbus_service_property(_interface, signature="b", access="read")
1267
 
    def ApprovalPending_dbus_property(self):
1268
 
        return dbus.Boolean(bool(self.approvals_pending))
1269
 
    
1270
 
    # ApprovedByDefault - property
1271
 
    @dbus_service_property(_interface, signature="b",
1272
 
                           access="readwrite")
1273
 
    def ApprovedByDefault_dbus_property(self, value=None):
1274
 
        if value is None:       # get
1275
 
            return dbus.Boolean(self.approved_by_default)
1276
 
        self.approved_by_default = bool(value)
1277
 
    
1278
 
    # ApprovalDelay - property
1279
 
    @dbus_service_property(_interface, signature="t",
1280
 
                           access="readwrite")
1281
 
    def ApprovalDelay_dbus_property(self, value=None):
1282
 
        if value is None:       # get
1283
 
            return dbus.UInt64(self.approval_delay_milliseconds())
1284
 
        self.approval_delay = datetime.timedelta(0, 0, 0, value)
1285
 
    
1286
 
    # ApprovalDuration - property
1287
 
    @dbus_service_property(_interface, signature="t",
1288
 
                           access="readwrite")
1289
 
    def ApprovalDuration_dbus_property(self, value=None):
1290
 
        if value is None:       # get
1291
 
            return dbus.UInt64(timedelta_to_milliseconds(
1292
 
                    self.approval_duration))
1293
 
        self.approval_duration = datetime.timedelta(0, 0, 0, value)
1294
 
    
1295
 
    # Name - property
1296
 
    @dbus_service_property(_interface, signature="s", access="read")
1297
 
    def Name_dbus_property(self):
 
905
    # approved_pending - property
 
906
    @dbus_service_property(_interface, signature=u"b", access=u"read")
 
907
    def approved_pending_dbus_property(self):
 
908
        return dbus.Boolean(self.approved_pending())
 
909
    
 
910
    # approved_by_default - property
 
911
    @dbus_service_property(_interface, signature=u"b",
 
912
                           access=u"readwrite")
 
913
    def approved_by_default_dbus_property(self):
 
914
        return dbus.Boolean(self.approved_by_default)
 
915
    
 
916
    # approved_delay - property
 
917
    @dbus_service_property(_interface, signature=u"t",
 
918
                           access=u"readwrite")
 
919
    def approved_delay_dbus_property(self):
 
920
        return dbus.UInt64(self.approved_delay_milliseconds())
 
921
    
 
922
    # approved_duration - property
 
923
    @dbus_service_property(_interface, signature=u"t",
 
924
                           access=u"readwrite")
 
925
    def approved_duration_dbus_property(self):
 
926
        return dbus.UInt64(self._timedelta_to_milliseconds(
 
927
                self.approved_duration))
 
928
    
 
929
    # name - property
 
930
    @dbus_service_property(_interface, signature=u"s", access=u"read")
 
931
    def name_dbus_property(self):
1298
932
        return dbus.String(self.name)
1299
933
    
1300
 
    # Fingerprint - property
1301
 
    @dbus_service_property(_interface, signature="s", access="read")
1302
 
    def Fingerprint_dbus_property(self):
 
934
    # fingerprint - property
 
935
    @dbus_service_property(_interface, signature=u"s", access=u"read")
 
936
    def fingerprint_dbus_property(self):
1303
937
        return dbus.String(self.fingerprint)
1304
938
    
1305
 
    # Host - property
1306
 
    @dbus_service_property(_interface, signature="s",
1307
 
                           access="readwrite")
1308
 
    def Host_dbus_property(self, value=None):
 
939
    # host - property
 
940
    @dbus_service_property(_interface, signature=u"s",
 
941
                           access=u"readwrite")
 
942
    def host_dbus_property(self, value=None):
1309
943
        if value is None:       # get
1310
944
            return dbus.String(self.host)
1311
 
        self.host = unicode(value)
1312
 
    
1313
 
    # Created - property
1314
 
    @dbus_service_property(_interface, signature="s", access="read")
1315
 
    def Created_dbus_property(self):
1316
 
        return datetime_to_dbus(self.created)
1317
 
    
1318
 
    # LastEnabled - property
1319
 
    @dbus_service_property(_interface, signature="s", access="read")
1320
 
    def LastEnabled_dbus_property(self):
1321
 
        return datetime_to_dbus(self.last_enabled)
1322
 
    
1323
 
    # Enabled - property
1324
 
    @dbus_service_property(_interface, signature="b",
1325
 
                           access="readwrite")
1326
 
    def Enabled_dbus_property(self, value=None):
 
945
        self.host = value
 
946
        # Emit D-Bus signal
 
947
        self.PropertyChanged(dbus.String(u"host"),
 
948
                             dbus.String(value, variant_level=1))
 
949
    
 
950
    # created - property
 
951
    @dbus_service_property(_interface, signature=u"s", access=u"read")
 
952
    def created_dbus_property(self):
 
953
        return dbus.String(self._datetime_to_dbus(self.created))
 
954
    
 
955
    # last_enabled - property
 
956
    @dbus_service_property(_interface, signature=u"s", access=u"read")
 
957
    def last_enabled_dbus_property(self):
 
958
        if self.last_enabled is None:
 
959
            return dbus.String(u"")
 
960
        return dbus.String(self._datetime_to_dbus(self.last_enabled))
 
961
    
 
962
    # enabled - property
 
963
    @dbus_service_property(_interface, signature=u"b",
 
964
                           access=u"readwrite")
 
965
    def enabled_dbus_property(self, value=None):
1327
966
        if value is None:       # get
1328
967
            return dbus.Boolean(self.enabled)
1329
968
        if value:
1331
970
        else:
1332
971
            self.disable()
1333
972
    
1334
 
    # LastCheckedOK - property
1335
 
    @dbus_service_property(_interface, signature="s",
1336
 
                           access="readwrite")
1337
 
    def LastCheckedOK_dbus_property(self, value=None):
 
973
    # last_checked_ok - property
 
974
    @dbus_service_property(_interface, signature=u"s",
 
975
                           access=u"readwrite")
 
976
    def last_checked_ok_dbus_property(self, value=None):
1338
977
        if value is not None:
1339
978
            self.checked_ok()
1340
979
            return
1341
 
        return datetime_to_dbus(self.last_checked_ok)
1342
 
    
1343
 
    # Expires - property
1344
 
    @dbus_service_property(_interface, signature="s", access="read")
1345
 
    def Expires_dbus_property(self):
1346
 
        return datetime_to_dbus(self.expires)
1347
 
    
1348
 
    # LastApprovalRequest - property
1349
 
    @dbus_service_property(_interface, signature="s", access="read")
1350
 
    def LastApprovalRequest_dbus_property(self):
1351
 
        return datetime_to_dbus(self.last_approval_request)
1352
 
    
1353
 
    # Timeout - property
1354
 
    @dbus_service_property(_interface, signature="t",
1355
 
                           access="readwrite")
1356
 
    def Timeout_dbus_property(self, value=None):
 
980
        if self.last_checked_ok is None:
 
981
            return dbus.String(u"")
 
982
        return dbus.String(self._datetime_to_dbus(self
 
983
                                                  .last_checked_ok))
 
984
    
 
985
    # timeout - property
 
986
    @dbus_service_property(_interface, signature=u"t",
 
987
                           access=u"readwrite")
 
988
    def timeout_dbus_property(self, value=None):
1357
989
        if value is None:       # get
1358
990
            return dbus.UInt64(self.timeout_milliseconds())
1359
991
        self.timeout = datetime.timedelta(0, 0, 0, value)
1360
 
        if getattr(self, "disable_initiator_tag", None) is None:
 
992
        # Emit D-Bus signal
 
993
        self.PropertyChanged(dbus.String(u"timeout"),
 
994
                             dbus.UInt64(value, variant_level=1))
 
995
        if getattr(self, u"disable_initiator_tag", None) is None:
1361
996
            return
1362
997
        # Reschedule timeout
1363
998
        gobject.source_remove(self.disable_initiator_tag)
1364
999
        self.disable_initiator_tag = None
1365
 
        self.expires = None
1366
 
        time_to_die = timedelta_to_milliseconds((self
1367
 
                                                 .last_checked_ok
1368
 
                                                 + self.timeout)
1369
 
                                                - datetime.datetime
1370
 
                                                .utcnow())
 
1000
        time_to_die = (self.
 
1001
                       _timedelta_to_milliseconds((self
 
1002
                                                   .last_checked_ok
 
1003
                                                   + self.timeout)
 
1004
                                                  - datetime.datetime
 
1005
                                                  .utcnow()))
1371
1006
        if time_to_die <= 0:
1372
1007
            # The timeout has passed
1373
1008
            self.disable()
1374
1009
        else:
1375
 
            self.expires = (datetime.datetime.utcnow()
1376
 
                            + datetime.timedelta(milliseconds =
1377
 
                                                 time_to_die))
1378
1010
            self.disable_initiator_tag = (gobject.timeout_add
1379
1011
                                          (time_to_die, self.disable))
1380
1012
    
1381
 
    # ExtendedTimeout - property
1382
 
    @dbus_service_property(_interface, signature="t",
1383
 
                           access="readwrite")
1384
 
    def ExtendedTimeout_dbus_property(self, value=None):
1385
 
        if value is None:       # get
1386
 
            return dbus.UInt64(self.extended_timeout_milliseconds())
1387
 
        self.extended_timeout = datetime.timedelta(0, 0, 0, value)
1388
 
    
1389
 
    # Interval - property
1390
 
    @dbus_service_property(_interface, signature="t",
1391
 
                           access="readwrite")
1392
 
    def Interval_dbus_property(self, value=None):
 
1013
    # interval - property
 
1014
    @dbus_service_property(_interface, signature=u"t",
 
1015
                           access=u"readwrite")
 
1016
    def interval_dbus_property(self, value=None):
1393
1017
        if value is None:       # get
1394
1018
            return dbus.UInt64(self.interval_milliseconds())
1395
1019
        self.interval = datetime.timedelta(0, 0, 0, value)
1396
 
        if getattr(self, "checker_initiator_tag", None) is None:
 
1020
        # Emit D-Bus signal
 
1021
        self.PropertyChanged(dbus.String(u"interval"),
 
1022
                             dbus.UInt64(value, variant_level=1))
 
1023
        if getattr(self, u"checker_initiator_tag", None) is None:
1397
1024
            return
1398
 
        if self.enabled:
1399
 
            # Reschedule checker run
1400
 
            gobject.source_remove(self.checker_initiator_tag)
1401
 
            self.checker_initiator_tag = (gobject.timeout_add
1402
 
                                          (value, self.start_checker))
1403
 
            self.start_checker()    # Start one now, too
1404
 
    
1405
 
    # Checker - property
1406
 
    @dbus_service_property(_interface, signature="s",
1407
 
                           access="readwrite")
1408
 
    def Checker_dbus_property(self, value=None):
 
1025
        # Reschedule checker run
 
1026
        gobject.source_remove(self.checker_initiator_tag)
 
1027
        self.checker_initiator_tag = (gobject.timeout_add
 
1028
                                      (value, self.start_checker))
 
1029
        self.start_checker()    # Start one now, too
 
1030
 
 
1031
    # checker - property
 
1032
    @dbus_service_property(_interface, signature=u"s",
 
1033
                           access=u"readwrite")
 
1034
    def checker_dbus_property(self, value=None):
1409
1035
        if value is None:       # get
1410
1036
            return dbus.String(self.checker_command)
1411
 
        self.checker_command = unicode(value)
 
1037
        self.checker_command = value
 
1038
        # Emit D-Bus signal
 
1039
        self.PropertyChanged(dbus.String(u"checker"),
 
1040
                             dbus.String(self.checker_command,
 
1041
                                         variant_level=1))
1412
1042
    
1413
 
    # CheckerRunning - property
1414
 
    @dbus_service_property(_interface, signature="b",
1415
 
                           access="readwrite")
1416
 
    def CheckerRunning_dbus_property(self, value=None):
 
1043
    # checker_running - property
 
1044
    @dbus_service_property(_interface, signature=u"b",
 
1045
                           access=u"readwrite")
 
1046
    def checker_running_dbus_property(self, value=None):
1417
1047
        if value is None:       # get
1418
1048
            return dbus.Boolean(self.checker is not None)
1419
1049
        if value:
1421
1051
        else:
1422
1052
            self.stop_checker()
1423
1053
    
1424
 
    # ObjectPath - property
1425
 
    @dbus_service_property(_interface, signature="o", access="read")
1426
 
    def ObjectPath_dbus_property(self):
 
1054
    # object_path - property
 
1055
    @dbus_service_property(_interface, signature=u"o", access=u"read")
 
1056
    def object_path_dbus_property(self):
1427
1057
        return self.dbus_object_path # is already a dbus.ObjectPath
1428
1058
    
1429
 
    # Secret = property
1430
 
    @dbus_service_property(_interface, signature="ay",
1431
 
                           access="write", byte_arrays=True)
1432
 
    def Secret_dbus_property(self, value):
 
1059
    # secret = property
 
1060
    @dbus_service_property(_interface, signature=u"ay",
 
1061
                           access=u"write", byte_arrays=True)
 
1062
    def secret_dbus_property(self, value):
1433
1063
        self.secret = str(value)
1434
1064
    
1435
1065
    del _interface
1441
1071
        self._pipe.send(('init', fpr, address))
1442
1072
        if not self._pipe.recv():
1443
1073
            raise KeyError()
1444
 
    
 
1074
 
1445
1075
    def __getattribute__(self, name):
1446
 
        if name == '_pipe':
 
1076
        if(name == '_pipe'):
1447
1077
            return super(ProxyClient, self).__getattribute__(name)
1448
1078
        self._pipe.send(('getattr', name))
1449
1079
        data = self._pipe.recv()
1454
1084
                self._pipe.send(('funcall', name, args, kwargs))
1455
1085
                return self._pipe.recv()[1]
1456
1086
            return func
1457
 
    
 
1087
 
1458
1088
    def __setattr__(self, name, value):
1459
 
        if name == '_pipe':
 
1089
        if(name == '_pipe'):
1460
1090
            return super(ProxyClient, self).__setattr__(name, value)
1461
1091
        self._pipe.send(('setattr', name, value))
1462
1092
 
1463
1093
 
1464
 
class ClientDBusTransitional(ClientDBus):
1465
 
    __metaclass__ = AlternateDBusNamesMetaclass
1466
 
 
1467
 
 
1468
1094
class ClientHandler(socketserver.BaseRequestHandler, object):
1469
1095
    """A class to handle client connections.
1470
1096
    
1473
1099
    
1474
1100
    def handle(self):
1475
1101
        with contextlib.closing(self.server.child_pipe) as child_pipe:
1476
 
            logger.info("TCP connection from: %s",
 
1102
            logger.info(u"TCP connection from: %s",
1477
1103
                        unicode(self.client_address))
1478
 
            logger.debug("Pipe FD: %d",
 
1104
            logger.debug(u"Pipe FD: %d",
1479
1105
                         self.server.child_pipe.fileno())
1480
 
            
 
1106
 
1481
1107
            session = (gnutls.connection
1482
1108
                       .ClientSession(self.request,
1483
1109
                                      gnutls.connection
1484
1110
                                      .X509Credentials()))
1485
 
            
 
1111
 
1486
1112
            # Note: gnutls.connection.X509Credentials is really a
1487
1113
            # generic GnuTLS certificate credentials object so long as
1488
1114
            # no X.509 keys are added to it.  Therefore, we can use it
1489
1115
            # here despite using OpenPGP certificates.
1490
 
            
1491
 
            #priority = ':'.join(("NONE", "+VERS-TLS1.1",
1492
 
            #                      "+AES-256-CBC", "+SHA1",
1493
 
            #                      "+COMP-NULL", "+CTYPE-OPENPGP",
1494
 
            #                      "+DHE-DSS"))
 
1116
 
 
1117
            #priority = u':'.join((u"NONE", u"+VERS-TLS1.1",
 
1118
            #                      u"+AES-256-CBC", u"+SHA1",
 
1119
            #                      u"+COMP-NULL", u"+CTYPE-OPENPGP",
 
1120
            #                      u"+DHE-DSS"))
1495
1121
            # Use a fallback default, since this MUST be set.
1496
1122
            priority = self.server.gnutls_priority
1497
1123
            if priority is None:
1498
 
                priority = "NORMAL"
 
1124
                priority = u"NORMAL"
1499
1125
            (gnutls.library.functions
1500
1126
             .gnutls_priority_set_direct(session._c_object,
1501
1127
                                         priority, None))
1502
 
            
 
1128
 
1503
1129
            # Start communication using the Mandos protocol
1504
1130
            # Get protocol number
1505
1131
            line = self.request.makefile().readline()
1506
 
            logger.debug("Protocol version: %r", line)
 
1132
            logger.debug(u"Protocol version: %r", line)
1507
1133
            try:
1508
1134
                if int(line.strip().split()[0]) > 1:
1509
1135
                    raise RuntimeError
1510
 
            except (ValueError, IndexError, RuntimeError) as error:
1511
 
                logger.error("Unknown protocol version: %s", error)
 
1136
            except (ValueError, IndexError, RuntimeError), error:
 
1137
                logger.error(u"Unknown protocol version: %s", error)
1512
1138
                return
1513
 
            
 
1139
 
1514
1140
            # Start GnuTLS connection
1515
1141
            try:
1516
1142
                session.handshake()
1517
 
            except gnutls.errors.GNUTLSError as error:
1518
 
                logger.warning("Handshake failed: %s", error)
 
1143
            except gnutls.errors.GNUTLSError, error:
 
1144
                logger.warning(u"Handshake failed: %s", error)
1519
1145
                # Do not run session.bye() here: the session is not
1520
1146
                # established.  Just abandon the request.
1521
1147
                return
1522
 
            logger.debug("Handshake succeeded")
1523
 
            
 
1148
            logger.debug(u"Handshake succeeded")
 
1149
 
1524
1150
            approval_required = False
1525
1151
            try:
1526
1152
                try:
1527
1153
                    fpr = self.fingerprint(self.peer_certificate
1528
1154
                                           (session))
1529
 
                except (TypeError,
1530
 
                        gnutls.errors.GNUTLSError) as error:
1531
 
                    logger.warning("Bad certificate: %s", error)
 
1155
                except (TypeError, gnutls.errors.GNUTLSError), error:
 
1156
                    logger.warning(u"Bad certificate: %s", error)
1532
1157
                    return
1533
 
                logger.debug("Fingerprint: %s", fpr)
1534
 
                
 
1158
                logger.debug(u"Fingerprint: %s", fpr)
 
1159
 
1535
1160
                try:
1536
1161
                    client = ProxyClient(child_pipe, fpr,
1537
1162
                                         self.client_address)
1538
1163
                except KeyError:
1539
1164
                    return
1540
1165
                
1541
 
                if self.server.use_dbus:
1542
 
                    # Emit D-Bus signal
1543
 
                    client.NewRequest(str(self.client_address))
1544
 
                
1545
 
                if client.approval_delay:
1546
 
                    delay = client.approval_delay
 
1166
                if client.approved_delay:
 
1167
                    delay = client.approved_delay
1547
1168
                    client.approvals_pending += 1
1548
1169
                    approval_required = True
1549
1170
                
1550
1171
                while True:
1551
1172
                    if not client.enabled:
1552
 
                        logger.info("Client %s is disabled",
 
1173
                        logger.warning(u"Client %s is disabled",
1553
1174
                                       client.name)
1554
1175
                        if self.server.use_dbus:
1555
1176
                            # Emit D-Bus signal
1556
 
                            client.Rejected("Disabled")
 
1177
                            client.Rejected("Disabled")                    
1557
1178
                        return
1558
1179
                    
1559
 
                    if client.approved or not client.approval_delay:
 
1180
                    if client._approved or not client.approved_delay:
1560
1181
                        #We are approved or approval is disabled
1561
1182
                        break
1562
 
                    elif client.approved is None:
1563
 
                        logger.info("Client %s needs approval",
 
1183
                    elif client._approved is None:
 
1184
                        logger.info(u"Client %s need approval",
1564
1185
                                    client.name)
1565
1186
                        if self.server.use_dbus:
1566
1187
                            # Emit D-Bus signal
1567
1188
                            client.NeedApproval(
1568
 
                                client.approval_delay_milliseconds(),
 
1189
                                client.approved_delay_milliseconds(),
1569
1190
                                client.approved_by_default)
1570
1191
                    else:
1571
 
                        logger.warning("Client %s was not approved",
 
1192
                        logger.warning(u"Client %s was not approved",
1572
1193
                                       client.name)
1573
1194
                        if self.server.use_dbus:
1574
1195
                            # Emit D-Bus signal
1575
 
                            client.Rejected("Denied")
 
1196
                            client.Rejected("Disapproved")
1576
1197
                        return
1577
1198
                    
1578
1199
                    #wait until timeout or approved
 
1200
                    #x = float(client._timedelta_to_milliseconds(delay))
1579
1201
                    time = datetime.datetime.now()
1580
1202
                    client.changedstate.acquire()
1581
 
                    (client.changedstate.wait
1582
 
                     (float(client.timedelta_to_milliseconds(delay)
1583
 
                            / 1000)))
 
1203
                    client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))
1584
1204
                    client.changedstate.release()
1585
1205
                    time2 = datetime.datetime.now()
1586
1206
                    if (time2 - time) >= delay:
1590
1210
                                           client.name)
1591
1211
                            if self.server.use_dbus:
1592
1212
                                # Emit D-Bus signal
1593
 
                                client.Rejected("Approval timed out")
 
1213
                                client.Rejected("Time out")
1594
1214
                            return
1595
1215
                        else:
1596
1216
                            break
1599
1219
                
1600
1220
                sent_size = 0
1601
1221
                while sent_size < len(client.secret):
1602
 
                    try:
1603
 
                        sent = session.send(client.secret[sent_size:])
1604
 
                    except gnutls.errors.GNUTLSError as error:
1605
 
                        logger.warning("gnutls send failed")
1606
 
                        return
1607
 
                    logger.debug("Sent: %d, remaining: %d",
 
1222
                    # XXX handle session exception
 
1223
                    sent = session.send(client.secret[sent_size:])
 
1224
                    logger.debug(u"Sent: %d, remaining: %d",
1608
1225
                                 sent, len(client.secret)
1609
1226
                                 - (sent_size + sent))
1610
1227
                    sent_size += sent
1611
 
                
1612
 
                logger.info("Sending secret to %s", client.name)
1613
 
                # bump the timeout using extended_timeout
1614
 
                client.checked_ok(client.extended_timeout)
 
1228
 
 
1229
                logger.info(u"Sending secret to %s", client.name)
 
1230
                # bump the timeout as if seen
 
1231
                client.checked_ok()
1615
1232
                if self.server.use_dbus:
1616
1233
                    # Emit D-Bus signal
1617
1234
                    client.GotSecret()
1619
1236
            finally:
1620
1237
                if approval_required:
1621
1238
                    client.approvals_pending -= 1
1622
 
                try:
1623
 
                    session.bye()
1624
 
                except gnutls.errors.GNUTLSError as error:
1625
 
                    logger.warning("GnuTLS bye failed")
 
1239
                session.bye()
1626
1240
    
1627
1241
    @staticmethod
1628
1242
    def peer_certificate(session):
1638
1252
                     .gnutls_certificate_get_peers
1639
1253
                     (session._c_object, ctypes.byref(list_size)))
1640
1254
        if not bool(cert_list) and list_size.value != 0:
1641
 
            raise gnutls.errors.GNUTLSError("error getting peer"
1642
 
                                            " certificate")
 
1255
            raise gnutls.errors.GNUTLSError(u"error getting peer"
 
1256
                                            u" certificate")
1643
1257
        if list_size.value == 0:
1644
1258
            return None
1645
1259
        cert = cert_list[0]
1671
1285
        if crtverify.value != 0:
1672
1286
            gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1673
1287
            raise (gnutls.errors.CertificateSecurityError
1674
 
                   ("Verify failed"))
 
1288
                   (u"Verify failed"))
1675
1289
        # New buffer for the fingerprint
1676
1290
        buf = ctypes.create_string_buffer(20)
1677
1291
        buf_len = ctypes.c_size_t()
1684
1298
        # Convert the buffer to a Python bytestring
1685
1299
        fpr = ctypes.string_at(buf, buf_len.value)
1686
1300
        # Convert the bytestring to hexadecimal notation
1687
 
        hex_fpr = binascii.hexlify(fpr).upper()
 
1301
        hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
1688
1302
        return hex_fpr
1689
1303
 
1690
1304
 
1693
1307
    def sub_process_main(self, request, address):
1694
1308
        try:
1695
1309
            self.finish_request(request, address)
1696
 
        except Exception:
 
1310
        except:
1697
1311
            self.handle_error(request, address)
1698
1312
        self.close_request(request)
1699
 
    
 
1313
            
1700
1314
    def process_request(self, request, address):
1701
1315
        """Start a new process to process the request."""
1702
 
        proc = multiprocessing.Process(target = self.sub_process_main,
1703
 
                                       args = (request,
1704
 
                                               address))
1705
 
        proc.start()
1706
 
        return proc
1707
 
 
 
1316
        multiprocessing.Process(target = self.sub_process_main,
 
1317
                                args = (request, address)).start()
1708
1318
 
1709
1319
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
1710
1320
    """ adds a pipe to the MixIn """
1714
1324
        This function creates a new pipe in self.pipe
1715
1325
        """
1716
1326
        parent_pipe, self.child_pipe = multiprocessing.Pipe()
1717
 
        
1718
 
        proc = MultiprocessingMixIn.process_request(self, request,
1719
 
                                                    client_address)
1720
 
        self.child_pipe.close()
1721
 
        self.add_pipe(parent_pipe, proc)
1722
 
    
1723
 
    def add_pipe(self, parent_pipe, proc):
 
1327
 
 
1328
        super(MultiprocessingMixInWithPipe,
 
1329
              self).process_request(request, client_address)
 
1330
        self.add_pipe(parent_pipe)
 
1331
    def add_pipe(self, parent_pipe):
1724
1332
        """Dummy function; override as necessary"""
1725
 
        raise NotImplementedError
1726
 
 
 
1333
        pass
1727
1334
 
1728
1335
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
1729
1336
                     socketserver.TCPServer, object):
1747
1354
        bind to an address or port if they were not specified."""
1748
1355
        if self.interface is not None:
1749
1356
            if SO_BINDTODEVICE is None:
1750
 
                logger.error("SO_BINDTODEVICE does not exist;"
1751
 
                             " cannot bind to interface %s",
 
1357
                logger.error(u"SO_BINDTODEVICE does not exist;"
 
1358
                             u" cannot bind to interface %s",
1752
1359
                             self.interface)
1753
1360
            else:
1754
1361
                try:
1755
1362
                    self.socket.setsockopt(socket.SOL_SOCKET,
1756
1363
                                           SO_BINDTODEVICE,
1757
1364
                                           str(self.interface
1758
 
                                               + '\0'))
1759
 
                except socket.error as error:
 
1365
                                               + u'\0'))
 
1366
                except socket.error, error:
1760
1367
                    if error[0] == errno.EPERM:
1761
 
                        logger.error("No permission to"
1762
 
                                     " bind to interface %s",
 
1368
                        logger.error(u"No permission to"
 
1369
                                     u" bind to interface %s",
1763
1370
                                     self.interface)
1764
1371
                    elif error[0] == errno.ENOPROTOOPT:
1765
 
                        logger.error("SO_BINDTODEVICE not available;"
1766
 
                                     " cannot bind to interface %s",
 
1372
                        logger.error(u"SO_BINDTODEVICE not available;"
 
1373
                                     u" cannot bind to interface %s",
1767
1374
                                     self.interface)
1768
1375
                    else:
1769
1376
                        raise
1771
1378
        if self.server_address[0] or self.server_address[1]:
1772
1379
            if not self.server_address[0]:
1773
1380
                if self.address_family == socket.AF_INET6:
1774
 
                    any_address = "::" # in6addr_any
 
1381
                    any_address = u"::" # in6addr_any
1775
1382
                else:
1776
1383
                    any_address = socket.INADDR_ANY
1777
1384
                self.server_address = (any_address,
1804
1411
        self.enabled = False
1805
1412
        self.clients = clients
1806
1413
        if self.clients is None:
1807
 
            self.clients = {}
 
1414
            self.clients = set()
1808
1415
        self.use_dbus = use_dbus
1809
1416
        self.gnutls_priority = gnutls_priority
1810
1417
        IPv6_TCPServer.__init__(self, server_address,
1814
1421
    def server_activate(self):
1815
1422
        if self.enabled:
1816
1423
            return socketserver.TCPServer.server_activate(self)
1817
 
    
1818
1424
    def enable(self):
1819
1425
        self.enabled = True
1820
 
    
1821
 
    def add_pipe(self, parent_pipe, proc):
 
1426
    def add_pipe(self, parent_pipe):
1822
1427
        # Call "handle_ipc" for both data and EOF events
1823
1428
        gobject.io_add_watch(parent_pipe.fileno(),
1824
1429
                             gobject.IO_IN | gobject.IO_HUP,
1825
1430
                             functools.partial(self.handle_ipc,
1826
 
                                               parent_pipe =
1827
 
                                               parent_pipe,
1828
 
                                               proc = proc))
1829
 
    
 
1431
                                               parent_pipe = parent_pipe))
 
1432
        
1830
1433
    def handle_ipc(self, source, condition, parent_pipe=None,
1831
 
                   proc = None, client_object=None):
 
1434
                   client_object=None):
1832
1435
        condition_names = {
1833
 
            gobject.IO_IN: "IN",   # There is data to read.
1834
 
            gobject.IO_OUT: "OUT", # Data can be written (without
 
1436
            gobject.IO_IN: u"IN",   # There is data to read.
 
1437
            gobject.IO_OUT: u"OUT", # Data can be written (without
1835
1438
                                    # blocking).
1836
 
            gobject.IO_PRI: "PRI", # There is urgent data to read.
1837
 
            gobject.IO_ERR: "ERR", # Error condition.
1838
 
            gobject.IO_HUP: "HUP"  # Hung up (the connection has been
 
1439
            gobject.IO_PRI: u"PRI", # There is urgent data to read.
 
1440
            gobject.IO_ERR: u"ERR", # Error condition.
 
1441
            gobject.IO_HUP: u"HUP"  # Hung up (the connection has been
1839
1442
                                    # broken, usually for pipes and
1840
1443
                                    # sockets).
1841
1444
            }
1843
1446
                                       for cond, name in
1844
1447
                                       condition_names.iteritems()
1845
1448
                                       if cond & condition)
1846
 
        # error, or the other end of multiprocessing.Pipe has closed
1847
 
        if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):
1848
 
            # Wait for other process to exit
1849
 
            proc.join()
1850
 
            return False
 
1449
        logger.debug(u"Handling IPC: FD = %d, condition = %s", source,
 
1450
                     conditions_string)
1851
1451
        
1852
1452
        # Read a request from the child
1853
1453
        request = parent_pipe.recv()
1857
1457
            fpr = request[1]
1858
1458
            address = request[2]
1859
1459
            
1860
 
            for c in self.clients.itervalues():
 
1460
            for c in self.clients:
1861
1461
                if c.fingerprint == fpr:
1862
1462
                    client = c
1863
1463
                    break
1864
1464
            else:
1865
 
                logger.info("Client not found for fingerprint: %s, ad"
1866
 
                            "dress: %s", fpr, address)
 
1465
                logger.warning(u"Client not found for fingerprint: %s, ad"
 
1466
                               u"dress: %s", fpr, address)
1867
1467
                if self.use_dbus:
1868
1468
                    # Emit D-Bus signal
1869
 
                    mandos_dbus_service.ClientNotFound(fpr,
1870
 
                                                       address[0])
 
1469
                    mandos_dbus_service.ClientNotFound(fpr, address)
1871
1470
                parent_pipe.send(False)
1872
1471
                return False
1873
1472
            
1874
1473
            gobject.io_add_watch(parent_pipe.fileno(),
1875
1474
                                 gobject.IO_IN | gobject.IO_HUP,
1876
1475
                                 functools.partial(self.handle_ipc,
1877
 
                                                   parent_pipe =
1878
 
                                                   parent_pipe,
1879
 
                                                   proc = proc,
1880
 
                                                   client_object =
1881
 
                                                   client))
 
1476
                                                   parent_pipe = parent_pipe,
 
1477
                                                   client_object = client))
1882
1478
            parent_pipe.send(True)
1883
 
            # remove the old hook in favor of the new above hook on
1884
 
            # same fileno
 
1479
            # remove the old hook in favor of the new above hook on same fileno
1885
1480
            return False
1886
1481
        if command == 'funcall':
1887
1482
            funcname = request[1]
1888
1483
            args = request[2]
1889
1484
            kwargs = request[3]
1890
1485
            
1891
 
            parent_pipe.send(('data', getattr(client_object,
1892
 
                                              funcname)(*args,
1893
 
                                                         **kwargs)))
1894
 
        
 
1486
            parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))
 
1487
 
1895
1488
        if command == 'getattr':
1896
1489
            attrname = request[1]
1897
1490
            if callable(client_object.__getattribute__(attrname)):
1898
1491
                parent_pipe.send(('function',))
1899
1492
            else:
1900
 
                parent_pipe.send(('data', client_object
1901
 
                                  .__getattribute__(attrname)))
1902
 
        
 
1493
                parent_pipe.send(('data', client_object.__getattribute__(attrname)))
 
1494
 
1903
1495
        if command == 'setattr':
1904
1496
            attrname = request[1]
1905
1497
            value = request[2]
1906
1498
            setattr(client_object, attrname, value)
1907
 
        
 
1499
            
1908
1500
        return True
1909
1501
 
1910
1502
 
1911
1503
def string_to_delta(interval):
1912
1504
    """Parse a string and return a datetime.timedelta
1913
1505
    
1914
 
    >>> string_to_delta('7d')
 
1506
    >>> string_to_delta(u'7d')
1915
1507
    datetime.timedelta(7)
1916
 
    >>> string_to_delta('60s')
 
1508
    >>> string_to_delta(u'60s')
1917
1509
    datetime.timedelta(0, 60)
1918
 
    >>> string_to_delta('60m')
 
1510
    >>> string_to_delta(u'60m')
1919
1511
    datetime.timedelta(0, 3600)
1920
 
    >>> string_to_delta('24h')
 
1512
    >>> string_to_delta(u'24h')
1921
1513
    datetime.timedelta(1)
1922
 
    >>> string_to_delta('1w')
 
1514
    >>> string_to_delta(u'1w')
1923
1515
    datetime.timedelta(7)
1924
 
    >>> string_to_delta('5m 30s')
 
1516
    >>> string_to_delta(u'5m 30s')
1925
1517
    datetime.timedelta(0, 330)
1926
1518
    """
1927
1519
    timevalue = datetime.timedelta(0)
1929
1521
        try:
1930
1522
            suffix = unicode(s[-1])
1931
1523
            value = int(s[:-1])
1932
 
            if suffix == "d":
 
1524
            if suffix == u"d":
1933
1525
                delta = datetime.timedelta(value)
1934
 
            elif suffix == "s":
 
1526
            elif suffix == u"s":
1935
1527
                delta = datetime.timedelta(0, value)
1936
 
            elif suffix == "m":
 
1528
            elif suffix == u"m":
1937
1529
                delta = datetime.timedelta(0, 0, 0, 0, value)
1938
 
            elif suffix == "h":
 
1530
            elif suffix == u"h":
1939
1531
                delta = datetime.timedelta(0, 0, 0, 0, 0, value)
1940
 
            elif suffix == "w":
 
1532
            elif suffix == u"w":
1941
1533
                delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
1942
1534
            else:
1943
 
                raise ValueError("Unknown suffix %r" % suffix)
1944
 
        except (ValueError, IndexError) as e:
1945
 
            raise ValueError(*(e.args))
 
1535
                raise ValueError(u"Unknown suffix %r" % suffix)
 
1536
        except (ValueError, IndexError), e:
 
1537
            raise ValueError(e.message)
1946
1538
        timevalue += delta
1947
1539
    return timevalue
1948
1540
 
1949
1541
 
 
1542
def if_nametoindex(interface):
 
1543
    """Call the C function if_nametoindex(), or equivalent
 
1544
    
 
1545
    Note: This function cannot accept a unicode string."""
 
1546
    global if_nametoindex
 
1547
    try:
 
1548
        if_nametoindex = (ctypes.cdll.LoadLibrary
 
1549
                          (ctypes.util.find_library(u"c"))
 
1550
                          .if_nametoindex)
 
1551
    except (OSError, AttributeError):
 
1552
        logger.warning(u"Doing if_nametoindex the hard way")
 
1553
        def if_nametoindex(interface):
 
1554
            "Get an interface index the hard way, i.e. using fcntl()"
 
1555
            SIOCGIFINDEX = 0x8933  # From /usr/include/linux/sockios.h
 
1556
            with contextlib.closing(socket.socket()) as s:
 
1557
                ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
 
1558
                                    struct.pack(str(u"16s16x"),
 
1559
                                                interface))
 
1560
            interface_index = struct.unpack(str(u"I"),
 
1561
                                            ifreq[16:20])[0]
 
1562
            return interface_index
 
1563
    return if_nametoindex(interface)
 
1564
 
 
1565
 
1950
1566
def daemon(nochdir = False, noclose = False):
1951
1567
    """See daemon(3).  Standard BSD Unix function.
1952
1568
    
1955
1571
        sys.exit()
1956
1572
    os.setsid()
1957
1573
    if not nochdir:
1958
 
        os.chdir("/")
 
1574
        os.chdir(u"/")
1959
1575
    if os.fork():
1960
1576
        sys.exit()
1961
1577
    if not noclose:
1963
1579
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1964
1580
        if not stat.S_ISCHR(os.fstat(null).st_mode):
1965
1581
            raise OSError(errno.ENODEV,
1966
 
                          "%s not a character device"
 
1582
                          u"%s not a character device"
1967
1583
                          % os.path.devnull)
1968
1584
        os.dup2(null, sys.stdin.fileno())
1969
1585
        os.dup2(null, sys.stdout.fileno())
1977
1593
    ##################################################################
1978
1594
    # Parsing of options, both command line and config file
1979
1595
    
1980
 
    parser = argparse.ArgumentParser()
1981
 
    parser.add_argument("-v", "--version", action="version",
1982
 
                        version = "%%(prog)s %s" % version,
1983
 
                        help="show version number and exit")
1984
 
    parser.add_argument("-i", "--interface", metavar="IF",
1985
 
                        help="Bind to interface IF")
1986
 
    parser.add_argument("-a", "--address",
1987
 
                        help="Address to listen for requests on")
1988
 
    parser.add_argument("-p", "--port", type=int,
1989
 
                        help="Port number to receive requests on")
1990
 
    parser.add_argument("--check", action="store_true",
1991
 
                        help="Run self-test")
1992
 
    parser.add_argument("--debug", action="store_true",
1993
 
                        help="Debug mode; run in foreground and log"
1994
 
                        " to terminal")
1995
 
    parser.add_argument("--debuglevel", metavar="LEVEL",
1996
 
                        help="Debug level for stdout output")
1997
 
    parser.add_argument("--priority", help="GnuTLS"
1998
 
                        " priority string (see GnuTLS documentation)")
1999
 
    parser.add_argument("--servicename",
2000
 
                        metavar="NAME", help="Zeroconf service name")
2001
 
    parser.add_argument("--configdir",
2002
 
                        default="/etc/mandos", metavar="DIR",
2003
 
                        help="Directory to search for configuration"
2004
 
                        " files")
2005
 
    parser.add_argument("--no-dbus", action="store_false",
2006
 
                        dest="use_dbus", help="Do not provide D-Bus"
2007
 
                        " system bus interface")
2008
 
    parser.add_argument("--no-ipv6", action="store_false",
2009
 
                        dest="use_ipv6", help="Do not use IPv6")
2010
 
    parser.add_argument("--no-restore", action="store_false",
2011
 
                        dest="restore", help="Do not restore stored"
2012
 
                        " state")
2013
 
    parser.add_argument("--statedir", metavar="DIR",
2014
 
                        help="Directory to save/restore state in")
2015
 
    
2016
 
    options = parser.parse_args()
 
1596
    parser = optparse.OptionParser(version = "%%prog %s" % version)
 
1597
    parser.add_option("-i", u"--interface", type=u"string",
 
1598
                      metavar="IF", help=u"Bind to interface IF")
 
1599
    parser.add_option("-a", u"--address", type=u"string",
 
1600
                      help=u"Address to listen for requests on")
 
1601
    parser.add_option("-p", u"--port", type=u"int",
 
1602
                      help=u"Port number to receive requests on")
 
1603
    parser.add_option("--check", action=u"store_true",
 
1604
                      help=u"Run self-test")
 
1605
    parser.add_option("--debug", action=u"store_true",
 
1606
                      help=u"Debug mode; run in foreground and log to"
 
1607
                      u" terminal")
 
1608
    parser.add_option("--priority", type=u"string", help=u"GnuTLS"
 
1609
                      u" priority string (see GnuTLS documentation)")
 
1610
    parser.add_option("--servicename", type=u"string",
 
1611
                      metavar=u"NAME", help=u"Zeroconf service name")
 
1612
    parser.add_option("--configdir", type=u"string",
 
1613
                      default=u"/etc/mandos", metavar=u"DIR",
 
1614
                      help=u"Directory to search for configuration"
 
1615
                      u" files")
 
1616
    parser.add_option("--no-dbus", action=u"store_false",
 
1617
                      dest=u"use_dbus", help=u"Do not provide D-Bus"
 
1618
                      u" system bus interface")
 
1619
    parser.add_option("--no-ipv6", action=u"store_false",
 
1620
                      dest=u"use_ipv6", help=u"Do not use IPv6")
 
1621
    options = parser.parse_args()[0]
2017
1622
    
2018
1623
    if options.check:
2019
1624
        import doctest
2021
1626
        sys.exit()
2022
1627
    
2023
1628
    # Default values for config file for server-global settings
2024
 
    server_defaults = { "interface": "",
2025
 
                        "address": "",
2026
 
                        "port": "",
2027
 
                        "debug": "False",
2028
 
                        "priority":
2029
 
                        "SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
2030
 
                        "servicename": "Mandos",
2031
 
                        "use_dbus": "True",
2032
 
                        "use_ipv6": "True",
2033
 
                        "debuglevel": "",
2034
 
                        "restore": "True",
2035
 
                        "statedir": "/var/lib/mandos"
 
1629
    server_defaults = { u"interface": u"",
 
1630
                        u"address": u"",
 
1631
                        u"port": u"",
 
1632
                        u"debug": u"False",
 
1633
                        u"priority":
 
1634
                        u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
 
1635
                        u"servicename": u"Mandos",
 
1636
                        u"use_dbus": u"True",
 
1637
                        u"use_ipv6": u"True",
2036
1638
                        }
2037
1639
    
2038
1640
    # Parse config file for server-global settings
2039
1641
    server_config = configparser.SafeConfigParser(server_defaults)
2040
1642
    del server_defaults
2041
1643
    server_config.read(os.path.join(options.configdir,
2042
 
                                    "mandos.conf"))
 
1644
                                    u"mandos.conf"))
2043
1645
    # Convert the SafeConfigParser object to a dict
2044
1646
    server_settings = server_config.defaults()
2045
1647
    # Use the appropriate methods on the non-string config options
2046
 
    for option in ("debug", "use_dbus", "use_ipv6"):
2047
 
        server_settings[option] = server_config.getboolean("DEFAULT",
 
1648
    for option in (u"debug", u"use_dbus", u"use_ipv6"):
 
1649
        server_settings[option] = server_config.getboolean(u"DEFAULT",
2048
1650
                                                           option)
2049
1651
    if server_settings["port"]:
2050
 
        server_settings["port"] = server_config.getint("DEFAULT",
2051
 
                                                       "port")
 
1652
        server_settings["port"] = server_config.getint(u"DEFAULT",
 
1653
                                                       u"port")
2052
1654
    del server_config
2053
1655
    
2054
1656
    # Override the settings from the config file with command line
2055
1657
    # options, if set.
2056
 
    for option in ("interface", "address", "port", "debug",
2057
 
                   "priority", "servicename", "configdir",
2058
 
                   "use_dbus", "use_ipv6", "debuglevel", "restore",
2059
 
                   "statedir"):
 
1658
    for option in (u"interface", u"address", u"port", u"debug",
 
1659
                   u"priority", u"servicename", u"configdir",
 
1660
                   u"use_dbus", u"use_ipv6"):
2060
1661
        value = getattr(options, option)
2061
1662
        if value is not None:
2062
1663
            server_settings[option] = value
2070
1671
    ##################################################################
2071
1672
    
2072
1673
    # For convenience
2073
 
    debug = server_settings["debug"]
2074
 
    debuglevel = server_settings["debuglevel"]
2075
 
    use_dbus = server_settings["use_dbus"]
2076
 
    use_ipv6 = server_settings["use_ipv6"]
2077
 
    stored_state_path = os.path.join(server_settings["statedir"],
2078
 
                                     stored_state_file)
2079
 
    
2080
 
    if debug:
2081
 
        initlogger(logging.DEBUG)
2082
 
    else:
2083
 
        if not debuglevel:
2084
 
            initlogger()
2085
 
        else:
2086
 
            level = getattr(logging, debuglevel.upper())
2087
 
            initlogger(level)
2088
 
    
2089
 
    if server_settings["servicename"] != "Mandos":
 
1674
    debug = server_settings[u"debug"]
 
1675
    use_dbus = server_settings[u"use_dbus"]
 
1676
    use_ipv6 = server_settings[u"use_ipv6"]
 
1677
    
 
1678
    if not debug:
 
1679
        syslogger.setLevel(logging.WARNING)
 
1680
        console.setLevel(logging.WARNING)
 
1681
    
 
1682
    if server_settings[u"servicename"] != u"Mandos":
2090
1683
        syslogger.setFormatter(logging.Formatter
2091
 
                               ('Mandos (%s) [%%(process)d]:'
2092
 
                                ' %%(levelname)s: %%(message)s'
2093
 
                                % server_settings["servicename"]))
 
1684
                               (u'Mandos (%s) [%%(process)d]:'
 
1685
                                u' %%(levelname)s: %%(message)s'
 
1686
                                % server_settings[u"servicename"]))
2094
1687
    
2095
1688
    # Parse config file with clients
2096
 
    client_config = configparser.SafeConfigParser(Client.client_defaults)
2097
 
    client_config.read(os.path.join(server_settings["configdir"],
2098
 
                                    "clients.conf"))
 
1689
    client_defaults = { u"timeout": u"1h",
 
1690
                        u"interval": u"5m",
 
1691
                        u"checker": u"fping -q -- %%(host)s",
 
1692
                        u"host": u"",
 
1693
                        u"approved_delay": u"0s",
 
1694
                        u"approved_duration": u"1s",
 
1695
                        }
 
1696
    client_config = configparser.SafeConfigParser(client_defaults)
 
1697
    client_config.read(os.path.join(server_settings[u"configdir"],
 
1698
                                    u"clients.conf"))
2099
1699
    
2100
1700
    global mandos_dbus_service
2101
1701
    mandos_dbus_service = None
2102
1702
    
2103
 
    tcp_server = MandosServer((server_settings["address"],
2104
 
                               server_settings["port"]),
 
1703
    tcp_server = MandosServer((server_settings[u"address"],
 
1704
                               server_settings[u"port"]),
2105
1705
                              ClientHandler,
2106
 
                              interface=(server_settings["interface"]
2107
 
                                         or None),
 
1706
                              interface=server_settings[u"interface"],
2108
1707
                              use_ipv6=use_ipv6,
2109
1708
                              gnutls_priority=
2110
 
                              server_settings["priority"],
 
1709
                              server_settings[u"priority"],
2111
1710
                              use_dbus=use_dbus)
2112
 
    if not debug:
2113
 
        pidfilename = "/var/run/mandos.pid"
2114
 
        try:
2115
 
            pidfile = open(pidfilename, "w")
2116
 
        except IOError:
2117
 
            logger.error("Could not open file %r", pidfilename)
 
1711
    pidfilename = u"/var/run/mandos.pid"
 
1712
    try:
 
1713
        pidfile = open(pidfilename, u"w")
 
1714
    except IOError:
 
1715
        logger.error(u"Could not open file %r", pidfilename)
2118
1716
    
2119
1717
    try:
2120
 
        uid = pwd.getpwnam("_mandos").pw_uid
2121
 
        gid = pwd.getpwnam("_mandos").pw_gid
 
1718
        uid = pwd.getpwnam(u"_mandos").pw_uid
 
1719
        gid = pwd.getpwnam(u"_mandos").pw_gid
2122
1720
    except KeyError:
2123
1721
        try:
2124
 
            uid = pwd.getpwnam("mandos").pw_uid
2125
 
            gid = pwd.getpwnam("mandos").pw_gid
 
1722
            uid = pwd.getpwnam(u"mandos").pw_uid
 
1723
            gid = pwd.getpwnam(u"mandos").pw_gid
2126
1724
        except KeyError:
2127
1725
            try:
2128
 
                uid = pwd.getpwnam("nobody").pw_uid
2129
 
                gid = pwd.getpwnam("nobody").pw_gid
 
1726
                uid = pwd.getpwnam(u"nobody").pw_uid
 
1727
                gid = pwd.getpwnam(u"nobody").pw_gid
2130
1728
            except KeyError:
2131
1729
                uid = 65534
2132
1730
                gid = 65534
2133
1731
    try:
2134
1732
        os.setgid(gid)
2135
1733
        os.setuid(uid)
2136
 
    except OSError as error:
 
1734
    except OSError, error:
2137
1735
        if error[0] != errno.EPERM:
2138
1736
            raise error
2139
1737
    
 
1738
    # Enable all possible GnuTLS debugging
2140
1739
    if debug:
2141
 
        # Enable all possible GnuTLS debugging
2142
 
        
2143
1740
        # "Use a log level over 10 to enable all debugging options."
2144
1741
        # - GnuTLS manual
2145
1742
        gnutls.library.functions.gnutls_global_set_log_level(11)
2146
1743
        
2147
1744
        @gnutls.library.types.gnutls_log_func
2148
1745
        def debug_gnutls(level, string):
2149
 
            logger.debug("GnuTLS: %s", string[:-1])
 
1746
            logger.debug(u"GnuTLS: %s", string[:-1])
2150
1747
        
2151
1748
        (gnutls.library.functions
2152
1749
         .gnutls_global_set_log_function(debug_gnutls))
2153
 
        
2154
 
        # Redirect stdin so all checkers get /dev/null
2155
 
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
2156
 
        os.dup2(null, sys.stdin.fileno())
2157
 
        if null > 2:
2158
 
            os.close(null)
2159
 
    else:
2160
 
        # No console logging
2161
 
        logger.removeHandler(console)
2162
 
    
2163
 
    # Need to fork before connecting to D-Bus
2164
 
    if not debug:
2165
 
        # Close all input and output, do double fork, etc.
2166
 
        daemon()
2167
 
    
2168
 
    gobject.threads_init()
2169
1750
    
2170
1751
    global main_loop
2171
1752
    # From the Avahi example code
2175
1756
    # End of Avahi example code
2176
1757
    if use_dbus:
2177
1758
        try:
2178
 
            bus_name = dbus.service.BusName("se.recompile.Mandos",
 
1759
            bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos",
2179
1760
                                            bus, do_not_queue=True)
2180
 
            old_bus_name = (dbus.service.BusName
2181
 
                            ("se.bsnet.fukt.Mandos", bus,
2182
 
                             do_not_queue=True))
2183
 
        except dbus.exceptions.NameExistsException as e:
2184
 
            logger.error(unicode(e) + ", disabling D-Bus")
 
1761
        except dbus.exceptions.NameExistsException, e:
 
1762
            logger.error(unicode(e) + u", disabling D-Bus")
2185
1763
            use_dbus = False
2186
 
            server_settings["use_dbus"] = False
 
1764
            server_settings[u"use_dbus"] = False
2187
1765
            tcp_server.use_dbus = False
2188
1766
    protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2189
 
    service = AvahiServiceToSyslog(name =
2190
 
                                   server_settings["servicename"],
2191
 
                                   servicetype = "_mandos._tcp",
2192
 
                                   protocol = protocol, bus = bus)
 
1767
    service = AvahiService(name = server_settings[u"servicename"],
 
1768
                           servicetype = u"_mandos._tcp",
 
1769
                           protocol = protocol, bus = bus)
2193
1770
    if server_settings["interface"]:
2194
1771
        service.interface = (if_nametoindex
2195
 
                             (str(server_settings["interface"])))
2196
 
    
2197
 
    global multiprocessing_manager
2198
 
    multiprocessing_manager = multiprocessing.Manager()
 
1772
                             (str(server_settings[u"interface"])))
2199
1773
    
2200
1774
    client_class = Client
2201
1775
    if use_dbus:
2202
 
        client_class = functools.partial(ClientDBusTransitional,
2203
 
                                         bus = bus)
2204
 
    
2205
 
    client_settings = Client.config_parser(client_config)
2206
 
    old_client_settings = {}
2207
 
    clients_data = {}
2208
 
    
2209
 
    # Get client data and settings from last running state.
2210
 
    if server_settings["restore"]:
2211
 
        try:
2212
 
            with open(stored_state_path, "rb") as stored_state:
2213
 
                clients_data, old_client_settings = (pickle.load
2214
 
                                                     (stored_state))
2215
 
            os.remove(stored_state_path)
2216
 
        except IOError as e:
2217
 
            logger.warning("Could not load persistent state: {0}"
2218
 
                           .format(e))
2219
 
            if e.errno != errno.ENOENT:
2220
 
                raise
2221
 
        except EOFError as e:
2222
 
            logger.warning("Could not load persistent state: "
2223
 
                           "EOFError: {0}".format(e))
2224
 
    
2225
 
    with PGPEngine() as pgp:
2226
 
        for client_name, client in clients_data.iteritems():
2227
 
            # Decide which value to use after restoring saved state.
2228
 
            # We have three different values: Old config file,
2229
 
            # new config file, and saved state.
2230
 
            # New config value takes precedence if it differs from old
2231
 
            # config value, otherwise use saved state.
2232
 
            for name, value in client_settings[client_name].items():
2233
 
                try:
2234
 
                    # For each value in new config, check if it
2235
 
                    # differs from the old config value (Except for
2236
 
                    # the "secret" attribute)
2237
 
                    if (name != "secret" and
2238
 
                        value != old_client_settings[client_name]
2239
 
                        [name]):
2240
 
                        client[name] = value
2241
 
                except KeyError:
2242
 
                    pass
2243
 
            
2244
 
            # Clients who has passed its expire date can still be
2245
 
            # enabled if its last checker was successful.  Clients
2246
 
            # whose checker failed before we stored its state is
2247
 
            # assumed to have failed all checkers during downtime.
2248
 
            if client["enabled"]:
2249
 
                if datetime.datetime.utcnow() >= client["expires"]:
2250
 
                    if not client["last_checked_ok"]:
2251
 
                        logger.warning(
2252
 
                            "disabling client {0} - Client never "
2253
 
                            "performed a successfull checker"
2254
 
                            .format(client["name"]))
2255
 
                        client["enabled"] = False
2256
 
                    elif client["last_checker_status"] != 0:
2257
 
                        logger.warning(
2258
 
                            "disabling client {0} - Client "
2259
 
                            "last checker failed with error code {1}"
2260
 
                            .format(client["name"],
2261
 
                                    client["last_checker_status"]))
2262
 
                        client["enabled"] = False
2263
 
                    else:
2264
 
                        client["expires"] = (datetime.datetime
2265
 
                                             .utcnow()
2266
 
                                             + client["timeout"])
2267
 
                    
 
1776
        client_class = functools.partial(ClientDBus, bus = bus)
 
1777
    def client_config_items(config, section):
 
1778
        special_settings = {
 
1779
            "approved_by_default":
 
1780
                lambda: config.getboolean(section,
 
1781
                                          "approved_by_default"),
 
1782
            }
 
1783
        for name, value in config.items(section):
2268
1784
            try:
2269
 
                client["secret"] = (
2270
 
                    pgp.decrypt(client["encrypted_secret"],
2271
 
                                client_settings[client_name]
2272
 
                                ["secret"]))
2273
 
            except PGPError:
2274
 
                # If decryption fails, we use secret from new settings
2275
 
                logger.debug("Failed to decrypt {0} old secret"
2276
 
                             .format(client_name))
2277
 
                client["secret"] = (
2278
 
                    client_settings[client_name]["secret"])
2279
 
 
2280
 
    
2281
 
    # Add/remove clients based on new changes made to config
2282
 
    for client_name in set(old_client_settings) - set(client_settings):
2283
 
        del clients_data[client_name]
2284
 
    for client_name in set(client_settings) - set(old_client_settings):
2285
 
        clients_data[client_name] = client_settings[client_name]
2286
 
 
2287
 
    # Create clients all clients
2288
 
    for client_name, client in clients_data.iteritems():
2289
 
        tcp_server.clients[client_name] = client_class(
2290
 
            name = client_name, settings = client)
2291
 
    
 
1785
                yield (name, special_settings[name]())
 
1786
            except KeyError:
 
1787
                yield (name, value)
 
1788
    
 
1789
    tcp_server.clients.update(set(
 
1790
            client_class(name = section,
 
1791
                         config= dict(client_config_items(
 
1792
                        client_config, section)))
 
1793
            for section in client_config.sections()))
2292
1794
    if not tcp_server.clients:
2293
 
        logger.warning("No clients defined")
2294
 
        
 
1795
        logger.warning(u"No clients defined")
 
1796
    
 
1797
    if debug:
 
1798
        # Redirect stdin so all checkers get /dev/null
 
1799
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
 
1800
        os.dup2(null, sys.stdin.fileno())
 
1801
        if null > 2:
 
1802
            os.close(null)
 
1803
    else:
 
1804
        # No console logging
 
1805
        logger.removeHandler(console)
 
1806
        # Close all input and output, do double fork, etc.
 
1807
        daemon()
 
1808
    
 
1809
    try:
 
1810
        with pidfile:
 
1811
            pid = os.getpid()
 
1812
            pidfile.write(str(pid) + "\n")
 
1813
        del pidfile
 
1814
    except IOError:
 
1815
        logger.error(u"Could not write to file %r with PID %d",
 
1816
                     pidfilename, pid)
 
1817
    except NameError:
 
1818
        # "pidfile" was never created
 
1819
        pass
 
1820
    del pidfilename
 
1821
    
2295
1822
    if not debug:
2296
 
        try:
2297
 
            with pidfile:
2298
 
                pid = os.getpid()
2299
 
                pidfile.write(str(pid) + "\n".encode("utf-8"))
2300
 
            del pidfile
2301
 
        except IOError:
2302
 
            logger.error("Could not write to file %r with PID %d",
2303
 
                         pidfilename, pid)
2304
 
        except NameError:
2305
 
            # "pidfile" was never created
2306
 
            pass
2307
 
        del pidfilename
2308
1823
        signal.signal(signal.SIGINT, signal.SIG_IGN)
2309
 
    
2310
1824
    signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2311
1825
    signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
2312
1826
    
2314
1828
        class MandosDBusService(dbus.service.Object):
2315
1829
            """A D-Bus proxy object"""
2316
1830
            def __init__(self):
2317
 
                dbus.service.Object.__init__(self, bus, "/")
2318
 
            _interface = "se.recompile.Mandos"
 
1831
                dbus.service.Object.__init__(self, bus, u"/")
 
1832
            _interface = u"se.bsnet.fukt.Mandos"
2319
1833
            
2320
 
            @dbus.service.signal(_interface, signature="o")
 
1834
            @dbus.service.signal(_interface, signature=u"o")
2321
1835
            def ClientAdded(self, objpath):
2322
1836
                "D-Bus signal"
2323
1837
                pass
2324
1838
            
2325
 
            @dbus.service.signal(_interface, signature="ss")
 
1839
            @dbus.service.signal(_interface, signature=u"ss")
2326
1840
            def ClientNotFound(self, fingerprint, address):
2327
1841
                "D-Bus signal"
2328
1842
                pass
2329
1843
            
2330
 
            @dbus.service.signal(_interface, signature="os")
 
1844
            @dbus.service.signal(_interface, signature=u"os")
2331
1845
            def ClientRemoved(self, objpath, name):
2332
1846
                "D-Bus signal"
2333
1847
                pass
2334
1848
            
2335
 
            @dbus.service.method(_interface, out_signature="ao")
 
1849
            @dbus.service.method(_interface, out_signature=u"ao")
2336
1850
            def GetAllClients(self):
2337
1851
                "D-Bus method"
2338
1852
                return dbus.Array(c.dbus_object_path
2339
 
                                  for c in
2340
 
                                  tcp_server.clients.itervalues())
 
1853
                                  for c in tcp_server.clients)
2341
1854
            
2342
1855
            @dbus.service.method(_interface,
2343
 
                                 out_signature="a{oa{sv}}")
 
1856
                                 out_signature=u"a{oa{sv}}")
2344
1857
            def GetAllClientsWithProperties(self):
2345
1858
                "D-Bus method"
2346
1859
                return dbus.Dictionary(
2347
 
                    ((c.dbus_object_path, c.GetAll(""))
2348
 
                     for c in tcp_server.clients.itervalues()),
2349
 
                    signature="oa{sv}")
 
1860
                    ((c.dbus_object_path, c.GetAll(u""))
 
1861
                     for c in tcp_server.clients),
 
1862
                    signature=u"oa{sv}")
2350
1863
            
2351
 
            @dbus.service.method(_interface, in_signature="o")
 
1864
            @dbus.service.method(_interface, in_signature=u"o")
2352
1865
            def RemoveClient(self, object_path):
2353
1866
                "D-Bus method"
2354
 
                for c in tcp_server.clients.itervalues():
 
1867
                for c in tcp_server.clients:
2355
1868
                    if c.dbus_object_path == object_path:
2356
 
                        del tcp_server.clients[c.name]
 
1869
                        tcp_server.clients.remove(c)
2357
1870
                        c.remove_from_connection()
2358
1871
                        # Don't signal anything except ClientRemoved
2359
1872
                        c.disable(quiet=True)
2364
1877
            
2365
1878
            del _interface
2366
1879
        
2367
 
        class MandosDBusServiceTransitional(MandosDBusService):
2368
 
            __metaclass__ = AlternateDBusNamesMetaclass
2369
 
        mandos_dbus_service = MandosDBusServiceTransitional()
 
1880
        mandos_dbus_service = MandosDBusService()
2370
1881
    
2371
1882
    def cleanup():
2372
1883
        "Cleanup function; run on exit"
2373
1884
        service.cleanup()
2374
1885
        
2375
 
        multiprocessing.active_children()
2376
 
        if not (tcp_server.clients or client_settings):
2377
 
            return
2378
 
        
2379
 
        # Store client before exiting. Secrets are encrypted with key
2380
 
        # based on what config file has. If config file is
2381
 
        # removed/edited, old secret will thus be unrecovable.
2382
 
        clients = {}
2383
 
        with PGPEngine() as pgp:
2384
 
            for client in tcp_server.clients.itervalues():
2385
 
                key = client_settings[client.name]["secret"]
2386
 
                client.encrypted_secret = pgp.encrypt(client.secret,
2387
 
                                                      key)
2388
 
                client_dict = {}
2389
 
                
2390
 
                # A list of attributes that can not be pickled
2391
 
                # + secret.
2392
 
                exclude = set(("bus", "changedstate", "secret",
2393
 
                               "checker"))
2394
 
                for name, typ in (inspect.getmembers
2395
 
                                  (dbus.service.Object)):
2396
 
                    exclude.add(name)
2397
 
                
2398
 
                client_dict["encrypted_secret"] = (client
2399
 
                                                   .encrypted_secret)
2400
 
                for attr in client.client_structure:
2401
 
                    if attr not in exclude:
2402
 
                        client_dict[attr] = getattr(client, attr)
2403
 
                
2404
 
                clients[client.name] = client_dict
2405
 
                del client_settings[client.name]["secret"]
2406
 
        
2407
 
        try:
2408
 
            tempfd, tempname = tempfile.mkstemp(suffix=".pickle",
2409
 
                                                prefix="clients-",
2410
 
                                                dir=os.path.dirname
2411
 
                                                (stored_state_path))
2412
 
            with os.fdopen(tempfd, "wb") as stored_state:
2413
 
                pickle.dump((clients, client_settings), stored_state)
2414
 
            os.rename(tempname, stored_state_path)
2415
 
        except (IOError, OSError) as e:
2416
 
            logger.warning("Could not save persistent state: {0}"
2417
 
                           .format(e))
2418
 
            if e.errno not in set((errno.ENOENT, errno.EACCES,
2419
 
                                   errno.EEXIST)):
2420
 
                raise
2421
 
        
2422
 
        # Delete all clients, and settings from config
2423
1886
        while tcp_server.clients:
2424
 
            name, client = tcp_server.clients.popitem()
 
1887
            client = tcp_server.clients.pop()
2425
1888
            if use_dbus:
2426
1889
                client.remove_from_connection()
 
1890
            client.disable_hook = None
2427
1891
            # Don't signal anything except ClientRemoved
2428
1892
            client.disable(quiet=True)
2429
1893
            if use_dbus:
2430
1894
                # Emit D-Bus signal
2431
 
                mandos_dbus_service.ClientRemoved(client
2432
 
                                                  .dbus_object_path,
 
1895
                mandos_dbus_service.ClientRemoved(client.dbus_object_path,
2433
1896
                                                  client.name)
2434
 
        client_settings.clear()
2435
1897
    
2436
1898
    atexit.register(cleanup)
2437
1899
    
2438
 
    for client in tcp_server.clients.itervalues():
 
1900
    for client in tcp_server.clients:
2439
1901
        if use_dbus:
2440
1902
            # Emit D-Bus signal
2441
1903
            mandos_dbus_service.ClientAdded(client.dbus_object_path)
2442
 
        # Need to initiate checking of clients
2443
 
        if client.enabled:
2444
 
            client.init_checker()
 
1904
        client.enable()
2445
1905
    
2446
1906
    tcp_server.enable()
2447
1907
    tcp_server.server_activate()
2449
1909
    # Find out what port we got
2450
1910
    service.port = tcp_server.socket.getsockname()[1]
2451
1911
    if use_ipv6:
2452
 
        logger.info("Now listening on address %r, port %d,"
 
1912
        logger.info(u"Now listening on address %r, port %d,"
2453
1913
                    " flowinfo %d, scope_id %d"
2454
1914
                    % tcp_server.socket.getsockname())
2455
1915
    else:                       # IPv4
2456
 
        logger.info("Now listening on address %r, port %d"
 
1916
        logger.info(u"Now listening on address %r, port %d"
2457
1917
                    % tcp_server.socket.getsockname())
2458
1918
    
2459
1919
    #service.interface = tcp_server.socket.getsockname()[3]
2462
1922
        # From the Avahi example code
2463
1923
        try:
2464
1924
            service.activate()
2465
 
        except dbus.exceptions.DBusException as error:
2466
 
            logger.critical("DBusException: %s", error)
 
1925
        except dbus.exceptions.DBusException, error:
 
1926
            logger.critical(u"DBusException: %s", error)
2467
1927
            cleanup()
2468
1928
            sys.exit(1)
2469
1929
        # End of Avahi example code
2473
1933
                             (tcp_server.handle_request
2474
1934
                              (*args[2:], **kwargs) or True))
2475
1935
        
2476
 
        logger.debug("Starting main loop")
 
1936
        logger.debug(u"Starting main loop")
2477
1937
        main_loop.run()
2478
 
    except AvahiError as error:
2479
 
        logger.critical("AvahiError: %s", error)
 
1938
    except AvahiError, error:
 
1939
        logger.critical(u"AvahiError: %s", error)
2480
1940
        cleanup()
2481
1941
        sys.exit(1)
2482
1942
    except KeyboardInterrupt:
2483
1943
        if debug:
2484
 
            print("", file=sys.stderr)
2485
 
        logger.debug("Server received KeyboardInterrupt")
2486
 
    logger.debug("Server exiting")
 
1944
            print >> sys.stderr
 
1945
        logger.debug(u"Server received KeyboardInterrupt")
 
1946
    logger.debug(u"Server exiting")
2487
1947
    # Must run before the D-Bus bus name gets deregistered
2488
1948
    cleanup()
2489
1949