/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos

  • Committer: teddy at bsnet
  • Date: 2010-09-09 18:16:14 UTC
  • mfrom: (237.2.35 mandos-empty-device)
  • Revision ID: teddy@fukt.bsnet.se-20100909181614-oanlmvkzsiodbo3c
Merge in branch to interpret an empty device name to mean
"autodetect".

Show diffs side-by-side

added added

removed removed

Lines of Context:
11
11
# "AvahiService" class, and some lines in "main".
12
12
13
13
# Everything else is
14
 
# Copyright © 2008-2012 Teddy Hogeborn
15
 
# Copyright © 2008-2012 Björn Påhlsson
 
14
# Copyright © 2008,2009 Teddy Hogeborn
 
15
# Copyright © 2008,2009 Björn Påhlsson
16
16
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
28
28
# along with this program.  If not, see
29
29
# <http://www.gnu.org/licenses/>.
30
30
31
 
# Contact the authors at <mandos@recompile.se>.
 
31
# Contact the authors at <mandos@fukt.bsnet.se>.
32
32
33
33
 
34
 
from __future__ import (division, absolute_import, print_function,
35
 
                        unicode_literals)
 
34
from __future__ import division, with_statement, absolute_import
36
35
 
37
36
import SocketServer as socketserver
38
37
import socket
39
 
import argparse
 
38
import optparse
40
39
import datetime
41
40
import errno
42
41
import gnutls.crypto
61
60
import fcntl
62
61
import functools
63
62
import cPickle as pickle
64
 
import multiprocessing
65
 
import types
66
 
import binascii
67
 
import tempfile
 
63
import select
68
64
 
69
65
import dbus
70
66
import dbus.service
75
71
import ctypes.util
76
72
import xml.dom.minidom
77
73
import inspect
78
 
import GnuPGInterface
79
74
 
80
75
try:
81
76
    SO_BINDTODEVICE = socket.SO_BINDTODEVICE
85
80
    except ImportError:
86
81
        SO_BINDTODEVICE = None
87
82
 
88
 
version = "1.5.3"
89
 
stored_state_file = "clients.pickle"
90
 
 
91
 
logger = logging.getLogger()
 
83
 
 
84
version = "1.0.14"
 
85
 
 
86
logger = logging.Logger(u'mandos')
92
87
syslogger = (logging.handlers.SysLogHandler
93
88
             (facility = logging.handlers.SysLogHandler.LOG_DAEMON,
94
 
              address = str("/dev/log")))
95
 
 
96
 
try:
97
 
    if_nametoindex = (ctypes.cdll.LoadLibrary
98
 
                      (ctypes.util.find_library("c"))
99
 
                      .if_nametoindex)
100
 
except (OSError, AttributeError):
101
 
    def if_nametoindex(interface):
102
 
        "Get an interface index the hard way, i.e. using fcntl()"
103
 
        SIOCGIFINDEX = 0x8933  # From /usr/include/linux/sockios.h
104
 
        with contextlib.closing(socket.socket()) as s:
105
 
            ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
106
 
                                struct.pack(str("16s16x"),
107
 
                                            interface))
108
 
        interface_index = struct.unpack(str("I"),
109
 
                                        ifreq[16:20])[0]
110
 
        return interface_index
111
 
 
112
 
 
113
 
def initlogger(debug, level=logging.WARNING):
114
 
    """init logger and add loglevel"""
115
 
    
116
 
    syslogger.setFormatter(logging.Formatter
117
 
                           ('Mandos [%(process)d]: %(levelname)s:'
118
 
                            ' %(message)s'))
119
 
    logger.addHandler(syslogger)
120
 
    
121
 
    if debug:
122
 
        console = logging.StreamHandler()
123
 
        console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
124
 
                                               ' [%(process)d]:'
125
 
                                               ' %(levelname)s:'
126
 
                                               ' %(message)s'))
127
 
        logger.addHandler(console)
128
 
    logger.setLevel(level)
129
 
 
130
 
 
131
 
class PGPError(Exception):
132
 
    """Exception if encryption/decryption fails"""
133
 
    pass
134
 
 
135
 
 
136
 
class PGPEngine(object):
137
 
    """A simple class for OpenPGP symmetric encryption & decryption"""
138
 
    def __init__(self):
139
 
        self.gnupg = GnuPGInterface.GnuPG()
140
 
        self.tempdir = tempfile.mkdtemp(prefix="mandos-")
141
 
        self.gnupg = GnuPGInterface.GnuPG()
142
 
        self.gnupg.options.meta_interactive = False
143
 
        self.gnupg.options.homedir = self.tempdir
144
 
        self.gnupg.options.extra_args.extend(['--force-mdc',
145
 
                                              '--quiet',
146
 
                                              '--no-use-agent'])
147
 
    
148
 
    def __enter__(self):
149
 
        return self
150
 
    
151
 
    def __exit__ (self, exc_type, exc_value, traceback):
152
 
        self._cleanup()
153
 
        return False
154
 
    
155
 
    def __del__(self):
156
 
        self._cleanup()
157
 
    
158
 
    def _cleanup(self):
159
 
        if self.tempdir is not None:
160
 
            # Delete contents of tempdir
161
 
            for root, dirs, files in os.walk(self.tempdir,
162
 
                                             topdown = False):
163
 
                for filename in files:
164
 
                    os.remove(os.path.join(root, filename))
165
 
                for dirname in dirs:
166
 
                    os.rmdir(os.path.join(root, dirname))
167
 
            # Remove tempdir
168
 
            os.rmdir(self.tempdir)
169
 
            self.tempdir = None
170
 
    
171
 
    def password_encode(self, password):
172
 
        # Passphrase can not be empty and can not contain newlines or
173
 
        # NUL bytes.  So we prefix it and hex encode it.
174
 
        return b"mandos" + binascii.hexlify(password)
175
 
    
176
 
    def encrypt(self, data, password):
177
 
        self.gnupg.passphrase = self.password_encode(password)
178
 
        with open(os.devnull) as devnull:
179
 
            try:
180
 
                proc = self.gnupg.run(['--symmetric'],
181
 
                                      create_fhs=['stdin', 'stdout'],
182
 
                                      attach_fhs={'stderr': devnull})
183
 
                with contextlib.closing(proc.handles['stdin']) as f:
184
 
                    f.write(data)
185
 
                with contextlib.closing(proc.handles['stdout']) as f:
186
 
                    ciphertext = f.read()
187
 
                proc.wait()
188
 
            except IOError as e:
189
 
                raise PGPError(e)
190
 
        self.gnupg.passphrase = None
191
 
        return ciphertext
192
 
    
193
 
    def decrypt(self, data, password):
194
 
        self.gnupg.passphrase = self.password_encode(password)
195
 
        with open(os.devnull) as devnull:
196
 
            try:
197
 
                proc = self.gnupg.run(['--decrypt'],
198
 
                                      create_fhs=['stdin', 'stdout'],
199
 
                                      attach_fhs={'stderr': devnull})
200
 
                with contextlib.closing(proc.handles['stdin'] ) as f:
201
 
                    f.write(data)
202
 
                with contextlib.closing(proc.handles['stdout']) as f:
203
 
                    decrypted_plaintext = f.read()
204
 
                proc.wait()
205
 
            except IOError as e:
206
 
                raise PGPError(e)
207
 
        self.gnupg.passphrase = None
208
 
        return decrypted_plaintext
209
 
 
210
 
 
 
89
              address = "/dev/log"))
 
90
syslogger.setFormatter(logging.Formatter
 
91
                       (u'Mandos [%(process)d]: %(levelname)s:'
 
92
                        u' %(message)s'))
 
93
logger.addHandler(syslogger)
 
94
 
 
95
console = logging.StreamHandler()
 
96
console.setFormatter(logging.Formatter(u'%(name)s [%(process)d]:'
 
97
                                       u' %(levelname)s:'
 
98
                                       u' %(message)s'))
 
99
logger.addHandler(console)
211
100
 
212
101
class AvahiError(Exception):
213
102
    def __init__(self, value, *args, **kwargs):
229
118
    Attributes:
230
119
    interface: integer; avahi.IF_UNSPEC or an interface index.
231
120
               Used to optionally bind to the specified interface.
232
 
    name: string; Example: 'Mandos'
233
 
    type: string; Example: '_mandos._tcp'.
 
121
    name: string; Example: u'Mandos'
 
122
    type: string; Example: u'_mandos._tcp'.
234
123
                  See <http://www.dns-sd.org/ServiceTypes.html>
235
124
    port: integer; what port to announce
236
125
    TXT: list of strings; TXT record for the service
245
134
    """
246
135
    def __init__(self, interface = avahi.IF_UNSPEC, name = None,
247
136
                 servicetype = None, port = None, TXT = None,
248
 
                 domain = "", host = "", max_renames = 32768,
 
137
                 domain = u"", host = u"", max_renames = 32768,
249
138
                 protocol = avahi.PROTO_UNSPEC, bus = None):
250
139
        self.interface = interface
251
140
        self.name = name
260
149
        self.group = None       # our entry group
261
150
        self.server = None
262
151
        self.bus = bus
263
 
        self.entry_group_state_changed_match = None
264
152
    def rename(self):
265
153
        """Derived from the Avahi example code"""
266
154
        if self.rename_count >= self.max_renames:
267
 
            logger.critical("No suitable Zeroconf service name found"
268
 
                            " after %i retries, exiting.",
 
155
            logger.critical(u"No suitable Zeroconf service name found"
 
156
                            u" after %i retries, exiting.",
269
157
                            self.rename_count)
270
 
            raise AvahiServiceError("Too many renames")
271
 
        self.name = unicode(self.server
272
 
                            .GetAlternativeServiceName(self.name))
273
 
        logger.info("Changing Zeroconf service name to %r ...",
274
 
                    self.name)
 
158
            raise AvahiServiceError(u"Too many renames")
 
159
        self.name = self.server.GetAlternativeServiceName(self.name)
 
160
        logger.info(u"Changing Zeroconf service name to %r ...",
 
161
                    unicode(self.name))
 
162
        syslogger.setFormatter(logging.Formatter
 
163
                               (u'Mandos (%s) [%%(process)d]:'
 
164
                                u' %%(levelname)s: %%(message)s'
 
165
                                % self.name))
275
166
        self.remove()
276
 
        try:
277
 
            self.add()
278
 
        except dbus.exceptions.DBusException as error:
279
 
            logger.critical("DBusException: %s", error)
280
 
            self.cleanup()
281
 
            os._exit(1)
 
167
        self.add()
282
168
        self.rename_count += 1
283
169
    def remove(self):
284
170
        """Derived from the Avahi example code"""
285
 
        if self.entry_group_state_changed_match is not None:
286
 
            self.entry_group_state_changed_match.remove()
287
 
            self.entry_group_state_changed_match = None
288
171
        if self.group is not None:
289
172
            self.group.Reset()
290
173
    def add(self):
291
174
        """Derived from the Avahi example code"""
292
 
        self.remove()
293
175
        if self.group is None:
294
176
            self.group = dbus.Interface(
295
177
                self.bus.get_object(avahi.DBUS_NAME,
296
178
                                    self.server.EntryGroupNew()),
297
179
                avahi.DBUS_INTERFACE_ENTRY_GROUP)
298
 
        self.entry_group_state_changed_match = (
299
 
            self.group.connect_to_signal(
300
 
                'StateChanged', self.entry_group_state_changed))
301
 
        logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
 
180
            self.group.connect_to_signal('StateChanged',
 
181
                                         self
 
182
                                         .entry_group_state_changed)
 
183
        logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
302
184
                     self.name, self.type)
303
185
        self.group.AddService(
304
186
            self.interface,
311
193
        self.group.Commit()
312
194
    def entry_group_state_changed(self, state, error):
313
195
        """Derived from the Avahi example code"""
314
 
        logger.debug("Avahi entry group state change: %i", state)
 
196
        logger.debug(u"Avahi entry group state change: %i", state)
315
197
        
316
198
        if state == avahi.ENTRY_GROUP_ESTABLISHED:
317
 
            logger.debug("Zeroconf service established.")
 
199
            logger.debug(u"Zeroconf service established.")
318
200
        elif state == avahi.ENTRY_GROUP_COLLISION:
319
 
            logger.info("Zeroconf service name collision.")
 
201
            logger.warning(u"Zeroconf service name collision.")
320
202
            self.rename()
321
203
        elif state == avahi.ENTRY_GROUP_FAILURE:
322
 
            logger.critical("Avahi: Error in group state changed %s",
 
204
            logger.critical(u"Avahi: Error in group state changed %s",
323
205
                            unicode(error))
324
 
            raise AvahiGroupError("State changed: %s"
 
206
            raise AvahiGroupError(u"State changed: %s"
325
207
                                  % unicode(error))
326
208
    def cleanup(self):
327
209
        """Derived from the Avahi example code"""
328
210
        if self.group is not None:
329
 
            try:
330
 
                self.group.Free()
331
 
            except (dbus.exceptions.UnknownMethodException,
332
 
                    dbus.exceptions.DBusException):
333
 
                pass
 
211
            self.group.Free()
334
212
            self.group = None
335
 
        self.remove()
336
 
    def server_state_changed(self, state, error=None):
 
213
    def server_state_changed(self, state):
337
214
        """Derived from the Avahi example code"""
338
 
        logger.debug("Avahi server state change: %i", state)
339
 
        bad_states = { avahi.SERVER_INVALID:
340
 
                           "Zeroconf server invalid",
341
 
                       avahi.SERVER_REGISTERING: None,
342
 
                       avahi.SERVER_COLLISION:
343
 
                           "Zeroconf server name collision",
344
 
                       avahi.SERVER_FAILURE:
345
 
                           "Zeroconf server failure" }
346
 
        if state in bad_states:
347
 
            if bad_states[state] is not None:
348
 
                if error is None:
349
 
                    logger.error(bad_states[state])
350
 
                else:
351
 
                    logger.error(bad_states[state] + ": %r", error)
352
 
            self.cleanup()
 
215
        logger.debug(u"Avahi server state change: %i", state)
 
216
        if state == avahi.SERVER_COLLISION:
 
217
            logger.error(u"Zeroconf server name collision")
 
218
            self.remove()
353
219
        elif state == avahi.SERVER_RUNNING:
354
220
            self.add()
355
 
        else:
356
 
            if error is None:
357
 
                logger.debug("Unknown state: %r", state)
358
 
            else:
359
 
                logger.debug("Unknown state: %r: %r", state, error)
360
221
    def activate(self):
361
222
        """Derived from the Avahi example code"""
362
223
        if self.server is None:
363
224
            self.server = dbus.Interface(
364
225
                self.bus.get_object(avahi.DBUS_NAME,
365
 
                                    avahi.DBUS_PATH_SERVER,
366
 
                                    follow_name_owner_changes=True),
 
226
                                    avahi.DBUS_PATH_SERVER),
367
227
                avahi.DBUS_INTERFACE_SERVER)
368
 
        self.server.connect_to_signal("StateChanged",
 
228
        self.server.connect_to_signal(u"StateChanged",
369
229
                                 self.server_state_changed)
370
230
        self.server_state_changed(self.server.GetState())
371
231
 
372
 
class AvahiServiceToSyslog(AvahiService):
373
 
    def rename(self):
374
 
        """Add the new name to the syslog messages"""
375
 
        ret = AvahiService.rename(self)
376
 
        syslogger.setFormatter(logging.Formatter
377
 
                               ('Mandos (%s) [%%(process)d]:'
378
 
                                ' %%(levelname)s: %%(message)s'
379
 
                                % self.name))
380
 
        return ret
381
232
 
382
 
def timedelta_to_milliseconds(td):
383
 
    "Convert a datetime.timedelta() to milliseconds"
384
 
    return ((td.days * 24 * 60 * 60 * 1000)
385
 
            + (td.seconds * 1000)
386
 
            + (td.microseconds // 1000))
387
 
        
388
233
class Client(object):
389
234
    """A representation of a client host served by this server.
390
235
    
391
236
    Attributes:
392
 
    approved:   bool(); 'None' if not yet approved/disapproved
393
 
    approval_delay: datetime.timedelta(); Time to wait for approval
394
 
    approval_duration: datetime.timedelta(); Duration of one approval
 
237
    name:       string; from the config file, used in log messages and
 
238
                        D-Bus identifiers
 
239
    fingerprint: string (40 or 32 hexadecimal digits); used to
 
240
                 uniquely identify the client
 
241
    secret:     bytestring; sent verbatim (over TLS) to client
 
242
    host:       string; available for use by the checker command
 
243
    created:    datetime.datetime(); (UTC) object creation
 
244
    last_enabled: datetime.datetime(); (UTC)
 
245
    enabled:    bool()
 
246
    last_checked_ok: datetime.datetime(); (UTC) or None
 
247
    timeout:    datetime.timedelta(); How long from last_checked_ok
 
248
                                      until this client is disabled
 
249
    interval:   datetime.timedelta(); How often to start a new checker
 
250
    disable_hook:  If set, called by disable() as disable_hook(self)
395
251
    checker:    subprocess.Popen(); a running checker process used
396
252
                                    to see if the client lives.
397
253
                                    'None' if no process is running.
398
 
    checker_callback_tag: a gobject event source tag, or None
399
 
    checker_command: string; External command which is run to check
400
 
                     if client lives.  %() expansions are done at
 
254
    checker_initiator_tag: a gobject event source tag, or None
 
255
    disable_initiator_tag: - '' -
 
256
    checker_callback_tag:  - '' -
 
257
    checker_command: string; External command which is run to check if
 
258
                     client lives.  %() expansions are done at
401
259
                     runtime with vars(self) as dict, so that for
402
260
                     instance %(name)s can be used in the command.
403
 
    checker_initiator_tag: a gobject event source tag, or None
404
 
    created:    datetime.datetime(); (UTC) object creation
405
 
    client_structure: Object describing what attributes a client has
406
 
                      and is used for storing the client at exit
407
261
    current_checker_command: string; current running checker_command
408
 
    disable_initiator_tag: a gobject event source tag, or None
409
 
    enabled:    bool()
410
 
    fingerprint: string (40 or 32 hexadecimal digits); used to
411
 
                 uniquely identify the client
412
 
    host:       string; available for use by the checker command
413
 
    interval:   datetime.timedelta(); How often to start a new checker
414
 
    last_approval_request: datetime.datetime(); (UTC) or None
415
 
    last_checked_ok: datetime.datetime(); (UTC) or None
416
 
    last_checker_status: integer between 0 and 255 reflecting exit
417
 
                         status of last checker. -1 reflects crashed
418
 
                         checker, -2 means no checker completed yet.
419
 
    last_enabled: datetime.datetime(); (UTC) or None
420
 
    name:       string; from the config file, used in log messages and
421
 
                        D-Bus identifiers
422
 
    secret:     bytestring; sent verbatim (over TLS) to client
423
 
    timeout:    datetime.timedelta(); How long from last_checked_ok
424
 
                                      until this client is disabled
425
 
    extended_timeout:   extra long timeout when secret has been sent
426
 
    runtime_expansions: Allowed attributes for runtime expansion.
427
 
    expires:    datetime.datetime(); time (UTC) when a client will be
428
 
                disabled, or None
429
262
    """
430
263
    
431
 
    runtime_expansions = ("approval_delay", "approval_duration",
432
 
                          "created", "enabled", "fingerprint",
433
 
                          "host", "interval", "last_checked_ok",
434
 
                          "last_enabled", "name", "timeout")
435
 
    client_defaults = { "timeout": "5m",
436
 
                        "extended_timeout": "15m",
437
 
                        "interval": "2m",
438
 
                        "checker": "fping -q -- %%(host)s",
439
 
                        "host": "",
440
 
                        "approval_delay": "0s",
441
 
                        "approval_duration": "1s",
442
 
                        "approved_by_default": "True",
443
 
                        "enabled": "True",
444
 
                        }
 
264
    @staticmethod
 
265
    def _timedelta_to_milliseconds(td):
 
266
        "Convert a datetime.timedelta() to milliseconds"
 
267
        return ((td.days * 24 * 60 * 60 * 1000)
 
268
                + (td.seconds * 1000)
 
269
                + (td.microseconds // 1000))
445
270
    
446
271
    def timeout_milliseconds(self):
447
272
        "Return the 'timeout' attribute in milliseconds"
448
 
        return timedelta_to_milliseconds(self.timeout)
449
 
    
450
 
    def extended_timeout_milliseconds(self):
451
 
        "Return the 'extended_timeout' attribute in milliseconds"
452
 
        return timedelta_to_milliseconds(self.extended_timeout)
 
273
        return self._timedelta_to_milliseconds(self.timeout)
453
274
    
454
275
    def interval_milliseconds(self):
455
276
        "Return the 'interval' attribute in milliseconds"
456
 
        return timedelta_to_milliseconds(self.interval)
 
277
        return self._timedelta_to_milliseconds(self.interval)
457
278
    
458
 
    def approval_delay_milliseconds(self):
459
 
        return timedelta_to_milliseconds(self.approval_delay)
460
 
 
461
 
    @staticmethod
462
 
    def config_parser(config):
463
 
        """Construct a new dict of client settings of this form:
464
 
        { client_name: {setting_name: value, ...}, ...}
465
 
        with exceptions for any special settings as defined above.
466
 
        NOTE: Must be a pure function. Must return the same result
467
 
        value given the same arguments.
468
 
        """
469
 
        settings = {}
470
 
        for client_name in config.sections():
471
 
            section = dict(config.items(client_name))
472
 
            client = settings[client_name] = {}
473
 
            
474
 
            client["host"] = section["host"]
475
 
            # Reformat values from string types to Python types
476
 
            client["approved_by_default"] = config.getboolean(
477
 
                client_name, "approved_by_default")
478
 
            client["enabled"] = config.getboolean(client_name,
479
 
                                                  "enabled")
480
 
            
481
 
            client["fingerprint"] = (section["fingerprint"].upper()
482
 
                                     .replace(" ", ""))
483
 
            if "secret" in section:
484
 
                client["secret"] = section["secret"].decode("base64")
485
 
            elif "secfile" in section:
486
 
                with open(os.path.expanduser(os.path.expandvars
487
 
                                             (section["secfile"])),
488
 
                          "rb") as secfile:
489
 
                    client["secret"] = secfile.read()
490
 
            else:
491
 
                raise TypeError("No secret or secfile for section %s"
492
 
                                % section)
493
 
            client["timeout"] = string_to_delta(section["timeout"])
494
 
            client["extended_timeout"] = string_to_delta(
495
 
                section["extended_timeout"])
496
 
            client["interval"] = string_to_delta(section["interval"])
497
 
            client["approval_delay"] = string_to_delta(
498
 
                section["approval_delay"])
499
 
            client["approval_duration"] = string_to_delta(
500
 
                section["approval_duration"])
501
 
            client["checker_command"] = section["checker"]
502
 
            client["last_approval_request"] = None
503
 
            client["last_checked_ok"] = None
504
 
            client["last_checker_status"] = -2
505
 
        
506
 
        return settings
507
 
        
508
 
        
509
 
    def __init__(self, settings, name = None):
 
279
    def __init__(self, name = None, disable_hook=None, config=None):
510
280
        """Note: the 'checker' key in 'config' sets the
511
281
        'checker_command' attribute and *not* the 'checker'
512
282
        attribute."""
513
283
        self.name = name
514
 
        # adding all client settings
515
 
        for setting, value in settings.iteritems():
516
 
            setattr(self, setting, value)
517
 
        
518
 
        if self.enabled:
519
 
            if not hasattr(self, "last_enabled"):
520
 
                self.last_enabled = datetime.datetime.utcnow()
521
 
            if not hasattr(self, "expires"):
522
 
                self.expires = (datetime.datetime.utcnow()
523
 
                                + self.timeout)
524
 
        else:
525
 
            self.last_enabled = None
526
 
            self.expires = None
527
 
       
528
 
        logger.debug("Creating client %r", self.name)
 
284
        if config is None:
 
285
            config = {}
 
286
        logger.debug(u"Creating client %r", self.name)
529
287
        # Uppercase and remove spaces from fingerprint for later
530
288
        # comparison purposes with return value from the fingerprint()
531
289
        # function
532
 
        logger.debug("  Fingerprint: %s", self.fingerprint)
533
 
        self.created = settings.get("created",
534
 
                                    datetime.datetime.utcnow())
535
 
 
536
 
        # attributes specific for this server instance
 
290
        self.fingerprint = (config[u"fingerprint"].upper()
 
291
                            .replace(u" ", u""))
 
292
        logger.debug(u"  Fingerprint: %s", self.fingerprint)
 
293
        if u"secret" in config:
 
294
            self.secret = config[u"secret"].decode(u"base64")
 
295
        elif u"secfile" in config:
 
296
            with open(os.path.expanduser(os.path.expandvars
 
297
                                         (config[u"secfile"])),
 
298
                      "rb") as secfile:
 
299
                self.secret = secfile.read()
 
300
        else:
 
301
            raise TypeError(u"No secret or secfile for client %s"
 
302
                            % self.name)
 
303
        self.host = config.get(u"host", u"")
 
304
        self.created = datetime.datetime.utcnow()
 
305
        self.enabled = False
 
306
        self.last_enabled = None
 
307
        self.last_checked_ok = None
 
308
        self.timeout = string_to_delta(config[u"timeout"])
 
309
        self.interval = string_to_delta(config[u"interval"])
 
310
        self.disable_hook = disable_hook
537
311
        self.checker = None
538
312
        self.checker_initiator_tag = None
539
313
        self.disable_initiator_tag = None
540
314
        self.checker_callback_tag = None
 
315
        self.checker_command = config[u"checker"]
541
316
        self.current_checker_command = None
542
 
        self.approved = None
543
 
        self.approvals_pending = 0
544
 
        self.changedstate = (multiprocessing_manager
545
 
                             .Condition(multiprocessing_manager
546
 
                                        .Lock()))
547
 
        self.client_structure = [attr for attr in
548
 
                                 self.__dict__.iterkeys()
549
 
                                 if not attr.startswith("_")]
550
 
        self.client_structure.append("client_structure")
551
 
        
552
 
        for name, t in inspect.getmembers(type(self),
553
 
                                          lambda obj:
554
 
                                              isinstance(obj,
555
 
                                                         property)):
556
 
            if not name.startswith("_"):
557
 
                self.client_structure.append(name)
558
 
    
559
 
    # Send notice to process children that client state has changed
560
 
    def send_changedstate(self):
561
 
        with self.changedstate:
562
 
            self.changedstate.notify_all()
 
317
        self.last_connect = None
563
318
    
564
319
    def enable(self):
565
320
        """Start this client's checker and timeout hooks"""
566
 
        if getattr(self, "enabled", False):
 
321
        if getattr(self, u"enabled", False):
567
322
            # Already enabled
568
323
            return
569
 
        self.send_changedstate()
570
 
        self.expires = datetime.datetime.utcnow() + self.timeout
571
 
        self.enabled = True
572
324
        self.last_enabled = datetime.datetime.utcnow()
573
 
        self.init_checker()
574
 
    
575
 
    def disable(self, quiet=True):
576
 
        """Disable this client."""
577
 
        if not getattr(self, "enabled", False):
578
 
            return False
579
 
        if not quiet:
580
 
            self.send_changedstate()
581
 
        if not quiet:
582
 
            logger.info("Disabling client %s", self.name)
583
 
        if getattr(self, "disable_initiator_tag", False):
584
 
            gobject.source_remove(self.disable_initiator_tag)
585
 
            self.disable_initiator_tag = None
586
 
        self.expires = None
587
 
        if getattr(self, "checker_initiator_tag", False):
588
 
            gobject.source_remove(self.checker_initiator_tag)
589
 
            self.checker_initiator_tag = None
590
 
        self.stop_checker()
591
 
        self.enabled = False
592
 
        # Do not run this again if called by a gobject.timeout_add
593
 
        return False
594
 
    
595
 
    def __del__(self):
596
 
        self.disable()
597
 
    
598
 
    def init_checker(self):
599
325
        # Schedule a new checker to be started an 'interval' from now,
600
326
        # and every interval from then on.
601
327
        self.checker_initiator_tag = (gobject.timeout_add
605
331
        self.disable_initiator_tag = (gobject.timeout_add
606
332
                                   (self.timeout_milliseconds(),
607
333
                                    self.disable))
 
334
        self.enabled = True
608
335
        # Also start a new checker *right now*.
609
336
        self.start_checker()
610
337
    
 
338
    def disable(self, quiet=True):
 
339
        """Disable this client."""
 
340
        if not getattr(self, "enabled", False):
 
341
            return False
 
342
        if not quiet:
 
343
            logger.info(u"Disabling client %s", self.name)
 
344
        if getattr(self, u"disable_initiator_tag", False):
 
345
            gobject.source_remove(self.disable_initiator_tag)
 
346
            self.disable_initiator_tag = None
 
347
        if getattr(self, u"checker_initiator_tag", False):
 
348
            gobject.source_remove(self.checker_initiator_tag)
 
349
            self.checker_initiator_tag = None
 
350
        self.stop_checker()
 
351
        if self.disable_hook:
 
352
            self.disable_hook(self)
 
353
        self.enabled = False
 
354
        # Do not run this again if called by a gobject.timeout_add
 
355
        return False
 
356
    
 
357
    def __del__(self):
 
358
        self.disable_hook = None
 
359
        self.disable()
 
360
    
611
361
    def checker_callback(self, pid, condition, command):
612
362
        """The checker has completed, so take appropriate actions."""
613
363
        self.checker_callback_tag = None
614
364
        self.checker = None
615
365
        if os.WIFEXITED(condition):
616
 
            self.last_checker_status = os.WEXITSTATUS(condition)
617
 
            if self.last_checker_status == 0:
618
 
                logger.info("Checker for %(name)s succeeded",
 
366
            exitstatus = os.WEXITSTATUS(condition)
 
367
            if exitstatus == 0:
 
368
                logger.info(u"Checker for %(name)s succeeded",
619
369
                            vars(self))
620
370
                self.checked_ok()
621
371
            else:
622
 
                logger.info("Checker for %(name)s failed",
 
372
                logger.info(u"Checker for %(name)s failed",
623
373
                            vars(self))
624
374
        else:
625
 
            self.last_checker_status = -1
626
 
            logger.warning("Checker for %(name)s crashed?",
 
375
            logger.warning(u"Checker for %(name)s crashed?",
627
376
                           vars(self))
628
377
    
629
378
    def checked_ok(self):
630
 
        """Assert that the client has been seen, alive and well."""
 
379
        """Bump up the timeout for this client.
 
380
        
 
381
        This should only be called when the client has been seen,
 
382
        alive and well.
 
383
        """
631
384
        self.last_checked_ok = datetime.datetime.utcnow()
632
 
        self.last_checker_status = 0
633
 
        self.bump_timeout()
634
 
    
635
 
    def bump_timeout(self, timeout=None):
636
 
        """Bump up the timeout for this client."""
637
 
        if timeout is None:
638
 
            timeout = self.timeout
639
 
        if self.disable_initiator_tag is not None:
640
 
            gobject.source_remove(self.disable_initiator_tag)
641
 
        if getattr(self, "enabled", False):
642
 
            self.disable_initiator_tag = (gobject.timeout_add
643
 
                                          (timedelta_to_milliseconds
644
 
                                           (timeout), self.disable))
645
 
            self.expires = datetime.datetime.utcnow() + timeout
646
 
    
647
 
    def need_approval(self):
648
 
        self.last_approval_request = datetime.datetime.utcnow()
 
385
        gobject.source_remove(self.disable_initiator_tag)
 
386
        self.disable_initiator_tag = (gobject.timeout_add
 
387
                                      (self.timeout_milliseconds(),
 
388
                                       self.disable))
649
389
    
650
390
    def start_checker(self):
651
391
        """Start a new checker subprocess if one is not running.
664
404
        # If a checker exists, make sure it is not a zombie
665
405
        try:
666
406
            pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
667
 
        except (AttributeError, OSError) as error:
 
407
        except (AttributeError, OSError), error:
668
408
            if (isinstance(error, OSError)
669
409
                and error.errno != errno.ECHILD):
670
410
                raise error
671
411
        else:
672
412
            if pid:
673
 
                logger.warning("Checker was a zombie")
 
413
                logger.warning(u"Checker was a zombie")
674
414
                gobject.source_remove(self.checker_callback_tag)
675
415
                self.checker_callback(pid, status,
676
416
                                      self.current_checker_command)
681
421
                command = self.checker_command % self.host
682
422
            except TypeError:
683
423
                # Escape attributes for the shell
684
 
                escaped_attrs = dict(
685
 
                    (attr,
686
 
                     re.escape(unicode(str(getattr(self, attr, "")),
687
 
                                       errors=
688
 
                                       'replace')))
689
 
                    for attr in
690
 
                    self.runtime_expansions)
691
 
                
 
424
                escaped_attrs = dict((key,
 
425
                                      re.escape(unicode(str(val),
 
426
                                                        errors=
 
427
                                                        u'replace')))
 
428
                                     for key, val in
 
429
                                     vars(self).iteritems())
692
430
                try:
693
431
                    command = self.checker_command % escaped_attrs
694
 
                except TypeError as error:
695
 
                    logger.error('Could not format string "%s":'
696
 
                                 ' %s', self.checker_command, error)
 
432
                except TypeError, error:
 
433
                    logger.error(u'Could not format string "%s":'
 
434
                                 u' %s', self.checker_command, error)
697
435
                    return True # Try again later
698
436
            self.current_checker_command = command
699
437
            try:
700
 
                logger.info("Starting checker %r for %s",
 
438
                logger.info(u"Starting checker %r for %s",
701
439
                            command, self.name)
702
440
                # We don't need to redirect stdout and stderr, since
703
441
                # in normal mode, that is already done by daemon(),
705
443
                # always replaced by /dev/null.)
706
444
                self.checker = subprocess.Popen(command,
707
445
                                                close_fds=True,
708
 
                                                shell=True, cwd="/")
 
446
                                                shell=True, cwd=u"/")
709
447
                self.checker_callback_tag = (gobject.child_watch_add
710
448
                                             (self.checker.pid,
711
449
                                              self.checker_callback,
716
454
                if pid:
717
455
                    gobject.source_remove(self.checker_callback_tag)
718
456
                    self.checker_callback(pid, status, command)
719
 
            except OSError as error:
720
 
                logger.error("Failed to start subprocess: %s",
 
457
            except OSError, error:
 
458
                logger.error(u"Failed to start subprocess: %s",
721
459
                             error)
722
460
        # Re-run this periodically if run by gobject.timeout_add
723
461
        return True
727
465
        if self.checker_callback_tag:
728
466
            gobject.source_remove(self.checker_callback_tag)
729
467
            self.checker_callback_tag = None
730
 
        if getattr(self, "checker", None) is None:
 
468
        if getattr(self, u"checker", None) is None:
731
469
            return
732
 
        logger.debug("Stopping checker for %(name)s", vars(self))
 
470
        logger.debug(u"Stopping checker for %(name)s", vars(self))
733
471
        try:
734
472
            os.kill(self.checker.pid, signal.SIGTERM)
735
473
            #time.sleep(0.5)
736
474
            #if self.checker.poll() is None:
737
475
            #    os.kill(self.checker.pid, signal.SIGKILL)
738
 
        except OSError as error:
 
476
        except OSError, error:
739
477
            if error.errno != errno.ESRCH: # No such process
740
478
                raise
741
479
        self.checker = None
742
480
 
743
481
 
744
 
def dbus_service_property(dbus_interface, signature="v",
745
 
                          access="readwrite", byte_arrays=False):
 
482
def dbus_service_property(dbus_interface, signature=u"v",
 
483
                          access=u"readwrite", byte_arrays=False):
746
484
    """Decorators for marking methods of a DBusObjectWithProperties to
747
485
    become properties on the D-Bus.
748
486
    
755
493
    """
756
494
    # Encoding deeply encoded byte arrays is not supported yet by the
757
495
    # "Set" method, so we fail early here:
758
 
    if byte_arrays and signature != "ay":
759
 
        raise ValueError("Byte arrays not supported for non-'ay'"
760
 
                         " signature %r" % signature)
 
496
    if byte_arrays and signature != u"ay":
 
497
        raise ValueError(u"Byte arrays not supported for non-'ay'"
 
498
                         u" signature %r" % signature)
761
499
    def decorator(func):
762
500
        func._dbus_is_property = True
763
501
        func._dbus_interface = dbus_interface
764
502
        func._dbus_signature = signature
765
503
        func._dbus_access = access
766
504
        func._dbus_name = func.__name__
767
 
        if func._dbus_name.endswith("_dbus_property"):
 
505
        if func._dbus_name.endswith(u"_dbus_property"):
768
506
            func._dbus_name = func._dbus_name[:-14]
769
 
        func._dbus_get_args_options = {'byte_arrays': byte_arrays }
 
507
        func._dbus_get_args_options = {u'byte_arrays': byte_arrays }
770
508
        return func
771
509
    return decorator
772
510
 
792
530
 
793
531
class DBusObjectWithProperties(dbus.service.Object):
794
532
    """A D-Bus object with properties.
795
 
    
 
533
 
796
534
    Classes inheriting from this can use the dbus_service_property
797
535
    decorator to expose methods as D-Bus properties.  It exposes the
798
536
    standard Get(), Set(), and GetAll() methods on the D-Bus.
800
538
    
801
539
    @staticmethod
802
540
    def _is_dbus_property(obj):
803
 
        return getattr(obj, "_dbus_is_property", False)
 
541
        return getattr(obj, u"_dbus_is_property", False)
804
542
    
805
543
    def _get_all_dbus_properties(self):
806
544
        """Returns a generator of (name, attribute) pairs
807
545
        """
808
 
        return ((prop.__get__(self)._dbus_name, prop.__get__(self))
809
 
                for cls in self.__class__.__mro__
 
546
        return ((prop._dbus_name, prop)
810
547
                for name, prop in
811
 
                inspect.getmembers(cls, self._is_dbus_property))
 
548
                inspect.getmembers(self, self._is_dbus_property))
812
549
    
813
550
    def _get_dbus_property(self, interface_name, property_name):
814
551
        """Returns a bound method if one exists which is a D-Bus
815
552
        property with the specified name and interface.
816
553
        """
817
 
        for cls in  self.__class__.__mro__:
818
 
            for name, value in (inspect.getmembers
819
 
                                (cls, self._is_dbus_property)):
820
 
                if (value._dbus_name == property_name
821
 
                    and value._dbus_interface == interface_name):
822
 
                    return value.__get__(self)
823
 
        
 
554
        for name in (property_name,
 
555
                     property_name + u"_dbus_property"):
 
556
            prop = getattr(self, name, None)
 
557
            if (prop is None
 
558
                or not self._is_dbus_property(prop)
 
559
                or prop._dbus_name != property_name
 
560
                or (interface_name and prop._dbus_interface
 
561
                    and interface_name != prop._dbus_interface)):
 
562
                continue
 
563
            return prop
824
564
        # No such property
825
 
        raise DBusPropertyNotFound(self.dbus_object_path + ":"
826
 
                                   + interface_name + "."
 
565
        raise DBusPropertyNotFound(self.dbus_object_path + u":"
 
566
                                   + interface_name + u"."
827
567
                                   + property_name)
828
568
    
829
 
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
830
 
                         out_signature="v")
 
569
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ss",
 
570
                         out_signature=u"v")
831
571
    def Get(self, interface_name, property_name):
832
572
        """Standard D-Bus property Get() method, see D-Bus standard.
833
573
        """
834
574
        prop = self._get_dbus_property(interface_name, property_name)
835
 
        if prop._dbus_access == "write":
 
575
        if prop._dbus_access == u"write":
836
576
            raise DBusPropertyAccessException(property_name)
837
577
        value = prop()
838
 
        if not hasattr(value, "variant_level"):
 
578
        if not hasattr(value, u"variant_level"):
839
579
            return value
840
580
        return type(value)(value, variant_level=value.variant_level+1)
841
581
    
842
 
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
 
582
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ssv")
843
583
    def Set(self, interface_name, property_name, value):
844
584
        """Standard D-Bus property Set() method, see D-Bus standard.
845
585
        """
846
586
        prop = self._get_dbus_property(interface_name, property_name)
847
 
        if prop._dbus_access == "read":
 
587
        if prop._dbus_access == u"read":
848
588
            raise DBusPropertyAccessException(property_name)
849
 
        if prop._dbus_get_args_options["byte_arrays"]:
 
589
        if prop._dbus_get_args_options[u"byte_arrays"]:
850
590
            # The byte_arrays option is not supported yet on
851
591
            # signatures other than "ay".
852
 
            if prop._dbus_signature != "ay":
 
592
            if prop._dbus_signature != u"ay":
853
593
                raise ValueError
854
 
            value = dbus.ByteArray(b''.join(chr(byte)
855
 
                                            for byte in value))
 
594
            value = dbus.ByteArray(''.join(unichr(byte)
 
595
                                           for byte in value))
856
596
        prop(value)
857
597
    
858
 
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
859
 
                         out_signature="a{sv}")
 
598
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"s",
 
599
                         out_signature=u"a{sv}")
860
600
    def GetAll(self, interface_name):
861
601
        """Standard D-Bus property GetAll() method, see D-Bus
862
602
        standard.
863
 
        
 
603
 
864
604
        Note: Will not include properties with access="write".
865
605
        """
866
 
        properties = {}
 
606
        all = {}
867
607
        for name, prop in self._get_all_dbus_properties():
868
608
            if (interface_name
869
609
                and interface_name != prop._dbus_interface):
870
610
                # Interface non-empty but did not match
871
611
                continue
872
612
            # Ignore write-only properties
873
 
            if prop._dbus_access == "write":
 
613
            if prop._dbus_access == u"write":
874
614
                continue
875
615
            value = prop()
876
 
            if not hasattr(value, "variant_level"):
877
 
                properties[name] = value
 
616
            if not hasattr(value, u"variant_level"):
 
617
                all[name] = value
878
618
                continue
879
 
            properties[name] = type(value)(value, variant_level=
880
 
                                           value.variant_level+1)
881
 
        return dbus.Dictionary(properties, signature="sv")
 
619
            all[name] = type(value)(value, variant_level=
 
620
                                    value.variant_level+1)
 
621
        return dbus.Dictionary(all, signature=u"sv")
882
622
    
883
623
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
884
 
                         out_signature="s",
 
624
                         out_signature=u"s",
885
625
                         path_keyword='object_path',
886
626
                         connection_keyword='connection')
887
627
    def Introspect(self, object_path, connection):
892
632
        try:
893
633
            document = xml.dom.minidom.parseString(xmlstring)
894
634
            def make_tag(document, name, prop):
895
 
                e = document.createElement("property")
896
 
                e.setAttribute("name", name)
897
 
                e.setAttribute("type", prop._dbus_signature)
898
 
                e.setAttribute("access", prop._dbus_access)
 
635
                e = document.createElement(u"property")
 
636
                e.setAttribute(u"name", name)
 
637
                e.setAttribute(u"type", prop._dbus_signature)
 
638
                e.setAttribute(u"access", prop._dbus_access)
899
639
                return e
900
 
            for if_tag in document.getElementsByTagName("interface"):
 
640
            for if_tag in document.getElementsByTagName(u"interface"):
901
641
                for tag in (make_tag(document, name, prop)
902
642
                            for name, prop
903
643
                            in self._get_all_dbus_properties()
904
644
                            if prop._dbus_interface
905
 
                            == if_tag.getAttribute("name")):
 
645
                            == if_tag.getAttribute(u"name")):
906
646
                    if_tag.appendChild(tag)
907
647
                # Add the names to the return values for the
908
648
                # "org.freedesktop.DBus.Properties" methods
909
 
                if (if_tag.getAttribute("name")
910
 
                    == "org.freedesktop.DBus.Properties"):
911
 
                    for cn in if_tag.getElementsByTagName("method"):
912
 
                        if cn.getAttribute("name") == "Get":
913
 
                            for arg in cn.getElementsByTagName("arg"):
914
 
                                if (arg.getAttribute("direction")
915
 
                                    == "out"):
916
 
                                    arg.setAttribute("name", "value")
917
 
                        elif cn.getAttribute("name") == "GetAll":
918
 
                            for arg in cn.getElementsByTagName("arg"):
919
 
                                if (arg.getAttribute("direction")
920
 
                                    == "out"):
921
 
                                    arg.setAttribute("name", "props")
922
 
            xmlstring = document.toxml("utf-8")
 
649
                if (if_tag.getAttribute(u"name")
 
650
                    == u"org.freedesktop.DBus.Properties"):
 
651
                    for cn in if_tag.getElementsByTagName(u"method"):
 
652
                        if cn.getAttribute(u"name") == u"Get":
 
653
                            for arg in cn.getElementsByTagName(u"arg"):
 
654
                                if (arg.getAttribute(u"direction")
 
655
                                    == u"out"):
 
656
                                    arg.setAttribute(u"name", u"value")
 
657
                        elif cn.getAttribute(u"name") == u"GetAll":
 
658
                            for arg in cn.getElementsByTagName(u"arg"):
 
659
                                if (arg.getAttribute(u"direction")
 
660
                                    == u"out"):
 
661
                                    arg.setAttribute(u"name", u"props")
 
662
            xmlstring = document.toxml(u"utf-8")
923
663
            document.unlink()
924
664
        except (AttributeError, xml.dom.DOMException,
925
 
                xml.parsers.expat.ExpatError) as error:
926
 
            logger.error("Failed to override Introspection method",
 
665
                xml.parsers.expat.ExpatError), error:
 
666
            logger.error(u"Failed to override Introspection method",
927
667
                         error)
928
668
        return xmlstring
929
669
 
930
670
 
931
 
def datetime_to_dbus (dt, variant_level=0):
932
 
    """Convert a UTC datetime.datetime() to a D-Bus type."""
933
 
    if dt is None:
934
 
        return dbus.String("", variant_level = variant_level)
935
 
    return dbus.String(dt.isoformat(),
936
 
                       variant_level=variant_level)
937
 
 
938
 
 
939
 
class AlternateDBusNamesMetaclass(DBusObjectWithProperties
940
 
                                  .__metaclass__):
941
 
    """Applied to an empty subclass of a D-Bus object, this metaclass
942
 
    will add additional D-Bus attributes matching a certain pattern.
943
 
    """
944
 
    def __new__(mcs, name, bases, attr):
945
 
        # Go through all the base classes which could have D-Bus
946
 
        # methods, signals, or properties in them
947
 
        for base in (b for b in bases
948
 
                     if issubclass(b, dbus.service.Object)):
949
 
            # Go though all attributes of the base class
950
 
            for attrname, attribute in inspect.getmembers(base):
951
 
                # Ignore non-D-Bus attributes, and D-Bus attributes
952
 
                # with the wrong interface name
953
 
                if (not hasattr(attribute, "_dbus_interface")
954
 
                    or not attribute._dbus_interface
955
 
                    .startswith("se.recompile.Mandos")):
956
 
                    continue
957
 
                # Create an alternate D-Bus interface name based on
958
 
                # the current name
959
 
                alt_interface = (attribute._dbus_interface
960
 
                                 .replace("se.recompile.Mandos",
961
 
                                          "se.bsnet.fukt.Mandos"))
962
 
                # Is this a D-Bus signal?
963
 
                if getattr(attribute, "_dbus_is_signal", False):
964
 
                    # Extract the original non-method function by
965
 
                    # black magic
966
 
                    nonmethod_func = (dict(
967
 
                            zip(attribute.func_code.co_freevars,
968
 
                                attribute.__closure__))["func"]
969
 
                                      .cell_contents)
970
 
                    # Create a new, but exactly alike, function
971
 
                    # object, and decorate it to be a new D-Bus signal
972
 
                    # with the alternate D-Bus interface name
973
 
                    new_function = (dbus.service.signal
974
 
                                    (alt_interface,
975
 
                                     attribute._dbus_signature)
976
 
                                    (types.FunctionType(
977
 
                                nonmethod_func.func_code,
978
 
                                nonmethod_func.func_globals,
979
 
                                nonmethod_func.func_name,
980
 
                                nonmethod_func.func_defaults,
981
 
                                nonmethod_func.func_closure)))
982
 
                    # Define a creator of a function to call both the
983
 
                    # old and new functions, so both the old and new
984
 
                    # signals gets sent when the function is called
985
 
                    def fixscope(func1, func2):
986
 
                        """This function is a scope container to pass
987
 
                        func1 and func2 to the "call_both" function
988
 
                        outside of its arguments"""
989
 
                        def call_both(*args, **kwargs):
990
 
                            """This function will emit two D-Bus
991
 
                            signals by calling func1 and func2"""
992
 
                            func1(*args, **kwargs)
993
 
                            func2(*args, **kwargs)
994
 
                        return call_both
995
 
                    # Create the "call_both" function and add it to
996
 
                    # the class
997
 
                    attr[attrname] = fixscope(attribute,
998
 
                                              new_function)
999
 
                # Is this a D-Bus method?
1000
 
                elif getattr(attribute, "_dbus_is_method", False):
1001
 
                    # Create a new, but exactly alike, function
1002
 
                    # object.  Decorate it to be a new D-Bus method
1003
 
                    # with the alternate D-Bus interface name.  Add it
1004
 
                    # to the class.
1005
 
                    attr[attrname] = (dbus.service.method
1006
 
                                      (alt_interface,
1007
 
                                       attribute._dbus_in_signature,
1008
 
                                       attribute._dbus_out_signature)
1009
 
                                      (types.FunctionType
1010
 
                                       (attribute.func_code,
1011
 
                                        attribute.func_globals,
1012
 
                                        attribute.func_name,
1013
 
                                        attribute.func_defaults,
1014
 
                                        attribute.func_closure)))
1015
 
                # Is this a D-Bus property?
1016
 
                elif getattr(attribute, "_dbus_is_property", False):
1017
 
                    # Create a new, but exactly alike, function
1018
 
                    # object, and decorate it to be a new D-Bus
1019
 
                    # property with the alternate D-Bus interface
1020
 
                    # name.  Add it to the class.
1021
 
                    attr[attrname] = (dbus_service_property
1022
 
                                      (alt_interface,
1023
 
                                       attribute._dbus_signature,
1024
 
                                       attribute._dbus_access,
1025
 
                                       attribute
1026
 
                                       ._dbus_get_args_options
1027
 
                                       ["byte_arrays"])
1028
 
                                      (types.FunctionType
1029
 
                                       (attribute.func_code,
1030
 
                                        attribute.func_globals,
1031
 
                                        attribute.func_name,
1032
 
                                        attribute.func_defaults,
1033
 
                                        attribute.func_closure)))
1034
 
        return type.__new__(mcs, name, bases, attr)
1035
 
 
1036
 
 
1037
671
class ClientDBus(Client, DBusObjectWithProperties):
1038
672
    """A Client class using D-Bus
1039
673
    
1041
675
    dbus_object_path: dbus.ObjectPath
1042
676
    bus: dbus.SystemBus()
1043
677
    """
1044
 
    
1045
 
    runtime_expansions = (Client.runtime_expansions
1046
 
                          + ("dbus_object_path",))
1047
 
    
1048
678
    # dbus.service.Object doesn't use super(), so we can't either.
1049
679
    
1050
680
    def __init__(self, bus = None, *args, **kwargs):
1052
682
        Client.__init__(self, *args, **kwargs)
1053
683
        # Only now, when this client is initialized, can it show up on
1054
684
        # the D-Bus
1055
 
        client_object_name = unicode(self.name).translate(
1056
 
            {ord("."): ord("_"),
1057
 
             ord("-"): ord("_")})
1058
685
        self.dbus_object_path = (dbus.ObjectPath
1059
 
                                 ("/clients/" + client_object_name))
 
686
                                 (u"/clients/"
 
687
                                  + self.name.replace(u".", u"_")))
1060
688
        DBusObjectWithProperties.__init__(self, self.bus,
1061
689
                                          self.dbus_object_path)
1062
 
        
1063
 
    def notifychangeproperty(transform_func,
1064
 
                             dbus_name, type_func=lambda x: x,
1065
 
                             variant_level=1):
1066
 
        """ Modify a variable so that it's a property which announces
1067
 
        its changes to DBus.
1068
 
        
1069
 
        transform_fun: Function that takes a value and a variant_level
1070
 
                       and transforms it to a D-Bus type.
1071
 
        dbus_name: D-Bus name of the variable
1072
 
        type_func: Function that transform the value before sending it
1073
 
                   to the D-Bus.  Default: no transform
1074
 
        variant_level: D-Bus variant level.  Default: 1
1075
 
        """
1076
 
        attrname = "_{0}".format(dbus_name)
1077
 
        def setter(self, value):
1078
 
            if hasattr(self, "dbus_object_path"):
1079
 
                if (not hasattr(self, attrname) or
1080
 
                    type_func(getattr(self, attrname, None))
1081
 
                    != type_func(value)):
1082
 
                    dbus_value = transform_func(type_func(value),
1083
 
                                                variant_level
1084
 
                                                =variant_level)
1085
 
                    self.PropertyChanged(dbus.String(dbus_name),
1086
 
                                         dbus_value)
1087
 
            setattr(self, attrname, value)
1088
 
        
1089
 
        return property(lambda self: getattr(self, attrname), setter)
1090
 
    
1091
 
    
1092
 
    expires = notifychangeproperty(datetime_to_dbus, "Expires")
1093
 
    approvals_pending = notifychangeproperty(dbus.Boolean,
1094
 
                                             "ApprovalPending",
1095
 
                                             type_func = bool)
1096
 
    enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1097
 
    last_enabled = notifychangeproperty(datetime_to_dbus,
1098
 
                                        "LastEnabled")
1099
 
    checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",
1100
 
                                   type_func = lambda checker:
1101
 
                                       checker is not None)
1102
 
    last_checked_ok = notifychangeproperty(datetime_to_dbus,
1103
 
                                           "LastCheckedOK")
1104
 
    last_checker_status = notifychangeproperty(dbus.Int16,
1105
 
                                               "LastCheckerStatus")
1106
 
    last_approval_request = notifychangeproperty(
1107
 
        datetime_to_dbus, "LastApprovalRequest")
1108
 
    approved_by_default = notifychangeproperty(dbus.Boolean,
1109
 
                                               "ApprovedByDefault")
1110
 
    approval_delay = notifychangeproperty(dbus.UInt64,
1111
 
                                          "ApprovalDelay",
1112
 
                                          type_func =
1113
 
                                          timedelta_to_milliseconds)
1114
 
    approval_duration = notifychangeproperty(
1115
 
        dbus.UInt64, "ApprovalDuration",
1116
 
        type_func = timedelta_to_milliseconds)
1117
 
    host = notifychangeproperty(dbus.String, "Host")
1118
 
    timeout = notifychangeproperty(dbus.UInt64, "Timeout",
1119
 
                                   type_func =
1120
 
                                   timedelta_to_milliseconds)
1121
 
    extended_timeout = notifychangeproperty(
1122
 
        dbus.UInt64, "ExtendedTimeout",
1123
 
        type_func = timedelta_to_milliseconds)
1124
 
    interval = notifychangeproperty(dbus.UInt64,
1125
 
                                    "Interval",
1126
 
                                    type_func =
1127
 
                                    timedelta_to_milliseconds)
1128
 
    checker_command = notifychangeproperty(dbus.String, "Checker")
1129
 
    
1130
 
    del notifychangeproperty
 
690
    
 
691
    @staticmethod
 
692
    def _datetime_to_dbus(dt, variant_level=0):
 
693
        """Convert a UTC datetime.datetime() to a D-Bus type."""
 
694
        return dbus.String(dt.isoformat(),
 
695
                           variant_level=variant_level)
 
696
    
 
697
    def enable(self):
 
698
        oldstate = getattr(self, u"enabled", False)
 
699
        r = Client.enable(self)
 
700
        if oldstate != self.enabled:
 
701
            # Emit D-Bus signals
 
702
            self.PropertyChanged(dbus.String(u"enabled"),
 
703
                                 dbus.Boolean(True, variant_level=1))
 
704
            self.PropertyChanged(
 
705
                dbus.String(u"last_enabled"),
 
706
                self._datetime_to_dbus(self.last_enabled,
 
707
                                       variant_level=1))
 
708
        return r
 
709
    
 
710
    def disable(self, quiet = False):
 
711
        oldstate = getattr(self, u"enabled", False)
 
712
        r = Client.disable(self, quiet=quiet)
 
713
        if not quiet and oldstate != self.enabled:
 
714
            # Emit D-Bus signal
 
715
            self.PropertyChanged(dbus.String(u"enabled"),
 
716
                                 dbus.Boolean(False, variant_level=1))
 
717
        return r
1131
718
    
1132
719
    def __del__(self, *args, **kwargs):
1133
720
        try:
1134
721
            self.remove_from_connection()
1135
722
        except LookupError:
1136
723
            pass
1137
 
        if hasattr(DBusObjectWithProperties, "__del__"):
 
724
        if hasattr(DBusObjectWithProperties, u"__del__"):
1138
725
            DBusObjectWithProperties.__del__(self, *args, **kwargs)
1139
726
        Client.__del__(self, *args, **kwargs)
1140
727
    
1142
729
                         *args, **kwargs):
1143
730
        self.checker_callback_tag = None
1144
731
        self.checker = None
 
732
        # Emit D-Bus signal
 
733
        self.PropertyChanged(dbus.String(u"checker_running"),
 
734
                             dbus.Boolean(False, variant_level=1))
1145
735
        if os.WIFEXITED(condition):
1146
736
            exitstatus = os.WEXITSTATUS(condition)
1147
737
            # Emit D-Bus signal
1157
747
        return Client.checker_callback(self, pid, condition, command,
1158
748
                                       *args, **kwargs)
1159
749
    
 
750
    def checked_ok(self, *args, **kwargs):
 
751
        r = Client.checked_ok(self, *args, **kwargs)
 
752
        # Emit D-Bus signal
 
753
        self.PropertyChanged(
 
754
            dbus.String(u"last_checked_ok"),
 
755
            (self._datetime_to_dbus(self.last_checked_ok,
 
756
                                    variant_level=1)))
 
757
        return r
 
758
    
1160
759
    def start_checker(self, *args, **kwargs):
1161
760
        old_checker = self.checker
1162
761
        if self.checker is not None:
1169
768
            and old_checker_pid != self.checker.pid):
1170
769
            # Emit D-Bus signal
1171
770
            self.CheckerStarted(self.current_checker_command)
1172
 
        return r
1173
 
    
1174
 
    def _reset_approved(self):
1175
 
        self.approved = None
1176
 
        return False
1177
 
    
1178
 
    def approve(self, value=True):
1179
 
        self.send_changedstate()
1180
 
        self.approved = value
1181
 
        gobject.timeout_add(timedelta_to_milliseconds
1182
 
                            (self.approval_duration),
1183
 
                            self._reset_approved)
1184
 
    
 
771
            self.PropertyChanged(
 
772
                dbus.String(u"checker_running"),
 
773
                dbus.Boolean(True, variant_level=1))
 
774
        return r
 
775
    
 
776
    def stop_checker(self, *args, **kwargs):
 
777
        old_checker = getattr(self, u"checker", None)
 
778
        r = Client.stop_checker(self, *args, **kwargs)
 
779
        if (old_checker is not None
 
780
            and getattr(self, u"checker", None) is None):
 
781
            self.PropertyChanged(dbus.String(u"checker_running"),
 
782
                                 dbus.Boolean(False, variant_level=1))
 
783
        return r
1185
784
    
1186
785
    ## D-Bus methods, signals & properties
1187
 
    _interface = "se.recompile.Mandos.Client"
 
786
    _interface = u"se.bsnet.fukt.Mandos.Client"
1188
787
    
1189
788
    ## Signals
1190
789
    
1191
790
    # CheckerCompleted - signal
1192
 
    @dbus.service.signal(_interface, signature="nxs")
 
791
    @dbus.service.signal(_interface, signature=u"nxs")
1193
792
    def CheckerCompleted(self, exitcode, waitstatus, command):
1194
793
        "D-Bus signal"
1195
794
        pass
1196
795
    
1197
796
    # CheckerStarted - signal
1198
 
    @dbus.service.signal(_interface, signature="s")
 
797
    @dbus.service.signal(_interface, signature=u"s")
1199
798
    def CheckerStarted(self, command):
1200
799
        "D-Bus signal"
1201
800
        pass
1202
801
    
1203
802
    # PropertyChanged - signal
1204
 
    @dbus.service.signal(_interface, signature="sv")
 
803
    @dbus.service.signal(_interface, signature=u"sv")
1205
804
    def PropertyChanged(self, property, value):
1206
805
        "D-Bus signal"
1207
806
        pass
1209
808
    # GotSecret - signal
1210
809
    @dbus.service.signal(_interface)
1211
810
    def GotSecret(self):
1212
 
        """D-Bus signal
1213
 
        Is sent after a successful transfer of secret from the Mandos
1214
 
        server to mandos-client
1215
 
        """
 
811
        "D-Bus signal"
1216
812
        pass
1217
813
    
1218
814
    # Rejected - signal
1219
 
    @dbus.service.signal(_interface, signature="s")
1220
 
    def Rejected(self, reason):
 
815
    @dbus.service.signal(_interface)
 
816
    def Rejected(self):
1221
817
        "D-Bus signal"
1222
818
        pass
1223
819
    
1224
 
    # NeedApproval - signal
1225
 
    @dbus.service.signal(_interface, signature="tb")
1226
 
    def NeedApproval(self, timeout, default):
1227
 
        "D-Bus signal"
1228
 
        return self.need_approval()
1229
 
    
1230
820
    ## Methods
1231
821
    
1232
 
    # Approve - method
1233
 
    @dbus.service.method(_interface, in_signature="b")
1234
 
    def Approve(self, value):
1235
 
        self.approve(value)
1236
 
    
1237
822
    # CheckedOK - method
1238
823
    @dbus.service.method(_interface)
1239
824
    def CheckedOK(self):
1240
 
        self.checked_ok()
 
825
        return self.checked_ok()
1241
826
    
1242
827
    # Enable - method
1243
828
    @dbus.service.method(_interface)
1264
849
    
1265
850
    ## Properties
1266
851
    
1267
 
    # ApprovalPending - property
1268
 
    @dbus_service_property(_interface, signature="b", access="read")
1269
 
    def ApprovalPending_dbus_property(self):
1270
 
        return dbus.Boolean(bool(self.approvals_pending))
1271
 
    
1272
 
    # ApprovedByDefault - property
1273
 
    @dbus_service_property(_interface, signature="b",
1274
 
                           access="readwrite")
1275
 
    def ApprovedByDefault_dbus_property(self, value=None):
1276
 
        if value is None:       # get
1277
 
            return dbus.Boolean(self.approved_by_default)
1278
 
        self.approved_by_default = bool(value)
1279
 
    
1280
 
    # ApprovalDelay - property
1281
 
    @dbus_service_property(_interface, signature="t",
1282
 
                           access="readwrite")
1283
 
    def ApprovalDelay_dbus_property(self, value=None):
1284
 
        if value is None:       # get
1285
 
            return dbus.UInt64(self.approval_delay_milliseconds())
1286
 
        self.approval_delay = datetime.timedelta(0, 0, 0, value)
1287
 
    
1288
 
    # ApprovalDuration - property
1289
 
    @dbus_service_property(_interface, signature="t",
1290
 
                           access="readwrite")
1291
 
    def ApprovalDuration_dbus_property(self, value=None):
1292
 
        if value is None:       # get
1293
 
            return dbus.UInt64(timedelta_to_milliseconds(
1294
 
                    self.approval_duration))
1295
 
        self.approval_duration = datetime.timedelta(0, 0, 0, value)
1296
 
    
1297
 
    # Name - property
1298
 
    @dbus_service_property(_interface, signature="s", access="read")
1299
 
    def Name_dbus_property(self):
 
852
    # name - property
 
853
    @dbus_service_property(_interface, signature=u"s", access=u"read")
 
854
    def name_dbus_property(self):
1300
855
        return dbus.String(self.name)
1301
856
    
1302
 
    # Fingerprint - property
1303
 
    @dbus_service_property(_interface, signature="s", access="read")
1304
 
    def Fingerprint_dbus_property(self):
 
857
    # fingerprint - property
 
858
    @dbus_service_property(_interface, signature=u"s", access=u"read")
 
859
    def fingerprint_dbus_property(self):
1305
860
        return dbus.String(self.fingerprint)
1306
861
    
1307
 
    # Host - property
1308
 
    @dbus_service_property(_interface, signature="s",
1309
 
                           access="readwrite")
1310
 
    def Host_dbus_property(self, value=None):
 
862
    # host - property
 
863
    @dbus_service_property(_interface, signature=u"s",
 
864
                           access=u"readwrite")
 
865
    def host_dbus_property(self, value=None):
1311
866
        if value is None:       # get
1312
867
            return dbus.String(self.host)
1313
 
        self.host = unicode(value)
1314
 
    
1315
 
    # Created - property
1316
 
    @dbus_service_property(_interface, signature="s", access="read")
1317
 
    def Created_dbus_property(self):
1318
 
        return datetime_to_dbus(self.created)
1319
 
    
1320
 
    # LastEnabled - property
1321
 
    @dbus_service_property(_interface, signature="s", access="read")
1322
 
    def LastEnabled_dbus_property(self):
1323
 
        return datetime_to_dbus(self.last_enabled)
1324
 
    
1325
 
    # Enabled - property
1326
 
    @dbus_service_property(_interface, signature="b",
1327
 
                           access="readwrite")
1328
 
    def Enabled_dbus_property(self, value=None):
 
868
        self.host = value
 
869
        # Emit D-Bus signal
 
870
        self.PropertyChanged(dbus.String(u"host"),
 
871
                             dbus.String(value, variant_level=1))
 
872
    
 
873
    # created - property
 
874
    @dbus_service_property(_interface, signature=u"s", access=u"read")
 
875
    def created_dbus_property(self):
 
876
        return dbus.String(self._datetime_to_dbus(self.created))
 
877
    
 
878
    # last_enabled - property
 
879
    @dbus_service_property(_interface, signature=u"s", access=u"read")
 
880
    def last_enabled_dbus_property(self):
 
881
        if self.last_enabled is None:
 
882
            return dbus.String(u"")
 
883
        return dbus.String(self._datetime_to_dbus(self.last_enabled))
 
884
    
 
885
    # enabled - property
 
886
    @dbus_service_property(_interface, signature=u"b",
 
887
                           access=u"readwrite")
 
888
    def enabled_dbus_property(self, value=None):
1329
889
        if value is None:       # get
1330
890
            return dbus.Boolean(self.enabled)
1331
891
        if value:
1333
893
        else:
1334
894
            self.disable()
1335
895
    
1336
 
    # LastCheckedOK - property
1337
 
    @dbus_service_property(_interface, signature="s",
1338
 
                           access="readwrite")
1339
 
    def LastCheckedOK_dbus_property(self, value=None):
 
896
    # last_checked_ok - property
 
897
    @dbus_service_property(_interface, signature=u"s",
 
898
                           access=u"readwrite")
 
899
    def last_checked_ok_dbus_property(self, value=None):
1340
900
        if value is not None:
1341
901
            self.checked_ok()
1342
902
            return
1343
 
        return datetime_to_dbus(self.last_checked_ok)
1344
 
    
1345
 
    # LastCheckerStatus - property
1346
 
    @dbus_service_property(_interface, signature="n",
1347
 
                           access="read")
1348
 
    def LastCheckerStatus_dbus_property(self):
1349
 
        return dbus.Int16(self.last_checker_status)
1350
 
    
1351
 
    # Expires - property
1352
 
    @dbus_service_property(_interface, signature="s", access="read")
1353
 
    def Expires_dbus_property(self):
1354
 
        return datetime_to_dbus(self.expires)
1355
 
    
1356
 
    # LastApprovalRequest - property
1357
 
    @dbus_service_property(_interface, signature="s", access="read")
1358
 
    def LastApprovalRequest_dbus_property(self):
1359
 
        return datetime_to_dbus(self.last_approval_request)
1360
 
    
1361
 
    # Timeout - property
1362
 
    @dbus_service_property(_interface, signature="t",
1363
 
                           access="readwrite")
1364
 
    def Timeout_dbus_property(self, value=None):
 
903
        if self.last_checked_ok is None:
 
904
            return dbus.String(u"")
 
905
        return dbus.String(self._datetime_to_dbus(self
 
906
                                                  .last_checked_ok))
 
907
    
 
908
    # timeout - property
 
909
    @dbus_service_property(_interface, signature=u"t",
 
910
                           access=u"readwrite")
 
911
    def timeout_dbus_property(self, value=None):
1365
912
        if value is None:       # get
1366
913
            return dbus.UInt64(self.timeout_milliseconds())
1367
914
        self.timeout = datetime.timedelta(0, 0, 0, value)
 
915
        # Emit D-Bus signal
 
916
        self.PropertyChanged(dbus.String(u"timeout"),
 
917
                             dbus.UInt64(value, variant_level=1))
 
918
        if getattr(self, u"disable_initiator_tag", None) is None:
 
919
            return
1368
920
        # Reschedule timeout
1369
 
        if self.enabled:
1370
 
            now = datetime.datetime.utcnow()
1371
 
            time_to_die = timedelta_to_milliseconds(
1372
 
                (self.last_checked_ok + self.timeout) - now)
1373
 
            if time_to_die <= 0:
1374
 
                # The timeout has passed
1375
 
                self.disable()
1376
 
            else:
1377
 
                self.expires = (now +
1378
 
                                datetime.timedelta(milliseconds =
1379
 
                                                   time_to_die))
1380
 
                if (getattr(self, "disable_initiator_tag", None)
1381
 
                    is None):
1382
 
                    return
1383
 
                gobject.source_remove(self.disable_initiator_tag)
1384
 
                self.disable_initiator_tag = (gobject.timeout_add
1385
 
                                              (time_to_die,
1386
 
                                               self.disable))
1387
 
    
1388
 
    # ExtendedTimeout - property
1389
 
    @dbus_service_property(_interface, signature="t",
1390
 
                           access="readwrite")
1391
 
    def ExtendedTimeout_dbus_property(self, value=None):
1392
 
        if value is None:       # get
1393
 
            return dbus.UInt64(self.extended_timeout_milliseconds())
1394
 
        self.extended_timeout = datetime.timedelta(0, 0, 0, value)
1395
 
    
1396
 
    # Interval - property
1397
 
    @dbus_service_property(_interface, signature="t",
1398
 
                           access="readwrite")
1399
 
    def Interval_dbus_property(self, value=None):
 
921
        gobject.source_remove(self.disable_initiator_tag)
 
922
        self.disable_initiator_tag = None
 
923
        time_to_die = (self.
 
924
                       _timedelta_to_milliseconds((self
 
925
                                                   .last_checked_ok
 
926
                                                   + self.timeout)
 
927
                                                  - datetime.datetime
 
928
                                                  .utcnow()))
 
929
        if time_to_die <= 0:
 
930
            # The timeout has passed
 
931
            self.disable()
 
932
        else:
 
933
            self.disable_initiator_tag = (gobject.timeout_add
 
934
                                          (time_to_die, self.disable))
 
935
    
 
936
    # interval - property
 
937
    @dbus_service_property(_interface, signature=u"t",
 
938
                           access=u"readwrite")
 
939
    def interval_dbus_property(self, value=None):
1400
940
        if value is None:       # get
1401
941
            return dbus.UInt64(self.interval_milliseconds())
1402
942
        self.interval = datetime.timedelta(0, 0, 0, value)
1403
 
        if getattr(self, "checker_initiator_tag", None) is None:
 
943
        # Emit D-Bus signal
 
944
        self.PropertyChanged(dbus.String(u"interval"),
 
945
                             dbus.UInt64(value, variant_level=1))
 
946
        if getattr(self, u"checker_initiator_tag", None) is None:
1404
947
            return
1405
 
        if self.enabled:
1406
 
            # Reschedule checker run
1407
 
            gobject.source_remove(self.checker_initiator_tag)
1408
 
            self.checker_initiator_tag = (gobject.timeout_add
1409
 
                                          (value, self.start_checker))
1410
 
            self.start_checker()    # Start one now, too
1411
 
    
1412
 
    # Checker - property
1413
 
    @dbus_service_property(_interface, signature="s",
1414
 
                           access="readwrite")
1415
 
    def Checker_dbus_property(self, value=None):
 
948
        # Reschedule checker run
 
949
        gobject.source_remove(self.checker_initiator_tag)
 
950
        self.checker_initiator_tag = (gobject.timeout_add
 
951
                                      (value, self.start_checker))
 
952
        self.start_checker()    # Start one now, too
 
953
 
 
954
    # checker - property
 
955
    @dbus_service_property(_interface, signature=u"s",
 
956
                           access=u"readwrite")
 
957
    def checker_dbus_property(self, value=None):
1416
958
        if value is None:       # get
1417
959
            return dbus.String(self.checker_command)
1418
 
        self.checker_command = unicode(value)
 
960
        self.checker_command = value
 
961
        # Emit D-Bus signal
 
962
        self.PropertyChanged(dbus.String(u"checker"),
 
963
                             dbus.String(self.checker_command,
 
964
                                         variant_level=1))
1419
965
    
1420
 
    # CheckerRunning - property
1421
 
    @dbus_service_property(_interface, signature="b",
1422
 
                           access="readwrite")
1423
 
    def CheckerRunning_dbus_property(self, value=None):
 
966
    # checker_running - property
 
967
    @dbus_service_property(_interface, signature=u"b",
 
968
                           access=u"readwrite")
 
969
    def checker_running_dbus_property(self, value=None):
1424
970
        if value is None:       # get
1425
971
            return dbus.Boolean(self.checker is not None)
1426
972
        if value:
1428
974
        else:
1429
975
            self.stop_checker()
1430
976
    
1431
 
    # ObjectPath - property
1432
 
    @dbus_service_property(_interface, signature="o", access="read")
1433
 
    def ObjectPath_dbus_property(self):
 
977
    # object_path - property
 
978
    @dbus_service_property(_interface, signature=u"o", access=u"read")
 
979
    def object_path_dbus_property(self):
1434
980
        return self.dbus_object_path # is already a dbus.ObjectPath
1435
981
    
1436
 
    # Secret = property
1437
 
    @dbus_service_property(_interface, signature="ay",
1438
 
                           access="write", byte_arrays=True)
1439
 
    def Secret_dbus_property(self, value):
 
982
    # secret = property
 
983
    @dbus_service_property(_interface, signature=u"ay",
 
984
                           access=u"write", byte_arrays=True)
 
985
    def secret_dbus_property(self, value):
1440
986
        self.secret = str(value)
1441
987
    
1442
988
    del _interface
1443
989
 
1444
990
 
1445
 
class ProxyClient(object):
1446
 
    def __init__(self, child_pipe, fpr, address):
1447
 
        self._pipe = child_pipe
1448
 
        self._pipe.send(('init', fpr, address))
1449
 
        if not self._pipe.recv():
1450
 
            raise KeyError()
1451
 
    
1452
 
    def __getattribute__(self, name):
1453
 
        if name == '_pipe':
1454
 
            return super(ProxyClient, self).__getattribute__(name)
1455
 
        self._pipe.send(('getattr', name))
1456
 
        data = self._pipe.recv()
1457
 
        if data[0] == 'data':
1458
 
            return data[1]
1459
 
        if data[0] == 'function':
1460
 
            def func(*args, **kwargs):
1461
 
                self._pipe.send(('funcall', name, args, kwargs))
1462
 
                return self._pipe.recv()[1]
1463
 
            return func
1464
 
    
1465
 
    def __setattr__(self, name, value):
1466
 
        if name == '_pipe':
1467
 
            return super(ProxyClient, self).__setattr__(name, value)
1468
 
        self._pipe.send(('setattr', name, value))
1469
 
 
1470
 
 
1471
 
class ClientDBusTransitional(ClientDBus):
1472
 
    __metaclass__ = AlternateDBusNamesMetaclass
1473
 
 
1474
 
 
1475
991
class ClientHandler(socketserver.BaseRequestHandler, object):
1476
992
    """A class to handle client connections.
1477
993
    
1479
995
    Note: This will run in its own forked process."""
1480
996
    
1481
997
    def handle(self):
1482
 
        with contextlib.closing(self.server.child_pipe) as child_pipe:
1483
 
            logger.info("TCP connection from: %s",
1484
 
                        unicode(self.client_address))
1485
 
            logger.debug("Pipe FD: %d",
1486
 
                         self.server.child_pipe.fileno())
1487
 
            
 
998
        logger.info(u"TCP connection from: %s",
 
999
                    unicode(self.client_address))
 
1000
        logger.debug(u"IPC Pipe FD: %d",
 
1001
                     self.server.child_pipe[1].fileno())
 
1002
        # Open IPC pipe to parent process
 
1003
        with contextlib.nested(self.server.child_pipe[1],
 
1004
                               self.server.parent_pipe[0]
 
1005
                               ) as (ipc, ipc_return):
1488
1006
            session = (gnutls.connection
1489
1007
                       .ClientSession(self.request,
1490
1008
                                      gnutls.connection
1495
1013
            # no X.509 keys are added to it.  Therefore, we can use it
1496
1014
            # here despite using OpenPGP certificates.
1497
1015
            
1498
 
            #priority = ':'.join(("NONE", "+VERS-TLS1.1",
1499
 
            #                      "+AES-256-CBC", "+SHA1",
1500
 
            #                      "+COMP-NULL", "+CTYPE-OPENPGP",
1501
 
            #                      "+DHE-DSS"))
 
1016
            #priority = u':'.join((u"NONE", u"+VERS-TLS1.1",
 
1017
            #                      u"+AES-256-CBC", u"+SHA1",
 
1018
            #                      u"+COMP-NULL", u"+CTYPE-OPENPGP",
 
1019
            #                      u"+DHE-DSS"))
1502
1020
            # Use a fallback default, since this MUST be set.
1503
1021
            priority = self.server.gnutls_priority
1504
1022
            if priority is None:
1505
 
                priority = "NORMAL"
 
1023
                priority = u"NORMAL"
1506
1024
            (gnutls.library.functions
1507
1025
             .gnutls_priority_set_direct(session._c_object,
1508
1026
                                         priority, None))
1510
1028
            # Start communication using the Mandos protocol
1511
1029
            # Get protocol number
1512
1030
            line = self.request.makefile().readline()
1513
 
            logger.debug("Protocol version: %r", line)
 
1031
            logger.debug(u"Protocol version: %r", line)
1514
1032
            try:
1515
1033
                if int(line.strip().split()[0]) > 1:
1516
1034
                    raise RuntimeError
1517
 
            except (ValueError, IndexError, RuntimeError) as error:
1518
 
                logger.error("Unknown protocol version: %s", error)
 
1035
            except (ValueError, IndexError, RuntimeError), error:
 
1036
                logger.error(u"Unknown protocol version: %s", error)
1519
1037
                return
1520
1038
            
1521
1039
            # Start GnuTLS connection
1522
1040
            try:
1523
1041
                session.handshake()
1524
 
            except gnutls.errors.GNUTLSError as error:
1525
 
                logger.warning("Handshake failed: %s", error)
 
1042
            except gnutls.errors.GNUTLSError, error:
 
1043
                logger.warning(u"Handshake failed: %s", error)
1526
1044
                # Do not run session.bye() here: the session is not
1527
1045
                # established.  Just abandon the request.
1528
1046
                return
1529
 
            logger.debug("Handshake succeeded")
1530
 
            
1531
 
            approval_required = False
 
1047
            logger.debug(u"Handshake succeeded")
1532
1048
            try:
1533
1049
                try:
1534
1050
                    fpr = self.fingerprint(self.peer_certificate
1535
1051
                                           (session))
1536
 
                except (TypeError,
1537
 
                        gnutls.errors.GNUTLSError) as error:
1538
 
                    logger.warning("Bad certificate: %s", error)
1539
 
                    return
1540
 
                logger.debug("Fingerprint: %s", fpr)
1541
 
                
1542
 
                try:
1543
 
                    client = ProxyClient(child_pipe, fpr,
1544
 
                                         self.client_address)
1545
 
                except KeyError:
1546
 
                    return
1547
 
                
1548
 
                if client.approval_delay:
1549
 
                    delay = client.approval_delay
1550
 
                    client.approvals_pending += 1
1551
 
                    approval_required = True
1552
 
                
1553
 
                while True:
1554
 
                    if not client.enabled:
1555
 
                        logger.info("Client %s is disabled",
1556
 
                                       client.name)
1557
 
                        if self.server.use_dbus:
1558
 
                            # Emit D-Bus signal
1559
 
                            client.Rejected("Disabled")
1560
 
                        return
1561
 
                    
1562
 
                    if client.approved or not client.approval_delay:
1563
 
                        #We are approved or approval is disabled
 
1052
                except (TypeError, gnutls.errors.GNUTLSError), error:
 
1053
                    logger.warning(u"Bad certificate: %s", error)
 
1054
                    return
 
1055
                logger.debug(u"Fingerprint: %s", fpr)
 
1056
 
 
1057
                for c in self.server.clients:
 
1058
                    if c.fingerprint == fpr:
 
1059
                        client = c
1564
1060
                        break
1565
 
                    elif client.approved is None:
1566
 
                        logger.info("Client %s needs approval",
1567
 
                                    client.name)
1568
 
                        if self.server.use_dbus:
1569
 
                            # Emit D-Bus signal
1570
 
                            client.NeedApproval(
1571
 
                                client.approval_delay_milliseconds(),
1572
 
                                client.approved_by_default)
1573
 
                    else:
1574
 
                        logger.warning("Client %s was not approved",
1575
 
                                       client.name)
1576
 
                        if self.server.use_dbus:
1577
 
                            # Emit D-Bus signal
1578
 
                            client.Rejected("Denied")
1579
 
                        return
1580
 
                    
1581
 
                    #wait until timeout or approved
1582
 
                    time = datetime.datetime.now()
1583
 
                    client.changedstate.acquire()
1584
 
                    (client.changedstate.wait
1585
 
                     (float(client.timedelta_to_milliseconds(delay)
1586
 
                            / 1000)))
1587
 
                    client.changedstate.release()
1588
 
                    time2 = datetime.datetime.now()
1589
 
                    if (time2 - time) >= delay:
1590
 
                        if not client.approved_by_default:
1591
 
                            logger.warning("Client %s timed out while"
1592
 
                                           " waiting for approval",
1593
 
                                           client.name)
1594
 
                            if self.server.use_dbus:
1595
 
                                # Emit D-Bus signal
1596
 
                                client.Rejected("Approval timed out")
1597
 
                            return
1598
 
                        else:
1599
 
                            break
1600
 
                    else:
1601
 
                        delay -= time2 - time
1602
 
                
 
1061
                else:
 
1062
                    ipc.write(u"NOTFOUND %s %s\n"
 
1063
                              % (fpr, unicode(self.client_address)))
 
1064
                    return
 
1065
                
 
1066
                class ClientProxy(object):
 
1067
                    """Client proxy object.  Not for calling methods."""
 
1068
                    def __init__(self, client):
 
1069
                        self.client = client
 
1070
                    def __getattr__(self, name):
 
1071
                        if name.startswith("ipc_"):
 
1072
                            def tempfunc():
 
1073
                                ipc.write("%s %s\n" % (name[4:].upper(),
 
1074
                                                       self.client.name))
 
1075
                            return tempfunc
 
1076
                        if not hasattr(self.client, name):
 
1077
                            raise AttributeError
 
1078
                        ipc.write(u"GETATTR %s %s\n"
 
1079
                                  % (name, self.client.fingerprint))
 
1080
                        return pickle.load(ipc_return)
 
1081
                clientproxy = ClientProxy(client)
 
1082
                # Have to check if client.enabled, since it is
 
1083
                # possible that the client was disabled since the
 
1084
                # GnuTLS session was established.
 
1085
                if not clientproxy.enabled:
 
1086
                    clientproxy.ipc_disabled()
 
1087
                    return
 
1088
                
 
1089
                clientproxy.ipc_sending()
1603
1090
                sent_size = 0
1604
1091
                while sent_size < len(client.secret):
1605
 
                    try:
1606
 
                        sent = session.send(client.secret[sent_size:])
1607
 
                    except gnutls.errors.GNUTLSError as error:
1608
 
                        logger.warning("gnutls send failed")
1609
 
                        return
1610
 
                    logger.debug("Sent: %d, remaining: %d",
 
1092
                    sent = session.send(client.secret[sent_size:])
 
1093
                    logger.debug(u"Sent: %d, remaining: %d",
1611
1094
                                 sent, len(client.secret)
1612
1095
                                 - (sent_size + sent))
1613
1096
                    sent_size += sent
1614
 
                
1615
 
                logger.info("Sending secret to %s", client.name)
1616
 
                # bump the timeout using extended_timeout
1617
 
                client.bump_timeout(client.extended_timeout)
1618
 
                if self.server.use_dbus:
1619
 
                    # Emit D-Bus signal
1620
 
                    client.GotSecret()
1621
 
            
1622
1097
            finally:
1623
 
                if approval_required:
1624
 
                    client.approvals_pending -= 1
1625
 
                try:
1626
 
                    session.bye()
1627
 
                except gnutls.errors.GNUTLSError as error:
1628
 
                    logger.warning("GnuTLS bye failed")
 
1098
                session.bye()
1629
1099
    
1630
1100
    @staticmethod
1631
1101
    def peer_certificate(session):
1641
1111
                     .gnutls_certificate_get_peers
1642
1112
                     (session._c_object, ctypes.byref(list_size)))
1643
1113
        if not bool(cert_list) and list_size.value != 0:
1644
 
            raise gnutls.errors.GNUTLSError("error getting peer"
1645
 
                                            " certificate")
 
1114
            raise gnutls.errors.GNUTLSError(u"error getting peer"
 
1115
                                            u" certificate")
1646
1116
        if list_size.value == 0:
1647
1117
            return None
1648
1118
        cert = cert_list[0]
1674
1144
        if crtverify.value != 0:
1675
1145
            gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1676
1146
            raise (gnutls.errors.CertificateSecurityError
1677
 
                   ("Verify failed"))
 
1147
                   (u"Verify failed"))
1678
1148
        # New buffer for the fingerprint
1679
1149
        buf = ctypes.create_string_buffer(20)
1680
1150
        buf_len = ctypes.c_size_t()
1687
1157
        # Convert the buffer to a Python bytestring
1688
1158
        fpr = ctypes.string_at(buf, buf_len.value)
1689
1159
        # Convert the bytestring to hexadecimal notation
1690
 
        hex_fpr = binascii.hexlify(fpr).upper()
 
1160
        hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
1691
1161
        return hex_fpr
1692
1162
 
1693
1163
 
1694
 
class MultiprocessingMixIn(object):
1695
 
    """Like socketserver.ThreadingMixIn, but with multiprocessing"""
1696
 
    def sub_process_main(self, request, address):
1697
 
        try:
1698
 
            self.finish_request(request, address)
1699
 
        except Exception:
1700
 
            self.handle_error(request, address)
1701
 
        self.close_request(request)
1702
 
    
1703
 
    def process_request(self, request, address):
1704
 
        """Start a new process to process the request."""
1705
 
        proc = multiprocessing.Process(target = self.sub_process_main,
1706
 
                                       args = (request,
1707
 
                                               address))
1708
 
        proc.start()
1709
 
        return proc
1710
 
 
1711
 
 
1712
 
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
1713
 
    """ adds a pipe to the MixIn """
 
1164
class ForkingMixInWithPipes(socketserver.ForkingMixIn, object):
 
1165
    """Like socketserver.ForkingMixIn, but also pass a pipe pair."""
1714
1166
    def process_request(self, request, client_address):
1715
1167
        """Overrides and wraps the original process_request().
1716
1168
        
1717
1169
        This function creates a new pipe in self.pipe
1718
1170
        """
1719
 
        parent_pipe, self.child_pipe = multiprocessing.Pipe()
1720
 
        
1721
 
        proc = MultiprocessingMixIn.process_request(self, request,
1722
 
                                                    client_address)
1723
 
        self.child_pipe.close()
1724
 
        self.add_pipe(parent_pipe, proc)
1725
 
    
1726
 
    def add_pipe(self, parent_pipe, proc):
 
1171
        # Child writes to child_pipe
 
1172
        self.child_pipe = map(os.fdopen, os.pipe(), u"rw", (1, 0))
 
1173
        # Parent writes to parent_pipe
 
1174
        self.parent_pipe = map(os.fdopen, os.pipe(), u"rw", (1, 0))
 
1175
        super(ForkingMixInWithPipes,
 
1176
              self).process_request(request, client_address)
 
1177
        # Close unused ends for parent
 
1178
        self.parent_pipe[0].close() # close read end
 
1179
        self.child_pipe[1].close()  # close write end
 
1180
        self.add_pipe_fds(self.child_pipe[0], self.parent_pipe[1])
 
1181
    def add_pipe_fds(self, child_pipe_fd, parent_pipe_fd):
1727
1182
        """Dummy function; override as necessary"""
1728
 
        raise NotImplementedError
1729
 
 
1730
 
 
1731
 
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
 
1183
        child_pipe_fd.close()
 
1184
        parent_pipe_fd.close()
 
1185
 
 
1186
 
 
1187
class IPv6_TCPServer(ForkingMixInWithPipes,
1732
1188
                     socketserver.TCPServer, object):
1733
1189
    """IPv6-capable TCP server.  Accepts 'None' as address and/or port
1734
1190
    
1750
1206
        bind to an address or port if they were not specified."""
1751
1207
        if self.interface is not None:
1752
1208
            if SO_BINDTODEVICE is None:
1753
 
                logger.error("SO_BINDTODEVICE does not exist;"
1754
 
                             " cannot bind to interface %s",
 
1209
                logger.error(u"SO_BINDTODEVICE does not exist;"
 
1210
                             u" cannot bind to interface %s",
1755
1211
                             self.interface)
1756
1212
            else:
1757
1213
                try:
1758
1214
                    self.socket.setsockopt(socket.SOL_SOCKET,
1759
1215
                                           SO_BINDTODEVICE,
1760
1216
                                           str(self.interface
1761
 
                                               + '\0'))
1762
 
                except socket.error as error:
 
1217
                                               + u'\0'))
 
1218
                except socket.error, error:
1763
1219
                    if error[0] == errno.EPERM:
1764
 
                        logger.error("No permission to"
1765
 
                                     " bind to interface %s",
 
1220
                        logger.error(u"No permission to"
 
1221
                                     u" bind to interface %s",
1766
1222
                                     self.interface)
1767
1223
                    elif error[0] == errno.ENOPROTOOPT:
1768
 
                        logger.error("SO_BINDTODEVICE not available;"
1769
 
                                     " cannot bind to interface %s",
 
1224
                        logger.error(u"SO_BINDTODEVICE not available;"
 
1225
                                     u" cannot bind to interface %s",
1770
1226
                                     self.interface)
1771
1227
                    else:
1772
1228
                        raise
1774
1230
        if self.server_address[0] or self.server_address[1]:
1775
1231
            if not self.server_address[0]:
1776
1232
                if self.address_family == socket.AF_INET6:
1777
 
                    any_address = "::" # in6addr_any
 
1233
                    any_address = u"::" # in6addr_any
1778
1234
                else:
1779
1235
                    any_address = socket.INADDR_ANY
1780
1236
                self.server_address = (any_address,
1807
1263
        self.enabled = False
1808
1264
        self.clients = clients
1809
1265
        if self.clients is None:
1810
 
            self.clients = {}
 
1266
            self.clients = set()
1811
1267
        self.use_dbus = use_dbus
1812
1268
        self.gnutls_priority = gnutls_priority
1813
1269
        IPv6_TCPServer.__init__(self, server_address,
1817
1273
    def server_activate(self):
1818
1274
        if self.enabled:
1819
1275
            return socketserver.TCPServer.server_activate(self)
1820
 
    
1821
1276
    def enable(self):
1822
1277
        self.enabled = True
1823
 
    
1824
 
    def add_pipe(self, parent_pipe, proc):
 
1278
    def add_pipe_fds(self, child_pipe_fd, parent_pipe_fd):
1825
1279
        # Call "handle_ipc" for both data and EOF events
1826
 
        gobject.io_add_watch(parent_pipe.fileno(),
 
1280
        gobject.io_add_watch(child_pipe_fd.fileno(),
1827
1281
                             gobject.IO_IN | gobject.IO_HUP,
1828
1282
                             functools.partial(self.handle_ipc,
1829
 
                                               parent_pipe =
1830
 
                                               parent_pipe,
1831
 
                                               proc = proc))
1832
 
    
1833
 
    def handle_ipc(self, source, condition, parent_pipe=None,
1834
 
                   proc = None, client_object=None):
 
1283
                                               reply = parent_pipe_fd,
 
1284
                                               sender= child_pipe_fd))
 
1285
    def handle_ipc(self, source, condition, reply=None, sender=None):
1835
1286
        condition_names = {
1836
 
            gobject.IO_IN: "IN",   # There is data to read.
1837
 
            gobject.IO_OUT: "OUT", # Data can be written (without
 
1287
            gobject.IO_IN: u"IN",   # There is data to read.
 
1288
            gobject.IO_OUT: u"OUT", # Data can be written (without
1838
1289
                                    # blocking).
1839
 
            gobject.IO_PRI: "PRI", # There is urgent data to read.
1840
 
            gobject.IO_ERR: "ERR", # Error condition.
1841
 
            gobject.IO_HUP: "HUP"  # Hung up (the connection has been
 
1290
            gobject.IO_PRI: u"PRI", # There is urgent data to read.
 
1291
            gobject.IO_ERR: u"ERR", # Error condition.
 
1292
            gobject.IO_HUP: u"HUP"  # Hung up (the connection has been
1842
1293
                                    # broken, usually for pipes and
1843
1294
                                    # sockets).
1844
1295
            }
1846
1297
                                       for cond, name in
1847
1298
                                       condition_names.iteritems()
1848
1299
                                       if cond & condition)
1849
 
        # error, or the other end of multiprocessing.Pipe has closed
1850
 
        if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):
1851
 
            # Wait for other process to exit
1852
 
            proc.join()
1853
 
            return False
1854
 
        
1855
 
        # Read a request from the child
1856
 
        request = parent_pipe.recv()
1857
 
        command = request[0]
1858
 
        
1859
 
        if command == 'init':
1860
 
            fpr = request[1]
1861
 
            address = request[2]
1862
 
            
1863
 
            for c in self.clients.itervalues():
1864
 
                if c.fingerprint == fpr:
1865
 
                    client = c
1866
 
                    break
1867
 
            else:
1868
 
                logger.info("Client not found for fingerprint: %s, ad"
1869
 
                            "dress: %s", fpr, address)
1870
 
                if self.use_dbus:
1871
 
                    # Emit D-Bus signal
1872
 
                    mandos_dbus_service.ClientNotFound(fpr,
1873
 
                                                       address[0])
1874
 
                parent_pipe.send(False)
1875
 
                return False
1876
 
            
1877
 
            gobject.io_add_watch(parent_pipe.fileno(),
1878
 
                                 gobject.IO_IN | gobject.IO_HUP,
1879
 
                                 functools.partial(self.handle_ipc,
1880
 
                                                   parent_pipe =
1881
 
                                                   parent_pipe,
1882
 
                                                   proc = proc,
1883
 
                                                   client_object =
1884
 
                                                   client))
1885
 
            parent_pipe.send(True)
1886
 
            # remove the old hook in favor of the new above hook on
1887
 
            # same fileno
1888
 
            return False
1889
 
        if command == 'funcall':
1890
 
            funcname = request[1]
1891
 
            args = request[2]
1892
 
            kwargs = request[3]
1893
 
            
1894
 
            parent_pipe.send(('data', getattr(client_object,
1895
 
                                              funcname)(*args,
1896
 
                                                         **kwargs)))
1897
 
        
1898
 
        if command == 'getattr':
1899
 
            attrname = request[1]
1900
 
            if callable(client_object.__getattribute__(attrname)):
1901
 
                parent_pipe.send(('function',))
1902
 
            else:
1903
 
                parent_pipe.send(('data', client_object
1904
 
                                  .__getattribute__(attrname)))
1905
 
        
1906
 
        if command == 'setattr':
1907
 
            attrname = request[1]
1908
 
            value = request[2]
1909
 
            setattr(client_object, attrname, value)
1910
 
        
 
1300
        logger.debug(u"Handling IPC: FD = %d, condition = %s", source,
 
1301
                     conditions_string)
 
1302
        
 
1303
        # Read a line from the file object
 
1304
        cmdline = sender.readline()
 
1305
        if not cmdline:             # Empty line means end of file
 
1306
            # close the IPC pipes
 
1307
            sender.close()
 
1308
            reply.close()
 
1309
            
 
1310
            # Stop calling this function
 
1311
            return False
 
1312
        
 
1313
        logger.debug(u"IPC command: %r", cmdline)
 
1314
        
 
1315
        # Parse and act on command
 
1316
        cmd, args = cmdline.rstrip(u"\r\n").split(None, 1)
 
1317
        
 
1318
        if cmd == u"NOTFOUND":
 
1319
            fpr, address = args.split(None, 1)
 
1320
            logger.warning(u"Client not found for fingerprint: %s, ad"
 
1321
                           u"dress: %s", fpr, address)
 
1322
            if self.use_dbus:
 
1323
                # Emit D-Bus signal
 
1324
                mandos_dbus_service.ClientNotFound(fpr, address)
 
1325
        elif cmd == u"DISABLED":
 
1326
            for client in self.clients:
 
1327
                if client.name == args:
 
1328
                    logger.warning(u"Client %s is disabled", args)
 
1329
                    if self.use_dbus:
 
1330
                        # Emit D-Bus signal
 
1331
                        client.Rejected()
 
1332
                    break
 
1333
            else:
 
1334
                logger.error(u"Unknown client %s is disabled", args)
 
1335
        elif cmd == u"SENDING":
 
1336
            for client in self.clients:
 
1337
                if client.name == args:
 
1338
                    logger.info(u"Sending secret to %s", client.name)
 
1339
                    client.checked_ok()
 
1340
                    if self.use_dbus:
 
1341
                        # Emit D-Bus signal
 
1342
                        client.GotSecret()
 
1343
                    break
 
1344
            else:
 
1345
                logger.error(u"Sending secret to unknown client %s",
 
1346
                             args)
 
1347
        elif cmd == u"GETATTR":
 
1348
            attr_name, fpr = args.split(None, 1)
 
1349
            for client in self.clients:
 
1350
                if client.fingerprint == fpr:
 
1351
                    attr_value = getattr(client, attr_name, None)
 
1352
                    logger.debug("IPC reply: %r", attr_value)
 
1353
                    pickle.dump(attr_value, reply)
 
1354
                    break
 
1355
            else:
 
1356
                logger.error(u"Client %s on address %s requesting "
 
1357
                             u"attribute %s not found", fpr, address,
 
1358
                             attr_name)
 
1359
                pickle.dump(None, reply)
 
1360
        else:
 
1361
            logger.error(u"Unknown IPC command: %r", cmdline)
 
1362
        
 
1363
        # Keep calling this function
1911
1364
        return True
1912
1365
 
1913
1366
 
1914
1367
def string_to_delta(interval):
1915
1368
    """Parse a string and return a datetime.timedelta
1916
1369
    
1917
 
    >>> string_to_delta('7d')
 
1370
    >>> string_to_delta(u'7d')
1918
1371
    datetime.timedelta(7)
1919
 
    >>> string_to_delta('60s')
 
1372
    >>> string_to_delta(u'60s')
1920
1373
    datetime.timedelta(0, 60)
1921
 
    >>> string_to_delta('60m')
 
1374
    >>> string_to_delta(u'60m')
1922
1375
    datetime.timedelta(0, 3600)
1923
 
    >>> string_to_delta('24h')
 
1376
    >>> string_to_delta(u'24h')
1924
1377
    datetime.timedelta(1)
1925
 
    >>> string_to_delta('1w')
 
1378
    >>> string_to_delta(u'1w')
1926
1379
    datetime.timedelta(7)
1927
 
    >>> string_to_delta('5m 30s')
 
1380
    >>> string_to_delta(u'5m 30s')
1928
1381
    datetime.timedelta(0, 330)
1929
1382
    """
1930
1383
    timevalue = datetime.timedelta(0)
1932
1385
        try:
1933
1386
            suffix = unicode(s[-1])
1934
1387
            value = int(s[:-1])
1935
 
            if suffix == "d":
 
1388
            if suffix == u"d":
1936
1389
                delta = datetime.timedelta(value)
1937
 
            elif suffix == "s":
 
1390
            elif suffix == u"s":
1938
1391
                delta = datetime.timedelta(0, value)
1939
 
            elif suffix == "m":
 
1392
            elif suffix == u"m":
1940
1393
                delta = datetime.timedelta(0, 0, 0, 0, value)
1941
 
            elif suffix == "h":
 
1394
            elif suffix == u"h":
1942
1395
                delta = datetime.timedelta(0, 0, 0, 0, 0, value)
1943
 
            elif suffix == "w":
 
1396
            elif suffix == u"w":
1944
1397
                delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
1945
1398
            else:
1946
 
                raise ValueError("Unknown suffix %r" % suffix)
1947
 
        except (ValueError, IndexError) as e:
1948
 
            raise ValueError(*(e.args))
 
1399
                raise ValueError(u"Unknown suffix %r" % suffix)
 
1400
        except (ValueError, IndexError), e:
 
1401
            raise ValueError(e.message)
1949
1402
        timevalue += delta
1950
1403
    return timevalue
1951
1404
 
1952
1405
 
 
1406
def if_nametoindex(interface):
 
1407
    """Call the C function if_nametoindex(), or equivalent
 
1408
    
 
1409
    Note: This function cannot accept a unicode string."""
 
1410
    global if_nametoindex
 
1411
    try:
 
1412
        if_nametoindex = (ctypes.cdll.LoadLibrary
 
1413
                          (ctypes.util.find_library(u"c"))
 
1414
                          .if_nametoindex)
 
1415
    except (OSError, AttributeError):
 
1416
        logger.warning(u"Doing if_nametoindex the hard way")
 
1417
        def if_nametoindex(interface):
 
1418
            "Get an interface index the hard way, i.e. using fcntl()"
 
1419
            SIOCGIFINDEX = 0x8933  # From /usr/include/linux/sockios.h
 
1420
            with contextlib.closing(socket.socket()) as s:
 
1421
                ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
 
1422
                                    struct.pack(str(u"16s16x"),
 
1423
                                                interface))
 
1424
            interface_index = struct.unpack(str(u"I"),
 
1425
                                            ifreq[16:20])[0]
 
1426
            return interface_index
 
1427
    return if_nametoindex(interface)
 
1428
 
 
1429
 
1953
1430
def daemon(nochdir = False, noclose = False):
1954
1431
    """See daemon(3).  Standard BSD Unix function.
1955
1432
    
1958
1435
        sys.exit()
1959
1436
    os.setsid()
1960
1437
    if not nochdir:
1961
 
        os.chdir("/")
 
1438
        os.chdir(u"/")
1962
1439
    if os.fork():
1963
1440
        sys.exit()
1964
1441
    if not noclose:
1966
1443
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1967
1444
        if not stat.S_ISCHR(os.fstat(null).st_mode):
1968
1445
            raise OSError(errno.ENODEV,
1969
 
                          "%s not a character device"
 
1446
                          u"%s not a character device"
1970
1447
                          % os.path.devnull)
1971
1448
        os.dup2(null, sys.stdin.fileno())
1972
1449
        os.dup2(null, sys.stdout.fileno())
1980
1457
    ##################################################################
1981
1458
    # Parsing of options, both command line and config file
1982
1459
    
1983
 
    parser = argparse.ArgumentParser()
1984
 
    parser.add_argument("-v", "--version", action="version",
1985
 
                        version = "%%(prog)s %s" % version,
1986
 
                        help="show version number and exit")
1987
 
    parser.add_argument("-i", "--interface", metavar="IF",
1988
 
                        help="Bind to interface IF")
1989
 
    parser.add_argument("-a", "--address",
1990
 
                        help="Address to listen for requests on")
1991
 
    parser.add_argument("-p", "--port", type=int,
1992
 
                        help="Port number to receive requests on")
1993
 
    parser.add_argument("--check", action="store_true",
1994
 
                        help="Run self-test")
1995
 
    parser.add_argument("--debug", action="store_true",
1996
 
                        help="Debug mode; run in foreground and log"
1997
 
                        " to terminal")
1998
 
    parser.add_argument("--debuglevel", metavar="LEVEL",
1999
 
                        help="Debug level for stdout output")
2000
 
    parser.add_argument("--priority", help="GnuTLS"
2001
 
                        " priority string (see GnuTLS documentation)")
2002
 
    parser.add_argument("--servicename",
2003
 
                        metavar="NAME", help="Zeroconf service name")
2004
 
    parser.add_argument("--configdir",
2005
 
                        default="/etc/mandos", metavar="DIR",
2006
 
                        help="Directory to search for configuration"
2007
 
                        " files")
2008
 
    parser.add_argument("--no-dbus", action="store_false",
2009
 
                        dest="use_dbus", help="Do not provide D-Bus"
2010
 
                        " system bus interface")
2011
 
    parser.add_argument("--no-ipv6", action="store_false",
2012
 
                        dest="use_ipv6", help="Do not use IPv6")
2013
 
    parser.add_argument("--no-restore", action="store_false",
2014
 
                        dest="restore", help="Do not restore stored"
2015
 
                        " state")
2016
 
    parser.add_argument("--statedir", metavar="DIR",
2017
 
                        help="Directory to save/restore state in")
2018
 
    
2019
 
    options = parser.parse_args()
 
1460
    parser = optparse.OptionParser(version = "%%prog %s" % version)
 
1461
    parser.add_option("-i", u"--interface", type=u"string",
 
1462
                      metavar="IF", help=u"Bind to interface IF")
 
1463
    parser.add_option("-a", u"--address", type=u"string",
 
1464
                      help=u"Address to listen for requests on")
 
1465
    parser.add_option("-p", u"--port", type=u"int",
 
1466
                      help=u"Port number to receive requests on")
 
1467
    parser.add_option("--check", action=u"store_true",
 
1468
                      help=u"Run self-test")
 
1469
    parser.add_option("--debug", action=u"store_true",
 
1470
                      help=u"Debug mode; run in foreground and log to"
 
1471
                      u" terminal")
 
1472
    parser.add_option("--priority", type=u"string", help=u"GnuTLS"
 
1473
                      u" priority string (see GnuTLS documentation)")
 
1474
    parser.add_option("--servicename", type=u"string",
 
1475
                      metavar=u"NAME", help=u"Zeroconf service name")
 
1476
    parser.add_option("--configdir", type=u"string",
 
1477
                      default=u"/etc/mandos", metavar=u"DIR",
 
1478
                      help=u"Directory to search for configuration"
 
1479
                      u" files")
 
1480
    parser.add_option("--no-dbus", action=u"store_false",
 
1481
                      dest=u"use_dbus", help=u"Do not provide D-Bus"
 
1482
                      u" system bus interface")
 
1483
    parser.add_option("--no-ipv6", action=u"store_false",
 
1484
                      dest=u"use_ipv6", help=u"Do not use IPv6")
 
1485
    options = parser.parse_args()[0]
2020
1486
    
2021
1487
    if options.check:
2022
1488
        import doctest
2024
1490
        sys.exit()
2025
1491
    
2026
1492
    # Default values for config file for server-global settings
2027
 
    server_defaults = { "interface": "",
2028
 
                        "address": "",
2029
 
                        "port": "",
2030
 
                        "debug": "False",
2031
 
                        "priority":
2032
 
                        "SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
2033
 
                        "servicename": "Mandos",
2034
 
                        "use_dbus": "True",
2035
 
                        "use_ipv6": "True",
2036
 
                        "debuglevel": "",
2037
 
                        "restore": "True",
2038
 
                        "statedir": "/var/lib/mandos"
 
1493
    server_defaults = { u"interface": u"",
 
1494
                        u"address": u"",
 
1495
                        u"port": u"",
 
1496
                        u"debug": u"False",
 
1497
                        u"priority":
 
1498
                        u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
 
1499
                        u"servicename": u"Mandos",
 
1500
                        u"use_dbus": u"True",
 
1501
                        u"use_ipv6": u"True",
2039
1502
                        }
2040
1503
    
2041
1504
    # Parse config file for server-global settings
2042
1505
    server_config = configparser.SafeConfigParser(server_defaults)
2043
1506
    del server_defaults
2044
1507
    server_config.read(os.path.join(options.configdir,
2045
 
                                    "mandos.conf"))
 
1508
                                    u"mandos.conf"))
2046
1509
    # Convert the SafeConfigParser object to a dict
2047
1510
    server_settings = server_config.defaults()
2048
1511
    # Use the appropriate methods on the non-string config options
2049
 
    for option in ("debug", "use_dbus", "use_ipv6"):
2050
 
        server_settings[option] = server_config.getboolean("DEFAULT",
 
1512
    for option in (u"debug", u"use_dbus", u"use_ipv6"):
 
1513
        server_settings[option] = server_config.getboolean(u"DEFAULT",
2051
1514
                                                           option)
2052
1515
    if server_settings["port"]:
2053
 
        server_settings["port"] = server_config.getint("DEFAULT",
2054
 
                                                       "port")
 
1516
        server_settings["port"] = server_config.getint(u"DEFAULT",
 
1517
                                                       u"port")
2055
1518
    del server_config
2056
1519
    
2057
1520
    # Override the settings from the config file with command line
2058
1521
    # options, if set.
2059
 
    for option in ("interface", "address", "port", "debug",
2060
 
                   "priority", "servicename", "configdir",
2061
 
                   "use_dbus", "use_ipv6", "debuglevel", "restore",
2062
 
                   "statedir"):
 
1522
    for option in (u"interface", u"address", u"port", u"debug",
 
1523
                   u"priority", u"servicename", u"configdir",
 
1524
                   u"use_dbus", u"use_ipv6"):
2063
1525
        value = getattr(options, option)
2064
1526
        if value is not None:
2065
1527
            server_settings[option] = value
2073
1535
    ##################################################################
2074
1536
    
2075
1537
    # For convenience
2076
 
    debug = server_settings["debug"]
2077
 
    debuglevel = server_settings["debuglevel"]
2078
 
    use_dbus = server_settings["use_dbus"]
2079
 
    use_ipv6 = server_settings["use_ipv6"]
2080
 
    stored_state_path = os.path.join(server_settings["statedir"],
2081
 
                                     stored_state_file)
2082
 
    
2083
 
    if debug:
2084
 
        initlogger(debug, logging.DEBUG)
2085
 
    else:
2086
 
        if not debuglevel:
2087
 
            initlogger(debug)
2088
 
        else:
2089
 
            level = getattr(logging, debuglevel.upper())
2090
 
            initlogger(debug, level)
2091
 
    
2092
 
    if server_settings["servicename"] != "Mandos":
 
1538
    debug = server_settings[u"debug"]
 
1539
    use_dbus = server_settings[u"use_dbus"]
 
1540
    use_ipv6 = server_settings[u"use_ipv6"]
 
1541
    
 
1542
    if not debug:
 
1543
        syslogger.setLevel(logging.WARNING)
 
1544
        console.setLevel(logging.WARNING)
 
1545
    
 
1546
    if server_settings[u"servicename"] != u"Mandos":
2093
1547
        syslogger.setFormatter(logging.Formatter
2094
 
                               ('Mandos (%s) [%%(process)d]:'
2095
 
                                ' %%(levelname)s: %%(message)s'
2096
 
                                % server_settings["servicename"]))
 
1548
                               (u'Mandos (%s) [%%(process)d]:'
 
1549
                                u' %%(levelname)s: %%(message)s'
 
1550
                                % server_settings[u"servicename"]))
2097
1551
    
2098
1552
    # Parse config file with clients
2099
 
    client_config = configparser.SafeConfigParser(Client
2100
 
                                                  .client_defaults)
2101
 
    client_config.read(os.path.join(server_settings["configdir"],
2102
 
                                    "clients.conf"))
 
1553
    client_defaults = { u"timeout": u"1h",
 
1554
                        u"interval": u"5m",
 
1555
                        u"checker": u"fping -q -- %%(host)s",
 
1556
                        u"host": u"",
 
1557
                        }
 
1558
    client_config = configparser.SafeConfigParser(client_defaults)
 
1559
    client_config.read(os.path.join(server_settings[u"configdir"],
 
1560
                                    u"clients.conf"))
2103
1561
    
2104
1562
    global mandos_dbus_service
2105
1563
    mandos_dbus_service = None
2106
1564
    
2107
 
    tcp_server = MandosServer((server_settings["address"],
2108
 
                               server_settings["port"]),
 
1565
    tcp_server = MandosServer((server_settings[u"address"],
 
1566
                               server_settings[u"port"]),
2109
1567
                              ClientHandler,
2110
 
                              interface=(server_settings["interface"]
 
1568
                              interface=(server_settings[u"interface"]
2111
1569
                                         or None),
2112
1570
                              use_ipv6=use_ipv6,
2113
1571
                              gnutls_priority=
2114
 
                              server_settings["priority"],
 
1572
                              server_settings[u"priority"],
2115
1573
                              use_dbus=use_dbus)
2116
 
    if not debug:
2117
 
        pidfilename = "/var/run/mandos.pid"
2118
 
        try:
2119
 
            pidfile = open(pidfilename, "w")
2120
 
        except IOError:
2121
 
            logger.error("Could not open file %r", pidfilename)
 
1574
    pidfilename = u"/var/run/mandos.pid"
 
1575
    try:
 
1576
        pidfile = open(pidfilename, u"w")
 
1577
    except IOError:
 
1578
        logger.error(u"Could not open file %r", pidfilename)
2122
1579
    
2123
1580
    try:
2124
 
        uid = pwd.getpwnam("_mandos").pw_uid
2125
 
        gid = pwd.getpwnam("_mandos").pw_gid
 
1581
        uid = pwd.getpwnam(u"_mandos").pw_uid
 
1582
        gid = pwd.getpwnam(u"_mandos").pw_gid
2126
1583
    except KeyError:
2127
1584
        try:
2128
 
            uid = pwd.getpwnam("mandos").pw_uid
2129
 
            gid = pwd.getpwnam("mandos").pw_gid
 
1585
            uid = pwd.getpwnam(u"mandos").pw_uid
 
1586
            gid = pwd.getpwnam(u"mandos").pw_gid
2130
1587
        except KeyError:
2131
1588
            try:
2132
 
                uid = pwd.getpwnam("nobody").pw_uid
2133
 
                gid = pwd.getpwnam("nobody").pw_gid
 
1589
                uid = pwd.getpwnam(u"nobody").pw_uid
 
1590
                gid = pwd.getpwnam(u"nobody").pw_gid
2134
1591
            except KeyError:
2135
1592
                uid = 65534
2136
1593
                gid = 65534
2137
1594
    try:
2138
1595
        os.setgid(gid)
2139
1596
        os.setuid(uid)
2140
 
    except OSError as error:
 
1597
    except OSError, error:
2141
1598
        if error[0] != errno.EPERM:
2142
1599
            raise error
2143
1600
    
 
1601
    # Enable all possible GnuTLS debugging
2144
1602
    if debug:
2145
 
        # Enable all possible GnuTLS debugging
2146
 
        
2147
1603
        # "Use a log level over 10 to enable all debugging options."
2148
1604
        # - GnuTLS manual
2149
1605
        gnutls.library.functions.gnutls_global_set_log_level(11)
2150
1606
        
2151
1607
        @gnutls.library.types.gnutls_log_func
2152
1608
        def debug_gnutls(level, string):
2153
 
            logger.debug("GnuTLS: %s", string[:-1])
 
1609
            logger.debug(u"GnuTLS: %s", string[:-1])
2154
1610
        
2155
1611
        (gnutls.library.functions
2156
1612
         .gnutls_global_set_log_function(debug_gnutls))
2157
 
        
2158
 
        # Redirect stdin so all checkers get /dev/null
2159
 
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
2160
 
        os.dup2(null, sys.stdin.fileno())
2161
 
        if null > 2:
2162
 
            os.close(null)
2163
 
    
2164
 
    # Need to fork before connecting to D-Bus
2165
 
    if not debug:
2166
 
        # Close all input and output, do double fork, etc.
2167
 
        daemon()
2168
 
    
2169
 
    gobject.threads_init()
2170
1613
    
2171
1614
    global main_loop
2172
1615
    # From the Avahi example code
2176
1619
    # End of Avahi example code
2177
1620
    if use_dbus:
2178
1621
        try:
2179
 
            bus_name = dbus.service.BusName("se.recompile.Mandos",
 
1622
            bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos",
2180
1623
                                            bus, do_not_queue=True)
2181
 
            old_bus_name = (dbus.service.BusName
2182
 
                            ("se.bsnet.fukt.Mandos", bus,
2183
 
                             do_not_queue=True))
2184
 
        except dbus.exceptions.NameExistsException as e:
2185
 
            logger.error(unicode(e) + ", disabling D-Bus")
 
1624
        except dbus.exceptions.NameExistsException, e:
 
1625
            logger.error(unicode(e) + u", disabling D-Bus")
2186
1626
            use_dbus = False
2187
 
            server_settings["use_dbus"] = False
 
1627
            server_settings[u"use_dbus"] = False
2188
1628
            tcp_server.use_dbus = False
2189
1629
    protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2190
 
    service = AvahiServiceToSyslog(name =
2191
 
                                   server_settings["servicename"],
2192
 
                                   servicetype = "_mandos._tcp",
2193
 
                                   protocol = protocol, bus = bus)
 
1630
    service = AvahiService(name = server_settings[u"servicename"],
 
1631
                           servicetype = u"_mandos._tcp",
 
1632
                           protocol = protocol, bus = bus)
2194
1633
    if server_settings["interface"]:
2195
1634
        service.interface = (if_nametoindex
2196
 
                             (str(server_settings["interface"])))
2197
 
    
2198
 
    global multiprocessing_manager
2199
 
    multiprocessing_manager = multiprocessing.Manager()
 
1635
                             (str(server_settings[u"interface"])))
2200
1636
    
2201
1637
    client_class = Client
2202
1638
    if use_dbus:
2203
 
        client_class = functools.partial(ClientDBusTransitional,
2204
 
                                         bus = bus)
2205
 
    
2206
 
    client_settings = Client.config_parser(client_config)
2207
 
    old_client_settings = {}
2208
 
    clients_data = {}
2209
 
    
2210
 
    # Get client data and settings from last running state.
2211
 
    if server_settings["restore"]:
2212
 
        try:
2213
 
            with open(stored_state_path, "rb") as stored_state:
2214
 
                clients_data, old_client_settings = (pickle.load
2215
 
                                                     (stored_state))
2216
 
            os.remove(stored_state_path)
2217
 
        except IOError as e:
2218
 
            logger.warning("Could not load persistent state: {0}"
2219
 
                           .format(e))
2220
 
            if e.errno != errno.ENOENT:
2221
 
                raise
2222
 
        except EOFError as e:
2223
 
            logger.warning("Could not load persistent state: "
2224
 
                           "EOFError: {0}".format(e))
2225
 
    
2226
 
    with PGPEngine() as pgp:
2227
 
        for client_name, client in clients_data.iteritems():
2228
 
            # Decide which value to use after restoring saved state.
2229
 
            # We have three different values: Old config file,
2230
 
            # new config file, and saved state.
2231
 
            # New config value takes precedence if it differs from old
2232
 
            # config value, otherwise use saved state.
2233
 
            for name, value in client_settings[client_name].items():
2234
 
                try:
2235
 
                    # For each value in new config, check if it
2236
 
                    # differs from the old config value (Except for
2237
 
                    # the "secret" attribute)
2238
 
                    if (name != "secret" and
2239
 
                        value != old_client_settings[client_name]
2240
 
                        [name]):
2241
 
                        client[name] = value
2242
 
                except KeyError:
2243
 
                    pass
2244
 
            
2245
 
            # Clients who has passed its expire date can still be
2246
 
            # enabled if its last checker was successful.  Clients
2247
 
            # whose checker succeeded before we stored its state is
2248
 
            # assumed to have successfully run all checkers during
2249
 
            # downtime.
2250
 
            if client["enabled"]:
2251
 
                if datetime.datetime.utcnow() >= client["expires"]:
2252
 
                    if not client["last_checked_ok"]:
2253
 
                        logger.warning(
2254
 
                            "disabling client {0} - Client never "
2255
 
                            "performed a successful checker"
2256
 
                            .format(client_name))
2257
 
                        client["enabled"] = False
2258
 
                    elif client["last_checker_status"] != 0:
2259
 
                        logger.warning(
2260
 
                            "disabling client {0} - Client "
2261
 
                            "last checker failed with error code {1}"
2262
 
                            .format(client_name,
2263
 
                                    client["last_checker_status"]))
2264
 
                        client["enabled"] = False
2265
 
                    else:
2266
 
                        client["expires"] = (datetime.datetime
2267
 
                                             .utcnow()
2268
 
                                             + client["timeout"])
2269
 
                        logger.debug("Last checker succeeded,"
2270
 
                                     " keeping {0} enabled"
2271
 
                                     .format(client_name))
2272
 
            try:
2273
 
                client["secret"] = (
2274
 
                    pgp.decrypt(client["encrypted_secret"],
2275
 
                                client_settings[client_name]
2276
 
                                ["secret"]))
2277
 
            except PGPError:
2278
 
                # If decryption fails, we use secret from new settings
2279
 
                logger.debug("Failed to decrypt {0} old secret"
2280
 
                             .format(client_name))
2281
 
                client["secret"] = (
2282
 
                    client_settings[client_name]["secret"])
2283
 
 
2284
 
    
2285
 
    # Add/remove clients based on new changes made to config
2286
 
    for client_name in (set(old_client_settings)
2287
 
                        - set(client_settings)):
2288
 
        del clients_data[client_name]
2289
 
    for client_name in (set(client_settings)
2290
 
                        - set(old_client_settings)):
2291
 
        clients_data[client_name] = client_settings[client_name]
2292
 
 
2293
 
    # Create all client objects
2294
 
    for client_name, client in clients_data.iteritems():
2295
 
        tcp_server.clients[client_name] = client_class(
2296
 
            name = client_name, settings = client)
2297
 
    
 
1639
        client_class = functools.partial(ClientDBus, bus = bus)
 
1640
    tcp_server.clients.update(set(
 
1641
            client_class(name = section,
 
1642
                         config= dict(client_config.items(section)))
 
1643
            for section in client_config.sections()))
2298
1644
    if not tcp_server.clients:
2299
 
        logger.warning("No clients defined")
2300
 
        
 
1645
        logger.warning(u"No clients defined")
 
1646
    
 
1647
    if debug:
 
1648
        # Redirect stdin so all checkers get /dev/null
 
1649
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
 
1650
        os.dup2(null, sys.stdin.fileno())
 
1651
        if null > 2:
 
1652
            os.close(null)
 
1653
    else:
 
1654
        # No console logging
 
1655
        logger.removeHandler(console)
 
1656
        # Close all input and output, do double fork, etc.
 
1657
        daemon()
 
1658
    
 
1659
    try:
 
1660
        with pidfile:
 
1661
            pid = os.getpid()
 
1662
            pidfile.write(str(pid) + "\n")
 
1663
        del pidfile
 
1664
    except IOError:
 
1665
        logger.error(u"Could not write to file %r with PID %d",
 
1666
                     pidfilename, pid)
 
1667
    except NameError:
 
1668
        # "pidfile" was never created
 
1669
        pass
 
1670
    del pidfilename
 
1671
    
2301
1672
    if not debug:
2302
 
        try:
2303
 
            with pidfile:
2304
 
                pid = os.getpid()
2305
 
                pidfile.write(str(pid) + "\n".encode("utf-8"))
2306
 
            del pidfile
2307
 
        except IOError:
2308
 
            logger.error("Could not write to file %r with PID %d",
2309
 
                         pidfilename, pid)
2310
 
        except NameError:
2311
 
            # "pidfile" was never created
2312
 
            pass
2313
 
        del pidfilename
2314
1673
        signal.signal(signal.SIGINT, signal.SIG_IGN)
2315
 
    
2316
1674
    signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2317
1675
    signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
2318
1676
    
2320
1678
        class MandosDBusService(dbus.service.Object):
2321
1679
            """A D-Bus proxy object"""
2322
1680
            def __init__(self):
2323
 
                dbus.service.Object.__init__(self, bus, "/")
2324
 
            _interface = "se.recompile.Mandos"
 
1681
                dbus.service.Object.__init__(self, bus, u"/")
 
1682
            _interface = u"se.bsnet.fukt.Mandos"
2325
1683
            
2326
 
            @dbus.service.signal(_interface, signature="o")
 
1684
            @dbus.service.signal(_interface, signature=u"o")
2327
1685
            def ClientAdded(self, objpath):
2328
1686
                "D-Bus signal"
2329
1687
                pass
2330
1688
            
2331
 
            @dbus.service.signal(_interface, signature="ss")
 
1689
            @dbus.service.signal(_interface, signature=u"ss")
2332
1690
            def ClientNotFound(self, fingerprint, address):
2333
1691
                "D-Bus signal"
2334
1692
                pass
2335
1693
            
2336
 
            @dbus.service.signal(_interface, signature="os")
 
1694
            @dbus.service.signal(_interface, signature=u"os")
2337
1695
            def ClientRemoved(self, objpath, name):
2338
1696
                "D-Bus signal"
2339
1697
                pass
2340
1698
            
2341
 
            @dbus.service.method(_interface, out_signature="ao")
 
1699
            @dbus.service.method(_interface, out_signature=u"ao")
2342
1700
            def GetAllClients(self):
2343
1701
                "D-Bus method"
2344
1702
                return dbus.Array(c.dbus_object_path
2345
 
                                  for c in
2346
 
                                  tcp_server.clients.itervalues())
 
1703
                                  for c in tcp_server.clients)
2347
1704
            
2348
1705
            @dbus.service.method(_interface,
2349
 
                                 out_signature="a{oa{sv}}")
 
1706
                                 out_signature=u"a{oa{sv}}")
2350
1707
            def GetAllClientsWithProperties(self):
2351
1708
                "D-Bus method"
2352
1709
                return dbus.Dictionary(
2353
 
                    ((c.dbus_object_path, c.GetAll(""))
2354
 
                     for c in tcp_server.clients.itervalues()),
2355
 
                    signature="oa{sv}")
 
1710
                    ((c.dbus_object_path, c.GetAll(u""))
 
1711
                     for c in tcp_server.clients),
 
1712
                    signature=u"oa{sv}")
2356
1713
            
2357
 
            @dbus.service.method(_interface, in_signature="o")
 
1714
            @dbus.service.method(_interface, in_signature=u"o")
2358
1715
            def RemoveClient(self, object_path):
2359
1716
                "D-Bus method"
2360
 
                for c in tcp_server.clients.itervalues():
 
1717
                for c in tcp_server.clients:
2361
1718
                    if c.dbus_object_path == object_path:
2362
 
                        del tcp_server.clients[c.name]
 
1719
                        tcp_server.clients.remove(c)
2363
1720
                        c.remove_from_connection()
2364
1721
                        # Don't signal anything except ClientRemoved
2365
1722
                        c.disable(quiet=True)
2370
1727
            
2371
1728
            del _interface
2372
1729
        
2373
 
        class MandosDBusServiceTransitional(MandosDBusService):
2374
 
            __metaclass__ = AlternateDBusNamesMetaclass
2375
 
        mandos_dbus_service = MandosDBusServiceTransitional()
 
1730
        mandos_dbus_service = MandosDBusService()
2376
1731
    
2377
1732
    def cleanup():
2378
1733
        "Cleanup function; run on exit"
2379
1734
        service.cleanup()
2380
1735
        
2381
 
        multiprocessing.active_children()
2382
 
        if not (tcp_server.clients or client_settings):
2383
 
            return
2384
 
        
2385
 
        # Store client before exiting. Secrets are encrypted with key
2386
 
        # based on what config file has. If config file is
2387
 
        # removed/edited, old secret will thus be unrecovable.
2388
 
        clients = {}
2389
 
        with PGPEngine() as pgp:
2390
 
            for client in tcp_server.clients.itervalues():
2391
 
                key = client_settings[client.name]["secret"]
2392
 
                client.encrypted_secret = pgp.encrypt(client.secret,
2393
 
                                                      key)
2394
 
                client_dict = {}
2395
 
                
2396
 
                # A list of attributes that can not be pickled
2397
 
                # + secret.
2398
 
                exclude = set(("bus", "changedstate", "secret",
2399
 
                               "checker"))
2400
 
                for name, typ in (inspect.getmembers
2401
 
                                  (dbus.service.Object)):
2402
 
                    exclude.add(name)
2403
 
                
2404
 
                client_dict["encrypted_secret"] = (client
2405
 
                                                   .encrypted_secret)
2406
 
                for attr in client.client_structure:
2407
 
                    if attr not in exclude:
2408
 
                        client_dict[attr] = getattr(client, attr)
2409
 
                
2410
 
                clients[client.name] = client_dict
2411
 
                del client_settings[client.name]["secret"]
2412
 
        
2413
 
        try:
2414
 
            tempfd, tempname = tempfile.mkstemp(suffix=".pickle",
2415
 
                                                prefix="clients-",
2416
 
                                                dir=os.path.dirname
2417
 
                                                (stored_state_path))
2418
 
            with os.fdopen(tempfd, "wb") as stored_state:
2419
 
                pickle.dump((clients, client_settings), stored_state)
2420
 
            os.rename(tempname, stored_state_path)
2421
 
        except (IOError, OSError) as e:
2422
 
            logger.warning("Could not save persistent state: {0}"
2423
 
                           .format(e))
2424
 
            if not debug:
2425
 
                try:
2426
 
                    os.remove(tempname)
2427
 
                except NameError:
2428
 
                    pass
2429
 
            if e.errno not in set((errno.ENOENT, errno.EACCES,
2430
 
                                   errno.EEXIST)):
2431
 
                raise e
2432
 
        
2433
 
        # Delete all clients, and settings from config
2434
1736
        while tcp_server.clients:
2435
 
            name, client = tcp_server.clients.popitem()
 
1737
            client = tcp_server.clients.pop()
2436
1738
            if use_dbus:
2437
1739
                client.remove_from_connection()
 
1740
            client.disable_hook = None
2438
1741
            # Don't signal anything except ClientRemoved
2439
1742
            client.disable(quiet=True)
2440
1743
            if use_dbus:
2441
1744
                # Emit D-Bus signal
2442
 
                mandos_dbus_service.ClientRemoved(client
2443
 
                                                  .dbus_object_path,
 
1745
                mandos_dbus_service.ClientRemoved(client.dbus_object_path,
2444
1746
                                                  client.name)
2445
 
        client_settings.clear()
2446
1747
    
2447
1748
    atexit.register(cleanup)
2448
1749
    
2449
 
    for client in tcp_server.clients.itervalues():
 
1750
    for client in tcp_server.clients:
2450
1751
        if use_dbus:
2451
1752
            # Emit D-Bus signal
2452
1753
            mandos_dbus_service.ClientAdded(client.dbus_object_path)
2453
 
        # Need to initiate checking of clients
2454
 
        if client.enabled:
2455
 
            client.init_checker()
 
1754
        client.enable()
2456
1755
    
2457
1756
    tcp_server.enable()
2458
1757
    tcp_server.server_activate()
2460
1759
    # Find out what port we got
2461
1760
    service.port = tcp_server.socket.getsockname()[1]
2462
1761
    if use_ipv6:
2463
 
        logger.info("Now listening on address %r, port %d,"
 
1762
        logger.info(u"Now listening on address %r, port %d,"
2464
1763
                    " flowinfo %d, scope_id %d"
2465
1764
                    % tcp_server.socket.getsockname())
2466
1765
    else:                       # IPv4
2467
 
        logger.info("Now listening on address %r, port %d"
 
1766
        logger.info(u"Now listening on address %r, port %d"
2468
1767
                    % tcp_server.socket.getsockname())
2469
1768
    
2470
1769
    #service.interface = tcp_server.socket.getsockname()[3]
2473
1772
        # From the Avahi example code
2474
1773
        try:
2475
1774
            service.activate()
2476
 
        except dbus.exceptions.DBusException as error:
2477
 
            logger.critical("DBusException: %s", error)
 
1775
        except dbus.exceptions.DBusException, error:
 
1776
            logger.critical(u"DBusException: %s", error)
2478
1777
            cleanup()
2479
1778
            sys.exit(1)
2480
1779
        # End of Avahi example code
2484
1783
                             (tcp_server.handle_request
2485
1784
                              (*args[2:], **kwargs) or True))
2486
1785
        
2487
 
        logger.debug("Starting main loop")
 
1786
        logger.debug(u"Starting main loop")
2488
1787
        main_loop.run()
2489
 
    except AvahiError as error:
2490
 
        logger.critical("AvahiError: %s", error)
 
1788
    except AvahiError, error:
 
1789
        logger.critical(u"AvahiError: %s", error)
2491
1790
        cleanup()
2492
1791
        sys.exit(1)
2493
1792
    except KeyboardInterrupt:
2494
1793
        if debug:
2495
 
            print("", file=sys.stderr)
2496
 
        logger.debug("Server received KeyboardInterrupt")
2497
 
    logger.debug("Server exiting")
 
1794
            print >> sys.stderr
 
1795
        logger.debug(u"Server received KeyboardInterrupt")
 
1796
    logger.debug(u"Server exiting")
2498
1797
    # Must run before the D-Bus bus name gets deregistered
2499
1798
    cleanup()
2500
1799