/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos

  • Committer: Teddy Hogeborn
  • Date: 2010-09-12 03:00:40 UTC
  • Revision ID: teddy@fukt.bsnet.se-20100912030040-b0uopyennste9fdh
Documentation changes:

* DBUS-API: New file documenting the server D-Bus interface.

* clients.conf: Add examples of new approval settings.

* debian/mandos.docs: Added "DBUS-API".

* mandos-clients.conf.xml (OPTIONS): Added "approved_by_default",
                                     "approval_delay", and
                                     "approval_duration".
* mandos.xml (D-BUS INTERFACE): Refer to the "DBUS-API" file.
  (BUGS): Remove mention of lack of a remote query interface.

Show diffs side-by-side

added added

removed removed

Lines of Context:
1
 
#!/usr/bin/python2.7
 
1
#!/usr/bin/python
2
2
# -*- mode: python; coding: utf-8 -*-
3
3
4
4
# Mandos server - give out binary blobs to connecting clients.
11
11
# "AvahiService" class, and some lines in "main".
12
12
13
13
# Everything else is
14
 
# Copyright © 2008-2015 Teddy Hogeborn
15
 
# Copyright © 2008-2015 Björn Påhlsson
 
14
# Copyright © 2008,2009 Teddy Hogeborn
 
15
# Copyright © 2008,2009 Björn Påhlsson
16
16
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
28
28
# along with this program.  If not, see
29
29
# <http://www.gnu.org/licenses/>.
30
30
31
 
# Contact the authors at <mandos@recompile.se>.
 
31
# Contact the authors at <mandos@fukt.bsnet.se>.
32
32
33
33
 
34
 
from __future__ import (division, absolute_import, print_function,
35
 
                        unicode_literals)
36
 
 
37
 
from future_builtins import *
38
 
 
39
 
try:
40
 
    import SocketServer as socketserver
41
 
except ImportError:
42
 
    import socketserver
 
34
from __future__ import division, with_statement, absolute_import
 
35
 
 
36
import SocketServer as socketserver
43
37
import socket
44
 
import argparse
 
38
import optparse
45
39
import datetime
46
40
import errno
47
41
import gnutls.crypto
50
44
import gnutls.library.functions
51
45
import gnutls.library.constants
52
46
import gnutls.library.types
53
 
try:
54
 
    import ConfigParser as configparser
55
 
except ImportError:
56
 
    import configparser
 
47
import ConfigParser as configparser
57
48
import sys
58
49
import re
59
50
import os
68
59
import struct
69
60
import fcntl
70
61
import functools
71
 
try:
72
 
    import cPickle as pickle
73
 
except ImportError:
74
 
    import pickle
 
62
import cPickle as pickle
75
63
import multiprocessing
76
 
import types
77
 
import binascii
78
 
import tempfile
79
 
import itertools
80
 
import collections
81
 
import codecs
82
64
 
83
65
import dbus
84
66
import dbus.service
85
 
try:
86
 
    import gobject
87
 
except ImportError:
88
 
    from gi.repository import GObject as gobject
 
67
import gobject
89
68
import avahi
90
69
from dbus.mainloop.glib import DBusGMainLoop
91
70
import ctypes
101
80
    except ImportError:
102
81
        SO_BINDTODEVICE = None
103
82
 
104
 
if sys.version_info.major == 2:
105
 
    str = unicode
106
 
 
107
 
version = "1.6.9"
108
 
stored_state_file = "clients.pickle"
109
 
 
110
 
logger = logging.getLogger()
111
 
syslogger = None
112
 
 
113
 
try:
114
 
    if_nametoindex = ctypes.cdll.LoadLibrary(
115
 
        ctypes.util.find_library("c")).if_nametoindex
116
 
except (OSError, AttributeError):
117
 
    
118
 
    def if_nametoindex(interface):
119
 
        "Get an interface index the hard way, i.e. using fcntl()"
120
 
        SIOCGIFINDEX = 0x8933  # From /usr/include/linux/sockios.h
121
 
        with contextlib.closing(socket.socket()) as s:
122
 
            ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
123
 
                                struct.pack(b"16s16x", interface))
124
 
        interface_index = struct.unpack("I", ifreq[16:20])[0]
125
 
        return interface_index
126
 
 
127
 
 
128
 
def initlogger(debug, level=logging.WARNING):
129
 
    """init logger and add loglevel"""
130
 
    
131
 
    global syslogger
132
 
    syslogger = (logging.handlers.SysLogHandler(
133
 
        facility = logging.handlers.SysLogHandler.LOG_DAEMON,
134
 
        address = "/dev/log"))
135
 
    syslogger.setFormatter(logging.Formatter
136
 
                           ('Mandos [%(process)d]: %(levelname)s:'
137
 
                            ' %(message)s'))
138
 
    logger.addHandler(syslogger)
139
 
    
140
 
    if debug:
141
 
        console = logging.StreamHandler()
142
 
        console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
143
 
                                               ' [%(process)d]:'
144
 
                                               ' %(levelname)s:'
145
 
                                               ' %(message)s'))
146
 
        logger.addHandler(console)
147
 
    logger.setLevel(level)
148
 
 
149
 
 
150
 
class PGPError(Exception):
151
 
    """Exception if encryption/decryption fails"""
152
 
    pass
153
 
 
154
 
 
155
 
class PGPEngine(object):
156
 
    """A simple class for OpenPGP symmetric encryption & decryption"""
157
 
    
158
 
    def __init__(self):
159
 
        self.tempdir = tempfile.mkdtemp(prefix="mandos-")
160
 
        self.gnupgargs = ['--batch',
161
 
                          '--home', self.tempdir,
162
 
                          '--force-mdc',
163
 
                          '--quiet',
164
 
                          '--no-use-agent']
165
 
    
166
 
    def __enter__(self):
167
 
        return self
168
 
    
169
 
    def __exit__(self, exc_type, exc_value, traceback):
170
 
        self._cleanup()
171
 
        return False
172
 
    
173
 
    def __del__(self):
174
 
        self._cleanup()
175
 
    
176
 
    def _cleanup(self):
177
 
        if self.tempdir is not None:
178
 
            # Delete contents of tempdir
179
 
            for root, dirs, files in os.walk(self.tempdir,
180
 
                                             topdown = False):
181
 
                for filename in files:
182
 
                    os.remove(os.path.join(root, filename))
183
 
                for dirname in dirs:
184
 
                    os.rmdir(os.path.join(root, dirname))
185
 
            # Remove tempdir
186
 
            os.rmdir(self.tempdir)
187
 
            self.tempdir = None
188
 
    
189
 
    def password_encode(self, password):
190
 
        # Passphrase can not be empty and can not contain newlines or
191
 
        # NUL bytes.  So we prefix it and hex encode it.
192
 
        encoded = b"mandos" + binascii.hexlify(password)
193
 
        if len(encoded) > 2048:
194
 
            # GnuPG can't handle long passwords, so encode differently
195
 
            encoded = (b"mandos" + password.replace(b"\\", b"\\\\")
196
 
                       .replace(b"\n", b"\\n")
197
 
                       .replace(b"\0", b"\\x00"))
198
 
        return encoded
199
 
    
200
 
    def encrypt(self, data, password):
201
 
        passphrase = self.password_encode(password)
202
 
        with tempfile.NamedTemporaryFile(
203
 
                dir=self.tempdir) as passfile:
204
 
            passfile.write(passphrase)
205
 
            passfile.flush()
206
 
            proc = subprocess.Popen(['gpg', '--symmetric',
207
 
                                     '--passphrase-file',
208
 
                                     passfile.name]
209
 
                                    + self.gnupgargs,
210
 
                                    stdin = subprocess.PIPE,
211
 
                                    stdout = subprocess.PIPE,
212
 
                                    stderr = subprocess.PIPE)
213
 
            ciphertext, err = proc.communicate(input = data)
214
 
        if proc.returncode != 0:
215
 
            raise PGPError(err)
216
 
        return ciphertext
217
 
    
218
 
    def decrypt(self, data, password):
219
 
        passphrase = self.password_encode(password)
220
 
        with tempfile.NamedTemporaryFile(
221
 
                dir = self.tempdir) as passfile:
222
 
            passfile.write(passphrase)
223
 
            passfile.flush()
224
 
            proc = subprocess.Popen(['gpg', '--decrypt',
225
 
                                     '--passphrase-file',
226
 
                                     passfile.name]
227
 
                                    + self.gnupgargs,
228
 
                                    stdin = subprocess.PIPE,
229
 
                                    stdout = subprocess.PIPE,
230
 
                                    stderr = subprocess.PIPE)
231
 
            decrypted_plaintext, err = proc.communicate(input = data)
232
 
        if proc.returncode != 0:
233
 
            raise PGPError(err)
234
 
        return decrypted_plaintext
235
 
 
 
83
 
 
84
version = "1.0.14"
 
85
 
 
86
#logger = logging.getLogger(u'mandos')
 
87
logger = logging.Logger(u'mandos')
 
88
syslogger = (logging.handlers.SysLogHandler
 
89
             (facility = logging.handlers.SysLogHandler.LOG_DAEMON,
 
90
              address = "/dev/log"))
 
91
syslogger.setFormatter(logging.Formatter
 
92
                       (u'Mandos [%(process)d]: %(levelname)s:'
 
93
                        u' %(message)s'))
 
94
logger.addHandler(syslogger)
 
95
 
 
96
console = logging.StreamHandler()
 
97
console.setFormatter(logging.Formatter(u'%(name)s [%(process)d]:'
 
98
                                       u' %(levelname)s:'
 
99
                                       u' %(message)s'))
 
100
logger.addHandler(console)
236
101
 
237
102
class AvahiError(Exception):
238
103
    def __init__(self, value, *args, **kwargs):
239
104
        self.value = value
240
 
        return super(AvahiError, self).__init__(value, *args,
241
 
                                                **kwargs)
242
 
 
 
105
        super(AvahiError, self).__init__(value, *args, **kwargs)
 
106
    def __unicode__(self):
 
107
        return unicode(repr(self.value))
243
108
 
244
109
class AvahiServiceError(AvahiError):
245
110
    pass
246
111
 
247
 
 
248
112
class AvahiGroupError(AvahiError):
249
113
    pass
250
114
 
255
119
    Attributes:
256
120
    interface: integer; avahi.IF_UNSPEC or an interface index.
257
121
               Used to optionally bind to the specified interface.
258
 
    name: string; Example: 'Mandos'
259
 
    type: string; Example: '_mandos._tcp'.
260
 
     See <https://www.iana.org/assignments/service-names-port-numbers>
 
122
    name: string; Example: u'Mandos'
 
123
    type: string; Example: u'_mandos._tcp'.
 
124
                  See <http://www.dns-sd.org/ServiceTypes.html>
261
125
    port: integer; what port to announce
262
126
    TXT: list of strings; TXT record for the service
263
127
    domain: string; Domain to publish on, default to .local if empty.
269
133
    server: D-Bus Server
270
134
    bus: dbus.SystemBus()
271
135
    """
272
 
    
273
 
    def __init__(self,
274
 
                 interface = avahi.IF_UNSPEC,
275
 
                 name = None,
276
 
                 servicetype = None,
277
 
                 port = None,
278
 
                 TXT = None,
279
 
                 domain = "",
280
 
                 host = "",
281
 
                 max_renames = 32768,
282
 
                 protocol = avahi.PROTO_UNSPEC,
283
 
                 bus = None):
 
136
    def __init__(self, interface = avahi.IF_UNSPEC, name = None,
 
137
                 servicetype = None, port = None, TXT = None,
 
138
                 domain = u"", host = u"", max_renames = 32768,
 
139
                 protocol = avahi.PROTO_UNSPEC, bus = None):
284
140
        self.interface = interface
285
141
        self.name = name
286
142
        self.type = servicetype
294
150
        self.group = None       # our entry group
295
151
        self.server = None
296
152
        self.bus = bus
297
 
        self.entry_group_state_changed_match = None
298
 
    
299
 
    def rename(self, remove=True):
 
153
    def rename(self):
300
154
        """Derived from the Avahi example code"""
301
155
        if self.rename_count >= self.max_renames:
302
 
            logger.critical("No suitable Zeroconf service name found"
303
 
                            " after %i retries, exiting.",
 
156
            logger.critical(u"No suitable Zeroconf service name found"
 
157
                            u" after %i retries, exiting.",
304
158
                            self.rename_count)
305
 
            raise AvahiServiceError("Too many renames")
306
 
        self.name = str(
307
 
            self.server.GetAlternativeServiceName(self.name))
 
159
            raise AvahiServiceError(u"Too many renames")
 
160
        self.name = unicode(self.server.GetAlternativeServiceName(self.name))
 
161
        logger.info(u"Changing Zeroconf service name to %r ...",
 
162
                    self.name)
 
163
        syslogger.setFormatter(logging.Formatter
 
164
                               (u'Mandos (%s) [%%(process)d]:'
 
165
                                u' %%(levelname)s: %%(message)s'
 
166
                                % self.name))
 
167
        self.remove()
 
168
        try:
 
169
            self.add()
 
170
        except dbus.exceptions.DBusException, error:
 
171
            logger.critical(u"DBusException: %s", error)
 
172
            self.cleanup()
 
173
            os._exit(1)
308
174
        self.rename_count += 1
309
 
        logger.info("Changing Zeroconf service name to %r ...",
310
 
                    self.name)
311
 
        if remove:
312
 
            self.remove()
313
 
        try:
314
 
            self.add()
315
 
        except dbus.exceptions.DBusException as error:
316
 
            if (error.get_dbus_name()
317
 
                == "org.freedesktop.Avahi.CollisionError"):
318
 
                logger.info("Local Zeroconf service name collision.")
319
 
                return self.rename(remove=False)
320
 
            else:
321
 
                logger.critical("D-Bus Exception", exc_info=error)
322
 
                self.cleanup()
323
 
                os._exit(1)
324
 
    
325
175
    def remove(self):
326
176
        """Derived from the Avahi example code"""
327
 
        if self.entry_group_state_changed_match is not None:
328
 
            self.entry_group_state_changed_match.remove()
329
 
            self.entry_group_state_changed_match = None
330
177
        if self.group is not None:
331
178
            self.group.Reset()
332
 
    
333
179
    def add(self):
334
180
        """Derived from the Avahi example code"""
335
 
        self.remove()
336
181
        if self.group is None:
337
182
            self.group = dbus.Interface(
338
183
                self.bus.get_object(avahi.DBUS_NAME,
339
184
                                    self.server.EntryGroupNew()),
340
185
                avahi.DBUS_INTERFACE_ENTRY_GROUP)
341
 
        self.entry_group_state_changed_match = (
342
 
            self.group.connect_to_signal(
343
 
                'StateChanged', self.entry_group_state_changed))
344
 
        logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
 
186
            self.group.connect_to_signal('StateChanged',
 
187
                                         self
 
188
                                         .entry_group_state_changed)
 
189
        logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
345
190
                     self.name, self.type)
346
191
        self.group.AddService(
347
192
            self.interface,
352
197
            dbus.UInt16(self.port),
353
198
            avahi.string_array_to_txt_array(self.TXT))
354
199
        self.group.Commit()
355
 
    
356
200
    def entry_group_state_changed(self, state, error):
357
201
        """Derived from the Avahi example code"""
358
 
        logger.debug("Avahi entry group state change: %i", state)
 
202
        logger.debug(u"Avahi entry group state change: %i", state)
359
203
        
360
204
        if state == avahi.ENTRY_GROUP_ESTABLISHED:
361
 
            logger.debug("Zeroconf service established.")
 
205
            logger.debug(u"Zeroconf service established.")
362
206
        elif state == avahi.ENTRY_GROUP_COLLISION:
363
 
            logger.info("Zeroconf service name collision.")
 
207
            logger.warning(u"Zeroconf service name collision.")
364
208
            self.rename()
365
209
        elif state == avahi.ENTRY_GROUP_FAILURE:
366
 
            logger.critical("Avahi: Error in group state changed %s",
367
 
                            str(error))
368
 
            raise AvahiGroupError("State changed: {!s}".format(error))
369
 
    
 
210
            logger.critical(u"Avahi: Error in group state changed %s",
 
211
                            unicode(error))
 
212
            raise AvahiGroupError(u"State changed: %s"
 
213
                                  % unicode(error))
370
214
    def cleanup(self):
371
215
        """Derived from the Avahi example code"""
372
216
        if self.group is not None:
373
 
            try:
374
 
                self.group.Free()
375
 
            except (dbus.exceptions.UnknownMethodException,
376
 
                    dbus.exceptions.DBusException):
377
 
                pass
 
217
            self.group.Free()
378
218
            self.group = None
379
 
        self.remove()
380
 
    
381
 
    def server_state_changed(self, state, error=None):
 
219
    def server_state_changed(self, state):
382
220
        """Derived from the Avahi example code"""
383
 
        logger.debug("Avahi server state change: %i", state)
384
 
        bad_states = {
385
 
            avahi.SERVER_INVALID: "Zeroconf server invalid",
386
 
            avahi.SERVER_REGISTERING: None,
387
 
            avahi.SERVER_COLLISION: "Zeroconf server name collision",
388
 
            avahi.SERVER_FAILURE: "Zeroconf server failure",
389
 
        }
390
 
        if state in bad_states:
391
 
            if bad_states[state] is not None:
392
 
                if error is None:
393
 
                    logger.error(bad_states[state])
394
 
                else:
395
 
                    logger.error(bad_states[state] + ": %r", error)
396
 
            self.cleanup()
 
221
        logger.debug(u"Avahi server state change: %i", state)
 
222
        if state == avahi.SERVER_COLLISION:
 
223
            logger.error(u"Zeroconf server name collision")
 
224
            self.remove()
397
225
        elif state == avahi.SERVER_RUNNING:
398
 
            try:
399
 
                self.add()
400
 
            except dbus.exceptions.DBusException as error:
401
 
                if (error.get_dbus_name()
402
 
                    == "org.freedesktop.Avahi.CollisionError"):
403
 
                    logger.info("Local Zeroconf service name"
404
 
                                " collision.")
405
 
                    return self.rename(remove=False)
406
 
                else:
407
 
                    logger.critical("D-Bus Exception", exc_info=error)
408
 
                    self.cleanup()
409
 
                    os._exit(1)
410
 
        else:
411
 
            if error is None:
412
 
                logger.debug("Unknown state: %r", state)
413
 
            else:
414
 
                logger.debug("Unknown state: %r: %r", state, error)
415
 
    
 
226
            self.add()
416
227
    def activate(self):
417
228
        """Derived from the Avahi example code"""
418
229
        if self.server is None:
419
230
            self.server = dbus.Interface(
420
231
                self.bus.get_object(avahi.DBUS_NAME,
421
 
                                    avahi.DBUS_PATH_SERVER,
422
 
                                    follow_name_owner_changes=True),
 
232
                                    avahi.DBUS_PATH_SERVER),
423
233
                avahi.DBUS_INTERFACE_SERVER)
424
 
        self.server.connect_to_signal("StateChanged",
425
 
                                      self.server_state_changed)
 
234
        self.server.connect_to_signal(u"StateChanged",
 
235
                                 self.server_state_changed)
426
236
        self.server_state_changed(self.server.GetState())
427
237
 
428
238
 
429
 
class AvahiServiceToSyslog(AvahiService):
430
 
    def rename(self, *args, **kwargs):
431
 
        """Add the new name to the syslog messages"""
432
 
        ret = AvahiService.rename(self, *args, **kwargs)
433
 
        syslogger.setFormatter(logging.Formatter(
434
 
            'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
435
 
            .format(self.name)))
436
 
        return ret
437
 
 
438
 
def call_pipe(connection,       # : multiprocessing.Connection
439
 
              func, *args, **kwargs):
440
 
    """This function is meant to be called by multiprocessing.Process
441
 
    
442
 
    This function runs func(*args, **kwargs), and writes the resulting
443
 
    return value on the provided multiprocessing.Connection.
444
 
    """
445
 
    connection.send(func(*args, **kwargs))
446
 
    connection.close()
447
 
 
448
239
class Client(object):
449
240
    """A representation of a client host served by this server.
450
241
    
451
242
    Attributes:
452
 
    approved:   bool(); 'None' if not yet approved/disapproved
453
 
    approval_delay: datetime.timedelta(); Time to wait for approval
454
 
    approval_duration: datetime.timedelta(); Duration of one approval
 
243
    name:       string; from the config file, used in log messages and
 
244
                        D-Bus identifiers
 
245
    fingerprint: string (40 or 32 hexadecimal digits); used to
 
246
                 uniquely identify the client
 
247
    secret:     bytestring; sent verbatim (over TLS) to client
 
248
    host:       string; available for use by the checker command
 
249
    created:    datetime.datetime(); (UTC) object creation
 
250
    last_enabled: datetime.datetime(); (UTC)
 
251
    enabled:    bool()
 
252
    last_checked_ok: datetime.datetime(); (UTC) or None
 
253
    timeout:    datetime.timedelta(); How long from last_checked_ok
 
254
                                      until this client is disabled
 
255
    interval:   datetime.timedelta(); How often to start a new checker
 
256
    disable_hook:  If set, called by disable() as disable_hook(self)
455
257
    checker:    subprocess.Popen(); a running checker process used
456
258
                                    to see if the client lives.
457
259
                                    'None' if no process is running.
458
 
    checker_callback_tag: a gobject event source tag, or None
459
 
    checker_command: string; External command which is run to check
460
 
                     if client lives.  %() expansions are done at
 
260
    checker_initiator_tag: a gobject event source tag, or None
 
261
    disable_initiator_tag: - '' -
 
262
    checker_callback_tag:  - '' -
 
263
    checker_command: string; External command which is run to check if
 
264
                     client lives.  %() expansions are done at
461
265
                     runtime with vars(self) as dict, so that for
462
266
                     instance %(name)s can be used in the command.
463
 
    checker_initiator_tag: a gobject event source tag, or None
464
 
    created:    datetime.datetime(); (UTC) object creation
465
 
    client_structure: Object describing what attributes a client has
466
 
                      and is used for storing the client at exit
467
267
    current_checker_command: string; current running checker_command
468
 
    disable_initiator_tag: a gobject event source tag, or None
469
 
    enabled:    bool()
470
 
    fingerprint: string (40 or 32 hexadecimal digits); used to
471
 
                 uniquely identify the client
472
 
    host:       string; available for use by the checker command
473
 
    interval:   datetime.timedelta(); How often to start a new checker
474
 
    last_approval_request: datetime.datetime(); (UTC) or None
475
 
    last_checked_ok: datetime.datetime(); (UTC) or None
476
 
    last_checker_status: integer between 0 and 255 reflecting exit
477
 
                         status of last checker. -1 reflects crashed
478
 
                         checker, -2 means no checker completed yet.
479
 
    last_checker_signal: The signal which killed the last checker, if
480
 
                         last_checker_status is -1
481
 
    last_enabled: datetime.datetime(); (UTC) or None
482
 
    name:       string; from the config file, used in log messages and
483
 
                        D-Bus identifiers
484
 
    secret:     bytestring; sent verbatim (over TLS) to client
485
 
    timeout:    datetime.timedelta(); How long from last_checked_ok
486
 
                                      until this client is disabled
487
 
    extended_timeout:   extra long timeout when secret has been sent
488
 
    runtime_expansions: Allowed attributes for runtime expansion.
489
 
    expires:    datetime.datetime(); time (UTC) when a client will be
490
 
                disabled, or None
491
 
    server_settings: The server_settings dict from main()
 
268
    approval_delay: datetime.timedelta(); Time to wait for approval
 
269
    _approved:   bool(); 'None' if not yet approved/disapproved
 
270
    approval_duration: datetime.timedelta(); Duration of one approval
492
271
    """
493
272
    
494
 
    runtime_expansions = ("approval_delay", "approval_duration",
495
 
                          "created", "enabled", "expires",
496
 
                          "fingerprint", "host", "interval",
497
 
                          "last_approval_request", "last_checked_ok",
498
 
                          "last_enabled", "name", "timeout")
499
 
    client_defaults = {
500
 
        "timeout": "PT5M",
501
 
        "extended_timeout": "PT15M",
502
 
        "interval": "PT2M",
503
 
        "checker": "fping -q -- %%(host)s",
504
 
        "host": "",
505
 
        "approval_delay": "PT0S",
506
 
        "approval_duration": "PT1S",
507
 
        "approved_by_default": "True",
508
 
        "enabled": "True",
509
 
    }
510
 
    
511
273
    @staticmethod
512
 
    def config_parser(config):
513
 
        """Construct a new dict of client settings of this form:
514
 
        { client_name: {setting_name: value, ...}, ...}
515
 
        with exceptions for any special settings as defined above.
516
 
        NOTE: Must be a pure function. Must return the same result
517
 
        value given the same arguments.
518
 
        """
519
 
        settings = {}
520
 
        for client_name in config.sections():
521
 
            section = dict(config.items(client_name))
522
 
            client = settings[client_name] = {}
523
 
            
524
 
            client["host"] = section["host"]
525
 
            # Reformat values from string types to Python types
526
 
            client["approved_by_default"] = config.getboolean(
527
 
                client_name, "approved_by_default")
528
 
            client["enabled"] = config.getboolean(client_name,
529
 
                                                  "enabled")
530
 
            
531
 
            # Uppercase and remove spaces from fingerprint for later
532
 
            # comparison purposes with return value from the
533
 
            # fingerprint() function
534
 
            client["fingerprint"] = (section["fingerprint"].upper()
535
 
                                     .replace(" ", ""))
536
 
            if "secret" in section:
537
 
                client["secret"] = section["secret"].decode("base64")
538
 
            elif "secfile" in section:
539
 
                with open(os.path.expanduser(os.path.expandvars
540
 
                                             (section["secfile"])),
541
 
                          "rb") as secfile:
542
 
                    client["secret"] = secfile.read()
543
 
            else:
544
 
                raise TypeError("No secret or secfile for section {}"
545
 
                                .format(section))
546
 
            client["timeout"] = string_to_delta(section["timeout"])
547
 
            client["extended_timeout"] = string_to_delta(
548
 
                section["extended_timeout"])
549
 
            client["interval"] = string_to_delta(section["interval"])
550
 
            client["approval_delay"] = string_to_delta(
551
 
                section["approval_delay"])
552
 
            client["approval_duration"] = string_to_delta(
553
 
                section["approval_duration"])
554
 
            client["checker_command"] = section["checker"]
555
 
            client["last_approval_request"] = None
556
 
            client["last_checked_ok"] = None
557
 
            client["last_checker_status"] = -2
558
 
        
559
 
        return settings
560
 
    
561
 
    def __init__(self, settings, name = None, server_settings=None):
 
274
    def _timedelta_to_milliseconds(td):
 
275
        "Convert a datetime.timedelta() to milliseconds"
 
276
        return ((td.days * 24 * 60 * 60 * 1000)
 
277
                + (td.seconds * 1000)
 
278
                + (td.microseconds // 1000))
 
279
    
 
280
    def timeout_milliseconds(self):
 
281
        "Return the 'timeout' attribute in milliseconds"
 
282
        return self._timedelta_to_milliseconds(self.timeout)
 
283
    
 
284
    def interval_milliseconds(self):
 
285
        "Return the 'interval' attribute in milliseconds"
 
286
        return self._timedelta_to_milliseconds(self.interval)
 
287
 
 
288
    def approval_delay_milliseconds(self):
 
289
        return self._timedelta_to_milliseconds(self.approval_delay)
 
290
    
 
291
    def __init__(self, name = None, disable_hook=None, config=None):
 
292
        """Note: the 'checker' key in 'config' sets the
 
293
        'checker_command' attribute and *not* the 'checker'
 
294
        attribute."""
562
295
        self.name = name
563
 
        if server_settings is None:
564
 
            server_settings = {}
565
 
        self.server_settings = server_settings
566
 
        # adding all client settings
567
 
        for setting, value in settings.items():
568
 
            setattr(self, setting, value)
569
 
        
570
 
        if self.enabled:
571
 
            if not hasattr(self, "last_enabled"):
572
 
                self.last_enabled = datetime.datetime.utcnow()
573
 
            if not hasattr(self, "expires"):
574
 
                self.expires = (datetime.datetime.utcnow()
575
 
                                + self.timeout)
 
296
        if config is None:
 
297
            config = {}
 
298
        logger.debug(u"Creating client %r", self.name)
 
299
        # Uppercase and remove spaces from fingerprint for later
 
300
        # comparison purposes with return value from the fingerprint()
 
301
        # function
 
302
        self.fingerprint = (config[u"fingerprint"].upper()
 
303
                            .replace(u" ", u""))
 
304
        logger.debug(u"  Fingerprint: %s", self.fingerprint)
 
305
        if u"secret" in config:
 
306
            self.secret = config[u"secret"].decode(u"base64")
 
307
        elif u"secfile" in config:
 
308
            with open(os.path.expanduser(os.path.expandvars
 
309
                                         (config[u"secfile"])),
 
310
                      "rb") as secfile:
 
311
                self.secret = secfile.read()
576
312
        else:
577
 
            self.last_enabled = None
578
 
            self.expires = None
579
 
        
580
 
        logger.debug("Creating client %r", self.name)
581
 
        logger.debug("  Fingerprint: %s", self.fingerprint)
582
 
        self.created = settings.get("created",
583
 
                                    datetime.datetime.utcnow())
584
 
        
585
 
        # attributes specific for this server instance
 
313
            raise TypeError(u"No secret or secfile for client %s"
 
314
                            % self.name)
 
315
        self.host = config.get(u"host", u"")
 
316
        self.created = datetime.datetime.utcnow()
 
317
        self.enabled = False
 
318
        self.last_enabled = None
 
319
        self.last_checked_ok = None
 
320
        self.timeout = string_to_delta(config[u"timeout"])
 
321
        self.interval = string_to_delta(config[u"interval"])
 
322
        self.disable_hook = disable_hook
586
323
        self.checker = None
587
324
        self.checker_initiator_tag = None
588
325
        self.disable_initiator_tag = None
589
326
        self.checker_callback_tag = None
 
327
        self.checker_command = config[u"checker"]
590
328
        self.current_checker_command = None
591
 
        self.approved = None
 
329
        self.last_connect = None
 
330
        self._approved = None
 
331
        self.approved_by_default = config.get(u"approved_by_default",
 
332
                                              True)
592
333
        self.approvals_pending = 0
593
 
        self.changedstate = multiprocessing_manager.Condition(
594
 
            multiprocessing_manager.Lock())
595
 
        self.client_structure = [attr
596
 
                                 for attr in self.__dict__.iterkeys()
597
 
                                 if not attr.startswith("_")]
598
 
        self.client_structure.append("client_structure")
599
 
        
600
 
        for name, t in inspect.getmembers(
601
 
                type(self), lambda obj: isinstance(obj, property)):
602
 
            if not name.startswith("_"):
603
 
                self.client_structure.append(name)
 
334
        self.approval_delay = string_to_delta(
 
335
            config[u"approval_delay"])
 
336
        self.approval_duration = string_to_delta(
 
337
            config[u"approval_duration"])
 
338
        self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())
604
339
    
605
 
    # Send notice to process children that client state has changed
606
340
    def send_changedstate(self):
607
 
        with self.changedstate:
608
 
            self.changedstate.notify_all()
609
 
    
 
341
        self.changedstate.acquire()
 
342
        self.changedstate.notify_all()
 
343
        self.changedstate.release()
 
344
        
610
345
    def enable(self):
611
346
        """Start this client's checker and timeout hooks"""
612
 
        if getattr(self, "enabled", False):
 
347
        if getattr(self, u"enabled", False):
613
348
            # Already enabled
614
349
            return
615
 
        self.expires = datetime.datetime.utcnow() + self.timeout
616
 
        self.enabled = True
 
350
        self.send_changedstate()
617
351
        self.last_enabled = datetime.datetime.utcnow()
618
 
        self.init_checker()
619
 
        self.send_changedstate()
 
352
        # Schedule a new checker to be started an 'interval' from now,
 
353
        # and every interval from then on.
 
354
        self.checker_initiator_tag = (gobject.timeout_add
 
355
                                      (self.interval_milliseconds(),
 
356
                                       self.start_checker))
 
357
        # Schedule a disable() when 'timeout' has passed
 
358
        self.disable_initiator_tag = (gobject.timeout_add
 
359
                                   (self.timeout_milliseconds(),
 
360
                                    self.disable))
 
361
        self.enabled = True
 
362
        # Also start a new checker *right now*.
 
363
        self.start_checker()
620
364
    
621
365
    def disable(self, quiet=True):
622
366
        """Disable this client."""
623
367
        if not getattr(self, "enabled", False):
624
368
            return False
625
369
        if not quiet:
626
 
            logger.info("Disabling client %s", self.name)
627
 
        if getattr(self, "disable_initiator_tag", None) is not None:
 
370
            self.send_changedstate()
 
371
        if not quiet:
 
372
            logger.info(u"Disabling client %s", self.name)
 
373
        if getattr(self, u"disable_initiator_tag", False):
628
374
            gobject.source_remove(self.disable_initiator_tag)
629
375
            self.disable_initiator_tag = None
630
 
        self.expires = None
631
 
        if getattr(self, "checker_initiator_tag", None) is not None:
 
376
        if getattr(self, u"checker_initiator_tag", False):
632
377
            gobject.source_remove(self.checker_initiator_tag)
633
378
            self.checker_initiator_tag = None
634
379
        self.stop_checker()
 
380
        if self.disable_hook:
 
381
            self.disable_hook(self)
635
382
        self.enabled = False
636
 
        if not quiet:
637
 
            self.send_changedstate()
638
383
        # Do not run this again if called by a gobject.timeout_add
639
384
        return False
640
385
    
641
386
    def __del__(self):
 
387
        self.disable_hook = None
642
388
        self.disable()
643
389
    
644
 
    def init_checker(self):
645
 
        # Schedule a new checker to be started an 'interval' from now,
646
 
        # and every interval from then on.
647
 
        if self.checker_initiator_tag is not None:
648
 
            gobject.source_remove(self.checker_initiator_tag)
649
 
        self.checker_initiator_tag = gobject.timeout_add(
650
 
            int(self.interval.total_seconds() * 1000),
651
 
            self.start_checker)
652
 
        # Schedule a disable() when 'timeout' has passed
653
 
        if self.disable_initiator_tag is not None:
654
 
            gobject.source_remove(self.disable_initiator_tag)
655
 
        self.disable_initiator_tag = gobject.timeout_add(
656
 
            int(self.timeout.total_seconds() * 1000), self.disable)
657
 
        # Also start a new checker *right now*.
658
 
        self.start_checker()
659
 
    
660
 
    def checker_callback(self, source, condition, connection,
661
 
                         command):
 
390
    def checker_callback(self, pid, condition, command):
662
391
        """The checker has completed, so take appropriate actions."""
663
392
        self.checker_callback_tag = None
664
393
        self.checker = None
665
 
        # Read return code from connection (see call_pipe)
666
 
        returncode = connection.recv()
667
 
        connection.close()
668
 
        
669
 
        if returncode >= 0:
670
 
            self.last_checker_status = returncode
671
 
            self.last_checker_signal = None
672
 
            if self.last_checker_status == 0:
673
 
                logger.info("Checker for %(name)s succeeded",
 
394
        if os.WIFEXITED(condition):
 
395
            exitstatus = os.WEXITSTATUS(condition)
 
396
            if exitstatus == 0:
 
397
                logger.info(u"Checker for %(name)s succeeded",
674
398
                            vars(self))
675
399
                self.checked_ok()
676
400
            else:
677
 
                logger.info("Checker for %(name)s failed", vars(self))
 
401
                logger.info(u"Checker for %(name)s failed",
 
402
                            vars(self))
678
403
        else:
679
 
            self.last_checker_status = -1
680
 
            self.last_checker_signal = -returncode
681
 
            logger.warning("Checker for %(name)s crashed?",
 
404
            logger.warning(u"Checker for %(name)s crashed?",
682
405
                           vars(self))
683
 
        return False
684
406
    
685
407
    def checked_ok(self):
686
 
        """Assert that the client has been seen, alive and well."""
 
408
        """Bump up the timeout for this client.
 
409
        
 
410
        This should only be called when the client has been seen,
 
411
        alive and well.
 
412
        """
687
413
        self.last_checked_ok = datetime.datetime.utcnow()
688
 
        self.last_checker_status = 0
689
 
        self.last_checker_signal = None
690
 
        self.bump_timeout()
691
 
    
692
 
    def bump_timeout(self, timeout=None):
693
 
        """Bump up the timeout for this client."""
694
 
        if timeout is None:
695
 
            timeout = self.timeout
696
 
        if self.disable_initiator_tag is not None:
697
 
            gobject.source_remove(self.disable_initiator_tag)
698
 
            self.disable_initiator_tag = None
699
 
        if getattr(self, "enabled", False):
700
 
            self.disable_initiator_tag = gobject.timeout_add(
701
 
                int(timeout.total_seconds() * 1000), self.disable)
702
 
            self.expires = datetime.datetime.utcnow() + timeout
703
 
    
704
 
    def need_approval(self):
705
 
        self.last_approval_request = datetime.datetime.utcnow()
 
414
        gobject.source_remove(self.disable_initiator_tag)
 
415
        self.disable_initiator_tag = (gobject.timeout_add
 
416
                                      (self.timeout_milliseconds(),
 
417
                                       self.disable))
706
418
    
707
419
    def start_checker(self):
708
420
        """Start a new checker subprocess if one is not running.
710
422
        If a checker already exists, leave it running and do
711
423
        nothing."""
712
424
        # The reason for not killing a running checker is that if we
713
 
        # did that, and if a checker (for some reason) started running
714
 
        # slowly and taking more than 'interval' time, then the client
715
 
        # would inevitably timeout, since no checker would get a
716
 
        # chance to run to completion.  If we instead leave running
 
425
        # did that, then if a checker (for some reason) started
 
426
        # running slowly and taking more than 'interval' time, the
 
427
        # client would inevitably timeout, since no checker would get
 
428
        # a chance to run to completion.  If we instead leave running
717
429
        # checkers alone, the checker would have to take more time
718
430
        # than 'timeout' for the client to be disabled, which is as it
719
431
        # should be.
720
432
        
721
 
        if self.checker is not None and not self.checker.is_alive():
722
 
            logger.warning("Checker was not alive; joining")
723
 
            self.checker.join()
724
 
            self.checker = None
 
433
        # If a checker exists, make sure it is not a zombie
 
434
        try:
 
435
            pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
 
436
        except (AttributeError, OSError), error:
 
437
            if (isinstance(error, OSError)
 
438
                and error.errno != errno.ECHILD):
 
439
                raise error
 
440
        else:
 
441
            if pid:
 
442
                logger.warning(u"Checker was a zombie")
 
443
                gobject.source_remove(self.checker_callback_tag)
 
444
                self.checker_callback(pid, status,
 
445
                                      self.current_checker_command)
725
446
        # Start a new checker if needed
726
447
        if self.checker is None:
727
 
            # Escape attributes for the shell
728
 
            escaped_attrs = {
729
 
                attr: re.escape(str(getattr(self, attr)))
730
 
                for attr in self.runtime_expansions }
731
448
            try:
732
 
                command = self.checker_command % escaped_attrs
733
 
            except TypeError as error:
734
 
                logger.error('Could not format string "%s"',
735
 
                             self.checker_command,
736
 
                             exc_info=error)
737
 
                return True     # Try again later
 
449
                # In case checker_command has exactly one % operator
 
450
                command = self.checker_command % self.host
 
451
            except TypeError:
 
452
                # Escape attributes for the shell
 
453
                escaped_attrs = dict((key,
 
454
                                      re.escape(unicode(str(val),
 
455
                                                        errors=
 
456
                                                        u'replace')))
 
457
                                     for key, val in
 
458
                                     vars(self).iteritems())
 
459
                try:
 
460
                    command = self.checker_command % escaped_attrs
 
461
                except TypeError, error:
 
462
                    logger.error(u'Could not format string "%s":'
 
463
                                 u' %s', self.checker_command, error)
 
464
                    return True # Try again later
738
465
            self.current_checker_command = command
739
 
            logger.info("Starting checker %r for %s", command,
740
 
                        self.name)
741
 
            # We don't need to redirect stdout and stderr, since
742
 
            # in normal mode, that is already done by daemon(),
743
 
            # and in debug mode we don't want to.  (Stdin is
744
 
            # always replaced by /dev/null.)
745
 
            # The exception is when not debugging but nevertheless
746
 
            # running in the foreground; use the previously
747
 
            # created wnull.
748
 
            popen_args = { "close_fds": True,
749
 
                           "shell": True,
750
 
                           "cwd": "/" }
751
 
            if (not self.server_settings["debug"]
752
 
                and self.server_settings["foreground"]):
753
 
                popen_args.update({"stdout": wnull,
754
 
                                   "stderr": wnull })
755
 
            pipe = multiprocessing.Pipe(duplex = False)
756
 
            self.checker = multiprocessing.Process(
757
 
                target = call_pipe,
758
 
                args = (pipe[1], subprocess.call, command),
759
 
                kwargs = popen_args)
760
 
            self.checker.start()
761
 
            self.checker_callback_tag = gobject.io_add_watch(
762
 
                pipe[0].fileno(), gobject.IO_IN,
763
 
                self.checker_callback, pipe[0], command)
 
466
            try:
 
467
                logger.info(u"Starting checker %r for %s",
 
468
                            command, self.name)
 
469
                # We don't need to redirect stdout and stderr, since
 
470
                # in normal mode, that is already done by daemon(),
 
471
                # and in debug mode we don't want to.  (Stdin is
 
472
                # always replaced by /dev/null.)
 
473
                self.checker = subprocess.Popen(command,
 
474
                                                close_fds=True,
 
475
                                                shell=True, cwd=u"/")
 
476
                self.checker_callback_tag = (gobject.child_watch_add
 
477
                                             (self.checker.pid,
 
478
                                              self.checker_callback,
 
479
                                              data=command))
 
480
                # The checker may have completed before the gobject
 
481
                # watch was added.  Check for this.
 
482
                pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
 
483
                if pid:
 
484
                    gobject.source_remove(self.checker_callback_tag)
 
485
                    self.checker_callback(pid, status, command)
 
486
            except OSError, error:
 
487
                logger.error(u"Failed to start subprocess: %s",
 
488
                             error)
764
489
        # Re-run this periodically if run by gobject.timeout_add
765
490
        return True
766
491
    
769
494
        if self.checker_callback_tag:
770
495
            gobject.source_remove(self.checker_callback_tag)
771
496
            self.checker_callback_tag = None
772
 
        if getattr(self, "checker", None) is None:
 
497
        if getattr(self, u"checker", None) is None:
773
498
            return
774
 
        logger.debug("Stopping checker for %(name)s", vars(self))
775
 
        self.checker.terminate()
 
499
        logger.debug(u"Stopping checker for %(name)s", vars(self))
 
500
        try:
 
501
            os.kill(self.checker.pid, signal.SIGTERM)
 
502
            #time.sleep(0.5)
 
503
            #if self.checker.poll() is None:
 
504
            #    os.kill(self.checker.pid, signal.SIGKILL)
 
505
        except OSError, error:
 
506
            if error.errno != errno.ESRCH: # No such process
 
507
                raise
776
508
        self.checker = None
777
509
 
778
 
 
779
 
def dbus_service_property(dbus_interface,
780
 
                          signature="v",
781
 
                          access="readwrite",
782
 
                          byte_arrays=False):
 
510
def dbus_service_property(dbus_interface, signature=u"v",
 
511
                          access=u"readwrite", byte_arrays=False):
783
512
    """Decorators for marking methods of a DBusObjectWithProperties to
784
513
    become properties on the D-Bus.
785
514
    
792
521
    """
793
522
    # Encoding deeply encoded byte arrays is not supported yet by the
794
523
    # "Set" method, so we fail early here:
795
 
    if byte_arrays and signature != "ay":
796
 
        raise ValueError("Byte arrays not supported for non-'ay'"
797
 
                         " signature {!r}".format(signature))
798
 
    
 
524
    if byte_arrays and signature != u"ay":
 
525
        raise ValueError(u"Byte arrays not supported for non-'ay'"
 
526
                         u" signature %r" % signature)
799
527
    def decorator(func):
800
528
        func._dbus_is_property = True
801
529
        func._dbus_interface = dbus_interface
802
530
        func._dbus_signature = signature
803
531
        func._dbus_access = access
804
532
        func._dbus_name = func.__name__
805
 
        if func._dbus_name.endswith("_dbus_property"):
 
533
        if func._dbus_name.endswith(u"_dbus_property"):
806
534
            func._dbus_name = func._dbus_name[:-14]
807
 
        func._dbus_get_args_options = {'byte_arrays': byte_arrays }
808
 
        return func
809
 
    
810
 
    return decorator
811
 
 
812
 
 
813
 
def dbus_interface_annotations(dbus_interface):
814
 
    """Decorator for marking functions returning interface annotations
815
 
    
816
 
    Usage:
817
 
    
818
 
    @dbus_interface_annotations("org.example.Interface")
819
 
    def _foo(self):  # Function name does not matter
820
 
        return {"org.freedesktop.DBus.Deprecated": "true",
821
 
                "org.freedesktop.DBus.Property.EmitsChangedSignal":
822
 
                    "false"}
823
 
    """
824
 
    
825
 
    def decorator(func):
826
 
        func._dbus_is_interface = True
827
 
        func._dbus_interface = dbus_interface
828
 
        func._dbus_name = dbus_interface
829
 
        return func
830
 
    
831
 
    return decorator
832
 
 
833
 
 
834
 
def dbus_annotations(annotations):
835
 
    """Decorator to annotate D-Bus methods, signals or properties
836
 
    Usage:
837
 
    
838
 
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",
839
 
                       "org.freedesktop.DBus.Property."
840
 
                       "EmitsChangedSignal": "false"})
841
 
    @dbus_service_property("org.example.Interface", signature="b",
842
 
                           access="r")
843
 
    def Property_dbus_property(self):
844
 
        return dbus.Boolean(False)
845
 
    """
846
 
    
847
 
    def decorator(func):
848
 
        func._dbus_annotations = annotations
849
 
        return func
850
 
    
 
535
        func._dbus_get_args_options = {u'byte_arrays': byte_arrays }
 
536
        return func
851
537
    return decorator
852
538
 
853
539
 
854
540
class DBusPropertyException(dbus.exceptions.DBusException):
855
541
    """A base class for D-Bus property-related exceptions
856
542
    """
857
 
    pass
 
543
    def __unicode__(self):
 
544
        return unicode(str(self))
858
545
 
859
546
 
860
547
class DBusPropertyAccessException(DBusPropertyException):
871
558
 
872
559
class DBusObjectWithProperties(dbus.service.Object):
873
560
    """A D-Bus object with properties.
874
 
    
 
561
 
875
562
    Classes inheriting from this can use the dbus_service_property
876
563
    decorator to expose methods as D-Bus properties.  It exposes the
877
564
    standard Get(), Set(), and GetAll() methods on the D-Bus.
878
565
    """
879
566
    
880
567
    @staticmethod
881
 
    def _is_dbus_thing(thing):
882
 
        """Returns a function testing if an attribute is a D-Bus thing
883
 
        
884
 
        If called like _is_dbus_thing("method") it returns a function
885
 
        suitable for use as predicate to inspect.getmembers().
886
 
        """
887
 
        return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
888
 
                                   False)
 
568
    def _is_dbus_property(obj):
 
569
        return getattr(obj, u"_dbus_is_property", False)
889
570
    
890
 
    def _get_all_dbus_things(self, thing):
 
571
    def _get_all_dbus_properties(self):
891
572
        """Returns a generator of (name, attribute) pairs
892
573
        """
893
 
        return ((getattr(athing.__get__(self), "_dbus_name", name),
894
 
                 athing.__get__(self))
895
 
                for cls in self.__class__.__mro__
896
 
                for name, athing in
897
 
                inspect.getmembers(cls, self._is_dbus_thing(thing)))
 
574
        return ((prop._dbus_name, prop)
 
575
                for name, prop in
 
576
                inspect.getmembers(self, self._is_dbus_property))
898
577
    
899
578
    def _get_dbus_property(self, interface_name, property_name):
900
579
        """Returns a bound method if one exists which is a D-Bus
901
580
        property with the specified name and interface.
902
581
        """
903
 
        for cls in self.__class__.__mro__:
904
 
            for name, value in inspect.getmembers(
905
 
                    cls, self._is_dbus_thing("property")):
906
 
                if (value._dbus_name == property_name
907
 
                    and value._dbus_interface == interface_name):
908
 
                    return value.__get__(self)
909
 
        
 
582
        for name in (property_name,
 
583
                     property_name + u"_dbus_property"):
 
584
            prop = getattr(self, name, None)
 
585
            if (prop is None
 
586
                or not self._is_dbus_property(prop)
 
587
                or prop._dbus_name != property_name
 
588
                or (interface_name and prop._dbus_interface
 
589
                    and interface_name != prop._dbus_interface)):
 
590
                continue
 
591
            return prop
910
592
        # No such property
911
 
        raise DBusPropertyNotFound("{}:{}.{}".format(
912
 
            self.dbus_object_path, interface_name, property_name))
 
593
        raise DBusPropertyNotFound(self.dbus_object_path + u":"
 
594
                                   + interface_name + u"."
 
595
                                   + property_name)
913
596
    
914
 
    @dbus.service.method(dbus.PROPERTIES_IFACE,
915
 
                         in_signature="ss",
916
 
                         out_signature="v")
 
597
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ss",
 
598
                         out_signature=u"v")
917
599
    def Get(self, interface_name, property_name):
918
600
        """Standard D-Bus property Get() method, see D-Bus standard.
919
601
        """
920
602
        prop = self._get_dbus_property(interface_name, property_name)
921
 
        if prop._dbus_access == "write":
 
603
        if prop._dbus_access == u"write":
922
604
            raise DBusPropertyAccessException(property_name)
923
605
        value = prop()
924
 
        if not hasattr(value, "variant_level"):
 
606
        if not hasattr(value, u"variant_level"):
925
607
            return value
926
608
        return type(value)(value, variant_level=value.variant_level+1)
927
609
    
928
 
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
 
610
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ssv")
929
611
    def Set(self, interface_name, property_name, value):
930
612
        """Standard D-Bus property Set() method, see D-Bus standard.
931
613
        """
932
614
        prop = self._get_dbus_property(interface_name, property_name)
933
 
        if prop._dbus_access == "read":
 
615
        if prop._dbus_access == u"read":
934
616
            raise DBusPropertyAccessException(property_name)
935
 
        if prop._dbus_get_args_options["byte_arrays"]:
 
617
        if prop._dbus_get_args_options[u"byte_arrays"]:
936
618
            # The byte_arrays option is not supported yet on
937
619
            # signatures other than "ay".
938
 
            if prop._dbus_signature != "ay":
939
 
                raise ValueError("Byte arrays not supported for non-"
940
 
                                 "'ay' signature {!r}"
941
 
                                 .format(prop._dbus_signature))
942
 
            value = dbus.ByteArray(b''.join(chr(byte)
943
 
                                            for byte in value))
 
620
            if prop._dbus_signature != u"ay":
 
621
                raise ValueError
 
622
            value = dbus.ByteArray(''.join(unichr(byte)
 
623
                                           for byte in value))
944
624
        prop(value)
945
625
    
946
 
    @dbus.service.method(dbus.PROPERTIES_IFACE,
947
 
                         in_signature="s",
948
 
                         out_signature="a{sv}")
 
626
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"s",
 
627
                         out_signature=u"a{sv}")
949
628
    def GetAll(self, interface_name):
950
629
        """Standard D-Bus property GetAll() method, see D-Bus
951
630
        standard.
952
 
        
 
631
 
953
632
        Note: Will not include properties with access="write".
954
633
        """
955
 
        properties = {}
956
 
        for name, prop in self._get_all_dbus_things("property"):
 
634
        all = {}
 
635
        for name, prop in self._get_all_dbus_properties():
957
636
            if (interface_name
958
637
                and interface_name != prop._dbus_interface):
959
638
                # Interface non-empty but did not match
960
639
                continue
961
640
            # Ignore write-only properties
962
 
            if prop._dbus_access == "write":
 
641
            if prop._dbus_access == u"write":
963
642
                continue
964
643
            value = prop()
965
 
            if not hasattr(value, "variant_level"):
966
 
                properties[name] = value
 
644
            if not hasattr(value, u"variant_level"):
 
645
                all[name] = value
967
646
                continue
968
 
            properties[name] = type(value)(
969
 
                value, variant_level = value.variant_level + 1)
970
 
        return dbus.Dictionary(properties, signature="sv")
971
 
    
972
 
    @dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")
973
 
    def PropertiesChanged(self, interface_name, changed_properties,
974
 
                          invalidated_properties):
975
 
        """Standard D-Bus PropertiesChanged() signal, see D-Bus
976
 
        standard.
977
 
        """
978
 
        pass
 
647
            all[name] = type(value)(value, variant_level=
 
648
                                    value.variant_level+1)
 
649
        return dbus.Dictionary(all, signature=u"sv")
979
650
    
980
651
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
981
 
                         out_signature="s",
 
652
                         out_signature=u"s",
982
653
                         path_keyword='object_path',
983
654
                         connection_keyword='connection')
984
655
    def Introspect(self, object_path, connection):
985
 
        """Overloading of standard D-Bus method.
986
 
        
987
 
        Inserts property tags and interface annotation tags.
 
656
        """Standard D-Bus method, overloaded to insert property tags.
988
657
        """
989
658
        xmlstring = dbus.service.Object.Introspect(self, object_path,
990
659
                                                   connection)
991
660
        try:
992
661
            document = xml.dom.minidom.parseString(xmlstring)
993
 
            
994
662
            def make_tag(document, name, prop):
995
 
                e = document.createElement("property")
996
 
                e.setAttribute("name", name)
997
 
                e.setAttribute("type", prop._dbus_signature)
998
 
                e.setAttribute("access", prop._dbus_access)
 
663
                e = document.createElement(u"property")
 
664
                e.setAttribute(u"name", name)
 
665
                e.setAttribute(u"type", prop._dbus_signature)
 
666
                e.setAttribute(u"access", prop._dbus_access)
999
667
                return e
1000
 
            
1001
 
            for if_tag in document.getElementsByTagName("interface"):
1002
 
                # Add property tags
 
668
            for if_tag in document.getElementsByTagName(u"interface"):
1003
669
                for tag in (make_tag(document, name, prop)
1004
670
                            for name, prop
1005
 
                            in self._get_all_dbus_things("property")
 
671
                            in self._get_all_dbus_properties()
1006
672
                            if prop._dbus_interface
1007
 
                            == if_tag.getAttribute("name")):
 
673
                            == if_tag.getAttribute(u"name")):
1008
674
                    if_tag.appendChild(tag)
1009
 
                # Add annotation tags
1010
 
                for typ in ("method", "signal", "property"):
1011
 
                    for tag in if_tag.getElementsByTagName(typ):
1012
 
                        annots = dict()
1013
 
                        for name, prop in (self.
1014
 
                                           _get_all_dbus_things(typ)):
1015
 
                            if (name == tag.getAttribute("name")
1016
 
                                and prop._dbus_interface
1017
 
                                == if_tag.getAttribute("name")):
1018
 
                                annots.update(getattr(
1019
 
                                    prop, "_dbus_annotations", {}))
1020
 
                        for name, value in annots.items():
1021
 
                            ann_tag = document.createElement(
1022
 
                                "annotation")
1023
 
                            ann_tag.setAttribute("name", name)
1024
 
                            ann_tag.setAttribute("value", value)
1025
 
                            tag.appendChild(ann_tag)
1026
 
                # Add interface annotation tags
1027
 
                for annotation, value in dict(
1028
 
                    itertools.chain.from_iterable(
1029
 
                        annotations().items()
1030
 
                        for name, annotations
1031
 
                        in self._get_all_dbus_things("interface")
1032
 
                        if name == if_tag.getAttribute("name")
1033
 
                        )).items():
1034
 
                    ann_tag = document.createElement("annotation")
1035
 
                    ann_tag.setAttribute("name", annotation)
1036
 
                    ann_tag.setAttribute("value", value)
1037
 
                    if_tag.appendChild(ann_tag)
1038
675
                # Add the names to the return values for the
1039
676
                # "org.freedesktop.DBus.Properties" methods
1040
 
                if (if_tag.getAttribute("name")
1041
 
                    == "org.freedesktop.DBus.Properties"):
1042
 
                    for cn in if_tag.getElementsByTagName("method"):
1043
 
                        if cn.getAttribute("name") == "Get":
1044
 
                            for arg in cn.getElementsByTagName("arg"):
1045
 
                                if (arg.getAttribute("direction")
1046
 
                                    == "out"):
1047
 
                                    arg.setAttribute("name", "value")
1048
 
                        elif cn.getAttribute("name") == "GetAll":
1049
 
                            for arg in cn.getElementsByTagName("arg"):
1050
 
                                if (arg.getAttribute("direction")
1051
 
                                    == "out"):
1052
 
                                    arg.setAttribute("name", "props")
1053
 
            xmlstring = document.toxml("utf-8")
 
677
                if (if_tag.getAttribute(u"name")
 
678
                    == u"org.freedesktop.DBus.Properties"):
 
679
                    for cn in if_tag.getElementsByTagName(u"method"):
 
680
                        if cn.getAttribute(u"name") == u"Get":
 
681
                            for arg in cn.getElementsByTagName(u"arg"):
 
682
                                if (arg.getAttribute(u"direction")
 
683
                                    == u"out"):
 
684
                                    arg.setAttribute(u"name", u"value")
 
685
                        elif cn.getAttribute(u"name") == u"GetAll":
 
686
                            for arg in cn.getElementsByTagName(u"arg"):
 
687
                                if (arg.getAttribute(u"direction")
 
688
                                    == u"out"):
 
689
                                    arg.setAttribute(u"name", u"props")
 
690
            xmlstring = document.toxml(u"utf-8")
1054
691
            document.unlink()
1055
692
        except (AttributeError, xml.dom.DOMException,
1056
 
                xml.parsers.expat.ExpatError) as error:
1057
 
            logger.error("Failed to override Introspection method",
1058
 
                         exc_info=error)
 
693
                xml.parsers.expat.ExpatError), error:
 
694
            logger.error(u"Failed to override Introspection method",
 
695
                         error)
1059
696
        return xmlstring
1060
697
 
1061
698
 
1062
 
def datetime_to_dbus(dt, variant_level=0):
1063
 
    """Convert a UTC datetime.datetime() to a D-Bus type."""
1064
 
    if dt is None:
1065
 
        return dbus.String("", variant_level = variant_level)
1066
 
    return dbus.String(dt.isoformat(), variant_level=variant_level)
1067
 
 
1068
 
 
1069
 
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
1070
 
    """A class decorator; applied to a subclass of
1071
 
    dbus.service.Object, it will add alternate D-Bus attributes with
1072
 
    interface names according to the "alt_interface_names" mapping.
1073
 
    Usage:
1074
 
    
1075
 
    @alternate_dbus_interfaces({"org.example.Interface":
1076
 
                                    "net.example.AlternateInterface"})
1077
 
    class SampleDBusObject(dbus.service.Object):
1078
 
        @dbus.service.method("org.example.Interface")
1079
 
        def SampleDBusMethod():
1080
 
            pass
1081
 
    
1082
 
    The above "SampleDBusMethod" on "SampleDBusObject" will be
1083
 
    reachable via two interfaces: "org.example.Interface" and
1084
 
    "net.example.AlternateInterface", the latter of which will have
1085
 
    its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
1086
 
    "true", unless "deprecate" is passed with a False value.
1087
 
    
1088
 
    This works for methods and signals, and also for D-Bus properties
1089
 
    (from DBusObjectWithProperties) and interfaces (from the
1090
 
    dbus_interface_annotations decorator).
1091
 
    """
1092
 
    
1093
 
    def wrapper(cls):
1094
 
        for orig_interface_name, alt_interface_name in (
1095
 
                alt_interface_names.items()):
1096
 
            attr = {}
1097
 
            interface_names = set()
1098
 
            # Go though all attributes of the class
1099
 
            for attrname, attribute in inspect.getmembers(cls):
1100
 
                # Ignore non-D-Bus attributes, and D-Bus attributes
1101
 
                # with the wrong interface name
1102
 
                if (not hasattr(attribute, "_dbus_interface")
1103
 
                    or not attribute._dbus_interface.startswith(
1104
 
                        orig_interface_name)):
1105
 
                    continue
1106
 
                # Create an alternate D-Bus interface name based on
1107
 
                # the current name
1108
 
                alt_interface = attribute._dbus_interface.replace(
1109
 
                    orig_interface_name, alt_interface_name)
1110
 
                interface_names.add(alt_interface)
1111
 
                # Is this a D-Bus signal?
1112
 
                if getattr(attribute, "_dbus_is_signal", False):
1113
 
                    if sys.version_info.major == 2:
1114
 
                        # Extract the original non-method undecorated
1115
 
                        # function by black magic
1116
 
                        nonmethod_func = (dict(
1117
 
                            zip(attribute.func_code.co_freevars,
1118
 
                                attribute.__closure__))
1119
 
                                          ["func"].cell_contents)
1120
 
                    else:
1121
 
                        nonmethod_func = attribute
1122
 
                    # Create a new, but exactly alike, function
1123
 
                    # object, and decorate it to be a new D-Bus signal
1124
 
                    # with the alternate D-Bus interface name
1125
 
                    if sys.version_info.major == 2:
1126
 
                        new_function = types.FunctionType(
1127
 
                            nonmethod_func.func_code,
1128
 
                            nonmethod_func.func_globals,
1129
 
                            nonmethod_func.func_name,
1130
 
                            nonmethod_func.func_defaults,
1131
 
                            nonmethod_func.func_closure)
1132
 
                    else:
1133
 
                        new_function = types.FunctionType(
1134
 
                            nonmethod_func.__code__,
1135
 
                            nonmethod_func.__globals__,
1136
 
                            nonmethod_func.__name__,
1137
 
                            nonmethod_func.__defaults__,
1138
 
                            nonmethod_func.__closure__)
1139
 
                    new_function = (dbus.service.signal(
1140
 
                        alt_interface,
1141
 
                        attribute._dbus_signature)(new_function))
1142
 
                    # Copy annotations, if any
1143
 
                    try:
1144
 
                        new_function._dbus_annotations = dict(
1145
 
                            attribute._dbus_annotations)
1146
 
                    except AttributeError:
1147
 
                        pass
1148
 
                    # Define a creator of a function to call both the
1149
 
                    # original and alternate functions, so both the
1150
 
                    # original and alternate signals gets sent when
1151
 
                    # the function is called
1152
 
                    def fixscope(func1, func2):
1153
 
                        """This function is a scope container to pass
1154
 
                        func1 and func2 to the "call_both" function
1155
 
                        outside of its arguments"""
1156
 
                        
1157
 
                        def call_both(*args, **kwargs):
1158
 
                            """This function will emit two D-Bus
1159
 
                            signals by calling func1 and func2"""
1160
 
                            func1(*args, **kwargs)
1161
 
                            func2(*args, **kwargs)
1162
 
                        
1163
 
                        return call_both
1164
 
                    # Create the "call_both" function and add it to
1165
 
                    # the class
1166
 
                    attr[attrname] = fixscope(attribute, new_function)
1167
 
                # Is this a D-Bus method?
1168
 
                elif getattr(attribute, "_dbus_is_method", False):
1169
 
                    # Create a new, but exactly alike, function
1170
 
                    # object.  Decorate it to be a new D-Bus method
1171
 
                    # with the alternate D-Bus interface name.  Add it
1172
 
                    # to the class.
1173
 
                    attr[attrname] = (
1174
 
                        dbus.service.method(
1175
 
                            alt_interface,
1176
 
                            attribute._dbus_in_signature,
1177
 
                            attribute._dbus_out_signature)
1178
 
                        (types.FunctionType(attribute.func_code,
1179
 
                                            attribute.func_globals,
1180
 
                                            attribute.func_name,
1181
 
                                            attribute.func_defaults,
1182
 
                                            attribute.func_closure)))
1183
 
                    # Copy annotations, if any
1184
 
                    try:
1185
 
                        attr[attrname]._dbus_annotations = dict(
1186
 
                            attribute._dbus_annotations)
1187
 
                    except AttributeError:
1188
 
                        pass
1189
 
                # Is this a D-Bus property?
1190
 
                elif getattr(attribute, "_dbus_is_property", False):
1191
 
                    # Create a new, but exactly alike, function
1192
 
                    # object, and decorate it to be a new D-Bus
1193
 
                    # property with the alternate D-Bus interface
1194
 
                    # name.  Add it to the class.
1195
 
                    attr[attrname] = (dbus_service_property(
1196
 
                        alt_interface, attribute._dbus_signature,
1197
 
                        attribute._dbus_access,
1198
 
                        attribute._dbus_get_args_options
1199
 
                        ["byte_arrays"])
1200
 
                                      (types.FunctionType(
1201
 
                                          attribute.func_code,
1202
 
                                          attribute.func_globals,
1203
 
                                          attribute.func_name,
1204
 
                                          attribute.func_defaults,
1205
 
                                          attribute.func_closure)))
1206
 
                    # Copy annotations, if any
1207
 
                    try:
1208
 
                        attr[attrname]._dbus_annotations = dict(
1209
 
                            attribute._dbus_annotations)
1210
 
                    except AttributeError:
1211
 
                        pass
1212
 
                # Is this a D-Bus interface?
1213
 
                elif getattr(attribute, "_dbus_is_interface", False):
1214
 
                    # Create a new, but exactly alike, function
1215
 
                    # object.  Decorate it to be a new D-Bus interface
1216
 
                    # with the alternate D-Bus interface name.  Add it
1217
 
                    # to the class.
1218
 
                    attr[attrname] = (
1219
 
                        dbus_interface_annotations(alt_interface)
1220
 
                        (types.FunctionType(attribute.func_code,
1221
 
                                            attribute.func_globals,
1222
 
                                            attribute.func_name,
1223
 
                                            attribute.func_defaults,
1224
 
                                            attribute.func_closure)))
1225
 
            if deprecate:
1226
 
                # Deprecate all alternate interfaces
1227
 
                iname="_AlternateDBusNames_interface_annotation{}"
1228
 
                for interface_name in interface_names:
1229
 
                    
1230
 
                    @dbus_interface_annotations(interface_name)
1231
 
                    def func(self):
1232
 
                        return { "org.freedesktop.DBus.Deprecated":
1233
 
                                 "true" }
1234
 
                    # Find an unused name
1235
 
                    for aname in (iname.format(i)
1236
 
                                  for i in itertools.count()):
1237
 
                        if aname not in attr:
1238
 
                            attr[aname] = func
1239
 
                            break
1240
 
            if interface_names:
1241
 
                # Replace the class with a new subclass of it with
1242
 
                # methods, signals, etc. as created above.
1243
 
                cls = type(b"{}Alternate".format(cls.__name__),
1244
 
                           (cls, ), attr)
1245
 
        return cls
1246
 
    
1247
 
    return wrapper
1248
 
 
1249
 
 
1250
 
@alternate_dbus_interfaces({"se.recompile.Mandos":
1251
 
                            "se.bsnet.fukt.Mandos"})
1252
699
class ClientDBus(Client, DBusObjectWithProperties):
1253
700
    """A Client class using D-Bus
1254
701
    
1256
703
    dbus_object_path: dbus.ObjectPath
1257
704
    bus: dbus.SystemBus()
1258
705
    """
1259
 
    
1260
 
    runtime_expansions = (Client.runtime_expansions
1261
 
                          + ("dbus_object_path", ))
1262
 
    
1263
 
    _interface = "se.recompile.Mandos.Client"
1264
 
    
1265
706
    # dbus.service.Object doesn't use super(), so we can't either.
1266
707
    
1267
708
    def __init__(self, bus = None, *args, **kwargs):
 
709
        self._approvals_pending = 0
1268
710
        self.bus = bus
1269
711
        Client.__init__(self, *args, **kwargs)
1270
712
        # Only now, when this client is initialized, can it show up on
1271
713
        # the D-Bus
1272
 
        client_object_name = str(self.name).translate(
1273
 
            {ord("."): ord("_"),
1274
 
             ord("-"): ord("_")})
1275
 
        self.dbus_object_path = dbus.ObjectPath(
1276
 
            "/clients/" + client_object_name)
 
714
        self.dbus_object_path = (dbus.ObjectPath
 
715
                                 (u"/clients/"
 
716
                                  + self.name.replace(u".", u"_")))
1277
717
        DBusObjectWithProperties.__init__(self, self.bus,
1278
718
                                          self.dbus_object_path)
1279
 
    
1280
 
    def notifychangeproperty(transform_func, dbus_name,
1281
 
                             type_func=lambda x: x,
1282
 
                             variant_level=1,
1283
 
                             invalidate_only=False,
1284
 
                             _interface=_interface):
1285
 
        """ Modify a variable so that it's a property which announces
1286
 
        its changes to DBus.
1287
 
        
1288
 
        transform_fun: Function that takes a value and a variant_level
1289
 
                       and transforms it to a D-Bus type.
1290
 
        dbus_name: D-Bus name of the variable
1291
 
        type_func: Function that transform the value before sending it
1292
 
                   to the D-Bus.  Default: no transform
1293
 
        variant_level: D-Bus variant level.  Default: 1
1294
 
        """
1295
 
        attrname = "_{}".format(dbus_name)
1296
 
        
1297
 
        def setter(self, value):
1298
 
            if hasattr(self, "dbus_object_path"):
1299
 
                if (not hasattr(self, attrname) or
1300
 
                    type_func(getattr(self, attrname, None))
1301
 
                    != type_func(value)):
1302
 
                    if invalidate_only:
1303
 
                        self.PropertiesChanged(
1304
 
                            _interface, dbus.Dictionary(),
1305
 
                            dbus.Array((dbus_name, )))
1306
 
                    else:
1307
 
                        dbus_value = transform_func(
1308
 
                            type_func(value),
1309
 
                            variant_level = variant_level)
1310
 
                        self.PropertyChanged(dbus.String(dbus_name),
1311
 
                                             dbus_value)
1312
 
                        self.PropertiesChanged(
1313
 
                            _interface,
1314
 
                            dbus.Dictionary({ dbus.String(dbus_name):
1315
 
                                              dbus_value }),
1316
 
                            dbus.Array())
1317
 
            setattr(self, attrname, value)
1318
 
        
1319
 
        return property(lambda self: getattr(self, attrname), setter)
1320
 
    
1321
 
    expires = notifychangeproperty(datetime_to_dbus, "Expires")
1322
 
    approvals_pending = notifychangeproperty(dbus.Boolean,
1323
 
                                             "ApprovalPending",
1324
 
                                             type_func = bool)
1325
 
    enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1326
 
    last_enabled = notifychangeproperty(datetime_to_dbus,
1327
 
                                        "LastEnabled")
1328
 
    checker = notifychangeproperty(
1329
 
        dbus.Boolean, "CheckerRunning",
1330
 
        type_func = lambda checker: checker is not None)
1331
 
    last_checked_ok = notifychangeproperty(datetime_to_dbus,
1332
 
                                           "LastCheckedOK")
1333
 
    last_checker_status = notifychangeproperty(dbus.Int16,
1334
 
                                               "LastCheckerStatus")
1335
 
    last_approval_request = notifychangeproperty(
1336
 
        datetime_to_dbus, "LastApprovalRequest")
1337
 
    approved_by_default = notifychangeproperty(dbus.Boolean,
1338
 
                                               "ApprovedByDefault")
1339
 
    approval_delay = notifychangeproperty(
1340
 
        dbus.UInt64, "ApprovalDelay",
1341
 
        type_func = lambda td: td.total_seconds() * 1000)
1342
 
    approval_duration = notifychangeproperty(
1343
 
        dbus.UInt64, "ApprovalDuration",
1344
 
        type_func = lambda td: td.total_seconds() * 1000)
1345
 
    host = notifychangeproperty(dbus.String, "Host")
1346
 
    timeout = notifychangeproperty(
1347
 
        dbus.UInt64, "Timeout",
1348
 
        type_func = lambda td: td.total_seconds() * 1000)
1349
 
    extended_timeout = notifychangeproperty(
1350
 
        dbus.UInt64, "ExtendedTimeout",
1351
 
        type_func = lambda td: td.total_seconds() * 1000)
1352
 
    interval = notifychangeproperty(
1353
 
        dbus.UInt64, "Interval",
1354
 
        type_func = lambda td: td.total_seconds() * 1000)
1355
 
    checker_command = notifychangeproperty(dbus.String, "Checker")
1356
 
    secret = notifychangeproperty(dbus.ByteArray, "Secret",
1357
 
                                  invalidate_only=True)
1358
 
    
1359
 
    del notifychangeproperty
 
719
        
 
720
    def _get_approvals_pending(self):
 
721
        return self._approvals_pending
 
722
    def _set_approvals_pending(self, value):
 
723
        old_value = self._approvals_pending
 
724
        self._approvals_pending = value
 
725
        bval = bool(value)
 
726
        if (hasattr(self, "dbus_object_path")
 
727
            and bval is not bool(old_value)):
 
728
            dbus_bool = dbus.Boolean(bval, variant_level=1)
 
729
            self.PropertyChanged(dbus.String(u"ApprovalPending"),
 
730
                                 dbus_bool)
 
731
 
 
732
    approvals_pending = property(_get_approvals_pending,
 
733
                                 _set_approvals_pending)
 
734
    del _get_approvals_pending, _set_approvals_pending
 
735
    
 
736
    @staticmethod
 
737
    def _datetime_to_dbus(dt, variant_level=0):
 
738
        """Convert a UTC datetime.datetime() to a D-Bus type."""
 
739
        return dbus.String(dt.isoformat(),
 
740
                           variant_level=variant_level)
 
741
    
 
742
    def enable(self):
 
743
        oldstate = getattr(self, u"enabled", False)
 
744
        r = Client.enable(self)
 
745
        if oldstate != self.enabled:
 
746
            # Emit D-Bus signals
 
747
            self.PropertyChanged(dbus.String(u"Enabled"),
 
748
                                 dbus.Boolean(True, variant_level=1))
 
749
            self.PropertyChanged(
 
750
                dbus.String(u"LastEnabled"),
 
751
                self._datetime_to_dbus(self.last_enabled,
 
752
                                       variant_level=1))
 
753
        return r
 
754
    
 
755
    def disable(self, quiet = False):
 
756
        oldstate = getattr(self, u"enabled", False)
 
757
        r = Client.disable(self, quiet=quiet)
 
758
        if not quiet and oldstate != self.enabled:
 
759
            # Emit D-Bus signal
 
760
            self.PropertyChanged(dbus.String(u"Enabled"),
 
761
                                 dbus.Boolean(False, variant_level=1))
 
762
        return r
1360
763
    
1361
764
    def __del__(self, *args, **kwargs):
1362
765
        try:
1363
766
            self.remove_from_connection()
1364
767
        except LookupError:
1365
768
            pass
1366
 
        if hasattr(DBusObjectWithProperties, "__del__"):
 
769
        if hasattr(DBusObjectWithProperties, u"__del__"):
1367
770
            DBusObjectWithProperties.__del__(self, *args, **kwargs)
1368
771
        Client.__del__(self, *args, **kwargs)
1369
772
    
1370
 
    def checker_callback(self, source, condition,
1371
 
                         connection, command, *args, **kwargs):
1372
 
        ret = Client.checker_callback(self, source, condition,
1373
 
                                      connection, command, *args,
1374
 
                                      **kwargs)
1375
 
        exitstatus = self.last_checker_status
1376
 
        if exitstatus >= 0:
 
773
    def checker_callback(self, pid, condition, command,
 
774
                         *args, **kwargs):
 
775
        self.checker_callback_tag = None
 
776
        self.checker = None
 
777
        # Emit D-Bus signal
 
778
        self.PropertyChanged(dbus.String(u"CheckerRunning"),
 
779
                             dbus.Boolean(False, variant_level=1))
 
780
        if os.WIFEXITED(condition):
 
781
            exitstatus = os.WEXITSTATUS(condition)
1377
782
            # Emit D-Bus signal
1378
783
            self.CheckerCompleted(dbus.Int16(exitstatus),
1379
 
                                  dbus.Int64(0),
 
784
                                  dbus.Int64(condition),
1380
785
                                  dbus.String(command))
1381
786
        else:
1382
787
            # Emit D-Bus signal
1383
788
            self.CheckerCompleted(dbus.Int16(-1),
1384
 
                                  dbus.Int64(
1385
 
                                      self.last_checker_signal),
 
789
                                  dbus.Int64(condition),
1386
790
                                  dbus.String(command))
1387
 
        return ret
 
791
        
 
792
        return Client.checker_callback(self, pid, condition, command,
 
793
                                       *args, **kwargs)
 
794
    
 
795
    def checked_ok(self, *args, **kwargs):
 
796
        r = Client.checked_ok(self, *args, **kwargs)
 
797
        # Emit D-Bus signal
 
798
        self.PropertyChanged(
 
799
            dbus.String(u"LastCheckedOK"),
 
800
            (self._datetime_to_dbus(self.last_checked_ok,
 
801
                                    variant_level=1)))
 
802
        return r
1388
803
    
1389
804
    def start_checker(self, *args, **kwargs):
1390
 
        old_checker_pid = getattr(self.checker, "pid", None)
 
805
        old_checker = self.checker
 
806
        if self.checker is not None:
 
807
            old_checker_pid = self.checker.pid
 
808
        else:
 
809
            old_checker_pid = None
1391
810
        r = Client.start_checker(self, *args, **kwargs)
1392
811
        # Only if new checker process was started
1393
812
        if (self.checker is not None
1394
813
            and old_checker_pid != self.checker.pid):
1395
814
            # Emit D-Bus signal
1396
815
            self.CheckerStarted(self.current_checker_command)
 
816
            self.PropertyChanged(
 
817
                dbus.String(u"CheckerRunning"),
 
818
                dbus.Boolean(True, variant_level=1))
1397
819
        return r
1398
820
    
 
821
    def stop_checker(self, *args, **kwargs):
 
822
        old_checker = getattr(self, u"checker", None)
 
823
        r = Client.stop_checker(self, *args, **kwargs)
 
824
        if (old_checker is not None
 
825
            and getattr(self, u"checker", None) is None):
 
826
            self.PropertyChanged(dbus.String(u"CheckerRunning"),
 
827
                                 dbus.Boolean(False, variant_level=1))
 
828
        return r
 
829
 
1399
830
    def _reset_approved(self):
1400
 
        self.approved = None
 
831
        self._approved = None
1401
832
        return False
1402
833
    
1403
834
    def approve(self, value=True):
1404
 
        self.approved = value
1405
 
        gobject.timeout_add(int(self.approval_duration.total_seconds()
1406
 
                                * 1000), self._reset_approved)
1407
835
        self.send_changedstate()
 
836
        self._approved = value
 
837
        gobject.timeout_add(self._timedelta_to_milliseconds
 
838
                            (self.approval_duration),
 
839
                            self._reset_approved)
 
840
    
1408
841
    
1409
842
    ## D-Bus methods, signals & properties
1410
 
    
1411
 
    ## Interfaces
 
843
    _interface = u"se.bsnet.fukt.Mandos.Client"
1412
844
    
1413
845
    ## Signals
1414
846
    
1415
847
    # CheckerCompleted - signal
1416
 
    @dbus.service.signal(_interface, signature="nxs")
 
848
    @dbus.service.signal(_interface, signature=u"nxs")
1417
849
    def CheckerCompleted(self, exitcode, waitstatus, command):
1418
850
        "D-Bus signal"
1419
851
        pass
1420
852
    
1421
853
    # CheckerStarted - signal
1422
 
    @dbus.service.signal(_interface, signature="s")
 
854
    @dbus.service.signal(_interface, signature=u"s")
1423
855
    def CheckerStarted(self, command):
1424
856
        "D-Bus signal"
1425
857
        pass
1426
858
    
1427
859
    # PropertyChanged - signal
1428
 
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1429
 
    @dbus.service.signal(_interface, signature="sv")
 
860
    @dbus.service.signal(_interface, signature=u"sv")
1430
861
    def PropertyChanged(self, property, value):
1431
862
        "D-Bus signal"
1432
863
        pass
1441
872
        pass
1442
873
    
1443
874
    # Rejected - signal
1444
 
    @dbus.service.signal(_interface, signature="s")
 
875
    @dbus.service.signal(_interface, signature=u"s")
1445
876
    def Rejected(self, reason):
1446
877
        "D-Bus signal"
1447
878
        pass
1448
879
    
1449
880
    # NeedApproval - signal
1450
 
    @dbus.service.signal(_interface, signature="tb")
 
881
    @dbus.service.signal(_interface, signature=u"tb")
1451
882
    def NeedApproval(self, timeout, default):
1452
883
        "D-Bus signal"
1453
 
        return self.need_approval()
 
884
        pass
1454
885
    
1455
886
    ## Methods
1456
 
    
 
887
 
1457
888
    # Approve - method
1458
 
    @dbus.service.method(_interface, in_signature="b")
 
889
    @dbus.service.method(_interface, in_signature=u"b")
1459
890
    def Approve(self, value):
1460
891
        self.approve(value)
1461
 
    
 
892
 
1462
893
    # CheckedOK - method
1463
894
    @dbus.service.method(_interface)
1464
895
    def CheckedOK(self):
1465
 
        self.checked_ok()
 
896
        return self.checked_ok()
1466
897
    
1467
898
    # Enable - method
1468
899
    @dbus.service.method(_interface)
1490
921
    ## Properties
1491
922
    
1492
923
    # ApprovalPending - property
1493
 
    @dbus_service_property(_interface, signature="b", access="read")
 
924
    @dbus_service_property(_interface, signature=u"b", access=u"read")
1494
925
    def ApprovalPending_dbus_property(self):
1495
926
        return dbus.Boolean(bool(self.approvals_pending))
1496
927
    
1497
928
    # ApprovedByDefault - property
1498
 
    @dbus_service_property(_interface,
1499
 
                           signature="b",
1500
 
                           access="readwrite")
 
929
    @dbus_service_property(_interface, signature=u"b",
 
930
                           access=u"readwrite")
1501
931
    def ApprovedByDefault_dbus_property(self, value=None):
1502
932
        if value is None:       # get
1503
933
            return dbus.Boolean(self.approved_by_default)
1504
934
        self.approved_by_default = bool(value)
 
935
        # Emit D-Bus signal
 
936
        self.PropertyChanged(dbus.String(u"ApprovedByDefault"),
 
937
                             dbus.Boolean(value, variant_level=1))
1505
938
    
1506
939
    # ApprovalDelay - property
1507
 
    @dbus_service_property(_interface,
1508
 
                           signature="t",
1509
 
                           access="readwrite")
 
940
    @dbus_service_property(_interface, signature=u"t",
 
941
                           access=u"readwrite")
1510
942
    def ApprovalDelay_dbus_property(self, value=None):
1511
943
        if value is None:       # get
1512
 
            return dbus.UInt64(self.approval_delay.total_seconds()
1513
 
                               * 1000)
 
944
            return dbus.UInt64(self.approval_delay_milliseconds())
1514
945
        self.approval_delay = datetime.timedelta(0, 0, 0, value)
 
946
        # Emit D-Bus signal
 
947
        self.PropertyChanged(dbus.String(u"ApprovalDelay"),
 
948
                             dbus.UInt64(value, variant_level=1))
1515
949
    
1516
950
    # ApprovalDuration - property
1517
 
    @dbus_service_property(_interface,
1518
 
                           signature="t",
1519
 
                           access="readwrite")
 
951
    @dbus_service_property(_interface, signature=u"t",
 
952
                           access=u"readwrite")
1520
953
    def ApprovalDuration_dbus_property(self, value=None):
1521
954
        if value is None:       # get
1522
 
            return dbus.UInt64(self.approval_duration.total_seconds()
1523
 
                               * 1000)
 
955
            return dbus.UInt64(self._timedelta_to_milliseconds(
 
956
                    self.approval_duration))
1524
957
        self.approval_duration = datetime.timedelta(0, 0, 0, value)
 
958
        # Emit D-Bus signal
 
959
        self.PropertyChanged(dbus.String(u"ApprovalDuration"),
 
960
                             dbus.UInt64(value, variant_level=1))
1525
961
    
1526
962
    # Name - property
1527
 
    @dbus_service_property(_interface, signature="s", access="read")
 
963
    @dbus_service_property(_interface, signature=u"s", access=u"read")
1528
964
    def Name_dbus_property(self):
1529
965
        return dbus.String(self.name)
1530
966
    
1531
967
    # Fingerprint - property
1532
 
    @dbus_service_property(_interface, signature="s", access="read")
 
968
    @dbus_service_property(_interface, signature=u"s", access=u"read")
1533
969
    def Fingerprint_dbus_property(self):
1534
970
        return dbus.String(self.fingerprint)
1535
971
    
1536
972
    # Host - property
1537
 
    @dbus_service_property(_interface,
1538
 
                           signature="s",
1539
 
                           access="readwrite")
 
973
    @dbus_service_property(_interface, signature=u"s",
 
974
                           access=u"readwrite")
1540
975
    def Host_dbus_property(self, value=None):
1541
976
        if value is None:       # get
1542
977
            return dbus.String(self.host)
1543
 
        self.host = str(value)
 
978
        self.host = value
 
979
        # Emit D-Bus signal
 
980
        self.PropertyChanged(dbus.String(u"Host"),
 
981
                             dbus.String(value, variant_level=1))
1544
982
    
1545
983
    # Created - property
1546
 
    @dbus_service_property(_interface, signature="s", access="read")
 
984
    @dbus_service_property(_interface, signature=u"s", access=u"read")
1547
985
    def Created_dbus_property(self):
1548
 
        return datetime_to_dbus(self.created)
 
986
        return dbus.String(self._datetime_to_dbus(self.created))
1549
987
    
1550
988
    # LastEnabled - property
1551
 
    @dbus_service_property(_interface, signature="s", access="read")
 
989
    @dbus_service_property(_interface, signature=u"s", access=u"read")
1552
990
    def LastEnabled_dbus_property(self):
1553
 
        return datetime_to_dbus(self.last_enabled)
 
991
        if self.last_enabled is None:
 
992
            return dbus.String(u"")
 
993
        return dbus.String(self._datetime_to_dbus(self.last_enabled))
1554
994
    
1555
995
    # Enabled - property
1556
 
    @dbus_service_property(_interface,
1557
 
                           signature="b",
1558
 
                           access="readwrite")
 
996
    @dbus_service_property(_interface, signature=u"b",
 
997
                           access=u"readwrite")
1559
998
    def Enabled_dbus_property(self, value=None):
1560
999
        if value is None:       # get
1561
1000
            return dbus.Boolean(self.enabled)
1565
1004
            self.disable()
1566
1005
    
1567
1006
    # LastCheckedOK - property
1568
 
    @dbus_service_property(_interface,
1569
 
                           signature="s",
1570
 
                           access="readwrite")
 
1007
    @dbus_service_property(_interface, signature=u"s",
 
1008
                           access=u"readwrite")
1571
1009
    def LastCheckedOK_dbus_property(self, value=None):
1572
1010
        if value is not None:
1573
1011
            self.checked_ok()
1574
1012
            return
1575
 
        return datetime_to_dbus(self.last_checked_ok)
1576
 
    
1577
 
    # LastCheckerStatus - property
1578
 
    @dbus_service_property(_interface, signature="n", access="read")
1579
 
    def LastCheckerStatus_dbus_property(self):
1580
 
        return dbus.Int16(self.last_checker_status)
1581
 
    
1582
 
    # Expires - property
1583
 
    @dbus_service_property(_interface, signature="s", access="read")
1584
 
    def Expires_dbus_property(self):
1585
 
        return datetime_to_dbus(self.expires)
1586
 
    
1587
 
    # LastApprovalRequest - property
1588
 
    @dbus_service_property(_interface, signature="s", access="read")
1589
 
    def LastApprovalRequest_dbus_property(self):
1590
 
        return datetime_to_dbus(self.last_approval_request)
 
1013
        if self.last_checked_ok is None:
 
1014
            return dbus.String(u"")
 
1015
        return dbus.String(self._datetime_to_dbus(self
 
1016
                                                  .last_checked_ok))
1591
1017
    
1592
1018
    # Timeout - property
1593
 
    @dbus_service_property(_interface,
1594
 
                           signature="t",
1595
 
                           access="readwrite")
 
1019
    @dbus_service_property(_interface, signature=u"t",
 
1020
                           access=u"readwrite")
1596
1021
    def Timeout_dbus_property(self, value=None):
1597
1022
        if value is None:       # get
1598
 
            return dbus.UInt64(self.timeout.total_seconds() * 1000)
1599
 
        old_timeout = self.timeout
 
1023
            return dbus.UInt64(self.timeout_milliseconds())
1600
1024
        self.timeout = datetime.timedelta(0, 0, 0, value)
1601
 
        # Reschedule disabling
1602
 
        if self.enabled:
1603
 
            now = datetime.datetime.utcnow()
1604
 
            self.expires += self.timeout - old_timeout
1605
 
            if self.expires <= now:
1606
 
                # The timeout has passed
1607
 
                self.disable()
1608
 
            else:
1609
 
                if (getattr(self, "disable_initiator_tag", None)
1610
 
                    is None):
1611
 
                    return
1612
 
                gobject.source_remove(self.disable_initiator_tag)
1613
 
                self.disable_initiator_tag = gobject.timeout_add(
1614
 
                    int((self.expires - now).total_seconds() * 1000),
1615
 
                    self.disable)
1616
 
    
1617
 
    # ExtendedTimeout - property
1618
 
    @dbus_service_property(_interface,
1619
 
                           signature="t",
1620
 
                           access="readwrite")
1621
 
    def ExtendedTimeout_dbus_property(self, value=None):
1622
 
        if value is None:       # get
1623
 
            return dbus.UInt64(self.extended_timeout.total_seconds()
1624
 
                               * 1000)
1625
 
        self.extended_timeout = datetime.timedelta(0, 0, 0, value)
 
1025
        # Emit D-Bus signal
 
1026
        self.PropertyChanged(dbus.String(u"Timeout"),
 
1027
                             dbus.UInt64(value, variant_level=1))
 
1028
        if getattr(self, u"disable_initiator_tag", None) is None:
 
1029
            return
 
1030
        # Reschedule timeout
 
1031
        gobject.source_remove(self.disable_initiator_tag)
 
1032
        self.disable_initiator_tag = None
 
1033
        time_to_die = (self.
 
1034
                       _timedelta_to_milliseconds((self
 
1035
                                                   .last_checked_ok
 
1036
                                                   + self.timeout)
 
1037
                                                  - datetime.datetime
 
1038
                                                  .utcnow()))
 
1039
        if time_to_die <= 0:
 
1040
            # The timeout has passed
 
1041
            self.disable()
 
1042
        else:
 
1043
            self.disable_initiator_tag = (gobject.timeout_add
 
1044
                                          (time_to_die, self.disable))
1626
1045
    
1627
1046
    # Interval - property
1628
 
    @dbus_service_property(_interface,
1629
 
                           signature="t",
1630
 
                           access="readwrite")
 
1047
    @dbus_service_property(_interface, signature=u"t",
 
1048
                           access=u"readwrite")
1631
1049
    def Interval_dbus_property(self, value=None):
1632
1050
        if value is None:       # get
1633
 
            return dbus.UInt64(self.interval.total_seconds() * 1000)
 
1051
            return dbus.UInt64(self.interval_milliseconds())
1634
1052
        self.interval = datetime.timedelta(0, 0, 0, value)
1635
 
        if getattr(self, "checker_initiator_tag", None) is None:
 
1053
        # Emit D-Bus signal
 
1054
        self.PropertyChanged(dbus.String(u"Interval"),
 
1055
                             dbus.UInt64(value, variant_level=1))
 
1056
        if getattr(self, u"checker_initiator_tag", None) is None:
1636
1057
            return
1637
 
        if self.enabled:
1638
 
            # Reschedule checker run
1639
 
            gobject.source_remove(self.checker_initiator_tag)
1640
 
            self.checker_initiator_tag = gobject.timeout_add(
1641
 
                value, self.start_checker)
1642
 
            self.start_checker() # Start one now, too
1643
 
    
 
1058
        # Reschedule checker run
 
1059
        gobject.source_remove(self.checker_initiator_tag)
 
1060
        self.checker_initiator_tag = (gobject.timeout_add
 
1061
                                      (value, self.start_checker))
 
1062
        self.start_checker()    # Start one now, too
 
1063
 
1644
1064
    # Checker - property
1645
 
    @dbus_service_property(_interface,
1646
 
                           signature="s",
1647
 
                           access="readwrite")
 
1065
    @dbus_service_property(_interface, signature=u"s",
 
1066
                           access=u"readwrite")
1648
1067
    def Checker_dbus_property(self, value=None):
1649
1068
        if value is None:       # get
1650
1069
            return dbus.String(self.checker_command)
1651
 
        self.checker_command = str(value)
 
1070
        self.checker_command = value
 
1071
        # Emit D-Bus signal
 
1072
        self.PropertyChanged(dbus.String(u"Checker"),
 
1073
                             dbus.String(self.checker_command,
 
1074
                                         variant_level=1))
1652
1075
    
1653
1076
    # CheckerRunning - property
1654
 
    @dbus_service_property(_interface,
1655
 
                           signature="b",
1656
 
                           access="readwrite")
 
1077
    @dbus_service_property(_interface, signature=u"b",
 
1078
                           access=u"readwrite")
1657
1079
    def CheckerRunning_dbus_property(self, value=None):
1658
1080
        if value is None:       # get
1659
1081
            return dbus.Boolean(self.checker is not None)
1663
1085
            self.stop_checker()
1664
1086
    
1665
1087
    # ObjectPath - property
1666
 
    @dbus_service_property(_interface, signature="o", access="read")
 
1088
    @dbus_service_property(_interface, signature=u"o", access=u"read")
1667
1089
    def ObjectPath_dbus_property(self):
1668
1090
        return self.dbus_object_path # is already a dbus.ObjectPath
1669
1091
    
1670
1092
    # Secret = property
1671
 
    @dbus_service_property(_interface,
1672
 
                           signature="ay",
1673
 
                           access="write",
1674
 
                           byte_arrays=True)
 
1093
    @dbus_service_property(_interface, signature=u"ay",
 
1094
                           access=u"write", byte_arrays=True)
1675
1095
    def Secret_dbus_property(self, value):
1676
 
        self.secret = bytes(value)
 
1096
        self.secret = str(value)
1677
1097
    
1678
1098
    del _interface
1679
1099
 
1683
1103
        self._pipe = child_pipe
1684
1104
        self._pipe.send(('init', fpr, address))
1685
1105
        if not self._pipe.recv():
1686
 
            raise KeyError(fpr)
1687
 
    
 
1106
            raise KeyError()
 
1107
 
1688
1108
    def __getattribute__(self, name):
1689
 
        if name == '_pipe':
 
1109
        if(name == '_pipe'):
1690
1110
            return super(ProxyClient, self).__getattribute__(name)
1691
1111
        self._pipe.send(('getattr', name))
1692
1112
        data = self._pipe.recv()
1693
1113
        if data[0] == 'data':
1694
1114
            return data[1]
1695
1115
        if data[0] == 'function':
1696
 
            
1697
1116
            def func(*args, **kwargs):
1698
1117
                self._pipe.send(('funcall', name, args, kwargs))
1699
1118
                return self._pipe.recv()[1]
1700
 
            
1701
1119
            return func
1702
 
    
 
1120
 
1703
1121
    def __setattr__(self, name, value):
1704
 
        if name == '_pipe':
 
1122
        if(name == '_pipe'):
1705
1123
            return super(ProxyClient, self).__setattr__(name, value)
1706
1124
        self._pipe.send(('setattr', name, value))
1707
1125
 
1714
1132
    
1715
1133
    def handle(self):
1716
1134
        with contextlib.closing(self.server.child_pipe) as child_pipe:
1717
 
            logger.info("TCP connection from: %s",
1718
 
                        str(self.client_address))
1719
 
            logger.debug("Pipe FD: %d",
 
1135
            logger.info(u"TCP connection from: %s",
 
1136
                        unicode(self.client_address))
 
1137
            logger.debug(u"Pipe FD: %d",
1720
1138
                         self.server.child_pipe.fileno())
1721
 
            
1722
 
            session = gnutls.connection.ClientSession(
1723
 
                self.request, gnutls.connection .X509Credentials())
1724
 
            
 
1139
 
 
1140
            session = (gnutls.connection
 
1141
                       .ClientSession(self.request,
 
1142
                                      gnutls.connection
 
1143
                                      .X509Credentials()))
 
1144
 
1725
1145
            # Note: gnutls.connection.X509Credentials is really a
1726
1146
            # generic GnuTLS certificate credentials object so long as
1727
1147
            # no X.509 keys are added to it.  Therefore, we can use it
1728
1148
            # here despite using OpenPGP certificates.
1729
 
            
1730
 
            #priority = ':'.join(("NONE", "+VERS-TLS1.1",
1731
 
            #                      "+AES-256-CBC", "+SHA1",
1732
 
            #                      "+COMP-NULL", "+CTYPE-OPENPGP",
1733
 
            #                      "+DHE-DSS"))
 
1149
 
 
1150
            #priority = u':'.join((u"NONE", u"+VERS-TLS1.1",
 
1151
            #                      u"+AES-256-CBC", u"+SHA1",
 
1152
            #                      u"+COMP-NULL", u"+CTYPE-OPENPGP",
 
1153
            #                      u"+DHE-DSS"))
1734
1154
            # Use a fallback default, since this MUST be set.
1735
1155
            priority = self.server.gnutls_priority
1736
1156
            if priority is None:
1737
 
                priority = "NORMAL"
1738
 
            gnutls.library.functions.gnutls_priority_set_direct(
1739
 
                session._c_object, priority, None)
1740
 
            
 
1157
                priority = u"NORMAL"
 
1158
            (gnutls.library.functions
 
1159
             .gnutls_priority_set_direct(session._c_object,
 
1160
                                         priority, None))
 
1161
 
1741
1162
            # Start communication using the Mandos protocol
1742
1163
            # Get protocol number
1743
1164
            line = self.request.makefile().readline()
1744
 
            logger.debug("Protocol version: %r", line)
 
1165
            logger.debug(u"Protocol version: %r", line)
1745
1166
            try:
1746
1167
                if int(line.strip().split()[0]) > 1:
1747
 
                    raise RuntimeError(line)
1748
 
            except (ValueError, IndexError, RuntimeError) as error:
1749
 
                logger.error("Unknown protocol version: %s", error)
 
1168
                    raise RuntimeError
 
1169
            except (ValueError, IndexError, RuntimeError), error:
 
1170
                logger.error(u"Unknown protocol version: %s", error)
1750
1171
                return
1751
 
            
 
1172
 
1752
1173
            # Start GnuTLS connection
1753
1174
            try:
1754
1175
                session.handshake()
1755
 
            except gnutls.errors.GNUTLSError as error:
1756
 
                logger.warning("Handshake failed: %s", error)
 
1176
            except gnutls.errors.GNUTLSError, error:
 
1177
                logger.warning(u"Handshake failed: %s", error)
1757
1178
                # Do not run session.bye() here: the session is not
1758
1179
                # established.  Just abandon the request.
1759
1180
                return
1760
 
            logger.debug("Handshake succeeded")
1761
 
            
 
1181
            logger.debug(u"Handshake succeeded")
 
1182
 
1762
1183
            approval_required = False
1763
1184
            try:
1764
1185
                try:
1765
 
                    fpr = self.fingerprint(
1766
 
                        self.peer_certificate(session))
1767
 
                except (TypeError,
1768
 
                        gnutls.errors.GNUTLSError) as error:
1769
 
                    logger.warning("Bad certificate: %s", error)
 
1186
                    fpr = self.fingerprint(self.peer_certificate
 
1187
                                           (session))
 
1188
                except (TypeError, gnutls.errors.GNUTLSError), error:
 
1189
                    logger.warning(u"Bad certificate: %s", error)
1770
1190
                    return
1771
 
                logger.debug("Fingerprint: %s", fpr)
1772
 
                
 
1191
                logger.debug(u"Fingerprint: %s", fpr)
 
1192
 
1773
1193
                try:
1774
1194
                    client = ProxyClient(child_pipe, fpr,
1775
1195
                                         self.client_address)
1783
1203
                
1784
1204
                while True:
1785
1205
                    if not client.enabled:
1786
 
                        logger.info("Client %s is disabled",
1787
 
                                    client.name)
 
1206
                        logger.warning(u"Client %s is disabled",
 
1207
                                       client.name)
1788
1208
                        if self.server.use_dbus:
1789
1209
                            # Emit D-Bus signal
1790
 
                            client.Rejected("Disabled")
 
1210
                            client.Rejected("Disabled")                    
1791
1211
                        return
1792
1212
                    
1793
 
                    if client.approved or not client.approval_delay:
 
1213
                    if client._approved or not client.approval_delay:
1794
1214
                        #We are approved or approval is disabled
1795
1215
                        break
1796
 
                    elif client.approved is None:
1797
 
                        logger.info("Client %s needs approval",
 
1216
                    elif client._approved is None:
 
1217
                        logger.info(u"Client %s needs approval",
1798
1218
                                    client.name)
1799
1219
                        if self.server.use_dbus:
1800
1220
                            # Emit D-Bus signal
1801
1221
                            client.NeedApproval(
1802
 
                                client.approval_delay.total_seconds()
1803
 
                                * 1000, client.approved_by_default)
 
1222
                                client.approval_delay_milliseconds(),
 
1223
                                client.approved_by_default)
1804
1224
                    else:
1805
 
                        logger.warning("Client %s was not approved",
 
1225
                        logger.warning(u"Client %s was not approved",
1806
1226
                                       client.name)
1807
1227
                        if self.server.use_dbus:
1808
1228
                            # Emit D-Bus signal
1810
1230
                        return
1811
1231
                    
1812
1232
                    #wait until timeout or approved
 
1233
                    #x = float(client._timedelta_to_milliseconds(delay))
1813
1234
                    time = datetime.datetime.now()
1814
1235
                    client.changedstate.acquire()
1815
 
                    client.changedstate.wait(delay.total_seconds())
 
1236
                    client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))
1816
1237
                    client.changedstate.release()
1817
1238
                    time2 = datetime.datetime.now()
1818
1239
                    if (time2 - time) >= delay:
1822
1243
                                           client.name)
1823
1244
                            if self.server.use_dbus:
1824
1245
                                # Emit D-Bus signal
1825
 
                                client.Rejected("Approval timed out")
 
1246
                                client.Rejected("Timed out")
1826
1247
                            return
1827
1248
                        else:
1828
1249
                            break
1833
1254
                while sent_size < len(client.secret):
1834
1255
                    try:
1835
1256
                        sent = session.send(client.secret[sent_size:])
1836
 
                    except gnutls.errors.GNUTLSError as error:
1837
 
                        logger.warning("gnutls send failed",
1838
 
                                       exc_info=error)
 
1257
                    except (gnutls.errors.GNUTLSError), error:
 
1258
                        logger.warning("gnutls send failed")
1839
1259
                        return
1840
 
                    logger.debug("Sent: %d, remaining: %d", sent,
1841
 
                                 len(client.secret) - (sent_size
1842
 
                                                       + sent))
 
1260
                    logger.debug(u"Sent: %d, remaining: %d",
 
1261
                                 sent, len(client.secret)
 
1262
                                 - (sent_size + sent))
1843
1263
                    sent_size += sent
1844
 
                
1845
 
                logger.info("Sending secret to %s", client.name)
1846
 
                # bump the timeout using extended_timeout
1847
 
                client.bump_timeout(client.extended_timeout)
 
1264
 
 
1265
                logger.info(u"Sending secret to %s", client.name)
 
1266
                # bump the timeout as if seen
 
1267
                client.checked_ok()
1848
1268
                if self.server.use_dbus:
1849
1269
                    # Emit D-Bus signal
1850
1270
                    client.GotSecret()
1854
1274
                    client.approvals_pending -= 1
1855
1275
                try:
1856
1276
                    session.bye()
1857
 
                except gnutls.errors.GNUTLSError as error:
1858
 
                    logger.warning("GnuTLS bye failed",
1859
 
                                   exc_info=error)
 
1277
                except (gnutls.errors.GNUTLSError), error:
 
1278
                    logger.warning("GnuTLS bye failed")
1860
1279
    
1861
1280
    @staticmethod
1862
1281
    def peer_certificate(session):
1863
1282
        "Return the peer's OpenPGP certificate as a bytestring"
1864
1283
        # If not an OpenPGP certificate...
1865
 
        if (gnutls.library.functions.gnutls_certificate_type_get(
1866
 
                session._c_object)
 
1284
        if (gnutls.library.functions
 
1285
            .gnutls_certificate_type_get(session._c_object)
1867
1286
            != gnutls.library.constants.GNUTLS_CRT_OPENPGP):
1868
1287
            # ...do the normal thing
1869
1288
            return session.peer_certificate
1872
1291
                     .gnutls_certificate_get_peers
1873
1292
                     (session._c_object, ctypes.byref(list_size)))
1874
1293
        if not bool(cert_list) and list_size.value != 0:
1875
 
            raise gnutls.errors.GNUTLSError("error getting peer"
1876
 
                                            " certificate")
 
1294
            raise gnutls.errors.GNUTLSError(u"error getting peer"
 
1295
                                            u" certificate")
1877
1296
        if list_size.value == 0:
1878
1297
            return None
1879
1298
        cert = cert_list[0]
1883
1302
    def fingerprint(openpgp):
1884
1303
        "Convert an OpenPGP bytestring to a hexdigit fingerprint"
1885
1304
        # New GnuTLS "datum" with the OpenPGP public key
1886
 
        datum = gnutls.library.types.gnutls_datum_t(
1887
 
            ctypes.cast(ctypes.c_char_p(openpgp),
1888
 
                        ctypes.POINTER(ctypes.c_ubyte)),
1889
 
            ctypes.c_uint(len(openpgp)))
 
1305
        datum = (gnutls.library.types
 
1306
                 .gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
 
1307
                                             ctypes.POINTER
 
1308
                                             (ctypes.c_ubyte)),
 
1309
                                 ctypes.c_uint(len(openpgp))))
1890
1310
        # New empty GnuTLS certificate
1891
1311
        crt = gnutls.library.types.gnutls_openpgp_crt_t()
1892
 
        gnutls.library.functions.gnutls_openpgp_crt_init(
1893
 
            ctypes.byref(crt))
 
1312
        (gnutls.library.functions
 
1313
         .gnutls_openpgp_crt_init(ctypes.byref(crt)))
1894
1314
        # Import the OpenPGP public key into the certificate
1895
 
        gnutls.library.functions.gnutls_openpgp_crt_import(
1896
 
            crt, ctypes.byref(datum),
1897
 
            gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
 
1315
        (gnutls.library.functions
 
1316
         .gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
 
1317
                                    gnutls.library.constants
 
1318
                                    .GNUTLS_OPENPGP_FMT_RAW))
1898
1319
        # Verify the self signature in the key
1899
1320
        crtverify = ctypes.c_uint()
1900
 
        gnutls.library.functions.gnutls_openpgp_crt_verify_self(
1901
 
            crt, 0, ctypes.byref(crtverify))
 
1321
        (gnutls.library.functions
 
1322
         .gnutls_openpgp_crt_verify_self(crt, 0,
 
1323
                                         ctypes.byref(crtverify)))
1902
1324
        if crtverify.value != 0:
1903
1325
            gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1904
 
            raise gnutls.errors.CertificateSecurityError(
1905
 
                "Verify failed")
 
1326
            raise (gnutls.errors.CertificateSecurityError
 
1327
                   (u"Verify failed"))
1906
1328
        # New buffer for the fingerprint
1907
1329
        buf = ctypes.create_string_buffer(20)
1908
1330
        buf_len = ctypes.c_size_t()
1909
1331
        # Get the fingerprint from the certificate into the buffer
1910
 
        gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint(
1911
 
            crt, ctypes.byref(buf), ctypes.byref(buf_len))
 
1332
        (gnutls.library.functions
 
1333
         .gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
 
1334
                                             ctypes.byref(buf_len)))
1912
1335
        # Deinit the certificate
1913
1336
        gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1914
1337
        # Convert the buffer to a Python bytestring
1915
1338
        fpr = ctypes.string_at(buf, buf_len.value)
1916
1339
        # Convert the bytestring to hexadecimal notation
1917
 
        hex_fpr = binascii.hexlify(fpr).upper()
 
1340
        hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
1918
1341
        return hex_fpr
1919
1342
 
1920
1343
 
1921
1344
class MultiprocessingMixIn(object):
1922
1345
    """Like socketserver.ThreadingMixIn, but with multiprocessing"""
1923
 
    
1924
1346
    def sub_process_main(self, request, address):
1925
1347
        try:
1926
1348
            self.finish_request(request, address)
1927
 
        except Exception:
 
1349
        except:
1928
1350
            self.handle_error(request, address)
1929
1351
        self.close_request(request)
1930
 
    
 
1352
            
1931
1353
    def process_request(self, request, address):
1932
1354
        """Start a new process to process the request."""
1933
 
        proc = multiprocessing.Process(target = self.sub_process_main,
1934
 
                                       args = (request, address))
1935
 
        proc.start()
1936
 
        return proc
1937
 
 
 
1355
        multiprocessing.Process(target = self.sub_process_main,
 
1356
                                args = (request, address)).start()
1938
1357
 
1939
1358
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
1940
1359
    """ adds a pipe to the MixIn """
1941
 
    
1942
1360
    def process_request(self, request, client_address):
1943
1361
        """Overrides and wraps the original process_request().
1944
1362
        
1945
1363
        This function creates a new pipe in self.pipe
1946
1364
        """
1947
1365
        parent_pipe, self.child_pipe = multiprocessing.Pipe()
1948
 
        
1949
 
        proc = MultiprocessingMixIn.process_request(self, request,
1950
 
                                                    client_address)
 
1366
 
 
1367
        super(MultiprocessingMixInWithPipe,
 
1368
              self).process_request(request, client_address)
1951
1369
        self.child_pipe.close()
1952
 
        self.add_pipe(parent_pipe, proc)
1953
 
    
1954
 
    def add_pipe(self, parent_pipe, proc):
 
1370
        self.add_pipe(parent_pipe)
 
1371
 
 
1372
    def add_pipe(self, parent_pipe):
1955
1373
        """Dummy function; override as necessary"""
1956
 
        raise NotImplementedError()
1957
 
 
 
1374
        pass
1958
1375
 
1959
1376
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
1960
1377
                     socketserver.TCPServer, object):
1965
1382
        interface:      None or a network interface name (string)
1966
1383
        use_ipv6:       Boolean; to use IPv6 or not
1967
1384
    """
1968
 
    
1969
1385
    def __init__(self, server_address, RequestHandlerClass,
1970
 
                 interface=None,
1971
 
                 use_ipv6=True,
1972
 
                 socketfd=None):
1973
 
        """If socketfd is set, use that file descriptor instead of
1974
 
        creating a new one with socket.socket().
1975
 
        """
 
1386
                 interface=None, use_ipv6=True):
1976
1387
        self.interface = interface
1977
1388
        if use_ipv6:
1978
1389
            self.address_family = socket.AF_INET6
1979
 
        if socketfd is not None:
1980
 
            # Save the file descriptor
1981
 
            self.socketfd = socketfd
1982
 
            # Save the original socket.socket() function
1983
 
            self.socket_socket = socket.socket
1984
 
            # To implement --socket, we monkey patch socket.socket.
1985
 
            # 
1986
 
            # (When socketserver.TCPServer is a new-style class, we
1987
 
            # could make self.socket into a property instead of monkey
1988
 
            # patching socket.socket.)
1989
 
            # 
1990
 
            # Create a one-time-only replacement for socket.socket()
1991
 
            @functools.wraps(socket.socket)
1992
 
            def socket_wrapper(*args, **kwargs):
1993
 
                # Restore original function so subsequent calls are
1994
 
                # not affected.
1995
 
                socket.socket = self.socket_socket
1996
 
                del self.socket_socket
1997
 
                # This time only, return a new socket object from the
1998
 
                # saved file descriptor.
1999
 
                return socket.fromfd(self.socketfd, *args, **kwargs)
2000
 
            # Replace socket.socket() function with wrapper
2001
 
            socket.socket = socket_wrapper
2002
 
        # The socketserver.TCPServer.__init__ will call
2003
 
        # socket.socket(), which might be our replacement,
2004
 
        # socket_wrapper(), if socketfd was set.
2005
1390
        socketserver.TCPServer.__init__(self, server_address,
2006
1391
                                        RequestHandlerClass)
2007
 
    
2008
1392
    def server_bind(self):
2009
1393
        """This overrides the normal server_bind() function
2010
1394
        to bind to an interface if one was specified, and also NOT to
2011
1395
        bind to an address or port if they were not specified."""
2012
1396
        if self.interface is not None:
2013
1397
            if SO_BINDTODEVICE is None:
2014
 
                logger.error("SO_BINDTODEVICE does not exist;"
2015
 
                             " cannot bind to interface %s",
 
1398
                logger.error(u"SO_BINDTODEVICE does not exist;"
 
1399
                             u" cannot bind to interface %s",
2016
1400
                             self.interface)
2017
1401
            else:
2018
1402
                try:
2019
 
                    self.socket.setsockopt(
2020
 
                        socket.SOL_SOCKET, SO_BINDTODEVICE,
2021
 
                        (self.interface + "\0").encode("utf-8"))
2022
 
                except socket.error as error:
2023
 
                    if error.errno == errno.EPERM:
2024
 
                        logger.error("No permission to bind to"
2025
 
                                     " interface %s", self.interface)
2026
 
                    elif error.errno == errno.ENOPROTOOPT:
2027
 
                        logger.error("SO_BINDTODEVICE not available;"
2028
 
                                     " cannot bind to interface %s",
2029
 
                                     self.interface)
2030
 
                    elif error.errno == errno.ENODEV:
2031
 
                        logger.error("Interface %s does not exist,"
2032
 
                                     " cannot bind", self.interface)
 
1403
                    self.socket.setsockopt(socket.SOL_SOCKET,
 
1404
                                           SO_BINDTODEVICE,
 
1405
                                           str(self.interface
 
1406
                                               + u'\0'))
 
1407
                except socket.error, error:
 
1408
                    if error[0] == errno.EPERM:
 
1409
                        logger.error(u"No permission to"
 
1410
                                     u" bind to interface %s",
 
1411
                                     self.interface)
 
1412
                    elif error[0] == errno.ENOPROTOOPT:
 
1413
                        logger.error(u"SO_BINDTODEVICE not available;"
 
1414
                                     u" cannot bind to interface %s",
 
1415
                                     self.interface)
2033
1416
                    else:
2034
1417
                        raise
2035
1418
        # Only bind(2) the socket if we really need to.
2036
1419
        if self.server_address[0] or self.server_address[1]:
2037
1420
            if not self.server_address[0]:
2038
1421
                if self.address_family == socket.AF_INET6:
2039
 
                    any_address = "::" # in6addr_any
 
1422
                    any_address = u"::" # in6addr_any
2040
1423
                else:
2041
 
                    any_address = "0.0.0.0" # INADDR_ANY
 
1424
                    any_address = socket.INADDR_ANY
2042
1425
                self.server_address = (any_address,
2043
1426
                                       self.server_address[1])
2044
1427
            elif not self.server_address[1]:
2045
 
                self.server_address = (self.server_address[0], 0)
 
1428
                self.server_address = (self.server_address[0],
 
1429
                                       0)
2046
1430
#                 if self.interface:
2047
1431
#                     self.server_address = (self.server_address[0],
2048
1432
#                                            0, # port
2062
1446
    
2063
1447
    Assumes a gobject.MainLoop event loop.
2064
1448
    """
2065
 
    
2066
1449
    def __init__(self, server_address, RequestHandlerClass,
2067
 
                 interface=None,
2068
 
                 use_ipv6=True,
2069
 
                 clients=None,
2070
 
                 gnutls_priority=None,
2071
 
                 use_dbus=True,
2072
 
                 socketfd=None):
 
1450
                 interface=None, use_ipv6=True, clients=None,
 
1451
                 gnutls_priority=None, use_dbus=True):
2073
1452
        self.enabled = False
2074
1453
        self.clients = clients
2075
1454
        if self.clients is None:
2076
 
            self.clients = {}
 
1455
            self.clients = set()
2077
1456
        self.use_dbus = use_dbus
2078
1457
        self.gnutls_priority = gnutls_priority
2079
1458
        IPv6_TCPServer.__init__(self, server_address,
2080
1459
                                RequestHandlerClass,
2081
1460
                                interface = interface,
2082
 
                                use_ipv6 = use_ipv6,
2083
 
                                socketfd = socketfd)
2084
 
    
 
1461
                                use_ipv6 = use_ipv6)
2085
1462
    def server_activate(self):
2086
1463
        if self.enabled:
2087
1464
            return socketserver.TCPServer.server_activate(self)
2088
 
    
2089
1465
    def enable(self):
2090
1466
        self.enabled = True
2091
 
    
2092
 
    def add_pipe(self, parent_pipe, proc):
 
1467
    def add_pipe(self, parent_pipe):
2093
1468
        # Call "handle_ipc" for both data and EOF events
2094
 
        gobject.io_add_watch(
2095
 
            parent_pipe.fileno(),
2096
 
            gobject.IO_IN | gobject.IO_HUP,
2097
 
            functools.partial(self.handle_ipc,
2098
 
                              parent_pipe = parent_pipe,
2099
 
                              proc = proc))
2100
 
    
2101
 
    def handle_ipc(self, source, condition,
2102
 
                   parent_pipe=None,
2103
 
                   proc = None,
 
1469
        gobject.io_add_watch(parent_pipe.fileno(),
 
1470
                             gobject.IO_IN | gobject.IO_HUP,
 
1471
                             functools.partial(self.handle_ipc,
 
1472
                                               parent_pipe = parent_pipe))
 
1473
        
 
1474
    def handle_ipc(self, source, condition, parent_pipe=None,
2104
1475
                   client_object=None):
2105
 
        # error, or the other end of multiprocessing.Pipe has closed
2106
 
        if condition & (gobject.IO_ERR | gobject.IO_HUP):
2107
 
            # Wait for other process to exit
2108
 
            proc.join()
 
1476
        condition_names = {
 
1477
            gobject.IO_IN: u"IN",   # There is data to read.
 
1478
            gobject.IO_OUT: u"OUT", # Data can be written (without
 
1479
                                    # blocking).
 
1480
            gobject.IO_PRI: u"PRI", # There is urgent data to read.
 
1481
            gobject.IO_ERR: u"ERR", # Error condition.
 
1482
            gobject.IO_HUP: u"HUP"  # Hung up (the connection has been
 
1483
                                    # broken, usually for pipes and
 
1484
                                    # sockets).
 
1485
            }
 
1486
        conditions_string = ' | '.join(name
 
1487
                                       for cond, name in
 
1488
                                       condition_names.iteritems()
 
1489
                                       if cond & condition)
 
1490
        logger.debug(u"Handling IPC: FD = %d, condition = %s", source,
 
1491
                     conditions_string)
 
1492
 
 
1493
        # error or the other end of multiprocessing.Pipe has closed
 
1494
        if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):
2109
1495
            return False
2110
1496
        
2111
1497
        # Read a request from the child
2112
1498
        request = parent_pipe.recv()
 
1499
        logger.debug(u"IPC request: %s", repr(request))
2113
1500
        command = request[0]
2114
1501
        
2115
1502
        if command == 'init':
2116
1503
            fpr = request[1]
2117
1504
            address = request[2]
2118
1505
            
2119
 
            for c in self.clients.itervalues():
 
1506
            for c in self.clients:
2120
1507
                if c.fingerprint == fpr:
2121
1508
                    client = c
2122
1509
                    break
2123
1510
            else:
2124
 
                logger.info("Client not found for fingerprint: %s, ad"
2125
 
                            "dress: %s", fpr, address)
 
1511
                logger.warning(u"Client not found for fingerprint: %s, ad"
 
1512
                               u"dress: %s", fpr, address)
2126
1513
                if self.use_dbus:
2127
1514
                    # Emit D-Bus signal
2128
 
                    mandos_dbus_service.ClientNotFound(fpr,
2129
 
                                                       address[0])
 
1515
                    mandos_dbus_service.ClientNotFound(fpr, address)
2130
1516
                parent_pipe.send(False)
2131
1517
                return False
2132
1518
            
2133
 
            gobject.io_add_watch(
2134
 
                parent_pipe.fileno(),
2135
 
                gobject.IO_IN | gobject.IO_HUP,
2136
 
                functools.partial(self.handle_ipc,
2137
 
                                  parent_pipe = parent_pipe,
2138
 
                                  proc = proc,
2139
 
                                  client_object = client))
 
1519
            gobject.io_add_watch(parent_pipe.fileno(),
 
1520
                                 gobject.IO_IN | gobject.IO_HUP,
 
1521
                                 functools.partial(self.handle_ipc,
 
1522
                                                   parent_pipe = parent_pipe,
 
1523
                                                   client_object = client))
2140
1524
            parent_pipe.send(True)
2141
 
            # remove the old hook in favor of the new above hook on
2142
 
            # same fileno
 
1525
            # remove the old hook in favor of the new above hook on same fileno
2143
1526
            return False
2144
1527
        if command == 'funcall':
2145
1528
            funcname = request[1]
2146
1529
            args = request[2]
2147
1530
            kwargs = request[3]
2148
1531
            
2149
 
            parent_pipe.send(('data', getattr(client_object,
2150
 
                                              funcname)(*args,
2151
 
                                                        **kwargs)))
2152
 
        
 
1532
            parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))
 
1533
 
2153
1534
        if command == 'getattr':
2154
1535
            attrname = request[1]
2155
 
            if isinstance(client_object.__getattribute__(attrname),
2156
 
                          collections.Callable):
2157
 
                parent_pipe.send(('function', ))
 
1536
            if callable(client_object.__getattribute__(attrname)):
 
1537
                parent_pipe.send(('function',))
2158
1538
            else:
2159
 
                parent_pipe.send((
2160
 
                    'data', client_object.__getattribute__(attrname)))
 
1539
                parent_pipe.send(('data', client_object.__getattribute__(attrname)))
2161
1540
        
2162
1541
        if command == 'setattr':
2163
1542
            attrname = request[1]
2164
1543
            value = request[2]
2165
1544
            setattr(client_object, attrname, value)
2166
 
        
 
1545
 
2167
1546
        return True
2168
1547
 
2169
1548
 
2170
 
def rfc3339_duration_to_delta(duration):
2171
 
    """Parse an RFC 3339 "duration" and return a datetime.timedelta
2172
 
    
2173
 
    >>> rfc3339_duration_to_delta("P7D")
2174
 
    datetime.timedelta(7)
2175
 
    >>> rfc3339_duration_to_delta("PT60S")
2176
 
    datetime.timedelta(0, 60)
2177
 
    >>> rfc3339_duration_to_delta("PT60M")
2178
 
    datetime.timedelta(0, 3600)
2179
 
    >>> rfc3339_duration_to_delta("PT24H")
2180
 
    datetime.timedelta(1)
2181
 
    >>> rfc3339_duration_to_delta("P1W")
2182
 
    datetime.timedelta(7)
2183
 
    >>> rfc3339_duration_to_delta("PT5M30S")
2184
 
    datetime.timedelta(0, 330)
2185
 
    >>> rfc3339_duration_to_delta("P1DT3M20S")
2186
 
    datetime.timedelta(1, 200)
2187
 
    """
2188
 
    
2189
 
    # Parsing an RFC 3339 duration with regular expressions is not
2190
 
    # possible - there would have to be multiple places for the same
2191
 
    # values, like seconds.  The current code, while more esoteric, is
2192
 
    # cleaner without depending on a parsing library.  If Python had a
2193
 
    # built-in library for parsing we would use it, but we'd like to
2194
 
    # avoid excessive use of external libraries.
2195
 
    
2196
 
    # New type for defining tokens, syntax, and semantics all-in-one
2197
 
    Token = collections.namedtuple("Token", (
2198
 
        "regexp",  # To match token; if "value" is not None, must have
2199
 
                   # a "group" containing digits
2200
 
        "value",   # datetime.timedelta or None
2201
 
        "followers"))           # Tokens valid after this token
2202
 
    # RFC 3339 "duration" tokens, syntax, and semantics; taken from
2203
 
    # the "duration" ABNF definition in RFC 3339, Appendix A.
2204
 
    token_end = Token(re.compile(r"$"), None, frozenset())
2205
 
    token_second = Token(re.compile(r"(\d+)S"),
2206
 
                         datetime.timedelta(seconds=1),
2207
 
                         frozenset((token_end, )))
2208
 
    token_minute = Token(re.compile(r"(\d+)M"),
2209
 
                         datetime.timedelta(minutes=1),
2210
 
                         frozenset((token_second, token_end)))
2211
 
    token_hour = Token(re.compile(r"(\d+)H"),
2212
 
                       datetime.timedelta(hours=1),
2213
 
                       frozenset((token_minute, token_end)))
2214
 
    token_time = Token(re.compile(r"T"),
2215
 
                       None,
2216
 
                       frozenset((token_hour, token_minute,
2217
 
                                  token_second)))
2218
 
    token_day = Token(re.compile(r"(\d+)D"),
2219
 
                      datetime.timedelta(days=1),
2220
 
                      frozenset((token_time, token_end)))
2221
 
    token_month = Token(re.compile(r"(\d+)M"),
2222
 
                        datetime.timedelta(weeks=4),
2223
 
                        frozenset((token_day, token_end)))
2224
 
    token_year = Token(re.compile(r"(\d+)Y"),
2225
 
                       datetime.timedelta(weeks=52),
2226
 
                       frozenset((token_month, token_end)))
2227
 
    token_week = Token(re.compile(r"(\d+)W"),
2228
 
                       datetime.timedelta(weeks=1),
2229
 
                       frozenset((token_end, )))
2230
 
    token_duration = Token(re.compile(r"P"), None,
2231
 
                           frozenset((token_year, token_month,
2232
 
                                      token_day, token_time,
2233
 
                                      token_week)))
2234
 
    # Define starting values
2235
 
    value = datetime.timedelta() # Value so far
2236
 
    found_token = None
2237
 
    followers = frozenset((token_duration, )) # Following valid tokens
2238
 
    s = duration                # String left to parse
2239
 
    # Loop until end token is found
2240
 
    while found_token is not token_end:
2241
 
        # Search for any currently valid tokens
2242
 
        for token in followers:
2243
 
            match = token.regexp.match(s)
2244
 
            if match is not None:
2245
 
                # Token found
2246
 
                if token.value is not None:
2247
 
                    # Value found, parse digits
2248
 
                    factor = int(match.group(1), 10)
2249
 
                    # Add to value so far
2250
 
                    value += factor * token.value
2251
 
                # Strip token from string
2252
 
                s = token.regexp.sub("", s, 1)
2253
 
                # Go to found token
2254
 
                found_token = token
2255
 
                # Set valid next tokens
2256
 
                followers = found_token.followers
2257
 
                break
2258
 
        else:
2259
 
            # No currently valid tokens were found
2260
 
            raise ValueError("Invalid RFC 3339 duration: {!r}"
2261
 
                             .format(duration))
2262
 
    # End token found
2263
 
    return value
2264
 
 
2265
 
 
2266
1549
def string_to_delta(interval):
2267
1550
    """Parse a string and return a datetime.timedelta
2268
1551
    
2269
 
    >>> string_to_delta('7d')
 
1552
    >>> string_to_delta(u'7d')
2270
1553
    datetime.timedelta(7)
2271
 
    >>> string_to_delta('60s')
 
1554
    >>> string_to_delta(u'60s')
2272
1555
    datetime.timedelta(0, 60)
2273
 
    >>> string_to_delta('60m')
 
1556
    >>> string_to_delta(u'60m')
2274
1557
    datetime.timedelta(0, 3600)
2275
 
    >>> string_to_delta('24h')
 
1558
    >>> string_to_delta(u'24h')
2276
1559
    datetime.timedelta(1)
2277
 
    >>> string_to_delta('1w')
 
1560
    >>> string_to_delta(u'1w')
2278
1561
    datetime.timedelta(7)
2279
 
    >>> string_to_delta('5m 30s')
 
1562
    >>> string_to_delta(u'5m 30s')
2280
1563
    datetime.timedelta(0, 330)
2281
1564
    """
2282
 
    
2283
 
    try:
2284
 
        return rfc3339_duration_to_delta(interval)
2285
 
    except ValueError:
2286
 
        pass
2287
 
    
2288
1565
    timevalue = datetime.timedelta(0)
2289
1566
    for s in interval.split():
2290
1567
        try:
2291
 
            suffix = s[-1]
 
1568
            suffix = unicode(s[-1])
2292
1569
            value = int(s[:-1])
2293
 
            if suffix == "d":
 
1570
            if suffix == u"d":
2294
1571
                delta = datetime.timedelta(value)
2295
 
            elif suffix == "s":
 
1572
            elif suffix == u"s":
2296
1573
                delta = datetime.timedelta(0, value)
2297
 
            elif suffix == "m":
 
1574
            elif suffix == u"m":
2298
1575
                delta = datetime.timedelta(0, 0, 0, 0, value)
2299
 
            elif suffix == "h":
 
1576
            elif suffix == u"h":
2300
1577
                delta = datetime.timedelta(0, 0, 0, 0, 0, value)
2301
 
            elif suffix == "w":
 
1578
            elif suffix == u"w":
2302
1579
                delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
2303
1580
            else:
2304
 
                raise ValueError("Unknown suffix {!r}".format(suffix))
2305
 
        except IndexError as e:
2306
 
            raise ValueError(*(e.args))
 
1581
                raise ValueError(u"Unknown suffix %r" % suffix)
 
1582
        except (ValueError, IndexError), e:
 
1583
            raise ValueError(e.message)
2307
1584
        timevalue += delta
2308
1585
    return timevalue
2309
1586
 
2310
1587
 
 
1588
def if_nametoindex(interface):
 
1589
    """Call the C function if_nametoindex(), or equivalent
 
1590
    
 
1591
    Note: This function cannot accept a unicode string."""
 
1592
    global if_nametoindex
 
1593
    try:
 
1594
        if_nametoindex = (ctypes.cdll.LoadLibrary
 
1595
                          (ctypes.util.find_library(u"c"))
 
1596
                          .if_nametoindex)
 
1597
    except (OSError, AttributeError):
 
1598
        logger.warning(u"Doing if_nametoindex the hard way")
 
1599
        def if_nametoindex(interface):
 
1600
            "Get an interface index the hard way, i.e. using fcntl()"
 
1601
            SIOCGIFINDEX = 0x8933  # From /usr/include/linux/sockios.h
 
1602
            with contextlib.closing(socket.socket()) as s:
 
1603
                ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
 
1604
                                    struct.pack(str(u"16s16x"),
 
1605
                                                interface))
 
1606
            interface_index = struct.unpack(str(u"I"),
 
1607
                                            ifreq[16:20])[0]
 
1608
            return interface_index
 
1609
    return if_nametoindex(interface)
 
1610
 
 
1611
 
2311
1612
def daemon(nochdir = False, noclose = False):
2312
1613
    """See daemon(3).  Standard BSD Unix function.
2313
1614
    
2316
1617
        sys.exit()
2317
1618
    os.setsid()
2318
1619
    if not nochdir:
2319
 
        os.chdir("/")
 
1620
        os.chdir(u"/")
2320
1621
    if os.fork():
2321
1622
        sys.exit()
2322
1623
    if not noclose:
2323
1624
        # Close all standard open file descriptors
2324
 
        null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
 
1625
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
2325
1626
        if not stat.S_ISCHR(os.fstat(null).st_mode):
2326
1627
            raise OSError(errno.ENODEV,
2327
 
                          "{} not a character device"
2328
 
                          .format(os.devnull))
 
1628
                          u"%s not a character device"
 
1629
                          % os.path.devnull)
2329
1630
        os.dup2(null, sys.stdin.fileno())
2330
1631
        os.dup2(null, sys.stdout.fileno())
2331
1632
        os.dup2(null, sys.stderr.fileno())
2338
1639
    ##################################################################
2339
1640
    # Parsing of options, both command line and config file
2340
1641
    
2341
 
    parser = argparse.ArgumentParser()
2342
 
    parser.add_argument("-v", "--version", action="version",
2343
 
                        version = "%(prog)s {}".format(version),
2344
 
                        help="show version number and exit")
2345
 
    parser.add_argument("-i", "--interface", metavar="IF",
2346
 
                        help="Bind to interface IF")
2347
 
    parser.add_argument("-a", "--address",
2348
 
                        help="Address to listen for requests on")
2349
 
    parser.add_argument("-p", "--port", type=int,
2350
 
                        help="Port number to receive requests on")
2351
 
    parser.add_argument("--check", action="store_true",
2352
 
                        help="Run self-test")
2353
 
    parser.add_argument("--debug", action="store_true",
2354
 
                        help="Debug mode; run in foreground and log"
2355
 
                        " to terminal", default=None)
2356
 
    parser.add_argument("--debuglevel", metavar="LEVEL",
2357
 
                        help="Debug level for stdout output")
2358
 
    parser.add_argument("--priority", help="GnuTLS"
2359
 
                        " priority string (see GnuTLS documentation)")
2360
 
    parser.add_argument("--servicename",
2361
 
                        metavar="NAME", help="Zeroconf service name")
2362
 
    parser.add_argument("--configdir",
2363
 
                        default="/etc/mandos", metavar="DIR",
2364
 
                        help="Directory to search for configuration"
2365
 
                        " files")
2366
 
    parser.add_argument("--no-dbus", action="store_false",
2367
 
                        dest="use_dbus", help="Do not provide D-Bus"
2368
 
                        " system bus interface", default=None)
2369
 
    parser.add_argument("--no-ipv6", action="store_false",
2370
 
                        dest="use_ipv6", help="Do not use IPv6",
2371
 
                        default=None)
2372
 
    parser.add_argument("--no-restore", action="store_false",
2373
 
                        dest="restore", help="Do not restore stored"
2374
 
                        " state", default=None)
2375
 
    parser.add_argument("--socket", type=int,
2376
 
                        help="Specify a file descriptor to a network"
2377
 
                        " socket to use instead of creating one")
2378
 
    parser.add_argument("--statedir", metavar="DIR",
2379
 
                        help="Directory to save/restore state in")
2380
 
    parser.add_argument("--foreground", action="store_true",
2381
 
                        help="Run in foreground", default=None)
2382
 
    parser.add_argument("--no-zeroconf", action="store_false",
2383
 
                        dest="zeroconf", help="Do not use Zeroconf",
2384
 
                        default=None)
2385
 
    
2386
 
    options = parser.parse_args()
 
1642
    parser = optparse.OptionParser(version = "%%prog %s" % version)
 
1643
    parser.add_option("-i", u"--interface", type=u"string",
 
1644
                      metavar="IF", help=u"Bind to interface IF")
 
1645
    parser.add_option("-a", u"--address", type=u"string",
 
1646
                      help=u"Address to listen for requests on")
 
1647
    parser.add_option("-p", u"--port", type=u"int",
 
1648
                      help=u"Port number to receive requests on")
 
1649
    parser.add_option("--check", action=u"store_true",
 
1650
                      help=u"Run self-test")
 
1651
    parser.add_option("--debug", action=u"store_true",
 
1652
                      help=u"Debug mode; run in foreground and log to"
 
1653
                      u" terminal")
 
1654
    parser.add_option("--debuglevel", type=u"string", metavar="Level",
 
1655
                      help=u"Debug level for stdout output")
 
1656
    parser.add_option("--priority", type=u"string", help=u"GnuTLS"
 
1657
                      u" priority string (see GnuTLS documentation)")
 
1658
    parser.add_option("--servicename", type=u"string",
 
1659
                      metavar=u"NAME", help=u"Zeroconf service name")
 
1660
    parser.add_option("--configdir", type=u"string",
 
1661
                      default=u"/etc/mandos", metavar=u"DIR",
 
1662
                      help=u"Directory to search for configuration"
 
1663
                      u" files")
 
1664
    parser.add_option("--no-dbus", action=u"store_false",
 
1665
                      dest=u"use_dbus", help=u"Do not provide D-Bus"
 
1666
                      u" system bus interface")
 
1667
    parser.add_option("--no-ipv6", action=u"store_false",
 
1668
                      dest=u"use_ipv6", help=u"Do not use IPv6")
 
1669
    options = parser.parse_args()[0]
2387
1670
    
2388
1671
    if options.check:
2389
1672
        import doctest
2390
 
        fail_count, test_count = doctest.testmod()
2391
 
        sys.exit(os.EX_OK if fail_count == 0 else 1)
 
1673
        doctest.testmod()
 
1674
        sys.exit()
2392
1675
    
2393
1676
    # Default values for config file for server-global settings
2394
 
    server_defaults = { "interface": "",
2395
 
                        "address": "",
2396
 
                        "port": "",
2397
 
                        "debug": "False",
2398
 
                        "priority":
2399
 
                        "SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2400
 
                        ":+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",
2401
 
                        "servicename": "Mandos",
2402
 
                        "use_dbus": "True",
2403
 
                        "use_ipv6": "True",
2404
 
                        "debuglevel": "",
2405
 
                        "restore": "True",
2406
 
                        "socket": "",
2407
 
                        "statedir": "/var/lib/mandos",
2408
 
                        "foreground": "False",
2409
 
                        "zeroconf": "True",
2410
 
                    }
 
1677
    server_defaults = { u"interface": u"",
 
1678
                        u"address": u"",
 
1679
                        u"port": u"",
 
1680
                        u"debug": u"False",
 
1681
                        u"priority":
 
1682
                        u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
 
1683
                        u"servicename": u"Mandos",
 
1684
                        u"use_dbus": u"True",
 
1685
                        u"use_ipv6": u"True",
 
1686
                        u"debuglevel": u"",
 
1687
                        }
2411
1688
    
2412
1689
    # Parse config file for server-global settings
2413
1690
    server_config = configparser.SafeConfigParser(server_defaults)
2414
1691
    del server_defaults
2415
 
    server_config.read(os.path.join(options.configdir, "mandos.conf"))
 
1692
    server_config.read(os.path.join(options.configdir,
 
1693
                                    u"mandos.conf"))
2416
1694
    # Convert the SafeConfigParser object to a dict
2417
1695
    server_settings = server_config.defaults()
2418
1696
    # Use the appropriate methods on the non-string config options
2419
 
    for option in ("debug", "use_dbus", "use_ipv6", "foreground"):
2420
 
        server_settings[option] = server_config.getboolean("DEFAULT",
 
1697
    for option in (u"debug", u"use_dbus", u"use_ipv6"):
 
1698
        server_settings[option] = server_config.getboolean(u"DEFAULT",
2421
1699
                                                           option)
2422
1700
    if server_settings["port"]:
2423
 
        server_settings["port"] = server_config.getint("DEFAULT",
2424
 
                                                       "port")
2425
 
    if server_settings["socket"]:
2426
 
        server_settings["socket"] = server_config.getint("DEFAULT",
2427
 
                                                         "socket")
2428
 
        # Later, stdin will, and stdout and stderr might, be dup'ed
2429
 
        # over with an opened os.devnull.  But we don't want this to
2430
 
        # happen with a supplied network socket.
2431
 
        if 0 <= server_settings["socket"] <= 2:
2432
 
            server_settings["socket"] = os.dup(server_settings
2433
 
                                               ["socket"])
 
1701
        server_settings["port"] = server_config.getint(u"DEFAULT",
 
1702
                                                       u"port")
2434
1703
    del server_config
2435
1704
    
2436
1705
    # Override the settings from the config file with command line
2437
1706
    # options, if set.
2438
 
    for option in ("interface", "address", "port", "debug",
2439
 
                   "priority", "servicename", "configdir", "use_dbus",
2440
 
                   "use_ipv6", "debuglevel", "restore", "statedir",
2441
 
                   "socket", "foreground", "zeroconf"):
 
1707
    for option in (u"interface", u"address", u"port", u"debug",
 
1708
                   u"priority", u"servicename", u"configdir",
 
1709
                   u"use_dbus", u"use_ipv6", u"debuglevel"):
2442
1710
        value = getattr(options, option)
2443
1711
        if value is not None:
2444
1712
            server_settings[option] = value
2445
1713
    del options
2446
1714
    # Force all strings to be unicode
2447
1715
    for option in server_settings.keys():
2448
 
        if isinstance(server_settings[option], bytes):
2449
 
            server_settings[option] = (server_settings[option]
2450
 
                                       .decode("utf-8"))
2451
 
    # Force all boolean options to be boolean
2452
 
    for option in ("debug", "use_dbus", "use_ipv6", "restore",
2453
 
                   "foreground", "zeroconf"):
2454
 
        server_settings[option] = bool(server_settings[option])
2455
 
    # Debug implies foreground
2456
 
    if server_settings["debug"]:
2457
 
        server_settings["foreground"] = True
 
1716
        if type(server_settings[option]) is str:
 
1717
            server_settings[option] = unicode(server_settings[option])
2458
1718
    # Now we have our good server settings in "server_settings"
2459
1719
    
2460
1720
    ##################################################################
2461
1721
    
2462
 
    if (not server_settings["zeroconf"]
2463
 
        and not (server_settings["port"]
2464
 
                 or server_settings["socket"] != "")):
2465
 
        parser.error("Needs port or socket to work without Zeroconf")
2466
 
    
2467
1722
    # For convenience
2468
 
    debug = server_settings["debug"]
2469
 
    debuglevel = server_settings["debuglevel"]
2470
 
    use_dbus = server_settings["use_dbus"]
2471
 
    use_ipv6 = server_settings["use_ipv6"]
2472
 
    stored_state_path = os.path.join(server_settings["statedir"],
2473
 
                                     stored_state_file)
2474
 
    foreground = server_settings["foreground"]
2475
 
    zeroconf = server_settings["zeroconf"]
2476
 
    
2477
 
    if debug:
2478
 
        initlogger(debug, logging.DEBUG)
2479
 
    else:
2480
 
        if not debuglevel:
2481
 
            initlogger(debug)
2482
 
        else:
2483
 
            level = getattr(logging, debuglevel.upper())
2484
 
            initlogger(debug, level)
2485
 
    
2486
 
    if server_settings["servicename"] != "Mandos":
2487
 
        syslogger.setFormatter(
2488
 
            logging.Formatter('Mandos ({}) [%(process)d]:'
2489
 
                              ' %(levelname)s: %(message)s'.format(
2490
 
                                  server_settings["servicename"])))
 
1723
    debug = server_settings[u"debug"]
 
1724
    debuglevel = server_settings[u"debuglevel"]
 
1725
    use_dbus = server_settings[u"use_dbus"]
 
1726
    use_ipv6 = server_settings[u"use_ipv6"]
 
1727
 
 
1728
    if server_settings[u"servicename"] != u"Mandos":
 
1729
        syslogger.setFormatter(logging.Formatter
 
1730
                               (u'Mandos (%s) [%%(process)d]:'
 
1731
                                u' %%(levelname)s: %%(message)s'
 
1732
                                % server_settings[u"servicename"]))
2491
1733
    
2492
1734
    # Parse config file with clients
2493
 
    client_config = configparser.SafeConfigParser(Client
2494
 
                                                  .client_defaults)
2495
 
    client_config.read(os.path.join(server_settings["configdir"],
2496
 
                                    "clients.conf"))
 
1735
    client_defaults = { u"timeout": u"1h",
 
1736
                        u"interval": u"5m",
 
1737
                        u"checker": u"fping -q -- %%(host)s",
 
1738
                        u"host": u"",
 
1739
                        u"approval_delay": u"0s",
 
1740
                        u"approval_duration": u"1s",
 
1741
                        }
 
1742
    client_config = configparser.SafeConfigParser(client_defaults)
 
1743
    client_config.read(os.path.join(server_settings[u"configdir"],
 
1744
                                    u"clients.conf"))
2497
1745
    
2498
1746
    global mandos_dbus_service
2499
1747
    mandos_dbus_service = None
2500
1748
    
2501
 
    socketfd = None
2502
 
    if server_settings["socket"] != "":
2503
 
        socketfd = server_settings["socket"]
2504
 
    tcp_server = MandosServer(
2505
 
        (server_settings["address"], server_settings["port"]),
2506
 
        ClientHandler,
2507
 
        interface=(server_settings["interface"] or None),
2508
 
        use_ipv6=use_ipv6,
2509
 
        gnutls_priority=server_settings["priority"],
2510
 
        use_dbus=use_dbus,
2511
 
        socketfd=socketfd)
2512
 
    if not foreground:
2513
 
        pidfilename = "/run/mandos.pid"
2514
 
        if not os.path.isdir("/run/."):
2515
 
            pidfilename = "/var/run/mandos.pid"
2516
 
        pidfile = None
2517
 
        try:
2518
 
            pidfile = codecs.open(pidfilename, "w", encoding="utf-8")
2519
 
        except IOError as e:
2520
 
            logger.error("Could not open file %r", pidfilename,
2521
 
                         exc_info=e)
 
1749
    tcp_server = MandosServer((server_settings[u"address"],
 
1750
                               server_settings[u"port"]),
 
1751
                              ClientHandler,
 
1752
                              interface=(server_settings[u"interface"]
 
1753
                                         or None),
 
1754
                              use_ipv6=use_ipv6,
 
1755
                              gnutls_priority=
 
1756
                              server_settings[u"priority"],
 
1757
                              use_dbus=use_dbus)
 
1758
    pidfilename = u"/var/run/mandos.pid"
 
1759
    try:
 
1760
        pidfile = open(pidfilename, u"w")
 
1761
    except IOError:
 
1762
        logger.error(u"Could not open file %r", pidfilename)
2522
1763
    
2523
 
    for name in ("_mandos", "mandos", "nobody"):
 
1764
    try:
 
1765
        uid = pwd.getpwnam(u"_mandos").pw_uid
 
1766
        gid = pwd.getpwnam(u"_mandos").pw_gid
 
1767
    except KeyError:
2524
1768
        try:
2525
 
            uid = pwd.getpwnam(name).pw_uid
2526
 
            gid = pwd.getpwnam(name).pw_gid
2527
 
            break
 
1769
            uid = pwd.getpwnam(u"mandos").pw_uid
 
1770
            gid = pwd.getpwnam(u"mandos").pw_gid
2528
1771
        except KeyError:
2529
 
            continue
2530
 
    else:
2531
 
        uid = 65534
2532
 
        gid = 65534
 
1772
            try:
 
1773
                uid = pwd.getpwnam(u"nobody").pw_uid
 
1774
                gid = pwd.getpwnam(u"nobody").pw_gid
 
1775
            except KeyError:
 
1776
                uid = 65534
 
1777
                gid = 65534
2533
1778
    try:
2534
1779
        os.setgid(gid)
2535
1780
        os.setuid(uid)
2536
 
    except OSError as error:
2537
 
        if error.errno != errno.EPERM:
2538
 
            raise
 
1781
    except OSError, error:
 
1782
        if error[0] != errno.EPERM:
 
1783
            raise error
2539
1784
    
 
1785
    if not debug and not debuglevel:
 
1786
        syslogger.setLevel(logging.WARNING)
 
1787
        console.setLevel(logging.WARNING)
 
1788
    if debuglevel:
 
1789
        level = getattr(logging, debuglevel.upper())
 
1790
        syslogger.setLevel(level)
 
1791
        console.setLevel(level)
 
1792
 
2540
1793
    if debug:
2541
1794
        # Enable all possible GnuTLS debugging
2542
1795
        
2546
1799
        
2547
1800
        @gnutls.library.types.gnutls_log_func
2548
1801
        def debug_gnutls(level, string):
2549
 
            logger.debug("GnuTLS: %s", string[:-1])
 
1802
            logger.debug(u"GnuTLS: %s", string[:-1])
2550
1803
        
2551
 
        gnutls.library.functions.gnutls_global_set_log_function(
2552
 
            debug_gnutls)
 
1804
        (gnutls.library.functions
 
1805
         .gnutls_global_set_log_function(debug_gnutls))
2553
1806
        
2554
1807
        # Redirect stdin so all checkers get /dev/null
2555
 
        null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
 
1808
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
2556
1809
        os.dup2(null, sys.stdin.fileno())
2557
1810
        if null > 2:
2558
1811
            os.close(null)
2559
 
    
2560
 
    # Need to fork before connecting to D-Bus
2561
 
    if not foreground:
2562
 
        # Close all input and output, do double fork, etc.
2563
 
        daemon()
2564
 
    
2565
 
    # multiprocessing will use threads, so before we use gobject we
2566
 
    # need to inform gobject that threads will be used.
2567
 
    gobject.threads_init()
 
1812
    else:
 
1813
        # No console logging
 
1814
        logger.removeHandler(console)
 
1815
    
2568
1816
    
2569
1817
    global main_loop
2570
1818
    # From the Avahi example code
2571
 
    DBusGMainLoop(set_as_default=True)
 
1819
    DBusGMainLoop(set_as_default=True )
2572
1820
    main_loop = gobject.MainLoop()
2573
1821
    bus = dbus.SystemBus()
2574
1822
    # End of Avahi example code
2575
1823
    if use_dbus:
2576
1824
        try:
2577
 
            bus_name = dbus.service.BusName("se.recompile.Mandos",
2578
 
                                            bus,
2579
 
                                            do_not_queue=True)
2580
 
            old_bus_name = dbus.service.BusName(
2581
 
                "se.bsnet.fukt.Mandos", bus,
2582
 
                do_not_queue=True)
2583
 
        except dbus.exceptions.DBusException as e:
2584
 
            logger.error("Disabling D-Bus:", exc_info=e)
 
1825
            bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos",
 
1826
                                            bus, do_not_queue=True)
 
1827
        except dbus.exceptions.NameExistsException, e:
 
1828
            logger.error(unicode(e) + u", disabling D-Bus")
2585
1829
            use_dbus = False
2586
 
            server_settings["use_dbus"] = False
 
1830
            server_settings[u"use_dbus"] = False
2587
1831
            tcp_server.use_dbus = False
2588
 
    if zeroconf:
2589
 
        protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2590
 
        service = AvahiServiceToSyslog(
2591
 
            name = server_settings["servicename"],
2592
 
            servicetype = "_mandos._tcp",
2593
 
            protocol = protocol,
2594
 
            bus = bus)
2595
 
        if server_settings["interface"]:
2596
 
            service.interface = if_nametoindex(
2597
 
                server_settings["interface"].encode("utf-8"))
2598
 
    
 
1832
    protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
 
1833
    service = AvahiService(name = server_settings[u"servicename"],
 
1834
                           servicetype = u"_mandos._tcp",
 
1835
                           protocol = protocol, bus = bus)
 
1836
    if server_settings["interface"]:
 
1837
        service.interface = (if_nametoindex
 
1838
                             (str(server_settings[u"interface"])))
 
1839
 
 
1840
    if not debug:
 
1841
        # Close all input and output, do double fork, etc.
 
1842
        daemon()
 
1843
        
2599
1844
    global multiprocessing_manager
2600
1845
    multiprocessing_manager = multiprocessing.Manager()
2601
1846
    
2602
1847
    client_class = Client
2603
1848
    if use_dbus:
2604
1849
        client_class = functools.partial(ClientDBus, bus = bus)
2605
 
    
2606
 
    client_settings = Client.config_parser(client_config)
2607
 
    old_client_settings = {}
2608
 
    clients_data = {}
2609
 
    
2610
 
    # This is used to redirect stdout and stderr for checker processes
2611
 
    global wnull
2612
 
    wnull = open(os.devnull, "w") # A writable /dev/null
2613
 
    # Only used if server is running in foreground but not in debug
2614
 
    # mode
2615
 
    if debug or not foreground:
2616
 
        wnull.close()
2617
 
    
2618
 
    # Get client data and settings from last running state.
2619
 
    if server_settings["restore"]:
2620
 
        try:
2621
 
            with open(stored_state_path, "rb") as stored_state:
2622
 
                clients_data, old_client_settings = pickle.load(
2623
 
                    stored_state)
2624
 
            os.remove(stored_state_path)
2625
 
        except IOError as e:
2626
 
            if e.errno == errno.ENOENT:
2627
 
                logger.warning("Could not load persistent state:"
2628
 
                               " {}".format(os.strerror(e.errno)))
2629
 
            else:
2630
 
                logger.critical("Could not load persistent state:",
2631
 
                                exc_info=e)
2632
 
                raise
2633
 
        except EOFError as e:
2634
 
            logger.warning("Could not load persistent state: "
2635
 
                           "EOFError:",
2636
 
                           exc_info=e)
2637
 
    
2638
 
    with PGPEngine() as pgp:
2639
 
        for client_name, client in clients_data.items():
2640
 
            # Skip removed clients
2641
 
            if client_name not in client_settings:
2642
 
                continue
2643
 
            
2644
 
            # Decide which value to use after restoring saved state.
2645
 
            # We have three different values: Old config file,
2646
 
            # new config file, and saved state.
2647
 
            # New config value takes precedence if it differs from old
2648
 
            # config value, otherwise use saved state.
2649
 
            for name, value in client_settings[client_name].items():
2650
 
                try:
2651
 
                    # For each value in new config, check if it
2652
 
                    # differs from the old config value (Except for
2653
 
                    # the "secret" attribute)
2654
 
                    if (name != "secret"
2655
 
                        and (value !=
2656
 
                             old_client_settings[client_name][name])):
2657
 
                        client[name] = value
2658
 
                except KeyError:
2659
 
                    pass
2660
 
            
2661
 
            # Clients who has passed its expire date can still be
2662
 
            # enabled if its last checker was successful.  A Client
2663
 
            # whose checker succeeded before we stored its state is
2664
 
            # assumed to have successfully run all checkers during
2665
 
            # downtime.
2666
 
            if client["enabled"]:
2667
 
                if datetime.datetime.utcnow() >= client["expires"]:
2668
 
                    if not client["last_checked_ok"]:
2669
 
                        logger.warning(
2670
 
                            "disabling client {} - Client never "
2671
 
                            "performed a successful checker".format(
2672
 
                                client_name))
2673
 
                        client["enabled"] = False
2674
 
                    elif client["last_checker_status"] != 0:
2675
 
                        logger.warning(
2676
 
                            "disabling client {} - Client last"
2677
 
                            " checker failed with error code"
2678
 
                            " {}".format(
2679
 
                                client_name,
2680
 
                                client["last_checker_status"]))
2681
 
                        client["enabled"] = False
2682
 
                    else:
2683
 
                        client["expires"] = (
2684
 
                            datetime.datetime.utcnow()
2685
 
                            + client["timeout"])
2686
 
                        logger.debug("Last checker succeeded,"
2687
 
                                     " keeping {} enabled".format(
2688
 
                                         client_name))
 
1850
    def client_config_items(config, section):
 
1851
        special_settings = {
 
1852
            "approved_by_default":
 
1853
                lambda: config.getboolean(section,
 
1854
                                          "approved_by_default"),
 
1855
            }
 
1856
        for name, value in config.items(section):
2689
1857
            try:
2690
 
                client["secret"] = pgp.decrypt(
2691
 
                    client["encrypted_secret"],
2692
 
                    client_settings[client_name]["secret"])
2693
 
            except PGPError:
2694
 
                # If decryption fails, we use secret from new settings
2695
 
                logger.debug("Failed to decrypt {} old secret".format(
2696
 
                    client_name))
2697
 
                client["secret"] = (client_settings[client_name]
2698
 
                                    ["secret"])
2699
 
    
2700
 
    # Add/remove clients based on new changes made to config
2701
 
    for client_name in (set(old_client_settings)
2702
 
                        - set(client_settings)):
2703
 
        del clients_data[client_name]
2704
 
    for client_name in (set(client_settings)
2705
 
                        - set(old_client_settings)):
2706
 
        clients_data[client_name] = client_settings[client_name]
2707
 
    
2708
 
    # Create all client objects
2709
 
    for client_name, client in clients_data.items():
2710
 
        tcp_server.clients[client_name] = client_class(
2711
 
            name = client_name,
2712
 
            settings = client,
2713
 
            server_settings = server_settings)
2714
 
    
 
1858
                yield (name, special_settings[name]())
 
1859
            except KeyError:
 
1860
                yield (name, value)
 
1861
    
 
1862
    tcp_server.clients.update(set(
 
1863
            client_class(name = section,
 
1864
                         config= dict(client_config_items(
 
1865
                        client_config, section)))
 
1866
            for section in client_config.sections()))
2715
1867
    if not tcp_server.clients:
2716
 
        logger.warning("No clients defined")
2717
 
    
2718
 
    if not foreground:
2719
 
        if pidfile is not None:
 
1868
        logger.warning(u"No clients defined")
 
1869
        
 
1870
    try:
 
1871
        with pidfile:
2720
1872
            pid = os.getpid()
2721
 
            try:
2722
 
                with pidfile:
2723
 
                    print(pid, file=pidfile)
2724
 
            except IOError:
2725
 
                logger.error("Could not write to file %r with PID %d",
2726
 
                             pidfilename, pid)
 
1873
            pidfile.write(str(pid) + "\n")
2727
1874
        del pidfile
2728
 
        del pidfilename
 
1875
    except IOError:
 
1876
        logger.error(u"Could not write to file %r with PID %d",
 
1877
                     pidfilename, pid)
 
1878
    except NameError:
 
1879
        # "pidfile" was never created
 
1880
        pass
 
1881
    del pidfilename
2729
1882
    
 
1883
    if not debug:
 
1884
        signal.signal(signal.SIGINT, signal.SIG_IGN)
2730
1885
    signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2731
1886
    signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
2732
1887
    
2733
1888
    if use_dbus:
2734
 
        
2735
 
        @alternate_dbus_interfaces(
2736
 
            { "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })
2737
 
        class MandosDBusService(DBusObjectWithProperties):
 
1889
        class MandosDBusService(dbus.service.Object):
2738
1890
            """A D-Bus proxy object"""
2739
 
            
2740
1891
            def __init__(self):
2741
 
                dbus.service.Object.__init__(self, bus, "/")
2742
 
            
2743
 
            _interface = "se.recompile.Mandos"
2744
 
            
2745
 
            @dbus_interface_annotations(_interface)
2746
 
            def _foo(self):
2747
 
                return {
2748
 
                    "org.freedesktop.DBus.Property.EmitsChangedSignal":
2749
 
                    "false" }
2750
 
            
2751
 
            @dbus.service.signal(_interface, signature="o")
 
1892
                dbus.service.Object.__init__(self, bus, u"/")
 
1893
            _interface = u"se.bsnet.fukt.Mandos"
 
1894
            
 
1895
            @dbus.service.signal(_interface, signature=u"o")
2752
1896
            def ClientAdded(self, objpath):
2753
1897
                "D-Bus signal"
2754
1898
                pass
2755
1899
            
2756
 
            @dbus.service.signal(_interface, signature="ss")
 
1900
            @dbus.service.signal(_interface, signature=u"ss")
2757
1901
            def ClientNotFound(self, fingerprint, address):
2758
1902
                "D-Bus signal"
2759
1903
                pass
2760
1904
            
2761
 
            @dbus.service.signal(_interface, signature="os")
 
1905
            @dbus.service.signal(_interface, signature=u"os")
2762
1906
            def ClientRemoved(self, objpath, name):
2763
1907
                "D-Bus signal"
2764
1908
                pass
2765
1909
            
2766
 
            @dbus.service.method(_interface, out_signature="ao")
 
1910
            @dbus.service.method(_interface, out_signature=u"ao")
2767
1911
            def GetAllClients(self):
2768
1912
                "D-Bus method"
2769
 
                return dbus.Array(c.dbus_object_path for c in
2770
 
                                  tcp_server.clients.itervalues())
 
1913
                return dbus.Array(c.dbus_object_path
 
1914
                                  for c in tcp_server.clients)
2771
1915
            
2772
1916
            @dbus.service.method(_interface,
2773
 
                                 out_signature="a{oa{sv}}")
 
1917
                                 out_signature=u"a{oa{sv}}")
2774
1918
            def GetAllClientsWithProperties(self):
2775
1919
                "D-Bus method"
2776
1920
                return dbus.Dictionary(
2777
 
                    { c.dbus_object_path: c.GetAll("")
2778
 
                      for c in tcp_server.clients.itervalues() },
2779
 
                    signature="oa{sv}")
 
1921
                    ((c.dbus_object_path, c.GetAll(u""))
 
1922
                     for c in tcp_server.clients),
 
1923
                    signature=u"oa{sv}")
2780
1924
            
2781
 
            @dbus.service.method(_interface, in_signature="o")
 
1925
            @dbus.service.method(_interface, in_signature=u"o")
2782
1926
            def RemoveClient(self, object_path):
2783
1927
                "D-Bus method"
2784
 
                for c in tcp_server.clients.itervalues():
 
1928
                for c in tcp_server.clients:
2785
1929
                    if c.dbus_object_path == object_path:
2786
 
                        del tcp_server.clients[c.name]
 
1930
                        tcp_server.clients.remove(c)
2787
1931
                        c.remove_from_connection()
2788
1932
                        # Don't signal anything except ClientRemoved
2789
1933
                        c.disable(quiet=True)
2798
1942
    
2799
1943
    def cleanup():
2800
1944
        "Cleanup function; run on exit"
2801
 
        if zeroconf:
2802
 
            service.cleanup()
2803
 
        
2804
 
        multiprocessing.active_children()
2805
 
        wnull.close()
2806
 
        if not (tcp_server.clients or client_settings):
2807
 
            return
2808
 
        
2809
 
        # Store client before exiting. Secrets are encrypted with key
2810
 
        # based on what config file has. If config file is
2811
 
        # removed/edited, old secret will thus be unrecovable.
2812
 
        clients = {}
2813
 
        with PGPEngine() as pgp:
2814
 
            for client in tcp_server.clients.itervalues():
2815
 
                key = client_settings[client.name]["secret"]
2816
 
                client.encrypted_secret = pgp.encrypt(client.secret,
2817
 
                                                      key)
2818
 
                client_dict = {}
2819
 
                
2820
 
                # A list of attributes that can not be pickled
2821
 
                # + secret.
2822
 
                exclude = { "bus", "changedstate", "secret",
2823
 
                            "checker", "server_settings" }
2824
 
                for name, typ in inspect.getmembers(dbus.service
2825
 
                                                    .Object):
2826
 
                    exclude.add(name)
2827
 
                
2828
 
                client_dict["encrypted_secret"] = (client
2829
 
                                                   .encrypted_secret)
2830
 
                for attr in client.client_structure:
2831
 
                    if attr not in exclude:
2832
 
                        client_dict[attr] = getattr(client, attr)
2833
 
                
2834
 
                clients[client.name] = client_dict
2835
 
                del client_settings[client.name]["secret"]
2836
 
        
2837
 
        try:
2838
 
            with tempfile.NamedTemporaryFile(
2839
 
                    mode='wb',
2840
 
                    suffix=".pickle",
2841
 
                    prefix='clients-',
2842
 
                    dir=os.path.dirname(stored_state_path),
2843
 
                    delete=False) as stored_state:
2844
 
                pickle.dump((clients, client_settings), stored_state)
2845
 
                tempname = stored_state.name
2846
 
            os.rename(tempname, stored_state_path)
2847
 
        except (IOError, OSError) as e:
2848
 
            if not debug:
2849
 
                try:
2850
 
                    os.remove(tempname)
2851
 
                except NameError:
2852
 
                    pass
2853
 
            if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
2854
 
                logger.warning("Could not save persistent state: {}"
2855
 
                               .format(os.strerror(e.errno)))
2856
 
            else:
2857
 
                logger.warning("Could not save persistent state:",
2858
 
                               exc_info=e)
2859
 
                raise
2860
 
        
2861
 
        # Delete all clients, and settings from config
 
1945
        service.cleanup()
 
1946
        
2862
1947
        while tcp_server.clients:
2863
 
            name, client = tcp_server.clients.popitem()
 
1948
            client = tcp_server.clients.pop()
2864
1949
            if use_dbus:
2865
1950
                client.remove_from_connection()
 
1951
            client.disable_hook = None
2866
1952
            # Don't signal anything except ClientRemoved
2867
1953
            client.disable(quiet=True)
2868
1954
            if use_dbus:
2869
1955
                # Emit D-Bus signal
2870
 
                mandos_dbus_service.ClientRemoved(
2871
 
                    client.dbus_object_path, client.name)
2872
 
        client_settings.clear()
 
1956
                mandos_dbus_service.ClientRemoved(client.dbus_object_path,
 
1957
                                                  client.name)
2873
1958
    
2874
1959
    atexit.register(cleanup)
2875
1960
    
2876
 
    for client in tcp_server.clients.itervalues():
 
1961
    for client in tcp_server.clients:
2877
1962
        if use_dbus:
2878
1963
            # Emit D-Bus signal
2879
1964
            mandos_dbus_service.ClientAdded(client.dbus_object_path)
2880
 
        # Need to initiate checking of clients
2881
 
        if client.enabled:
2882
 
            client.init_checker()
 
1965
        client.enable()
2883
1966
    
2884
1967
    tcp_server.enable()
2885
1968
    tcp_server.server_activate()
2886
1969
    
2887
1970
    # Find out what port we got
2888
 
    if zeroconf:
2889
 
        service.port = tcp_server.socket.getsockname()[1]
 
1971
    service.port = tcp_server.socket.getsockname()[1]
2890
1972
    if use_ipv6:
2891
 
        logger.info("Now listening on address %r, port %d,"
2892
 
                    " flowinfo %d, scope_id %d",
2893
 
                    *tcp_server.socket.getsockname())
 
1973
        logger.info(u"Now listening on address %r, port %d,"
 
1974
                    " flowinfo %d, scope_id %d"
 
1975
                    % tcp_server.socket.getsockname())
2894
1976
    else:                       # IPv4
2895
 
        logger.info("Now listening on address %r, port %d",
2896
 
                    *tcp_server.socket.getsockname())
 
1977
        logger.info(u"Now listening on address %r, port %d"
 
1978
                    % tcp_server.socket.getsockname())
2897
1979
    
2898
1980
    #service.interface = tcp_server.socket.getsockname()[3]
2899
1981
    
2900
1982
    try:
2901
 
        if zeroconf:
2902
 
            # From the Avahi example code
2903
 
            try:
2904
 
                service.activate()
2905
 
            except dbus.exceptions.DBusException as error:
2906
 
                logger.critical("D-Bus Exception", exc_info=error)
2907
 
                cleanup()
2908
 
                sys.exit(1)
2909
 
            # End of Avahi example code
 
1983
        # From the Avahi example code
 
1984
        try:
 
1985
            service.activate()
 
1986
        except dbus.exceptions.DBusException, error:
 
1987
            logger.critical(u"DBusException: %s", error)
 
1988
            cleanup()
 
1989
            sys.exit(1)
 
1990
        # End of Avahi example code
2910
1991
        
2911
1992
        gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
2912
1993
                             lambda *args, **kwargs:
2913
1994
                             (tcp_server.handle_request
2914
1995
                              (*args[2:], **kwargs) or True))
2915
1996
        
2916
 
        logger.debug("Starting main loop")
 
1997
        logger.debug(u"Starting main loop")
2917
1998
        main_loop.run()
2918
 
    except AvahiError as error:
2919
 
        logger.critical("Avahi Error", exc_info=error)
 
1999
    except AvahiError, error:
 
2000
        logger.critical(u"AvahiError: %s", error)
2920
2001
        cleanup()
2921
2002
        sys.exit(1)
2922
2003
    except KeyboardInterrupt:
2923
2004
        if debug:
2924
 
            print("", file=sys.stderr)
2925
 
        logger.debug("Server received KeyboardInterrupt")
2926
 
    logger.debug("Server exiting")
 
2005
            print >> sys.stderr
 
2006
        logger.debug(u"Server received KeyboardInterrupt")
 
2007
    logger.debug(u"Server exiting")
2927
2008
    # Must run before the D-Bus bus name gets deregistered
2928
2009
    cleanup()
2929
2010
 
2930
 
 
2931
2011
if __name__ == '__main__':
2932
2012
    main()