/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to server.py

  • Committer: Teddy Hogeborn
  • Date: 2008-08-04 20:43:31 UTC
  • mfrom: (24.1.17 mandos)
  • Revision ID: teddy@fukt.bsnet.se-20080804204331-zgu42g8ii997h1l2
* ca.pem: Removed.
* cert.pem: - '' -
* client-cert.pem: - '' -
* client-key.pem: - '' -
* crl.pem: - '' -
* key.pem: - '' -

* plugins.d/mandosclient.c (start_mandos_communication): Change "to"
                                    to be a union.  All users changed.

* server.py: Changed log severity for many log messages.
  (Client.__init__): Take all config file settins as a dict instead of
                     as keyword arguments.

Show diffs side-by-side

added added

removed removed

Lines of Context:
6
6
# This program is partly derived from an example program for an Avahi
7
7
# service publisher, downloaded from
8
8
# <http://avahi.org/wiki/PythonPublishExample>.  This includes the
9
 
# methods "add", "remove", "server_state_changed",
10
 
# "entry_group_state_changed", "cleanup", and "activate" in the
11
 
# "AvahiService" class, and some lines in "main".
 
9
# following functions: "AvahiService.add", "AvahiService.remove",
 
10
# "server_state_changed", "entry_group_state_changed", and some lines
 
11
# in "main".
12
12
13
13
# Everything else is
14
 
# Copyright © 2008-2012 Teddy Hogeborn
15
 
# Copyright © 2008-2012 Björn Påhlsson
 
14
# Copyright © 2007-2008 Teddy Hogeborn & Björn Påhlsson
16
15
17
16
# This program is free software: you can redistribute it and/or modify
18
17
# it under the terms of the GNU General Public License as published by
25
24
#     GNU General Public License for more details.
26
25
27
26
# You should have received a copy of the GNU General Public License
28
 
# along with this program.  If not, see
29
 
# <http://www.gnu.org/licenses/>.
30
 
31
 
# Contact the authors at <mandos@recompile.se>.
32
 
33
 
 
34
 
from __future__ import (division, absolute_import, print_function,
35
 
                        unicode_literals)
36
 
 
37
 
import SocketServer as socketserver
 
27
# along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
28
 
29
# Contact the authors at <mandos@fukt.bsnet.se>.
 
30
 
31
 
 
32
from __future__ import division
 
33
 
 
34
import SocketServer
38
35
import socket
39
 
import argparse
 
36
import select
 
37
from optparse import OptionParser
40
38
import datetime
41
39
import errno
42
40
import gnutls.crypto
45
43
import gnutls.library.functions
46
44
import gnutls.library.constants
47
45
import gnutls.library.types
48
 
import ConfigParser as configparser
 
46
import ConfigParser
49
47
import sys
50
48
import re
51
49
import os
52
50
import signal
 
51
from sets import Set
53
52
import subprocess
54
53
import atexit
55
54
import stat
56
55
import logging
57
56
import logging.handlers
58
 
import pwd
59
 
import contextlib
60
 
import struct
61
 
import fcntl
62
 
import functools
63
 
import cPickle as pickle
64
 
import multiprocessing
65
 
import types
66
 
import binascii
67
 
import tempfile
68
 
import itertools
69
57
 
70
58
import dbus
71
 
import dbus.service
72
59
import gobject
73
60
import avahi
74
61
from dbus.mainloop.glib import DBusGMainLoop
75
62
import ctypes
76
 
import ctypes.util
77
 
import xml.dom.minidom
78
 
import inspect
79
 
import GnuPGInterface
80
 
 
81
 
try:
82
 
    SO_BINDTODEVICE = socket.SO_BINDTODEVICE
83
 
except AttributeError:
84
 
    try:
85
 
        from IN import SO_BINDTODEVICE
86
 
    except ImportError:
87
 
        SO_BINDTODEVICE = None
88
 
 
89
 
version = "1.5.3"
90
 
stored_state_file = "clients.pickle"
91
 
 
92
 
logger = logging.getLogger()
93
 
syslogger = (logging.handlers.SysLogHandler
94
 
             (facility = logging.handlers.SysLogHandler.LOG_DAEMON,
95
 
              address = str("/dev/log")))
96
 
 
97
 
try:
98
 
    if_nametoindex = (ctypes.cdll.LoadLibrary
99
 
                      (ctypes.util.find_library("c"))
100
 
                      .if_nametoindex)
101
 
except (OSError, AttributeError):
102
 
    def if_nametoindex(interface):
103
 
        "Get an interface index the hard way, i.e. using fcntl()"
104
 
        SIOCGIFINDEX = 0x8933  # From /usr/include/linux/sockios.h
105
 
        with contextlib.closing(socket.socket()) as s:
106
 
            ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
107
 
                                struct.pack(str("16s16x"),
108
 
                                            interface))
109
 
        interface_index = struct.unpack(str("I"),
110
 
                                        ifreq[16:20])[0]
111
 
        return interface_index
112
 
 
113
 
 
114
 
def initlogger(debug, level=logging.WARNING):
115
 
    """init logger and add loglevel"""
116
 
    
117
 
    syslogger.setFormatter(logging.Formatter
118
 
                           ('Mandos [%(process)d]: %(levelname)s:'
119
 
                            ' %(message)s'))
120
 
    logger.addHandler(syslogger)
121
 
    
122
 
    if debug:
123
 
        console = logging.StreamHandler()
124
 
        console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
125
 
                                               ' [%(process)d]:'
126
 
                                               ' %(levelname)s:'
127
 
                                               ' %(message)s'))
128
 
        logger.addHandler(console)
129
 
    logger.setLevel(level)
130
 
 
131
 
 
132
 
class PGPError(Exception):
133
 
    """Exception if encryption/decryption fails"""
134
 
    pass
135
 
 
136
 
 
137
 
class PGPEngine(object):
138
 
    """A simple class for OpenPGP symmetric encryption & decryption"""
139
 
    def __init__(self):
140
 
        self.gnupg = GnuPGInterface.GnuPG()
141
 
        self.tempdir = tempfile.mkdtemp(prefix="mandos-")
142
 
        self.gnupg = GnuPGInterface.GnuPG()
143
 
        self.gnupg.options.meta_interactive = False
144
 
        self.gnupg.options.homedir = self.tempdir
145
 
        self.gnupg.options.extra_args.extend(['--force-mdc',
146
 
                                              '--quiet',
147
 
                                              '--no-use-agent'])
148
 
    
149
 
    def __enter__(self):
150
 
        return self
151
 
    
152
 
    def __exit__ (self, exc_type, exc_value, traceback):
153
 
        self._cleanup()
154
 
        return False
155
 
    
156
 
    def __del__(self):
157
 
        self._cleanup()
158
 
    
159
 
    def _cleanup(self):
160
 
        if self.tempdir is not None:
161
 
            # Delete contents of tempdir
162
 
            for root, dirs, files in os.walk(self.tempdir,
163
 
                                             topdown = False):
164
 
                for filename in files:
165
 
                    os.remove(os.path.join(root, filename))
166
 
                for dirname in dirs:
167
 
                    os.rmdir(os.path.join(root, dirname))
168
 
            # Remove tempdir
169
 
            os.rmdir(self.tempdir)
170
 
            self.tempdir = None
171
 
    
172
 
    def password_encode(self, password):
173
 
        # Passphrase can not be empty and can not contain newlines or
174
 
        # NUL bytes.  So we prefix it and hex encode it.
175
 
        return b"mandos" + binascii.hexlify(password)
176
 
    
177
 
    def encrypt(self, data, password):
178
 
        self.gnupg.passphrase = self.password_encode(password)
179
 
        with open(os.devnull, "w") as devnull:
180
 
            try:
181
 
                proc = self.gnupg.run(['--symmetric'],
182
 
                                      create_fhs=['stdin', 'stdout'],
183
 
                                      attach_fhs={'stderr': devnull})
184
 
                with contextlib.closing(proc.handles['stdin']) as f:
185
 
                    f.write(data)
186
 
                with contextlib.closing(proc.handles['stdout']) as f:
187
 
                    ciphertext = f.read()
188
 
                proc.wait()
189
 
            except IOError as e:
190
 
                raise PGPError(e)
191
 
        self.gnupg.passphrase = None
192
 
        return ciphertext
193
 
    
194
 
    def decrypt(self, data, password):
195
 
        self.gnupg.passphrase = self.password_encode(password)
196
 
        with open(os.devnull, "w") as devnull:
197
 
            try:
198
 
                proc = self.gnupg.run(['--decrypt'],
199
 
                                      create_fhs=['stdin', 'stdout'],
200
 
                                      attach_fhs={'stderr': devnull})
201
 
                with contextlib.closing(proc.handles['stdin']) as f:
202
 
                    f.write(data)
203
 
                with contextlib.closing(proc.handles['stdout']) as f:
204
 
                    decrypted_plaintext = f.read()
205
 
                proc.wait()
206
 
            except IOError as e:
207
 
                raise PGPError(e)
208
 
        self.gnupg.passphrase = None
209
 
        return decrypted_plaintext
210
 
 
 
63
 
 
64
# Brief description of the operation of this program:
 
65
 
66
# This server announces itself as a Zeroconf service.  Connecting
 
67
# clients use the TLS protocol, with the unusual quirk that this
 
68
# server program acts as a TLS "client" while a connecting client acts
 
69
# as a TLS "server".  The client (acting as a TLS "server") must
 
70
# supply an OpenPGP certificate, and the fingerprint of this
 
71
# certificate is used by this server to look up (in a list read from a
 
72
# file at start time) which binary blob to give the client.  No other
 
73
# authentication or authorization is done by this server.
 
74
 
 
75
 
 
76
logger = logging.Logger('mandos')
 
77
syslogger = logging.handlers.SysLogHandler\
 
78
            (facility = logging.handlers.SysLogHandler.LOG_DAEMON)
 
79
syslogger.setFormatter(logging.Formatter\
 
80
                        ('%(levelname)s: %(message)s'))
 
81
logger.addHandler(syslogger)
 
82
del syslogger
211
83
 
212
84
 
213
85
class AvahiError(Exception):
214
 
    def __init__(self, value, *args, **kwargs):
 
86
    def __init__(self, value):
215
87
        self.value = value
216
 
        super(AvahiError, self).__init__(value, *args, **kwargs)
217
 
    def __unicode__(self):
218
 
        return unicode(repr(self.value))
 
88
    def __str__(self):
 
89
        return repr(self.value)
219
90
 
220
91
class AvahiServiceError(AvahiError):
221
92
    pass
225
96
 
226
97
 
227
98
class AvahiService(object):
228
 
    """An Avahi (Zeroconf) service.
229
 
    
230
 
    Attributes:
 
99
    """
231
100
    interface: integer; avahi.IF_UNSPEC or an interface index.
232
101
               Used to optionally bind to the specified interface.
233
 
    name: string; Example: 'Mandos'
234
 
    type: string; Example: '_mandos._tcp'.
235
 
                  See <http://www.dns-sd.org/ServiceTypes.html>
236
 
    port: integer; what port to announce
237
 
    TXT: list of strings; TXT record for the service
238
 
    domain: string; Domain to publish on, default to .local if empty.
239
 
    host: string; Host to publish records for, default is localhost
240
 
    max_renames: integer; maximum number of renames
241
 
    rename_count: integer; counter so we only rename after collisions
242
 
                  a sensible number of times
243
 
    group: D-Bus Entry Group
244
 
    server: D-Bus Server
245
 
    bus: dbus.SystemBus()
 
102
    name = string; Example: "Mandos"
 
103
    type = string; Example: "_mandos._tcp".
 
104
                   See <http://www.dns-sd.org/ServiceTypes.html>
 
105
    port = integer; what port to announce
 
106
    TXT = list of strings; TXT record for the service
 
107
    domain = string; Domain to publish on, default to .local if empty.
 
108
    host = string; Host to publish records for, default to localhost
 
109
                   if empty.
 
110
    max_renames = integer; maximum number of renames
 
111
    rename_count = integer; counter so we only rename after collisions
 
112
                   a sensible number of times
246
113
    """
247
114
    def __init__(self, interface = avahi.IF_UNSPEC, name = None,
248
 
                 servicetype = None, port = None, TXT = None,
249
 
                 domain = "", host = "", max_renames = 32768,
250
 
                 protocol = avahi.PROTO_UNSPEC, bus = None):
 
115
                 type = None, port = None, TXT = None, domain = "",
 
116
                 host = "", max_renames = 12):
 
117
        """An Avahi (Zeroconf) service. """
251
118
        self.interface = interface
252
119
        self.name = name
253
 
        self.type = servicetype
 
120
        self.type = type
254
121
        self.port = port
255
 
        self.TXT = TXT if TXT is not None else []
 
122
        if TXT is None:
 
123
            self.TXT = []
 
124
        else:
 
125
            self.TXT = TXT
256
126
        self.domain = domain
257
127
        self.host = host
258
128
        self.rename_count = 0
259
 
        self.max_renames = max_renames
260
 
        self.protocol = protocol
261
 
        self.group = None       # our entry group
262
 
        self.server = None
263
 
        self.bus = bus
264
 
        self.entry_group_state_changed_match = None
265
129
    def rename(self):
266
130
        """Derived from the Avahi example code"""
267
131
        if self.rename_count >= self.max_renames:
268
 
            logger.critical("No suitable Zeroconf service name found"
269
 
                            " after %i retries, exiting.",
270
 
                            self.rename_count)
 
132
            logger.critical(u"No suitable service name found after %i"
 
133
                            u" retries, exiting.", rename_count)
271
134
            raise AvahiServiceError("Too many renames")
272
 
        self.name = unicode(self.server
273
 
                            .GetAlternativeServiceName(self.name))
274
 
        logger.info("Changing Zeroconf service name to %r ...",
275
 
                    self.name)
 
135
        name = server.GetAlternativeServiceName(name)
 
136
        logger.error(u"Changing name to %r ...", name)
276
137
        self.remove()
277
 
        try:
278
 
            self.add()
279
 
        except dbus.exceptions.DBusException as error:
280
 
            logger.critical("DBusException: %s", error)
281
 
            self.cleanup()
282
 
            os._exit(1)
 
138
        self.add()
283
139
        self.rename_count += 1
284
140
    def remove(self):
285
141
        """Derived from the Avahi example code"""
286
 
        if self.entry_group_state_changed_match is not None:
287
 
            self.entry_group_state_changed_match.remove()
288
 
            self.entry_group_state_changed_match = None
289
 
        if self.group is not None:
290
 
            self.group.Reset()
 
142
        if group is not None:
 
143
            group.Reset()
291
144
    def add(self):
292
145
        """Derived from the Avahi example code"""
293
 
        self.remove()
294
 
        if self.group is None:
295
 
            self.group = dbus.Interface(
296
 
                self.bus.get_object(avahi.DBUS_NAME,
297
 
                                    self.server.EntryGroupNew()),
298
 
                avahi.DBUS_INTERFACE_ENTRY_GROUP)
299
 
        self.entry_group_state_changed_match = (
300
 
            self.group.connect_to_signal(
301
 
                'StateChanged', self.entry_group_state_changed))
302
 
        logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
303
 
                     self.name, self.type)
304
 
        self.group.AddService(
305
 
            self.interface,
306
 
            self.protocol,
307
 
            dbus.UInt32(0),     # flags
308
 
            self.name, self.type,
309
 
            self.domain, self.host,
310
 
            dbus.UInt16(self.port),
311
 
            avahi.string_array_to_txt_array(self.TXT))
312
 
        self.group.Commit()
313
 
    def entry_group_state_changed(self, state, error):
314
 
        """Derived from the Avahi example code"""
315
 
        logger.debug("Avahi entry group state change: %i", state)
316
 
        
317
 
        if state == avahi.ENTRY_GROUP_ESTABLISHED:
318
 
            logger.debug("Zeroconf service established.")
319
 
        elif state == avahi.ENTRY_GROUP_COLLISION:
320
 
            logger.info("Zeroconf service name collision.")
321
 
            self.rename()
322
 
        elif state == avahi.ENTRY_GROUP_FAILURE:
323
 
            logger.critical("Avahi: Error in group state changed %s",
324
 
                            unicode(error))
325
 
            raise AvahiGroupError("State changed: %s"
326
 
                                  % unicode(error))
327
 
    def cleanup(self):
328
 
        """Derived from the Avahi example code"""
329
 
        if self.group is not None:
330
 
            try:
331
 
                self.group.Free()
332
 
            except (dbus.exceptions.UnknownMethodException,
333
 
                    dbus.exceptions.DBusException):
334
 
                pass
335
 
            self.group = None
336
 
        self.remove()
337
 
    def server_state_changed(self, state, error=None):
338
 
        """Derived from the Avahi example code"""
339
 
        logger.debug("Avahi server state change: %i", state)
340
 
        bad_states = { avahi.SERVER_INVALID:
341
 
                           "Zeroconf server invalid",
342
 
                       avahi.SERVER_REGISTERING: None,
343
 
                       avahi.SERVER_COLLISION:
344
 
                           "Zeroconf server name collision",
345
 
                       avahi.SERVER_FAILURE:
346
 
                           "Zeroconf server failure" }
347
 
        if state in bad_states:
348
 
            if bad_states[state] is not None:
349
 
                if error is None:
350
 
                    logger.error(bad_states[state])
351
 
                else:
352
 
                    logger.error(bad_states[state] + ": %r", error)
353
 
            self.cleanup()
354
 
        elif state == avahi.SERVER_RUNNING:
355
 
            self.add()
356
 
        else:
357
 
            if error is None:
358
 
                logger.debug("Unknown state: %r", state)
359
 
            else:
360
 
                logger.debug("Unknown state: %r: %r", state, error)
361
 
    def activate(self):
362
 
        """Derived from the Avahi example code"""
363
 
        if self.server is None:
364
 
            self.server = dbus.Interface(
365
 
                self.bus.get_object(avahi.DBUS_NAME,
366
 
                                    avahi.DBUS_PATH_SERVER,
367
 
                                    follow_name_owner_changes=True),
368
 
                avahi.DBUS_INTERFACE_SERVER)
369
 
        self.server.connect_to_signal("StateChanged",
370
 
                                 self.server_state_changed)
371
 
        self.server_state_changed(self.server.GetState())
372
 
 
373
 
class AvahiServiceToSyslog(AvahiService):
374
 
    def rename(self):
375
 
        """Add the new name to the syslog messages"""
376
 
        ret = AvahiService.rename(self)
377
 
        syslogger.setFormatter(logging.Formatter
378
 
                               ('Mandos (%s) [%%(process)d]:'
379
 
                                ' %%(levelname)s: %%(message)s'
380
 
                                % self.name))
381
 
        return ret
382
 
 
383
 
def timedelta_to_milliseconds(td):
384
 
    "Convert a datetime.timedelta() to milliseconds"
385
 
    return ((td.days * 24 * 60 * 60 * 1000)
386
 
            + (td.seconds * 1000)
387
 
            + (td.microseconds // 1000))
388
 
        
 
146
        global group
 
147
        if group is None:
 
148
            group = dbus.Interface\
 
149
                    (bus.get_object(avahi.DBUS_NAME,
 
150
                                    server.EntryGroupNew()),
 
151
                     avahi.DBUS_INTERFACE_ENTRY_GROUP)
 
152
            group.connect_to_signal('StateChanged',
 
153
                                    entry_group_state_changed)
 
154
        logger.debug(u"Adding service '%s' of type '%s' ...",
 
155
                     service.name, service.type)
 
156
        group.AddService(
 
157
                self.interface,         # interface
 
158
                avahi.PROTO_INET6,      # protocol
 
159
                dbus.UInt32(0),         # flags
 
160
                self.name, self.type,
 
161
                self.domain, self.host,
 
162
                dbus.UInt16(self.port),
 
163
                avahi.string_array_to_txt_array(self.TXT))
 
164
        group.Commit()
 
165
 
 
166
# From the Avahi example code:
 
167
group = None                            # our entry group
 
168
# End of Avahi example code
 
169
 
 
170
 
389
171
class Client(object):
390
172
    """A representation of a client host served by this server.
391
 
    
392
173
    Attributes:
393
 
    approved:   bool(); 'None' if not yet approved/disapproved
394
 
    approval_delay: datetime.timedelta(); Time to wait for approval
395
 
    approval_duration: datetime.timedelta(); Duration of one approval
396
 
    checker:    subprocess.Popen(); a running checker process used
397
 
                                    to see if the client lives.
398
 
                                    'None' if no process is running.
399
 
    checker_callback_tag: a gobject event source tag, or None
400
 
    checker_command: string; External command which is run to check
401
 
                     if client lives.  %() expansions are done at
 
174
    name:      string; from the config file, used in log messages
 
175
    fingerprint: string (40 or 32 hexadecimal digits); used to
 
176
                 uniquely identify the client
 
177
    secret:    bytestring; sent verbatim (over TLS) to client
 
178
    fqdn:      string (FQDN); available for use by the checker command
 
179
    created:   datetime.datetime(); object creation, not client host
 
180
    last_checked_ok: datetime.datetime() or None if not yet checked OK
 
181
    timeout:   datetime.timedelta(); How long from last_checked_ok
 
182
                                     until this client is invalid
 
183
    interval:  datetime.timedelta(); How often to start a new checker
 
184
    stop_hook: If set, called by stop() as stop_hook(self)
 
185
    checker:   subprocess.Popen(); a running checker process used
 
186
                                   to see if the client lives.
 
187
                                   'None' if no process is running.
 
188
    checker_initiator_tag: a gobject event source tag, or None
 
189
    stop_initiator_tag:    - '' -
 
190
    checker_callback_tag:  - '' -
 
191
    checker_command: string; External command which is run to check if
 
192
                     client lives.  %() expansions are done at
402
193
                     runtime with vars(self) as dict, so that for
403
194
                     instance %(name)s can be used in the command.
404
 
    checker_initiator_tag: a gobject event source tag, or None
405
 
    created:    datetime.datetime(); (UTC) object creation
406
 
    client_structure: Object describing what attributes a client has
407
 
                      and is used for storing the client at exit
408
 
    current_checker_command: string; current running checker_command
409
 
    disable_initiator_tag: a gobject event source tag, or None
410
 
    enabled:    bool()
411
 
    fingerprint: string (40 or 32 hexadecimal digits); used to
412
 
                 uniquely identify the client
413
 
    host:       string; available for use by the checker command
414
 
    interval:   datetime.timedelta(); How often to start a new checker
415
 
    last_approval_request: datetime.datetime(); (UTC) or None
416
 
    last_checked_ok: datetime.datetime(); (UTC) or None
417
 
    last_checker_status: integer between 0 and 255 reflecting exit
418
 
                         status of last checker. -1 reflects crashed
419
 
                         checker, -2 means no checker completed yet.
420
 
    last_enabled: datetime.datetime(); (UTC) or None
421
 
    name:       string; from the config file, used in log messages and
422
 
                        D-Bus identifiers
423
 
    secret:     bytestring; sent verbatim (over TLS) to client
424
 
    timeout:    datetime.timedelta(); How long from last_checked_ok
425
 
                                      until this client is disabled
426
 
    extended_timeout:   extra long timeout when secret has been sent
427
 
    runtime_expansions: Allowed attributes for runtime expansion.
428
 
    expires:    datetime.datetime(); time (UTC) when a client will be
429
 
                disabled, or None
 
195
    Private attibutes:
 
196
    _timeout: Real variable for 'timeout'
 
197
    _interval: Real variable for 'interval'
 
198
    _timeout_milliseconds: Used when calling gobject.timeout_add()
 
199
    _interval_milliseconds: - '' -
430
200
    """
431
 
    
432
 
    runtime_expansions = ("approval_delay", "approval_duration",
433
 
                          "created", "enabled", "fingerprint",
434
 
                          "host", "interval", "last_checked_ok",
435
 
                          "last_enabled", "name", "timeout")
436
 
    client_defaults = { "timeout": "5m",
437
 
                        "extended_timeout": "15m",
438
 
                        "interval": "2m",
439
 
                        "checker": "fping -q -- %%(host)s",
440
 
                        "host": "",
441
 
                        "approval_delay": "0s",
442
 
                        "approval_duration": "1s",
443
 
                        "approved_by_default": "True",
444
 
                        "enabled": "True",
445
 
                        }
446
 
    
447
 
    def timeout_milliseconds(self):
448
 
        "Return the 'timeout' attribute in milliseconds"
449
 
        return timedelta_to_milliseconds(self.timeout)
450
 
    
451
 
    def extended_timeout_milliseconds(self):
452
 
        "Return the 'extended_timeout' attribute in milliseconds"
453
 
        return timedelta_to_milliseconds(self.extended_timeout)
454
 
    
455
 
    def interval_milliseconds(self):
456
 
        "Return the 'interval' attribute in milliseconds"
457
 
        return timedelta_to_milliseconds(self.interval)
458
 
    
459
 
    def approval_delay_milliseconds(self):
460
 
        return timedelta_to_milliseconds(self.approval_delay)
461
 
 
462
 
    @staticmethod
463
 
    def config_parser(config):
464
 
        """Construct a new dict of client settings of this form:
465
 
        { client_name: {setting_name: value, ...}, ...}
466
 
        with exceptions for any special settings as defined above.
467
 
        NOTE: Must be a pure function. Must return the same result
468
 
        value given the same arguments.
469
 
        """
470
 
        settings = {}
471
 
        for client_name in config.sections():
472
 
            section = dict(config.items(client_name))
473
 
            client = settings[client_name] = {}
474
 
            
475
 
            client["host"] = section["host"]
476
 
            # Reformat values from string types to Python types
477
 
            client["approved_by_default"] = config.getboolean(
478
 
                client_name, "approved_by_default")
479
 
            client["enabled"] = config.getboolean(client_name,
480
 
                                                  "enabled")
481
 
            
482
 
            client["fingerprint"] = (section["fingerprint"].upper()
483
 
                                     .replace(" ", ""))
484
 
            if "secret" in section:
485
 
                client["secret"] = section["secret"].decode("base64")
486
 
            elif "secfile" in section:
487
 
                with open(os.path.expanduser(os.path.expandvars
488
 
                                             (section["secfile"])),
489
 
                          "rb") as secfile:
490
 
                    client["secret"] = secfile.read()
491
 
            else:
492
 
                raise TypeError("No secret or secfile for section %s"
493
 
                                % section)
494
 
            client["timeout"] = string_to_delta(section["timeout"])
495
 
            client["extended_timeout"] = string_to_delta(
496
 
                section["extended_timeout"])
497
 
            client["interval"] = string_to_delta(section["interval"])
498
 
            client["approval_delay"] = string_to_delta(
499
 
                section["approval_delay"])
500
 
            client["approval_duration"] = string_to_delta(
501
 
                section["approval_duration"])
502
 
            client["checker_command"] = section["checker"]
503
 
            client["last_approval_request"] = None
504
 
            client["last_checked_ok"] = None
505
 
            client["last_checker_status"] = -2
506
 
        
507
 
        return settings
508
 
        
509
 
        
510
 
    def __init__(self, settings, name = None):
511
 
        """Note: the 'checker' key in 'config' sets the
512
 
        'checker_command' attribute and *not* the 'checker'
513
 
        attribute."""
 
201
    def _set_timeout(self, timeout):
 
202
        "Setter function for 'timeout' attribute"
 
203
        self._timeout = timeout
 
204
        self._timeout_milliseconds = ((self.timeout.days
 
205
                                       * 24 * 60 * 60 * 1000)
 
206
                                      + (self.timeout.seconds * 1000)
 
207
                                      + (self.timeout.microseconds
 
208
                                         // 1000))
 
209
    timeout = property(lambda self: self._timeout,
 
210
                       _set_timeout)
 
211
    del _set_timeout
 
212
    def _set_interval(self, interval):
 
213
        "Setter function for 'interval' attribute"
 
214
        self._interval = interval
 
215
        self._interval_milliseconds = ((self.interval.days
 
216
                                        * 24 * 60 * 60 * 1000)
 
217
                                       + (self.interval.seconds
 
218
                                          * 1000)
 
219
                                       + (self.interval.microseconds
 
220
                                          // 1000))
 
221
    interval = property(lambda self: self._interval,
 
222
                        _set_interval)
 
223
    del _set_interval
 
224
    def __init__(self, name = None, stop_hook=None, config={}):
 
225
        """Note: the 'checker' argument sets the 'checker_command'
 
226
        attribute and not the 'checker' attribute.."""
514
227
        self.name = name
515
 
        # adding all client settings
516
 
        for setting, value in settings.iteritems():
517
 
            setattr(self, setting, value)
518
 
        
519
 
        if self.enabled:
520
 
            if not hasattr(self, "last_enabled"):
521
 
                self.last_enabled = datetime.datetime.utcnow()
522
 
            if not hasattr(self, "expires"):
523
 
                self.expires = (datetime.datetime.utcnow()
524
 
                                + self.timeout)
 
228
        logger.debug(u"Creating client %r", self.name)
 
229
        # Uppercase and remove spaces from fingerprint
 
230
        # for later comparison purposes with return value of
 
231
        # the fingerprint() function
 
232
        self.fingerprint = config["fingerprint"].upper()\
 
233
                           .replace(u" ", u"")
 
234
        logger.debug(u"  Fingerprint: %s", self.fingerprint)
 
235
        if "secret" in config:
 
236
            self.secret = config["secret"].decode(u"base64")
 
237
        elif "secfile" in config:
 
238
            sf = open(config["secfile"])
 
239
            self.secret = sf.read()
 
240
            sf.close()
525
241
        else:
526
 
            self.last_enabled = None
527
 
            self.expires = None
528
 
       
529
 
        logger.debug("Creating client %r", self.name)
530
 
        # Uppercase and remove spaces from fingerprint for later
531
 
        # comparison purposes with return value from the fingerprint()
532
 
        # function
533
 
        logger.debug("  Fingerprint: %s", self.fingerprint)
534
 
        self.created = settings.get("created",
535
 
                                    datetime.datetime.utcnow())
536
 
 
537
 
        # attributes specific for this server instance
 
242
            raise TypeError(u"No secret or secfile for client %s"
 
243
                            % self.name)
 
244
        self.fqdn = config.get("fqdn", "")
 
245
        self.created = datetime.datetime.now()
 
246
        self.last_checked_ok = None
 
247
        self.timeout = string_to_delta(config["timeout"])
 
248
        self.interval = string_to_delta(config["interval"])
 
249
        self.stop_hook = stop_hook
538
250
        self.checker = None
539
251
        self.checker_initiator_tag = None
540
 
        self.disable_initiator_tag = None
 
252
        self.stop_initiator_tag = None
541
253
        self.checker_callback_tag = None
542
 
        self.current_checker_command = None
543
 
        self.approved = None
544
 
        self.approvals_pending = 0
545
 
        self.changedstate = (multiprocessing_manager
546
 
                             .Condition(multiprocessing_manager
547
 
                                        .Lock()))
548
 
        self.client_structure = [attr for attr in
549
 
                                 self.__dict__.iterkeys()
550
 
                                 if not attr.startswith("_")]
551
 
        self.client_structure.append("client_structure")
552
 
        
553
 
        for name, t in inspect.getmembers(type(self),
554
 
                                          lambda obj:
555
 
                                              isinstance(obj,
556
 
                                                         property)):
557
 
            if not name.startswith("_"):
558
 
                self.client_structure.append(name)
559
 
    
560
 
    # Send notice to process children that client state has changed
561
 
    def send_changedstate(self):
562
 
        with self.changedstate:
563
 
            self.changedstate.notify_all()
564
 
    
565
 
    def enable(self):
 
254
        self.check_command = config["checker"]
 
255
    def start(self):
566
256
        """Start this client's checker and timeout hooks"""
567
 
        if getattr(self, "enabled", False):
568
 
            # Already enabled
569
 
            return
570
 
        self.send_changedstate()
571
 
        self.expires = datetime.datetime.utcnow() + self.timeout
572
 
        self.enabled = True
573
 
        self.last_enabled = datetime.datetime.utcnow()
574
 
        self.init_checker()
575
 
    
576
 
    def disable(self, quiet=True):
577
 
        """Disable this client."""
578
 
        if not getattr(self, "enabled", False):
 
257
        # Schedule a new checker to be started an 'interval' from now,
 
258
        # and every interval from then on.
 
259
        self.checker_initiator_tag = gobject.timeout_add\
 
260
                                     (self._interval_milliseconds,
 
261
                                      self.start_checker)
 
262
        # Also start a new checker *right now*.
 
263
        self.start_checker()
 
264
        # Schedule a stop() when 'timeout' has passed
 
265
        self.stop_initiator_tag = gobject.timeout_add\
 
266
                                  (self._timeout_milliseconds,
 
267
                                   self.stop)
 
268
    def stop(self):
 
269
        """Stop this client.
 
270
        The possibility that a client might be restarted is left open,
 
271
        but not currently used."""
 
272
        # If this client doesn't have a secret, it is already stopped.
 
273
        if self.secret:
 
274
            logger.info(u"Stopping client %s", self.name)
 
275
            self.secret = None
 
276
        else:
579
277
            return False
580
 
        if not quiet:
581
 
            self.send_changedstate()
582
 
        if not quiet:
583
 
            logger.info("Disabling client %s", self.name)
584
 
        if getattr(self, "disable_initiator_tag", False):
585
 
            gobject.source_remove(self.disable_initiator_tag)
586
 
            self.disable_initiator_tag = None
587
 
        self.expires = None
 
278
        if getattr(self, "stop_initiator_tag", False):
 
279
            gobject.source_remove(self.stop_initiator_tag)
 
280
            self.stop_initiator_tag = None
588
281
        if getattr(self, "checker_initiator_tag", False):
589
282
            gobject.source_remove(self.checker_initiator_tag)
590
283
            self.checker_initiator_tag = None
591
284
        self.stop_checker()
592
 
        self.enabled = False
 
285
        if self.stop_hook:
 
286
            self.stop_hook(self)
593
287
        # Do not run this again if called by a gobject.timeout_add
594
288
        return False
595
 
    
596
289
    def __del__(self):
597
 
        self.disable()
598
 
    
599
 
    def init_checker(self):
600
 
        # Schedule a new checker to be started an 'interval' from now,
601
 
        # and every interval from then on.
602
 
        self.checker_initiator_tag = (gobject.timeout_add
603
 
                                      (self.interval_milliseconds(),
604
 
                                       self.start_checker))
605
 
        # Schedule a disable() when 'timeout' has passed
606
 
        self.disable_initiator_tag = (gobject.timeout_add
607
 
                                   (self.timeout_milliseconds(),
608
 
                                    self.disable))
609
 
        # Also start a new checker *right now*.
610
 
        self.start_checker()
611
 
    
612
 
    def checker_callback(self, pid, condition, command):
 
290
        self.stop_hook = None
 
291
        self.stop()
 
292
    def checker_callback(self, pid, condition):
613
293
        """The checker has completed, so take appropriate actions."""
 
294
        now = datetime.datetime.now()
614
295
        self.checker_callback_tag = None
615
296
        self.checker = None
616
 
        if os.WIFEXITED(condition):
617
 
            self.last_checker_status = os.WEXITSTATUS(condition)
618
 
            if self.last_checker_status == 0:
619
 
                logger.info("Checker for %(name)s succeeded",
620
 
                            vars(self))
621
 
                self.checked_ok()
622
 
            else:
623
 
                logger.info("Checker for %(name)s failed",
624
 
                            vars(self))
625
 
        else:
626
 
            self.last_checker_status = -1
627
 
            logger.warning("Checker for %(name)s crashed?",
 
297
        if os.WIFEXITED(condition) \
 
298
               and (os.WEXITSTATUS(condition) == 0):
 
299
            logger.info(u"Checker for %(name)s succeeded",
 
300
                        vars(self))
 
301
            self.last_checked_ok = now
 
302
            gobject.source_remove(self.stop_initiator_tag)
 
303
            self.stop_initiator_tag = gobject.timeout_add\
 
304
                                      (self._timeout_milliseconds,
 
305
                                       self.stop)
 
306
        elif not os.WIFEXITED(condition):
 
307
            logger.warning(u"Checker for %(name)s crashed?",
628
308
                           vars(self))
629
 
    
630
 
    def checked_ok(self):
631
 
        """Assert that the client has been seen, alive and well."""
632
 
        self.last_checked_ok = datetime.datetime.utcnow()
633
 
        self.last_checker_status = 0
634
 
        self.bump_timeout()
635
 
    
636
 
    def bump_timeout(self, timeout=None):
637
 
        """Bump up the timeout for this client."""
638
 
        if timeout is None:
639
 
            timeout = self.timeout
640
 
        if self.disable_initiator_tag is not None:
641
 
            gobject.source_remove(self.disable_initiator_tag)
642
 
        if getattr(self, "enabled", False):
643
 
            self.disable_initiator_tag = (gobject.timeout_add
644
 
                                          (timedelta_to_milliseconds
645
 
                                           (timeout), self.disable))
646
 
            self.expires = datetime.datetime.utcnow() + timeout
647
 
    
648
 
    def need_approval(self):
649
 
        self.last_approval_request = datetime.datetime.utcnow()
650
 
    
 
309
        else:
 
310
            logger.info(u"Checker for %(name)s failed",
 
311
                        vars(self))
651
312
    def start_checker(self):
652
313
        """Start a new checker subprocess if one is not running.
653
 
        
654
314
        If a checker already exists, leave it running and do
655
315
        nothing."""
656
316
        # The reason for not killing a running checker is that if we
659
319
        # client would inevitably timeout, since no checker would get
660
320
        # a chance to run to completion.  If we instead leave running
661
321
        # checkers alone, the checker would have to take more time
662
 
        # than 'timeout' for the client to be disabled, which is as it
663
 
        # should be.
664
 
        
665
 
        # If a checker exists, make sure it is not a zombie
666
 
        try:
667
 
            pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
668
 
        except (AttributeError, OSError) as error:
669
 
            if (isinstance(error, OSError)
670
 
                and error.errno != errno.ECHILD):
671
 
                raise error
672
 
        else:
673
 
            if pid:
674
 
                logger.warning("Checker was a zombie")
675
 
                gobject.source_remove(self.checker_callback_tag)
676
 
                self.checker_callback(pid, status,
677
 
                                      self.current_checker_command)
678
 
        # Start a new checker if needed
 
322
        # than 'timeout' for the client to be declared invalid, which
 
323
        # is as it should be.
679
324
        if self.checker is None:
680
325
            try:
681
 
                # In case checker_command has exactly one % operator
682
 
                command = self.checker_command % self.host
 
326
                # In case check_command has exactly one % operator
 
327
                command = self.check_command % self.fqdn
683
328
            except TypeError:
684
329
                # Escape attributes for the shell
685
 
                escaped_attrs = dict(
686
 
                    (attr,
687
 
                     re.escape(unicode(str(getattr(self, attr, "")),
688
 
                                       errors=
689
 
                                       'replace')))
690
 
                    for attr in
691
 
                    self.runtime_expansions)
692
 
                
 
330
                escaped_attrs = dict((key, re.escape(str(val)))
 
331
                                     for key, val in
 
332
                                     vars(self).iteritems())
693
333
                try:
694
 
                    command = self.checker_command % escaped_attrs
695
 
                except TypeError as error:
696
 
                    logger.error('Could not format string "%s":'
697
 
                                 ' %s', self.checker_command, error)
 
334
                    command = self.check_command % escaped_attrs
 
335
                except TypeError, error:
 
336
                    logger.error(u'Could not format string "%s":'
 
337
                                 u' %s', self.check_command, error)
698
338
                    return True # Try again later
699
 
            self.current_checker_command = command
700
339
            try:
701
 
                logger.info("Starting checker %r for %s",
 
340
                logger.info(u"Starting checker %r for %s",
702
341
                            command, self.name)
703
 
                # We don't need to redirect stdout and stderr, since
704
 
                # in normal mode, that is already done by daemon(),
705
 
                # and in debug mode we don't want to.  (Stdin is
706
 
                # always replaced by /dev/null.)
707
342
                self.checker = subprocess.Popen(command,
708
343
                                                close_fds=True,
709
344
                                                shell=True, cwd="/")
710
 
                self.checker_callback_tag = (gobject.child_watch_add
711
 
                                             (self.checker.pid,
712
 
                                              self.checker_callback,
713
 
                                              data=command))
714
 
                # The checker may have completed before the gobject
715
 
                # watch was added.  Check for this.
716
 
                pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
717
 
                if pid:
718
 
                    gobject.source_remove(self.checker_callback_tag)
719
 
                    self.checker_callback(pid, status, command)
720
 
            except OSError as error:
721
 
                logger.error("Failed to start subprocess: %s",
 
345
                self.checker_callback_tag = gobject.child_watch_add\
 
346
                                            (self.checker.pid,
 
347
                                             self.checker_callback)
 
348
            except subprocess.OSError, error:
 
349
                logger.error(u"Failed to start subprocess: %s",
722
350
                             error)
723
351
        # Re-run this periodically if run by gobject.timeout_add
724
352
        return True
725
 
    
726
353
    def stop_checker(self):
727
354
        """Force the checker process, if any, to stop."""
728
355
        if self.checker_callback_tag:
733
360
        logger.debug("Stopping checker for %(name)s", vars(self))
734
361
        try:
735
362
            os.kill(self.checker.pid, signal.SIGTERM)
736
 
            #time.sleep(0.5)
 
363
            #os.sleep(0.5)
737
364
            #if self.checker.poll() is None:
738
365
            #    os.kill(self.checker.pid, signal.SIGKILL)
739
 
        except OSError as error:
 
366
        except OSError, error:
740
367
            if error.errno != errno.ESRCH: # No such process
741
368
                raise
742
369
        self.checker = None
743
 
 
744
 
 
745
 
def dbus_service_property(dbus_interface, signature="v",
746
 
                          access="readwrite", byte_arrays=False):
747
 
    """Decorators for marking methods of a DBusObjectWithProperties to
748
 
    become properties on the D-Bus.
749
 
    
750
 
    The decorated method will be called with no arguments by "Get"
751
 
    and with one argument by "Set".
752
 
    
753
 
    The parameters, where they are supported, are the same as
754
 
    dbus.service.method, except there is only "signature", since the
755
 
    type from Get() and the type sent to Set() is the same.
756
 
    """
757
 
    # Encoding deeply encoded byte arrays is not supported yet by the
758
 
    # "Set" method, so we fail early here:
759
 
    if byte_arrays and signature != "ay":
760
 
        raise ValueError("Byte arrays not supported for non-'ay'"
761
 
                         " signature %r" % signature)
762
 
    def decorator(func):
763
 
        func._dbus_is_property = True
764
 
        func._dbus_interface = dbus_interface
765
 
        func._dbus_signature = signature
766
 
        func._dbus_access = access
767
 
        func._dbus_name = func.__name__
768
 
        if func._dbus_name.endswith("_dbus_property"):
769
 
            func._dbus_name = func._dbus_name[:-14]
770
 
        func._dbus_get_args_options = {'byte_arrays': byte_arrays }
771
 
        return func
772
 
    return decorator
773
 
 
774
 
 
775
 
def dbus_interface_annotations(dbus_interface):
776
 
    """Decorator for marking functions returning interface annotations.
777
 
    
778
 
    Usage:
779
 
    
780
 
    @dbus_interface_annotations("org.example.Interface")
781
 
    def _foo(self):  # Function name does not matter
782
 
        return {"org.freedesktop.DBus.Deprecated": "true",
783
 
                "org.freedesktop.DBus.Property.EmitsChangedSignal":
784
 
                    "false"}
785
 
    """
786
 
    def decorator(func):
787
 
        func._dbus_is_interface = True
788
 
        func._dbus_interface = dbus_interface
789
 
        func._dbus_name = dbus_interface
790
 
        return func
791
 
    return decorator
792
 
 
793
 
 
794
 
def dbus_annotations(annotations):
795
 
    """Decorator to annotate D-Bus methods, signals or properties
796
 
    Usage:
797
 
    
798
 
    @dbus_service_property("org.example.Interface", signature="b",
799
 
                           access="r")
800
 
    @dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",
801
 
                        "org.freedesktop.DBus.Property."
802
 
                        "EmitsChangedSignal": "false"})
803
 
    def Property_dbus_property(self):
804
 
        return dbus.Boolean(False)
805
 
    """
806
 
    def decorator(func):
807
 
        func._dbus_annotations = annotations
808
 
        return func
809
 
    return decorator
810
 
 
811
 
 
812
 
class DBusPropertyException(dbus.exceptions.DBusException):
813
 
    """A base class for D-Bus property-related exceptions
814
 
    """
815
 
    def __unicode__(self):
816
 
        return unicode(str(self))
817
 
 
818
 
 
819
 
class DBusPropertyAccessException(DBusPropertyException):
820
 
    """A property's access permissions disallows an operation.
821
 
    """
822
 
    pass
823
 
 
824
 
 
825
 
class DBusPropertyNotFound(DBusPropertyException):
826
 
    """An attempt was made to access a non-existing property.
827
 
    """
828
 
    pass
829
 
 
830
 
 
831
 
class DBusObjectWithProperties(dbus.service.Object):
832
 
    """A D-Bus object with properties.
833
 
    
834
 
    Classes inheriting from this can use the dbus_service_property
835
 
    decorator to expose methods as D-Bus properties.  It exposes the
836
 
    standard Get(), Set(), and GetAll() methods on the D-Bus.
837
 
    """
838
 
    
839
 
    @staticmethod
840
 
    def _is_dbus_thing(thing):
841
 
        """Returns a function testing if an attribute is a D-Bus thing
842
 
        
843
 
        If called like _is_dbus_thing("method") it returns a function
844
 
        suitable for use as predicate to inspect.getmembers().
845
 
        """
846
 
        return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),
847
 
                                   False)
848
 
    
849
 
    def _get_all_dbus_things(self, thing):
850
 
        """Returns a generator of (name, attribute) pairs
851
 
        """
852
 
        return ((getattr(athing.__get__(self), "_dbus_name",
853
 
                         name),
854
 
                 athing.__get__(self))
855
 
                for cls in self.__class__.__mro__
856
 
                for name, athing in
857
 
                inspect.getmembers(cls,
858
 
                                   self._is_dbus_thing(thing)))
859
 
    
860
 
    def _get_dbus_property(self, interface_name, property_name):
861
 
        """Returns a bound method if one exists which is a D-Bus
862
 
        property with the specified name and interface.
863
 
        """
864
 
        for cls in  self.__class__.__mro__:
865
 
            for name, value in (inspect.getmembers
866
 
                                (cls,
867
 
                                 self._is_dbus_thing("property"))):
868
 
                if (value._dbus_name == property_name
869
 
                    and value._dbus_interface == interface_name):
870
 
                    return value.__get__(self)
871
 
        
872
 
        # No such property
873
 
        raise DBusPropertyNotFound(self.dbus_object_path + ":"
874
 
                                   + interface_name + "."
875
 
                                   + property_name)
876
 
    
877
 
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
878
 
                         out_signature="v")
879
 
    def Get(self, interface_name, property_name):
880
 
        """Standard D-Bus property Get() method, see D-Bus standard.
881
 
        """
882
 
        prop = self._get_dbus_property(interface_name, property_name)
883
 
        if prop._dbus_access == "write":
884
 
            raise DBusPropertyAccessException(property_name)
885
 
        value = prop()
886
 
        if not hasattr(value, "variant_level"):
887
 
            return value
888
 
        return type(value)(value, variant_level=value.variant_level+1)
889
 
    
890
 
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
891
 
    def Set(self, interface_name, property_name, value):
892
 
        """Standard D-Bus property Set() method, see D-Bus standard.
893
 
        """
894
 
        prop = self._get_dbus_property(interface_name, property_name)
895
 
        if prop._dbus_access == "read":
896
 
            raise DBusPropertyAccessException(property_name)
897
 
        if prop._dbus_get_args_options["byte_arrays"]:
898
 
            # The byte_arrays option is not supported yet on
899
 
            # signatures other than "ay".
900
 
            if prop._dbus_signature != "ay":
901
 
                raise ValueError
902
 
            value = dbus.ByteArray(b''.join(chr(byte)
903
 
                                            for byte in value))
904
 
        prop(value)
905
 
    
906
 
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
907
 
                         out_signature="a{sv}")
908
 
    def GetAll(self, interface_name):
909
 
        """Standard D-Bus property GetAll() method, see D-Bus
910
 
        standard.
911
 
        
912
 
        Note: Will not include properties with access="write".
913
 
        """
914
 
        properties = {}
915
 
        for name, prop in self._get_all_dbus_things("property"):
916
 
            if (interface_name
917
 
                and interface_name != prop._dbus_interface):
918
 
                # Interface non-empty but did not match
919
 
                continue
920
 
            # Ignore write-only properties
921
 
            if prop._dbus_access == "write":
922
 
                continue
923
 
            value = prop()
924
 
            if not hasattr(value, "variant_level"):
925
 
                properties[name] = value
926
 
                continue
927
 
            properties[name] = type(value)(value, variant_level=
928
 
                                           value.variant_level+1)
929
 
        return dbus.Dictionary(properties, signature="sv")
930
 
    
931
 
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
932
 
                         out_signature="s",
933
 
                         path_keyword='object_path',
934
 
                         connection_keyword='connection')
935
 
    def Introspect(self, object_path, connection):
936
 
        """Overloading of standard D-Bus method.
937
 
        
938
 
        Inserts property tags and interface annotation tags.
939
 
        """
940
 
        xmlstring = dbus.service.Object.Introspect(self, object_path,
941
 
                                                   connection)
942
 
        try:
943
 
            document = xml.dom.minidom.parseString(xmlstring)
944
 
            def make_tag(document, name, prop):
945
 
                e = document.createElement("property")
946
 
                e.setAttribute("name", name)
947
 
                e.setAttribute("type", prop._dbus_signature)
948
 
                e.setAttribute("access", prop._dbus_access)
949
 
                return e
950
 
            for if_tag in document.getElementsByTagName("interface"):
951
 
                # Add property tags
952
 
                for tag in (make_tag(document, name, prop)
953
 
                            for name, prop
954
 
                            in self._get_all_dbus_things("property")
955
 
                            if prop._dbus_interface
956
 
                            == if_tag.getAttribute("name")):
957
 
                    if_tag.appendChild(tag)
958
 
                # Add annotation tags
959
 
                for typ in ("method", "signal", "property"):
960
 
                    for tag in if_tag.getElementsByTagName(typ):
961
 
                        annots = dict()
962
 
                        for name, prop in (self.
963
 
                                           _get_all_dbus_things(typ)):
964
 
                            if (name == tag.getAttribute("name")
965
 
                                and prop._dbus_interface
966
 
                                == if_tag.getAttribute("name")):
967
 
                                annots.update(getattr
968
 
                                              (prop,
969
 
                                               "_dbus_annotations",
970
 
                                               {}))
971
 
                        for name, value in annots.iteritems():
972
 
                            ann_tag = document.createElement(
973
 
                                "annotation")
974
 
                            ann_tag.setAttribute("name", name)
975
 
                            ann_tag.setAttribute("value", value)
976
 
                            tag.appendChild(ann_tag)
977
 
                # Add interface annotation tags
978
 
                for annotation, value in dict(
979
 
                    itertools.chain(
980
 
                        *(annotations().iteritems()
981
 
                          for name, annotations in
982
 
                          self._get_all_dbus_things("interface")
983
 
                          if name == if_tag.getAttribute("name")
984
 
                          ))).iteritems():
985
 
                    ann_tag = document.createElement("annotation")
986
 
                    ann_tag.setAttribute("name", annotation)
987
 
                    ann_tag.setAttribute("value", value)
988
 
                    if_tag.appendChild(ann_tag)
989
 
                # Add the names to the return values for the
990
 
                # "org.freedesktop.DBus.Properties" methods
991
 
                if (if_tag.getAttribute("name")
992
 
                    == "org.freedesktop.DBus.Properties"):
993
 
                    for cn in if_tag.getElementsByTagName("method"):
994
 
                        if cn.getAttribute("name") == "Get":
995
 
                            for arg in cn.getElementsByTagName("arg"):
996
 
                                if (arg.getAttribute("direction")
997
 
                                    == "out"):
998
 
                                    arg.setAttribute("name", "value")
999
 
                        elif cn.getAttribute("name") == "GetAll":
1000
 
                            for arg in cn.getElementsByTagName("arg"):
1001
 
                                if (arg.getAttribute("direction")
1002
 
                                    == "out"):
1003
 
                                    arg.setAttribute("name", "props")
1004
 
            xmlstring = document.toxml("utf-8")
1005
 
            document.unlink()
1006
 
        except (AttributeError, xml.dom.DOMException,
1007
 
                xml.parsers.expat.ExpatError) as error:
1008
 
            logger.error("Failed to override Introspection method",
1009
 
                         error)
1010
 
        return xmlstring
1011
 
 
1012
 
 
1013
 
def datetime_to_dbus (dt, variant_level=0):
1014
 
    """Convert a UTC datetime.datetime() to a D-Bus type."""
1015
 
    if dt is None:
1016
 
        return dbus.String("", variant_level = variant_level)
1017
 
    return dbus.String(dt.isoformat(),
1018
 
                       variant_level=variant_level)
1019
 
 
1020
 
 
1021
 
class AlternateDBusNamesMetaclass(DBusObjectWithProperties
1022
 
                                  .__metaclass__):
1023
 
    """Applied to an empty subclass of a D-Bus object, this metaclass
1024
 
    will add additional D-Bus attributes matching a certain pattern.
1025
 
    """
1026
 
    def __new__(mcs, name, bases, attr):
1027
 
        # Go through all the base classes which could have D-Bus
1028
 
        # methods, signals, or properties in them
1029
 
        old_interface_names = []
1030
 
        for base in (b for b in bases
1031
 
                     if issubclass(b, dbus.service.Object)):
1032
 
            # Go though all attributes of the base class
1033
 
            for attrname, attribute in inspect.getmembers(base):
1034
 
                # Ignore non-D-Bus attributes, and D-Bus attributes
1035
 
                # with the wrong interface name
1036
 
                if (not hasattr(attribute, "_dbus_interface")
1037
 
                    or not attribute._dbus_interface
1038
 
                    .startswith("se.recompile.Mandos")):
1039
 
                    continue
1040
 
                # Create an alternate D-Bus interface name based on
1041
 
                # the current name
1042
 
                alt_interface = (attribute._dbus_interface
1043
 
                                 .replace("se.recompile.Mandos",
1044
 
                                          "se.bsnet.fukt.Mandos"))
1045
 
                if alt_interface != attribute._dbus_interface:
1046
 
                    old_interface_names.append(alt_interface)
1047
 
                # Is this a D-Bus signal?
1048
 
                if getattr(attribute, "_dbus_is_signal", False):
1049
 
                    # Extract the original non-method function by
1050
 
                    # black magic
1051
 
                    nonmethod_func = (dict(
1052
 
                            zip(attribute.func_code.co_freevars,
1053
 
                                attribute.__closure__))["func"]
1054
 
                                      .cell_contents)
1055
 
                    # Create a new, but exactly alike, function
1056
 
                    # object, and decorate it to be a new D-Bus signal
1057
 
                    # with the alternate D-Bus interface name
1058
 
                    new_function = (dbus.service.signal
1059
 
                                    (alt_interface,
1060
 
                                     attribute._dbus_signature)
1061
 
                                    (types.FunctionType(
1062
 
                                nonmethod_func.func_code,
1063
 
                                nonmethod_func.func_globals,
1064
 
                                nonmethod_func.func_name,
1065
 
                                nonmethod_func.func_defaults,
1066
 
                                nonmethod_func.func_closure)))
1067
 
                    # Copy annotations, if any
1068
 
                    try:
1069
 
                        new_function._dbus_annotations = (
1070
 
                            dict(attribute._dbus_annotations))
1071
 
                    except AttributeError:
1072
 
                        pass
1073
 
                    # Define a creator of a function to call both the
1074
 
                    # old and new functions, so both the old and new
1075
 
                    # signals gets sent when the function is called
1076
 
                    def fixscope(func1, func2):
1077
 
                        """This function is a scope container to pass
1078
 
                        func1 and func2 to the "call_both" function
1079
 
                        outside of its arguments"""
1080
 
                        def call_both(*args, **kwargs):
1081
 
                            """This function will emit two D-Bus
1082
 
                            signals by calling func1 and func2"""
1083
 
                            func1(*args, **kwargs)
1084
 
                            func2(*args, **kwargs)
1085
 
                        return call_both
1086
 
                    # Create the "call_both" function and add it to
1087
 
                    # the class
1088
 
                    attr[attrname] = fixscope(attribute,
1089
 
                                              new_function)
1090
 
                # Is this a D-Bus method?
1091
 
                elif getattr(attribute, "_dbus_is_method", False):
1092
 
                    # Create a new, but exactly alike, function
1093
 
                    # object.  Decorate it to be a new D-Bus method
1094
 
                    # with the alternate D-Bus interface name.  Add it
1095
 
                    # to the class.
1096
 
                    attr[attrname] = (dbus.service.method
1097
 
                                      (alt_interface,
1098
 
                                       attribute._dbus_in_signature,
1099
 
                                       attribute._dbus_out_signature)
1100
 
                                      (types.FunctionType
1101
 
                                       (attribute.func_code,
1102
 
                                        attribute.func_globals,
1103
 
                                        attribute.func_name,
1104
 
                                        attribute.func_defaults,
1105
 
                                        attribute.func_closure)))
1106
 
                    # Copy annotations, if any
1107
 
                    try:
1108
 
                        attr[attrname]._dbus_annotations = (
1109
 
                            dict(attribute._dbus_annotations))
1110
 
                    except AttributeError:
1111
 
                        pass
1112
 
                # Is this a D-Bus property?
1113
 
                elif getattr(attribute, "_dbus_is_property", False):
1114
 
                    # Create a new, but exactly alike, function
1115
 
                    # object, and decorate it to be a new D-Bus
1116
 
                    # property with the alternate D-Bus interface
1117
 
                    # name.  Add it to the class.
1118
 
                    attr[attrname] = (dbus_service_property
1119
 
                                      (alt_interface,
1120
 
                                       attribute._dbus_signature,
1121
 
                                       attribute._dbus_access,
1122
 
                                       attribute
1123
 
                                       ._dbus_get_args_options
1124
 
                                       ["byte_arrays"])
1125
 
                                      (types.FunctionType
1126
 
                                       (attribute.func_code,
1127
 
                                        attribute.func_globals,
1128
 
                                        attribute.func_name,
1129
 
                                        attribute.func_defaults,
1130
 
                                        attribute.func_closure)))
1131
 
                    # Copy annotations, if any
1132
 
                    try:
1133
 
                        attr[attrname]._dbus_annotations = (
1134
 
                            dict(attribute._dbus_annotations))
1135
 
                    except AttributeError:
1136
 
                        pass
1137
 
                # Is this a D-Bus interface?
1138
 
                elif getattr(attribute, "_dbus_is_interface", False):
1139
 
                    # Create a new, but exactly alike, function
1140
 
                    # object.  Decorate it to be a new D-Bus interface
1141
 
                    # with the alternate D-Bus interface name.  Add it
1142
 
                    # to the class.
1143
 
                    attr[attrname] = (dbus_interface_annotations
1144
 
                                      (alt_interface)
1145
 
                                      (types.FunctionType
1146
 
                                       (attribute.func_code,
1147
 
                                        attribute.func_globals,
1148
 
                                        attribute.func_name,
1149
 
                                        attribute.func_defaults,
1150
 
                                        attribute.func_closure)))
1151
 
        # Deprecate all old interfaces
1152
 
        basename="_AlternateDBusNamesMetaclass_interface_annotation{0}"
1153
 
        for old_interface_name in old_interface_names:
1154
 
            @dbus_interface_annotations(old_interface_name)
1155
 
            def func(self):
1156
 
                return { "org.freedesktop.DBus.Deprecated": "true" }
1157
 
            # Find an unused name
1158
 
            for aname in (basename.format(i) for i in
1159
 
                          itertools.count()):
1160
 
                if aname not in attr:
1161
 
                    attr[aname] = func
1162
 
                    break
1163
 
        return type.__new__(mcs, name, bases, attr)
1164
 
 
1165
 
 
1166
 
class ClientDBus(Client, DBusObjectWithProperties):
1167
 
    """A Client class using D-Bus
1168
 
    
1169
 
    Attributes:
1170
 
    dbus_object_path: dbus.ObjectPath
1171
 
    bus: dbus.SystemBus()
1172
 
    """
1173
 
    
1174
 
    runtime_expansions = (Client.runtime_expansions
1175
 
                          + ("dbus_object_path",))
1176
 
    
1177
 
    # dbus.service.Object doesn't use super(), so we can't either.
1178
 
    
1179
 
    def __init__(self, bus = None, *args, **kwargs):
1180
 
        self.bus = bus
1181
 
        Client.__init__(self, *args, **kwargs)
1182
 
        # Only now, when this client is initialized, can it show up on
1183
 
        # the D-Bus
1184
 
        client_object_name = unicode(self.name).translate(
1185
 
            {ord("."): ord("_"),
1186
 
             ord("-"): ord("_")})
1187
 
        self.dbus_object_path = (dbus.ObjectPath
1188
 
                                 ("/clients/" + client_object_name))
1189
 
        DBusObjectWithProperties.__init__(self, self.bus,
1190
 
                                          self.dbus_object_path)
1191
 
        
1192
 
    def notifychangeproperty(transform_func,
1193
 
                             dbus_name, type_func=lambda x: x,
1194
 
                             variant_level=1):
1195
 
        """ Modify a variable so that it's a property which announces
1196
 
        its changes to DBus.
1197
 
        
1198
 
        transform_fun: Function that takes a value and a variant_level
1199
 
                       and transforms it to a D-Bus type.
1200
 
        dbus_name: D-Bus name of the variable
1201
 
        type_func: Function that transform the value before sending it
1202
 
                   to the D-Bus.  Default: no transform
1203
 
        variant_level: D-Bus variant level.  Default: 1
1204
 
        """
1205
 
        attrname = "_{0}".format(dbus_name)
1206
 
        def setter(self, value):
1207
 
            if hasattr(self, "dbus_object_path"):
1208
 
                if (not hasattr(self, attrname) or
1209
 
                    type_func(getattr(self, attrname, None))
1210
 
                    != type_func(value)):
1211
 
                    dbus_value = transform_func(type_func(value),
1212
 
                                                variant_level
1213
 
                                                =variant_level)
1214
 
                    self.PropertyChanged(dbus.String(dbus_name),
1215
 
                                         dbus_value)
1216
 
            setattr(self, attrname, value)
1217
 
        
1218
 
        return property(lambda self: getattr(self, attrname), setter)
1219
 
    
1220
 
    
1221
 
    expires = notifychangeproperty(datetime_to_dbus, "Expires")
1222
 
    approvals_pending = notifychangeproperty(dbus.Boolean,
1223
 
                                             "ApprovalPending",
1224
 
                                             type_func = bool)
1225
 
    enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1226
 
    last_enabled = notifychangeproperty(datetime_to_dbus,
1227
 
                                        "LastEnabled")
1228
 
    checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",
1229
 
                                   type_func = lambda checker:
1230
 
                                       checker is not None)
1231
 
    last_checked_ok = notifychangeproperty(datetime_to_dbus,
1232
 
                                           "LastCheckedOK")
1233
 
    last_checker_status = notifychangeproperty(dbus.Int16,
1234
 
                                               "LastCheckerStatus")
1235
 
    last_approval_request = notifychangeproperty(
1236
 
        datetime_to_dbus, "LastApprovalRequest")
1237
 
    approved_by_default = notifychangeproperty(dbus.Boolean,
1238
 
                                               "ApprovedByDefault")
1239
 
    approval_delay = notifychangeproperty(dbus.UInt64,
1240
 
                                          "ApprovalDelay",
1241
 
                                          type_func =
1242
 
                                          timedelta_to_milliseconds)
1243
 
    approval_duration = notifychangeproperty(
1244
 
        dbus.UInt64, "ApprovalDuration",
1245
 
        type_func = timedelta_to_milliseconds)
1246
 
    host = notifychangeproperty(dbus.String, "Host")
1247
 
    timeout = notifychangeproperty(dbus.UInt64, "Timeout",
1248
 
                                   type_func =
1249
 
                                   timedelta_to_milliseconds)
1250
 
    extended_timeout = notifychangeproperty(
1251
 
        dbus.UInt64, "ExtendedTimeout",
1252
 
        type_func = timedelta_to_milliseconds)
1253
 
    interval = notifychangeproperty(dbus.UInt64,
1254
 
                                    "Interval",
1255
 
                                    type_func =
1256
 
                                    timedelta_to_milliseconds)
1257
 
    checker_command = notifychangeproperty(dbus.String, "Checker")
1258
 
    
1259
 
    del notifychangeproperty
1260
 
    
1261
 
    def __del__(self, *args, **kwargs):
1262
 
        try:
1263
 
            self.remove_from_connection()
1264
 
        except LookupError:
1265
 
            pass
1266
 
        if hasattr(DBusObjectWithProperties, "__del__"):
1267
 
            DBusObjectWithProperties.__del__(self, *args, **kwargs)
1268
 
        Client.__del__(self, *args, **kwargs)
1269
 
    
1270
 
    def checker_callback(self, pid, condition, command,
1271
 
                         *args, **kwargs):
1272
 
        self.checker_callback_tag = None
1273
 
        self.checker = None
1274
 
        if os.WIFEXITED(condition):
1275
 
            exitstatus = os.WEXITSTATUS(condition)
1276
 
            # Emit D-Bus signal
1277
 
            self.CheckerCompleted(dbus.Int16(exitstatus),
1278
 
                                  dbus.Int64(condition),
1279
 
                                  dbus.String(command))
1280
 
        else:
1281
 
            # Emit D-Bus signal
1282
 
            self.CheckerCompleted(dbus.Int16(-1),
1283
 
                                  dbus.Int64(condition),
1284
 
                                  dbus.String(command))
1285
 
        
1286
 
        return Client.checker_callback(self, pid, condition, command,
1287
 
                                       *args, **kwargs)
1288
 
    
1289
 
    def start_checker(self, *args, **kwargs):
1290
 
        old_checker = self.checker
1291
 
        if self.checker is not None:
1292
 
            old_checker_pid = self.checker.pid
1293
 
        else:
1294
 
            old_checker_pid = None
1295
 
        r = Client.start_checker(self, *args, **kwargs)
1296
 
        # Only if new checker process was started
1297
 
        if (self.checker is not None
1298
 
            and old_checker_pid != self.checker.pid):
1299
 
            # Emit D-Bus signal
1300
 
            self.CheckerStarted(self.current_checker_command)
1301
 
        return r
1302
 
    
1303
 
    def _reset_approved(self):
1304
 
        self.approved = None
1305
 
        return False
1306
 
    
1307
 
    def approve(self, value=True):
1308
 
        self.send_changedstate()
1309
 
        self.approved = value
1310
 
        gobject.timeout_add(timedelta_to_milliseconds
1311
 
                            (self.approval_duration),
1312
 
                            self._reset_approved)
1313
 
    
1314
 
    
1315
 
    ## D-Bus methods, signals & properties
1316
 
    _interface = "se.recompile.Mandos.Client"
1317
 
    
1318
 
    ## Interfaces
1319
 
    
1320
 
    @dbus_interface_annotations(_interface)
1321
 
    def _foo(self):
1322
 
        return { "org.freedesktop.DBus.Property.EmitsChangedSignal":
1323
 
                     "false"}
1324
 
    
1325
 
    ## Signals
1326
 
    
1327
 
    # CheckerCompleted - signal
1328
 
    @dbus.service.signal(_interface, signature="nxs")
1329
 
    def CheckerCompleted(self, exitcode, waitstatus, command):
1330
 
        "D-Bus signal"
1331
 
        pass
1332
 
    
1333
 
    # CheckerStarted - signal
1334
 
    @dbus.service.signal(_interface, signature="s")
1335
 
    def CheckerStarted(self, command):
1336
 
        "D-Bus signal"
1337
 
        pass
1338
 
    
1339
 
    # PropertyChanged - signal
1340
 
    @dbus.service.signal(_interface, signature="sv")
1341
 
    def PropertyChanged(self, property, value):
1342
 
        "D-Bus signal"
1343
 
        pass
1344
 
    
1345
 
    # GotSecret - signal
1346
 
    @dbus.service.signal(_interface)
1347
 
    def GotSecret(self):
1348
 
        """D-Bus signal
1349
 
        Is sent after a successful transfer of secret from the Mandos
1350
 
        server to mandos-client
1351
 
        """
1352
 
        pass
1353
 
    
1354
 
    # Rejected - signal
1355
 
    @dbus.service.signal(_interface, signature="s")
1356
 
    def Rejected(self, reason):
1357
 
        "D-Bus signal"
1358
 
        pass
1359
 
    
1360
 
    # NeedApproval - signal
1361
 
    @dbus.service.signal(_interface, signature="tb")
1362
 
    def NeedApproval(self, timeout, default):
1363
 
        "D-Bus signal"
1364
 
        return self.need_approval()
1365
 
    
1366
 
    ## Methods
1367
 
    
1368
 
    # Approve - method
1369
 
    @dbus.service.method(_interface, in_signature="b")
1370
 
    def Approve(self, value):
1371
 
        self.approve(value)
1372
 
    
1373
 
    # CheckedOK - method
1374
 
    @dbus.service.method(_interface)
1375
 
    def CheckedOK(self):
1376
 
        self.checked_ok()
1377
 
    
1378
 
    # Enable - method
1379
 
    @dbus.service.method(_interface)
1380
 
    def Enable(self):
1381
 
        "D-Bus method"
1382
 
        self.enable()
1383
 
    
1384
 
    # StartChecker - method
1385
 
    @dbus.service.method(_interface)
1386
 
    def StartChecker(self):
1387
 
        "D-Bus method"
1388
 
        self.start_checker()
1389
 
    
1390
 
    # Disable - method
1391
 
    @dbus.service.method(_interface)
1392
 
    def Disable(self):
1393
 
        "D-Bus method"
1394
 
        self.disable()
1395
 
    
1396
 
    # StopChecker - method
1397
 
    @dbus.service.method(_interface)
1398
 
    def StopChecker(self):
1399
 
        self.stop_checker()
1400
 
    
1401
 
    ## Properties
1402
 
    
1403
 
    # ApprovalPending - property
1404
 
    @dbus_service_property(_interface, signature="b", access="read")
1405
 
    def ApprovalPending_dbus_property(self):
1406
 
        return dbus.Boolean(bool(self.approvals_pending))
1407
 
    
1408
 
    # ApprovedByDefault - property
1409
 
    @dbus_service_property(_interface, signature="b",
1410
 
                           access="readwrite")
1411
 
    def ApprovedByDefault_dbus_property(self, value=None):
1412
 
        if value is None:       # get
1413
 
            return dbus.Boolean(self.approved_by_default)
1414
 
        self.approved_by_default = bool(value)
1415
 
    
1416
 
    # ApprovalDelay - property
1417
 
    @dbus_service_property(_interface, signature="t",
1418
 
                           access="readwrite")
1419
 
    def ApprovalDelay_dbus_property(self, value=None):
1420
 
        if value is None:       # get
1421
 
            return dbus.UInt64(self.approval_delay_milliseconds())
1422
 
        self.approval_delay = datetime.timedelta(0, 0, 0, value)
1423
 
    
1424
 
    # ApprovalDuration - property
1425
 
    @dbus_service_property(_interface, signature="t",
1426
 
                           access="readwrite")
1427
 
    def ApprovalDuration_dbus_property(self, value=None):
1428
 
        if value is None:       # get
1429
 
            return dbus.UInt64(timedelta_to_milliseconds(
1430
 
                    self.approval_duration))
1431
 
        self.approval_duration = datetime.timedelta(0, 0, 0, value)
1432
 
    
1433
 
    # Name - property
1434
 
    @dbus_service_property(_interface, signature="s", access="read")
1435
 
    def Name_dbus_property(self):
1436
 
        return dbus.String(self.name)
1437
 
    
1438
 
    # Fingerprint - property
1439
 
    @dbus_service_property(_interface, signature="s", access="read")
1440
 
    def Fingerprint_dbus_property(self):
1441
 
        return dbus.String(self.fingerprint)
1442
 
    
1443
 
    # Host - property
1444
 
    @dbus_service_property(_interface, signature="s",
1445
 
                           access="readwrite")
1446
 
    def Host_dbus_property(self, value=None):
1447
 
        if value is None:       # get
1448
 
            return dbus.String(self.host)
1449
 
        self.host = unicode(value)
1450
 
    
1451
 
    # Created - property
1452
 
    @dbus_service_property(_interface, signature="s", access="read")
1453
 
    def Created_dbus_property(self):
1454
 
        return datetime_to_dbus(self.created)
1455
 
    
1456
 
    # LastEnabled - property
1457
 
    @dbus_service_property(_interface, signature="s", access="read")
1458
 
    def LastEnabled_dbus_property(self):
1459
 
        return datetime_to_dbus(self.last_enabled)
1460
 
    
1461
 
    # Enabled - property
1462
 
    @dbus_service_property(_interface, signature="b",
1463
 
                           access="readwrite")
1464
 
    def Enabled_dbus_property(self, value=None):
1465
 
        if value is None:       # get
1466
 
            return dbus.Boolean(self.enabled)
1467
 
        if value:
1468
 
            self.enable()
1469
 
        else:
1470
 
            self.disable()
1471
 
    
1472
 
    # LastCheckedOK - property
1473
 
    @dbus_service_property(_interface, signature="s",
1474
 
                           access="readwrite")
1475
 
    def LastCheckedOK_dbus_property(self, value=None):
1476
 
        if value is not None:
1477
 
            self.checked_ok()
1478
 
            return
1479
 
        return datetime_to_dbus(self.last_checked_ok)
1480
 
    
1481
 
    # LastCheckerStatus - property
1482
 
    @dbus_service_property(_interface, signature="n",
1483
 
                           access="read")
1484
 
    def LastCheckerStatus_dbus_property(self):
1485
 
        return dbus.Int16(self.last_checker_status)
1486
 
    
1487
 
    # Expires - property
1488
 
    @dbus_service_property(_interface, signature="s", access="read")
1489
 
    def Expires_dbus_property(self):
1490
 
        return datetime_to_dbus(self.expires)
1491
 
    
1492
 
    # LastApprovalRequest - property
1493
 
    @dbus_service_property(_interface, signature="s", access="read")
1494
 
    def LastApprovalRequest_dbus_property(self):
1495
 
        return datetime_to_dbus(self.last_approval_request)
1496
 
    
1497
 
    # Timeout - property
1498
 
    @dbus_service_property(_interface, signature="t",
1499
 
                           access="readwrite")
1500
 
    def Timeout_dbus_property(self, value=None):
1501
 
        if value is None:       # get
1502
 
            return dbus.UInt64(self.timeout_milliseconds())
1503
 
        self.timeout = datetime.timedelta(0, 0, 0, value)
1504
 
        # Reschedule timeout
1505
 
        if self.enabled:
1506
 
            now = datetime.datetime.utcnow()
1507
 
            time_to_die = timedelta_to_milliseconds(
1508
 
                (self.last_checked_ok + self.timeout) - now)
1509
 
            if time_to_die <= 0:
1510
 
                # The timeout has passed
1511
 
                self.disable()
1512
 
            else:
1513
 
                self.expires = (now +
1514
 
                                datetime.timedelta(milliseconds =
1515
 
                                                   time_to_die))
1516
 
                if (getattr(self, "disable_initiator_tag", None)
1517
 
                    is None):
1518
 
                    return
1519
 
                gobject.source_remove(self.disable_initiator_tag)
1520
 
                self.disable_initiator_tag = (gobject.timeout_add
1521
 
                                              (time_to_die,
1522
 
                                               self.disable))
1523
 
    
1524
 
    # ExtendedTimeout - property
1525
 
    @dbus_service_property(_interface, signature="t",
1526
 
                           access="readwrite")
1527
 
    def ExtendedTimeout_dbus_property(self, value=None):
1528
 
        if value is None:       # get
1529
 
            return dbus.UInt64(self.extended_timeout_milliseconds())
1530
 
        self.extended_timeout = datetime.timedelta(0, 0, 0, value)
1531
 
    
1532
 
    # Interval - property
1533
 
    @dbus_service_property(_interface, signature="t",
1534
 
                           access="readwrite")
1535
 
    def Interval_dbus_property(self, value=None):
1536
 
        if value is None:       # get
1537
 
            return dbus.UInt64(self.interval_milliseconds())
1538
 
        self.interval = datetime.timedelta(0, 0, 0, value)
1539
 
        if getattr(self, "checker_initiator_tag", None) is None:
1540
 
            return
1541
 
        if self.enabled:
1542
 
            # Reschedule checker run
1543
 
            gobject.source_remove(self.checker_initiator_tag)
1544
 
            self.checker_initiator_tag = (gobject.timeout_add
1545
 
                                          (value, self.start_checker))
1546
 
            self.start_checker()    # Start one now, too
1547
 
    
1548
 
    # Checker - property
1549
 
    @dbus_service_property(_interface, signature="s",
1550
 
                           access="readwrite")
1551
 
    def Checker_dbus_property(self, value=None):
1552
 
        if value is None:       # get
1553
 
            return dbus.String(self.checker_command)
1554
 
        self.checker_command = unicode(value)
1555
 
    
1556
 
    # CheckerRunning - property
1557
 
    @dbus_service_property(_interface, signature="b",
1558
 
                           access="readwrite")
1559
 
    def CheckerRunning_dbus_property(self, value=None):
1560
 
        if value is None:       # get
1561
 
            return dbus.Boolean(self.checker is not None)
1562
 
        if value:
1563
 
            self.start_checker()
1564
 
        else:
1565
 
            self.stop_checker()
1566
 
    
1567
 
    # ObjectPath - property
1568
 
    @dbus_service_property(_interface, signature="o", access="read")
1569
 
    def ObjectPath_dbus_property(self):
1570
 
        return self.dbus_object_path # is already a dbus.ObjectPath
1571
 
    
1572
 
    # Secret = property
1573
 
    @dbus_service_property(_interface, signature="ay",
1574
 
                           access="write", byte_arrays=True)
1575
 
    def Secret_dbus_property(self, value):
1576
 
        self.secret = str(value)
1577
 
    
1578
 
    del _interface
1579
 
 
1580
 
 
1581
 
class ProxyClient(object):
1582
 
    def __init__(self, child_pipe, fpr, address):
1583
 
        self._pipe = child_pipe
1584
 
        self._pipe.send(('init', fpr, address))
1585
 
        if not self._pipe.recv():
1586
 
            raise KeyError()
1587
 
    
1588
 
    def __getattribute__(self, name):
1589
 
        if name == '_pipe':
1590
 
            return super(ProxyClient, self).__getattribute__(name)
1591
 
        self._pipe.send(('getattr', name))
1592
 
        data = self._pipe.recv()
1593
 
        if data[0] == 'data':
1594
 
            return data[1]
1595
 
        if data[0] == 'function':
1596
 
            def func(*args, **kwargs):
1597
 
                self._pipe.send(('funcall', name, args, kwargs))
1598
 
                return self._pipe.recv()[1]
1599
 
            return func
1600
 
    
1601
 
    def __setattr__(self, name, value):
1602
 
        if name == '_pipe':
1603
 
            return super(ProxyClient, self).__setattr__(name, value)
1604
 
        self._pipe.send(('setattr', name, value))
1605
 
 
1606
 
 
1607
 
class ClientDBusTransitional(ClientDBus):
1608
 
    __metaclass__ = AlternateDBusNamesMetaclass
1609
 
 
1610
 
 
1611
 
class ClientHandler(socketserver.BaseRequestHandler, object):
1612
 
    """A class to handle client connections.
1613
 
    
1614
 
    Instantiated once for each connection to handle it.
 
370
    def still_valid(self):
 
371
        """Has the timeout not yet passed for this client?"""
 
372
        now = datetime.datetime.now()
 
373
        if self.last_checked_ok is None:
 
374
            return now < (self.created + self.timeout)
 
375
        else:
 
376
            return now < (self.last_checked_ok + self.timeout)
 
377
 
 
378
 
 
379
def peer_certificate(session):
 
380
    "Return the peer's OpenPGP certificate as a bytestring"
 
381
    # If not an OpenPGP certificate...
 
382
    if gnutls.library.functions.gnutls_certificate_type_get\
 
383
            (session._c_object) \
 
384
           != gnutls.library.constants.GNUTLS_CRT_OPENPGP:
 
385
        # ...do the normal thing
 
386
        return session.peer_certificate
 
387
    list_size = ctypes.c_uint()
 
388
    cert_list = gnutls.library.functions.gnutls_certificate_get_peers\
 
389
        (session._c_object, ctypes.byref(list_size))
 
390
    if list_size.value == 0:
 
391
        return None
 
392
    cert = cert_list[0]
 
393
    return ctypes.string_at(cert.data, cert.size)
 
394
 
 
395
 
 
396
def fingerprint(openpgp):
 
397
    "Convert an OpenPGP bytestring to a hexdigit fingerprint string"
 
398
    # New empty GnuTLS certificate
 
399
    crt = gnutls.library.types.gnutls_openpgp_crt_t()
 
400
    gnutls.library.functions.gnutls_openpgp_crt_init\
 
401
        (ctypes.byref(crt))
 
402
    # New GnuTLS "datum" with the OpenPGP public key
 
403
    datum = gnutls.library.types.gnutls_datum_t\
 
404
        (ctypes.cast(ctypes.c_char_p(openpgp),
 
405
                     ctypes.POINTER(ctypes.c_ubyte)),
 
406
         ctypes.c_uint(len(openpgp)))
 
407
    # Import the OpenPGP public key into the certificate
 
408
    ret = gnutls.library.functions.gnutls_openpgp_crt_import\
 
409
        (crt,
 
410
         ctypes.byref(datum),
 
411
         gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
 
412
    # New buffer for the fingerprint
 
413
    buffer = ctypes.create_string_buffer(20)
 
414
    buffer_length = ctypes.c_size_t()
 
415
    # Get the fingerprint from the certificate into the buffer
 
416
    gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint\
 
417
        (crt, ctypes.byref(buffer), ctypes.byref(buffer_length))
 
418
    # Deinit the certificate
 
419
    gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
 
420
    # Convert the buffer to a Python bytestring
 
421
    fpr = ctypes.string_at(buffer, buffer_length.value)
 
422
    # Convert the bytestring to hexadecimal notation
 
423
    hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
 
424
    return hex_fpr
 
425
 
 
426
 
 
427
class tcp_handler(SocketServer.BaseRequestHandler, object):
 
428
    """A TCP request handler class.
 
429
    Instantiated by IPv6_TCPServer for each request to handle it.
1615
430
    Note: This will run in its own forked process."""
1616
431
    
1617
432
    def handle(self):
1618
 
        with contextlib.closing(self.server.child_pipe) as child_pipe:
1619
 
            logger.info("TCP connection from: %s",
1620
 
                        unicode(self.client_address))
1621
 
            logger.debug("Pipe FD: %d",
1622
 
                         self.server.child_pipe.fileno())
1623
 
            
1624
 
            session = (gnutls.connection
1625
 
                       .ClientSession(self.request,
1626
 
                                      gnutls.connection
1627
 
                                      .X509Credentials()))
1628
 
            
1629
 
            # Note: gnutls.connection.X509Credentials is really a
1630
 
            # generic GnuTLS certificate credentials object so long as
1631
 
            # no X.509 keys are added to it.  Therefore, we can use it
1632
 
            # here despite using OpenPGP certificates.
1633
 
            
1634
 
            #priority = ':'.join(("NONE", "+VERS-TLS1.1",
1635
 
            #                      "+AES-256-CBC", "+SHA1",
1636
 
            #                      "+COMP-NULL", "+CTYPE-OPENPGP",
1637
 
            #                      "+DHE-DSS"))
1638
 
            # Use a fallback default, since this MUST be set.
1639
 
            priority = self.server.gnutls_priority
1640
 
            if priority is None:
1641
 
                priority = "NORMAL"
1642
 
            (gnutls.library.functions
1643
 
             .gnutls_priority_set_direct(session._c_object,
1644
 
                                         priority, None))
1645
 
            
1646
 
            # Start communication using the Mandos protocol
1647
 
            # Get protocol number
1648
 
            line = self.request.makefile().readline()
1649
 
            logger.debug("Protocol version: %r", line)
1650
 
            try:
1651
 
                if int(line.strip().split()[0]) > 1:
1652
 
                    raise RuntimeError
1653
 
            except (ValueError, IndexError, RuntimeError) as error:
1654
 
                logger.error("Unknown protocol version: %s", error)
1655
 
                return
1656
 
            
1657
 
            # Start GnuTLS connection
1658
 
            try:
1659
 
                session.handshake()
1660
 
            except gnutls.errors.GNUTLSError as error:
1661
 
                logger.warning("Handshake failed: %s", error)
1662
 
                # Do not run session.bye() here: the session is not
1663
 
                # established.  Just abandon the request.
1664
 
                return
1665
 
            logger.debug("Handshake succeeded")
1666
 
            
1667
 
            approval_required = False
1668
 
            try:
1669
 
                try:
1670
 
                    fpr = self.fingerprint(self.peer_certificate
1671
 
                                           (session))
1672
 
                except (TypeError,
1673
 
                        gnutls.errors.GNUTLSError) as error:
1674
 
                    logger.warning("Bad certificate: %s", error)
1675
 
                    return
1676
 
                logger.debug("Fingerprint: %s", fpr)
1677
 
                
1678
 
                try:
1679
 
                    client = ProxyClient(child_pipe, fpr,
1680
 
                                         self.client_address)
1681
 
                except KeyError:
1682
 
                    return
1683
 
                
1684
 
                if client.approval_delay:
1685
 
                    delay = client.approval_delay
1686
 
                    client.approvals_pending += 1
1687
 
                    approval_required = True
1688
 
                
1689
 
                while True:
1690
 
                    if not client.enabled:
1691
 
                        logger.info("Client %s is disabled",
1692
 
                                       client.name)
1693
 
                        if self.server.use_dbus:
1694
 
                            # Emit D-Bus signal
1695
 
                            client.Rejected("Disabled")
1696
 
                        return
1697
 
                    
1698
 
                    if client.approved or not client.approval_delay:
1699
 
                        #We are approved or approval is disabled
1700
 
                        break
1701
 
                    elif client.approved is None:
1702
 
                        logger.info("Client %s needs approval",
1703
 
                                    client.name)
1704
 
                        if self.server.use_dbus:
1705
 
                            # Emit D-Bus signal
1706
 
                            client.NeedApproval(
1707
 
                                client.approval_delay_milliseconds(),
1708
 
                                client.approved_by_default)
1709
 
                    else:
1710
 
                        logger.warning("Client %s was not approved",
1711
 
                                       client.name)
1712
 
                        if self.server.use_dbus:
1713
 
                            # Emit D-Bus signal
1714
 
                            client.Rejected("Denied")
1715
 
                        return
1716
 
                    
1717
 
                    #wait until timeout or approved
1718
 
                    time = datetime.datetime.now()
1719
 
                    client.changedstate.acquire()
1720
 
                    (client.changedstate.wait
1721
 
                     (float(client.timedelta_to_milliseconds(delay)
1722
 
                            / 1000)))
1723
 
                    client.changedstate.release()
1724
 
                    time2 = datetime.datetime.now()
1725
 
                    if (time2 - time) >= delay:
1726
 
                        if not client.approved_by_default:
1727
 
                            logger.warning("Client %s timed out while"
1728
 
                                           " waiting for approval",
1729
 
                                           client.name)
1730
 
                            if self.server.use_dbus:
1731
 
                                # Emit D-Bus signal
1732
 
                                client.Rejected("Approval timed out")
1733
 
                            return
1734
 
                        else:
1735
 
                            break
1736
 
                    else:
1737
 
                        delay -= time2 - time
1738
 
                
1739
 
                sent_size = 0
1740
 
                while sent_size < len(client.secret):
1741
 
                    try:
1742
 
                        sent = session.send(client.secret[sent_size:])
1743
 
                    except gnutls.errors.GNUTLSError as error:
1744
 
                        logger.warning("gnutls send failed")
1745
 
                        return
1746
 
                    logger.debug("Sent: %d, remaining: %d",
1747
 
                                 sent, len(client.secret)
1748
 
                                 - (sent_size + sent))
1749
 
                    sent_size += sent
1750
 
                
1751
 
                logger.info("Sending secret to %s", client.name)
1752
 
                # bump the timeout using extended_timeout
1753
 
                client.bump_timeout(client.extended_timeout)
1754
 
                if self.server.use_dbus:
1755
 
                    # Emit D-Bus signal
1756
 
                    client.GotSecret()
1757
 
            
1758
 
            finally:
1759
 
                if approval_required:
1760
 
                    client.approvals_pending -= 1
1761
 
                try:
1762
 
                    session.bye()
1763
 
                except gnutls.errors.GNUTLSError as error:
1764
 
                    logger.warning("GnuTLS bye failed")
1765
 
    
1766
 
    @staticmethod
1767
 
    def peer_certificate(session):
1768
 
        "Return the peer's OpenPGP certificate as a bytestring"
1769
 
        # If not an OpenPGP certificate...
1770
 
        if (gnutls.library.functions
1771
 
            .gnutls_certificate_type_get(session._c_object)
1772
 
            != gnutls.library.constants.GNUTLS_CRT_OPENPGP):
1773
 
            # ...do the normal thing
1774
 
            return session.peer_certificate
1775
 
        list_size = ctypes.c_uint(1)
1776
 
        cert_list = (gnutls.library.functions
1777
 
                     .gnutls_certificate_get_peers
1778
 
                     (session._c_object, ctypes.byref(list_size)))
1779
 
        if not bool(cert_list) and list_size.value != 0:
1780
 
            raise gnutls.errors.GNUTLSError("error getting peer"
1781
 
                                            " certificate")
1782
 
        if list_size.value == 0:
1783
 
            return None
1784
 
        cert = cert_list[0]
1785
 
        return ctypes.string_at(cert.data, cert.size)
1786
 
    
1787
 
    @staticmethod
1788
 
    def fingerprint(openpgp):
1789
 
        "Convert an OpenPGP bytestring to a hexdigit fingerprint"
1790
 
        # New GnuTLS "datum" with the OpenPGP public key
1791
 
        datum = (gnutls.library.types
1792
 
                 .gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
1793
 
                                             ctypes.POINTER
1794
 
                                             (ctypes.c_ubyte)),
1795
 
                                 ctypes.c_uint(len(openpgp))))
1796
 
        # New empty GnuTLS certificate
1797
 
        crt = gnutls.library.types.gnutls_openpgp_crt_t()
1798
 
        (gnutls.library.functions
1799
 
         .gnutls_openpgp_crt_init(ctypes.byref(crt)))
1800
 
        # Import the OpenPGP public key into the certificate
1801
 
        (gnutls.library.functions
1802
 
         .gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
1803
 
                                    gnutls.library.constants
1804
 
                                    .GNUTLS_OPENPGP_FMT_RAW))
1805
 
        # Verify the self signature in the key
1806
 
        crtverify = ctypes.c_uint()
1807
 
        (gnutls.library.functions
1808
 
         .gnutls_openpgp_crt_verify_self(crt, 0,
1809
 
                                         ctypes.byref(crtverify)))
1810
 
        if crtverify.value != 0:
1811
 
            gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1812
 
            raise (gnutls.errors.CertificateSecurityError
1813
 
                   ("Verify failed"))
1814
 
        # New buffer for the fingerprint
1815
 
        buf = ctypes.create_string_buffer(20)
1816
 
        buf_len = ctypes.c_size_t()
1817
 
        # Get the fingerprint from the certificate into the buffer
1818
 
        (gnutls.library.functions
1819
 
         .gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
1820
 
                                             ctypes.byref(buf_len)))
1821
 
        # Deinit the certificate
1822
 
        gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1823
 
        # Convert the buffer to a Python bytestring
1824
 
        fpr = ctypes.string_at(buf, buf_len.value)
1825
 
        # Convert the bytestring to hexadecimal notation
1826
 
        hex_fpr = binascii.hexlify(fpr).upper()
1827
 
        return hex_fpr
1828
 
 
1829
 
 
1830
 
class MultiprocessingMixIn(object):
1831
 
    """Like socketserver.ThreadingMixIn, but with multiprocessing"""
1832
 
    def sub_process_main(self, request, address):
1833
 
        try:
1834
 
            self.finish_request(request, address)
1835
 
        except Exception:
1836
 
            self.handle_error(request, address)
1837
 
        self.close_request(request)
1838
 
    
1839
 
    def process_request(self, request, address):
1840
 
        """Start a new process to process the request."""
1841
 
        proc = multiprocessing.Process(target = self.sub_process_main,
1842
 
                                       args = (request,
1843
 
                                               address))
1844
 
        proc.start()
1845
 
        return proc
1846
 
 
1847
 
 
1848
 
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
1849
 
    """ adds a pipe to the MixIn """
1850
 
    def process_request(self, request, client_address):
1851
 
        """Overrides and wraps the original process_request().
1852
 
        
1853
 
        This function creates a new pipe in self.pipe
1854
 
        """
1855
 
        parent_pipe, self.child_pipe = multiprocessing.Pipe()
1856
 
        
1857
 
        proc = MultiprocessingMixIn.process_request(self, request,
1858
 
                                                    client_address)
1859
 
        self.child_pipe.close()
1860
 
        self.add_pipe(parent_pipe, proc)
1861
 
    
1862
 
    def add_pipe(self, parent_pipe, proc):
1863
 
        """Dummy function; override as necessary"""
1864
 
        raise NotImplementedError
1865
 
 
1866
 
 
1867
 
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
1868
 
                     socketserver.TCPServer, object):
1869
 
    """IPv6-capable TCP server.  Accepts 'None' as address and/or port
1870
 
    
 
433
        logger.info(u"TCP connection from: %s",
 
434
                     unicode(self.client_address))
 
435
        session = gnutls.connection.ClientSession\
 
436
                  (self.request, gnutls.connection.X509Credentials())
 
437
        
 
438
        line = self.request.makefile().readline()
 
439
        logger.debug(u"Protocol version: %r", line)
 
440
        try:
 
441
            if int(line.strip().split()[0]) > 1:
 
442
                raise RuntimeError
 
443
        except (ValueError, IndexError, RuntimeError), error:
 
444
            logger.error(u"Unknown protocol version: %s", error)
 
445
            return
 
446
        
 
447
        # Note: gnutls.connection.X509Credentials is really a generic
 
448
        # GnuTLS certificate credentials object so long as no X.509
 
449
        # keys are added to it.  Therefore, we can use it here despite
 
450
        # using OpenPGP certificates.
 
451
        
 
452
        #priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
 
453
        #                "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
 
454
        #                "+DHE-DSS"))
 
455
        priority = "NORMAL"             # Fallback default, since this
 
456
                                        # MUST be set.
 
457
        if self.server.settings["priority"]:
 
458
            priority = self.server.settings["priority"]
 
459
        gnutls.library.functions.gnutls_priority_set_direct\
 
460
            (session._c_object, priority, None);
 
461
        
 
462
        try:
 
463
            session.handshake()
 
464
        except gnutls.errors.GNUTLSError, error:
 
465
            logger.warning(u"Handshake failed: %s", error)
 
466
            # Do not run session.bye() here: the session is not
 
467
            # established.  Just abandon the request.
 
468
            return
 
469
        try:
 
470
            fpr = fingerprint(peer_certificate(session))
 
471
        except (TypeError, gnutls.errors.GNUTLSError), error:
 
472
            logger.warning(u"Bad certificate: %s", error)
 
473
            session.bye()
 
474
            return
 
475
        logger.debug(u"Fingerprint: %s", fpr)
 
476
        client = None
 
477
        for c in self.server.clients:
 
478
            if c.fingerprint == fpr:
 
479
                client = c
 
480
                break
 
481
        if not client:
 
482
            logger.warning(u"Client not found for fingerprint: %s",
 
483
                           fpr)
 
484
            session.bye()
 
485
            return
 
486
        # Have to check if client.still_valid(), since it is possible
 
487
        # that the client timed out while establishing the GnuTLS
 
488
        # session.
 
489
        if not client.still_valid():
 
490
            logger.warning(u"Client %(name)s is invalid",
 
491
                           vars(client))
 
492
            session.bye()
 
493
            return
 
494
        sent_size = 0
 
495
        while sent_size < len(client.secret):
 
496
            sent = session.send(client.secret[sent_size:])
 
497
            logger.debug(u"Sent: %d, remaining: %d",
 
498
                         sent, len(client.secret)
 
499
                         - (sent_size + sent))
 
500
            sent_size += sent
 
501
        session.bye()
 
502
 
 
503
 
 
504
class IPv6_TCPServer(SocketServer.ForkingTCPServer, object):
 
505
    """IPv6 TCP server.  Accepts 'None' as address and/or port.
1871
506
    Attributes:
1872
 
        enabled:        Boolean; whether this server is activated yet
1873
 
        interface:      None or a network interface name (string)
1874
 
        use_ipv6:       Boolean; to use IPv6 or not
 
507
        settings:       Server settings
 
508
        clients:        Set() of Client objects
1875
509
    """
1876
 
    def __init__(self, server_address, RequestHandlerClass,
1877
 
                 interface=None, use_ipv6=True):
1878
 
        self.interface = interface
1879
 
        if use_ipv6:
1880
 
            self.address_family = socket.AF_INET6
1881
 
        socketserver.TCPServer.__init__(self, server_address,
1882
 
                                        RequestHandlerClass)
 
510
    address_family = socket.AF_INET6
 
511
    def __init__(self, *args, **kwargs):
 
512
        if "settings" in kwargs:
 
513
            self.settings = kwargs["settings"]
 
514
            del kwargs["settings"]
 
515
        if "clients" in kwargs:
 
516
            self.clients = kwargs["clients"]
 
517
            del kwargs["clients"]
 
518
        return super(type(self), self).__init__(*args, **kwargs)
1883
519
    def server_bind(self):
1884
520
        """This overrides the normal server_bind() function
1885
521
        to bind to an interface if one was specified, and also NOT to
1886
522
        bind to an address or port if they were not specified."""
1887
 
        if self.interface is not None:
1888
 
            if SO_BINDTODEVICE is None:
1889
 
                logger.error("SO_BINDTODEVICE does not exist;"
1890
 
                             " cannot bind to interface %s",
1891
 
                             self.interface)
1892
 
            else:
1893
 
                try:
1894
 
                    self.socket.setsockopt(socket.SOL_SOCKET,
1895
 
                                           SO_BINDTODEVICE,
1896
 
                                           str(self.interface
1897
 
                                               + '\0'))
1898
 
                except socket.error as error:
1899
 
                    if error[0] == errno.EPERM:
1900
 
                        logger.error("No permission to"
1901
 
                                     " bind to interface %s",
1902
 
                                     self.interface)
1903
 
                    elif error[0] == errno.ENOPROTOOPT:
1904
 
                        logger.error("SO_BINDTODEVICE not available;"
1905
 
                                     " cannot bind to interface %s",
1906
 
                                     self.interface)
1907
 
                    else:
1908
 
                        raise
 
523
        if self.settings["interface"]:
 
524
            # 25 is from /usr/include/asm-i486/socket.h
 
525
            SO_BINDTODEVICE = getattr(socket, "SO_BINDTODEVICE", 25)
 
526
            try:
 
527
                self.socket.setsockopt(socket.SOL_SOCKET,
 
528
                                       SO_BINDTODEVICE,
 
529
                                       self.settings["interface"])
 
530
            except socket.error, error:
 
531
                if error[0] == errno.EPERM:
 
532
                    logger.error(u"No permission to"
 
533
                                 u" bind to interface %s",
 
534
                                 self.settings["interface"])
 
535
                else:
 
536
                    raise error
1909
537
        # Only bind(2) the socket if we really need to.
1910
538
        if self.server_address[0] or self.server_address[1]:
1911
539
            if not self.server_address[0]:
1912
 
                if self.address_family == socket.AF_INET6:
1913
 
                    any_address = "::" # in6addr_any
1914
 
                else:
1915
 
                    any_address = socket.INADDR_ANY
1916
 
                self.server_address = (any_address,
 
540
                in6addr_any = "::"
 
541
                self.server_address = (in6addr_any,
1917
542
                                       self.server_address[1])
1918
 
            elif not self.server_address[1]:
 
543
            elif self.server_address[1] is None:
1919
544
                self.server_address = (self.server_address[0],
1920
545
                                       0)
1921
 
#                 if self.interface:
1922
 
#                     self.server_address = (self.server_address[0],
1923
 
#                                            0, # port
1924
 
#                                            0, # flowinfo
1925
 
#                                            if_nametoindex
1926
 
#                                            (self.interface))
1927
 
            return socketserver.TCPServer.server_bind(self)
1928
 
 
1929
 
 
1930
 
class MandosServer(IPv6_TCPServer):
1931
 
    """Mandos server.
1932
 
    
1933
 
    Attributes:
1934
 
        clients:        set of Client objects
1935
 
        gnutls_priority GnuTLS priority string
1936
 
        use_dbus:       Boolean; to emit D-Bus signals or not
1937
 
    
1938
 
    Assumes a gobject.MainLoop event loop.
1939
 
    """
1940
 
    def __init__(self, server_address, RequestHandlerClass,
1941
 
                 interface=None, use_ipv6=True, clients=None,
1942
 
                 gnutls_priority=None, use_dbus=True):
1943
 
        self.enabled = False
1944
 
        self.clients = clients
1945
 
        if self.clients is None:
1946
 
            self.clients = {}
1947
 
        self.use_dbus = use_dbus
1948
 
        self.gnutls_priority = gnutls_priority
1949
 
        IPv6_TCPServer.__init__(self, server_address,
1950
 
                                RequestHandlerClass,
1951
 
                                interface = interface,
1952
 
                                use_ipv6 = use_ipv6)
1953
 
    def server_activate(self):
1954
 
        if self.enabled:
1955
 
            return socketserver.TCPServer.server_activate(self)
1956
 
    
1957
 
    def enable(self):
1958
 
        self.enabled = True
1959
 
    
1960
 
    def add_pipe(self, parent_pipe, proc):
1961
 
        # Call "handle_ipc" for both data and EOF events
1962
 
        gobject.io_add_watch(parent_pipe.fileno(),
1963
 
                             gobject.IO_IN | gobject.IO_HUP,
1964
 
                             functools.partial(self.handle_ipc,
1965
 
                                               parent_pipe =
1966
 
                                               parent_pipe,
1967
 
                                               proc = proc))
1968
 
    
1969
 
    def handle_ipc(self, source, condition, parent_pipe=None,
1970
 
                   proc = None, client_object=None):
1971
 
        condition_names = {
1972
 
            gobject.IO_IN: "IN",   # There is data to read.
1973
 
            gobject.IO_OUT: "OUT", # Data can be written (without
1974
 
                                    # blocking).
1975
 
            gobject.IO_PRI: "PRI", # There is urgent data to read.
1976
 
            gobject.IO_ERR: "ERR", # Error condition.
1977
 
            gobject.IO_HUP: "HUP"  # Hung up (the connection has been
1978
 
                                    # broken, usually for pipes and
1979
 
                                    # sockets).
1980
 
            }
1981
 
        conditions_string = ' | '.join(name
1982
 
                                       for cond, name in
1983
 
                                       condition_names.iteritems()
1984
 
                                       if cond & condition)
1985
 
        # error, or the other end of multiprocessing.Pipe has closed
1986
 
        if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):
1987
 
            # Wait for other process to exit
1988
 
            proc.join()
1989
 
            return False
1990
 
        
1991
 
        # Read a request from the child
1992
 
        request = parent_pipe.recv()
1993
 
        command = request[0]
1994
 
        
1995
 
        if command == 'init':
1996
 
            fpr = request[1]
1997
 
            address = request[2]
1998
 
            
1999
 
            for c in self.clients.itervalues():
2000
 
                if c.fingerprint == fpr:
2001
 
                    client = c
2002
 
                    break
2003
 
            else:
2004
 
                logger.info("Client not found for fingerprint: %s, ad"
2005
 
                            "dress: %s", fpr, address)
2006
 
                if self.use_dbus:
2007
 
                    # Emit D-Bus signal
2008
 
                    mandos_dbus_service.ClientNotFound(fpr,
2009
 
                                                       address[0])
2010
 
                parent_pipe.send(False)
2011
 
                return False
2012
 
            
2013
 
            gobject.io_add_watch(parent_pipe.fileno(),
2014
 
                                 gobject.IO_IN | gobject.IO_HUP,
2015
 
                                 functools.partial(self.handle_ipc,
2016
 
                                                   parent_pipe =
2017
 
                                                   parent_pipe,
2018
 
                                                   proc = proc,
2019
 
                                                   client_object =
2020
 
                                                   client))
2021
 
            parent_pipe.send(True)
2022
 
            # remove the old hook in favor of the new above hook on
2023
 
            # same fileno
2024
 
            return False
2025
 
        if command == 'funcall':
2026
 
            funcname = request[1]
2027
 
            args = request[2]
2028
 
            kwargs = request[3]
2029
 
            
2030
 
            parent_pipe.send(('data', getattr(client_object,
2031
 
                                              funcname)(*args,
2032
 
                                                         **kwargs)))
2033
 
        
2034
 
        if command == 'getattr':
2035
 
            attrname = request[1]
2036
 
            if callable(client_object.__getattribute__(attrname)):
2037
 
                parent_pipe.send(('function',))
2038
 
            else:
2039
 
                parent_pipe.send(('data', client_object
2040
 
                                  .__getattribute__(attrname)))
2041
 
        
2042
 
        if command == 'setattr':
2043
 
            attrname = request[1]
2044
 
            value = request[2]
2045
 
            setattr(client_object, attrname, value)
2046
 
        
2047
 
        return True
 
546
            return super(type(self), self).server_bind()
2048
547
 
2049
548
 
2050
549
def string_to_delta(interval):
2051
550
    """Parse a string and return a datetime.timedelta
2052
 
    
 
551
 
2053
552
    >>> string_to_delta('7d')
2054
553
    datetime.timedelta(7)
2055
554
    >>> string_to_delta('60s')
2058
557
    datetime.timedelta(0, 3600)
2059
558
    >>> string_to_delta('24h')
2060
559
    datetime.timedelta(1)
2061
 
    >>> string_to_delta('1w')
 
560
    >>> string_to_delta(u'1w')
2062
561
    datetime.timedelta(7)
2063
 
    >>> string_to_delta('5m 30s')
2064
 
    datetime.timedelta(0, 330)
2065
562
    """
2066
 
    timevalue = datetime.timedelta(0)
2067
 
    for s in interval.split():
2068
 
        try:
2069
 
            suffix = unicode(s[-1])
2070
 
            value = int(s[:-1])
2071
 
            if suffix == "d":
2072
 
                delta = datetime.timedelta(value)
2073
 
            elif suffix == "s":
2074
 
                delta = datetime.timedelta(0, value)
2075
 
            elif suffix == "m":
2076
 
                delta = datetime.timedelta(0, 0, 0, 0, value)
2077
 
            elif suffix == "h":
2078
 
                delta = datetime.timedelta(0, 0, 0, 0, 0, value)
2079
 
            elif suffix == "w":
2080
 
                delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
2081
 
            else:
2082
 
                raise ValueError("Unknown suffix %r" % suffix)
2083
 
        except (ValueError, IndexError) as e:
2084
 
            raise ValueError(*(e.args))
2085
 
        timevalue += delta
2086
 
    return timevalue
2087
 
 
2088
 
 
2089
 
def daemon(nochdir = False, noclose = False):
 
563
    try:
 
564
        suffix=unicode(interval[-1])
 
565
        value=int(interval[:-1])
 
566
        if suffix == u"d":
 
567
            delta = datetime.timedelta(value)
 
568
        elif suffix == u"s":
 
569
            delta = datetime.timedelta(0, value)
 
570
        elif suffix == u"m":
 
571
            delta = datetime.timedelta(0, 0, 0, 0, value)
 
572
        elif suffix == u"h":
 
573
            delta = datetime.timedelta(0, 0, 0, 0, 0, value)
 
574
        elif suffix == u"w":
 
575
            delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
 
576
        else:
 
577
            raise ValueError
 
578
    except (ValueError, IndexError):
 
579
        raise ValueError
 
580
    return delta
 
581
 
 
582
 
 
583
def server_state_changed(state):
 
584
    """Derived from the Avahi example code"""
 
585
    if state == avahi.SERVER_COLLISION:
 
586
        logger.error(u"Server name collision")
 
587
        service.remove()
 
588
    elif state == avahi.SERVER_RUNNING:
 
589
        service.add()
 
590
 
 
591
 
 
592
def entry_group_state_changed(state, error):
 
593
    """Derived from the Avahi example code"""
 
594
    logger.debug(u"state change: %i", state)
 
595
    
 
596
    if state == avahi.ENTRY_GROUP_ESTABLISHED:
 
597
        logger.debug(u"Service established.")
 
598
    elif state == avahi.ENTRY_GROUP_COLLISION:
 
599
        logger.warning(u"Service name collision.")
 
600
        service.rename()
 
601
    elif state == avahi.ENTRY_GROUP_FAILURE:
 
602
        logger.critical(u"Error in group state changed %s",
 
603
                        unicode(error))
 
604
        raise AvahiGroupError("State changed: %s", str(error))
 
605
 
 
606
def if_nametoindex(interface):
 
607
    """Call the C function if_nametoindex(), or equivalent"""
 
608
    global if_nametoindex
 
609
    try:
 
610
        if "ctypes.util" not in sys.modules:
 
611
            import ctypes.util
 
612
        if_nametoindex = ctypes.cdll.LoadLibrary\
 
613
            (ctypes.util.find_library("c")).if_nametoindex
 
614
    except (OSError, AttributeError):
 
615
        if "struct" not in sys.modules:
 
616
            import struct
 
617
        if "fcntl" not in sys.modules:
 
618
            import fcntl
 
619
        def if_nametoindex(interface):
 
620
            "Get an interface index the hard way, i.e. using fcntl()"
 
621
            SIOCGIFINDEX = 0x8933  # From /usr/include/linux/sockios.h
 
622
            s = socket.socket()
 
623
            ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
 
624
                                struct.pack("16s16x", interface))
 
625
            s.close()
 
626
            interface_index = struct.unpack("I", ifreq[16:20])[0]
 
627
            return interface_index
 
628
    return if_nametoindex(interface)
 
629
 
 
630
 
 
631
def daemon(nochdir, noclose):
2090
632
    """See daemon(3).  Standard BSD Unix function.
2091
 
    
2092
633
    This should really exist as os.daemon, but it doesn't (yet)."""
2093
634
    if os.fork():
2094
635
        sys.exit()
2095
636
    os.setsid()
2096
637
    if not nochdir:
2097
638
        os.chdir("/")
2098
 
    if os.fork():
2099
 
        sys.exit()
2100
639
    if not noclose:
2101
640
        # Close all standard open file descriptors
2102
 
        null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
 
641
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
2103
642
        if not stat.S_ISCHR(os.fstat(null).st_mode):
2104
643
            raise OSError(errno.ENODEV,
2105
 
                          "%s not a character device"
2106
 
                          % os.devnull)
 
644
                          "/dev/null not a character device")
2107
645
        os.dup2(null, sys.stdin.fileno())
2108
646
        os.dup2(null, sys.stdout.fileno())
2109
647
        os.dup2(null, sys.stderr.fileno())
2112
650
 
2113
651
 
2114
652
def main():
2115
 
    
2116
 
    ##################################################################
2117
 
    # Parsing of options, both command line and config file
2118
 
    
2119
 
    parser = argparse.ArgumentParser()
2120
 
    parser.add_argument("-v", "--version", action="version",
2121
 
                        version = "%%(prog)s %s" % version,
2122
 
                        help="show version number and exit")
2123
 
    parser.add_argument("-i", "--interface", metavar="IF",
2124
 
                        help="Bind to interface IF")
2125
 
    parser.add_argument("-a", "--address",
2126
 
                        help="Address to listen for requests on")
2127
 
    parser.add_argument("-p", "--port", type=int,
2128
 
                        help="Port number to receive requests on")
2129
 
    parser.add_argument("--check", action="store_true",
2130
 
                        help="Run self-test")
2131
 
    parser.add_argument("--debug", action="store_true",
2132
 
                        help="Debug mode; run in foreground and log"
2133
 
                        " to terminal")
2134
 
    parser.add_argument("--debuglevel", metavar="LEVEL",
2135
 
                        help="Debug level for stdout output")
2136
 
    parser.add_argument("--priority", help="GnuTLS"
2137
 
                        " priority string (see GnuTLS documentation)")
2138
 
    parser.add_argument("--servicename",
2139
 
                        metavar="NAME", help="Zeroconf service name")
2140
 
    parser.add_argument("--configdir",
2141
 
                        default="/etc/mandos", metavar="DIR",
2142
 
                        help="Directory to search for configuration"
2143
 
                        " files")
2144
 
    parser.add_argument("--no-dbus", action="store_false",
2145
 
                        dest="use_dbus", help="Do not provide D-Bus"
2146
 
                        " system bus interface")
2147
 
    parser.add_argument("--no-ipv6", action="store_false",
2148
 
                        dest="use_ipv6", help="Do not use IPv6")
2149
 
    parser.add_argument("--no-restore", action="store_false",
2150
 
                        dest="restore", help="Do not restore stored"
2151
 
                        " state")
2152
 
    parser.add_argument("--statedir", metavar="DIR",
2153
 
                        help="Directory to save/restore state in")
2154
 
    
2155
 
    options = parser.parse_args()
 
653
    global main_loop_started
 
654
    main_loop_started = False
 
655
    
 
656
    parser = OptionParser()
 
657
    parser.add_option("-i", "--interface", type="string",
 
658
                      metavar="IF", help="Bind to interface IF")
 
659
    parser.add_option("-a", "--address", type="string",
 
660
                      help="Address to listen for requests on")
 
661
    parser.add_option("-p", "--port", type="int",
 
662
                      help="Port number to receive requests on")
 
663
    parser.add_option("--check", action="store_true", default=False,
 
664
                      help="Run self-test")
 
665
    parser.add_option("--debug", action="store_true", default=False,
 
666
                      help="Debug mode; run in foreground and log to"
 
667
                      " terminal")
 
668
    parser.add_option("--priority", type="string", help="GnuTLS"
 
669
                      " priority string (see GnuTLS documentation)")
 
670
    parser.add_option("--servicename", type="string", metavar="NAME",
 
671
                      help="Zeroconf service name")
 
672
    parser.add_option("--configdir", type="string",
 
673
                      default="/etc/mandos", metavar="DIR",
 
674
                      help="Directory to search for configuration"
 
675
                      " files")
 
676
    (options, args) = parser.parse_args()
2156
677
    
2157
678
    if options.check:
2158
679
        import doctest
2167
688
                        "priority":
2168
689
                        "SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
2169
690
                        "servicename": "Mandos",
2170
 
                        "use_dbus": "True",
2171
 
                        "use_ipv6": "True",
2172
 
                        "debuglevel": "",
2173
 
                        "restore": "True",
2174
 
                        "statedir": "/var/lib/mandos"
2175
691
                        }
2176
692
    
2177
693
    # Parse config file for server-global settings
2178
 
    server_config = configparser.SafeConfigParser(server_defaults)
 
694
    server_config = ConfigParser.SafeConfigParser(server_defaults)
2179
695
    del server_defaults
2180
 
    server_config.read(os.path.join(options.configdir,
2181
 
                                    "mandos.conf"))
 
696
    server_config.read(os.path.join(options.configdir, "server.conf"))
 
697
    server_section = "server"
2182
698
    # Convert the SafeConfigParser object to a dict
2183
 
    server_settings = server_config.defaults()
2184
 
    # Use the appropriate methods on the non-string config options
2185
 
    for option in ("debug", "use_dbus", "use_ipv6"):
2186
 
        server_settings[option] = server_config.getboolean("DEFAULT",
2187
 
                                                           option)
2188
 
    if server_settings["port"]:
2189
 
        server_settings["port"] = server_config.getint("DEFAULT",
2190
 
                                                       "port")
 
699
    server_settings = dict(server_config.items(server_section))
 
700
    # Use getboolean on the boolean config option
 
701
    server_settings["debug"] = server_config.getboolean\
 
702
                               (server_section, "debug")
2191
703
    del server_config
2192
704
    
2193
705
    # Override the settings from the config file with command line
2194
706
    # options, if set.
2195
707
    for option in ("interface", "address", "port", "debug",
2196
 
                   "priority", "servicename", "configdir",
2197
 
                   "use_dbus", "use_ipv6", "debuglevel", "restore",
2198
 
                   "statedir"):
 
708
                   "priority", "servicename", "configdir"):
2199
709
        value = getattr(options, option)
2200
710
        if value is not None:
2201
711
            server_settings[option] = value
2202
712
    del options
2203
 
    # Force all strings to be unicode
2204
 
    for option in server_settings.keys():
2205
 
        if type(server_settings[option]) is str:
2206
 
            server_settings[option] = unicode(server_settings[option])
2207
713
    # Now we have our good server settings in "server_settings"
2208
714
    
2209
 
    ##################################################################
2210
 
    
2211
 
    # For convenience
2212
 
    debug = server_settings["debug"]
2213
 
    debuglevel = server_settings["debuglevel"]
2214
 
    use_dbus = server_settings["use_dbus"]
2215
 
    use_ipv6 = server_settings["use_ipv6"]
2216
 
    stored_state_path = os.path.join(server_settings["statedir"],
2217
 
                                     stored_state_file)
2218
 
    
2219
 
    if debug:
2220
 
        initlogger(debug, logging.DEBUG)
2221
 
    else:
2222
 
        if not debuglevel:
2223
 
            initlogger(debug)
2224
 
        else:
2225
 
            level = getattr(logging, debuglevel.upper())
2226
 
            initlogger(debug, level)
2227
 
    
2228
 
    if server_settings["servicename"] != "Mandos":
2229
 
        syslogger.setFormatter(logging.Formatter
2230
 
                               ('Mandos (%s) [%%(process)d]:'
2231
 
                                ' %%(levelname)s: %%(message)s'
2232
 
                                % server_settings["servicename"]))
2233
 
    
2234
715
    # Parse config file with clients
2235
 
    client_config = configparser.SafeConfigParser(Client
2236
 
                                                  .client_defaults)
 
716
    client_defaults = { "timeout": "1h",
 
717
                        "interval": "5m",
 
718
                        "checker": "fping -q -- %%(fqdn)s",
 
719
                        }
 
720
    client_config = ConfigParser.SafeConfigParser(client_defaults)
2237
721
    client_config.read(os.path.join(server_settings["configdir"],
2238
722
                                    "clients.conf"))
2239
723
    
2240
 
    global mandos_dbus_service
2241
 
    mandos_dbus_service = None
2242
 
    
2243
 
    tcp_server = MandosServer((server_settings["address"],
2244
 
                               server_settings["port"]),
2245
 
                              ClientHandler,
2246
 
                              interface=(server_settings["interface"]
2247
 
                                         or None),
2248
 
                              use_ipv6=use_ipv6,
2249
 
                              gnutls_priority=
2250
 
                              server_settings["priority"],
2251
 
                              use_dbus=use_dbus)
2252
 
    if not debug:
2253
 
        pidfilename = "/var/run/mandos.pid"
2254
 
        try:
2255
 
            pidfile = open(pidfilename, "w")
2256
 
        except IOError:
2257
 
            logger.error("Could not open file %r", pidfilename)
2258
 
    
2259
 
    try:
2260
 
        uid = pwd.getpwnam("_mandos").pw_uid
2261
 
        gid = pwd.getpwnam("_mandos").pw_gid
2262
 
    except KeyError:
2263
 
        try:
2264
 
            uid = pwd.getpwnam("mandos").pw_uid
2265
 
            gid = pwd.getpwnam("mandos").pw_gid
2266
 
        except KeyError:
2267
 
            try:
2268
 
                uid = pwd.getpwnam("nobody").pw_uid
2269
 
                gid = pwd.getpwnam("nobody").pw_gid
2270
 
            except KeyError:
2271
 
                uid = 65534
2272
 
                gid = 65534
2273
 
    try:
2274
 
        os.setgid(gid)
2275
 
        os.setuid(uid)
2276
 
    except OSError as error:
2277
 
        if error[0] != errno.EPERM:
2278
 
            raise error
2279
 
    
2280
 
    if debug:
2281
 
        # Enable all possible GnuTLS debugging
2282
 
        
2283
 
        # "Use a log level over 10 to enable all debugging options."
2284
 
        # - GnuTLS manual
2285
 
        gnutls.library.functions.gnutls_global_set_log_level(11)
2286
 
        
2287
 
        @gnutls.library.types.gnutls_log_func
2288
 
        def debug_gnutls(level, string):
2289
 
            logger.debug("GnuTLS: %s", string[:-1])
2290
 
        
2291
 
        (gnutls.library.functions
2292
 
         .gnutls_global_set_log_function(debug_gnutls))
2293
 
        
2294
 
        # Redirect stdin so all checkers get /dev/null
2295
 
        null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2296
 
        os.dup2(null, sys.stdin.fileno())
2297
 
        if null > 2:
2298
 
            os.close(null)
2299
 
    
2300
 
    # Need to fork before connecting to D-Bus
2301
 
    if not debug:
2302
 
        # Close all input and output, do double fork, etc.
2303
 
        daemon()
2304
 
    
2305
 
    gobject.threads_init()
 
724
    global service
 
725
    service = AvahiService(name = server_settings["servicename"],
 
726
                           type = "_mandos._tcp", );
 
727
    if server_settings["interface"]:
 
728
        service.interface = if_nametoindex(server_settings["interface"])
2306
729
    
2307
730
    global main_loop
 
731
    global bus
 
732
    global server
2308
733
    # From the Avahi example code
2309
 
    DBusGMainLoop(set_as_default=True)
 
734
    DBusGMainLoop(set_as_default=True )
2310
735
    main_loop = gobject.MainLoop()
2311
736
    bus = dbus.SystemBus()
 
737
    server = dbus.Interface(
 
738
            bus.get_object( avahi.DBUS_NAME, avahi.DBUS_PATH_SERVER ),
 
739
            avahi.DBUS_INTERFACE_SERVER )
2312
740
    # End of Avahi example code
2313
 
    if use_dbus:
2314
 
        try:
2315
 
            bus_name = dbus.service.BusName("se.recompile.Mandos",
2316
 
                                            bus, do_not_queue=True)
2317
 
            old_bus_name = (dbus.service.BusName
2318
 
                            ("se.bsnet.fukt.Mandos", bus,
2319
 
                             do_not_queue=True))
2320
 
        except dbus.exceptions.NameExistsException as e:
2321
 
            logger.error(unicode(e) + ", disabling D-Bus")
2322
 
            use_dbus = False
2323
 
            server_settings["use_dbus"] = False
2324
 
            tcp_server.use_dbus = False
2325
 
    protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2326
 
    service = AvahiServiceToSyslog(name =
2327
 
                                   server_settings["servicename"],
2328
 
                                   servicetype = "_mandos._tcp",
2329
 
                                   protocol = protocol, bus = bus)
2330
 
    if server_settings["interface"]:
2331
 
        service.interface = (if_nametoindex
2332
 
                             (str(server_settings["interface"])))
2333
 
    
2334
 
    global multiprocessing_manager
2335
 
    multiprocessing_manager = multiprocessing.Manager()
2336
 
    
2337
 
    client_class = Client
2338
 
    if use_dbus:
2339
 
        client_class = functools.partial(ClientDBusTransitional,
2340
 
                                         bus = bus)
2341
 
    
2342
 
    client_settings = Client.config_parser(client_config)
2343
 
    old_client_settings = {}
2344
 
    clients_data = {}
2345
 
    
2346
 
    # Get client data and settings from last running state.
2347
 
    if server_settings["restore"]:
2348
 
        try:
2349
 
            with open(stored_state_path, "rb") as stored_state:
2350
 
                clients_data, old_client_settings = (pickle.load
2351
 
                                                     (stored_state))
2352
 
            os.remove(stored_state_path)
2353
 
        except IOError as e:
2354
 
            logger.warning("Could not load persistent state: {0}"
2355
 
                           .format(e))
2356
 
            if e.errno != errno.ENOENT:
2357
 
                raise
2358
 
        except EOFError as e:
2359
 
            logger.warning("Could not load persistent state: "
2360
 
                           "EOFError: {0}".format(e))
2361
 
    
2362
 
    with PGPEngine() as pgp:
2363
 
        for client_name, client in clients_data.iteritems():
2364
 
            # Decide which value to use after restoring saved state.
2365
 
            # We have three different values: Old config file,
2366
 
            # new config file, and saved state.
2367
 
            # New config value takes precedence if it differs from old
2368
 
            # config value, otherwise use saved state.
2369
 
            for name, value in client_settings[client_name].items():
2370
 
                try:
2371
 
                    # For each value in new config, check if it
2372
 
                    # differs from the old config value (Except for
2373
 
                    # the "secret" attribute)
2374
 
                    if (name != "secret" and
2375
 
                        value != old_client_settings[client_name]
2376
 
                        [name]):
2377
 
                        client[name] = value
2378
 
                except KeyError:
2379
 
                    pass
2380
 
            
2381
 
            # Clients who has passed its expire date can still be
2382
 
            # enabled if its last checker was successful.  Clients
2383
 
            # whose checker succeeded before we stored its state is
2384
 
            # assumed to have successfully run all checkers during
2385
 
            # downtime.
2386
 
            if client["enabled"]:
2387
 
                if datetime.datetime.utcnow() >= client["expires"]:
2388
 
                    if not client["last_checked_ok"]:
2389
 
                        logger.warning(
2390
 
                            "disabling client {0} - Client never "
2391
 
                            "performed a successful checker"
2392
 
                            .format(client_name))
2393
 
                        client["enabled"] = False
2394
 
                    elif client["last_checker_status"] != 0:
2395
 
                        logger.warning(
2396
 
                            "disabling client {0} - Client "
2397
 
                            "last checker failed with error code {1}"
2398
 
                            .format(client_name,
2399
 
                                    client["last_checker_status"]))
2400
 
                        client["enabled"] = False
2401
 
                    else:
2402
 
                        client["expires"] = (datetime.datetime
2403
 
                                             .utcnow()
2404
 
                                             + client["timeout"])
2405
 
                        logger.debug("Last checker succeeded,"
2406
 
                                     " keeping {0} enabled"
2407
 
                                     .format(client_name))
2408
 
            try:
2409
 
                client["secret"] = (
2410
 
                    pgp.decrypt(client["encrypted_secret"],
2411
 
                                client_settings[client_name]
2412
 
                                ["secret"]))
2413
 
            except PGPError:
2414
 
                # If decryption fails, we use secret from new settings
2415
 
                logger.debug("Failed to decrypt {0} old secret"
2416
 
                             .format(client_name))
2417
 
                client["secret"] = (
2418
 
                    client_settings[client_name]["secret"])
2419
 
 
2420
 
    
2421
 
    # Add/remove clients based on new changes made to config
2422
 
    for client_name in (set(old_client_settings)
2423
 
                        - set(client_settings)):
2424
 
        del clients_data[client_name]
2425
 
    for client_name in (set(client_settings)
2426
 
                        - set(old_client_settings)):
2427
 
        clients_data[client_name] = client_settings[client_name]
2428
 
 
2429
 
    # Create all client objects
2430
 
    for client_name, client in clients_data.iteritems():
2431
 
        tcp_server.clients[client_name] = client_class(
2432
 
            name = client_name, settings = client)
2433
 
    
2434
 
    if not tcp_server.clients:
2435
 
        logger.warning("No clients defined")
 
741
    
 
742
    debug = server_settings["debug"]
 
743
    
 
744
    if debug:
 
745
        console = logging.StreamHandler()
 
746
        # console.setLevel(logging.DEBUG)
 
747
        console.setFormatter(logging.Formatter\
 
748
                             ('%(levelname)s: %(message)s'))
 
749
        logger.addHandler(console)
 
750
        del console
 
751
    
 
752
    clients = Set()
 
753
    def remove_from_clients(client):
 
754
        clients.remove(client)
 
755
        if not clients:
 
756
            logger.critical(u"No clients left, exiting")
 
757
            sys.exit()
 
758
    
 
759
    clients.update(Set(Client(name = section,
 
760
                              stop_hook = remove_from_clients,
 
761
                              config
 
762
                              = dict(client_config.items(section)))
 
763
                       for section in client_config.sections()))
 
764
    
 
765
    if not debug:
 
766
        daemon(False, False)
 
767
    
 
768
    def cleanup():
 
769
        "Cleanup function; run on exit"
 
770
        global group
 
771
        # From the Avahi example code
 
772
        if not group is None:
 
773
            group.Free()
 
774
            group = None
 
775
        # End of Avahi example code
2436
776
        
 
777
        while clients:
 
778
            client = clients.pop()
 
779
            client.stop_hook = None
 
780
            client.stop()
 
781
    
 
782
    atexit.register(cleanup)
 
783
    
2437
784
    if not debug:
2438
 
        try:
2439
 
            with pidfile:
2440
 
                pid = os.getpid()
2441
 
                pidfile.write(str(pid) + "\n".encode("utf-8"))
2442
 
            del pidfile
2443
 
        except IOError:
2444
 
            logger.error("Could not write to file %r with PID %d",
2445
 
                         pidfilename, pid)
2446
 
        except NameError:
2447
 
            # "pidfile" was never created
2448
 
            pass
2449
 
        del pidfilename
2450
785
        signal.signal(signal.SIGINT, signal.SIG_IGN)
2451
 
    
2452
786
    signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2453
787
    signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
2454
788
    
2455
 
    if use_dbus:
2456
 
        class MandosDBusService(DBusObjectWithProperties):
2457
 
            """A D-Bus proxy object"""
2458
 
            def __init__(self):
2459
 
                dbus.service.Object.__init__(self, bus, "/")
2460
 
            _interface = "se.recompile.Mandos"
2461
 
            
2462
 
            @dbus_interface_annotations(_interface)
2463
 
            def _foo(self):
2464
 
                return { "org.freedesktop.DBus.Property"
2465
 
                         ".EmitsChangedSignal":
2466
 
                             "false"}
2467
 
            
2468
 
            @dbus.service.signal(_interface, signature="o")
2469
 
            def ClientAdded(self, objpath):
2470
 
                "D-Bus signal"
2471
 
                pass
2472
 
            
2473
 
            @dbus.service.signal(_interface, signature="ss")
2474
 
            def ClientNotFound(self, fingerprint, address):
2475
 
                "D-Bus signal"
2476
 
                pass
2477
 
            
2478
 
            @dbus.service.signal(_interface, signature="os")
2479
 
            def ClientRemoved(self, objpath, name):
2480
 
                "D-Bus signal"
2481
 
                pass
2482
 
            
2483
 
            @dbus.service.method(_interface, out_signature="ao")
2484
 
            def GetAllClients(self):
2485
 
                "D-Bus method"
2486
 
                return dbus.Array(c.dbus_object_path
2487
 
                                  for c in
2488
 
                                  tcp_server.clients.itervalues())
2489
 
            
2490
 
            @dbus.service.method(_interface,
2491
 
                                 out_signature="a{oa{sv}}")
2492
 
            def GetAllClientsWithProperties(self):
2493
 
                "D-Bus method"
2494
 
                return dbus.Dictionary(
2495
 
                    ((c.dbus_object_path, c.GetAll(""))
2496
 
                     for c in tcp_server.clients.itervalues()),
2497
 
                    signature="oa{sv}")
2498
 
            
2499
 
            @dbus.service.method(_interface, in_signature="o")
2500
 
            def RemoveClient(self, object_path):
2501
 
                "D-Bus method"
2502
 
                for c in tcp_server.clients.itervalues():
2503
 
                    if c.dbus_object_path == object_path:
2504
 
                        del tcp_server.clients[c.name]
2505
 
                        c.remove_from_connection()
2506
 
                        # Don't signal anything except ClientRemoved
2507
 
                        c.disable(quiet=True)
2508
 
                        # Emit D-Bus signal
2509
 
                        self.ClientRemoved(object_path, c.name)
2510
 
                        return
2511
 
                raise KeyError(object_path)
2512
 
            
2513
 
            del _interface
2514
 
        
2515
 
        class MandosDBusServiceTransitional(MandosDBusService):
2516
 
            __metaclass__ = AlternateDBusNamesMetaclass
2517
 
        mandos_dbus_service = MandosDBusServiceTransitional()
2518
 
    
2519
 
    def cleanup():
2520
 
        "Cleanup function; run on exit"
2521
 
        service.cleanup()
2522
 
        
2523
 
        multiprocessing.active_children()
2524
 
        if not (tcp_server.clients or client_settings):
2525
 
            return
2526
 
        
2527
 
        # Store client before exiting. Secrets are encrypted with key
2528
 
        # based on what config file has. If config file is
2529
 
        # removed/edited, old secret will thus be unrecovable.
2530
 
        clients = {}
2531
 
        with PGPEngine() as pgp:
2532
 
            for client in tcp_server.clients.itervalues():
2533
 
                key = client_settings[client.name]["secret"]
2534
 
                client.encrypted_secret = pgp.encrypt(client.secret,
2535
 
                                                      key)
2536
 
                client_dict = {}
2537
 
                
2538
 
                # A list of attributes that can not be pickled
2539
 
                # + secret.
2540
 
                exclude = set(("bus", "changedstate", "secret",
2541
 
                               "checker"))
2542
 
                for name, typ in (inspect.getmembers
2543
 
                                  (dbus.service.Object)):
2544
 
                    exclude.add(name)
2545
 
                
2546
 
                client_dict["encrypted_secret"] = (client
2547
 
                                                   .encrypted_secret)
2548
 
                for attr in client.client_structure:
2549
 
                    if attr not in exclude:
2550
 
                        client_dict[attr] = getattr(client, attr)
2551
 
                
2552
 
                clients[client.name] = client_dict
2553
 
                del client_settings[client.name]["secret"]
2554
 
        
2555
 
        try:
2556
 
            tempfd, tempname = tempfile.mkstemp(suffix=".pickle",
2557
 
                                                prefix="clients-",
2558
 
                                                dir=os.path.dirname
2559
 
                                                (stored_state_path))
2560
 
            with os.fdopen(tempfd, "wb") as stored_state:
2561
 
                pickle.dump((clients, client_settings), stored_state)
2562
 
            os.rename(tempname, stored_state_path)
2563
 
        except (IOError, OSError) as e:
2564
 
            logger.warning("Could not save persistent state: {0}"
2565
 
                           .format(e))
2566
 
            if not debug:
2567
 
                try:
2568
 
                    os.remove(tempname)
2569
 
                except NameError:
2570
 
                    pass
2571
 
            if e.errno not in set((errno.ENOENT, errno.EACCES,
2572
 
                                   errno.EEXIST)):
2573
 
                raise e
2574
 
        
2575
 
        # Delete all clients, and settings from config
2576
 
        while tcp_server.clients:
2577
 
            name, client = tcp_server.clients.popitem()
2578
 
            if use_dbus:
2579
 
                client.remove_from_connection()
2580
 
            # Don't signal anything except ClientRemoved
2581
 
            client.disable(quiet=True)
2582
 
            if use_dbus:
2583
 
                # Emit D-Bus signal
2584
 
                mandos_dbus_service.ClientRemoved(client
2585
 
                                                  .dbus_object_path,
2586
 
                                                  client.name)
2587
 
        client_settings.clear()
2588
 
    
2589
 
    atexit.register(cleanup)
2590
 
    
2591
 
    for client in tcp_server.clients.itervalues():
2592
 
        if use_dbus:
2593
 
            # Emit D-Bus signal
2594
 
            mandos_dbus_service.ClientAdded(client.dbus_object_path)
2595
 
        # Need to initiate checking of clients
2596
 
        if client.enabled:
2597
 
            client.init_checker()
2598
 
    
2599
 
    tcp_server.enable()
2600
 
    tcp_server.server_activate()
2601
 
    
 
789
    for client in clients:
 
790
        client.start()
 
791
    
 
792
    tcp_server = IPv6_TCPServer((server_settings["address"],
 
793
                                 server_settings["port"]),
 
794
                                tcp_handler,
 
795
                                settings=server_settings,
 
796
                                clients=clients)
2602
797
    # Find out what port we got
2603
798
    service.port = tcp_server.socket.getsockname()[1]
2604
 
    if use_ipv6:
2605
 
        logger.info("Now listening on address %r, port %d,"
2606
 
                    " flowinfo %d, scope_id %d"
2607
 
                    % tcp_server.socket.getsockname())
2608
 
    else:                       # IPv4
2609
 
        logger.info("Now listening on address %r, port %d"
2610
 
                    % tcp_server.socket.getsockname())
 
799
    logger.info(u"Now listening on address %r, port %d, flowinfo %d,"
 
800
                u" scope_id %d" % tcp_server.socket.getsockname())
2611
801
    
2612
802
    #service.interface = tcp_server.socket.getsockname()[3]
2613
803
    
2614
804
    try:
2615
805
        # From the Avahi example code
 
806
        server.connect_to_signal("StateChanged", server_state_changed)
2616
807
        try:
2617
 
            service.activate()
2618
 
        except dbus.exceptions.DBusException as error:
2619
 
            logger.critical("DBusException: %s", error)
2620
 
            cleanup()
 
808
            server_state_changed(server.GetState())
 
809
        except dbus.exceptions.DBusException, error:
 
810
            logger.critical(u"DBusException: %s", error)
2621
811
            sys.exit(1)
2622
812
        # End of Avahi example code
2623
813
        
2624
814
        gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
2625
815
                             lambda *args, **kwargs:
2626
 
                             (tcp_server.handle_request
2627
 
                              (*args[2:], **kwargs) or True))
 
816
                             tcp_server.handle_request\
 
817
                             (*args[2:], **kwargs) or True)
2628
818
        
2629
819
        logger.debug("Starting main loop")
 
820
        main_loop_started = True
2630
821
        main_loop.run()
2631
 
    except AvahiError as error:
2632
 
        logger.critical("AvahiError: %s", error)
2633
 
        cleanup()
 
822
    except AvahiError, error:
 
823
        logger.critical(u"AvahiError: %s" + unicode(error))
2634
824
        sys.exit(1)
2635
825
    except KeyboardInterrupt:
2636
826
        if debug:
2637
 
            print("", file=sys.stderr)
2638
 
        logger.debug("Server received KeyboardInterrupt")
2639
 
    logger.debug("Server exiting")
2640
 
    # Must run before the D-Bus bus name gets deregistered
2641
 
    cleanup()
 
827
            print
2642
828
 
2643
829
if __name__ == '__main__':
2644
830
    main()