/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos

  • Committer: Teddy Hogeborn
  • Date: 2011-02-27 17:26:35 UTC
  • Revision ID: teddy@fukt.bsnet.se-20110227172635-hw1sire7k3vuo1co
Update copyright year to "2011" wherever appropriate.

Show diffs side-by-side

added added

removed removed

Lines of Context:
11
11
# "AvahiService" class, and some lines in "main".
12
12
13
13
# Everything else is
14
 
# Copyright © 2008-2012 Teddy Hogeborn
15
 
# Copyright © 2008-2012 Björn Påhlsson
 
14
# Copyright © 2008-2011 Teddy Hogeborn
 
15
# Copyright © 2008-2011 Björn Påhlsson
16
16
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
28
28
# along with this program.  If not, see
29
29
# <http://www.gnu.org/licenses/>.
30
30
31
 
# Contact the authors at <mandos@recompile.se>.
 
31
# Contact the authors at <mandos@fukt.bsnet.se>.
32
32
33
33
 
34
34
from __future__ import (division, absolute_import, print_function,
35
35
                        unicode_literals)
36
36
 
37
 
from future_builtins import *
38
 
 
39
37
import SocketServer as socketserver
40
38
import socket
41
 
import argparse
 
39
import optparse
42
40
import datetime
43
41
import errno
44
42
import gnutls.crypto
64
62
import functools
65
63
import cPickle as pickle
66
64
import multiprocessing
67
 
import types
68
 
import binascii
69
 
import tempfile
70
 
import itertools
71
65
 
72
66
import dbus
73
67
import dbus.service
78
72
import ctypes.util
79
73
import xml.dom.minidom
80
74
import inspect
81
 
import GnuPGInterface
82
75
 
83
76
try:
84
77
    SO_BINDTODEVICE = socket.SO_BINDTODEVICE
88
81
    except ImportError:
89
82
        SO_BINDTODEVICE = None
90
83
 
91
 
version = "1.5.4"
92
 
stored_state_file = "clients.pickle"
93
 
 
94
 
logger = logging.getLogger()
 
84
 
 
85
version = "1.2.3"
 
86
 
 
87
#logger = logging.getLogger('mandos')
 
88
logger = logging.Logger('mandos')
95
89
syslogger = (logging.handlers.SysLogHandler
96
90
             (facility = logging.handlers.SysLogHandler.LOG_DAEMON,
97
91
              address = str("/dev/log")))
98
 
 
99
 
try:
100
 
    if_nametoindex = (ctypes.cdll.LoadLibrary
101
 
                      (ctypes.util.find_library("c"))
102
 
                      .if_nametoindex)
103
 
except (OSError, AttributeError):
104
 
    def if_nametoindex(interface):
105
 
        "Get an interface index the hard way, i.e. using fcntl()"
106
 
        SIOCGIFINDEX = 0x8933  # From /usr/include/linux/sockios.h
107
 
        with contextlib.closing(socket.socket()) as s:
108
 
            ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
109
 
                                struct.pack(str("16s16x"),
110
 
                                            interface))
111
 
        interface_index = struct.unpack(str("I"),
112
 
                                        ifreq[16:20])[0]
113
 
        return interface_index
114
 
 
115
 
 
116
 
def initlogger(debug, level=logging.WARNING):
117
 
    """init logger and add loglevel"""
118
 
    
119
 
    syslogger.setFormatter(logging.Formatter
120
 
                           ('Mandos [%(process)d]: %(levelname)s:'
121
 
                            ' %(message)s'))
122
 
    logger.addHandler(syslogger)
123
 
    
124
 
    if debug:
125
 
        console = logging.StreamHandler()
126
 
        console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
127
 
                                               ' [%(process)d]:'
128
 
                                               ' %(levelname)s:'
129
 
                                               ' %(message)s'))
130
 
        logger.addHandler(console)
131
 
    logger.setLevel(level)
132
 
 
133
 
 
134
 
class PGPError(Exception):
135
 
    """Exception if encryption/decryption fails"""
136
 
    pass
137
 
 
138
 
 
139
 
class PGPEngine(object):
140
 
    """A simple class for OpenPGP symmetric encryption & decryption"""
141
 
    def __init__(self):
142
 
        self.gnupg = GnuPGInterface.GnuPG()
143
 
        self.tempdir = tempfile.mkdtemp(prefix="mandos-")
144
 
        self.gnupg = GnuPGInterface.GnuPG()
145
 
        self.gnupg.options.meta_interactive = False
146
 
        self.gnupg.options.homedir = self.tempdir
147
 
        self.gnupg.options.extra_args.extend(['--force-mdc',
148
 
                                              '--quiet',
149
 
                                              '--no-use-agent'])
150
 
    
151
 
    def __enter__(self):
152
 
        return self
153
 
    
154
 
    def __exit__(self, exc_type, exc_value, traceback):
155
 
        self._cleanup()
156
 
        return False
157
 
    
158
 
    def __del__(self):
159
 
        self._cleanup()
160
 
    
161
 
    def _cleanup(self):
162
 
        if self.tempdir is not None:
163
 
            # Delete contents of tempdir
164
 
            for root, dirs, files in os.walk(self.tempdir,
165
 
                                             topdown = False):
166
 
                for filename in files:
167
 
                    os.remove(os.path.join(root, filename))
168
 
                for dirname in dirs:
169
 
                    os.rmdir(os.path.join(root, dirname))
170
 
            # Remove tempdir
171
 
            os.rmdir(self.tempdir)
172
 
            self.tempdir = None
173
 
    
174
 
    def password_encode(self, password):
175
 
        # Passphrase can not be empty and can not contain newlines or
176
 
        # NUL bytes.  So we prefix it and hex encode it.
177
 
        return b"mandos" + binascii.hexlify(password)
178
 
    
179
 
    def encrypt(self, data, password):
180
 
        self.gnupg.passphrase = self.password_encode(password)
181
 
        with open(os.devnull, "w") as devnull:
182
 
            try:
183
 
                proc = self.gnupg.run(['--symmetric'],
184
 
                                      create_fhs=['stdin', 'stdout'],
185
 
                                      attach_fhs={'stderr': devnull})
186
 
                with contextlib.closing(proc.handles['stdin']) as f:
187
 
                    f.write(data)
188
 
                with contextlib.closing(proc.handles['stdout']) as f:
189
 
                    ciphertext = f.read()
190
 
                proc.wait()
191
 
            except IOError as e:
192
 
                raise PGPError(e)
193
 
        self.gnupg.passphrase = None
194
 
        return ciphertext
195
 
    
196
 
    def decrypt(self, data, password):
197
 
        self.gnupg.passphrase = self.password_encode(password)
198
 
        with open(os.devnull, "w") as devnull:
199
 
            try:
200
 
                proc = self.gnupg.run(['--decrypt'],
201
 
                                      create_fhs=['stdin', 'stdout'],
202
 
                                      attach_fhs={'stderr': devnull})
203
 
                with contextlib.closing(proc.handles['stdin']) as f:
204
 
                    f.write(data)
205
 
                with contextlib.closing(proc.handles['stdout']) as f:
206
 
                    decrypted_plaintext = f.read()
207
 
                proc.wait()
208
 
            except IOError as e:
209
 
                raise PGPError(e)
210
 
        self.gnupg.passphrase = None
211
 
        return decrypted_plaintext
212
 
 
 
92
syslogger.setFormatter(logging.Formatter
 
93
                       ('Mandos [%(process)d]: %(levelname)s:'
 
94
                        ' %(message)s'))
 
95
logger.addHandler(syslogger)
 
96
 
 
97
console = logging.StreamHandler()
 
98
console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'
 
99
                                       ' %(levelname)s:'
 
100
                                       ' %(message)s'))
 
101
logger.addHandler(console)
213
102
 
214
103
class AvahiError(Exception):
215
104
    def __init__(self, value, *args, **kwargs):
245
134
    server: D-Bus Server
246
135
    bus: dbus.SystemBus()
247
136
    """
248
 
    
249
137
    def __init__(self, interface = avahi.IF_UNSPEC, name = None,
250
138
                 servicetype = None, port = None, TXT = None,
251
139
                 domain = "", host = "", max_renames = 32768,
263
151
        self.group = None       # our entry group
264
152
        self.server = None
265
153
        self.bus = bus
266
 
        self.entry_group_state_changed_match = None
267
 
    
268
154
    def rename(self):
269
155
        """Derived from the Avahi example code"""
270
156
        if self.rename_count >= self.max_renames:
272
158
                            " after %i retries, exiting.",
273
159
                            self.rename_count)
274
160
            raise AvahiServiceError("Too many renames")
275
 
        self.name = unicode(self.server
276
 
                            .GetAlternativeServiceName(self.name))
 
161
        self.name = unicode(self.server.GetAlternativeServiceName(self.name))
277
162
        logger.info("Changing Zeroconf service name to %r ...",
278
163
                    self.name)
 
164
        syslogger.setFormatter(logging.Formatter
 
165
                               ('Mandos (%s) [%%(process)d]:'
 
166
                                ' %%(levelname)s: %%(message)s'
 
167
                                % self.name))
279
168
        self.remove()
280
169
        try:
281
170
            self.add()
282
 
        except dbus.exceptions.DBusException as error:
283
 
            logger.critical("D-Bus Exception", exc_info=error)
 
171
        except dbus.exceptions.DBusException, error:
 
172
            logger.critical("DBusException: %s", error)
284
173
            self.cleanup()
285
174
            os._exit(1)
286
175
        self.rename_count += 1
287
 
    
288
176
    def remove(self):
289
177
        """Derived from the Avahi example code"""
290
 
        if self.entry_group_state_changed_match is not None:
291
 
            self.entry_group_state_changed_match.remove()
292
 
            self.entry_group_state_changed_match = None
293
178
        if self.group is not None:
294
179
            self.group.Reset()
295
 
    
296
180
    def add(self):
297
181
        """Derived from the Avahi example code"""
298
 
        self.remove()
299
182
        if self.group is None:
300
183
            self.group = dbus.Interface(
301
184
                self.bus.get_object(avahi.DBUS_NAME,
302
185
                                    self.server.EntryGroupNew()),
303
186
                avahi.DBUS_INTERFACE_ENTRY_GROUP)
304
 
        self.entry_group_state_changed_match = (
305
 
            self.group.connect_to_signal(
306
 
                'StateChanged', self.entry_group_state_changed))
 
187
            self.group.connect_to_signal('StateChanged',
 
188
                                         self
 
189
                                         .entry_group_state_changed)
307
190
        logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
308
191
                     self.name, self.type)
309
192
        self.group.AddService(
315
198
            dbus.UInt16(self.port),
316
199
            avahi.string_array_to_txt_array(self.TXT))
317
200
        self.group.Commit()
318
 
    
319
201
    def entry_group_state_changed(self, state, error):
320
202
        """Derived from the Avahi example code"""
321
203
        logger.debug("Avahi entry group state change: %i", state)
328
210
        elif state == avahi.ENTRY_GROUP_FAILURE:
329
211
            logger.critical("Avahi: Error in group state changed %s",
330
212
                            unicode(error))
331
 
            raise AvahiGroupError("State changed: {0!s}"
332
 
                                  .format(error))
333
 
    
 
213
            raise AvahiGroupError("State changed: %s"
 
214
                                  % unicode(error))
334
215
    def cleanup(self):
335
216
        """Derived from the Avahi example code"""
336
217
        if self.group is not None:
337
 
            try:
338
 
                self.group.Free()
339
 
            except (dbus.exceptions.UnknownMethodException,
340
 
                    dbus.exceptions.DBusException):
341
 
                pass
 
218
            self.group.Free()
342
219
            self.group = None
343
 
        self.remove()
344
 
    
345
 
    def server_state_changed(self, state, error=None):
 
220
    def server_state_changed(self, state):
346
221
        """Derived from the Avahi example code"""
347
222
        logger.debug("Avahi server state change: %i", state)
348
 
        bad_states = { avahi.SERVER_INVALID:
349
 
                           "Zeroconf server invalid",
350
 
                       avahi.SERVER_REGISTERING: None,
351
 
                       avahi.SERVER_COLLISION:
352
 
                           "Zeroconf server name collision",
353
 
                       avahi.SERVER_FAILURE:
354
 
                           "Zeroconf server failure" }
355
 
        if state in bad_states:
356
 
            if bad_states[state] is not None:
357
 
                if error is None:
358
 
                    logger.error(bad_states[state])
359
 
                else:
360
 
                    logger.error(bad_states[state] + ": %r", error)
361
 
            self.cleanup()
 
223
        if state == avahi.SERVER_COLLISION:
 
224
            logger.error("Zeroconf server name collision")
 
225
            self.remove()
362
226
        elif state == avahi.SERVER_RUNNING:
363
227
            self.add()
364
 
        else:
365
 
            if error is None:
366
 
                logger.debug("Unknown state: %r", state)
367
 
            else:
368
 
                logger.debug("Unknown state: %r: %r", state, error)
369
 
    
370
228
    def activate(self):
371
229
        """Derived from the Avahi example code"""
372
230
        if self.server is None:
373
231
            self.server = dbus.Interface(
374
232
                self.bus.get_object(avahi.DBUS_NAME,
375
 
                                    avahi.DBUS_PATH_SERVER,
376
 
                                    follow_name_owner_changes=True),
 
233
                                    avahi.DBUS_PATH_SERVER),
377
234
                avahi.DBUS_INTERFACE_SERVER)
378
235
        self.server.connect_to_signal("StateChanged",
379
236
                                 self.server_state_changed)
380
237
        self.server_state_changed(self.server.GetState())
381
238
 
382
239
 
383
 
class AvahiServiceToSyslog(AvahiService):
384
 
    def rename(self):
385
 
        """Add the new name to the syslog messages"""
386
 
        ret = AvahiService.rename(self)
387
 
        syslogger.setFormatter(logging.Formatter
388
 
                               ('Mandos ({0}) [%(process)d]:'
389
 
                                ' %(levelname)s: %(message)s'
390
 
                                .format(self.name)))
391
 
        return ret
392
 
 
393
 
 
394
 
def timedelta_to_milliseconds(td):
395
 
    "Convert a datetime.timedelta() to milliseconds"
396
 
    return ((td.days * 24 * 60 * 60 * 1000)
397
 
            + (td.seconds * 1000)
398
 
            + (td.microseconds // 1000))
399
 
 
400
 
 
401
240
class Client(object):
402
241
    """A representation of a client host served by this server.
403
242
    
404
243
    Attributes:
405
 
    approved:   bool(); 'None' if not yet approved/disapproved
 
244
    _approved:   bool(); 'None' if not yet approved/disapproved
406
245
    approval_delay: datetime.timedelta(); Time to wait for approval
407
246
    approval_duration: datetime.timedelta(); Duration of one approval
408
247
    checker:    subprocess.Popen(); a running checker process used
415
254
                     instance %(name)s can be used in the command.
416
255
    checker_initiator_tag: a gobject event source tag, or None
417
256
    created:    datetime.datetime(); (UTC) object creation
418
 
    client_structure: Object describing what attributes a client has
419
 
                      and is used for storing the client at exit
420
257
    current_checker_command: string; current running checker_command
 
258
    disable_hook:  If set, called by disable() as disable_hook(self)
421
259
    disable_initiator_tag: a gobject event source tag, or None
422
260
    enabled:    bool()
423
261
    fingerprint: string (40 or 32 hexadecimal digits); used to
426
264
    interval:   datetime.timedelta(); How often to start a new checker
427
265
    last_approval_request: datetime.datetime(); (UTC) or None
428
266
    last_checked_ok: datetime.datetime(); (UTC) or None
429
 
    last_checker_status: integer between 0 and 255 reflecting exit
430
 
                         status of last checker. -1 reflects crashed
431
 
                         checker, -2 means no checker completed yet.
432
 
    last_enabled: datetime.datetime(); (UTC) or None
 
267
    last_enabled: datetime.datetime(); (UTC)
433
268
    name:       string; from the config file, used in log messages and
434
269
                        D-Bus identifiers
435
270
    secret:     bytestring; sent verbatim (over TLS) to client
436
271
    timeout:    datetime.timedelta(); How long from last_checked_ok
437
272
                                      until this client is disabled
438
 
    extended_timeout:   extra long timeout when secret has been sent
439
273
    runtime_expansions: Allowed attributes for runtime expansion.
440
 
    expires:    datetime.datetime(); time (UTC) when a client will be
441
 
                disabled, or None
442
274
    """
443
275
    
444
276
    runtime_expansions = ("approval_delay", "approval_duration",
445
 
                          "created", "enabled", "expires",
446
 
                          "fingerprint", "host", "interval",
447
 
                          "last_approval_request", "last_checked_ok",
 
277
                          "created", "enabled", "fingerprint",
 
278
                          "host", "interval", "last_checked_ok",
448
279
                          "last_enabled", "name", "timeout")
449
 
    client_defaults = { "timeout": "5m",
450
 
                        "extended_timeout": "15m",
451
 
                        "interval": "2m",
452
 
                        "checker": "fping -q -- %%(host)s",
453
 
                        "host": "",
454
 
                        "approval_delay": "0s",
455
 
                        "approval_duration": "1s",
456
 
                        "approved_by_default": "True",
457
 
                        "enabled": "True",
458
 
                        }
 
280
    
 
281
    @staticmethod
 
282
    def _timedelta_to_milliseconds(td):
 
283
        "Convert a datetime.timedelta() to milliseconds"
 
284
        return ((td.days * 24 * 60 * 60 * 1000)
 
285
                + (td.seconds * 1000)
 
286
                + (td.microseconds // 1000))
459
287
    
460
288
    def timeout_milliseconds(self):
461
289
        "Return the 'timeout' attribute in milliseconds"
462
 
        return timedelta_to_milliseconds(self.timeout)
463
 
    
464
 
    def extended_timeout_milliseconds(self):
465
 
        "Return the 'extended_timeout' attribute in milliseconds"
466
 
        return timedelta_to_milliseconds(self.extended_timeout)
 
290
        return self._timedelta_to_milliseconds(self.timeout)
467
291
    
468
292
    def interval_milliseconds(self):
469
293
        "Return the 'interval' attribute in milliseconds"
470
 
        return timedelta_to_milliseconds(self.interval)
471
 
    
 
294
        return self._timedelta_to_milliseconds(self.interval)
 
295
 
472
296
    def approval_delay_milliseconds(self):
473
 
        return timedelta_to_milliseconds(self.approval_delay)
474
 
    
475
 
    @staticmethod
476
 
    def config_parser(config):
477
 
        """Construct a new dict of client settings of this form:
478
 
        { client_name: {setting_name: value, ...}, ...}
479
 
        with exceptions for any special settings as defined above.
480
 
        NOTE: Must be a pure function. Must return the same result
481
 
        value given the same arguments.
482
 
        """
483
 
        settings = {}
484
 
        for client_name in config.sections():
485
 
            section = dict(config.items(client_name))
486
 
            client = settings[client_name] = {}
487
 
            
488
 
            client["host"] = section["host"]
489
 
            # Reformat values from string types to Python types
490
 
            client["approved_by_default"] = config.getboolean(
491
 
                client_name, "approved_by_default")
492
 
            client["enabled"] = config.getboolean(client_name,
493
 
                                                  "enabled")
494
 
            
495
 
            client["fingerprint"] = (section["fingerprint"].upper()
496
 
                                     .replace(" ", ""))
497
 
            if "secret" in section:
498
 
                client["secret"] = section["secret"].decode("base64")
499
 
            elif "secfile" in section:
500
 
                with open(os.path.expanduser(os.path.expandvars
501
 
                                             (section["secfile"])),
502
 
                          "rb") as secfile:
503
 
                    client["secret"] = secfile.read()
504
 
            else:
505
 
                raise TypeError("No secret or secfile for section {0}"
506
 
                                .format(section))
507
 
            client["timeout"] = string_to_delta(section["timeout"])
508
 
            client["extended_timeout"] = string_to_delta(
509
 
                section["extended_timeout"])
510
 
            client["interval"] = string_to_delta(section["interval"])
511
 
            client["approval_delay"] = string_to_delta(
512
 
                section["approval_delay"])
513
 
            client["approval_duration"] = string_to_delta(
514
 
                section["approval_duration"])
515
 
            client["checker_command"] = section["checker"]
516
 
            client["last_approval_request"] = None
517
 
            client["last_checked_ok"] = None
518
 
            client["last_checker_status"] = -2
519
 
        
520
 
        return settings
521
 
    
522
 
    def __init__(self, settings, name = None):
 
297
        return self._timedelta_to_milliseconds(self.approval_delay)
 
298
    
 
299
    def __init__(self, name = None, disable_hook=None, config=None):
 
300
        """Note: the 'checker' key in 'config' sets the
 
301
        'checker_command' attribute and *not* the 'checker'
 
302
        attribute."""
523
303
        self.name = name
524
 
        # adding all client settings
525
 
        for setting, value in settings.iteritems():
526
 
            setattr(self, setting, value)
527
 
        
528
 
        if self.enabled:
529
 
            if not hasattr(self, "last_enabled"):
530
 
                self.last_enabled = datetime.datetime.utcnow()
531
 
            if not hasattr(self, "expires"):
532
 
                self.expires = (datetime.datetime.utcnow()
533
 
                                + self.timeout)
534
 
        else:
535
 
            self.last_enabled = None
536
 
            self.expires = None
537
 
        
 
304
        if config is None:
 
305
            config = {}
538
306
        logger.debug("Creating client %r", self.name)
539
307
        # Uppercase and remove spaces from fingerprint for later
540
308
        # comparison purposes with return value from the fingerprint()
541
309
        # function
 
310
        self.fingerprint = (config["fingerprint"].upper()
 
311
                            .replace(" ", ""))
542
312
        logger.debug("  Fingerprint: %s", self.fingerprint)
543
 
        self.created = settings.get("created",
544
 
                                    datetime.datetime.utcnow())
545
 
        
546
 
        # attributes specific for this server instance
 
313
        if "secret" in config:
 
314
            self.secret = config["secret"].decode("base64")
 
315
        elif "secfile" in config:
 
316
            with open(os.path.expanduser(os.path.expandvars
 
317
                                         (config["secfile"])),
 
318
                      "rb") as secfile:
 
319
                self.secret = secfile.read()
 
320
        else:
 
321
            raise TypeError("No secret or secfile for client %s"
 
322
                            % self.name)
 
323
        self.host = config.get("host", "")
 
324
        self.created = datetime.datetime.utcnow()
 
325
        self.enabled = False
 
326
        self.last_approval_request = None
 
327
        self.last_enabled = None
 
328
        self.last_checked_ok = None
 
329
        self.timeout = string_to_delta(config["timeout"])
 
330
        self.interval = string_to_delta(config["interval"])
 
331
        self.disable_hook = disable_hook
547
332
        self.checker = None
548
333
        self.checker_initiator_tag = None
549
334
        self.disable_initiator_tag = None
550
335
        self.checker_callback_tag = None
 
336
        self.checker_command = config["checker"]
551
337
        self.current_checker_command = None
552
 
        self.approved = None
 
338
        self.last_connect = None
 
339
        self._approved = None
 
340
        self.approved_by_default = config.get("approved_by_default",
 
341
                                              True)
553
342
        self.approvals_pending = 0
554
 
        self.changedstate = (multiprocessing_manager
555
 
                             .Condition(multiprocessing_manager
556
 
                                        .Lock()))
557
 
        self.client_structure = [attr for attr in
558
 
                                 self.__dict__.iterkeys()
559
 
                                 if not attr.startswith("_")]
560
 
        self.client_structure.append("client_structure")
561
 
        
562
 
        for name, t in inspect.getmembers(type(self),
563
 
                                          lambda obj:
564
 
                                              isinstance(obj,
565
 
                                                         property)):
566
 
            if not name.startswith("_"):
567
 
                self.client_structure.append(name)
 
343
        self.approval_delay = string_to_delta(
 
344
            config["approval_delay"])
 
345
        self.approval_duration = string_to_delta(
 
346
            config["approval_duration"])
 
347
        self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())
568
348
    
569
 
    # Send notice to process children that client state has changed
570
349
    def send_changedstate(self):
571
 
        with self.changedstate:
572
 
            self.changedstate.notify_all()
573
 
    
 
350
        self.changedstate.acquire()
 
351
        self.changedstate.notify_all()
 
352
        self.changedstate.release()
 
353
        
574
354
    def enable(self):
575
355
        """Start this client's checker and timeout hooks"""
576
356
        if getattr(self, "enabled", False):
577
357
            # Already enabled
578
358
            return
579
 
        self.expires = datetime.datetime.utcnow() + self.timeout
580
 
        self.enabled = True
 
359
        self.send_changedstate()
581
360
        self.last_enabled = datetime.datetime.utcnow()
582
 
        self.init_checker()
583
 
        self.send_changedstate()
584
 
    
585
 
    def disable(self, quiet=True):
586
 
        """Disable this client."""
587
 
        if not getattr(self, "enabled", False):
588
 
            return False
589
 
        if not quiet:
590
 
            logger.info("Disabling client %s", self.name)
591
 
        if getattr(self, "disable_initiator_tag", None) is not None:
592
 
            gobject.source_remove(self.disable_initiator_tag)
593
 
            self.disable_initiator_tag = None
594
 
        self.expires = None
595
 
        if getattr(self, "checker_initiator_tag", None) is not None:
596
 
            gobject.source_remove(self.checker_initiator_tag)
597
 
            self.checker_initiator_tag = None
598
 
        self.stop_checker()
599
 
        self.enabled = False
600
 
        if not quiet:
601
 
            self.send_changedstate()
602
 
        # Do not run this again if called by a gobject.timeout_add
603
 
        return False
604
 
    
605
 
    def __del__(self):
606
 
        self.disable()
607
 
    
608
 
    def init_checker(self):
609
361
        # Schedule a new checker to be started an 'interval' from now,
610
362
        # and every interval from then on.
611
 
        if self.checker_initiator_tag is not None:
612
 
            gobject.source_remove(self.checker_initiator_tag)
613
363
        self.checker_initiator_tag = (gobject.timeout_add
614
364
                                      (self.interval_milliseconds(),
615
365
                                       self.start_checker))
616
366
        # Schedule a disable() when 'timeout' has passed
617
 
        if self.disable_initiator_tag is not None:
618
 
            gobject.source_remove(self.disable_initiator_tag)
619
367
        self.disable_initiator_tag = (gobject.timeout_add
620
368
                                   (self.timeout_milliseconds(),
621
369
                                    self.disable))
 
370
        self.enabled = True
622
371
        # Also start a new checker *right now*.
623
372
        self.start_checker()
624
373
    
 
374
    def disable(self, quiet=True):
 
375
        """Disable this client."""
 
376
        if not getattr(self, "enabled", False):
 
377
            return False
 
378
        if not quiet:
 
379
            self.send_changedstate()
 
380
        if not quiet:
 
381
            logger.info("Disabling client %s", self.name)
 
382
        if getattr(self, "disable_initiator_tag", False):
 
383
            gobject.source_remove(self.disable_initiator_tag)
 
384
            self.disable_initiator_tag = None
 
385
        if getattr(self, "checker_initiator_tag", False):
 
386
            gobject.source_remove(self.checker_initiator_tag)
 
387
            self.checker_initiator_tag = None
 
388
        self.stop_checker()
 
389
        if self.disable_hook:
 
390
            self.disable_hook(self)
 
391
        self.enabled = False
 
392
        # Do not run this again if called by a gobject.timeout_add
 
393
        return False
 
394
    
 
395
    def __del__(self):
 
396
        self.disable_hook = None
 
397
        self.disable()
 
398
    
625
399
    def checker_callback(self, pid, condition, command):
626
400
        """The checker has completed, so take appropriate actions."""
627
401
        self.checker_callback_tag = None
628
402
        self.checker = None
629
403
        if os.WIFEXITED(condition):
630
 
            self.last_checker_status = os.WEXITSTATUS(condition)
631
 
            if self.last_checker_status == 0:
 
404
            exitstatus = os.WEXITSTATUS(condition)
 
405
            if exitstatus == 0:
632
406
                logger.info("Checker for %(name)s succeeded",
633
407
                            vars(self))
634
408
                self.checked_ok()
636
410
                logger.info("Checker for %(name)s failed",
637
411
                            vars(self))
638
412
        else:
639
 
            self.last_checker_status = -1
640
413
            logger.warning("Checker for %(name)s crashed?",
641
414
                           vars(self))
642
415
    
643
416
    def checked_ok(self):
644
 
        """Assert that the client has been seen, alive and well."""
 
417
        """Bump up the timeout for this client.
 
418
        
 
419
        This should only be called when the client has been seen,
 
420
        alive and well.
 
421
        """
645
422
        self.last_checked_ok = datetime.datetime.utcnow()
646
 
        self.last_checker_status = 0
647
 
        self.bump_timeout()
648
 
    
649
 
    def bump_timeout(self, timeout=None):
650
 
        """Bump up the timeout for this client."""
651
 
        if timeout is None:
652
 
            timeout = self.timeout
653
 
        if self.disable_initiator_tag is not None:
654
 
            gobject.source_remove(self.disable_initiator_tag)
655
 
            self.disable_initiator_tag = None
656
 
        if getattr(self, "enabled", False):
657
 
            self.disable_initiator_tag = (gobject.timeout_add
658
 
                                          (timedelta_to_milliseconds
659
 
                                           (timeout), self.disable))
660
 
            self.expires = datetime.datetime.utcnow() + timeout
 
423
        gobject.source_remove(self.disable_initiator_tag)
 
424
        self.disable_initiator_tag = (gobject.timeout_add
 
425
                                      (self.timeout_milliseconds(),
 
426
                                       self.disable))
661
427
    
662
428
    def need_approval(self):
663
429
        self.last_approval_request = datetime.datetime.utcnow()
668
434
        If a checker already exists, leave it running and do
669
435
        nothing."""
670
436
        # The reason for not killing a running checker is that if we
671
 
        # did that, and if a checker (for some reason) started running
672
 
        # slowly and taking more than 'interval' time, then the client
673
 
        # would inevitably timeout, since no checker would get a
674
 
        # chance to run to completion.  If we instead leave running
 
437
        # did that, then if a checker (for some reason) started
 
438
        # running slowly and taking more than 'interval' time, the
 
439
        # client would inevitably timeout, since no checker would get
 
440
        # a chance to run to completion.  If we instead leave running
675
441
        # checkers alone, the checker would have to take more time
676
442
        # than 'timeout' for the client to be disabled, which is as it
677
443
        # should be.
679
445
        # If a checker exists, make sure it is not a zombie
680
446
        try:
681
447
            pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
682
 
        except (AttributeError, OSError) as error:
 
448
        except (AttributeError, OSError), error:
683
449
            if (isinstance(error, OSError)
684
450
                and error.errno != errno.ECHILD):
685
451
                raise error
691
457
                                      self.current_checker_command)
692
458
        # Start a new checker if needed
693
459
        if self.checker is None:
694
 
            # Escape attributes for the shell
695
 
            escaped_attrs = dict(
696
 
                (attr, re.escape(unicode(getattr(self, attr))))
697
 
                for attr in
698
 
                self.runtime_expansions)
699
460
            try:
700
 
                command = self.checker_command % escaped_attrs
701
 
            except TypeError as error:
702
 
                logger.error('Could not format string "%s"',
703
 
                             self.checker_command, exc_info=error)
704
 
                return True # Try again later
 
461
                # In case checker_command has exactly one % operator
 
462
                command = self.checker_command % self.host
 
463
            except TypeError:
 
464
                # Escape attributes for the shell
 
465
                escaped_attrs = dict(
 
466
                    (attr,
 
467
                     re.escape(unicode(str(getattr(self, attr, "")),
 
468
                                       errors=
 
469
                                       'replace')))
 
470
                    for attr in
 
471
                    self.runtime_expansions)
 
472
 
 
473
                try:
 
474
                    command = self.checker_command % escaped_attrs
 
475
                except TypeError, error:
 
476
                    logger.error('Could not format string "%s":'
 
477
                                 ' %s', self.checker_command, error)
 
478
                    return True # Try again later
705
479
            self.current_checker_command = command
706
480
            try:
707
481
                logger.info("Starting checker %r for %s",
713
487
                self.checker = subprocess.Popen(command,
714
488
                                                close_fds=True,
715
489
                                                shell=True, cwd="/")
716
 
            except OSError as error:
717
 
                logger.error("Failed to start subprocess",
718
 
                             exc_info=error)
719
 
            self.checker_callback_tag = (gobject.child_watch_add
720
 
                                         (self.checker.pid,
721
 
                                          self.checker_callback,
722
 
                                          data=command))
723
 
            # The checker may have completed before the gobject
724
 
            # watch was added.  Check for this.
725
 
            pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
726
 
            if pid:
727
 
                gobject.source_remove(self.checker_callback_tag)
728
 
                self.checker_callback(pid, status, command)
 
490
                self.checker_callback_tag = (gobject.child_watch_add
 
491
                                             (self.checker.pid,
 
492
                                              self.checker_callback,
 
493
                                              data=command))
 
494
                # The checker may have completed before the gobject
 
495
                # watch was added.  Check for this.
 
496
                pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
 
497
                if pid:
 
498
                    gobject.source_remove(self.checker_callback_tag)
 
499
                    self.checker_callback(pid, status, command)
 
500
            except OSError, error:
 
501
                logger.error("Failed to start subprocess: %s",
 
502
                             error)
729
503
        # Re-run this periodically if run by gobject.timeout_add
730
504
        return True
731
505
    
738
512
            return
739
513
        logger.debug("Stopping checker for %(name)s", vars(self))
740
514
        try:
741
 
            self.checker.terminate()
 
515
            os.kill(self.checker.pid, signal.SIGTERM)
742
516
            #time.sleep(0.5)
743
517
            #if self.checker.poll() is None:
744
 
            #    self.checker.kill()
745
 
        except OSError as error:
 
518
            #    os.kill(self.checker.pid, signal.SIGKILL)
 
519
        except OSError, error:
746
520
            if error.errno != errno.ESRCH: # No such process
747
521
                raise
748
522
        self.checker = None
749
523
 
750
 
 
751
524
def dbus_service_property(dbus_interface, signature="v",
752
525
                          access="readwrite", byte_arrays=False):
753
526
    """Decorators for marking methods of a DBusObjectWithProperties to
764
537
    # "Set" method, so we fail early here:
765
538
    if byte_arrays and signature != "ay":
766
539
        raise ValueError("Byte arrays not supported for non-'ay'"
767
 
                         " signature {0!r}".format(signature))
 
540
                         " signature %r" % signature)
768
541
    def decorator(func):
769
542
        func._dbus_is_property = True
770
543
        func._dbus_interface = dbus_interface
778
551
    return decorator
779
552
 
780
553
 
781
 
def dbus_interface_annotations(dbus_interface):
782
 
    """Decorator for marking functions returning interface annotations
783
 
    
784
 
    Usage:
785
 
    
786
 
    @dbus_interface_annotations("org.example.Interface")
787
 
    def _foo(self):  # Function name does not matter
788
 
        return {"org.freedesktop.DBus.Deprecated": "true",
789
 
                "org.freedesktop.DBus.Property.EmitsChangedSignal":
790
 
                    "false"}
791
 
    """
792
 
    def decorator(func):
793
 
        func._dbus_is_interface = True
794
 
        func._dbus_interface = dbus_interface
795
 
        func._dbus_name = dbus_interface
796
 
        return func
797
 
    return decorator
798
 
 
799
 
 
800
 
def dbus_annotations(annotations):
801
 
    """Decorator to annotate D-Bus methods, signals or properties
802
 
    Usage:
803
 
    
804
 
    @dbus_service_property("org.example.Interface", signature="b",
805
 
                           access="r")
806
 
    @dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",
807
 
                        "org.freedesktop.DBus.Property."
808
 
                        "EmitsChangedSignal": "false"})
809
 
    def Property_dbus_property(self):
810
 
        return dbus.Boolean(False)
811
 
    """
812
 
    def decorator(func):
813
 
        func._dbus_annotations = annotations
814
 
        return func
815
 
    return decorator
816
 
 
817
 
 
818
554
class DBusPropertyException(dbus.exceptions.DBusException):
819
555
    """A base class for D-Bus property-related exceptions
820
556
    """
836
572
 
837
573
class DBusObjectWithProperties(dbus.service.Object):
838
574
    """A D-Bus object with properties.
839
 
    
 
575
 
840
576
    Classes inheriting from this can use the dbus_service_property
841
577
    decorator to expose methods as D-Bus properties.  It exposes the
842
578
    standard Get(), Set(), and GetAll() methods on the D-Bus.
843
579
    """
844
580
    
845
581
    @staticmethod
846
 
    def _is_dbus_thing(thing):
847
 
        """Returns a function testing if an attribute is a D-Bus thing
848
 
        
849
 
        If called like _is_dbus_thing("method") it returns a function
850
 
        suitable for use as predicate to inspect.getmembers().
851
 
        """
852
 
        return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),
853
 
                                   False)
 
582
    def _is_dbus_property(obj):
 
583
        return getattr(obj, "_dbus_is_property", False)
854
584
    
855
 
    def _get_all_dbus_things(self, thing):
 
585
    def _get_all_dbus_properties(self):
856
586
        """Returns a generator of (name, attribute) pairs
857
587
        """
858
 
        return ((getattr(athing.__get__(self), "_dbus_name",
859
 
                         name),
860
 
                 athing.__get__(self))
861
 
                for cls in self.__class__.__mro__
862
 
                for name, athing in
863
 
                inspect.getmembers(cls,
864
 
                                   self._is_dbus_thing(thing)))
 
588
        return ((prop._dbus_name, prop)
 
589
                for name, prop in
 
590
                inspect.getmembers(self, self._is_dbus_property))
865
591
    
866
592
    def _get_dbus_property(self, interface_name, property_name):
867
593
        """Returns a bound method if one exists which is a D-Bus
868
594
        property with the specified name and interface.
869
595
        """
870
 
        for cls in  self.__class__.__mro__:
871
 
            for name, value in (inspect.getmembers
872
 
                                (cls,
873
 
                                 self._is_dbus_thing("property"))):
874
 
                if (value._dbus_name == property_name
875
 
                    and value._dbus_interface == interface_name):
876
 
                    return value.__get__(self)
877
 
        
 
596
        for name in (property_name,
 
597
                     property_name + "_dbus_property"):
 
598
            prop = getattr(self, name, None)
 
599
            if (prop is None
 
600
                or not self._is_dbus_property(prop)
 
601
                or prop._dbus_name != property_name
 
602
                or (interface_name and prop._dbus_interface
 
603
                    and interface_name != prop._dbus_interface)):
 
604
                continue
 
605
            return prop
878
606
        # No such property
879
607
        raise DBusPropertyNotFound(self.dbus_object_path + ":"
880
608
                                   + interface_name + "."
905
633
            # signatures other than "ay".
906
634
            if prop._dbus_signature != "ay":
907
635
                raise ValueError
908
 
            value = dbus.ByteArray(b''.join(chr(byte)
909
 
                                            for byte in value))
 
636
            value = dbus.ByteArray(''.join(unichr(byte)
 
637
                                           for byte in value))
910
638
        prop(value)
911
639
    
912
640
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
914
642
    def GetAll(self, interface_name):
915
643
        """Standard D-Bus property GetAll() method, see D-Bus
916
644
        standard.
917
 
        
 
645
 
918
646
        Note: Will not include properties with access="write".
919
647
        """
920
 
        properties = {}
921
 
        for name, prop in self._get_all_dbus_things("property"):
 
648
        all = {}
 
649
        for name, prop in self._get_all_dbus_properties():
922
650
            if (interface_name
923
651
                and interface_name != prop._dbus_interface):
924
652
                # Interface non-empty but did not match
928
656
                continue
929
657
            value = prop()
930
658
            if not hasattr(value, "variant_level"):
931
 
                properties[name] = value
 
659
                all[name] = value
932
660
                continue
933
 
            properties[name] = type(value)(value, variant_level=
934
 
                                           value.variant_level+1)
935
 
        return dbus.Dictionary(properties, signature="sv")
 
661
            all[name] = type(value)(value, variant_level=
 
662
                                    value.variant_level+1)
 
663
        return dbus.Dictionary(all, signature="sv")
936
664
    
937
665
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
938
666
                         out_signature="s",
939
667
                         path_keyword='object_path',
940
668
                         connection_keyword='connection')
941
669
    def Introspect(self, object_path, connection):
942
 
        """Overloading of standard D-Bus method.
943
 
        
944
 
        Inserts property tags and interface annotation tags.
 
670
        """Standard D-Bus method, overloaded to insert property tags.
945
671
        """
946
672
        xmlstring = dbus.service.Object.Introspect(self, object_path,
947
673
                                                   connection)
954
680
                e.setAttribute("access", prop._dbus_access)
955
681
                return e
956
682
            for if_tag in document.getElementsByTagName("interface"):
957
 
                # Add property tags
958
683
                for tag in (make_tag(document, name, prop)
959
684
                            for name, prop
960
 
                            in self._get_all_dbus_things("property")
 
685
                            in self._get_all_dbus_properties()
961
686
                            if prop._dbus_interface
962
687
                            == if_tag.getAttribute("name")):
963
688
                    if_tag.appendChild(tag)
964
 
                # Add annotation tags
965
 
                for typ in ("method", "signal", "property"):
966
 
                    for tag in if_tag.getElementsByTagName(typ):
967
 
                        annots = dict()
968
 
                        for name, prop in (self.
969
 
                                           _get_all_dbus_things(typ)):
970
 
                            if (name == tag.getAttribute("name")
971
 
                                and prop._dbus_interface
972
 
                                == if_tag.getAttribute("name")):
973
 
                                annots.update(getattr
974
 
                                              (prop,
975
 
                                               "_dbus_annotations",
976
 
                                               {}))
977
 
                        for name, value in annots.iteritems():
978
 
                            ann_tag = document.createElement(
979
 
                                "annotation")
980
 
                            ann_tag.setAttribute("name", name)
981
 
                            ann_tag.setAttribute("value", value)
982
 
                            tag.appendChild(ann_tag)
983
 
                # Add interface annotation tags
984
 
                for annotation, value in dict(
985
 
                    itertools.chain.from_iterable(
986
 
                        annotations().iteritems()
987
 
                        for name, annotations in
988
 
                        self._get_all_dbus_things("interface")
989
 
                        if name == if_tag.getAttribute("name")
990
 
                        )).iteritems():
991
 
                    ann_tag = document.createElement("annotation")
992
 
                    ann_tag.setAttribute("name", annotation)
993
 
                    ann_tag.setAttribute("value", value)
994
 
                    if_tag.appendChild(ann_tag)
995
689
                # Add the names to the return values for the
996
690
                # "org.freedesktop.DBus.Properties" methods
997
691
                if (if_tag.getAttribute("name")
1010
704
            xmlstring = document.toxml("utf-8")
1011
705
            document.unlink()
1012
706
        except (AttributeError, xml.dom.DOMException,
1013
 
                xml.parsers.expat.ExpatError) as error:
 
707
                xml.parsers.expat.ExpatError), error:
1014
708
            logger.error("Failed to override Introspection method",
1015
 
                         exc_info=error)
 
709
                         error)
1016
710
        return xmlstring
1017
711
 
1018
712
 
1019
 
def datetime_to_dbus(dt, variant_level=0):
1020
 
    """Convert a UTC datetime.datetime() to a D-Bus type."""
1021
 
    if dt is None:
1022
 
        return dbus.String("", variant_level = variant_level)
1023
 
    return dbus.String(dt.isoformat(),
1024
 
                       variant_level=variant_level)
1025
 
 
1026
 
 
1027
 
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
1028
 
    """A class decorator; applied to a subclass of
1029
 
    dbus.service.Object, it will add alternate D-Bus attributes with
1030
 
    interface names according to the "alt_interface_names" mapping.
1031
 
    Usage:
1032
 
    
1033
 
    @alternate_dbus_interfaces({"org.example.Interface":
1034
 
                                    "net.example.AlternateInterface"})
1035
 
    class SampleDBusObject(dbus.service.Object):
1036
 
        @dbus.service.method("org.example.Interface")
1037
 
        def SampleDBusMethod():
1038
 
            pass
1039
 
    
1040
 
    The above "SampleDBusMethod" on "SampleDBusObject" will be
1041
 
    reachable via two interfaces: "org.example.Interface" and
1042
 
    "net.example.AlternateInterface", the latter of which will have
1043
 
    its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
1044
 
    "true", unless "deprecate" is passed with a False value.
1045
 
    
1046
 
    This works for methods and signals, and also for D-Bus properties
1047
 
    (from DBusObjectWithProperties) and interfaces (from the
1048
 
    dbus_interface_annotations decorator).
1049
 
    """
1050
 
    def wrapper(cls):
1051
 
        for orig_interface_name, alt_interface_name in (
1052
 
            alt_interface_names.iteritems()):
1053
 
            attr = {}
1054
 
            interface_names = set()
1055
 
            # Go though all attributes of the class
1056
 
            for attrname, attribute in inspect.getmembers(cls):
1057
 
                # Ignore non-D-Bus attributes, and D-Bus attributes
1058
 
                # with the wrong interface name
1059
 
                if (not hasattr(attribute, "_dbus_interface")
1060
 
                    or not attribute._dbus_interface
1061
 
                    .startswith(orig_interface_name)):
1062
 
                    continue
1063
 
                # Create an alternate D-Bus interface name based on
1064
 
                # the current name
1065
 
                alt_interface = (attribute._dbus_interface
1066
 
                                 .replace(orig_interface_name,
1067
 
                                          alt_interface_name))
1068
 
                interface_names.add(alt_interface)
1069
 
                # Is this a D-Bus signal?
1070
 
                if getattr(attribute, "_dbus_is_signal", False):
1071
 
                    # Extract the original non-method function by
1072
 
                    # black magic
1073
 
                    nonmethod_func = (dict(
1074
 
                            zip(attribute.func_code.co_freevars,
1075
 
                                attribute.__closure__))["func"]
1076
 
                                      .cell_contents)
1077
 
                    # Create a new, but exactly alike, function
1078
 
                    # object, and decorate it to be a new D-Bus signal
1079
 
                    # with the alternate D-Bus interface name
1080
 
                    new_function = (dbus.service.signal
1081
 
                                    (alt_interface,
1082
 
                                     attribute._dbus_signature)
1083
 
                                    (types.FunctionType(
1084
 
                                nonmethod_func.func_code,
1085
 
                                nonmethod_func.func_globals,
1086
 
                                nonmethod_func.func_name,
1087
 
                                nonmethod_func.func_defaults,
1088
 
                                nonmethod_func.func_closure)))
1089
 
                    # Copy annotations, if any
1090
 
                    try:
1091
 
                        new_function._dbus_annotations = (
1092
 
                            dict(attribute._dbus_annotations))
1093
 
                    except AttributeError:
1094
 
                        pass
1095
 
                    # Define a creator of a function to call both the
1096
 
                    # original and alternate functions, so both the
1097
 
                    # original and alternate signals gets sent when
1098
 
                    # the function is called
1099
 
                    def fixscope(func1, func2):
1100
 
                        """This function is a scope container to pass
1101
 
                        func1 and func2 to the "call_both" function
1102
 
                        outside of its arguments"""
1103
 
                        def call_both(*args, **kwargs):
1104
 
                            """This function will emit two D-Bus
1105
 
                            signals by calling func1 and func2"""
1106
 
                            func1(*args, **kwargs)
1107
 
                            func2(*args, **kwargs)
1108
 
                        return call_both
1109
 
                    # Create the "call_both" function and add it to
1110
 
                    # the class
1111
 
                    attr[attrname] = fixscope(attribute, new_function)
1112
 
                # Is this a D-Bus method?
1113
 
                elif getattr(attribute, "_dbus_is_method", False):
1114
 
                    # Create a new, but exactly alike, function
1115
 
                    # object.  Decorate it to be a new D-Bus method
1116
 
                    # with the alternate D-Bus interface name.  Add it
1117
 
                    # to the class.
1118
 
                    attr[attrname] = (dbus.service.method
1119
 
                                      (alt_interface,
1120
 
                                       attribute._dbus_in_signature,
1121
 
                                       attribute._dbus_out_signature)
1122
 
                                      (types.FunctionType
1123
 
                                       (attribute.func_code,
1124
 
                                        attribute.func_globals,
1125
 
                                        attribute.func_name,
1126
 
                                        attribute.func_defaults,
1127
 
                                        attribute.func_closure)))
1128
 
                    # Copy annotations, if any
1129
 
                    try:
1130
 
                        attr[attrname]._dbus_annotations = (
1131
 
                            dict(attribute._dbus_annotations))
1132
 
                    except AttributeError:
1133
 
                        pass
1134
 
                # Is this a D-Bus property?
1135
 
                elif getattr(attribute, "_dbus_is_property", False):
1136
 
                    # Create a new, but exactly alike, function
1137
 
                    # object, and decorate it to be a new D-Bus
1138
 
                    # property with the alternate D-Bus interface
1139
 
                    # name.  Add it to the class.
1140
 
                    attr[attrname] = (dbus_service_property
1141
 
                                      (alt_interface,
1142
 
                                       attribute._dbus_signature,
1143
 
                                       attribute._dbus_access,
1144
 
                                       attribute
1145
 
                                       ._dbus_get_args_options
1146
 
                                       ["byte_arrays"])
1147
 
                                      (types.FunctionType
1148
 
                                       (attribute.func_code,
1149
 
                                        attribute.func_globals,
1150
 
                                        attribute.func_name,
1151
 
                                        attribute.func_defaults,
1152
 
                                        attribute.func_closure)))
1153
 
                    # Copy annotations, if any
1154
 
                    try:
1155
 
                        attr[attrname]._dbus_annotations = (
1156
 
                            dict(attribute._dbus_annotations))
1157
 
                    except AttributeError:
1158
 
                        pass
1159
 
                # Is this a D-Bus interface?
1160
 
                elif getattr(attribute, "_dbus_is_interface", False):
1161
 
                    # Create a new, but exactly alike, function
1162
 
                    # object.  Decorate it to be a new D-Bus interface
1163
 
                    # with the alternate D-Bus interface name.  Add it
1164
 
                    # to the class.
1165
 
                    attr[attrname] = (dbus_interface_annotations
1166
 
                                      (alt_interface)
1167
 
                                      (types.FunctionType
1168
 
                                       (attribute.func_code,
1169
 
                                        attribute.func_globals,
1170
 
                                        attribute.func_name,
1171
 
                                        attribute.func_defaults,
1172
 
                                        attribute.func_closure)))
1173
 
            if deprecate:
1174
 
                # Deprecate all alternate interfaces
1175
 
                iname="_AlternateDBusNames_interface_annotation{0}"
1176
 
                for interface_name in interface_names:
1177
 
                    @dbus_interface_annotations(interface_name)
1178
 
                    def func(self):
1179
 
                        return { "org.freedesktop.DBus.Deprecated":
1180
 
                                     "true" }
1181
 
                    # Find an unused name
1182
 
                    for aname in (iname.format(i)
1183
 
                                  for i in itertools.count()):
1184
 
                        if aname not in attr:
1185
 
                            attr[aname] = func
1186
 
                            break
1187
 
            if interface_names:
1188
 
                # Replace the class with a new subclass of it with
1189
 
                # methods, signals, etc. as created above.
1190
 
                cls = type(b"{0}Alternate".format(cls.__name__),
1191
 
                           (cls,), attr)
1192
 
        return cls
1193
 
    return wrapper
1194
 
 
1195
 
 
1196
 
@alternate_dbus_interfaces({"se.recompile.Mandos":
1197
 
                                "se.bsnet.fukt.Mandos"})
1198
713
class ClientDBus(Client, DBusObjectWithProperties):
1199
714
    """A Client class using D-Bus
1200
715
    
1209
724
    # dbus.service.Object doesn't use super(), so we can't either.
1210
725
    
1211
726
    def __init__(self, bus = None, *args, **kwargs):
 
727
        self._approvals_pending = 0
1212
728
        self.bus = bus
1213
729
        Client.__init__(self, *args, **kwargs)
1214
730
        # Only now, when this client is initialized, can it show up on
1220
736
                                 ("/clients/" + client_object_name))
1221
737
        DBusObjectWithProperties.__init__(self, self.bus,
1222
738
                                          self.dbus_object_path)
1223
 
    
1224
 
    def notifychangeproperty(transform_func,
1225
 
                             dbus_name, type_func=lambda x: x,
1226
 
                             variant_level=1):
1227
 
        """ Modify a variable so that it's a property which announces
1228
 
        its changes to DBus.
1229
 
        
1230
 
        transform_fun: Function that takes a value and a variant_level
1231
 
                       and transforms it to a D-Bus type.
1232
 
        dbus_name: D-Bus name of the variable
1233
 
        type_func: Function that transform the value before sending it
1234
 
                   to the D-Bus.  Default: no transform
1235
 
        variant_level: D-Bus variant level.  Default: 1
1236
 
        """
1237
 
        attrname = "_{0}".format(dbus_name)
1238
 
        def setter(self, value):
1239
 
            if hasattr(self, "dbus_object_path"):
1240
 
                if (not hasattr(self, attrname) or
1241
 
                    type_func(getattr(self, attrname, None))
1242
 
                    != type_func(value)):
1243
 
                    dbus_value = transform_func(type_func(value),
1244
 
                                                variant_level
1245
 
                                                =variant_level)
1246
 
                    self.PropertyChanged(dbus.String(dbus_name),
1247
 
                                         dbus_value)
1248
 
            setattr(self, attrname, value)
1249
 
        
1250
 
        return property(lambda self: getattr(self, attrname), setter)
1251
 
    
1252
 
    expires = notifychangeproperty(datetime_to_dbus, "Expires")
1253
 
    approvals_pending = notifychangeproperty(dbus.Boolean,
1254
 
                                             "ApprovalPending",
1255
 
                                             type_func = bool)
1256
 
    enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1257
 
    last_enabled = notifychangeproperty(datetime_to_dbus,
1258
 
                                        "LastEnabled")
1259
 
    checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",
1260
 
                                   type_func = lambda checker:
1261
 
                                       checker is not None)
1262
 
    last_checked_ok = notifychangeproperty(datetime_to_dbus,
1263
 
                                           "LastCheckedOK")
1264
 
    last_checker_status = notifychangeproperty(dbus.Int16,
1265
 
                                               "LastCheckerStatus")
1266
 
    last_approval_request = notifychangeproperty(
1267
 
        datetime_to_dbus, "LastApprovalRequest")
1268
 
    approved_by_default = notifychangeproperty(dbus.Boolean,
1269
 
                                               "ApprovedByDefault")
1270
 
    approval_delay = notifychangeproperty(dbus.UInt64,
1271
 
                                          "ApprovalDelay",
1272
 
                                          type_func =
1273
 
                                          timedelta_to_milliseconds)
1274
 
    approval_duration = notifychangeproperty(
1275
 
        dbus.UInt64, "ApprovalDuration",
1276
 
        type_func = timedelta_to_milliseconds)
1277
 
    host = notifychangeproperty(dbus.String, "Host")
1278
 
    timeout = notifychangeproperty(dbus.UInt64, "Timeout",
1279
 
                                   type_func =
1280
 
                                   timedelta_to_milliseconds)
1281
 
    extended_timeout = notifychangeproperty(
1282
 
        dbus.UInt64, "ExtendedTimeout",
1283
 
        type_func = timedelta_to_milliseconds)
1284
 
    interval = notifychangeproperty(dbus.UInt64,
1285
 
                                    "Interval",
1286
 
                                    type_func =
1287
 
                                    timedelta_to_milliseconds)
1288
 
    checker_command = notifychangeproperty(dbus.String, "Checker")
1289
 
    
1290
 
    del notifychangeproperty
 
739
        
 
740
    def _get_approvals_pending(self):
 
741
        return self._approvals_pending
 
742
    def _set_approvals_pending(self, value):
 
743
        old_value = self._approvals_pending
 
744
        self._approvals_pending = value
 
745
        bval = bool(value)
 
746
        if (hasattr(self, "dbus_object_path")
 
747
            and bval is not bool(old_value)):
 
748
            dbus_bool = dbus.Boolean(bval, variant_level=1)
 
749
            self.PropertyChanged(dbus.String("ApprovalPending"),
 
750
                                 dbus_bool)
 
751
 
 
752
    approvals_pending = property(_get_approvals_pending,
 
753
                                 _set_approvals_pending)
 
754
    del _get_approvals_pending, _set_approvals_pending
 
755
    
 
756
    @staticmethod
 
757
    def _datetime_to_dbus(dt, variant_level=0):
 
758
        """Convert a UTC datetime.datetime() to a D-Bus type."""
 
759
        return dbus.String(dt.isoformat(),
 
760
                           variant_level=variant_level)
 
761
    
 
762
    def enable(self):
 
763
        oldstate = getattr(self, "enabled", False)
 
764
        r = Client.enable(self)
 
765
        if oldstate != self.enabled:
 
766
            # Emit D-Bus signals
 
767
            self.PropertyChanged(dbus.String("Enabled"),
 
768
                                 dbus.Boolean(True, variant_level=1))
 
769
            self.PropertyChanged(
 
770
                dbus.String("LastEnabled"),
 
771
                self._datetime_to_dbus(self.last_enabled,
 
772
                                       variant_level=1))
 
773
        return r
 
774
    
 
775
    def disable(self, quiet = False):
 
776
        oldstate = getattr(self, "enabled", False)
 
777
        r = Client.disable(self, quiet=quiet)
 
778
        if not quiet and oldstate != self.enabled:
 
779
            # Emit D-Bus signal
 
780
            self.PropertyChanged(dbus.String("Enabled"),
 
781
                                 dbus.Boolean(False, variant_level=1))
 
782
        return r
1291
783
    
1292
784
    def __del__(self, *args, **kwargs):
1293
785
        try:
1302
794
                         *args, **kwargs):
1303
795
        self.checker_callback_tag = None
1304
796
        self.checker = None
 
797
        # Emit D-Bus signal
 
798
        self.PropertyChanged(dbus.String("CheckerRunning"),
 
799
                             dbus.Boolean(False, variant_level=1))
1305
800
        if os.WIFEXITED(condition):
1306
801
            exitstatus = os.WEXITSTATUS(condition)
1307
802
            # Emit D-Bus signal
1317
812
        return Client.checker_callback(self, pid, condition, command,
1318
813
                                       *args, **kwargs)
1319
814
    
 
815
    def checked_ok(self, *args, **kwargs):
 
816
        r = Client.checked_ok(self, *args, **kwargs)
 
817
        # Emit D-Bus signal
 
818
        self.PropertyChanged(
 
819
            dbus.String("LastCheckedOK"),
 
820
            (self._datetime_to_dbus(self.last_checked_ok,
 
821
                                    variant_level=1)))
 
822
        return r
 
823
    
 
824
    def need_approval(self, *args, **kwargs):
 
825
        r = Client.need_approval(self, *args, **kwargs)
 
826
        # Emit D-Bus signal
 
827
        self.PropertyChanged(
 
828
            dbus.String("LastApprovalRequest"),
 
829
            (self._datetime_to_dbus(self.last_approval_request,
 
830
                                    variant_level=1)))
 
831
        return r
 
832
    
1320
833
    def start_checker(self, *args, **kwargs):
1321
834
        old_checker = self.checker
1322
835
        if self.checker is not None:
1329
842
            and old_checker_pid != self.checker.pid):
1330
843
            # Emit D-Bus signal
1331
844
            self.CheckerStarted(self.current_checker_command)
 
845
            self.PropertyChanged(
 
846
                dbus.String("CheckerRunning"),
 
847
                dbus.Boolean(True, variant_level=1))
1332
848
        return r
1333
849
    
 
850
    def stop_checker(self, *args, **kwargs):
 
851
        old_checker = getattr(self, "checker", None)
 
852
        r = Client.stop_checker(self, *args, **kwargs)
 
853
        if (old_checker is not None
 
854
            and getattr(self, "checker", None) is None):
 
855
            self.PropertyChanged(dbus.String("CheckerRunning"),
 
856
                                 dbus.Boolean(False, variant_level=1))
 
857
        return r
 
858
 
1334
859
    def _reset_approved(self):
1335
 
        self.approved = None
 
860
        self._approved = None
1336
861
        return False
1337
862
    
1338
863
    def approve(self, value=True):
1339
 
        self.approved = value
1340
 
        gobject.timeout_add(timedelta_to_milliseconds
 
864
        self.send_changedstate()
 
865
        self._approved = value
 
866
        gobject.timeout_add(self._timedelta_to_milliseconds
1341
867
                            (self.approval_duration),
1342
868
                            self._reset_approved)
1343
 
        self.send_changedstate()
 
869
    
1344
870
    
1345
871
    ## D-Bus methods, signals & properties
1346
 
    _interface = "se.recompile.Mandos.Client"
1347
 
    
1348
 
    ## Interfaces
1349
 
    
1350
 
    @dbus_interface_annotations(_interface)
1351
 
    def _foo(self):
1352
 
        return { "org.freedesktop.DBus.Property.EmitsChangedSignal":
1353
 
                     "false"}
 
872
    _interface = "se.bsnet.fukt.Mandos.Client"
1354
873
    
1355
874
    ## Signals
1356
875
    
1403
922
    # CheckedOK - method
1404
923
    @dbus.service.method(_interface)
1405
924
    def CheckedOK(self):
1406
 
        self.checked_ok()
 
925
        return self.checked_ok()
1407
926
    
1408
927
    # Enable - method
1409
928
    @dbus.service.method(_interface)
1442
961
        if value is None:       # get
1443
962
            return dbus.Boolean(self.approved_by_default)
1444
963
        self.approved_by_default = bool(value)
 
964
        # Emit D-Bus signal
 
965
        self.PropertyChanged(dbus.String("ApprovedByDefault"),
 
966
                             dbus.Boolean(value, variant_level=1))
1445
967
    
1446
968
    # ApprovalDelay - property
1447
969
    @dbus_service_property(_interface, signature="t",
1450
972
        if value is None:       # get
1451
973
            return dbus.UInt64(self.approval_delay_milliseconds())
1452
974
        self.approval_delay = datetime.timedelta(0, 0, 0, value)
 
975
        # Emit D-Bus signal
 
976
        self.PropertyChanged(dbus.String("ApprovalDelay"),
 
977
                             dbus.UInt64(value, variant_level=1))
1453
978
    
1454
979
    # ApprovalDuration - property
1455
980
    @dbus_service_property(_interface, signature="t",
1456
981
                           access="readwrite")
1457
982
    def ApprovalDuration_dbus_property(self, value=None):
1458
983
        if value is None:       # get
1459
 
            return dbus.UInt64(timedelta_to_milliseconds(
 
984
            return dbus.UInt64(self._timedelta_to_milliseconds(
1460
985
                    self.approval_duration))
1461
986
        self.approval_duration = datetime.timedelta(0, 0, 0, value)
 
987
        # Emit D-Bus signal
 
988
        self.PropertyChanged(dbus.String("ApprovalDuration"),
 
989
                             dbus.UInt64(value, variant_level=1))
1462
990
    
1463
991
    # Name - property
1464
992
    @dbus_service_property(_interface, signature="s", access="read")
1476
1004
    def Host_dbus_property(self, value=None):
1477
1005
        if value is None:       # get
1478
1006
            return dbus.String(self.host)
1479
 
        self.host = unicode(value)
 
1007
        self.host = value
 
1008
        # Emit D-Bus signal
 
1009
        self.PropertyChanged(dbus.String("Host"),
 
1010
                             dbus.String(value, variant_level=1))
1480
1011
    
1481
1012
    # Created - property
1482
1013
    @dbus_service_property(_interface, signature="s", access="read")
1483
1014
    def Created_dbus_property(self):
1484
 
        return datetime_to_dbus(self.created)
 
1015
        return dbus.String(self._datetime_to_dbus(self.created))
1485
1016
    
1486
1017
    # LastEnabled - property
1487
1018
    @dbus_service_property(_interface, signature="s", access="read")
1488
1019
    def LastEnabled_dbus_property(self):
1489
 
        return datetime_to_dbus(self.last_enabled)
 
1020
        if self.last_enabled is None:
 
1021
            return dbus.String("")
 
1022
        return dbus.String(self._datetime_to_dbus(self.last_enabled))
1490
1023
    
1491
1024
    # Enabled - property
1492
1025
    @dbus_service_property(_interface, signature="b",
1506
1039
        if value is not None:
1507
1040
            self.checked_ok()
1508
1041
            return
1509
 
        return datetime_to_dbus(self.last_checked_ok)
1510
 
    
1511
 
    # LastCheckerStatus - property
1512
 
    @dbus_service_property(_interface, signature="n",
1513
 
                           access="read")
1514
 
    def LastCheckerStatus_dbus_property(self):
1515
 
        return dbus.Int16(self.last_checker_status)
1516
 
    
1517
 
    # Expires - property
1518
 
    @dbus_service_property(_interface, signature="s", access="read")
1519
 
    def Expires_dbus_property(self):
1520
 
        return datetime_to_dbus(self.expires)
 
1042
        if self.last_checked_ok is None:
 
1043
            return dbus.String("")
 
1044
        return dbus.String(self._datetime_to_dbus(self
 
1045
                                                  .last_checked_ok))
1521
1046
    
1522
1047
    # LastApprovalRequest - property
1523
1048
    @dbus_service_property(_interface, signature="s", access="read")
1524
1049
    def LastApprovalRequest_dbus_property(self):
1525
 
        return datetime_to_dbus(self.last_approval_request)
 
1050
        if self.last_approval_request is None:
 
1051
            return dbus.String("")
 
1052
        return dbus.String(self.
 
1053
                           _datetime_to_dbus(self
 
1054
                                             .last_approval_request))
1526
1055
    
1527
1056
    # Timeout - property
1528
1057
    @dbus_service_property(_interface, signature="t",
1530
1059
    def Timeout_dbus_property(self, value=None):
1531
1060
        if value is None:       # get
1532
1061
            return dbus.UInt64(self.timeout_milliseconds())
1533
 
        old_timeout = self.timeout
1534
1062
        self.timeout = datetime.timedelta(0, 0, 0, value)
1535
 
        # Reschedule disabling
1536
 
        if self.enabled:
1537
 
            now = datetime.datetime.utcnow()
1538
 
            self.expires += self.timeout - old_timeout
1539
 
            if self.expires <= now:
1540
 
                # The timeout has passed
1541
 
                self.disable()
1542
 
            else:
1543
 
                if (getattr(self, "disable_initiator_tag", None)
1544
 
                    is None):
1545
 
                    return
1546
 
                gobject.source_remove(self.disable_initiator_tag)
1547
 
                self.disable_initiator_tag = (
1548
 
                    gobject.timeout_add(
1549
 
                        timedelta_to_milliseconds(self.expires - now),
1550
 
                        self.disable))
1551
 
    
1552
 
    # ExtendedTimeout - property
1553
 
    @dbus_service_property(_interface, signature="t",
1554
 
                           access="readwrite")
1555
 
    def ExtendedTimeout_dbus_property(self, value=None):
1556
 
        if value is None:       # get
1557
 
            return dbus.UInt64(self.extended_timeout_milliseconds())
1558
 
        self.extended_timeout = datetime.timedelta(0, 0, 0, value)
 
1063
        # Emit D-Bus signal
 
1064
        self.PropertyChanged(dbus.String("Timeout"),
 
1065
                             dbus.UInt64(value, variant_level=1))
 
1066
        if getattr(self, "disable_initiator_tag", None) is None:
 
1067
            return
 
1068
        # Reschedule timeout
 
1069
        gobject.source_remove(self.disable_initiator_tag)
 
1070
        self.disable_initiator_tag = None
 
1071
        time_to_die = (self.
 
1072
                       _timedelta_to_milliseconds((self
 
1073
                                                   .last_checked_ok
 
1074
                                                   + self.timeout)
 
1075
                                                  - datetime.datetime
 
1076
                                                  .utcnow()))
 
1077
        if time_to_die <= 0:
 
1078
            # The timeout has passed
 
1079
            self.disable()
 
1080
        else:
 
1081
            self.disable_initiator_tag = (gobject.timeout_add
 
1082
                                          (time_to_die, self.disable))
1559
1083
    
1560
1084
    # Interval - property
1561
1085
    @dbus_service_property(_interface, signature="t",
1564
1088
        if value is None:       # get
1565
1089
            return dbus.UInt64(self.interval_milliseconds())
1566
1090
        self.interval = datetime.timedelta(0, 0, 0, value)
 
1091
        # Emit D-Bus signal
 
1092
        self.PropertyChanged(dbus.String("Interval"),
 
1093
                             dbus.UInt64(value, variant_level=1))
1567
1094
        if getattr(self, "checker_initiator_tag", None) is None:
1568
1095
            return
1569
 
        if self.enabled:
1570
 
            # Reschedule checker run
1571
 
            gobject.source_remove(self.checker_initiator_tag)
1572
 
            self.checker_initiator_tag = (gobject.timeout_add
1573
 
                                          (value, self.start_checker))
1574
 
            self.start_checker()    # Start one now, too
1575
 
    
 
1096
        # Reschedule checker run
 
1097
        gobject.source_remove(self.checker_initiator_tag)
 
1098
        self.checker_initiator_tag = (gobject.timeout_add
 
1099
                                      (value, self.start_checker))
 
1100
        self.start_checker()    # Start one now, too
 
1101
 
1576
1102
    # Checker - property
1577
1103
    @dbus_service_property(_interface, signature="s",
1578
1104
                           access="readwrite")
1579
1105
    def Checker_dbus_property(self, value=None):
1580
1106
        if value is None:       # get
1581
1107
            return dbus.String(self.checker_command)
1582
 
        self.checker_command = unicode(value)
 
1108
        self.checker_command = value
 
1109
        # Emit D-Bus signal
 
1110
        self.PropertyChanged(dbus.String("Checker"),
 
1111
                             dbus.String(self.checker_command,
 
1112
                                         variant_level=1))
1583
1113
    
1584
1114
    # CheckerRunning - property
1585
1115
    @dbus_service_property(_interface, signature="b",
1612
1142
        self._pipe.send(('init', fpr, address))
1613
1143
        if not self._pipe.recv():
1614
1144
            raise KeyError()
1615
 
    
 
1145
 
1616
1146
    def __getattribute__(self, name):
1617
 
        if name == '_pipe':
 
1147
        if(name == '_pipe'):
1618
1148
            return super(ProxyClient, self).__getattribute__(name)
1619
1149
        self._pipe.send(('getattr', name))
1620
1150
        data = self._pipe.recv()
1625
1155
                self._pipe.send(('funcall', name, args, kwargs))
1626
1156
                return self._pipe.recv()[1]
1627
1157
            return func
1628
 
    
 
1158
 
1629
1159
    def __setattr__(self, name, value):
1630
 
        if name == '_pipe':
 
1160
        if(name == '_pipe'):
1631
1161
            return super(ProxyClient, self).__setattr__(name, value)
1632
1162
        self._pipe.send(('setattr', name, value))
1633
1163
 
1644
1174
                        unicode(self.client_address))
1645
1175
            logger.debug("Pipe FD: %d",
1646
1176
                         self.server.child_pipe.fileno())
1647
 
            
 
1177
 
1648
1178
            session = (gnutls.connection
1649
1179
                       .ClientSession(self.request,
1650
1180
                                      gnutls.connection
1651
1181
                                      .X509Credentials()))
1652
 
            
 
1182
 
1653
1183
            # Note: gnutls.connection.X509Credentials is really a
1654
1184
            # generic GnuTLS certificate credentials object so long as
1655
1185
            # no X.509 keys are added to it.  Therefore, we can use it
1656
1186
            # here despite using OpenPGP certificates.
1657
 
            
 
1187
 
1658
1188
            #priority = ':'.join(("NONE", "+VERS-TLS1.1",
1659
1189
            #                      "+AES-256-CBC", "+SHA1",
1660
1190
            #                      "+COMP-NULL", "+CTYPE-OPENPGP",
1666
1196
            (gnutls.library.functions
1667
1197
             .gnutls_priority_set_direct(session._c_object,
1668
1198
                                         priority, None))
1669
 
            
 
1199
 
1670
1200
            # Start communication using the Mandos protocol
1671
1201
            # Get protocol number
1672
1202
            line = self.request.makefile().readline()
1674
1204
            try:
1675
1205
                if int(line.strip().split()[0]) > 1:
1676
1206
                    raise RuntimeError
1677
 
            except (ValueError, IndexError, RuntimeError) as error:
 
1207
            except (ValueError, IndexError, RuntimeError), error:
1678
1208
                logger.error("Unknown protocol version: %s", error)
1679
1209
                return
1680
 
            
 
1210
 
1681
1211
            # Start GnuTLS connection
1682
1212
            try:
1683
1213
                session.handshake()
1684
 
            except gnutls.errors.GNUTLSError as error:
 
1214
            except gnutls.errors.GNUTLSError, error:
1685
1215
                logger.warning("Handshake failed: %s", error)
1686
1216
                # Do not run session.bye() here: the session is not
1687
1217
                # established.  Just abandon the request.
1688
1218
                return
1689
1219
            logger.debug("Handshake succeeded")
1690
 
            
 
1220
 
1691
1221
            approval_required = False
1692
1222
            try:
1693
1223
                try:
1694
1224
                    fpr = self.fingerprint(self.peer_certificate
1695
1225
                                           (session))
1696
 
                except (TypeError,
1697
 
                        gnutls.errors.GNUTLSError) as error:
 
1226
                except (TypeError, gnutls.errors.GNUTLSError), error:
1698
1227
                    logger.warning("Bad certificate: %s", error)
1699
1228
                    return
1700
1229
                logger.debug("Fingerprint: %s", fpr)
1701
 
                
 
1230
 
1702
1231
                try:
1703
1232
                    client = ProxyClient(child_pipe, fpr,
1704
1233
                                         self.client_address)
1712
1241
                
1713
1242
                while True:
1714
1243
                    if not client.enabled:
1715
 
                        logger.info("Client %s is disabled",
 
1244
                        logger.warning("Client %s is disabled",
1716
1245
                                       client.name)
1717
1246
                        if self.server.use_dbus:
1718
1247
                            # Emit D-Bus signal
1719
 
                            client.Rejected("Disabled")
 
1248
                            client.Rejected("Disabled")                    
1720
1249
                        return
1721
1250
                    
1722
 
                    if client.approved or not client.approval_delay:
 
1251
                    if client._approved or not client.approval_delay:
1723
1252
                        #We are approved or approval is disabled
1724
1253
                        break
1725
 
                    elif client.approved is None:
 
1254
                    elif client._approved is None:
1726
1255
                        logger.info("Client %s needs approval",
1727
1256
                                    client.name)
1728
1257
                        if self.server.use_dbus:
1739
1268
                        return
1740
1269
                    
1741
1270
                    #wait until timeout or approved
 
1271
                    #x = float(client._timedelta_to_milliseconds(delay))
1742
1272
                    time = datetime.datetime.now()
1743
1273
                    client.changedstate.acquire()
1744
 
                    client.changedstate.wait(
1745
 
                        float(timedelta_to_milliseconds(delay)
1746
 
                              / 1000))
 
1274
                    client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))
1747
1275
                    client.changedstate.release()
1748
1276
                    time2 = datetime.datetime.now()
1749
1277
                    if (time2 - time) >= delay:
1764
1292
                while sent_size < len(client.secret):
1765
1293
                    try:
1766
1294
                        sent = session.send(client.secret[sent_size:])
1767
 
                    except gnutls.errors.GNUTLSError as error:
1768
 
                        logger.warning("gnutls send failed",
1769
 
                                       exc_info=error)
 
1295
                    except (gnutls.errors.GNUTLSError), error:
 
1296
                        logger.warning("gnutls send failed")
1770
1297
                        return
1771
1298
                    logger.debug("Sent: %d, remaining: %d",
1772
1299
                                 sent, len(client.secret)
1773
1300
                                 - (sent_size + sent))
1774
1301
                    sent_size += sent
1775
 
                
 
1302
 
1776
1303
                logger.info("Sending secret to %s", client.name)
1777
 
                # bump the timeout using extended_timeout
1778
 
                client.bump_timeout(client.extended_timeout)
 
1304
                # bump the timeout as if seen
 
1305
                client.checked_ok()
1779
1306
                if self.server.use_dbus:
1780
1307
                    # Emit D-Bus signal
1781
1308
                    client.GotSecret()
1785
1312
                    client.approvals_pending -= 1
1786
1313
                try:
1787
1314
                    session.bye()
1788
 
                except gnutls.errors.GNUTLSError as error:
1789
 
                    logger.warning("GnuTLS bye failed",
1790
 
                                   exc_info=error)
 
1315
                except (gnutls.errors.GNUTLSError), error:
 
1316
                    logger.warning("GnuTLS bye failed")
1791
1317
    
1792
1318
    @staticmethod
1793
1319
    def peer_certificate(session):
1849
1375
        # Convert the buffer to a Python bytestring
1850
1376
        fpr = ctypes.string_at(buf, buf_len.value)
1851
1377
        # Convert the bytestring to hexadecimal notation
1852
 
        hex_fpr = binascii.hexlify(fpr).upper()
 
1378
        hex_fpr = ''.join("%02X" % ord(char) for char in fpr)
1853
1379
        return hex_fpr
1854
1380
 
1855
1381
 
1858
1384
    def sub_process_main(self, request, address):
1859
1385
        try:
1860
1386
            self.finish_request(request, address)
1861
 
        except Exception:
 
1387
        except:
1862
1388
            self.handle_error(request, address)
1863
1389
        self.close_request(request)
1864
 
    
 
1390
            
1865
1391
    def process_request(self, request, address):
1866
1392
        """Start a new process to process the request."""
1867
 
        proc = multiprocessing.Process(target = self.sub_process_main,
1868
 
                                       args = (request, address))
1869
 
        proc.start()
1870
 
        return proc
1871
 
 
 
1393
        multiprocessing.Process(target = self.sub_process_main,
 
1394
                                args = (request, address)).start()
1872
1395
 
1873
1396
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
1874
1397
    """ adds a pipe to the MixIn """
1878
1401
        This function creates a new pipe in self.pipe
1879
1402
        """
1880
1403
        parent_pipe, self.child_pipe = multiprocessing.Pipe()
1881
 
        
1882
 
        proc = MultiprocessingMixIn.process_request(self, request,
1883
 
                                                    client_address)
 
1404
 
 
1405
        super(MultiprocessingMixInWithPipe,
 
1406
              self).process_request(request, client_address)
1884
1407
        self.child_pipe.close()
1885
 
        self.add_pipe(parent_pipe, proc)
1886
 
    
1887
 
    def add_pipe(self, parent_pipe, proc):
 
1408
        self.add_pipe(parent_pipe)
 
1409
 
 
1410
    def add_pipe(self, parent_pipe):
1888
1411
        """Dummy function; override as necessary"""
1889
1412
        raise NotImplementedError
1890
1413
 
1891
 
 
1892
1414
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
1893
1415
                     socketserver.TCPServer, object):
1894
1416
    """IPv6-capable TCP server.  Accepts 'None' as address and/or port
1899
1421
        use_ipv6:       Boolean; to use IPv6 or not
1900
1422
    """
1901
1423
    def __init__(self, server_address, RequestHandlerClass,
1902
 
                 interface=None, use_ipv6=True, socketfd=None):
1903
 
        """If socketfd is set, use that file descriptor instead of
1904
 
        creating a new one with socket.socket().
1905
 
        """
 
1424
                 interface=None, use_ipv6=True):
1906
1425
        self.interface = interface
1907
1426
        if use_ipv6:
1908
1427
            self.address_family = socket.AF_INET6
1909
 
        if socketfd is not None:
1910
 
            # Save the file descriptor
1911
 
            self.socketfd = socketfd
1912
 
            # Save the original socket.socket() function
1913
 
            self.socket_socket = socket.socket
1914
 
            # To implement --socket, we monkey patch socket.socket.
1915
 
            # 
1916
 
            # (When socketserver.TCPServer is a new-style class, we
1917
 
            # could make self.socket into a property instead of monkey
1918
 
            # patching socket.socket.)
1919
 
            # 
1920
 
            # Create a one-time-only replacement for socket.socket()
1921
 
            @functools.wraps(socket.socket)
1922
 
            def socket_wrapper(*args, **kwargs):
1923
 
                # Restore original function so subsequent calls are
1924
 
                # not affected.
1925
 
                socket.socket = self.socket_socket
1926
 
                del self.socket_socket
1927
 
                # This time only, return a new socket object from the
1928
 
                # saved file descriptor.
1929
 
                return socket.fromfd(self.socketfd, *args, **kwargs)
1930
 
            # Replace socket.socket() function with wrapper
1931
 
            socket.socket = socket_wrapper
1932
 
        # The socketserver.TCPServer.__init__ will call
1933
 
        # socket.socket(), which might be our replacement,
1934
 
        # socket_wrapper(), if socketfd was set.
1935
1428
        socketserver.TCPServer.__init__(self, server_address,
1936
1429
                                        RequestHandlerClass)
1937
 
    
1938
1430
    def server_bind(self):
1939
1431
        """This overrides the normal server_bind() function
1940
1432
        to bind to an interface if one was specified, and also NOT to
1950
1442
                                           SO_BINDTODEVICE,
1951
1443
                                           str(self.interface
1952
1444
                                               + '\0'))
1953
 
                except socket.error as error:
1954
 
                    if error.errno == errno.EPERM:
 
1445
                except socket.error, error:
 
1446
                    if error[0] == errno.EPERM:
1955
1447
                        logger.error("No permission to"
1956
1448
                                     " bind to interface %s",
1957
1449
                                     self.interface)
1958
 
                    elif error.errno == errno.ENOPROTOOPT:
 
1450
                    elif error[0] == errno.ENOPROTOOPT:
1959
1451
                        logger.error("SO_BINDTODEVICE not available;"
1960
1452
                                     " cannot bind to interface %s",
1961
1453
                                     self.interface)
1962
 
                    elif error.errno == errno.ENODEV:
1963
 
                        logger.error("Interface %s does not"
1964
 
                                     " exist, cannot bind",
1965
 
                                     self.interface)
1966
1454
                    else:
1967
1455
                        raise
1968
1456
        # Only bind(2) the socket if we really need to.
1998
1486
    """
1999
1487
    def __init__(self, server_address, RequestHandlerClass,
2000
1488
                 interface=None, use_ipv6=True, clients=None,
2001
 
                 gnutls_priority=None, use_dbus=True, socketfd=None):
 
1489
                 gnutls_priority=None, use_dbus=True):
2002
1490
        self.enabled = False
2003
1491
        self.clients = clients
2004
1492
        if self.clients is None:
2005
 
            self.clients = {}
 
1493
            self.clients = set()
2006
1494
        self.use_dbus = use_dbus
2007
1495
        self.gnutls_priority = gnutls_priority
2008
1496
        IPv6_TCPServer.__init__(self, server_address,
2009
1497
                                RequestHandlerClass,
2010
1498
                                interface = interface,
2011
 
                                use_ipv6 = use_ipv6,
2012
 
                                socketfd = socketfd)
 
1499
                                use_ipv6 = use_ipv6)
2013
1500
    def server_activate(self):
2014
1501
        if self.enabled:
2015
1502
            return socketserver.TCPServer.server_activate(self)
2016
 
    
2017
1503
    def enable(self):
2018
1504
        self.enabled = True
2019
 
    
2020
 
    def add_pipe(self, parent_pipe, proc):
 
1505
    def add_pipe(self, parent_pipe):
2021
1506
        # Call "handle_ipc" for both data and EOF events
2022
1507
        gobject.io_add_watch(parent_pipe.fileno(),
2023
1508
                             gobject.IO_IN | gobject.IO_HUP,
2024
1509
                             functools.partial(self.handle_ipc,
2025
 
                                               parent_pipe =
2026
 
                                               parent_pipe,
2027
 
                                               proc = proc))
2028
 
    
 
1510
                                               parent_pipe = parent_pipe))
 
1511
        
2029
1512
    def handle_ipc(self, source, condition, parent_pipe=None,
2030
 
                   proc = None, client_object=None):
2031
 
        # error, or the other end of multiprocessing.Pipe has closed
2032
 
        if condition & (gobject.IO_ERR | gobject.IO_HUP):
2033
 
            # Wait for other process to exit
2034
 
            proc.join()
 
1513
                   client_object=None):
 
1514
        condition_names = {
 
1515
            gobject.IO_IN: "IN",   # There is data to read.
 
1516
            gobject.IO_OUT: "OUT", # Data can be written (without
 
1517
                                    # blocking).
 
1518
            gobject.IO_PRI: "PRI", # There is urgent data to read.
 
1519
            gobject.IO_ERR: "ERR", # Error condition.
 
1520
            gobject.IO_HUP: "HUP"  # Hung up (the connection has been
 
1521
                                    # broken, usually for pipes and
 
1522
                                    # sockets).
 
1523
            }
 
1524
        conditions_string = ' | '.join(name
 
1525
                                       for cond, name in
 
1526
                                       condition_names.iteritems()
 
1527
                                       if cond & condition)
 
1528
        # error or the other end of multiprocessing.Pipe has closed
 
1529
        if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):
2035
1530
            return False
2036
1531
        
2037
1532
        # Read a request from the child
2042
1537
            fpr = request[1]
2043
1538
            address = request[2]
2044
1539
            
2045
 
            for c in self.clients.itervalues():
 
1540
            for c in self.clients:
2046
1541
                if c.fingerprint == fpr:
2047
1542
                    client = c
2048
1543
                    break
2049
1544
            else:
2050
 
                logger.info("Client not found for fingerprint: %s, ad"
2051
 
                            "dress: %s", fpr, address)
 
1545
                logger.warning("Client not found for fingerprint: %s, ad"
 
1546
                               "dress: %s", fpr, address)
2052
1547
                if self.use_dbus:
2053
1548
                    # Emit D-Bus signal
2054
 
                    mandos_dbus_service.ClientNotFound(fpr,
2055
 
                                                       address[0])
 
1549
                    mandos_dbus_service.ClientNotFound(fpr, address[0])
2056
1550
                parent_pipe.send(False)
2057
1551
                return False
2058
1552
            
2059
1553
            gobject.io_add_watch(parent_pipe.fileno(),
2060
1554
                                 gobject.IO_IN | gobject.IO_HUP,
2061
1555
                                 functools.partial(self.handle_ipc,
2062
 
                                                   parent_pipe =
2063
 
                                                   parent_pipe,
2064
 
                                                   proc = proc,
2065
 
                                                   client_object =
2066
 
                                                   client))
 
1556
                                                   parent_pipe = parent_pipe,
 
1557
                                                   client_object = client))
2067
1558
            parent_pipe.send(True)
2068
 
            # remove the old hook in favor of the new above hook on
2069
 
            # same fileno
 
1559
            # remove the old hook in favor of the new above hook on same fileno
2070
1560
            return False
2071
1561
        if command == 'funcall':
2072
1562
            funcname = request[1]
2073
1563
            args = request[2]
2074
1564
            kwargs = request[3]
2075
1565
            
2076
 
            parent_pipe.send(('data', getattr(client_object,
2077
 
                                              funcname)(*args,
2078
 
                                                         **kwargs)))
2079
 
        
 
1566
            parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))
 
1567
 
2080
1568
        if command == 'getattr':
2081
1569
            attrname = request[1]
2082
1570
            if callable(client_object.__getattribute__(attrname)):
2083
1571
                parent_pipe.send(('function',))
2084
1572
            else:
2085
 
                parent_pipe.send(('data', client_object
2086
 
                                  .__getattribute__(attrname)))
 
1573
                parent_pipe.send(('data', client_object.__getattribute__(attrname)))
2087
1574
        
2088
1575
        if command == 'setattr':
2089
1576
            attrname = request[1]
2090
1577
            value = request[2]
2091
1578
            setattr(client_object, attrname, value)
2092
 
        
 
1579
 
2093
1580
        return True
2094
1581
 
2095
1582
 
2125
1612
            elif suffix == "w":
2126
1613
                delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
2127
1614
            else:
2128
 
                raise ValueError("Unknown suffix {0!r}"
2129
 
                                 .format(suffix))
2130
 
        except (ValueError, IndexError) as e:
 
1615
                raise ValueError("Unknown suffix %r" % suffix)
 
1616
        except (ValueError, IndexError), e:
2131
1617
            raise ValueError(*(e.args))
2132
1618
        timevalue += delta
2133
1619
    return timevalue
2134
1620
 
2135
1621
 
 
1622
def if_nametoindex(interface):
 
1623
    """Call the C function if_nametoindex(), or equivalent
 
1624
    
 
1625
    Note: This function cannot accept a unicode string."""
 
1626
    global if_nametoindex
 
1627
    try:
 
1628
        if_nametoindex = (ctypes.cdll.LoadLibrary
 
1629
                          (ctypes.util.find_library("c"))
 
1630
                          .if_nametoindex)
 
1631
    except (OSError, AttributeError):
 
1632
        logger.warning("Doing if_nametoindex the hard way")
 
1633
        def if_nametoindex(interface):
 
1634
            "Get an interface index the hard way, i.e. using fcntl()"
 
1635
            SIOCGIFINDEX = 0x8933  # From /usr/include/linux/sockios.h
 
1636
            with contextlib.closing(socket.socket()) as s:
 
1637
                ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
 
1638
                                    struct.pack(str("16s16x"),
 
1639
                                                interface))
 
1640
            interface_index = struct.unpack(str("I"),
 
1641
                                            ifreq[16:20])[0]
 
1642
            return interface_index
 
1643
    return if_nametoindex(interface)
 
1644
 
 
1645
 
2136
1646
def daemon(nochdir = False, noclose = False):
2137
1647
    """See daemon(3).  Standard BSD Unix function.
2138
1648
    
2146
1656
        sys.exit()
2147
1657
    if not noclose:
2148
1658
        # Close all standard open file descriptors
2149
 
        null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
 
1659
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
2150
1660
        if not stat.S_ISCHR(os.fstat(null).st_mode):
2151
1661
            raise OSError(errno.ENODEV,
2152
 
                          "{0} not a character device"
2153
 
                          .format(os.devnull))
 
1662
                          "%s not a character device"
 
1663
                          % os.path.devnull)
2154
1664
        os.dup2(null, sys.stdin.fileno())
2155
1665
        os.dup2(null, sys.stdout.fileno())
2156
1666
        os.dup2(null, sys.stderr.fileno())
2163
1673
    ##################################################################
2164
1674
    # Parsing of options, both command line and config file
2165
1675
    
2166
 
    parser = argparse.ArgumentParser()
2167
 
    parser.add_argument("-v", "--version", action="version",
2168
 
                        version = "%(prog)s {0}".format(version),
2169
 
                        help="show version number and exit")
2170
 
    parser.add_argument("-i", "--interface", metavar="IF",
2171
 
                        help="Bind to interface IF")
2172
 
    parser.add_argument("-a", "--address",
2173
 
                        help="Address to listen for requests on")
2174
 
    parser.add_argument("-p", "--port", type=int,
2175
 
                        help="Port number to receive requests on")
2176
 
    parser.add_argument("--check", action="store_true",
2177
 
                        help="Run self-test")
2178
 
    parser.add_argument("--debug", action="store_true",
2179
 
                        help="Debug mode; run in foreground and log"
2180
 
                        " to terminal")
2181
 
    parser.add_argument("--debuglevel", metavar="LEVEL",
2182
 
                        help="Debug level for stdout output")
2183
 
    parser.add_argument("--priority", help="GnuTLS"
2184
 
                        " priority string (see GnuTLS documentation)")
2185
 
    parser.add_argument("--servicename",
2186
 
                        metavar="NAME", help="Zeroconf service name")
2187
 
    parser.add_argument("--configdir",
2188
 
                        default="/etc/mandos", metavar="DIR",
2189
 
                        help="Directory to search for configuration"
2190
 
                        " files")
2191
 
    parser.add_argument("--no-dbus", action="store_false",
2192
 
                        dest="use_dbus", help="Do not provide D-Bus"
2193
 
                        " system bus interface")
2194
 
    parser.add_argument("--no-ipv6", action="store_false",
2195
 
                        dest="use_ipv6", help="Do not use IPv6")
2196
 
    parser.add_argument("--no-restore", action="store_false",
2197
 
                        dest="restore", help="Do not restore stored"
2198
 
                        " state")
2199
 
    parser.add_argument("--socket", type=int,
2200
 
                        help="Specify a file descriptor to a network"
2201
 
                        " socket to use instead of creating one")
2202
 
    parser.add_argument("--statedir", metavar="DIR",
2203
 
                        help="Directory to save/restore state in")
2204
 
    
2205
 
    options = parser.parse_args()
 
1676
    parser = optparse.OptionParser(version = "%%prog %s" % version)
 
1677
    parser.add_option("-i", "--interface", type="string",
 
1678
                      metavar="IF", help="Bind to interface IF")
 
1679
    parser.add_option("-a", "--address", type="string",
 
1680
                      help="Address to listen for requests on")
 
1681
    parser.add_option("-p", "--port", type="int",
 
1682
                      help="Port number to receive requests on")
 
1683
    parser.add_option("--check", action="store_true",
 
1684
                      help="Run self-test")
 
1685
    parser.add_option("--debug", action="store_true",
 
1686
                      help="Debug mode; run in foreground and log to"
 
1687
                      " terminal")
 
1688
    parser.add_option("--debuglevel", type="string", metavar="LEVEL",
 
1689
                      help="Debug level for stdout output")
 
1690
    parser.add_option("--priority", type="string", help="GnuTLS"
 
1691
                      " priority string (see GnuTLS documentation)")
 
1692
    parser.add_option("--servicename", type="string",
 
1693
                      metavar="NAME", help="Zeroconf service name")
 
1694
    parser.add_option("--configdir", type="string",
 
1695
                      default="/etc/mandos", metavar="DIR",
 
1696
                      help="Directory to search for configuration"
 
1697
                      " files")
 
1698
    parser.add_option("--no-dbus", action="store_false",
 
1699
                      dest="use_dbus", help="Do not provide D-Bus"
 
1700
                      " system bus interface")
 
1701
    parser.add_option("--no-ipv6", action="store_false",
 
1702
                      dest="use_ipv6", help="Do not use IPv6")
 
1703
    options = parser.parse_args()[0]
2206
1704
    
2207
1705
    if options.check:
2208
1706
        import doctest
2220
1718
                        "use_dbus": "True",
2221
1719
                        "use_ipv6": "True",
2222
1720
                        "debuglevel": "",
2223
 
                        "restore": "True",
2224
 
                        "socket": "",
2225
 
                        "statedir": "/var/lib/mandos"
2226
1721
                        }
2227
1722
    
2228
1723
    # Parse config file for server-global settings
2239
1734
    if server_settings["port"]:
2240
1735
        server_settings["port"] = server_config.getint("DEFAULT",
2241
1736
                                                       "port")
2242
 
    if server_settings["socket"]:
2243
 
        server_settings["socket"] = server_config.getint("DEFAULT",
2244
 
                                                         "socket")
2245
 
        # Later, stdin will, and stdout and stderr might, be dup'ed
2246
 
        # over with an opened os.devnull.  But we don't want this to
2247
 
        # happen with a supplied network socket.
2248
 
        if 0 <= server_settings["socket"] <= 2:
2249
 
            server_settings["socket"] = os.dup(server_settings
2250
 
                                               ["socket"])
2251
1737
    del server_config
2252
1738
    
2253
1739
    # Override the settings from the config file with command line
2254
1740
    # options, if set.
2255
1741
    for option in ("interface", "address", "port", "debug",
2256
1742
                   "priority", "servicename", "configdir",
2257
 
                   "use_dbus", "use_ipv6", "debuglevel", "restore",
2258
 
                   "statedir", "socket"):
 
1743
                   "use_dbus", "use_ipv6", "debuglevel"):
2259
1744
        value = getattr(options, option)
2260
1745
        if value is not None:
2261
1746
            server_settings[option] = value
2273
1758
    debuglevel = server_settings["debuglevel"]
2274
1759
    use_dbus = server_settings["use_dbus"]
2275
1760
    use_ipv6 = server_settings["use_ipv6"]
2276
 
    stored_state_path = os.path.join(server_settings["statedir"],
2277
 
                                     stored_state_file)
2278
 
    
2279
 
    if debug:
2280
 
        initlogger(debug, logging.DEBUG)
2281
 
    else:
2282
 
        if not debuglevel:
2283
 
            initlogger(debug)
2284
 
        else:
2285
 
            level = getattr(logging, debuglevel.upper())
2286
 
            initlogger(debug, level)
2287
 
    
 
1761
 
2288
1762
    if server_settings["servicename"] != "Mandos":
2289
1763
        syslogger.setFormatter(logging.Formatter
2290
 
                               ('Mandos ({0}) [%(process)d]:'
2291
 
                                ' %(levelname)s: %(message)s'
2292
 
                                .format(server_settings
2293
 
                                        ["servicename"])))
 
1764
                               ('Mandos (%s) [%%(process)d]:'
 
1765
                                ' %%(levelname)s: %%(message)s'
 
1766
                                % server_settings["servicename"]))
2294
1767
    
2295
1768
    # Parse config file with clients
2296
 
    client_config = configparser.SafeConfigParser(Client
2297
 
                                                  .client_defaults)
 
1769
    client_defaults = { "timeout": "1h",
 
1770
                        "interval": "5m",
 
1771
                        "checker": "fping -q -- %%(host)s",
 
1772
                        "host": "",
 
1773
                        "approval_delay": "0s",
 
1774
                        "approval_duration": "1s",
 
1775
                        }
 
1776
    client_config = configparser.SafeConfigParser(client_defaults)
2298
1777
    client_config.read(os.path.join(server_settings["configdir"],
2299
1778
                                    "clients.conf"))
2300
1779
    
2309
1788
                              use_ipv6=use_ipv6,
2310
1789
                              gnutls_priority=
2311
1790
                              server_settings["priority"],
2312
 
                              use_dbus=use_dbus,
2313
 
                              socketfd=(server_settings["socket"]
2314
 
                                        or None))
 
1791
                              use_dbus=use_dbus)
2315
1792
    if not debug:
2316
1793
        pidfilename = "/var/run/mandos.pid"
2317
1794
        try:
2318
1795
            pidfile = open(pidfilename, "w")
2319
 
        except IOError as e:
2320
 
            logger.error("Could not open file %r", pidfilename,
2321
 
                         exc_info=e)
 
1796
        except IOError:
 
1797
            logger.error("Could not open file %r", pidfilename)
2322
1798
    
2323
 
    for name in ("_mandos", "mandos", "nobody"):
 
1799
    try:
 
1800
        uid = pwd.getpwnam("_mandos").pw_uid
 
1801
        gid = pwd.getpwnam("_mandos").pw_gid
 
1802
    except KeyError:
2324
1803
        try:
2325
 
            uid = pwd.getpwnam(name).pw_uid
2326
 
            gid = pwd.getpwnam(name).pw_gid
2327
 
            break
 
1804
            uid = pwd.getpwnam("mandos").pw_uid
 
1805
            gid = pwd.getpwnam("mandos").pw_gid
2328
1806
        except KeyError:
2329
 
            continue
2330
 
    else:
2331
 
        uid = 65534
2332
 
        gid = 65534
 
1807
            try:
 
1808
                uid = pwd.getpwnam("nobody").pw_uid
 
1809
                gid = pwd.getpwnam("nobody").pw_gid
 
1810
            except KeyError:
 
1811
                uid = 65534
 
1812
                gid = 65534
2333
1813
    try:
2334
1814
        os.setgid(gid)
2335
1815
        os.setuid(uid)
2336
 
    except OSError as error:
2337
 
        if error.errno != errno.EPERM:
 
1816
    except OSError, error:
 
1817
        if error[0] != errno.EPERM:
2338
1818
            raise error
2339
1819
    
 
1820
    if not debug and not debuglevel:
 
1821
        syslogger.setLevel(logging.WARNING)
 
1822
        console.setLevel(logging.WARNING)
 
1823
    if debuglevel:
 
1824
        level = getattr(logging, debuglevel.upper())
 
1825
        syslogger.setLevel(level)
 
1826
        console.setLevel(level)
 
1827
 
2340
1828
    if debug:
2341
1829
        # Enable all possible GnuTLS debugging
2342
1830
        
2352
1840
         .gnutls_global_set_log_function(debug_gnutls))
2353
1841
        
2354
1842
        # Redirect stdin so all checkers get /dev/null
2355
 
        null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
 
1843
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
2356
1844
        os.dup2(null, sys.stdin.fileno())
2357
1845
        if null > 2:
2358
1846
            os.close(null)
 
1847
    else:
 
1848
        # No console logging
 
1849
        logger.removeHandler(console)
2359
1850
    
2360
1851
    # Need to fork before connecting to D-Bus
2361
1852
    if not debug:
2362
1853
        # Close all input and output, do double fork, etc.
2363
1854
        daemon()
2364
1855
    
2365
 
    # multiprocessing will use threads, so before we use gobject we
2366
 
    # need to inform gobject that threads will be used.
2367
 
    gobject.threads_init()
2368
 
    
2369
1856
    global main_loop
2370
1857
    # From the Avahi example code
2371
 
    DBusGMainLoop(set_as_default=True)
 
1858
    DBusGMainLoop(set_as_default=True )
2372
1859
    main_loop = gobject.MainLoop()
2373
1860
    bus = dbus.SystemBus()
2374
1861
    # End of Avahi example code
2375
1862
    if use_dbus:
2376
1863
        try:
2377
 
            bus_name = dbus.service.BusName("se.recompile.Mandos",
 
1864
            bus_name = dbus.service.BusName("se.bsnet.fukt.Mandos",
2378
1865
                                            bus, do_not_queue=True)
2379
 
            old_bus_name = (dbus.service.BusName
2380
 
                            ("se.bsnet.fukt.Mandos", bus,
2381
 
                             do_not_queue=True))
2382
 
        except dbus.exceptions.NameExistsException as e:
2383
 
            logger.error("Disabling D-Bus:", exc_info=e)
 
1866
        except dbus.exceptions.NameExistsException, e:
 
1867
            logger.error(unicode(e) + ", disabling D-Bus")
2384
1868
            use_dbus = False
2385
1869
            server_settings["use_dbus"] = False
2386
1870
            tcp_server.use_dbus = False
2387
1871
    protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2388
 
    service = AvahiServiceToSyslog(name =
2389
 
                                   server_settings["servicename"],
2390
 
                                   servicetype = "_mandos._tcp",
2391
 
                                   protocol = protocol, bus = bus)
 
1872
    service = AvahiService(name = server_settings["servicename"],
 
1873
                           servicetype = "_mandos._tcp",
 
1874
                           protocol = protocol, bus = bus)
2392
1875
    if server_settings["interface"]:
2393
1876
        service.interface = (if_nametoindex
2394
1877
                             (str(server_settings["interface"])))
2399
1882
    client_class = Client
2400
1883
    if use_dbus:
2401
1884
        client_class = functools.partial(ClientDBus, bus = bus)
2402
 
    
2403
 
    client_settings = Client.config_parser(client_config)
2404
 
    old_client_settings = {}
2405
 
    clients_data = {}
2406
 
    
2407
 
    # Get client data and settings from last running state.
2408
 
    if server_settings["restore"]:
2409
 
        try:
2410
 
            with open(stored_state_path, "rb") as stored_state:
2411
 
                clients_data, old_client_settings = (pickle.load
2412
 
                                                     (stored_state))
2413
 
            os.remove(stored_state_path)
2414
 
        except IOError as e:
2415
 
            if e.errno == errno.ENOENT:
2416
 
                logger.warning("Could not load persistent state: {0}"
2417
 
                                .format(os.strerror(e.errno)))
2418
 
            else:
2419
 
                logger.critical("Could not load persistent state:",
2420
 
                                exc_info=e)
2421
 
                raise
2422
 
        except EOFError as e:
2423
 
            logger.warning("Could not load persistent state: "
2424
 
                           "EOFError:", exc_info=e)
2425
 
    
2426
 
    with PGPEngine() as pgp:
2427
 
        for client_name, client in clients_data.iteritems():
2428
 
            # Decide which value to use after restoring saved state.
2429
 
            # We have three different values: Old config file,
2430
 
            # new config file, and saved state.
2431
 
            # New config value takes precedence if it differs from old
2432
 
            # config value, otherwise use saved state.
2433
 
            for name, value in client_settings[client_name].items():
2434
 
                try:
2435
 
                    # For each value in new config, check if it
2436
 
                    # differs from the old config value (Except for
2437
 
                    # the "secret" attribute)
2438
 
                    if (name != "secret" and
2439
 
                        value != old_client_settings[client_name]
2440
 
                        [name]):
2441
 
                        client[name] = value
2442
 
                except KeyError:
2443
 
                    pass
2444
 
            
2445
 
            # Clients who has passed its expire date can still be
2446
 
            # enabled if its last checker was successful.  Clients
2447
 
            # whose checker succeeded before we stored its state is
2448
 
            # assumed to have successfully run all checkers during
2449
 
            # downtime.
2450
 
            if client["enabled"]:
2451
 
                if datetime.datetime.utcnow() >= client["expires"]:
2452
 
                    if not client["last_checked_ok"]:
2453
 
                        logger.warning(
2454
 
                            "disabling client {0} - Client never "
2455
 
                            "performed a successful checker"
2456
 
                            .format(client_name))
2457
 
                        client["enabled"] = False
2458
 
                    elif client["last_checker_status"] != 0:
2459
 
                        logger.warning(
2460
 
                            "disabling client {0} - Client "
2461
 
                            "last checker failed with error code {1}"
2462
 
                            .format(client_name,
2463
 
                                    client["last_checker_status"]))
2464
 
                        client["enabled"] = False
2465
 
                    else:
2466
 
                        client["expires"] = (datetime.datetime
2467
 
                                             .utcnow()
2468
 
                                             + client["timeout"])
2469
 
                        logger.debug("Last checker succeeded,"
2470
 
                                     " keeping {0} enabled"
2471
 
                                     .format(client_name))
 
1885
    def client_config_items(config, section):
 
1886
        special_settings = {
 
1887
            "approved_by_default":
 
1888
                lambda: config.getboolean(section,
 
1889
                                          "approved_by_default"),
 
1890
            }
 
1891
        for name, value in config.items(section):
2472
1892
            try:
2473
 
                client["secret"] = (
2474
 
                    pgp.decrypt(client["encrypted_secret"],
2475
 
                                client_settings[client_name]
2476
 
                                ["secret"]))
2477
 
            except PGPError:
2478
 
                # If decryption fails, we use secret from new settings
2479
 
                logger.debug("Failed to decrypt {0} old secret"
2480
 
                             .format(client_name))
2481
 
                client["secret"] = (
2482
 
                    client_settings[client_name]["secret"])
2483
 
    
2484
 
    # Add/remove clients based on new changes made to config
2485
 
    for client_name in (set(old_client_settings)
2486
 
                        - set(client_settings)):
2487
 
        del clients_data[client_name]
2488
 
    for client_name in (set(client_settings)
2489
 
                        - set(old_client_settings)):
2490
 
        clients_data[client_name] = client_settings[client_name]
2491
 
    
2492
 
    # Create all client objects
2493
 
    for client_name, client in clients_data.iteritems():
2494
 
        tcp_server.clients[client_name] = client_class(
2495
 
            name = client_name, settings = client)
2496
 
    
 
1893
                yield (name, special_settings[name]())
 
1894
            except KeyError:
 
1895
                yield (name, value)
 
1896
    
 
1897
    tcp_server.clients.update(set(
 
1898
            client_class(name = section,
 
1899
                         config= dict(client_config_items(
 
1900
                        client_config, section)))
 
1901
            for section in client_config.sections()))
2497
1902
    if not tcp_server.clients:
2498
1903
        logger.warning("No clients defined")
2499
 
    
 
1904
        
2500
1905
    if not debug:
2501
1906
        try:
2502
1907
            with pidfile:
2510
1915
            # "pidfile" was never created
2511
1916
            pass
2512
1917
        del pidfilename
2513
 
    
 
1918
        
 
1919
        signal.signal(signal.SIGINT, signal.SIG_IGN)
 
1920
 
2514
1921
    signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2515
1922
    signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
2516
1923
    
2517
1924
    if use_dbus:
2518
 
        @alternate_dbus_interfaces({"se.recompile.Mandos":
2519
 
                                        "se.bsnet.fukt.Mandos"})
2520
 
        class MandosDBusService(DBusObjectWithProperties):
 
1925
        class MandosDBusService(dbus.service.Object):
2521
1926
            """A D-Bus proxy object"""
2522
1927
            def __init__(self):
2523
1928
                dbus.service.Object.__init__(self, bus, "/")
2524
 
            _interface = "se.recompile.Mandos"
2525
 
            
2526
 
            @dbus_interface_annotations(_interface)
2527
 
            def _foo(self):
2528
 
                return { "org.freedesktop.DBus.Property"
2529
 
                         ".EmitsChangedSignal":
2530
 
                             "false"}
 
1929
            _interface = "se.bsnet.fukt.Mandos"
2531
1930
            
2532
1931
            @dbus.service.signal(_interface, signature="o")
2533
1932
            def ClientAdded(self, objpath):
2548
1947
            def GetAllClients(self):
2549
1948
                "D-Bus method"
2550
1949
                return dbus.Array(c.dbus_object_path
2551
 
                                  for c in
2552
 
                                  tcp_server.clients.itervalues())
 
1950
                                  for c in tcp_server.clients)
2553
1951
            
2554
1952
            @dbus.service.method(_interface,
2555
1953
                                 out_signature="a{oa{sv}}")
2557
1955
                "D-Bus method"
2558
1956
                return dbus.Dictionary(
2559
1957
                    ((c.dbus_object_path, c.GetAll(""))
2560
 
                     for c in tcp_server.clients.itervalues()),
 
1958
                     for c in tcp_server.clients),
2561
1959
                    signature="oa{sv}")
2562
1960
            
2563
1961
            @dbus.service.method(_interface, in_signature="o")
2564
1962
            def RemoveClient(self, object_path):
2565
1963
                "D-Bus method"
2566
 
                for c in tcp_server.clients.itervalues():
 
1964
                for c in tcp_server.clients:
2567
1965
                    if c.dbus_object_path == object_path:
2568
 
                        del tcp_server.clients[c.name]
 
1966
                        tcp_server.clients.remove(c)
2569
1967
                        c.remove_from_connection()
2570
1968
                        # Don't signal anything except ClientRemoved
2571
1969
                        c.disable(quiet=True)
2582
1980
        "Cleanup function; run on exit"
2583
1981
        service.cleanup()
2584
1982
        
2585
 
        multiprocessing.active_children()
2586
 
        if not (tcp_server.clients or client_settings):
2587
 
            return
2588
 
        
2589
 
        # Store client before exiting. Secrets are encrypted with key
2590
 
        # based on what config file has. If config file is
2591
 
        # removed/edited, old secret will thus be unrecovable.
2592
 
        clients = {}
2593
 
        with PGPEngine() as pgp:
2594
 
            for client in tcp_server.clients.itervalues():
2595
 
                key = client_settings[client.name]["secret"]
2596
 
                client.encrypted_secret = pgp.encrypt(client.secret,
2597
 
                                                      key)
2598
 
                client_dict = {}
2599
 
                
2600
 
                # A list of attributes that can not be pickled
2601
 
                # + secret.
2602
 
                exclude = set(("bus", "changedstate", "secret",
2603
 
                               "checker"))
2604
 
                for name, typ in (inspect.getmembers
2605
 
                                  (dbus.service.Object)):
2606
 
                    exclude.add(name)
2607
 
                
2608
 
                client_dict["encrypted_secret"] = (client
2609
 
                                                   .encrypted_secret)
2610
 
                for attr in client.client_structure:
2611
 
                    if attr not in exclude:
2612
 
                        client_dict[attr] = getattr(client, attr)
2613
 
                
2614
 
                clients[client.name] = client_dict
2615
 
                del client_settings[client.name]["secret"]
2616
 
        
2617
 
        try:
2618
 
            with (tempfile.NamedTemporaryFile
2619
 
                  (mode='wb', suffix=".pickle", prefix='clients-',
2620
 
                   dir=os.path.dirname(stored_state_path),
2621
 
                   delete=False)) as stored_state:
2622
 
                pickle.dump((clients, client_settings), stored_state)
2623
 
                tempname=stored_state.name
2624
 
            os.rename(tempname, stored_state_path)
2625
 
        except (IOError, OSError) as e:
2626
 
            if not debug:
2627
 
                try:
2628
 
                    os.remove(tempname)
2629
 
                except NameError:
2630
 
                    pass
2631
 
            if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
2632
 
                logger.warning("Could not save persistent state: {0}"
2633
 
                               .format(os.strerror(e.errno)))
2634
 
            else:
2635
 
                logger.warning("Could not save persistent state:",
2636
 
                               exc_info=e)
2637
 
                raise e
2638
 
        
2639
 
        # Delete all clients, and settings from config
2640
1983
        while tcp_server.clients:
2641
 
            name, client = tcp_server.clients.popitem()
 
1984
            client = tcp_server.clients.pop()
2642
1985
            if use_dbus:
2643
1986
                client.remove_from_connection()
 
1987
            client.disable_hook = None
2644
1988
            # Don't signal anything except ClientRemoved
2645
1989
            client.disable(quiet=True)
2646
1990
            if use_dbus:
2647
1991
                # Emit D-Bus signal
2648
 
                mandos_dbus_service.ClientRemoved(client
2649
 
                                                  .dbus_object_path,
 
1992
                mandos_dbus_service.ClientRemoved(client.dbus_object_path,
2650
1993
                                                  client.name)
2651
 
        client_settings.clear()
2652
1994
    
2653
1995
    atexit.register(cleanup)
2654
1996
    
2655
 
    for client in tcp_server.clients.itervalues():
 
1997
    for client in tcp_server.clients:
2656
1998
        if use_dbus:
2657
1999
            # Emit D-Bus signal
2658
2000
            mandos_dbus_service.ClientAdded(client.dbus_object_path)
2659
 
        # Need to initiate checking of clients
2660
 
        if client.enabled:
2661
 
            client.init_checker()
 
2001
        client.enable()
2662
2002
    
2663
2003
    tcp_server.enable()
2664
2004
    tcp_server.server_activate()
2667
2007
    service.port = tcp_server.socket.getsockname()[1]
2668
2008
    if use_ipv6:
2669
2009
        logger.info("Now listening on address %r, port %d,"
2670
 
                    " flowinfo %d, scope_id %d",
2671
 
                    *tcp_server.socket.getsockname())
 
2010
                    " flowinfo %d, scope_id %d"
 
2011
                    % tcp_server.socket.getsockname())
2672
2012
    else:                       # IPv4
2673
 
        logger.info("Now listening on address %r, port %d",
2674
 
                    *tcp_server.socket.getsockname())
 
2013
        logger.info("Now listening on address %r, port %d"
 
2014
                    % tcp_server.socket.getsockname())
2675
2015
    
2676
2016
    #service.interface = tcp_server.socket.getsockname()[3]
2677
2017
    
2679
2019
        # From the Avahi example code
2680
2020
        try:
2681
2021
            service.activate()
2682
 
        except dbus.exceptions.DBusException as error:
2683
 
            logger.critical("D-Bus Exception", exc_info=error)
 
2022
        except dbus.exceptions.DBusException, error:
 
2023
            logger.critical("DBusException: %s", error)
2684
2024
            cleanup()
2685
2025
            sys.exit(1)
2686
2026
        # End of Avahi example code
2692
2032
        
2693
2033
        logger.debug("Starting main loop")
2694
2034
        main_loop.run()
2695
 
    except AvahiError as error:
2696
 
        logger.critical("Avahi Error", exc_info=error)
 
2035
    except AvahiError, error:
 
2036
        logger.critical("AvahiError: %s", error)
2697
2037
        cleanup()
2698
2038
        sys.exit(1)
2699
2039
    except KeyboardInterrupt: