/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos

  • Committer: Teddy Hogeborn
  • Date: 2011-04-02 06:37:18 UTC
  • Revision ID: teddy@fukt.bsnet.se-20110402063718-13ldrcuu0t33sdc4
* mandos: Tolerate restarting Avahi servers.  Also Changed to new
          "except x as y" exception syntax.
  (AvahiService.entry_group_state_changed_match): New; contains the
                                                  SignalMatch object.
  (AvahiService.remove): Really remove the group and the signal
                         connection, if any.
  (AvahiService.add): Always create a new group and signal connection.
  (AvahiService.cleanup): Changed to simply call remove().
  (AvahiService.server_state_changed): Handle and log more bad states.
  (AvahiService.activate): Set "follow_name_owner_changes=True" on the
                           Avahi Server proxy object.
  (ClientDBus.checked_ok): Do not return anything.
  (ClientDBus.CheckedOK): Do not return anything, as documented.
* mandos-monitor: Call D-Bus methods asynchronously.

Show diffs side-by-side

added added

removed removed

Lines of Context:
1
 
#!/usr/bin/python2.7
 
1
#!/usr/bin/python
2
2
# -*- mode: python; coding: utf-8 -*-
3
3
4
4
# Mandos server - give out binary blobs to connecting clients.
11
11
# "AvahiService" class, and some lines in "main".
12
12
13
13
# Everything else is
14
 
# Copyright © 2008-2015 Teddy Hogeborn
15
 
# Copyright © 2008-2015 Björn Påhlsson
 
14
# Copyright © 2008-2011 Teddy Hogeborn
 
15
# Copyright © 2008-2011 Björn Påhlsson
16
16
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
28
28
# along with this program.  If not, see
29
29
# <http://www.gnu.org/licenses/>.
30
30
31
 
# Contact the authors at <mandos@recompile.se>.
 
31
# Contact the authors at <mandos@fukt.bsnet.se>.
32
32
33
33
 
34
34
from __future__ import (division, absolute_import, print_function,
35
35
                        unicode_literals)
36
36
 
37
 
from future_builtins import *
38
 
 
39
 
try:
40
 
    import SocketServer as socketserver
41
 
except ImportError:
42
 
    import socketserver
 
37
import SocketServer as socketserver
43
38
import socket
44
39
import argparse
45
40
import datetime
46
41
import errno
47
 
try:
48
 
    import ConfigParser as configparser
49
 
except ImportError:
50
 
    import configparser
 
42
import gnutls.crypto
 
43
import gnutls.connection
 
44
import gnutls.errors
 
45
import gnutls.library.functions
 
46
import gnutls.library.constants
 
47
import gnutls.library.types
 
48
import ConfigParser as configparser
51
49
import sys
52
50
import re
53
51
import os
62
60
import struct
63
61
import fcntl
64
62
import functools
65
 
try:
66
 
    import cPickle as pickle
67
 
except ImportError:
68
 
    import pickle
 
63
import cPickle as pickle
69
64
import multiprocessing
70
 
import types
71
 
import binascii
72
 
import tempfile
73
 
import itertools
74
 
import collections
75
 
import codecs
76
65
 
77
66
import dbus
78
67
import dbus.service
79
 
try:
80
 
    import gobject
81
 
except ImportError:
82
 
    from gi.repository import GObject as gobject
 
68
import gobject
83
69
import avahi
84
70
from dbus.mainloop.glib import DBusGMainLoop
85
71
import ctypes
95
81
    except ImportError:
96
82
        SO_BINDTODEVICE = None
97
83
 
98
 
if sys.version_info.major == 2:
99
 
    str = unicode
100
 
 
101
 
version = "1.7.1"
102
 
stored_state_file = "clients.pickle"
103
 
 
104
 
logger = logging.getLogger()
105
 
syslogger = None
106
 
 
107
 
try:
108
 
    if_nametoindex = ctypes.cdll.LoadLibrary(
109
 
        ctypes.util.find_library("c")).if_nametoindex
110
 
except (OSError, AttributeError):
111
 
    
112
 
    def if_nametoindex(interface):
113
 
        "Get an interface index the hard way, i.e. using fcntl()"
114
 
        SIOCGIFINDEX = 0x8933  # From /usr/include/linux/sockios.h
115
 
        with contextlib.closing(socket.socket()) as s:
116
 
            ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
117
 
                                struct.pack(b"16s16x", interface))
118
 
        interface_index = struct.unpack("I", ifreq[16:20])[0]
119
 
        return interface_index
120
 
 
121
 
 
122
 
def initlogger(debug, level=logging.WARNING):
123
 
    """init logger and add loglevel"""
124
 
    
125
 
    global syslogger
126
 
    syslogger = (logging.handlers.SysLogHandler(
127
 
        facility = logging.handlers.SysLogHandler.LOG_DAEMON,
128
 
        address = "/dev/log"))
129
 
    syslogger.setFormatter(logging.Formatter
130
 
                           ('Mandos [%(process)d]: %(levelname)s:'
131
 
                            ' %(message)s'))
132
 
    logger.addHandler(syslogger)
133
 
    
134
 
    if debug:
135
 
        console = logging.StreamHandler()
136
 
        console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
137
 
                                               ' [%(process)d]:'
138
 
                                               ' %(levelname)s:'
139
 
                                               ' %(message)s'))
140
 
        logger.addHandler(console)
141
 
    logger.setLevel(level)
142
 
 
143
 
 
144
 
class PGPError(Exception):
145
 
    """Exception if encryption/decryption fails"""
146
 
    pass
147
 
 
148
 
 
149
 
class PGPEngine(object):
150
 
    """A simple class for OpenPGP symmetric encryption & decryption"""
151
 
    
152
 
    def __init__(self):
153
 
        self.tempdir = tempfile.mkdtemp(prefix="mandos-")
154
 
        self.gnupgargs = ['--batch',
155
 
                          '--home', self.tempdir,
156
 
                          '--force-mdc',
157
 
                          '--quiet',
158
 
                          '--no-use-agent']
159
 
    
160
 
    def __enter__(self):
161
 
        return self
162
 
    
163
 
    def __exit__(self, exc_type, exc_value, traceback):
164
 
        self._cleanup()
165
 
        return False
166
 
    
167
 
    def __del__(self):
168
 
        self._cleanup()
169
 
    
170
 
    def _cleanup(self):
171
 
        if self.tempdir is not None:
172
 
            # Delete contents of tempdir
173
 
            for root, dirs, files in os.walk(self.tempdir,
174
 
                                             topdown = False):
175
 
                for filename in files:
176
 
                    os.remove(os.path.join(root, filename))
177
 
                for dirname in dirs:
178
 
                    os.rmdir(os.path.join(root, dirname))
179
 
            # Remove tempdir
180
 
            os.rmdir(self.tempdir)
181
 
            self.tempdir = None
182
 
    
183
 
    def password_encode(self, password):
184
 
        # Passphrase can not be empty and can not contain newlines or
185
 
        # NUL bytes.  So we prefix it and hex encode it.
186
 
        encoded = b"mandos" + binascii.hexlify(password)
187
 
        if len(encoded) > 2048:
188
 
            # GnuPG can't handle long passwords, so encode differently
189
 
            encoded = (b"mandos" + password.replace(b"\\", b"\\\\")
190
 
                       .replace(b"\n", b"\\n")
191
 
                       .replace(b"\0", b"\\x00"))
192
 
        return encoded
193
 
    
194
 
    def encrypt(self, data, password):
195
 
        passphrase = self.password_encode(password)
196
 
        with tempfile.NamedTemporaryFile(
197
 
                dir=self.tempdir) as passfile:
198
 
            passfile.write(passphrase)
199
 
            passfile.flush()
200
 
            proc = subprocess.Popen(['gpg', '--symmetric',
201
 
                                     '--passphrase-file',
202
 
                                     passfile.name]
203
 
                                    + self.gnupgargs,
204
 
                                    stdin = subprocess.PIPE,
205
 
                                    stdout = subprocess.PIPE,
206
 
                                    stderr = subprocess.PIPE)
207
 
            ciphertext, err = proc.communicate(input = data)
208
 
        if proc.returncode != 0:
209
 
            raise PGPError(err)
210
 
        return ciphertext
211
 
    
212
 
    def decrypt(self, data, password):
213
 
        passphrase = self.password_encode(password)
214
 
        with tempfile.NamedTemporaryFile(
215
 
                dir = self.tempdir) as passfile:
216
 
            passfile.write(passphrase)
217
 
            passfile.flush()
218
 
            proc = subprocess.Popen(['gpg', '--decrypt',
219
 
                                     '--passphrase-file',
220
 
                                     passfile.name]
221
 
                                    + self.gnupgargs,
222
 
                                    stdin = subprocess.PIPE,
223
 
                                    stdout = subprocess.PIPE,
224
 
                                    stderr = subprocess.PIPE)
225
 
            decrypted_plaintext, err = proc.communicate(input = data)
226
 
        if proc.returncode != 0:
227
 
            raise PGPError(err)
228
 
        return decrypted_plaintext
229
 
 
 
84
 
 
85
version = "1.3.0"
 
86
 
 
87
#logger = logging.getLogger('mandos')
 
88
logger = logging.Logger('mandos')
 
89
syslogger = (logging.handlers.SysLogHandler
 
90
             (facility = logging.handlers.SysLogHandler.LOG_DAEMON,
 
91
              address = str("/dev/log")))
 
92
syslogger.setFormatter(logging.Formatter
 
93
                       ('Mandos [%(process)d]: %(levelname)s:'
 
94
                        ' %(message)s'))
 
95
logger.addHandler(syslogger)
 
96
 
 
97
console = logging.StreamHandler()
 
98
console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'
 
99
                                       ' %(levelname)s:'
 
100
                                       ' %(message)s'))
 
101
logger.addHandler(console)
230
102
 
231
103
class AvahiError(Exception):
232
104
    def __init__(self, value, *args, **kwargs):
233
105
        self.value = value
234
 
        return super(AvahiError, self).__init__(value, *args,
235
 
                                                **kwargs)
236
 
 
 
106
        super(AvahiError, self).__init__(value, *args, **kwargs)
 
107
    def __unicode__(self):
 
108
        return unicode(repr(self.value))
237
109
 
238
110
class AvahiServiceError(AvahiError):
239
111
    pass
240
112
 
241
 
 
242
113
class AvahiGroupError(AvahiError):
243
114
    pass
244
115
 
251
122
               Used to optionally bind to the specified interface.
252
123
    name: string; Example: 'Mandos'
253
124
    type: string; Example: '_mandos._tcp'.
254
 
     See <https://www.iana.org/assignments/service-names-port-numbers>
 
125
                  See <http://www.dns-sd.org/ServiceTypes.html>
255
126
    port: integer; what port to announce
256
127
    TXT: list of strings; TXT record for the service
257
128
    domain: string; Domain to publish on, default to .local if empty.
263
134
    server: D-Bus Server
264
135
    bus: dbus.SystemBus()
265
136
    """
266
 
    
267
 
    def __init__(self,
268
 
                 interface = avahi.IF_UNSPEC,
269
 
                 name = None,
270
 
                 servicetype = None,
271
 
                 port = None,
272
 
                 TXT = None,
273
 
                 domain = "",
274
 
                 host = "",
275
 
                 max_renames = 32768,
276
 
                 protocol = avahi.PROTO_UNSPEC,
277
 
                 bus = None):
 
137
    def __init__(self, interface = avahi.IF_UNSPEC, name = None,
 
138
                 servicetype = None, port = None, TXT = None,
 
139
                 domain = "", host = "", max_renames = 32768,
 
140
                 protocol = avahi.PROTO_UNSPEC, bus = None):
278
141
        self.interface = interface
279
142
        self.name = name
280
143
        self.type = servicetype
289
152
        self.server = None
290
153
        self.bus = bus
291
154
        self.entry_group_state_changed_match = None
292
 
    
293
 
    def rename(self, remove=True):
 
155
    def rename(self):
294
156
        """Derived from the Avahi example code"""
295
157
        if self.rename_count >= self.max_renames:
296
158
            logger.critical("No suitable Zeroconf service name found"
297
159
                            " after %i retries, exiting.",
298
160
                            self.rename_count)
299
161
            raise AvahiServiceError("Too many renames")
300
 
        self.name = str(
301
 
            self.server.GetAlternativeServiceName(self.name))
302
 
        self.rename_count += 1
 
162
        self.name = unicode(self.server.GetAlternativeServiceName(self.name))
303
163
        logger.info("Changing Zeroconf service name to %r ...",
304
164
                    self.name)
305
 
        if remove:
306
 
            self.remove()
 
165
        syslogger.setFormatter(logging.Formatter
 
166
                               ('Mandos (%s) [%%(process)d]:'
 
167
                                ' %%(levelname)s: %%(message)s'
 
168
                                % self.name))
 
169
        self.remove()
307
170
        try:
308
171
            self.add()
309
172
        except dbus.exceptions.DBusException as error:
310
 
            if (error.get_dbus_name()
311
 
                == "org.freedesktop.Avahi.CollisionError"):
312
 
                logger.info("Local Zeroconf service name collision.")
313
 
                return self.rename(remove=False)
314
 
            else:
315
 
                logger.critical("D-Bus Exception", exc_info=error)
316
 
                self.cleanup()
317
 
                os._exit(1)
318
 
    
 
173
            logger.critical("DBusException: %s", error)
 
174
            self.cleanup()
 
175
            os._exit(1)
 
176
        self.rename_count += 1
319
177
    def remove(self):
320
178
        """Derived from the Avahi example code"""
 
179
        if self.group is not None:
 
180
            try:
 
181
                self.group.Free()
 
182
            except (dbus.exceptions.UnknownMethodException,
 
183
                    dbus.exceptions.DBusException) as e:
 
184
                pass
 
185
            self.group = None
321
186
        if self.entry_group_state_changed_match is not None:
322
187
            self.entry_group_state_changed_match.remove()
323
188
            self.entry_group_state_changed_match = None
324
 
        if self.group is not None:
325
 
            self.group.Reset()
326
 
    
327
189
    def add(self):
328
190
        """Derived from the Avahi example code"""
329
191
        self.remove()
330
 
        if self.group is None:
331
 
            self.group = dbus.Interface(
332
 
                self.bus.get_object(avahi.DBUS_NAME,
333
 
                                    self.server.EntryGroupNew()),
334
 
                avahi.DBUS_INTERFACE_ENTRY_GROUP)
 
192
        self.group = dbus.Interface(
 
193
            self.bus.get_object(avahi.DBUS_NAME,
 
194
                                self.server.EntryGroupNew(),
 
195
                                follow_name_owner_changes=True),
 
196
            avahi.DBUS_INTERFACE_ENTRY_GROUP)
335
197
        self.entry_group_state_changed_match = (
336
198
            self.group.connect_to_signal(
337
 
                'StateChanged', self.entry_group_state_changed))
 
199
                'StateChanged', self .entry_group_state_changed))
338
200
        logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
339
201
                     self.name, self.type)
340
202
        self.group.AddService(
346
208
            dbus.UInt16(self.port),
347
209
            avahi.string_array_to_txt_array(self.TXT))
348
210
        self.group.Commit()
349
 
    
350
211
    def entry_group_state_changed(self, state, error):
351
212
        """Derived from the Avahi example code"""
352
213
        logger.debug("Avahi entry group state change: %i", state)
358
219
            self.rename()
359
220
        elif state == avahi.ENTRY_GROUP_FAILURE:
360
221
            logger.critical("Avahi: Error in group state changed %s",
361
 
                            str(error))
362
 
            raise AvahiGroupError("State changed: {!s}".format(error))
363
 
    
 
222
                            unicode(error))
 
223
            raise AvahiGroupError("State changed: %s"
 
224
                                  % unicode(error))
364
225
    def cleanup(self):
365
226
        """Derived from the Avahi example code"""
366
 
        if self.group is not None:
367
 
            try:
368
 
                self.group.Free()
369
 
            except (dbus.exceptions.UnknownMethodException,
370
 
                    dbus.exceptions.DBusException):
371
 
                pass
372
 
            self.group = None
373
227
        self.remove()
374
 
    
375
228
    def server_state_changed(self, state, error=None):
376
229
        """Derived from the Avahi example code"""
377
230
        logger.debug("Avahi server state change: %i", state)
378
 
        bad_states = {
379
 
            avahi.SERVER_INVALID: "Zeroconf server invalid",
380
 
            avahi.SERVER_REGISTERING: None,
381
 
            avahi.SERVER_COLLISION: "Zeroconf server name collision",
382
 
            avahi.SERVER_FAILURE: "Zeroconf server failure",
383
 
        }
 
231
        bad_states = { avahi.SERVER_INVALID:
 
232
                           "Zeroconf server invalid",
 
233
                       avahi.SERVER_REGISTERING: None,
 
234
                       avahi.SERVER_COLLISION:
 
235
                           "Zeroconf server name collision",
 
236
                       avahi.SERVER_FAILURE:
 
237
                           "Zeroconf server failure" }
384
238
        if state in bad_states:
385
 
            if bad_states[state] is not None:
386
 
                if error is None:
387
 
                    logger.error(bad_states[state])
388
 
                else:
389
 
                    logger.error(bad_states[state] + ": %r", error)
390
 
            self.cleanup()
 
239
            if bad_states[state]:
 
240
                logger.error(bad_states[state])
 
241
            self.remove()
391
242
        elif state == avahi.SERVER_RUNNING:
392
 
            try:
393
 
                self.add()
394
 
            except dbus.exceptions.DBusException as error:
395
 
                if (error.get_dbus_name()
396
 
                    == "org.freedesktop.Avahi.CollisionError"):
397
 
                    logger.info("Local Zeroconf service name"
398
 
                                " collision.")
399
 
                    return self.rename(remove=False)
400
 
                else:
401
 
                    logger.critical("D-Bus Exception", exc_info=error)
402
 
                    self.cleanup()
403
 
                    os._exit(1)
 
243
            self.add()
404
244
        else:
405
 
            if error is None:
406
 
                logger.debug("Unknown state: %r", state)
407
 
            else:
408
 
                logger.debug("Unknown state: %r: %r", state, error)
409
 
    
 
245
            logger.debug("Unknown state: %r", state)
410
246
    def activate(self):
411
247
        """Derived from the Avahi example code"""
412
248
        if self.server is None:
416
252
                                    follow_name_owner_changes=True),
417
253
                avahi.DBUS_INTERFACE_SERVER)
418
254
        self.server.connect_to_signal("StateChanged",
419
 
                                      self.server_state_changed)
 
255
                                 self.server_state_changed)
420
256
        self.server_state_changed(self.server.GetState())
421
257
 
422
258
 
423
 
class AvahiServiceToSyslog(AvahiService):
424
 
    def rename(self, *args, **kwargs):
425
 
        """Add the new name to the syslog messages"""
426
 
        ret = AvahiService.rename(self, *args, **kwargs)
427
 
        syslogger.setFormatter(logging.Formatter(
428
 
            'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
429
 
            .format(self.name)))
430
 
        return ret
431
 
 
432
 
# Pretend that we have a GnuTLS module
433
 
class GnuTLS(object):
434
 
    """This isn't so much a class as it is a module-like namespace.
435
 
    It is instantiated once, and simulates having a GnuTLS module."""
436
 
    
437
 
    _library = ctypes.cdll.LoadLibrary(
438
 
        ctypes.util.find_library("gnutls"))
439
 
    _need_version = "3.3.0"
440
 
    def __init__(self):
441
 
        # Need to use class name "GnuTLS" here, since this method is
442
 
        # called before the assignment to the "gnutls" global variable
443
 
        # happens.
444
 
        if GnuTLS.check_version(self._need_version) is None:
445
 
            raise GnuTLS.Error("Needs GnuTLS {} or later"
446
 
                               .format(self._need_version))
447
 
    
448
 
    # Unless otherwise indicated, the constants and types below are
449
 
    # all from the gnutls/gnutls.h C header file.
450
 
    
451
 
    # Constants
452
 
    E_SUCCESS = 0
453
 
    CRT_OPENPGP = 2
454
 
    CLIENT = 2
455
 
    SHUT_RDWR = 0
456
 
    CRD_CERTIFICATE = 1
457
 
    E_NO_CERTIFICATE_FOUND = -49
458
 
    OPENPGP_FMT_RAW = 0         # gnutls/openpgp.h
459
 
    
460
 
    # Types
461
 
    class session_int(ctypes.Structure):
462
 
        _fields_ = []
463
 
    session_t = ctypes.POINTER(session_int)
464
 
    class certificate_credentials_st(ctypes.Structure):
465
 
        _fields_ = []
466
 
    certificate_credentials_t = ctypes.POINTER(
467
 
        certificate_credentials_st)
468
 
    certificate_type_t = ctypes.c_int
469
 
    class datum_t(ctypes.Structure):
470
 
        _fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
471
 
                    ('size', ctypes.c_uint)]
472
 
    class openpgp_crt_int(ctypes.Structure):
473
 
        _fields_ = []
474
 
    openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
475
 
    openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
476
 
    log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
477
 
    credentials_type_t = ctypes.c_int # 
478
 
    transport_ptr_t = ctypes.c_void_p
479
 
    close_request_t = ctypes.c_int
480
 
    
481
 
    # Exceptions
482
 
    class Error(Exception):
483
 
        # We need to use the class name "GnuTLS" here, since this
484
 
        # exception might be raised from within GnuTLS.__init__,
485
 
        # which is called before the assignment to the "gnutls"
486
 
        # global variable happens.
487
 
        def __init__(self, message = None, code = None, args=()):
488
 
            # Default usage is by a message string, but if a return
489
 
            # code is passed, convert it to a string with
490
 
            # gnutls.strerror()
491
 
            if message is None and code is not None:
492
 
                message = GnuTLS.strerror(code)
493
 
            return super(GnuTLS.Error, self).__init__(
494
 
                message, *args)
495
 
    
496
 
    class CertificateSecurityError(Error):
497
 
        pass
498
 
    
499
 
    # Classes
500
 
    class Credentials(object):
501
 
        def __init__(self):
502
 
            self._c_object = gnutls.certificate_credentials_t()
503
 
            gnutls.certificate_allocate_credentials(
504
 
                ctypes.byref(self._c_object))
505
 
            self.type = gnutls.CRD_CERTIFICATE
506
 
        
507
 
        def __del__(self):
508
 
            gnutls.certificate_free_credentials(self._c_object)
509
 
    
510
 
    class ClientSession(object):
511
 
        def __init__(self, socket, credentials = None):
512
 
            self._c_object = gnutls.session_t()
513
 
            gnutls.init(ctypes.byref(self._c_object), gnutls.CLIENT)
514
 
            gnutls.set_default_priority(self._c_object)
515
 
            gnutls.transport_set_ptr(self._c_object, socket.fileno())
516
 
            gnutls.handshake_set_private_extensions(self._c_object,
517
 
                                                    True)
518
 
            self.socket = socket
519
 
            if credentials is None:
520
 
                credentials = gnutls.Credentials()
521
 
            gnutls.credentials_set(self._c_object, credentials.type,
522
 
                                   ctypes.cast(credentials._c_object,
523
 
                                               ctypes.c_void_p))
524
 
            self.credentials = credentials
525
 
        
526
 
        def __del__(self):
527
 
            gnutls.deinit(self._c_object)
528
 
        
529
 
        def handshake(self):
530
 
            return gnutls.handshake(self._c_object)
531
 
        
532
 
        def send(self, data):
533
 
            data = bytes(data)
534
 
            if not data:
535
 
                return 0
536
 
            return gnutls.record_send(self._c_object, data, len(data))
537
 
        
538
 
        def bye(self):
539
 
            return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
540
 
    
541
 
    # Error handling function
542
 
    def _error_code(result):
543
 
        """A function to raise exceptions on errors, suitable
544
 
        for the 'restype' attribute on ctypes functions"""
545
 
        if result >= 0:
546
 
            return result
547
 
        if result == gnutls.E_NO_CERTIFICATE_FOUND:
548
 
            raise gnutls.CertificateSecurityError(code = result)
549
 
        raise gnutls.Error(code = result)
550
 
    
551
 
    # Unless otherwise indicated, the function declarations below are
552
 
    # all from the gnutls/gnutls.h C header file.
553
 
    
554
 
    # Functions
555
 
    priority_set_direct = _library.gnutls_priority_set_direct
556
 
    priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
557
 
                                    ctypes.POINTER(ctypes.c_char_p)]
558
 
    priority_set_direct.restype = _error_code
559
 
    
560
 
    init = _library.gnutls_init
561
 
    init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
562
 
    init.restype = _error_code
563
 
    
564
 
    set_default_priority = _library.gnutls_set_default_priority
565
 
    set_default_priority.argtypes = [session_t]
566
 
    set_default_priority.restype = _error_code
567
 
    
568
 
    record_send = _library.gnutls_record_send
569
 
    record_send.argtypes = [session_t, ctypes.c_void_p,
570
 
                            ctypes.c_size_t]
571
 
    record_send.restype = ctypes.c_ssize_t
572
 
    
573
 
    certificate_allocate_credentials = (
574
 
        _library.gnutls_certificate_allocate_credentials)
575
 
    certificate_allocate_credentials.argtypes = [
576
 
        ctypes.POINTER(certificate_credentials_t)]
577
 
    certificate_allocate_credentials.restype = _error_code
578
 
    
579
 
    certificate_free_credentials = (
580
 
        _library.gnutls_certificate_free_credentials)
581
 
    certificate_free_credentials.argtypes = [certificate_credentials_t]
582
 
    certificate_free_credentials.restype = None
583
 
    
584
 
    handshake_set_private_extensions = (
585
 
        _library.gnutls_handshake_set_private_extensions)
586
 
    handshake_set_private_extensions.argtypes = [session_t,
587
 
                                                 ctypes.c_int]
588
 
    handshake_set_private_extensions.restype = None
589
 
    
590
 
    credentials_set = _library.gnutls_credentials_set
591
 
    credentials_set.argtypes = [session_t, credentials_type_t,
592
 
                                ctypes.c_void_p]
593
 
    credentials_set.restype = _error_code
594
 
    
595
 
    strerror = _library.gnutls_strerror
596
 
    strerror.argtypes = [ctypes.c_int]
597
 
    strerror.restype = ctypes.c_char_p
598
 
    
599
 
    certificate_type_get = _library.gnutls_certificate_type_get
600
 
    certificate_type_get.argtypes = [session_t]
601
 
    certificate_type_get.restype = _error_code
602
 
    
603
 
    certificate_get_peers = _library.gnutls_certificate_get_peers
604
 
    certificate_get_peers.argtypes = [session_t,
605
 
                                      ctypes.POINTER(ctypes.c_uint)]
606
 
    certificate_get_peers.restype = ctypes.POINTER(datum_t)
607
 
    
608
 
    global_set_log_level = _library.gnutls_global_set_log_level
609
 
    global_set_log_level.argtypes = [ctypes.c_int]
610
 
    global_set_log_level.restype = None
611
 
    
612
 
    global_set_log_function = _library.gnutls_global_set_log_function
613
 
    global_set_log_function.argtypes = [log_func]
614
 
    global_set_log_function.restype = None
615
 
    
616
 
    deinit = _library.gnutls_deinit
617
 
    deinit.argtypes = [session_t]
618
 
    deinit.restype = None
619
 
    
620
 
    handshake = _library.gnutls_handshake
621
 
    handshake.argtypes = [session_t]
622
 
    handshake.restype = _error_code
623
 
    
624
 
    transport_set_ptr = _library.gnutls_transport_set_ptr
625
 
    transport_set_ptr.argtypes = [session_t, transport_ptr_t]
626
 
    transport_set_ptr.restype = None
627
 
    
628
 
    bye = _library.gnutls_bye
629
 
    bye.argtypes = [session_t, close_request_t]
630
 
    bye.restype = _error_code
631
 
    
632
 
    check_version = _library.gnutls_check_version
633
 
    check_version.argtypes = [ctypes.c_char_p]
634
 
    check_version.restype = ctypes.c_char_p
635
 
    
636
 
    # All the function declarations below are from gnutls/openpgp.h
637
 
    
638
 
    openpgp_crt_init = _library.gnutls_openpgp_crt_init
639
 
    openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
640
 
    openpgp_crt_init.restype = _error_code
641
 
    
642
 
    openpgp_crt_import = _library.gnutls_openpgp_crt_import
643
 
    openpgp_crt_import.argtypes = [openpgp_crt_t,
644
 
                                   ctypes.POINTER(datum_t),
645
 
                                   openpgp_crt_fmt_t]
646
 
    openpgp_crt_import.restype = _error_code
647
 
    
648
 
    openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
649
 
    openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
650
 
                                        ctypes.POINTER(ctypes.c_uint)]
651
 
    openpgp_crt_verify_self.restype = _error_code
652
 
    
653
 
    openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
654
 
    openpgp_crt_deinit.argtypes = [openpgp_crt_t]
655
 
    openpgp_crt_deinit.restype = None
656
 
    
657
 
    openpgp_crt_get_fingerprint = (
658
 
        _library.gnutls_openpgp_crt_get_fingerprint)
659
 
    openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
660
 
                                            ctypes.c_void_p,
661
 
                                            ctypes.POINTER(
662
 
                                                ctypes.c_size_t)]
663
 
    openpgp_crt_get_fingerprint.restype = _error_code
664
 
    
665
 
    # Remove non-public function
666
 
    del _error_code
667
 
# Create the global "gnutls" object, simulating a module
668
 
gnutls = GnuTLS()
669
 
 
670
 
def call_pipe(connection,       # : multiprocessing.Connection
671
 
              func, *args, **kwargs):
672
 
    """This function is meant to be called by multiprocessing.Process
673
 
    
674
 
    This function runs func(*args, **kwargs), and writes the resulting
675
 
    return value on the provided multiprocessing.Connection.
676
 
    """
677
 
    connection.send(func(*args, **kwargs))
678
 
    connection.close()
679
 
 
680
259
class Client(object):
681
260
    """A representation of a client host served by this server.
682
261
    
683
262
    Attributes:
684
 
    approved:   bool(); 'None' if not yet approved/disapproved
 
263
    _approved:   bool(); 'None' if not yet approved/disapproved
685
264
    approval_delay: datetime.timedelta(); Time to wait for approval
686
265
    approval_duration: datetime.timedelta(); Duration of one approval
687
266
    checker:    subprocess.Popen(); a running checker process used
694
273
                     instance %(name)s can be used in the command.
695
274
    checker_initiator_tag: a gobject event source tag, or None
696
275
    created:    datetime.datetime(); (UTC) object creation
697
 
    client_structure: Object describing what attributes a client has
698
 
                      and is used for storing the client at exit
699
276
    current_checker_command: string; current running checker_command
 
277
    disable_hook:  If set, called by disable() as disable_hook(self)
700
278
    disable_initiator_tag: a gobject event source tag, or None
701
279
    enabled:    bool()
702
280
    fingerprint: string (40 or 32 hexadecimal digits); used to
705
283
    interval:   datetime.timedelta(); How often to start a new checker
706
284
    last_approval_request: datetime.datetime(); (UTC) or None
707
285
    last_checked_ok: datetime.datetime(); (UTC) or None
708
 
    last_checker_status: integer between 0 and 255 reflecting exit
709
 
                         status of last checker. -1 reflects crashed
710
 
                         checker, -2 means no checker completed yet.
711
 
    last_checker_signal: The signal which killed the last checker, if
712
 
                         last_checker_status is -1
713
 
    last_enabled: datetime.datetime(); (UTC) or None
 
286
    last_enabled: datetime.datetime(); (UTC)
714
287
    name:       string; from the config file, used in log messages and
715
288
                        D-Bus identifiers
716
289
    secret:     bytestring; sent verbatim (over TLS) to client
717
290
    timeout:    datetime.timedelta(); How long from last_checked_ok
718
291
                                      until this client is disabled
719
 
    extended_timeout:   extra long timeout when secret has been sent
720
292
    runtime_expansions: Allowed attributes for runtime expansion.
721
 
    expires:    datetime.datetime(); time (UTC) when a client will be
722
 
                disabled, or None
723
 
    server_settings: The server_settings dict from main()
724
293
    """
725
294
    
726
295
    runtime_expansions = ("approval_delay", "approval_duration",
727
 
                          "created", "enabled", "expires",
728
 
                          "fingerprint", "host", "interval",
729
 
                          "last_approval_request", "last_checked_ok",
 
296
                          "created", "enabled", "fingerprint",
 
297
                          "host", "interval", "last_checked_ok",
730
298
                          "last_enabled", "name", "timeout")
731
 
    client_defaults = {
732
 
        "timeout": "PT5M",
733
 
        "extended_timeout": "PT15M",
734
 
        "interval": "PT2M",
735
 
        "checker": "fping -q -- %%(host)s",
736
 
        "host": "",
737
 
        "approval_delay": "PT0S",
738
 
        "approval_duration": "PT1S",
739
 
        "approved_by_default": "True",
740
 
        "enabled": "True",
741
 
    }
742
299
    
743
300
    @staticmethod
744
 
    def config_parser(config):
745
 
        """Construct a new dict of client settings of this form:
746
 
        { client_name: {setting_name: value, ...}, ...}
747
 
        with exceptions for any special settings as defined above.
748
 
        NOTE: Must be a pure function. Must return the same result
749
 
        value given the same arguments.
750
 
        """
751
 
        settings = {}
752
 
        for client_name in config.sections():
753
 
            section = dict(config.items(client_name))
754
 
            client = settings[client_name] = {}
755
 
            
756
 
            client["host"] = section["host"]
757
 
            # Reformat values from string types to Python types
758
 
            client["approved_by_default"] = config.getboolean(
759
 
                client_name, "approved_by_default")
760
 
            client["enabled"] = config.getboolean(client_name,
761
 
                                                  "enabled")
762
 
            
763
 
            # Uppercase and remove spaces from fingerprint for later
764
 
            # comparison purposes with return value from the
765
 
            # fingerprint() function
766
 
            client["fingerprint"] = (section["fingerprint"].upper()
767
 
                                     .replace(" ", ""))
768
 
            if "secret" in section:
769
 
                client["secret"] = section["secret"].decode("base64")
770
 
            elif "secfile" in section:
771
 
                with open(os.path.expanduser(os.path.expandvars
772
 
                                             (section["secfile"])),
773
 
                          "rb") as secfile:
774
 
                    client["secret"] = secfile.read()
775
 
            else:
776
 
                raise TypeError("No secret or secfile for section {}"
777
 
                                .format(section))
778
 
            client["timeout"] = string_to_delta(section["timeout"])
779
 
            client["extended_timeout"] = string_to_delta(
780
 
                section["extended_timeout"])
781
 
            client["interval"] = string_to_delta(section["interval"])
782
 
            client["approval_delay"] = string_to_delta(
783
 
                section["approval_delay"])
784
 
            client["approval_duration"] = string_to_delta(
785
 
                section["approval_duration"])
786
 
            client["checker_command"] = section["checker"]
787
 
            client["last_approval_request"] = None
788
 
            client["last_checked_ok"] = None
789
 
            client["last_checker_status"] = -2
790
 
        
791
 
        return settings
792
 
    
793
 
    def __init__(self, settings, name = None, server_settings=None):
 
301
    def _timedelta_to_milliseconds(td):
 
302
        "Convert a datetime.timedelta() to milliseconds"
 
303
        return ((td.days * 24 * 60 * 60 * 1000)
 
304
                + (td.seconds * 1000)
 
305
                + (td.microseconds // 1000))
 
306
    
 
307
    def timeout_milliseconds(self):
 
308
        "Return the 'timeout' attribute in milliseconds"
 
309
        return self._timedelta_to_milliseconds(self.timeout)
 
310
    
 
311
    def interval_milliseconds(self):
 
312
        "Return the 'interval' attribute in milliseconds"
 
313
        return self._timedelta_to_milliseconds(self.interval)
 
314
 
 
315
    def approval_delay_milliseconds(self):
 
316
        return self._timedelta_to_milliseconds(self.approval_delay)
 
317
    
 
318
    def __init__(self, name = None, disable_hook=None, config=None):
 
319
        """Note: the 'checker' key in 'config' sets the
 
320
        'checker_command' attribute and *not* the 'checker'
 
321
        attribute."""
794
322
        self.name = name
795
 
        if server_settings is None:
796
 
            server_settings = {}
797
 
        self.server_settings = server_settings
798
 
        # adding all client settings
799
 
        for setting, value in settings.items():
800
 
            setattr(self, setting, value)
801
 
        
802
 
        if self.enabled:
803
 
            if not hasattr(self, "last_enabled"):
804
 
                self.last_enabled = datetime.datetime.utcnow()
805
 
            if not hasattr(self, "expires"):
806
 
                self.expires = (datetime.datetime.utcnow()
807
 
                                + self.timeout)
808
 
        else:
809
 
            self.last_enabled = None
810
 
            self.expires = None
811
 
        
 
323
        if config is None:
 
324
            config = {}
812
325
        logger.debug("Creating client %r", self.name)
 
326
        # Uppercase and remove spaces from fingerprint for later
 
327
        # comparison purposes with return value from the fingerprint()
 
328
        # function
 
329
        self.fingerprint = (config["fingerprint"].upper()
 
330
                            .replace(" ", ""))
813
331
        logger.debug("  Fingerprint: %s", self.fingerprint)
814
 
        self.created = settings.get("created",
815
 
                                    datetime.datetime.utcnow())
816
 
        
817
 
        # attributes specific for this server instance
 
332
        if "secret" in config:
 
333
            self.secret = config["secret"].decode("base64")
 
334
        elif "secfile" in config:
 
335
            with open(os.path.expanduser(os.path.expandvars
 
336
                                         (config["secfile"])),
 
337
                      "rb") as secfile:
 
338
                self.secret = secfile.read()
 
339
        else:
 
340
            raise TypeError("No secret or secfile for client %s"
 
341
                            % self.name)
 
342
        self.host = config.get("host", "")
 
343
        self.created = datetime.datetime.utcnow()
 
344
        self.enabled = False
 
345
        self.last_approval_request = None
 
346
        self.last_enabled = None
 
347
        self.last_checked_ok = None
 
348
        self.timeout = string_to_delta(config["timeout"])
 
349
        self.interval = string_to_delta(config["interval"])
 
350
        self.disable_hook = disable_hook
818
351
        self.checker = None
819
352
        self.checker_initiator_tag = None
820
353
        self.disable_initiator_tag = None
821
354
        self.checker_callback_tag = None
 
355
        self.checker_command = config["checker"]
822
356
        self.current_checker_command = None
823
 
        self.approved = None
 
357
        self.last_connect = None
 
358
        self._approved = None
 
359
        self.approved_by_default = config.get("approved_by_default",
 
360
                                              True)
824
361
        self.approvals_pending = 0
825
 
        self.changedstate = multiprocessing_manager.Condition(
826
 
            multiprocessing_manager.Lock())
827
 
        self.client_structure = [attr
828
 
                                 for attr in self.__dict__.iterkeys()
829
 
                                 if not attr.startswith("_")]
830
 
        self.client_structure.append("client_structure")
831
 
        
832
 
        for name, t in inspect.getmembers(
833
 
                type(self), lambda obj: isinstance(obj, property)):
834
 
            if not name.startswith("_"):
835
 
                self.client_structure.append(name)
 
362
        self.approval_delay = string_to_delta(
 
363
            config["approval_delay"])
 
364
        self.approval_duration = string_to_delta(
 
365
            config["approval_duration"])
 
366
        self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())
836
367
    
837
 
    # Send notice to process children that client state has changed
838
368
    def send_changedstate(self):
839
 
        with self.changedstate:
840
 
            self.changedstate.notify_all()
841
 
    
 
369
        self.changedstate.acquire()
 
370
        self.changedstate.notify_all()
 
371
        self.changedstate.release()
 
372
        
842
373
    def enable(self):
843
374
        """Start this client's checker and timeout hooks"""
844
375
        if getattr(self, "enabled", False):
845
376
            # Already enabled
846
377
            return
847
 
        self.expires = datetime.datetime.utcnow() + self.timeout
848
 
        self.enabled = True
 
378
        self.send_changedstate()
849
379
        self.last_enabled = datetime.datetime.utcnow()
850
 
        self.init_checker()
851
 
        self.send_changedstate()
 
380
        # Schedule a new checker to be started an 'interval' from now,
 
381
        # and every interval from then on.
 
382
        self.checker_initiator_tag = (gobject.timeout_add
 
383
                                      (self.interval_milliseconds(),
 
384
                                       self.start_checker))
 
385
        # Schedule a disable() when 'timeout' has passed
 
386
        self.disable_initiator_tag = (gobject.timeout_add
 
387
                                   (self.timeout_milliseconds(),
 
388
                                    self.disable))
 
389
        self.enabled = True
 
390
        # Also start a new checker *right now*.
 
391
        self.start_checker()
852
392
    
853
393
    def disable(self, quiet=True):
854
394
        """Disable this client."""
855
395
        if not getattr(self, "enabled", False):
856
396
            return False
857
397
        if not quiet:
 
398
            self.send_changedstate()
 
399
        if not quiet:
858
400
            logger.info("Disabling client %s", self.name)
859
 
        if getattr(self, "disable_initiator_tag", None) is not None:
 
401
        if getattr(self, "disable_initiator_tag", False):
860
402
            gobject.source_remove(self.disable_initiator_tag)
861
403
            self.disable_initiator_tag = None
862
 
        self.expires = None
863
 
        if getattr(self, "checker_initiator_tag", None) is not None:
 
404
        if getattr(self, "checker_initiator_tag", False):
864
405
            gobject.source_remove(self.checker_initiator_tag)
865
406
            self.checker_initiator_tag = None
866
407
        self.stop_checker()
 
408
        if self.disable_hook:
 
409
            self.disable_hook(self)
867
410
        self.enabled = False
868
 
        if not quiet:
869
 
            self.send_changedstate()
870
411
        # Do not run this again if called by a gobject.timeout_add
871
412
        return False
872
413
    
873
414
    def __del__(self):
 
415
        self.disable_hook = None
874
416
        self.disable()
875
417
    
876
 
    def init_checker(self):
877
 
        # Schedule a new checker to be started an 'interval' from now,
878
 
        # and every interval from then on.
879
 
        if self.checker_initiator_tag is not None:
880
 
            gobject.source_remove(self.checker_initiator_tag)
881
 
        self.checker_initiator_tag = gobject.timeout_add(
882
 
            int(self.interval.total_seconds() * 1000),
883
 
            self.start_checker)
884
 
        # Schedule a disable() when 'timeout' has passed
885
 
        if self.disable_initiator_tag is not None:
886
 
            gobject.source_remove(self.disable_initiator_tag)
887
 
        self.disable_initiator_tag = gobject.timeout_add(
888
 
            int(self.timeout.total_seconds() * 1000), self.disable)
889
 
        # Also start a new checker *right now*.
890
 
        self.start_checker()
891
 
    
892
 
    def checker_callback(self, source, condition, connection,
893
 
                         command):
 
418
    def checker_callback(self, pid, condition, command):
894
419
        """The checker has completed, so take appropriate actions."""
895
420
        self.checker_callback_tag = None
896
421
        self.checker = None
897
 
        # Read return code from connection (see call_pipe)
898
 
        returncode = connection.recv()
899
 
        connection.close()
900
 
        
901
 
        if returncode >= 0:
902
 
            self.last_checker_status = returncode
903
 
            self.last_checker_signal = None
904
 
            if self.last_checker_status == 0:
 
422
        if os.WIFEXITED(condition):
 
423
            exitstatus = os.WEXITSTATUS(condition)
 
424
            if exitstatus == 0:
905
425
                logger.info("Checker for %(name)s succeeded",
906
426
                            vars(self))
907
427
                self.checked_ok()
908
428
            else:
909
 
                logger.info("Checker for %(name)s failed", vars(self))
 
429
                logger.info("Checker for %(name)s failed",
 
430
                            vars(self))
910
431
        else:
911
 
            self.last_checker_status = -1
912
 
            self.last_checker_signal = -returncode
913
432
            logger.warning("Checker for %(name)s crashed?",
914
433
                           vars(self))
915
 
        return False
916
434
    
917
435
    def checked_ok(self):
918
 
        """Assert that the client has been seen, alive and well."""
 
436
        """Bump up the timeout for this client.
 
437
        
 
438
        This should only be called when the client has been seen,
 
439
        alive and well.
 
440
        """
919
441
        self.last_checked_ok = datetime.datetime.utcnow()
920
 
        self.last_checker_status = 0
921
 
        self.last_checker_signal = None
922
 
        self.bump_timeout()
923
 
    
924
 
    def bump_timeout(self, timeout=None):
925
 
        """Bump up the timeout for this client."""
926
 
        if timeout is None:
927
 
            timeout = self.timeout
928
 
        if self.disable_initiator_tag is not None:
929
 
            gobject.source_remove(self.disable_initiator_tag)
930
 
            self.disable_initiator_tag = None
931
 
        if getattr(self, "enabled", False):
932
 
            self.disable_initiator_tag = gobject.timeout_add(
933
 
                int(timeout.total_seconds() * 1000), self.disable)
934
 
            self.expires = datetime.datetime.utcnow() + timeout
 
442
        gobject.source_remove(self.disable_initiator_tag)
 
443
        self.disable_initiator_tag = (gobject.timeout_add
 
444
                                      (self.timeout_milliseconds(),
 
445
                                       self.disable))
935
446
    
936
447
    def need_approval(self):
937
448
        self.last_approval_request = datetime.datetime.utcnow()
942
453
        If a checker already exists, leave it running and do
943
454
        nothing."""
944
455
        # The reason for not killing a running checker is that if we
945
 
        # did that, and if a checker (for some reason) started running
946
 
        # slowly and taking more than 'interval' time, then the client
947
 
        # would inevitably timeout, since no checker would get a
948
 
        # chance to run to completion.  If we instead leave running
 
456
        # did that, then if a checker (for some reason) started
 
457
        # running slowly and taking more than 'interval' time, the
 
458
        # client would inevitably timeout, since no checker would get
 
459
        # a chance to run to completion.  If we instead leave running
949
460
        # checkers alone, the checker would have to take more time
950
461
        # than 'timeout' for the client to be disabled, which is as it
951
462
        # should be.
952
463
        
953
 
        if self.checker is not None and not self.checker.is_alive():
954
 
            logger.warning("Checker was not alive; joining")
955
 
            self.checker.join()
956
 
            self.checker = None
 
464
        # If a checker exists, make sure it is not a zombie
 
465
        try:
 
466
            pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
 
467
        except (AttributeError, OSError) as error:
 
468
            if (isinstance(error, OSError)
 
469
                and error.errno != errno.ECHILD):
 
470
                raise error
 
471
        else:
 
472
            if pid:
 
473
                logger.warning("Checker was a zombie")
 
474
                gobject.source_remove(self.checker_callback_tag)
 
475
                self.checker_callback(pid, status,
 
476
                                      self.current_checker_command)
957
477
        # Start a new checker if needed
958
478
        if self.checker is None:
959
 
            # Escape attributes for the shell
960
 
            escaped_attrs = {
961
 
                attr: re.escape(str(getattr(self, attr)))
962
 
                for attr in self.runtime_expansions }
963
479
            try:
964
 
                command = self.checker_command % escaped_attrs
965
 
            except TypeError as error:
966
 
                logger.error('Could not format string "%s"',
967
 
                             self.checker_command,
968
 
                             exc_info=error)
969
 
                return True     # Try again later
 
480
                # In case checker_command has exactly one % operator
 
481
                command = self.checker_command % self.host
 
482
            except TypeError:
 
483
                # Escape attributes for the shell
 
484
                escaped_attrs = dict(
 
485
                    (attr,
 
486
                     re.escape(unicode(str(getattr(self, attr, "")),
 
487
                                       errors=
 
488
                                       'replace')))
 
489
                    for attr in
 
490
                    self.runtime_expansions)
 
491
 
 
492
                try:
 
493
                    command = self.checker_command % escaped_attrs
 
494
                except TypeError as error:
 
495
                    logger.error('Could not format string "%s":'
 
496
                                 ' %s', self.checker_command, error)
 
497
                    return True # Try again later
970
498
            self.current_checker_command = command
971
 
            logger.info("Starting checker %r for %s", command,
972
 
                        self.name)
973
 
            # We don't need to redirect stdout and stderr, since
974
 
            # in normal mode, that is already done by daemon(),
975
 
            # and in debug mode we don't want to.  (Stdin is
976
 
            # always replaced by /dev/null.)
977
 
            # The exception is when not debugging but nevertheless
978
 
            # running in the foreground; use the previously
979
 
            # created wnull.
980
 
            popen_args = { "close_fds": True,
981
 
                           "shell": True,
982
 
                           "cwd": "/" }
983
 
            if (not self.server_settings["debug"]
984
 
                and self.server_settings["foreground"]):
985
 
                popen_args.update({"stdout": wnull,
986
 
                                   "stderr": wnull })
987
 
            pipe = multiprocessing.Pipe(duplex = False)
988
 
            self.checker = multiprocessing.Process(
989
 
                target = call_pipe,
990
 
                args = (pipe[1], subprocess.call, command),
991
 
                kwargs = popen_args)
992
 
            self.checker.start()
993
 
            self.checker_callback_tag = gobject.io_add_watch(
994
 
                pipe[0].fileno(), gobject.IO_IN,
995
 
                self.checker_callback, pipe[0], command)
 
499
            try:
 
500
                logger.info("Starting checker %r for %s",
 
501
                            command, self.name)
 
502
                # We don't need to redirect stdout and stderr, since
 
503
                # in normal mode, that is already done by daemon(),
 
504
                # and in debug mode we don't want to.  (Stdin is
 
505
                # always replaced by /dev/null.)
 
506
                self.checker = subprocess.Popen(command,
 
507
                                                close_fds=True,
 
508
                                                shell=True, cwd="/")
 
509
                self.checker_callback_tag = (gobject.child_watch_add
 
510
                                             (self.checker.pid,
 
511
                                              self.checker_callback,
 
512
                                              data=command))
 
513
                # The checker may have completed before the gobject
 
514
                # watch was added.  Check for this.
 
515
                pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
 
516
                if pid:
 
517
                    gobject.source_remove(self.checker_callback_tag)
 
518
                    self.checker_callback(pid, status, command)
 
519
            except OSError as error:
 
520
                logger.error("Failed to start subprocess: %s",
 
521
                             error)
996
522
        # Re-run this periodically if run by gobject.timeout_add
997
523
        return True
998
524
    
1004
530
        if getattr(self, "checker", None) is None:
1005
531
            return
1006
532
        logger.debug("Stopping checker for %(name)s", vars(self))
1007
 
        self.checker.terminate()
 
533
        try:
 
534
            os.kill(self.checker.pid, signal.SIGTERM)
 
535
            #time.sleep(0.5)
 
536
            #if self.checker.poll() is None:
 
537
            #    os.kill(self.checker.pid, signal.SIGKILL)
 
538
        except OSError as error:
 
539
            if error.errno != errno.ESRCH: # No such process
 
540
                raise
1008
541
        self.checker = None
1009
542
 
1010
 
 
1011
 
def dbus_service_property(dbus_interface,
1012
 
                          signature="v",
1013
 
                          access="readwrite",
1014
 
                          byte_arrays=False):
 
543
def dbus_service_property(dbus_interface, signature="v",
 
544
                          access="readwrite", byte_arrays=False):
1015
545
    """Decorators for marking methods of a DBusObjectWithProperties to
1016
546
    become properties on the D-Bus.
1017
547
    
1026
556
    # "Set" method, so we fail early here:
1027
557
    if byte_arrays and signature != "ay":
1028
558
        raise ValueError("Byte arrays not supported for non-'ay'"
1029
 
                         " signature {!r}".format(signature))
1030
 
    
 
559
                         " signature %r" % signature)
1031
560
    def decorator(func):
1032
561
        func._dbus_is_property = True
1033
562
        func._dbus_interface = dbus_interface
1038
567
            func._dbus_name = func._dbus_name[:-14]
1039
568
        func._dbus_get_args_options = {'byte_arrays': byte_arrays }
1040
569
        return func
1041
 
    
1042
 
    return decorator
1043
 
 
1044
 
 
1045
 
def dbus_interface_annotations(dbus_interface):
1046
 
    """Decorator for marking functions returning interface annotations
1047
 
    
1048
 
    Usage:
1049
 
    
1050
 
    @dbus_interface_annotations("org.example.Interface")
1051
 
    def _foo(self):  # Function name does not matter
1052
 
        return {"org.freedesktop.DBus.Deprecated": "true",
1053
 
                "org.freedesktop.DBus.Property.EmitsChangedSignal":
1054
 
                    "false"}
1055
 
    """
1056
 
    
1057
 
    def decorator(func):
1058
 
        func._dbus_is_interface = True
1059
 
        func._dbus_interface = dbus_interface
1060
 
        func._dbus_name = dbus_interface
1061
 
        return func
1062
 
    
1063
 
    return decorator
1064
 
 
1065
 
 
1066
 
def dbus_annotations(annotations):
1067
 
    """Decorator to annotate D-Bus methods, signals or properties
1068
 
    Usage:
1069
 
    
1070
 
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",
1071
 
                       "org.freedesktop.DBus.Property."
1072
 
                       "EmitsChangedSignal": "false"})
1073
 
    @dbus_service_property("org.example.Interface", signature="b",
1074
 
                           access="r")
1075
 
    def Property_dbus_property(self):
1076
 
        return dbus.Boolean(False)
1077
 
    
1078
 
    See also the DBusObjectWithAnnotations class.
1079
 
    """
1080
 
    
1081
 
    def decorator(func):
1082
 
        func._dbus_annotations = annotations
1083
 
        return func
1084
 
    
1085
570
    return decorator
1086
571
 
1087
572
 
1088
573
class DBusPropertyException(dbus.exceptions.DBusException):
1089
574
    """A base class for D-Bus property-related exceptions
1090
575
    """
1091
 
    pass
 
576
    def __unicode__(self):
 
577
        return unicode(str(self))
1092
578
 
1093
579
 
1094
580
class DBusPropertyAccessException(DBusPropertyException):
1103
589
    pass
1104
590
 
1105
591
 
1106
 
class DBusObjectWithAnnotations(dbus.service.Object):
1107
 
    """A D-Bus object with annotations.
1108
 
    
1109
 
    Classes inheriting from this can use the dbus_annotations
1110
 
    decorator to add annotations to methods or signals.
1111
 
    """
1112
 
    
1113
 
    @staticmethod
1114
 
    def _is_dbus_thing(thing):
1115
 
        """Returns a function testing if an attribute is a D-Bus thing
1116
 
        
1117
 
        If called like _is_dbus_thing("method") it returns a function
1118
 
        suitable for use as predicate to inspect.getmembers().
1119
 
        """
1120
 
        return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
1121
 
                                   False)
1122
 
    
1123
 
    def _get_all_dbus_things(self, thing):
1124
 
        """Returns a generator of (name, attribute) pairs
1125
 
        """
1126
 
        return ((getattr(athing.__get__(self), "_dbus_name", name),
1127
 
                 athing.__get__(self))
1128
 
                for cls in self.__class__.__mro__
1129
 
                for name, athing in
1130
 
                inspect.getmembers(cls, self._is_dbus_thing(thing)))
1131
 
    
1132
 
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1133
 
                         out_signature = "s",
1134
 
                         path_keyword = 'object_path',
1135
 
                         connection_keyword = 'connection')
1136
 
    def Introspect(self, object_path, connection):
1137
 
        """Overloading of standard D-Bus method.
1138
 
        
1139
 
        Inserts annotation tags on methods and signals.
1140
 
        """
1141
 
        xmlstring = dbus.service.Object.Introspect(self, object_path,
1142
 
                                                   connection)
1143
 
        try:
1144
 
            document = xml.dom.minidom.parseString(xmlstring)
1145
 
            
1146
 
            for if_tag in document.getElementsByTagName("interface"):
1147
 
                # Add annotation tags
1148
 
                for typ in ("method", "signal"):
1149
 
                    for tag in if_tag.getElementsByTagName(typ):
1150
 
                        annots = dict()
1151
 
                        for name, prop in (self.
1152
 
                                           _get_all_dbus_things(typ)):
1153
 
                            if (name == tag.getAttribute("name")
1154
 
                                and prop._dbus_interface
1155
 
                                == if_tag.getAttribute("name")):
1156
 
                                annots.update(getattr(
1157
 
                                    prop, "_dbus_annotations", {}))
1158
 
                        for name, value in annots.items():
1159
 
                            ann_tag = document.createElement(
1160
 
                                "annotation")
1161
 
                            ann_tag.setAttribute("name", name)
1162
 
                            ann_tag.setAttribute("value", value)
1163
 
                            tag.appendChild(ann_tag)
1164
 
                # Add interface annotation tags
1165
 
                for annotation, value in dict(
1166
 
                    itertools.chain.from_iterable(
1167
 
                        annotations().items()
1168
 
                        for name, annotations
1169
 
                        in self._get_all_dbus_things("interface")
1170
 
                        if name == if_tag.getAttribute("name")
1171
 
                        )).items():
1172
 
                    ann_tag = document.createElement("annotation")
1173
 
                    ann_tag.setAttribute("name", annotation)
1174
 
                    ann_tag.setAttribute("value", value)
1175
 
                    if_tag.appendChild(ann_tag)
1176
 
                # Fix argument name for the Introspect method itself
1177
 
                if (if_tag.getAttribute("name")
1178
 
                                == dbus.INTROSPECTABLE_IFACE):
1179
 
                    for cn in if_tag.getElementsByTagName("method"):
1180
 
                        if cn.getAttribute("name") == "Introspect":
1181
 
                            for arg in cn.getElementsByTagName("arg"):
1182
 
                                if (arg.getAttribute("direction")
1183
 
                                    == "out"):
1184
 
                                    arg.setAttribute("name",
1185
 
                                                     "xml_data")
1186
 
            xmlstring = document.toxml("utf-8")
1187
 
            document.unlink()
1188
 
        except (AttributeError, xml.dom.DOMException,
1189
 
                xml.parsers.expat.ExpatError) as error:
1190
 
            logger.error("Failed to override Introspection method",
1191
 
                         exc_info=error)
1192
 
        return xmlstring
1193
 
 
1194
 
 
1195
 
class DBusObjectWithProperties(DBusObjectWithAnnotations):
 
592
class DBusObjectWithProperties(dbus.service.Object):
1196
593
    """A D-Bus object with properties.
1197
 
    
 
594
 
1198
595
    Classes inheriting from this can use the dbus_service_property
1199
596
    decorator to expose methods as D-Bus properties.  It exposes the
1200
597
    standard Get(), Set(), and GetAll() methods on the D-Bus.
1201
598
    """
1202
599
    
 
600
    @staticmethod
 
601
    def _is_dbus_property(obj):
 
602
        return getattr(obj, "_dbus_is_property", False)
 
603
    
 
604
    def _get_all_dbus_properties(self):
 
605
        """Returns a generator of (name, attribute) pairs
 
606
        """
 
607
        return ((prop._dbus_name, prop)
 
608
                for name, prop in
 
609
                inspect.getmembers(self, self._is_dbus_property))
 
610
    
1203
611
    def _get_dbus_property(self, interface_name, property_name):
1204
612
        """Returns a bound method if one exists which is a D-Bus
1205
613
        property with the specified name and interface.
1206
614
        """
1207
 
        for cls in self.__class__.__mro__:
1208
 
            for name, value in inspect.getmembers(
1209
 
                    cls, self._is_dbus_thing("property")):
1210
 
                if (value._dbus_name == property_name
1211
 
                    and value._dbus_interface == interface_name):
1212
 
                    return value.__get__(self)
1213
 
        
 
615
        for name in (property_name,
 
616
                     property_name + "_dbus_property"):
 
617
            prop = getattr(self, name, None)
 
618
            if (prop is None
 
619
                or not self._is_dbus_property(prop)
 
620
                or prop._dbus_name != property_name
 
621
                or (interface_name and prop._dbus_interface
 
622
                    and interface_name != prop._dbus_interface)):
 
623
                continue
 
624
            return prop
1214
625
        # No such property
1215
 
        raise DBusPropertyNotFound("{}:{}.{}".format(
1216
 
            self.dbus_object_path, interface_name, property_name))
1217
 
    
1218
 
    @classmethod
1219
 
    def _get_all_interface_names(cls):
1220
 
        """Get a sequence of all interfaces supported by an object"""
1221
 
        return (name for name in set(getattr(getattr(x, attr),
1222
 
                                             "_dbus_interface", None)
1223
 
                                     for x in (inspect.getmro(cls))
1224
 
                                     for attr in dir(x))
1225
 
                if name is not None)
1226
 
    
1227
 
    @dbus.service.method(dbus.PROPERTIES_IFACE,
1228
 
                         in_signature="ss",
 
626
        raise DBusPropertyNotFound(self.dbus_object_path + ":"
 
627
                                   + interface_name + "."
 
628
                                   + property_name)
 
629
    
 
630
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
1229
631
                         out_signature="v")
1230
632
    def Get(self, interface_name, property_name):
1231
633
        """Standard D-Bus property Get() method, see D-Bus standard.
1249
651
            # The byte_arrays option is not supported yet on
1250
652
            # signatures other than "ay".
1251
653
            if prop._dbus_signature != "ay":
1252
 
                raise ValueError("Byte arrays not supported for non-"
1253
 
                                 "'ay' signature {!r}"
1254
 
                                 .format(prop._dbus_signature))
1255
 
            value = dbus.ByteArray(b''.join(chr(byte)
1256
 
                                            for byte in value))
 
654
                raise ValueError
 
655
            value = dbus.ByteArray(''.join(unichr(byte)
 
656
                                           for byte in value))
1257
657
        prop(value)
1258
658
    
1259
 
    @dbus.service.method(dbus.PROPERTIES_IFACE,
1260
 
                         in_signature="s",
 
659
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
1261
660
                         out_signature="a{sv}")
1262
661
    def GetAll(self, interface_name):
1263
662
        """Standard D-Bus property GetAll() method, see D-Bus
1264
663
        standard.
1265
 
        
 
664
 
1266
665
        Note: Will not include properties with access="write".
1267
666
        """
1268
 
        properties = {}
1269
 
        for name, prop in self._get_all_dbus_things("property"):
 
667
        all = {}
 
668
        for name, prop in self._get_all_dbus_properties():
1270
669
            if (interface_name
1271
670
                and interface_name != prop._dbus_interface):
1272
671
                # Interface non-empty but did not match
1276
675
                continue
1277
676
            value = prop()
1278
677
            if not hasattr(value, "variant_level"):
1279
 
                properties[name] = value
 
678
                all[name] = value
1280
679
                continue
1281
 
            properties[name] = type(value)(
1282
 
                value, variant_level = value.variant_level + 1)
1283
 
        return dbus.Dictionary(properties, signature="sv")
1284
 
    
1285
 
    @dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")
1286
 
    def PropertiesChanged(self, interface_name, changed_properties,
1287
 
                          invalidated_properties):
1288
 
        """Standard D-Bus PropertiesChanged() signal, see D-Bus
1289
 
        standard.
1290
 
        """
1291
 
        pass
 
680
            all[name] = type(value)(value, variant_level=
 
681
                                    value.variant_level+1)
 
682
        return dbus.Dictionary(all, signature="sv")
1292
683
    
1293
684
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1294
685
                         out_signature="s",
1295
686
                         path_keyword='object_path',
1296
687
                         connection_keyword='connection')
1297
688
    def Introspect(self, object_path, connection):
1298
 
        """Overloading of standard D-Bus method.
1299
 
        
1300
 
        Inserts property tags and interface annotation tags.
 
689
        """Standard D-Bus method, overloaded to insert property tags.
1301
690
        """
1302
 
        xmlstring = DBusObjectWithAnnotations.Introspect(self,
1303
 
                                                         object_path,
1304
 
                                                         connection)
 
691
        xmlstring = dbus.service.Object.Introspect(self, object_path,
 
692
                                                   connection)
1305
693
        try:
1306
694
            document = xml.dom.minidom.parseString(xmlstring)
1307
 
            
1308
695
            def make_tag(document, name, prop):
1309
696
                e = document.createElement("property")
1310
697
                e.setAttribute("name", name)
1311
698
                e.setAttribute("type", prop._dbus_signature)
1312
699
                e.setAttribute("access", prop._dbus_access)
1313
700
                return e
1314
 
            
1315
701
            for if_tag in document.getElementsByTagName("interface"):
1316
 
                # Add property tags
1317
702
                for tag in (make_tag(document, name, prop)
1318
703
                            for name, prop
1319
 
                            in self._get_all_dbus_things("property")
 
704
                            in self._get_all_dbus_properties()
1320
705
                            if prop._dbus_interface
1321
706
                            == if_tag.getAttribute("name")):
1322
707
                    if_tag.appendChild(tag)
1323
 
                # Add annotation tags for properties
1324
 
                for tag in if_tag.getElementsByTagName("property"):
1325
 
                    annots = dict()
1326
 
                    for name, prop in self._get_all_dbus_things(
1327
 
                            "property"):
1328
 
                        if (name == tag.getAttribute("name")
1329
 
                            and prop._dbus_interface
1330
 
                            == if_tag.getAttribute("name")):
1331
 
                            annots.update(getattr(
1332
 
                                prop, "_dbus_annotations", {}))
1333
 
                    for name, value in annots.items():
1334
 
                        ann_tag = document.createElement(
1335
 
                            "annotation")
1336
 
                        ann_tag.setAttribute("name", name)
1337
 
                        ann_tag.setAttribute("value", value)
1338
 
                        tag.appendChild(ann_tag)
1339
708
                # Add the names to the return values for the
1340
709
                # "org.freedesktop.DBus.Properties" methods
1341
710
                if (if_tag.getAttribute("name")
1356
725
        except (AttributeError, xml.dom.DOMException,
1357
726
                xml.parsers.expat.ExpatError) as error:
1358
727
            logger.error("Failed to override Introspection method",
1359
 
                         exc_info=error)
1360
 
        return xmlstring
1361
 
 
1362
 
try:
1363
 
    dbus.OBJECT_MANAGER_IFACE
1364
 
except AttributeError:
1365
 
    dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
1366
 
 
1367
 
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
1368
 
    """A D-Bus object with an ObjectManager.
1369
 
    
1370
 
    Classes inheriting from this exposes the standard
1371
 
    GetManagedObjects call and the InterfacesAdded and
1372
 
    InterfacesRemoved signals on the standard
1373
 
    "org.freedesktop.DBus.ObjectManager" interface.
1374
 
    
1375
 
    Note: No signals are sent automatically; they must be sent
1376
 
    manually.
1377
 
    """
1378
 
    @dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
1379
 
                         out_signature = "a{oa{sa{sv}}}")
1380
 
    def GetManagedObjects(self):
1381
 
        """This function must be overridden"""
1382
 
        raise NotImplementedError()
1383
 
    
1384
 
    @dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
1385
 
                         signature = "oa{sa{sv}}")
1386
 
    def InterfacesAdded(self, object_path, interfaces_and_properties):
1387
 
        pass
1388
 
    
1389
 
    @dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature = "oas")
1390
 
    def InterfacesRemoved(self, object_path, interfaces):
1391
 
        pass
1392
 
    
1393
 
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1394
 
                         out_signature = "s",
1395
 
                         path_keyword = 'object_path',
1396
 
                         connection_keyword = 'connection')
1397
 
    def Introspect(self, object_path, connection):
1398
 
        """Overloading of standard D-Bus method.
1399
 
        
1400
 
        Override return argument name of GetManagedObjects to be
1401
 
        "objpath_interfaces_and_properties"
1402
 
        """
1403
 
        xmlstring = DBusObjectWithAnnotations.Introspect(self,
1404
 
                                                         object_path,
1405
 
                                                         connection)
1406
 
        try:
1407
 
            document = xml.dom.minidom.parseString(xmlstring)
1408
 
            
1409
 
            for if_tag in document.getElementsByTagName("interface"):
1410
 
                # Fix argument name for the GetManagedObjects method
1411
 
                if (if_tag.getAttribute("name")
1412
 
                                == dbus.OBJECT_MANAGER_IFACE):
1413
 
                    for cn in if_tag.getElementsByTagName("method"):
1414
 
                        if (cn.getAttribute("name")
1415
 
                            == "GetManagedObjects"):
1416
 
                            for arg in cn.getElementsByTagName("arg"):
1417
 
                                if (arg.getAttribute("direction")
1418
 
                                    == "out"):
1419
 
                                    arg.setAttribute(
1420
 
                                        "name",
1421
 
                                        "objpath_interfaces"
1422
 
                                        "_and_properties")
1423
 
            xmlstring = document.toxml("utf-8")
1424
 
            document.unlink()
1425
 
        except (AttributeError, xml.dom.DOMException,
1426
 
                xml.parsers.expat.ExpatError) as error:
1427
 
            logger.error("Failed to override Introspection method",
1428
 
                         exc_info = error)
1429
 
        return xmlstring
1430
 
 
1431
 
def datetime_to_dbus(dt, variant_level=0):
1432
 
    """Convert a UTC datetime.datetime() to a D-Bus type."""
1433
 
    if dt is None:
1434
 
        return dbus.String("", variant_level = variant_level)
1435
 
    return dbus.String(dt.isoformat(), variant_level=variant_level)
1436
 
 
1437
 
 
1438
 
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
1439
 
    """A class decorator; applied to a subclass of
1440
 
    dbus.service.Object, it will add alternate D-Bus attributes with
1441
 
    interface names according to the "alt_interface_names" mapping.
1442
 
    Usage:
1443
 
    
1444
 
    @alternate_dbus_interfaces({"org.example.Interface":
1445
 
                                    "net.example.AlternateInterface"})
1446
 
    class SampleDBusObject(dbus.service.Object):
1447
 
        @dbus.service.method("org.example.Interface")
1448
 
        def SampleDBusMethod():
1449
 
            pass
1450
 
    
1451
 
    The above "SampleDBusMethod" on "SampleDBusObject" will be
1452
 
    reachable via two interfaces: "org.example.Interface" and
1453
 
    "net.example.AlternateInterface", the latter of which will have
1454
 
    its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
1455
 
    "true", unless "deprecate" is passed with a False value.
1456
 
    
1457
 
    This works for methods and signals, and also for D-Bus properties
1458
 
    (from DBusObjectWithProperties) and interfaces (from the
1459
 
    dbus_interface_annotations decorator).
1460
 
    """
1461
 
    
1462
 
    def wrapper(cls):
1463
 
        for orig_interface_name, alt_interface_name in (
1464
 
                alt_interface_names.items()):
1465
 
            attr = {}
1466
 
            interface_names = set()
1467
 
            # Go though all attributes of the class
1468
 
            for attrname, attribute in inspect.getmembers(cls):
1469
 
                # Ignore non-D-Bus attributes, and D-Bus attributes
1470
 
                # with the wrong interface name
1471
 
                if (not hasattr(attribute, "_dbus_interface")
1472
 
                    or not attribute._dbus_interface.startswith(
1473
 
                        orig_interface_name)):
1474
 
                    continue
1475
 
                # Create an alternate D-Bus interface name based on
1476
 
                # the current name
1477
 
                alt_interface = attribute._dbus_interface.replace(
1478
 
                    orig_interface_name, alt_interface_name)
1479
 
                interface_names.add(alt_interface)
1480
 
                # Is this a D-Bus signal?
1481
 
                if getattr(attribute, "_dbus_is_signal", False):
1482
 
                    if sys.version_info.major == 2:
1483
 
                        # Extract the original non-method undecorated
1484
 
                        # function by black magic
1485
 
                        nonmethod_func = (dict(
1486
 
                            zip(attribute.func_code.co_freevars,
1487
 
                                attribute.__closure__))
1488
 
                                          ["func"].cell_contents)
1489
 
                    else:
1490
 
                        nonmethod_func = attribute
1491
 
                    # Create a new, but exactly alike, function
1492
 
                    # object, and decorate it to be a new D-Bus signal
1493
 
                    # with the alternate D-Bus interface name
1494
 
                    if sys.version_info.major == 2:
1495
 
                        new_function = types.FunctionType(
1496
 
                            nonmethod_func.func_code,
1497
 
                            nonmethod_func.func_globals,
1498
 
                            nonmethod_func.func_name,
1499
 
                            nonmethod_func.func_defaults,
1500
 
                            nonmethod_func.func_closure)
1501
 
                    else:
1502
 
                        new_function = types.FunctionType(
1503
 
                            nonmethod_func.__code__,
1504
 
                            nonmethod_func.__globals__,
1505
 
                            nonmethod_func.__name__,
1506
 
                            nonmethod_func.__defaults__,
1507
 
                            nonmethod_func.__closure__)
1508
 
                    new_function = (dbus.service.signal(
1509
 
                        alt_interface,
1510
 
                        attribute._dbus_signature)(new_function))
1511
 
                    # Copy annotations, if any
1512
 
                    try:
1513
 
                        new_function._dbus_annotations = dict(
1514
 
                            attribute._dbus_annotations)
1515
 
                    except AttributeError:
1516
 
                        pass
1517
 
                    # Define a creator of a function to call both the
1518
 
                    # original and alternate functions, so both the
1519
 
                    # original and alternate signals gets sent when
1520
 
                    # the function is called
1521
 
                    def fixscope(func1, func2):
1522
 
                        """This function is a scope container to pass
1523
 
                        func1 and func2 to the "call_both" function
1524
 
                        outside of its arguments"""
1525
 
                        
1526
 
                        @functools.wraps(func2)
1527
 
                        def call_both(*args, **kwargs):
1528
 
                            """This function will emit two D-Bus
1529
 
                            signals by calling func1 and func2"""
1530
 
                            func1(*args, **kwargs)
1531
 
                            func2(*args, **kwargs)
1532
 
                        # Make wrapper function look like a D-Bus signal
1533
 
                        for name, attr in inspect.getmembers(func2):
1534
 
                            if name.startswith("_dbus_"):
1535
 
                                setattr(call_both, name, attr)
1536
 
                        
1537
 
                        return call_both
1538
 
                    # Create the "call_both" function and add it to
1539
 
                    # the class
1540
 
                    attr[attrname] = fixscope(attribute, new_function)
1541
 
                # Is this a D-Bus method?
1542
 
                elif getattr(attribute, "_dbus_is_method", False):
1543
 
                    # Create a new, but exactly alike, function
1544
 
                    # object.  Decorate it to be a new D-Bus method
1545
 
                    # with the alternate D-Bus interface name.  Add it
1546
 
                    # to the class.
1547
 
                    attr[attrname] = (
1548
 
                        dbus.service.method(
1549
 
                            alt_interface,
1550
 
                            attribute._dbus_in_signature,
1551
 
                            attribute._dbus_out_signature)
1552
 
                        (types.FunctionType(attribute.func_code,
1553
 
                                            attribute.func_globals,
1554
 
                                            attribute.func_name,
1555
 
                                            attribute.func_defaults,
1556
 
                                            attribute.func_closure)))
1557
 
                    # Copy annotations, if any
1558
 
                    try:
1559
 
                        attr[attrname]._dbus_annotations = dict(
1560
 
                            attribute._dbus_annotations)
1561
 
                    except AttributeError:
1562
 
                        pass
1563
 
                # Is this a D-Bus property?
1564
 
                elif getattr(attribute, "_dbus_is_property", False):
1565
 
                    # Create a new, but exactly alike, function
1566
 
                    # object, and decorate it to be a new D-Bus
1567
 
                    # property with the alternate D-Bus interface
1568
 
                    # name.  Add it to the class.
1569
 
                    attr[attrname] = (dbus_service_property(
1570
 
                        alt_interface, attribute._dbus_signature,
1571
 
                        attribute._dbus_access,
1572
 
                        attribute._dbus_get_args_options
1573
 
                        ["byte_arrays"])
1574
 
                                      (types.FunctionType(
1575
 
                                          attribute.func_code,
1576
 
                                          attribute.func_globals,
1577
 
                                          attribute.func_name,
1578
 
                                          attribute.func_defaults,
1579
 
                                          attribute.func_closure)))
1580
 
                    # Copy annotations, if any
1581
 
                    try:
1582
 
                        attr[attrname]._dbus_annotations = dict(
1583
 
                            attribute._dbus_annotations)
1584
 
                    except AttributeError:
1585
 
                        pass
1586
 
                # Is this a D-Bus interface?
1587
 
                elif getattr(attribute, "_dbus_is_interface", False):
1588
 
                    # Create a new, but exactly alike, function
1589
 
                    # object.  Decorate it to be a new D-Bus interface
1590
 
                    # with the alternate D-Bus interface name.  Add it
1591
 
                    # to the class.
1592
 
                    attr[attrname] = (
1593
 
                        dbus_interface_annotations(alt_interface)
1594
 
                        (types.FunctionType(attribute.func_code,
1595
 
                                            attribute.func_globals,
1596
 
                                            attribute.func_name,
1597
 
                                            attribute.func_defaults,
1598
 
                                            attribute.func_closure)))
1599
 
            if deprecate:
1600
 
                # Deprecate all alternate interfaces
1601
 
                iname="_AlternateDBusNames_interface_annotation{}"
1602
 
                for interface_name in interface_names:
1603
 
                    
1604
 
                    @dbus_interface_annotations(interface_name)
1605
 
                    def func(self):
1606
 
                        return { "org.freedesktop.DBus.Deprecated":
1607
 
                                 "true" }
1608
 
                    # Find an unused name
1609
 
                    for aname in (iname.format(i)
1610
 
                                  for i in itertools.count()):
1611
 
                        if aname not in attr:
1612
 
                            attr[aname] = func
1613
 
                            break
1614
 
            if interface_names:
1615
 
                # Replace the class with a new subclass of it with
1616
 
                # methods, signals, etc. as created above.
1617
 
                cls = type(b"{}Alternate".format(cls.__name__),
1618
 
                           (cls, ), attr)
1619
 
        return cls
1620
 
    
1621
 
    return wrapper
1622
 
 
1623
 
 
1624
 
@alternate_dbus_interfaces({"se.recompile.Mandos":
1625
 
                            "se.bsnet.fukt.Mandos"})
 
728
                         error)
 
729
        return xmlstring
 
730
 
 
731
 
1626
732
class ClientDBus(Client, DBusObjectWithProperties):
1627
733
    """A Client class using D-Bus
1628
734
    
1632
738
    """
1633
739
    
1634
740
    runtime_expansions = (Client.runtime_expansions
1635
 
                          + ("dbus_object_path", ))
1636
 
    
1637
 
    _interface = "se.recompile.Mandos.Client"
 
741
                          + ("dbus_object_path",))
1638
742
    
1639
743
    # dbus.service.Object doesn't use super(), so we can't either.
1640
744
    
1641
745
    def __init__(self, bus = None, *args, **kwargs):
 
746
        self._approvals_pending = 0
1642
747
        self.bus = bus
1643
748
        Client.__init__(self, *args, **kwargs)
1644
749
        # Only now, when this client is initialized, can it show up on
1645
750
        # the D-Bus
1646
 
        client_object_name = str(self.name).translate(
 
751
        client_object_name = unicode(self.name).translate(
1647
752
            {ord("."): ord("_"),
1648
753
             ord("-"): ord("_")})
1649
 
        self.dbus_object_path = dbus.ObjectPath(
1650
 
            "/clients/" + client_object_name)
 
754
        self.dbus_object_path = (dbus.ObjectPath
 
755
                                 ("/clients/" + client_object_name))
1651
756
        DBusObjectWithProperties.__init__(self, self.bus,
1652
757
                                          self.dbus_object_path)
1653
 
    
1654
 
    def notifychangeproperty(transform_func, dbus_name,
1655
 
                             type_func=lambda x: x,
1656
 
                             variant_level=1,
1657
 
                             invalidate_only=False,
1658
 
                             _interface=_interface):
1659
 
        """ Modify a variable so that it's a property which announces
1660
 
        its changes to DBus.
1661
 
        
1662
 
        transform_fun: Function that takes a value and a variant_level
1663
 
                       and transforms it to a D-Bus type.
1664
 
        dbus_name: D-Bus name of the variable
1665
 
        type_func: Function that transform the value before sending it
1666
 
                   to the D-Bus.  Default: no transform
1667
 
        variant_level: D-Bus variant level.  Default: 1
1668
 
        """
1669
 
        attrname = "_{}".format(dbus_name)
1670
 
        
1671
 
        def setter(self, value):
1672
 
            if hasattr(self, "dbus_object_path"):
1673
 
                if (not hasattr(self, attrname) or
1674
 
                    type_func(getattr(self, attrname, None))
1675
 
                    != type_func(value)):
1676
 
                    if invalidate_only:
1677
 
                        self.PropertiesChanged(
1678
 
                            _interface, dbus.Dictionary(),
1679
 
                            dbus.Array((dbus_name, )))
1680
 
                    else:
1681
 
                        dbus_value = transform_func(
1682
 
                            type_func(value),
1683
 
                            variant_level = variant_level)
1684
 
                        self.PropertyChanged(dbus.String(dbus_name),
1685
 
                                             dbus_value)
1686
 
                        self.PropertiesChanged(
1687
 
                            _interface,
1688
 
                            dbus.Dictionary({ dbus.String(dbus_name):
1689
 
                                              dbus_value }),
1690
 
                            dbus.Array())
1691
 
            setattr(self, attrname, value)
1692
 
        
1693
 
        return property(lambda self: getattr(self, attrname), setter)
1694
 
    
1695
 
    expires = notifychangeproperty(datetime_to_dbus, "Expires")
1696
 
    approvals_pending = notifychangeproperty(dbus.Boolean,
1697
 
                                             "ApprovalPending",
1698
 
                                             type_func = bool)
1699
 
    enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1700
 
    last_enabled = notifychangeproperty(datetime_to_dbus,
1701
 
                                        "LastEnabled")
1702
 
    checker = notifychangeproperty(
1703
 
        dbus.Boolean, "CheckerRunning",
1704
 
        type_func = lambda checker: checker is not None)
1705
 
    last_checked_ok = notifychangeproperty(datetime_to_dbus,
1706
 
                                           "LastCheckedOK")
1707
 
    last_checker_status = notifychangeproperty(dbus.Int16,
1708
 
                                               "LastCheckerStatus")
1709
 
    last_approval_request = notifychangeproperty(
1710
 
        datetime_to_dbus, "LastApprovalRequest")
1711
 
    approved_by_default = notifychangeproperty(dbus.Boolean,
1712
 
                                               "ApprovedByDefault")
1713
 
    approval_delay = notifychangeproperty(
1714
 
        dbus.UInt64, "ApprovalDelay",
1715
 
        type_func = lambda td: td.total_seconds() * 1000)
1716
 
    approval_duration = notifychangeproperty(
1717
 
        dbus.UInt64, "ApprovalDuration",
1718
 
        type_func = lambda td: td.total_seconds() * 1000)
1719
 
    host = notifychangeproperty(dbus.String, "Host")
1720
 
    timeout = notifychangeproperty(
1721
 
        dbus.UInt64, "Timeout",
1722
 
        type_func = lambda td: td.total_seconds() * 1000)
1723
 
    extended_timeout = notifychangeproperty(
1724
 
        dbus.UInt64, "ExtendedTimeout",
1725
 
        type_func = lambda td: td.total_seconds() * 1000)
1726
 
    interval = notifychangeproperty(
1727
 
        dbus.UInt64, "Interval",
1728
 
        type_func = lambda td: td.total_seconds() * 1000)
1729
 
    checker_command = notifychangeproperty(dbus.String, "Checker")
1730
 
    secret = notifychangeproperty(dbus.ByteArray, "Secret",
1731
 
                                  invalidate_only=True)
1732
 
    
1733
 
    del notifychangeproperty
 
758
        
 
759
    def _get_approvals_pending(self):
 
760
        return self._approvals_pending
 
761
    def _set_approvals_pending(self, value):
 
762
        old_value = self._approvals_pending
 
763
        self._approvals_pending = value
 
764
        bval = bool(value)
 
765
        if (hasattr(self, "dbus_object_path")
 
766
            and bval is not bool(old_value)):
 
767
            dbus_bool = dbus.Boolean(bval, variant_level=1)
 
768
            self.PropertyChanged(dbus.String("ApprovalPending"),
 
769
                                 dbus_bool)
 
770
 
 
771
    approvals_pending = property(_get_approvals_pending,
 
772
                                 _set_approvals_pending)
 
773
    del _get_approvals_pending, _set_approvals_pending
 
774
    
 
775
    @staticmethod
 
776
    def _datetime_to_dbus(dt, variant_level=0):
 
777
        """Convert a UTC datetime.datetime() to a D-Bus type."""
 
778
        return dbus.String(dt.isoformat(),
 
779
                           variant_level=variant_level)
 
780
    
 
781
    def enable(self):
 
782
        oldstate = getattr(self, "enabled", False)
 
783
        r = Client.enable(self)
 
784
        if oldstate != self.enabled:
 
785
            # Emit D-Bus signals
 
786
            self.PropertyChanged(dbus.String("Enabled"),
 
787
                                 dbus.Boolean(True, variant_level=1))
 
788
            self.PropertyChanged(
 
789
                dbus.String("LastEnabled"),
 
790
                self._datetime_to_dbus(self.last_enabled,
 
791
                                       variant_level=1))
 
792
        return r
 
793
    
 
794
    def disable(self, quiet = False):
 
795
        oldstate = getattr(self, "enabled", False)
 
796
        r = Client.disable(self, quiet=quiet)
 
797
        if not quiet and oldstate != self.enabled:
 
798
            # Emit D-Bus signal
 
799
            self.PropertyChanged(dbus.String("Enabled"),
 
800
                                 dbus.Boolean(False, variant_level=1))
 
801
        return r
1734
802
    
1735
803
    def __del__(self, *args, **kwargs):
1736
804
        try:
1741
809
            DBusObjectWithProperties.__del__(self, *args, **kwargs)
1742
810
        Client.__del__(self, *args, **kwargs)
1743
811
    
1744
 
    def checker_callback(self, source, condition,
1745
 
                         connection, command, *args, **kwargs):
1746
 
        ret = Client.checker_callback(self, source, condition,
1747
 
                                      connection, command, *args,
1748
 
                                      **kwargs)
1749
 
        exitstatus = self.last_checker_status
1750
 
        if exitstatus >= 0:
 
812
    def checker_callback(self, pid, condition, command,
 
813
                         *args, **kwargs):
 
814
        self.checker_callback_tag = None
 
815
        self.checker = None
 
816
        # Emit D-Bus signal
 
817
        self.PropertyChanged(dbus.String("CheckerRunning"),
 
818
                             dbus.Boolean(False, variant_level=1))
 
819
        if os.WIFEXITED(condition):
 
820
            exitstatus = os.WEXITSTATUS(condition)
1751
821
            # Emit D-Bus signal
1752
822
            self.CheckerCompleted(dbus.Int16(exitstatus),
1753
 
                                  # This is specific to GNU libC
1754
 
                                  dbus.Int64(exitstatus << 8),
 
823
                                  dbus.Int64(condition),
1755
824
                                  dbus.String(command))
1756
825
        else:
1757
826
            # Emit D-Bus signal
1758
827
            self.CheckerCompleted(dbus.Int16(-1),
1759
 
                                  dbus.Int64(
1760
 
                                      # This is specific to GNU libC
1761
 
                                      (exitstatus << 8)
1762
 
                                      | self.last_checker_signal),
 
828
                                  dbus.Int64(condition),
1763
829
                                  dbus.String(command))
1764
 
        return ret
 
830
        
 
831
        return Client.checker_callback(self, pid, condition, command,
 
832
                                       *args, **kwargs)
 
833
    
 
834
    def checked_ok(self, *args, **kwargs):
 
835
        Client.checked_ok(self, *args, **kwargs)
 
836
        # Emit D-Bus signal
 
837
        self.PropertyChanged(
 
838
            dbus.String("LastCheckedOK"),
 
839
            (self._datetime_to_dbus(self.last_checked_ok,
 
840
                                    variant_level=1)))
 
841
    
 
842
    def need_approval(self, *args, **kwargs):
 
843
        r = Client.need_approval(self, *args, **kwargs)
 
844
        # Emit D-Bus signal
 
845
        self.PropertyChanged(
 
846
            dbus.String("LastApprovalRequest"),
 
847
            (self._datetime_to_dbus(self.last_approval_request,
 
848
                                    variant_level=1)))
 
849
        return r
1765
850
    
1766
851
    def start_checker(self, *args, **kwargs):
1767
 
        old_checker_pid = getattr(self.checker, "pid", None)
 
852
        old_checker = self.checker
 
853
        if self.checker is not None:
 
854
            old_checker_pid = self.checker.pid
 
855
        else:
 
856
            old_checker_pid = None
1768
857
        r = Client.start_checker(self, *args, **kwargs)
1769
858
        # Only if new checker process was started
1770
859
        if (self.checker is not None
1771
860
            and old_checker_pid != self.checker.pid):
1772
861
            # Emit D-Bus signal
1773
862
            self.CheckerStarted(self.current_checker_command)
 
863
            self.PropertyChanged(
 
864
                dbus.String("CheckerRunning"),
 
865
                dbus.Boolean(True, variant_level=1))
1774
866
        return r
1775
867
    
 
868
    def stop_checker(self, *args, **kwargs):
 
869
        old_checker = getattr(self, "checker", None)
 
870
        r = Client.stop_checker(self, *args, **kwargs)
 
871
        if (old_checker is not None
 
872
            and getattr(self, "checker", None) is None):
 
873
            self.PropertyChanged(dbus.String("CheckerRunning"),
 
874
                                 dbus.Boolean(False, variant_level=1))
 
875
        return r
 
876
 
1776
877
    def _reset_approved(self):
1777
 
        self.approved = None
 
878
        self._approved = None
1778
879
        return False
1779
880
    
1780
881
    def approve(self, value=True):
1781
 
        self.approved = value
1782
 
        gobject.timeout_add(int(self.approval_duration.total_seconds()
1783
 
                                * 1000), self._reset_approved)
1784
882
        self.send_changedstate()
 
883
        self._approved = value
 
884
        gobject.timeout_add(self._timedelta_to_milliseconds
 
885
                            (self.approval_duration),
 
886
                            self._reset_approved)
 
887
    
1785
888
    
1786
889
    ## D-Bus methods, signals & properties
1787
 
    
1788
 
    ## Interfaces
 
890
    _interface = "se.bsnet.fukt.Mandos.Client"
1789
891
    
1790
892
    ## Signals
1791
893
    
1802
904
        pass
1803
905
    
1804
906
    # PropertyChanged - signal
1805
 
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1806
907
    @dbus.service.signal(_interface, signature="sv")
1807
908
    def PropertyChanged(self, property, value):
1808
909
        "D-Bus signal"
1842
943
        self.checked_ok()
1843
944
    
1844
945
    # Enable - method
1845
 
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1846
946
    @dbus.service.method(_interface)
1847
947
    def Enable(self):
1848
948
        "D-Bus method"
1849
949
        self.enable()
1850
950
    
1851
951
    # StartChecker - method
1852
 
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1853
952
    @dbus.service.method(_interface)
1854
953
    def StartChecker(self):
1855
954
        "D-Bus method"
1856
955
        self.start_checker()
1857
956
    
1858
957
    # Disable - method
1859
 
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1860
958
    @dbus.service.method(_interface)
1861
959
    def Disable(self):
1862
960
        "D-Bus method"
1863
961
        self.disable()
1864
962
    
1865
963
    # StopChecker - method
1866
 
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1867
964
    @dbus.service.method(_interface)
1868
965
    def StopChecker(self):
1869
966
        self.stop_checker()
1876
973
        return dbus.Boolean(bool(self.approvals_pending))
1877
974
    
1878
975
    # ApprovedByDefault - property
1879
 
    @dbus_service_property(_interface,
1880
 
                           signature="b",
 
976
    @dbus_service_property(_interface, signature="b",
1881
977
                           access="readwrite")
1882
978
    def ApprovedByDefault_dbus_property(self, value=None):
1883
979
        if value is None:       # get
1884
980
            return dbus.Boolean(self.approved_by_default)
1885
981
        self.approved_by_default = bool(value)
 
982
        # Emit D-Bus signal
 
983
        self.PropertyChanged(dbus.String("ApprovedByDefault"),
 
984
                             dbus.Boolean(value, variant_level=1))
1886
985
    
1887
986
    # ApprovalDelay - property
1888
 
    @dbus_service_property(_interface,
1889
 
                           signature="t",
 
987
    @dbus_service_property(_interface, signature="t",
1890
988
                           access="readwrite")
1891
989
    def ApprovalDelay_dbus_property(self, value=None):
1892
990
        if value is None:       # get
1893
 
            return dbus.UInt64(self.approval_delay.total_seconds()
1894
 
                               * 1000)
 
991
            return dbus.UInt64(self.approval_delay_milliseconds())
1895
992
        self.approval_delay = datetime.timedelta(0, 0, 0, value)
 
993
        # Emit D-Bus signal
 
994
        self.PropertyChanged(dbus.String("ApprovalDelay"),
 
995
                             dbus.UInt64(value, variant_level=1))
1896
996
    
1897
997
    # ApprovalDuration - property
1898
 
    @dbus_service_property(_interface,
1899
 
                           signature="t",
 
998
    @dbus_service_property(_interface, signature="t",
1900
999
                           access="readwrite")
1901
1000
    def ApprovalDuration_dbus_property(self, value=None):
1902
1001
        if value is None:       # get
1903
 
            return dbus.UInt64(self.approval_duration.total_seconds()
1904
 
                               * 1000)
 
1002
            return dbus.UInt64(self._timedelta_to_milliseconds(
 
1003
                    self.approval_duration))
1905
1004
        self.approval_duration = datetime.timedelta(0, 0, 0, value)
 
1005
        # Emit D-Bus signal
 
1006
        self.PropertyChanged(dbus.String("ApprovalDuration"),
 
1007
                             dbus.UInt64(value, variant_level=1))
1906
1008
    
1907
1009
    # Name - property
1908
 
    @dbus_annotations(
1909
 
        {"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1910
1010
    @dbus_service_property(_interface, signature="s", access="read")
1911
1011
    def Name_dbus_property(self):
1912
1012
        return dbus.String(self.name)
1913
1013
    
1914
1014
    # Fingerprint - property
1915
 
    @dbus_annotations(
1916
 
        {"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1917
1015
    @dbus_service_property(_interface, signature="s", access="read")
1918
1016
    def Fingerprint_dbus_property(self):
1919
1017
        return dbus.String(self.fingerprint)
1920
1018
    
1921
1019
    # Host - property
1922
 
    @dbus_service_property(_interface,
1923
 
                           signature="s",
 
1020
    @dbus_service_property(_interface, signature="s",
1924
1021
                           access="readwrite")
1925
1022
    def Host_dbus_property(self, value=None):
1926
1023
        if value is None:       # get
1927
1024
            return dbus.String(self.host)
1928
 
        self.host = str(value)
 
1025
        self.host = value
 
1026
        # Emit D-Bus signal
 
1027
        self.PropertyChanged(dbus.String("Host"),
 
1028
                             dbus.String(value, variant_level=1))
1929
1029
    
1930
1030
    # Created - property
1931
 
    @dbus_annotations(
1932
 
        {"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1933
1031
    @dbus_service_property(_interface, signature="s", access="read")
1934
1032
    def Created_dbus_property(self):
1935
 
        return datetime_to_dbus(self.created)
 
1033
        return dbus.String(self._datetime_to_dbus(self.created))
1936
1034
    
1937
1035
    # LastEnabled - property
1938
1036
    @dbus_service_property(_interface, signature="s", access="read")
1939
1037
    def LastEnabled_dbus_property(self):
1940
 
        return datetime_to_dbus(self.last_enabled)
 
1038
        if self.last_enabled is None:
 
1039
            return dbus.String("")
 
1040
        return dbus.String(self._datetime_to_dbus(self.last_enabled))
1941
1041
    
1942
1042
    # Enabled - property
1943
 
    @dbus_service_property(_interface,
1944
 
                           signature="b",
 
1043
    @dbus_service_property(_interface, signature="b",
1945
1044
                           access="readwrite")
1946
1045
    def Enabled_dbus_property(self, value=None):
1947
1046
        if value is None:       # get
1952
1051
            self.disable()
1953
1052
    
1954
1053
    # LastCheckedOK - property
1955
 
    @dbus_service_property(_interface,
1956
 
                           signature="s",
 
1054
    @dbus_service_property(_interface, signature="s",
1957
1055
                           access="readwrite")
1958
1056
    def LastCheckedOK_dbus_property(self, value=None):
1959
1057
        if value is not None:
1960
1058
            self.checked_ok()
1961
1059
            return
1962
 
        return datetime_to_dbus(self.last_checked_ok)
1963
 
    
1964
 
    # LastCheckerStatus - property
1965
 
    @dbus_service_property(_interface, signature="n", access="read")
1966
 
    def LastCheckerStatus_dbus_property(self):
1967
 
        return dbus.Int16(self.last_checker_status)
1968
 
    
1969
 
    # Expires - property
1970
 
    @dbus_service_property(_interface, signature="s", access="read")
1971
 
    def Expires_dbus_property(self):
1972
 
        return datetime_to_dbus(self.expires)
 
1060
        if self.last_checked_ok is None:
 
1061
            return dbus.String("")
 
1062
        return dbus.String(self._datetime_to_dbus(self
 
1063
                                                  .last_checked_ok))
1973
1064
    
1974
1065
    # LastApprovalRequest - property
1975
1066
    @dbus_service_property(_interface, signature="s", access="read")
1976
1067
    def LastApprovalRequest_dbus_property(self):
1977
 
        return datetime_to_dbus(self.last_approval_request)
 
1068
        if self.last_approval_request is None:
 
1069
            return dbus.String("")
 
1070
        return dbus.String(self.
 
1071
                           _datetime_to_dbus(self
 
1072
                                             .last_approval_request))
1978
1073
    
1979
1074
    # Timeout - property
1980
 
    @dbus_service_property(_interface,
1981
 
                           signature="t",
 
1075
    @dbus_service_property(_interface, signature="t",
1982
1076
                           access="readwrite")
1983
1077
    def Timeout_dbus_property(self, value=None):
1984
1078
        if value is None:       # get
1985
 
            return dbus.UInt64(self.timeout.total_seconds() * 1000)
1986
 
        old_timeout = self.timeout
 
1079
            return dbus.UInt64(self.timeout_milliseconds())
1987
1080
        self.timeout = datetime.timedelta(0, 0, 0, value)
1988
 
        # Reschedule disabling
1989
 
        if self.enabled:
1990
 
            now = datetime.datetime.utcnow()
1991
 
            self.expires += self.timeout - old_timeout
1992
 
            if self.expires <= now:
1993
 
                # The timeout has passed
1994
 
                self.disable()
1995
 
            else:
1996
 
                if (getattr(self, "disable_initiator_tag", None)
1997
 
                    is None):
1998
 
                    return
1999
 
                gobject.source_remove(self.disable_initiator_tag)
2000
 
                self.disable_initiator_tag = gobject.timeout_add(
2001
 
                    int((self.expires - now).total_seconds() * 1000),
2002
 
                    self.disable)
2003
 
    
2004
 
    # ExtendedTimeout - property
2005
 
    @dbus_service_property(_interface,
2006
 
                           signature="t",
2007
 
                           access="readwrite")
2008
 
    def ExtendedTimeout_dbus_property(self, value=None):
2009
 
        if value is None:       # get
2010
 
            return dbus.UInt64(self.extended_timeout.total_seconds()
2011
 
                               * 1000)
2012
 
        self.extended_timeout = datetime.timedelta(0, 0, 0, value)
 
1081
        # Emit D-Bus signal
 
1082
        self.PropertyChanged(dbus.String("Timeout"),
 
1083
                             dbus.UInt64(value, variant_level=1))
 
1084
        if getattr(self, "disable_initiator_tag", None) is None:
 
1085
            return
 
1086
        # Reschedule timeout
 
1087
        gobject.source_remove(self.disable_initiator_tag)
 
1088
        self.disable_initiator_tag = None
 
1089
        time_to_die = (self.
 
1090
                       _timedelta_to_milliseconds((self
 
1091
                                                   .last_checked_ok
 
1092
                                                   + self.timeout)
 
1093
                                                  - datetime.datetime
 
1094
                                                  .utcnow()))
 
1095
        if time_to_die <= 0:
 
1096
            # The timeout has passed
 
1097
            self.disable()
 
1098
        else:
 
1099
            self.disable_initiator_tag = (gobject.timeout_add
 
1100
                                          (time_to_die, self.disable))
2013
1101
    
2014
1102
    # Interval - property
2015
 
    @dbus_service_property(_interface,
2016
 
                           signature="t",
 
1103
    @dbus_service_property(_interface, signature="t",
2017
1104
                           access="readwrite")
2018
1105
    def Interval_dbus_property(self, value=None):
2019
1106
        if value is None:       # get
2020
 
            return dbus.UInt64(self.interval.total_seconds() * 1000)
 
1107
            return dbus.UInt64(self.interval_milliseconds())
2021
1108
        self.interval = datetime.timedelta(0, 0, 0, value)
 
1109
        # Emit D-Bus signal
 
1110
        self.PropertyChanged(dbus.String("Interval"),
 
1111
                             dbus.UInt64(value, variant_level=1))
2022
1112
        if getattr(self, "checker_initiator_tag", None) is None:
2023
1113
            return
2024
 
        if self.enabled:
2025
 
            # Reschedule checker run
2026
 
            gobject.source_remove(self.checker_initiator_tag)
2027
 
            self.checker_initiator_tag = gobject.timeout_add(
2028
 
                value, self.start_checker)
2029
 
            self.start_checker() # Start one now, too
2030
 
    
 
1114
        # Reschedule checker run
 
1115
        gobject.source_remove(self.checker_initiator_tag)
 
1116
        self.checker_initiator_tag = (gobject.timeout_add
 
1117
                                      (value, self.start_checker))
 
1118
        self.start_checker()    # Start one now, too
 
1119
 
2031
1120
    # Checker - property
2032
 
    @dbus_service_property(_interface,
2033
 
                           signature="s",
 
1121
    @dbus_service_property(_interface, signature="s",
2034
1122
                           access="readwrite")
2035
1123
    def Checker_dbus_property(self, value=None):
2036
1124
        if value is None:       # get
2037
1125
            return dbus.String(self.checker_command)
2038
 
        self.checker_command = str(value)
 
1126
        self.checker_command = value
 
1127
        # Emit D-Bus signal
 
1128
        self.PropertyChanged(dbus.String("Checker"),
 
1129
                             dbus.String(self.checker_command,
 
1130
                                         variant_level=1))
2039
1131
    
2040
1132
    # CheckerRunning - property
2041
 
    @dbus_service_property(_interface,
2042
 
                           signature="b",
 
1133
    @dbus_service_property(_interface, signature="b",
2043
1134
                           access="readwrite")
2044
1135
    def CheckerRunning_dbus_property(self, value=None):
2045
1136
        if value is None:       # get
2050
1141
            self.stop_checker()
2051
1142
    
2052
1143
    # ObjectPath - property
2053
 
    @dbus_annotations(
2054
 
        {"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",
2055
 
         "org.freedesktop.DBus.Deprecated": "true"})
2056
1144
    @dbus_service_property(_interface, signature="o", access="read")
2057
1145
    def ObjectPath_dbus_property(self):
2058
1146
        return self.dbus_object_path # is already a dbus.ObjectPath
2059
1147
    
2060
1148
    # Secret = property
2061
 
    @dbus_annotations(
2062
 
        {"org.freedesktop.DBus.Property.EmitsChangedSignal":
2063
 
         "invalidates"})
2064
 
    @dbus_service_property(_interface,
2065
 
                           signature="ay",
2066
 
                           access="write",
2067
 
                           byte_arrays=True)
 
1149
    @dbus_service_property(_interface, signature="ay",
 
1150
                           access="write", byte_arrays=True)
2068
1151
    def Secret_dbus_property(self, value):
2069
 
        self.secret = bytes(value)
 
1152
        self.secret = str(value)
2070
1153
    
2071
1154
    del _interface
2072
1155
 
2076
1159
        self._pipe = child_pipe
2077
1160
        self._pipe.send(('init', fpr, address))
2078
1161
        if not self._pipe.recv():
2079
 
            raise KeyError(fpr)
2080
 
    
 
1162
            raise KeyError()
 
1163
 
2081
1164
    def __getattribute__(self, name):
2082
 
        if name == '_pipe':
 
1165
        if(name == '_pipe'):
2083
1166
            return super(ProxyClient, self).__getattribute__(name)
2084
1167
        self._pipe.send(('getattr', name))
2085
1168
        data = self._pipe.recv()
2086
1169
        if data[0] == 'data':
2087
1170
            return data[1]
2088
1171
        if data[0] == 'function':
2089
 
            
2090
1172
            def func(*args, **kwargs):
2091
1173
                self._pipe.send(('funcall', name, args, kwargs))
2092
1174
                return self._pipe.recv()[1]
2093
 
            
2094
1175
            return func
2095
 
    
 
1176
 
2096
1177
    def __setattr__(self, name, value):
2097
 
        if name == '_pipe':
 
1178
        if(name == '_pipe'):
2098
1179
            return super(ProxyClient, self).__setattr__(name, value)
2099
1180
        self._pipe.send(('setattr', name, value))
2100
1181
 
2108
1189
    def handle(self):
2109
1190
        with contextlib.closing(self.server.child_pipe) as child_pipe:
2110
1191
            logger.info("TCP connection from: %s",
2111
 
                        str(self.client_address))
 
1192
                        unicode(self.client_address))
2112
1193
            logger.debug("Pipe FD: %d",
2113
1194
                         self.server.child_pipe.fileno())
2114
 
            
2115
 
            session = gnutls.ClientSession(self.request)
2116
 
            
 
1195
 
 
1196
            session = (gnutls.connection
 
1197
                       .ClientSession(self.request,
 
1198
                                      gnutls.connection
 
1199
                                      .X509Credentials()))
 
1200
 
 
1201
            # Note: gnutls.connection.X509Credentials is really a
 
1202
            # generic GnuTLS certificate credentials object so long as
 
1203
            # no X.509 keys are added to it.  Therefore, we can use it
 
1204
            # here despite using OpenPGP certificates.
 
1205
 
2117
1206
            #priority = ':'.join(("NONE", "+VERS-TLS1.1",
2118
1207
            #                      "+AES-256-CBC", "+SHA1",
2119
1208
            #                      "+COMP-NULL", "+CTYPE-OPENPGP",
2122
1211
            priority = self.server.gnutls_priority
2123
1212
            if priority is None:
2124
1213
                priority = "NORMAL"
2125
 
            gnutls.priority_set_direct(session._c_object, priority,
2126
 
                                       None)
2127
 
            
 
1214
            (gnutls.library.functions
 
1215
             .gnutls_priority_set_direct(session._c_object,
 
1216
                                         priority, None))
 
1217
 
2128
1218
            # Start communication using the Mandos protocol
2129
1219
            # Get protocol number
2130
1220
            line = self.request.makefile().readline()
2131
1221
            logger.debug("Protocol version: %r", line)
2132
1222
            try:
2133
1223
                if int(line.strip().split()[0]) > 1:
2134
 
                    raise RuntimeError(line)
 
1224
                    raise RuntimeError
2135
1225
            except (ValueError, IndexError, RuntimeError) as error:
2136
1226
                logger.error("Unknown protocol version: %s", error)
2137
1227
                return
2138
 
            
 
1228
 
2139
1229
            # Start GnuTLS connection
2140
1230
            try:
2141
1231
                session.handshake()
2142
 
            except gnutls.Error as error:
 
1232
            except gnutls.errors.GNUTLSError as error:
2143
1233
                logger.warning("Handshake failed: %s", error)
2144
1234
                # Do not run session.bye() here: the session is not
2145
1235
                # established.  Just abandon the request.
2146
1236
                return
2147
1237
            logger.debug("Handshake succeeded")
2148
 
            
 
1238
 
2149
1239
            approval_required = False
2150
1240
            try:
2151
1241
                try:
2152
 
                    fpr = self.fingerprint(
2153
 
                        self.peer_certificate(session))
2154
 
                except (TypeError, gnutls.Error) as error:
 
1242
                    fpr = self.fingerprint(self.peer_certificate
 
1243
                                           (session))
 
1244
                except (TypeError,
 
1245
                        gnutls.errors.GNUTLSError) as error:
2155
1246
                    logger.warning("Bad certificate: %s", error)
2156
1247
                    return
2157
1248
                logger.debug("Fingerprint: %s", fpr)
2158
 
                
 
1249
 
2159
1250
                try:
2160
1251
                    client = ProxyClient(child_pipe, fpr,
2161
1252
                                         self.client_address)
2169
1260
                
2170
1261
                while True:
2171
1262
                    if not client.enabled:
2172
 
                        logger.info("Client %s is disabled",
2173
 
                                    client.name)
 
1263
                        logger.warning("Client %s is disabled",
 
1264
                                       client.name)
2174
1265
                        if self.server.use_dbus:
2175
1266
                            # Emit D-Bus signal
2176
 
                            client.Rejected("Disabled")
 
1267
                            client.Rejected("Disabled")                    
2177
1268
                        return
2178
1269
                    
2179
 
                    if client.approved or not client.approval_delay:
 
1270
                    if client._approved or not client.approval_delay:
2180
1271
                        #We are approved or approval is disabled
2181
1272
                        break
2182
 
                    elif client.approved is None:
 
1273
                    elif client._approved is None:
2183
1274
                        logger.info("Client %s needs approval",
2184
1275
                                    client.name)
2185
1276
                        if self.server.use_dbus:
2186
1277
                            # Emit D-Bus signal
2187
1278
                            client.NeedApproval(
2188
 
                                client.approval_delay.total_seconds()
2189
 
                                * 1000, client.approved_by_default)
 
1279
                                client.approval_delay_milliseconds(),
 
1280
                                client.approved_by_default)
2190
1281
                    else:
2191
1282
                        logger.warning("Client %s was not approved",
2192
1283
                                       client.name)
2196
1287
                        return
2197
1288
                    
2198
1289
                    #wait until timeout or approved
 
1290
                    #x = float(client._timedelta_to_milliseconds(delay))
2199
1291
                    time = datetime.datetime.now()
2200
1292
                    client.changedstate.acquire()
2201
 
                    client.changedstate.wait(delay.total_seconds())
 
1293
                    client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))
2202
1294
                    client.changedstate.release()
2203
1295
                    time2 = datetime.datetime.now()
2204
1296
                    if (time2 - time) >= delay:
2219
1311
                while sent_size < len(client.secret):
2220
1312
                    try:
2221
1313
                        sent = session.send(client.secret[sent_size:])
2222
 
                    except gnutls.Error as error:
2223
 
                        logger.warning("gnutls send failed",
2224
 
                                       exc_info=error)
 
1314
                    except gnutls.errors.GNUTLSError as error:
 
1315
                        logger.warning("gnutls send failed")
2225
1316
                        return
2226
 
                    logger.debug("Sent: %d, remaining: %d", sent,
2227
 
                                 len(client.secret) - (sent_size
2228
 
                                                       + sent))
 
1317
                    logger.debug("Sent: %d, remaining: %d",
 
1318
                                 sent, len(client.secret)
 
1319
                                 - (sent_size + sent))
2229
1320
                    sent_size += sent
2230
 
                
 
1321
 
2231
1322
                logger.info("Sending secret to %s", client.name)
2232
 
                # bump the timeout using extended_timeout
2233
 
                client.bump_timeout(client.extended_timeout)
 
1323
                # bump the timeout as if seen
 
1324
                client.checked_ok()
2234
1325
                if self.server.use_dbus:
2235
1326
                    # Emit D-Bus signal
2236
1327
                    client.GotSecret()
2240
1331
                    client.approvals_pending -= 1
2241
1332
                try:
2242
1333
                    session.bye()
2243
 
                except gnutls.Error as error:
2244
 
                    logger.warning("GnuTLS bye failed",
2245
 
                                   exc_info=error)
 
1334
                except gnutls.errors.GNUTLSError as error:
 
1335
                    logger.warning("GnuTLS bye failed")
2246
1336
    
2247
1337
    @staticmethod
2248
1338
    def peer_certificate(session):
2249
1339
        "Return the peer's OpenPGP certificate as a bytestring"
2250
1340
        # If not an OpenPGP certificate...
2251
 
        if (gnutls.certificate_type_get(session._c_object)
2252
 
            != gnutls.CRT_OPENPGP):
2253
 
            # ...return invalid data
2254
 
            return b""
 
1341
        if (gnutls.library.functions
 
1342
            .gnutls_certificate_type_get(session._c_object)
 
1343
            != gnutls.library.constants.GNUTLS_CRT_OPENPGP):
 
1344
            # ...do the normal thing
 
1345
            return session.peer_certificate
2255
1346
        list_size = ctypes.c_uint(1)
2256
 
        cert_list = (gnutls.certificate_get_peers
 
1347
        cert_list = (gnutls.library.functions
 
1348
                     .gnutls_certificate_get_peers
2257
1349
                     (session._c_object, ctypes.byref(list_size)))
2258
1350
        if not bool(cert_list) and list_size.value != 0:
2259
 
            raise gnutls.Error("error getting peer certificate")
 
1351
            raise gnutls.errors.GNUTLSError("error getting peer"
 
1352
                                            " certificate")
2260
1353
        if list_size.value == 0:
2261
1354
            return None
2262
1355
        cert = cert_list[0]
2266
1359
    def fingerprint(openpgp):
2267
1360
        "Convert an OpenPGP bytestring to a hexdigit fingerprint"
2268
1361
        # New GnuTLS "datum" with the OpenPGP public key
2269
 
        datum = gnutls.datum_t(
2270
 
            ctypes.cast(ctypes.c_char_p(openpgp),
2271
 
                        ctypes.POINTER(ctypes.c_ubyte)),
2272
 
            ctypes.c_uint(len(openpgp)))
 
1362
        datum = (gnutls.library.types
 
1363
                 .gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
 
1364
                                             ctypes.POINTER
 
1365
                                             (ctypes.c_ubyte)),
 
1366
                                 ctypes.c_uint(len(openpgp))))
2273
1367
        # New empty GnuTLS certificate
2274
 
        crt = gnutls.openpgp_crt_t()
2275
 
        gnutls.openpgp_crt_init(ctypes.byref(crt))
 
1368
        crt = gnutls.library.types.gnutls_openpgp_crt_t()
 
1369
        (gnutls.library.functions
 
1370
         .gnutls_openpgp_crt_init(ctypes.byref(crt)))
2276
1371
        # Import the OpenPGP public key into the certificate
2277
 
        gnutls.openpgp_crt_import(crt, ctypes.byref(datum),
2278
 
                                  gnutls.OPENPGP_FMT_RAW)
 
1372
        (gnutls.library.functions
 
1373
         .gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
 
1374
                                    gnutls.library.constants
 
1375
                                    .GNUTLS_OPENPGP_FMT_RAW))
2279
1376
        # Verify the self signature in the key
2280
1377
        crtverify = ctypes.c_uint()
2281
 
        gnutls.openpgp_crt_verify_self(crt, 0,
2282
 
                                       ctypes.byref(crtverify))
 
1378
        (gnutls.library.functions
 
1379
         .gnutls_openpgp_crt_verify_self(crt, 0,
 
1380
                                         ctypes.byref(crtverify)))
2283
1381
        if crtverify.value != 0:
2284
 
            gnutls.openpgp_crt_deinit(crt)
2285
 
            raise gnutls.CertificateSecurityError("Verify failed")
 
1382
            gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
 
1383
            raise (gnutls.errors.CertificateSecurityError
 
1384
                   ("Verify failed"))
2286
1385
        # New buffer for the fingerprint
2287
1386
        buf = ctypes.create_string_buffer(20)
2288
1387
        buf_len = ctypes.c_size_t()
2289
1388
        # Get the fingerprint from the certificate into the buffer
2290
 
        gnutls.openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
2291
 
                                           ctypes.byref(buf_len))
 
1389
        (gnutls.library.functions
 
1390
         .gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
 
1391
                                             ctypes.byref(buf_len)))
2292
1392
        # Deinit the certificate
2293
 
        gnutls.openpgp_crt_deinit(crt)
 
1393
        gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
2294
1394
        # Convert the buffer to a Python bytestring
2295
1395
        fpr = ctypes.string_at(buf, buf_len.value)
2296
1396
        # Convert the bytestring to hexadecimal notation
2297
 
        hex_fpr = binascii.hexlify(fpr).upper()
 
1397
        hex_fpr = ''.join("%02X" % ord(char) for char in fpr)
2298
1398
        return hex_fpr
2299
1399
 
2300
1400
 
2301
1401
class MultiprocessingMixIn(object):
2302
1402
    """Like socketserver.ThreadingMixIn, but with multiprocessing"""
2303
 
    
2304
1403
    def sub_process_main(self, request, address):
2305
1404
        try:
2306
1405
            self.finish_request(request, address)
2307
 
        except Exception:
 
1406
        except:
2308
1407
            self.handle_error(request, address)
2309
1408
        self.close_request(request)
2310
 
    
 
1409
            
2311
1410
    def process_request(self, request, address):
2312
1411
        """Start a new process to process the request."""
2313
 
        proc = multiprocessing.Process(target = self.sub_process_main,
2314
 
                                       args = (request, address))
2315
 
        proc.start()
2316
 
        return proc
2317
 
 
 
1412
        multiprocessing.Process(target = self.sub_process_main,
 
1413
                                args = (request, address)).start()
2318
1414
 
2319
1415
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
2320
1416
    """ adds a pipe to the MixIn """
2321
 
    
2322
1417
    def process_request(self, request, client_address):
2323
1418
        """Overrides and wraps the original process_request().
2324
1419
        
2325
1420
        This function creates a new pipe in self.pipe
2326
1421
        """
2327
1422
        parent_pipe, self.child_pipe = multiprocessing.Pipe()
2328
 
        
2329
 
        proc = MultiprocessingMixIn.process_request(self, request,
2330
 
                                                    client_address)
 
1423
 
 
1424
        super(MultiprocessingMixInWithPipe,
 
1425
              self).process_request(request, client_address)
2331
1426
        self.child_pipe.close()
2332
 
        self.add_pipe(parent_pipe, proc)
2333
 
    
2334
 
    def add_pipe(self, parent_pipe, proc):
 
1427
        self.add_pipe(parent_pipe)
 
1428
 
 
1429
    def add_pipe(self, parent_pipe):
2335
1430
        """Dummy function; override as necessary"""
2336
 
        raise NotImplementedError()
2337
 
 
 
1431
        raise NotImplementedError
2338
1432
 
2339
1433
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
2340
1434
                     socketserver.TCPServer, object):
2345
1439
        interface:      None or a network interface name (string)
2346
1440
        use_ipv6:       Boolean; to use IPv6 or not
2347
1441
    """
2348
 
    
2349
1442
    def __init__(self, server_address, RequestHandlerClass,
2350
 
                 interface=None,
2351
 
                 use_ipv6=True,
2352
 
                 socketfd=None):
2353
 
        """If socketfd is set, use that file descriptor instead of
2354
 
        creating a new one with socket.socket().
2355
 
        """
 
1443
                 interface=None, use_ipv6=True):
2356
1444
        self.interface = interface
2357
1445
        if use_ipv6:
2358
1446
            self.address_family = socket.AF_INET6
2359
 
        if socketfd is not None:
2360
 
            # Save the file descriptor
2361
 
            self.socketfd = socketfd
2362
 
            # Save the original socket.socket() function
2363
 
            self.socket_socket = socket.socket
2364
 
            # To implement --socket, we monkey patch socket.socket.
2365
 
            # 
2366
 
            # (When socketserver.TCPServer is a new-style class, we
2367
 
            # could make self.socket into a property instead of monkey
2368
 
            # patching socket.socket.)
2369
 
            # 
2370
 
            # Create a one-time-only replacement for socket.socket()
2371
 
            @functools.wraps(socket.socket)
2372
 
            def socket_wrapper(*args, **kwargs):
2373
 
                # Restore original function so subsequent calls are
2374
 
                # not affected.
2375
 
                socket.socket = self.socket_socket
2376
 
                del self.socket_socket
2377
 
                # This time only, return a new socket object from the
2378
 
                # saved file descriptor.
2379
 
                return socket.fromfd(self.socketfd, *args, **kwargs)
2380
 
            # Replace socket.socket() function with wrapper
2381
 
            socket.socket = socket_wrapper
2382
 
        # The socketserver.TCPServer.__init__ will call
2383
 
        # socket.socket(), which might be our replacement,
2384
 
        # socket_wrapper(), if socketfd was set.
2385
1447
        socketserver.TCPServer.__init__(self, server_address,
2386
1448
                                        RequestHandlerClass)
2387
 
    
2388
1449
    def server_bind(self):
2389
1450
        """This overrides the normal server_bind() function
2390
1451
        to bind to an interface if one was specified, and also NOT to
2396
1457
                             self.interface)
2397
1458
            else:
2398
1459
                try:
2399
 
                    self.socket.setsockopt(
2400
 
                        socket.SOL_SOCKET, SO_BINDTODEVICE,
2401
 
                        (self.interface + "\0").encode("utf-8"))
 
1460
                    self.socket.setsockopt(socket.SOL_SOCKET,
 
1461
                                           SO_BINDTODEVICE,
 
1462
                                           str(self.interface
 
1463
                                               + '\0'))
2402
1464
                except socket.error as error:
2403
 
                    if error.errno == errno.EPERM:
2404
 
                        logger.error("No permission to bind to"
2405
 
                                     " interface %s", self.interface)
2406
 
                    elif error.errno == errno.ENOPROTOOPT:
 
1465
                    if error[0] == errno.EPERM:
 
1466
                        logger.error("No permission to"
 
1467
                                     " bind to interface %s",
 
1468
                                     self.interface)
 
1469
                    elif error[0] == errno.ENOPROTOOPT:
2407
1470
                        logger.error("SO_BINDTODEVICE not available;"
2408
1471
                                     " cannot bind to interface %s",
2409
1472
                                     self.interface)
2410
 
                    elif error.errno == errno.ENODEV:
2411
 
                        logger.error("Interface %s does not exist,"
2412
 
                                     " cannot bind", self.interface)
2413
1473
                    else:
2414
1474
                        raise
2415
1475
        # Only bind(2) the socket if we really need to.
2418
1478
                if self.address_family == socket.AF_INET6:
2419
1479
                    any_address = "::" # in6addr_any
2420
1480
                else:
2421
 
                    any_address = "0.0.0.0" # INADDR_ANY
 
1481
                    any_address = socket.INADDR_ANY
2422
1482
                self.server_address = (any_address,
2423
1483
                                       self.server_address[1])
2424
1484
            elif not self.server_address[1]:
2425
 
                self.server_address = (self.server_address[0], 0)
 
1485
                self.server_address = (self.server_address[0],
 
1486
                                       0)
2426
1487
#                 if self.interface:
2427
1488
#                     self.server_address = (self.server_address[0],
2428
1489
#                                            0, # port
2442
1503
    
2443
1504
    Assumes a gobject.MainLoop event loop.
2444
1505
    """
2445
 
    
2446
1506
    def __init__(self, server_address, RequestHandlerClass,
2447
 
                 interface=None,
2448
 
                 use_ipv6=True,
2449
 
                 clients=None,
2450
 
                 gnutls_priority=None,
2451
 
                 use_dbus=True,
2452
 
                 socketfd=None):
 
1507
                 interface=None, use_ipv6=True, clients=None,
 
1508
                 gnutls_priority=None, use_dbus=True):
2453
1509
        self.enabled = False
2454
1510
        self.clients = clients
2455
1511
        if self.clients is None:
2456
 
            self.clients = {}
 
1512
            self.clients = set()
2457
1513
        self.use_dbus = use_dbus
2458
1514
        self.gnutls_priority = gnutls_priority
2459
1515
        IPv6_TCPServer.__init__(self, server_address,
2460
1516
                                RequestHandlerClass,
2461
1517
                                interface = interface,
2462
 
                                use_ipv6 = use_ipv6,
2463
 
                                socketfd = socketfd)
2464
 
    
 
1518
                                use_ipv6 = use_ipv6)
2465
1519
    def server_activate(self):
2466
1520
        if self.enabled:
2467
1521
            return socketserver.TCPServer.server_activate(self)
2468
 
    
2469
1522
    def enable(self):
2470
1523
        self.enabled = True
2471
 
    
2472
 
    def add_pipe(self, parent_pipe, proc):
 
1524
    def add_pipe(self, parent_pipe):
2473
1525
        # Call "handle_ipc" for both data and EOF events
2474
 
        gobject.io_add_watch(
2475
 
            parent_pipe.fileno(),
2476
 
            gobject.IO_IN | gobject.IO_HUP,
2477
 
            functools.partial(self.handle_ipc,
2478
 
                              parent_pipe = parent_pipe,
2479
 
                              proc = proc))
2480
 
    
2481
 
    def handle_ipc(self, source, condition,
2482
 
                   parent_pipe=None,
2483
 
                   proc = None,
 
1526
        gobject.io_add_watch(parent_pipe.fileno(),
 
1527
                             gobject.IO_IN | gobject.IO_HUP,
 
1528
                             functools.partial(self.handle_ipc,
 
1529
                                               parent_pipe = parent_pipe))
 
1530
        
 
1531
    def handle_ipc(self, source, condition, parent_pipe=None,
2484
1532
                   client_object=None):
2485
 
        # error, or the other end of multiprocessing.Pipe has closed
2486
 
        if condition & (gobject.IO_ERR | gobject.IO_HUP):
2487
 
            # Wait for other process to exit
2488
 
            proc.join()
 
1533
        condition_names = {
 
1534
            gobject.IO_IN: "IN",   # There is data to read.
 
1535
            gobject.IO_OUT: "OUT", # Data can be written (without
 
1536
                                    # blocking).
 
1537
            gobject.IO_PRI: "PRI", # There is urgent data to read.
 
1538
            gobject.IO_ERR: "ERR", # Error condition.
 
1539
            gobject.IO_HUP: "HUP"  # Hung up (the connection has been
 
1540
                                    # broken, usually for pipes and
 
1541
                                    # sockets).
 
1542
            }
 
1543
        conditions_string = ' | '.join(name
 
1544
                                       for cond, name in
 
1545
                                       condition_names.iteritems()
 
1546
                                       if cond & condition)
 
1547
        # error or the other end of multiprocessing.Pipe has closed
 
1548
        if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):
2489
1549
            return False
2490
1550
        
2491
1551
        # Read a request from the child
2496
1556
            fpr = request[1]
2497
1557
            address = request[2]
2498
1558
            
2499
 
            for c in self.clients.itervalues():
 
1559
            for c in self.clients:
2500
1560
                if c.fingerprint == fpr:
2501
1561
                    client = c
2502
1562
                    break
2503
1563
            else:
2504
 
                logger.info("Client not found for fingerprint: %s, ad"
2505
 
                            "dress: %s", fpr, address)
 
1564
                logger.warning("Client not found for fingerprint: %s, ad"
 
1565
                               "dress: %s", fpr, address)
2506
1566
                if self.use_dbus:
2507
1567
                    # Emit D-Bus signal
2508
 
                    mandos_dbus_service.ClientNotFound(fpr,
2509
 
                                                       address[0])
 
1568
                    mandos_dbus_service.ClientNotFound(fpr, address[0])
2510
1569
                parent_pipe.send(False)
2511
1570
                return False
2512
1571
            
2513
 
            gobject.io_add_watch(
2514
 
                parent_pipe.fileno(),
2515
 
                gobject.IO_IN | gobject.IO_HUP,
2516
 
                functools.partial(self.handle_ipc,
2517
 
                                  parent_pipe = parent_pipe,
2518
 
                                  proc = proc,
2519
 
                                  client_object = client))
 
1572
            gobject.io_add_watch(parent_pipe.fileno(),
 
1573
                                 gobject.IO_IN | gobject.IO_HUP,
 
1574
                                 functools.partial(self.handle_ipc,
 
1575
                                                   parent_pipe = parent_pipe,
 
1576
                                                   client_object = client))
2520
1577
            parent_pipe.send(True)
2521
 
            # remove the old hook in favor of the new above hook on
2522
 
            # same fileno
 
1578
            # remove the old hook in favor of the new above hook on same fileno
2523
1579
            return False
2524
1580
        if command == 'funcall':
2525
1581
            funcname = request[1]
2526
1582
            args = request[2]
2527
1583
            kwargs = request[3]
2528
1584
            
2529
 
            parent_pipe.send(('data', getattr(client_object,
2530
 
                                              funcname)(*args,
2531
 
                                                        **kwargs)))
2532
 
        
 
1585
            parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))
 
1586
 
2533
1587
        if command == 'getattr':
2534
1588
            attrname = request[1]
2535
 
            if isinstance(client_object.__getattribute__(attrname),
2536
 
                          collections.Callable):
2537
 
                parent_pipe.send(('function', ))
 
1589
            if callable(client_object.__getattribute__(attrname)):
 
1590
                parent_pipe.send(('function',))
2538
1591
            else:
2539
 
                parent_pipe.send((
2540
 
                    'data', client_object.__getattribute__(attrname)))
 
1592
                parent_pipe.send(('data', client_object.__getattribute__(attrname)))
2541
1593
        
2542
1594
        if command == 'setattr':
2543
1595
            attrname = request[1]
2544
1596
            value = request[2]
2545
1597
            setattr(client_object, attrname, value)
2546
 
        
 
1598
 
2547
1599
        return True
2548
1600
 
2549
1601
 
2550
 
def rfc3339_duration_to_delta(duration):
2551
 
    """Parse an RFC 3339 "duration" and return a datetime.timedelta
2552
 
    
2553
 
    >>> rfc3339_duration_to_delta("P7D")
2554
 
    datetime.timedelta(7)
2555
 
    >>> rfc3339_duration_to_delta("PT60S")
2556
 
    datetime.timedelta(0, 60)
2557
 
    >>> rfc3339_duration_to_delta("PT60M")
2558
 
    datetime.timedelta(0, 3600)
2559
 
    >>> rfc3339_duration_to_delta("PT24H")
2560
 
    datetime.timedelta(1)
2561
 
    >>> rfc3339_duration_to_delta("P1W")
2562
 
    datetime.timedelta(7)
2563
 
    >>> rfc3339_duration_to_delta("PT5M30S")
2564
 
    datetime.timedelta(0, 330)
2565
 
    >>> rfc3339_duration_to_delta("P1DT3M20S")
2566
 
    datetime.timedelta(1, 200)
2567
 
    """
2568
 
    
2569
 
    # Parsing an RFC 3339 duration with regular expressions is not
2570
 
    # possible - there would have to be multiple places for the same
2571
 
    # values, like seconds.  The current code, while more esoteric, is
2572
 
    # cleaner without depending on a parsing library.  If Python had a
2573
 
    # built-in library for parsing we would use it, but we'd like to
2574
 
    # avoid excessive use of external libraries.
2575
 
    
2576
 
    # New type for defining tokens, syntax, and semantics all-in-one
2577
 
    Token = collections.namedtuple("Token", (
2578
 
        "regexp",  # To match token; if "value" is not None, must have
2579
 
                   # a "group" containing digits
2580
 
        "value",   # datetime.timedelta or None
2581
 
        "followers"))           # Tokens valid after this token
2582
 
    # RFC 3339 "duration" tokens, syntax, and semantics; taken from
2583
 
    # the "duration" ABNF definition in RFC 3339, Appendix A.
2584
 
    token_end = Token(re.compile(r"$"), None, frozenset())
2585
 
    token_second = Token(re.compile(r"(\d+)S"),
2586
 
                         datetime.timedelta(seconds=1),
2587
 
                         frozenset((token_end, )))
2588
 
    token_minute = Token(re.compile(r"(\d+)M"),
2589
 
                         datetime.timedelta(minutes=1),
2590
 
                         frozenset((token_second, token_end)))
2591
 
    token_hour = Token(re.compile(r"(\d+)H"),
2592
 
                       datetime.timedelta(hours=1),
2593
 
                       frozenset((token_minute, token_end)))
2594
 
    token_time = Token(re.compile(r"T"),
2595
 
                       None,
2596
 
                       frozenset((token_hour, token_minute,
2597
 
                                  token_second)))
2598
 
    token_day = Token(re.compile(r"(\d+)D"),
2599
 
                      datetime.timedelta(days=1),
2600
 
                      frozenset((token_time, token_end)))
2601
 
    token_month = Token(re.compile(r"(\d+)M"),
2602
 
                        datetime.timedelta(weeks=4),
2603
 
                        frozenset((token_day, token_end)))
2604
 
    token_year = Token(re.compile(r"(\d+)Y"),
2605
 
                       datetime.timedelta(weeks=52),
2606
 
                       frozenset((token_month, token_end)))
2607
 
    token_week = Token(re.compile(r"(\d+)W"),
2608
 
                       datetime.timedelta(weeks=1),
2609
 
                       frozenset((token_end, )))
2610
 
    token_duration = Token(re.compile(r"P"), None,
2611
 
                           frozenset((token_year, token_month,
2612
 
                                      token_day, token_time,
2613
 
                                      token_week)))
2614
 
    # Define starting values
2615
 
    value = datetime.timedelta() # Value so far
2616
 
    found_token = None
2617
 
    followers = frozenset((token_duration, )) # Following valid tokens
2618
 
    s = duration                # String left to parse
2619
 
    # Loop until end token is found
2620
 
    while found_token is not token_end:
2621
 
        # Search for any currently valid tokens
2622
 
        for token in followers:
2623
 
            match = token.regexp.match(s)
2624
 
            if match is not None:
2625
 
                # Token found
2626
 
                if token.value is not None:
2627
 
                    # Value found, parse digits
2628
 
                    factor = int(match.group(1), 10)
2629
 
                    # Add to value so far
2630
 
                    value += factor * token.value
2631
 
                # Strip token from string
2632
 
                s = token.regexp.sub("", s, 1)
2633
 
                # Go to found token
2634
 
                found_token = token
2635
 
                # Set valid next tokens
2636
 
                followers = found_token.followers
2637
 
                break
2638
 
        else:
2639
 
            # No currently valid tokens were found
2640
 
            raise ValueError("Invalid RFC 3339 duration: {!r}"
2641
 
                             .format(duration))
2642
 
    # End token found
2643
 
    return value
2644
 
 
2645
 
 
2646
1602
def string_to_delta(interval):
2647
1603
    """Parse a string and return a datetime.timedelta
2648
1604
    
2659
1615
    >>> string_to_delta('5m 30s')
2660
1616
    datetime.timedelta(0, 330)
2661
1617
    """
2662
 
    
2663
 
    try:
2664
 
        return rfc3339_duration_to_delta(interval)
2665
 
    except ValueError:
2666
 
        pass
2667
 
    
2668
1618
    timevalue = datetime.timedelta(0)
2669
1619
    for s in interval.split():
2670
1620
        try:
2671
 
            suffix = s[-1]
 
1621
            suffix = unicode(s[-1])
2672
1622
            value = int(s[:-1])
2673
1623
            if suffix == "d":
2674
1624
                delta = datetime.timedelta(value)
2681
1631
            elif suffix == "w":
2682
1632
                delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
2683
1633
            else:
2684
 
                raise ValueError("Unknown suffix {!r}".format(suffix))
2685
 
        except IndexError as e:
 
1634
                raise ValueError("Unknown suffix %r" % suffix)
 
1635
        except (ValueError, IndexError) as e:
2686
1636
            raise ValueError(*(e.args))
2687
1637
        timevalue += delta
2688
1638
    return timevalue
2689
1639
 
2690
1640
 
 
1641
def if_nametoindex(interface):
 
1642
    """Call the C function if_nametoindex(), or equivalent
 
1643
    
 
1644
    Note: This function cannot accept a unicode string."""
 
1645
    global if_nametoindex
 
1646
    try:
 
1647
        if_nametoindex = (ctypes.cdll.LoadLibrary
 
1648
                          (ctypes.util.find_library("c"))
 
1649
                          .if_nametoindex)
 
1650
    except (OSError, AttributeError):
 
1651
        logger.warning("Doing if_nametoindex the hard way")
 
1652
        def if_nametoindex(interface):
 
1653
            "Get an interface index the hard way, i.e. using fcntl()"
 
1654
            SIOCGIFINDEX = 0x8933  # From /usr/include/linux/sockios.h
 
1655
            with contextlib.closing(socket.socket()) as s:
 
1656
                ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
 
1657
                                    struct.pack(str("16s16x"),
 
1658
                                                interface))
 
1659
            interface_index = struct.unpack(str("I"),
 
1660
                                            ifreq[16:20])[0]
 
1661
            return interface_index
 
1662
    return if_nametoindex(interface)
 
1663
 
 
1664
 
2691
1665
def daemon(nochdir = False, noclose = False):
2692
1666
    """See daemon(3).  Standard BSD Unix function.
2693
1667
    
2701
1675
        sys.exit()
2702
1676
    if not noclose:
2703
1677
        # Close all standard open file descriptors
2704
 
        null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
 
1678
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
2705
1679
        if not stat.S_ISCHR(os.fstat(null).st_mode):
2706
1680
            raise OSError(errno.ENODEV,
2707
 
                          "{} not a character device"
2708
 
                          .format(os.devnull))
 
1681
                          "%s not a character device"
 
1682
                          % os.path.devnull)
2709
1683
        os.dup2(null, sys.stdin.fileno())
2710
1684
        os.dup2(null, sys.stdout.fileno())
2711
1685
        os.dup2(null, sys.stderr.fileno())
2720
1694
    
2721
1695
    parser = argparse.ArgumentParser()
2722
1696
    parser.add_argument("-v", "--version", action="version",
2723
 
                        version = "%(prog)s {}".format(version),
 
1697
                        version = "%%(prog)s %s" % version,
2724
1698
                        help="show version number and exit")
2725
1699
    parser.add_argument("-i", "--interface", metavar="IF",
2726
1700
                        help="Bind to interface IF")
2732
1706
                        help="Run self-test")
2733
1707
    parser.add_argument("--debug", action="store_true",
2734
1708
                        help="Debug mode; run in foreground and log"
2735
 
                        " to terminal", default=None)
 
1709
                        " to terminal")
2736
1710
    parser.add_argument("--debuglevel", metavar="LEVEL",
2737
1711
                        help="Debug level for stdout output")
2738
1712
    parser.add_argument("--priority", help="GnuTLS"
2745
1719
                        " files")
2746
1720
    parser.add_argument("--no-dbus", action="store_false",
2747
1721
                        dest="use_dbus", help="Do not provide D-Bus"
2748
 
                        " system bus interface", default=None)
 
1722
                        " system bus interface")
2749
1723
    parser.add_argument("--no-ipv6", action="store_false",
2750
 
                        dest="use_ipv6", help="Do not use IPv6",
2751
 
                        default=None)
2752
 
    parser.add_argument("--no-restore", action="store_false",
2753
 
                        dest="restore", help="Do not restore stored"
2754
 
                        " state", default=None)
2755
 
    parser.add_argument("--socket", type=int,
2756
 
                        help="Specify a file descriptor to a network"
2757
 
                        " socket to use instead of creating one")
2758
 
    parser.add_argument("--statedir", metavar="DIR",
2759
 
                        help="Directory to save/restore state in")
2760
 
    parser.add_argument("--foreground", action="store_true",
2761
 
                        help="Run in foreground", default=None)
2762
 
    parser.add_argument("--no-zeroconf", action="store_false",
2763
 
                        dest="zeroconf", help="Do not use Zeroconf",
2764
 
                        default=None)
2765
 
    
 
1724
                        dest="use_ipv6", help="Do not use IPv6")
2766
1725
    options = parser.parse_args()
2767
1726
    
2768
1727
    if options.check:
2769
1728
        import doctest
2770
 
        fail_count, test_count = doctest.testmod()
2771
 
        sys.exit(os.EX_OK if fail_count == 0 else 1)
 
1729
        doctest.testmod()
 
1730
        sys.exit()
2772
1731
    
2773
1732
    # Default values for config file for server-global settings
2774
1733
    server_defaults = { "interface": "",
2776
1735
                        "port": "",
2777
1736
                        "debug": "False",
2778
1737
                        "priority":
2779
 
                        "SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2780
 
                        ":+SIGN-DSA-SHA256",
 
1738
                        "SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
2781
1739
                        "servicename": "Mandos",
2782
1740
                        "use_dbus": "True",
2783
1741
                        "use_ipv6": "True",
2784
1742
                        "debuglevel": "",
2785
 
                        "restore": "True",
2786
 
                        "socket": "",
2787
 
                        "statedir": "/var/lib/mandos",
2788
 
                        "foreground": "False",
2789
 
                        "zeroconf": "True",
2790
 
                    }
 
1743
                        }
2791
1744
    
2792
1745
    # Parse config file for server-global settings
2793
1746
    server_config = configparser.SafeConfigParser(server_defaults)
2794
1747
    del server_defaults
2795
 
    server_config.read(os.path.join(options.configdir, "mandos.conf"))
 
1748
    server_config.read(os.path.join(options.configdir,
 
1749
                                    "mandos.conf"))
2796
1750
    # Convert the SafeConfigParser object to a dict
2797
1751
    server_settings = server_config.defaults()
2798
1752
    # Use the appropriate methods on the non-string config options
2799
 
    for option in ("debug", "use_dbus", "use_ipv6", "foreground"):
 
1753
    for option in ("debug", "use_dbus", "use_ipv6"):
2800
1754
        server_settings[option] = server_config.getboolean("DEFAULT",
2801
1755
                                                           option)
2802
1756
    if server_settings["port"]:
2803
1757
        server_settings["port"] = server_config.getint("DEFAULT",
2804
1758
                                                       "port")
2805
 
    if server_settings["socket"]:
2806
 
        server_settings["socket"] = server_config.getint("DEFAULT",
2807
 
                                                         "socket")
2808
 
        # Later, stdin will, and stdout and stderr might, be dup'ed
2809
 
        # over with an opened os.devnull.  But we don't want this to
2810
 
        # happen with a supplied network socket.
2811
 
        if 0 <= server_settings["socket"] <= 2:
2812
 
            server_settings["socket"] = os.dup(server_settings
2813
 
                                               ["socket"])
2814
1759
    del server_config
2815
1760
    
2816
1761
    # Override the settings from the config file with command line
2817
1762
    # options, if set.
2818
1763
    for option in ("interface", "address", "port", "debug",
2819
 
                   "priority", "servicename", "configdir", "use_dbus",
2820
 
                   "use_ipv6", "debuglevel", "restore", "statedir",
2821
 
                   "socket", "foreground", "zeroconf"):
 
1764
                   "priority", "servicename", "configdir",
 
1765
                   "use_dbus", "use_ipv6", "debuglevel"):
2822
1766
        value = getattr(options, option)
2823
1767
        if value is not None:
2824
1768
            server_settings[option] = value
2825
1769
    del options
2826
1770
    # Force all strings to be unicode
2827
1771
    for option in server_settings.keys():
2828
 
        if isinstance(server_settings[option], bytes):
2829
 
            server_settings[option] = (server_settings[option]
2830
 
                                       .decode("utf-8"))
2831
 
    # Force all boolean options to be boolean
2832
 
    for option in ("debug", "use_dbus", "use_ipv6", "restore",
2833
 
                   "foreground", "zeroconf"):
2834
 
        server_settings[option] = bool(server_settings[option])
2835
 
    # Debug implies foreground
2836
 
    if server_settings["debug"]:
2837
 
        server_settings["foreground"] = True
 
1772
        if type(server_settings[option]) is str:
 
1773
            server_settings[option] = unicode(server_settings[option])
2838
1774
    # Now we have our good server settings in "server_settings"
2839
1775
    
2840
1776
    ##################################################################
2841
1777
    
2842
 
    if (not server_settings["zeroconf"]
2843
 
        and not (server_settings["port"]
2844
 
                 or server_settings["socket"] != "")):
2845
 
        parser.error("Needs port or socket to work without Zeroconf")
2846
 
    
2847
1778
    # For convenience
2848
1779
    debug = server_settings["debug"]
2849
1780
    debuglevel = server_settings["debuglevel"]
2850
1781
    use_dbus = server_settings["use_dbus"]
2851
1782
    use_ipv6 = server_settings["use_ipv6"]
2852
 
    stored_state_path = os.path.join(server_settings["statedir"],
2853
 
                                     stored_state_file)
2854
 
    foreground = server_settings["foreground"]
2855
 
    zeroconf = server_settings["zeroconf"]
2856
 
    
2857
 
    if debug:
2858
 
        initlogger(debug, logging.DEBUG)
2859
 
    else:
2860
 
        if not debuglevel:
2861
 
            initlogger(debug)
2862
 
        else:
2863
 
            level = getattr(logging, debuglevel.upper())
2864
 
            initlogger(debug, level)
2865
 
    
 
1783
 
2866
1784
    if server_settings["servicename"] != "Mandos":
2867
 
        syslogger.setFormatter(
2868
 
            logging.Formatter('Mandos ({}) [%(process)d]:'
2869
 
                              ' %(levelname)s: %(message)s'.format(
2870
 
                                  server_settings["servicename"])))
 
1785
        syslogger.setFormatter(logging.Formatter
 
1786
                               ('Mandos (%s) [%%(process)d]:'
 
1787
                                ' %%(levelname)s: %%(message)s'
 
1788
                                % server_settings["servicename"]))
2871
1789
    
2872
1790
    # Parse config file with clients
2873
 
    client_config = configparser.SafeConfigParser(Client
2874
 
                                                  .client_defaults)
 
1791
    client_defaults = { "timeout": "1h",
 
1792
                        "interval": "5m",
 
1793
                        "checker": "fping -q -- %%(host)s",
 
1794
                        "host": "",
 
1795
                        "approval_delay": "0s",
 
1796
                        "approval_duration": "1s",
 
1797
                        }
 
1798
    client_config = configparser.SafeConfigParser(client_defaults)
2875
1799
    client_config.read(os.path.join(server_settings["configdir"],
2876
1800
                                    "clients.conf"))
2877
1801
    
2878
1802
    global mandos_dbus_service
2879
1803
    mandos_dbus_service = None
2880
1804
    
2881
 
    socketfd = None
2882
 
    if server_settings["socket"] != "":
2883
 
        socketfd = server_settings["socket"]
2884
 
    tcp_server = MandosServer(
2885
 
        (server_settings["address"], server_settings["port"]),
2886
 
        ClientHandler,
2887
 
        interface=(server_settings["interface"] or None),
2888
 
        use_ipv6=use_ipv6,
2889
 
        gnutls_priority=server_settings["priority"],
2890
 
        use_dbus=use_dbus,
2891
 
        socketfd=socketfd)
2892
 
    if not foreground:
2893
 
        pidfilename = "/run/mandos.pid"
2894
 
        if not os.path.isdir("/run/."):
2895
 
            pidfilename = "/var/run/mandos.pid"
2896
 
        pidfile = None
 
1805
    tcp_server = MandosServer((server_settings["address"],
 
1806
                               server_settings["port"]),
 
1807
                              ClientHandler,
 
1808
                              interface=(server_settings["interface"]
 
1809
                                         or None),
 
1810
                              use_ipv6=use_ipv6,
 
1811
                              gnutls_priority=
 
1812
                              server_settings["priority"],
 
1813
                              use_dbus=use_dbus)
 
1814
    if not debug:
 
1815
        pidfilename = "/var/run/mandos.pid"
2897
1816
        try:
2898
 
            pidfile = codecs.open(pidfilename, "w", encoding="utf-8")
2899
 
        except IOError as e:
2900
 
            logger.error("Could not open file %r", pidfilename,
2901
 
                         exc_info=e)
 
1817
            pidfile = open(pidfilename, "w")
 
1818
        except IOError:
 
1819
            logger.error("Could not open file %r", pidfilename)
2902
1820
    
2903
 
    for name in ("_mandos", "mandos", "nobody"):
 
1821
    try:
 
1822
        uid = pwd.getpwnam("_mandos").pw_uid
 
1823
        gid = pwd.getpwnam("_mandos").pw_gid
 
1824
    except KeyError:
2904
1825
        try:
2905
 
            uid = pwd.getpwnam(name).pw_uid
2906
 
            gid = pwd.getpwnam(name).pw_gid
2907
 
            break
 
1826
            uid = pwd.getpwnam("mandos").pw_uid
 
1827
            gid = pwd.getpwnam("mandos").pw_gid
2908
1828
        except KeyError:
2909
 
            continue
2910
 
    else:
2911
 
        uid = 65534
2912
 
        gid = 65534
 
1829
            try:
 
1830
                uid = pwd.getpwnam("nobody").pw_uid
 
1831
                gid = pwd.getpwnam("nobody").pw_gid
 
1832
            except KeyError:
 
1833
                uid = 65534
 
1834
                gid = 65534
2913
1835
    try:
2914
1836
        os.setgid(gid)
2915
1837
        os.setuid(uid)
2916
1838
    except OSError as error:
2917
 
        if error.errno != errno.EPERM:
2918
 
            raise
 
1839
        if error[0] != errno.EPERM:
 
1840
            raise error
2919
1841
    
 
1842
    if not debug and not debuglevel:
 
1843
        syslogger.setLevel(logging.WARNING)
 
1844
        console.setLevel(logging.WARNING)
 
1845
    if debuglevel:
 
1846
        level = getattr(logging, debuglevel.upper())
 
1847
        syslogger.setLevel(level)
 
1848
        console.setLevel(level)
 
1849
 
2920
1850
    if debug:
2921
1851
        # Enable all possible GnuTLS debugging
2922
1852
        
2923
1853
        # "Use a log level over 10 to enable all debugging options."
2924
1854
        # - GnuTLS manual
2925
 
        gnutls.global_set_log_level(11)
 
1855
        gnutls.library.functions.gnutls_global_set_log_level(11)
2926
1856
        
2927
 
        @gnutls.log_func
 
1857
        @gnutls.library.types.gnutls_log_func
2928
1858
        def debug_gnutls(level, string):
2929
1859
            logger.debug("GnuTLS: %s", string[:-1])
2930
1860
        
2931
 
        gnutls.global_set_log_function(debug_gnutls)
 
1861
        (gnutls.library.functions
 
1862
         .gnutls_global_set_log_function(debug_gnutls))
2932
1863
        
2933
1864
        # Redirect stdin so all checkers get /dev/null
2934
 
        null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
 
1865
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
2935
1866
        os.dup2(null, sys.stdin.fileno())
2936
1867
        if null > 2:
2937
1868
            os.close(null)
 
1869
    else:
 
1870
        # No console logging
 
1871
        logger.removeHandler(console)
2938
1872
    
2939
1873
    # Need to fork before connecting to D-Bus
2940
 
    if not foreground:
 
1874
    if not debug:
2941
1875
        # Close all input and output, do double fork, etc.
2942
1876
        daemon()
2943
1877
    
2944
 
    # multiprocessing will use threads, so before we use gobject we
2945
 
    # need to inform gobject that threads will be used.
2946
 
    gobject.threads_init()
2947
 
    
2948
1878
    global main_loop
2949
1879
    # From the Avahi example code
2950
 
    DBusGMainLoop(set_as_default=True)
 
1880
    DBusGMainLoop(set_as_default=True )
2951
1881
    main_loop = gobject.MainLoop()
2952
1882
    bus = dbus.SystemBus()
2953
1883
    # End of Avahi example code
2954
1884
    if use_dbus:
2955
1885
        try:
2956
 
            bus_name = dbus.service.BusName("se.recompile.Mandos",
2957
 
                                            bus,
2958
 
                                            do_not_queue=True)
2959
 
            old_bus_name = dbus.service.BusName(
2960
 
                "se.bsnet.fukt.Mandos", bus,
2961
 
                do_not_queue=True)
2962
 
        except dbus.exceptions.DBusException as e:
2963
 
            logger.error("Disabling D-Bus:", exc_info=e)
 
1886
            bus_name = dbus.service.BusName("se.bsnet.fukt.Mandos",
 
1887
                                            bus, do_not_queue=True)
 
1888
        except dbus.exceptions.NameExistsException as e:
 
1889
            logger.error(unicode(e) + ", disabling D-Bus")
2964
1890
            use_dbus = False
2965
1891
            server_settings["use_dbus"] = False
2966
1892
            tcp_server.use_dbus = False
2967
 
    if zeroconf:
2968
 
        protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2969
 
        service = AvahiServiceToSyslog(
2970
 
            name = server_settings["servicename"],
2971
 
            servicetype = "_mandos._tcp",
2972
 
            protocol = protocol,
2973
 
            bus = bus)
2974
 
        if server_settings["interface"]:
2975
 
            service.interface = if_nametoindex(
2976
 
                server_settings["interface"].encode("utf-8"))
 
1893
    protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
 
1894
    service = AvahiService(name = server_settings["servicename"],
 
1895
                           servicetype = "_mandos._tcp",
 
1896
                           protocol = protocol, bus = bus)
 
1897
    if server_settings["interface"]:
 
1898
        service.interface = (if_nametoindex
 
1899
                             (str(server_settings["interface"])))
2977
1900
    
2978
1901
    global multiprocessing_manager
2979
1902
    multiprocessing_manager = multiprocessing.Manager()
2981
1904
    client_class = Client
2982
1905
    if use_dbus:
2983
1906
        client_class = functools.partial(ClientDBus, bus = bus)
2984
 
    
2985
 
    client_settings = Client.config_parser(client_config)
2986
 
    old_client_settings = {}
2987
 
    clients_data = {}
2988
 
    
2989
 
    # This is used to redirect stdout and stderr for checker processes
2990
 
    global wnull
2991
 
    wnull = open(os.devnull, "w") # A writable /dev/null
2992
 
    # Only used if server is running in foreground but not in debug
2993
 
    # mode
2994
 
    if debug or not foreground:
2995
 
        wnull.close()
2996
 
    
2997
 
    # Get client data and settings from last running state.
2998
 
    if server_settings["restore"]:
2999
 
        try:
3000
 
            with open(stored_state_path, "rb") as stored_state:
3001
 
                clients_data, old_client_settings = pickle.load(
3002
 
                    stored_state)
3003
 
            os.remove(stored_state_path)
3004
 
        except IOError as e:
3005
 
            if e.errno == errno.ENOENT:
3006
 
                logger.warning("Could not load persistent state:"
3007
 
                               " {}".format(os.strerror(e.errno)))
3008
 
            else:
3009
 
                logger.critical("Could not load persistent state:",
3010
 
                                exc_info=e)
3011
 
                raise
3012
 
        except EOFError as e:
3013
 
            logger.warning("Could not load persistent state: "
3014
 
                           "EOFError:",
3015
 
                           exc_info=e)
3016
 
    
3017
 
    with PGPEngine() as pgp:
3018
 
        for client_name, client in clients_data.items():
3019
 
            # Skip removed clients
3020
 
            if client_name not in client_settings:
3021
 
                continue
3022
 
            
3023
 
            # Decide which value to use after restoring saved state.
3024
 
            # We have three different values: Old config file,
3025
 
            # new config file, and saved state.
3026
 
            # New config value takes precedence if it differs from old
3027
 
            # config value, otherwise use saved state.
3028
 
            for name, value in client_settings[client_name].items():
3029
 
                try:
3030
 
                    # For each value in new config, check if it
3031
 
                    # differs from the old config value (Except for
3032
 
                    # the "secret" attribute)
3033
 
                    if (name != "secret"
3034
 
                        and (value !=
3035
 
                             old_client_settings[client_name][name])):
3036
 
                        client[name] = value
3037
 
                except KeyError:
3038
 
                    pass
3039
 
            
3040
 
            # Clients who has passed its expire date can still be
3041
 
            # enabled if its last checker was successful.  A Client
3042
 
            # whose checker succeeded before we stored its state is
3043
 
            # assumed to have successfully run all checkers during
3044
 
            # downtime.
3045
 
            if client["enabled"]:
3046
 
                if datetime.datetime.utcnow() >= client["expires"]:
3047
 
                    if not client["last_checked_ok"]:
3048
 
                        logger.warning(
3049
 
                            "disabling client {} - Client never "
3050
 
                            "performed a successful checker".format(
3051
 
                                client_name))
3052
 
                        client["enabled"] = False
3053
 
                    elif client["last_checker_status"] != 0:
3054
 
                        logger.warning(
3055
 
                            "disabling client {} - Client last"
3056
 
                            " checker failed with error code"
3057
 
                            " {}".format(
3058
 
                                client_name,
3059
 
                                client["last_checker_status"]))
3060
 
                        client["enabled"] = False
3061
 
                    else:
3062
 
                        client["expires"] = (
3063
 
                            datetime.datetime.utcnow()
3064
 
                            + client["timeout"])
3065
 
                        logger.debug("Last checker succeeded,"
3066
 
                                     " keeping {} enabled".format(
3067
 
                                         client_name))
 
1907
    def client_config_items(config, section):
 
1908
        special_settings = {
 
1909
            "approved_by_default":
 
1910
                lambda: config.getboolean(section,
 
1911
                                          "approved_by_default"),
 
1912
            }
 
1913
        for name, value in config.items(section):
3068
1914
            try:
3069
 
                client["secret"] = pgp.decrypt(
3070
 
                    client["encrypted_secret"],
3071
 
                    client_settings[client_name]["secret"])
3072
 
            except PGPError:
3073
 
                # If decryption fails, we use secret from new settings
3074
 
                logger.debug("Failed to decrypt {} old secret".format(
3075
 
                    client_name))
3076
 
                client["secret"] = (client_settings[client_name]
3077
 
                                    ["secret"])
3078
 
    
3079
 
    # Add/remove clients based on new changes made to config
3080
 
    for client_name in (set(old_client_settings)
3081
 
                        - set(client_settings)):
3082
 
        del clients_data[client_name]
3083
 
    for client_name in (set(client_settings)
3084
 
                        - set(old_client_settings)):
3085
 
        clients_data[client_name] = client_settings[client_name]
3086
 
    
3087
 
    # Create all client objects
3088
 
    for client_name, client in clients_data.items():
3089
 
        tcp_server.clients[client_name] = client_class(
3090
 
            name = client_name,
3091
 
            settings = client,
3092
 
            server_settings = server_settings)
3093
 
    
 
1915
                yield (name, special_settings[name]())
 
1916
            except KeyError:
 
1917
                yield (name, value)
 
1918
    
 
1919
    tcp_server.clients.update(set(
 
1920
            client_class(name = section,
 
1921
                         config= dict(client_config_items(
 
1922
                        client_config, section)))
 
1923
            for section in client_config.sections()))
3094
1924
    if not tcp_server.clients:
3095
1925
        logger.warning("No clients defined")
3096
 
    
3097
 
    if not foreground:
3098
 
        if pidfile is not None:
3099
 
            pid = os.getpid()
3100
 
            try:
3101
 
                with pidfile:
3102
 
                    print(pid, file=pidfile)
3103
 
            except IOError:
3104
 
                logger.error("Could not write to file %r with PID %d",
3105
 
                             pidfilename, pid)
3106
 
        del pidfile
 
1926
        
 
1927
    if not debug:
 
1928
        try:
 
1929
            with pidfile:
 
1930
                pid = os.getpid()
 
1931
                pidfile.write(str(pid) + "\n".encode("utf-8"))
 
1932
            del pidfile
 
1933
        except IOError:
 
1934
            logger.error("Could not write to file %r with PID %d",
 
1935
                         pidfilename, pid)
 
1936
        except NameError:
 
1937
            # "pidfile" was never created
 
1938
            pass
3107
1939
        del pidfilename
3108
 
    
 
1940
        
 
1941
        signal.signal(signal.SIGINT, signal.SIG_IGN)
 
1942
 
3109
1943
    signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
3110
1944
    signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
3111
1945
    
3112
1946
    if use_dbus:
3113
 
        
3114
 
        @alternate_dbus_interfaces(
3115
 
            { "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })
3116
 
        class MandosDBusService(DBusObjectWithObjectManager):
 
1947
        class MandosDBusService(dbus.service.Object):
3117
1948
            """A D-Bus proxy object"""
3118
 
            
3119
1949
            def __init__(self):
3120
1950
                dbus.service.Object.__init__(self, bus, "/")
3121
 
            
3122
 
            _interface = "se.recompile.Mandos"
 
1951
            _interface = "se.bsnet.fukt.Mandos"
3123
1952
            
3124
1953
            @dbus.service.signal(_interface, signature="o")
3125
1954
            def ClientAdded(self, objpath):
3131
1960
                "D-Bus signal"
3132
1961
                pass
3133
1962
            
3134
 
            @dbus_annotations({"org.freedesktop.DBus.Deprecated":
3135
 
                               "true"})
3136
1963
            @dbus.service.signal(_interface, signature="os")
3137
1964
            def ClientRemoved(self, objpath, name):
3138
1965
                "D-Bus signal"
3139
1966
                pass
3140
1967
            
3141
 
            @dbus_annotations({"org.freedesktop.DBus.Deprecated":
3142
 
                               "true"})
3143
1968
            @dbus.service.method(_interface, out_signature="ao")
3144
1969
            def GetAllClients(self):
3145
1970
                "D-Bus method"
3146
 
                return dbus.Array(c.dbus_object_path for c in
3147
 
                                  tcp_server.clients.itervalues())
 
1971
                return dbus.Array(c.dbus_object_path
 
1972
                                  for c in tcp_server.clients)
3148
1973
            
3149
 
            @dbus_annotations({"org.freedesktop.DBus.Deprecated":
3150
 
                               "true"})
3151
1974
            @dbus.service.method(_interface,
3152
1975
                                 out_signature="a{oa{sv}}")
3153
1976
            def GetAllClientsWithProperties(self):
3154
1977
                "D-Bus method"
3155
1978
                return dbus.Dictionary(
3156
 
                    { c.dbus_object_path: c.GetAll(
3157
 
                        "se.recompile.Mandos.Client")
3158
 
                      for c in tcp_server.clients.itervalues() },
 
1979
                    ((c.dbus_object_path, c.GetAll(""))
 
1980
                     for c in tcp_server.clients),
3159
1981
                    signature="oa{sv}")
3160
1982
            
3161
1983
            @dbus.service.method(_interface, in_signature="o")
3162
1984
            def RemoveClient(self, object_path):
3163
1985
                "D-Bus method"
3164
 
                for c in tcp_server.clients.itervalues():
 
1986
                for c in tcp_server.clients:
3165
1987
                    if c.dbus_object_path == object_path:
3166
 
                        del tcp_server.clients[c.name]
 
1988
                        tcp_server.clients.remove(c)
3167
1989
                        c.remove_from_connection()
3168
 
                        # Don't signal the disabling
 
1990
                        # Don't signal anything except ClientRemoved
3169
1991
                        c.disable(quiet=True)
3170
 
                        # Emit D-Bus signal for removal
3171
 
                        self.client_removed_signal(c)
 
1992
                        # Emit D-Bus signal
 
1993
                        self.ClientRemoved(object_path, c.name)
3172
1994
                        return
3173
1995
                raise KeyError(object_path)
3174
1996
            
3175
1997
            del _interface
3176
 
            
3177
 
            @dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
3178
 
                                 out_signature = "a{oa{sa{sv}}}")
3179
 
            def GetManagedObjects(self):
3180
 
                """D-Bus method"""
3181
 
                return dbus.Dictionary(
3182
 
                    { client.dbus_object_path:
3183
 
                      dbus.Dictionary(
3184
 
                          { interface: client.GetAll(interface)
3185
 
                            for interface in
3186
 
                                 client._get_all_interface_names()})
3187
 
                      for client in tcp_server.clients.values()})
3188
 
            
3189
 
            def client_added_signal(self, client):
3190
 
                """Send the new standard signal and the old signal"""
3191
 
                if use_dbus:
3192
 
                    # New standard signal
3193
 
                    self.InterfacesAdded(
3194
 
                        client.dbus_object_path,
3195
 
                        dbus.Dictionary(
3196
 
                            { interface: client.GetAll(interface)
3197
 
                              for interface in
3198
 
                              client._get_all_interface_names()}))
3199
 
                    # Old signal
3200
 
                    self.ClientAdded(client.dbus_object_path)
3201
 
            
3202
 
            def client_removed_signal(self, client):
3203
 
                """Send the new standard signal and the old signal"""
3204
 
                if use_dbus:
3205
 
                    # New standard signal
3206
 
                    self.InterfacesRemoved(
3207
 
                        client.dbus_object_path,
3208
 
                        client._get_all_interface_names())
3209
 
                    # Old signal
3210
 
                    self.ClientRemoved(client.dbus_object_path,
3211
 
                                       client.name)
3212
1998
        
3213
1999
        mandos_dbus_service = MandosDBusService()
3214
2000
    
3215
2001
    def cleanup():
3216
2002
        "Cleanup function; run on exit"
3217
 
        if zeroconf:
3218
 
            service.cleanup()
3219
 
        
3220
 
        multiprocessing.active_children()
3221
 
        wnull.close()
3222
 
        if not (tcp_server.clients or client_settings):
3223
 
            return
3224
 
        
3225
 
        # Store client before exiting. Secrets are encrypted with key
3226
 
        # based on what config file has. If config file is
3227
 
        # removed/edited, old secret will thus be unrecovable.
3228
 
        clients = {}
3229
 
        with PGPEngine() as pgp:
3230
 
            for client in tcp_server.clients.itervalues():
3231
 
                key = client_settings[client.name]["secret"]
3232
 
                client.encrypted_secret = pgp.encrypt(client.secret,
3233
 
                                                      key)
3234
 
                client_dict = {}
3235
 
                
3236
 
                # A list of attributes that can not be pickled
3237
 
                # + secret.
3238
 
                exclude = { "bus", "changedstate", "secret",
3239
 
                            "checker", "server_settings" }
3240
 
                for name, typ in inspect.getmembers(dbus.service
3241
 
                                                    .Object):
3242
 
                    exclude.add(name)
3243
 
                
3244
 
                client_dict["encrypted_secret"] = (client
3245
 
                                                   .encrypted_secret)
3246
 
                for attr in client.client_structure:
3247
 
                    if attr not in exclude:
3248
 
                        client_dict[attr] = getattr(client, attr)
3249
 
                
3250
 
                clients[client.name] = client_dict
3251
 
                del client_settings[client.name]["secret"]
3252
 
        
3253
 
        try:
3254
 
            with tempfile.NamedTemporaryFile(
3255
 
                    mode='wb',
3256
 
                    suffix=".pickle",
3257
 
                    prefix='clients-',
3258
 
                    dir=os.path.dirname(stored_state_path),
3259
 
                    delete=False) as stored_state:
3260
 
                pickle.dump((clients, client_settings), stored_state)
3261
 
                tempname = stored_state.name
3262
 
            os.rename(tempname, stored_state_path)
3263
 
        except (IOError, OSError) as e:
3264
 
            if not debug:
3265
 
                try:
3266
 
                    os.remove(tempname)
3267
 
                except NameError:
3268
 
                    pass
3269
 
            if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
3270
 
                logger.warning("Could not save persistent state: {}"
3271
 
                               .format(os.strerror(e.errno)))
3272
 
            else:
3273
 
                logger.warning("Could not save persistent state:",
3274
 
                               exc_info=e)
3275
 
                raise
3276
 
        
3277
 
        # Delete all clients, and settings from config
 
2003
        service.cleanup()
 
2004
        
3278
2005
        while tcp_server.clients:
3279
 
            name, client = tcp_server.clients.popitem()
 
2006
            client = tcp_server.clients.pop()
3280
2007
            if use_dbus:
3281
2008
                client.remove_from_connection()
3282
 
            # Don't signal the disabling
 
2009
            client.disable_hook = None
 
2010
            # Don't signal anything except ClientRemoved
3283
2011
            client.disable(quiet=True)
3284
 
            # Emit D-Bus signal for removal
3285
2012
            if use_dbus:
3286
 
                mandos_dbus_service.client_removed_signal(client)
3287
 
        client_settings.clear()
 
2013
                # Emit D-Bus signal
 
2014
                mandos_dbus_service.ClientRemoved(client.dbus_object_path,
 
2015
                                                  client.name)
3288
2016
    
3289
2017
    atexit.register(cleanup)
3290
2018
    
3291
 
    for client in tcp_server.clients.itervalues():
 
2019
    for client in tcp_server.clients:
3292
2020
        if use_dbus:
3293
 
            # Emit D-Bus signal for adding
3294
 
            mandos_dbus_service.client_added_signal(client)
3295
 
        # Need to initiate checking of clients
3296
 
        if client.enabled:
3297
 
            client.init_checker()
 
2021
            # Emit D-Bus signal
 
2022
            mandos_dbus_service.ClientAdded(client.dbus_object_path)
 
2023
        client.enable()
3298
2024
    
3299
2025
    tcp_server.enable()
3300
2026
    tcp_server.server_activate()
3301
2027
    
3302
2028
    # Find out what port we got
3303
 
    if zeroconf:
3304
 
        service.port = tcp_server.socket.getsockname()[1]
 
2029
    service.port = tcp_server.socket.getsockname()[1]
3305
2030
    if use_ipv6:
3306
2031
        logger.info("Now listening on address %r, port %d,"
3307
 
                    " flowinfo %d, scope_id %d",
3308
 
                    *tcp_server.socket.getsockname())
 
2032
                    " flowinfo %d, scope_id %d"
 
2033
                    % tcp_server.socket.getsockname())
3309
2034
    else:                       # IPv4
3310
 
        logger.info("Now listening on address %r, port %d",
3311
 
                    *tcp_server.socket.getsockname())
 
2035
        logger.info("Now listening on address %r, port %d"
 
2036
                    % tcp_server.socket.getsockname())
3312
2037
    
3313
2038
    #service.interface = tcp_server.socket.getsockname()[3]
3314
2039
    
3315
2040
    try:
3316
 
        if zeroconf:
3317
 
            # From the Avahi example code
3318
 
            try:
3319
 
                service.activate()
3320
 
            except dbus.exceptions.DBusException as error:
3321
 
                logger.critical("D-Bus Exception", exc_info=error)
3322
 
                cleanup()
3323
 
                sys.exit(1)
3324
 
            # End of Avahi example code
 
2041
        # From the Avahi example code
 
2042
        try:
 
2043
            service.activate()
 
2044
        except dbus.exceptions.DBusException as error:
 
2045
            logger.critical("DBusException: %s", error)
 
2046
            cleanup()
 
2047
            sys.exit(1)
 
2048
        # End of Avahi example code
3325
2049
        
3326
2050
        gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
3327
2051
                             lambda *args, **kwargs:
3331
2055
        logger.debug("Starting main loop")
3332
2056
        main_loop.run()
3333
2057
    except AvahiError as error:
3334
 
        logger.critical("Avahi Error", exc_info=error)
 
2058
        logger.critical("AvahiError: %s", error)
3335
2059
        cleanup()
3336
2060
        sys.exit(1)
3337
2061
    except KeyboardInterrupt:
3342
2066
    # Must run before the D-Bus bus name gets deregistered
3343
2067
    cleanup()
3344
2068
 
3345
 
 
3346
2069
if __name__ == '__main__':
3347
2070
    main()