/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos

  • Committer: Teddy Hogeborn
  • Date: 2011-08-08 21:12:37 UTC
  • Revision ID: teddy@fukt.bsnet.se-20110808211237-jejsz5brjytrjot8
* Makefile (DOCS): Added "intro.8mandos".
  (intro.8mandos, intro.8mandos.xhtml): New.
* README: Replaced text with link, reference and short summary.
* intro.xml: New.
* mandos-clients.conf.xml (SEE ALSO): Added "intro(8mandos)".
* mandos-ctl.xml (SEE ALSO): - '' -
* mandos-keygen.xml (SEE ALSO): - '' -
* mandos-monitor.xml (SEE ALSO): - '' -
* mandos.conf.xml (SEE ALSO): - '' -
* mandos.xml (SEE ALSO): - '' -
* plugin-runner.xml (SEE ALSO): - '' -
* plugins.d/askpass-fifo.xml (SEE ALSO): - '' -
* plugins.d/mandos-client.xml (SEE ALSO): - '' -
* plugins.d/password-prompt.xml (SEE ALSO): - '' -
* plugins.d/plymouth.xml (SEE ALSO): - '' -
* plugins.d/splashy.xml (SEE ALSO): - '' -
* plugins.d/usplash.xml (SEE ALSO): - '' -

Show diffs side-by-side

added added

removed removed

Lines of Context:
11
11
# "AvahiService" class, and some lines in "main".
12
12
13
13
# Everything else is
14
 
# Copyright © 2008-2012 Teddy Hogeborn
15
 
# Copyright © 2008-2012 Björn Påhlsson
 
14
# Copyright © 2008-2011 Teddy Hogeborn
 
15
# Copyright © 2008-2011 Björn Påhlsson
16
16
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
28
28
# along with this program.  If not, see
29
29
# <http://www.gnu.org/licenses/>.
30
30
31
 
# Contact the authors at <mandos@recompile.se>.
 
31
# Contact the authors at <mandos@fukt.bsnet.se>.
32
32
33
33
 
34
34
from __future__ import (division, absolute_import, print_function,
62
62
import functools
63
63
import cPickle as pickle
64
64
import multiprocessing
65
 
import types
66
 
import binascii
67
 
import tempfile
68
65
 
69
66
import dbus
70
67
import dbus.service
75
72
import ctypes.util
76
73
import xml.dom.minidom
77
74
import inspect
78
 
import GnuPGInterface
79
75
 
80
76
try:
81
77
    SO_BINDTODEVICE = socket.SO_BINDTODEVICE
85
81
    except ImportError:
86
82
        SO_BINDTODEVICE = None
87
83
 
88
 
version = "1.4.1"
89
 
stored_state_file = "clients.pickle"
90
 
 
91
 
logger = logging.getLogger()
 
84
 
 
85
version = "1.3.1"
 
86
 
 
87
#logger = logging.getLogger('mandos')
 
88
logger = logging.Logger('mandos')
92
89
syslogger = (logging.handlers.SysLogHandler
93
90
             (facility = logging.handlers.SysLogHandler.LOG_DAEMON,
94
91
              address = str("/dev/log")))
95
 
 
96
 
try:
97
 
    if_nametoindex = (ctypes.cdll.LoadLibrary
98
 
                      (ctypes.util.find_library("c"))
99
 
                      .if_nametoindex)
100
 
except (OSError, AttributeError):
101
 
    def if_nametoindex(interface):
102
 
        "Get an interface index the hard way, i.e. using fcntl()"
103
 
        SIOCGIFINDEX = 0x8933  # From /usr/include/linux/sockios.h
104
 
        with contextlib.closing(socket.socket()) as s:
105
 
            ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
106
 
                                struct.pack(str("16s16x"),
107
 
                                            interface))
108
 
        interface_index = struct.unpack(str("I"),
109
 
                                        ifreq[16:20])[0]
110
 
        return interface_index
111
 
 
112
 
 
113
 
def initlogger(debug, level=logging.WARNING):
114
 
    """init logger and add loglevel"""
115
 
    
116
 
    syslogger.setFormatter(logging.Formatter
117
 
                           ('Mandos [%(process)d]: %(levelname)s:'
118
 
                            ' %(message)s'))
119
 
    logger.addHandler(syslogger)
120
 
    
121
 
    if debug:
122
 
        console = logging.StreamHandler()
123
 
        console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
124
 
                                               ' [%(process)d]:'
125
 
                                               ' %(levelname)s:'
126
 
                                               ' %(message)s'))
127
 
        logger.addHandler(console)
128
 
    logger.setLevel(level)
129
 
 
130
 
 
131
 
class PGPError(Exception):
132
 
    """Exception if encryption/decryption fails"""
133
 
    pass
134
 
 
135
 
 
136
 
class PGPEngine(object):
137
 
    """A simple class for OpenPGP symmetric encryption & decryption"""
138
 
    def __init__(self):
139
 
        self.gnupg = GnuPGInterface.GnuPG()
140
 
        self.tempdir = tempfile.mkdtemp(prefix="mandos-")
141
 
        self.gnupg = GnuPGInterface.GnuPG()
142
 
        self.gnupg.options.meta_interactive = False
143
 
        self.gnupg.options.homedir = self.tempdir
144
 
        self.gnupg.options.extra_args.extend(['--force-mdc',
145
 
                                              '--quiet',
146
 
                                              '--no-use-agent'])
147
 
    
148
 
    def __enter__(self):
149
 
        return self
150
 
    
151
 
    def __exit__ (self, exc_type, exc_value, traceback):
152
 
        self._cleanup()
153
 
        return False
154
 
    
155
 
    def __del__(self):
156
 
        self._cleanup()
157
 
    
158
 
    def _cleanup(self):
159
 
        if self.tempdir is not None:
160
 
            # Delete contents of tempdir
161
 
            for root, dirs, files in os.walk(self.tempdir,
162
 
                                             topdown = False):
163
 
                for filename in files:
164
 
                    os.remove(os.path.join(root, filename))
165
 
                for dirname in dirs:
166
 
                    os.rmdir(os.path.join(root, dirname))
167
 
            # Remove tempdir
168
 
            os.rmdir(self.tempdir)
169
 
            self.tempdir = None
170
 
    
171
 
    def password_encode(self, password):
172
 
        # Passphrase can not be empty and can not contain newlines or
173
 
        # NUL bytes.  So we prefix it and hex encode it.
174
 
        return b"mandos" + binascii.hexlify(password)
175
 
    
176
 
    def encrypt(self, data, password):
177
 
        self.gnupg.passphrase = self.password_encode(password)
178
 
        with open(os.devnull) as devnull:
179
 
            try:
180
 
                proc = self.gnupg.run(['--symmetric'],
181
 
                                      create_fhs=['stdin', 'stdout'],
182
 
                                      attach_fhs={'stderr': devnull})
183
 
                with contextlib.closing(proc.handles['stdin']) as f:
184
 
                    f.write(data)
185
 
                with contextlib.closing(proc.handles['stdout']) as f:
186
 
                    ciphertext = f.read()
187
 
                proc.wait()
188
 
            except IOError as e:
189
 
                raise PGPError(e)
190
 
        self.gnupg.passphrase = None
191
 
        return ciphertext
192
 
    
193
 
    def decrypt(self, data, password):
194
 
        self.gnupg.passphrase = self.password_encode(password)
195
 
        with open(os.devnull) as devnull:
196
 
            try:
197
 
                proc = self.gnupg.run(['--decrypt'],
198
 
                                      create_fhs=['stdin', 'stdout'],
199
 
                                      attach_fhs={'stderr': devnull})
200
 
                with contextlib.closing(proc.handles['stdin'] ) as f:
201
 
                    f.write(data)
202
 
                with contextlib.closing(proc.handles['stdout']) as f:
203
 
                    decrypted_plaintext = f.read()
204
 
                proc.wait()
205
 
            except IOError as e:
206
 
                raise PGPError(e)
207
 
        self.gnupg.passphrase = None
208
 
        return decrypted_plaintext
209
 
 
210
 
 
 
92
syslogger.setFormatter(logging.Formatter
 
93
                       ('Mandos [%(process)d]: %(levelname)s:'
 
94
                        ' %(message)s'))
 
95
logger.addHandler(syslogger)
 
96
 
 
97
console = logging.StreamHandler()
 
98
console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'
 
99
                                       ' %(levelname)s:'
 
100
                                       ' %(message)s'))
 
101
logger.addHandler(console)
211
102
 
212
103
class AvahiError(Exception):
213
104
    def __init__(self, value, *args, **kwargs):
268
159
                            " after %i retries, exiting.",
269
160
                            self.rename_count)
270
161
            raise AvahiServiceError("Too many renames")
271
 
        self.name = unicode(self.server
272
 
                            .GetAlternativeServiceName(self.name))
 
162
        self.name = unicode(self.server.GetAlternativeServiceName(self.name))
273
163
        logger.info("Changing Zeroconf service name to %r ...",
274
164
                    self.name)
 
165
        syslogger.setFormatter(logging.Formatter
 
166
                               ('Mandos (%s) [%%(process)d]:'
 
167
                                ' %%(levelname)s: %%(message)s'
 
168
                                % self.name))
275
169
        self.remove()
276
170
        try:
277
171
            self.add()
297
191
                avahi.DBUS_INTERFACE_ENTRY_GROUP)
298
192
        self.entry_group_state_changed_match = (
299
193
            self.group.connect_to_signal(
300
 
                'StateChanged', self.entry_group_state_changed))
 
194
                'StateChanged', self .entry_group_state_changed))
301
195
        logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
302
196
                     self.name, self.type)
303
197
        self.group.AddService(
329
223
            try:
330
224
                self.group.Free()
331
225
            except (dbus.exceptions.UnknownMethodException,
332
 
                    dbus.exceptions.DBusException):
 
226
                    dbus.exceptions.DBusException) as e:
333
227
                pass
334
228
            self.group = None
335
229
        self.remove()
369
263
                                 self.server_state_changed)
370
264
        self.server_state_changed(self.server.GetState())
371
265
 
372
 
class AvahiServiceToSyslog(AvahiService):
373
 
    def rename(self):
374
 
        """Add the new name to the syslog messages"""
375
 
        ret = AvahiService.rename(self)
376
 
        syslogger.setFormatter(logging.Formatter
377
 
                               ('Mandos (%s) [%%(process)d]:'
378
 
                                ' %%(levelname)s: %%(message)s'
379
 
                                % self.name))
380
 
        return ret
381
266
 
382
 
def timedelta_to_milliseconds(td):
383
 
    "Convert a datetime.timedelta() to milliseconds"
384
 
    return ((td.days * 24 * 60 * 60 * 1000)
385
 
            + (td.seconds * 1000)
386
 
            + (td.microseconds // 1000))
387
 
        
388
267
class Client(object):
389
268
    """A representation of a client host served by this server.
390
269
    
391
270
    Attributes:
392
 
    approved:   bool(); 'None' if not yet approved/disapproved
 
271
    _approved:   bool(); 'None' if not yet approved/disapproved
393
272
    approval_delay: datetime.timedelta(); Time to wait for approval
394
273
    approval_duration: datetime.timedelta(); Duration of one approval
395
274
    checker:    subprocess.Popen(); a running checker process used
402
281
                     instance %(name)s can be used in the command.
403
282
    checker_initiator_tag: a gobject event source tag, or None
404
283
    created:    datetime.datetime(); (UTC) object creation
405
 
    client_structure: Object describing what attributes a client has
406
 
                      and is used for storing the client at exit
407
284
    current_checker_command: string; current running checker_command
 
285
    disable_hook:  If set, called by disable() as disable_hook(self)
408
286
    disable_initiator_tag: a gobject event source tag, or None
409
287
    enabled:    bool()
410
288
    fingerprint: string (40 or 32 hexadecimal digits); used to
413
291
    interval:   datetime.timedelta(); How often to start a new checker
414
292
    last_approval_request: datetime.datetime(); (UTC) or None
415
293
    last_checked_ok: datetime.datetime(); (UTC) or None
416
 
    last_checker_status: integer between 0 and 255 reflecting exit
417
 
                         status of last checker. -1 reflects crashed
418
 
                         checker, or None.
419
 
    last_enabled: datetime.datetime(); (UTC) or None
 
294
    last_enabled: datetime.datetime(); (UTC)
420
295
    name:       string; from the config file, used in log messages and
421
296
                        D-Bus identifiers
422
297
    secret:     bytestring; sent verbatim (over TLS) to client
423
298
    timeout:    datetime.timedelta(); How long from last_checked_ok
424
299
                                      until this client is disabled
425
 
    extended_timeout:   extra long timeout when password has been sent
426
300
    runtime_expansions: Allowed attributes for runtime expansion.
427
 
    expires:    datetime.datetime(); time (UTC) when a client will be
428
 
                disabled, or None
429
301
    """
430
302
    
431
303
    runtime_expansions = ("approval_delay", "approval_duration",
432
304
                          "created", "enabled", "fingerprint",
433
305
                          "host", "interval", "last_checked_ok",
434
306
                          "last_enabled", "name", "timeout")
435
 
    client_defaults = { "timeout": "5m",
436
 
                        "extended_timeout": "15m",
437
 
                        "interval": "2m",
438
 
                        "checker": "fping -q -- %%(host)s",
439
 
                        "host": "",
440
 
                        "approval_delay": "0s",
441
 
                        "approval_duration": "1s",
442
 
                        "approved_by_default": "True",
443
 
                        "enabled": "True",
444
 
                        }
 
307
    
 
308
    @staticmethod
 
309
    def _timedelta_to_milliseconds(td):
 
310
        "Convert a datetime.timedelta() to milliseconds"
 
311
        return ((td.days * 24 * 60 * 60 * 1000)
 
312
                + (td.seconds * 1000)
 
313
                + (td.microseconds // 1000))
445
314
    
446
315
    def timeout_milliseconds(self):
447
316
        "Return the 'timeout' attribute in milliseconds"
448
 
        return timedelta_to_milliseconds(self.timeout)
449
 
    
450
 
    def extended_timeout_milliseconds(self):
451
 
        "Return the 'extended_timeout' attribute in milliseconds"
452
 
        return timedelta_to_milliseconds(self.extended_timeout)
 
317
        return self._timedelta_to_milliseconds(self.timeout)
453
318
    
454
319
    def interval_milliseconds(self):
455
320
        "Return the 'interval' attribute in milliseconds"
456
 
        return timedelta_to_milliseconds(self.interval)
457
 
    
 
321
        return self._timedelta_to_milliseconds(self.interval)
 
322
 
458
323
    def approval_delay_milliseconds(self):
459
 
        return timedelta_to_milliseconds(self.approval_delay)
460
 
 
461
 
    @staticmethod
462
 
    def config_parser(config):
463
 
        """Construct a new dict of client settings of this form:
464
 
        { client_name: {setting_name: value, ...}, ...}
465
 
        with exceptions for any special settings as defined above.
466
 
        NOTE: Must be a pure function. Must return the same result
467
 
        value given the same arguments.
468
 
        """
469
 
        settings = {}
470
 
        for client_name in config.sections():
471
 
            section = dict(config.items(client_name))
472
 
            client = settings[client_name] = {}
473
 
            
474
 
            client["host"] = section["host"]
475
 
            # Reformat values from string types to Python types
476
 
            client["approved_by_default"] = config.getboolean(
477
 
                client_name, "approved_by_default")
478
 
            client["enabled"] = config.getboolean(client_name,
479
 
                                                  "enabled")
480
 
            
481
 
            client["fingerprint"] = (section["fingerprint"].upper()
482
 
                                     .replace(" ", ""))
483
 
            if "secret" in section:
484
 
                client["secret"] = section["secret"].decode("base64")
485
 
            elif "secfile" in section:
486
 
                with open(os.path.expanduser(os.path.expandvars
487
 
                                             (section["secfile"])),
488
 
                          "rb") as secfile:
489
 
                    client["secret"] = secfile.read()
490
 
            else:
491
 
                raise TypeError("No secret or secfile for section %s"
492
 
                                % section)
493
 
            client["timeout"] = string_to_delta(section["timeout"])
494
 
            client["extended_timeout"] = string_to_delta(
495
 
                section["extended_timeout"])
496
 
            client["interval"] = string_to_delta(section["interval"])
497
 
            client["approval_delay"] = string_to_delta(
498
 
                section["approval_delay"])
499
 
            client["approval_duration"] = string_to_delta(
500
 
                section["approval_duration"])
501
 
            client["checker_command"] = section["checker"]
502
 
            client["last_approval_request"] = None
503
 
            client["last_checked_ok"] = None
504
 
            client["last_checker_status"] = None
505
 
        
506
 
        return settings
507
 
        
508
 
        
509
 
    def __init__(self, settings, name = None):
 
324
        return self._timedelta_to_milliseconds(self.approval_delay)
 
325
    
 
326
    def __init__(self, name = None, disable_hook=None, config=None):
510
327
        """Note: the 'checker' key in 'config' sets the
511
328
        'checker_command' attribute and *not* the 'checker'
512
329
        attribute."""
513
330
        self.name = name
514
 
        # adding all client settings
515
 
        for setting, value in settings.iteritems():
516
 
            setattr(self, setting, value)
517
 
        
518
 
        if self.enabled:
519
 
            if not hasattr(self, "last_enabled"):
520
 
                self.last_enabled = datetime.datetime.utcnow()
521
 
            if not hasattr(self, "expires"):
522
 
                self.expires = (datetime.datetime.utcnow()
523
 
                                + self.timeout)
524
 
        else:
525
 
            self.last_enabled = None
526
 
            self.expires = None
527
 
       
 
331
        if config is None:
 
332
            config = {}
528
333
        logger.debug("Creating client %r", self.name)
529
334
        # Uppercase and remove spaces from fingerprint for later
530
335
        # comparison purposes with return value from the fingerprint()
531
336
        # function
 
337
        self.fingerprint = (config["fingerprint"].upper()
 
338
                            .replace(" ", ""))
532
339
        logger.debug("  Fingerprint: %s", self.fingerprint)
533
 
        self.created = settings.get("created",
534
 
                                    datetime.datetime.utcnow())
535
 
 
536
 
        # attributes specific for this server instance
 
340
        if "secret" in config:
 
341
            self.secret = config["secret"].decode("base64")
 
342
        elif "secfile" in config:
 
343
            with open(os.path.expanduser(os.path.expandvars
 
344
                                         (config["secfile"])),
 
345
                      "rb") as secfile:
 
346
                self.secret = secfile.read()
 
347
        else:
 
348
            raise TypeError("No secret or secfile for client %s"
 
349
                            % self.name)
 
350
        self.host = config.get("host", "")
 
351
        self.created = datetime.datetime.utcnow()
 
352
        self.enabled = False
 
353
        self.last_approval_request = None
 
354
        self.last_enabled = None
 
355
        self.last_checked_ok = None
 
356
        self.timeout = string_to_delta(config["timeout"])
 
357
        self.interval = string_to_delta(config["interval"])
 
358
        self.disable_hook = disable_hook
537
359
        self.checker = None
538
360
        self.checker_initiator_tag = None
539
361
        self.disable_initiator_tag = None
540
362
        self.checker_callback_tag = None
 
363
        self.checker_command = config["checker"]
541
364
        self.current_checker_command = None
542
 
        self.approved = None
 
365
        self.last_connect = None
 
366
        self._approved = None
 
367
        self.approved_by_default = config.get("approved_by_default",
 
368
                                              True)
543
369
        self.approvals_pending = 0
544
 
        self.changedstate = (multiprocessing_manager
545
 
                             .Condition(multiprocessing_manager
546
 
                                        .Lock()))
547
 
        self.client_structure = [attr for attr in
548
 
                                 self.__dict__.iterkeys()
549
 
                                 if not attr.startswith("_")]
550
 
        self.client_structure.append("client_structure")
551
 
        
552
 
        for name, t in inspect.getmembers(type(self),
553
 
                                          lambda obj:
554
 
                                              isinstance(obj,
555
 
                                                         property)):
556
 
            if not name.startswith("_"):
557
 
                self.client_structure.append(name)
 
370
        self.approval_delay = string_to_delta(
 
371
            config["approval_delay"])
 
372
        self.approval_duration = string_to_delta(
 
373
            config["approval_duration"])
 
374
        self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())
558
375
    
559
 
    # Send notice to process children that client state has changed
560
376
    def send_changedstate(self):
561
 
        with self.changedstate:
562
 
            self.changedstate.notify_all()
563
 
    
 
377
        self.changedstate.acquire()
 
378
        self.changedstate.notify_all()
 
379
        self.changedstate.release()
 
380
        
564
381
    def enable(self):
565
382
        """Start this client's checker and timeout hooks"""
566
383
        if getattr(self, "enabled", False):
567
384
            # Already enabled
568
385
            return
569
386
        self.send_changedstate()
570
 
        self.expires = datetime.datetime.utcnow() + self.timeout
571
 
        self.enabled = True
572
387
        self.last_enabled = datetime.datetime.utcnow()
573
 
        self.init_checker()
 
388
        # Schedule a new checker to be started an 'interval' from now,
 
389
        # and every interval from then on.
 
390
        self.checker_initiator_tag = (gobject.timeout_add
 
391
                                      (self.interval_milliseconds(),
 
392
                                       self.start_checker))
 
393
        # Schedule a disable() when 'timeout' has passed
 
394
        self.disable_initiator_tag = (gobject.timeout_add
 
395
                                   (self.timeout_milliseconds(),
 
396
                                    self.disable))
 
397
        self.enabled = True
 
398
        # Also start a new checker *right now*.
 
399
        self.start_checker()
574
400
    
575
401
    def disable(self, quiet=True):
576
402
        """Disable this client."""
583
409
        if getattr(self, "disable_initiator_tag", False):
584
410
            gobject.source_remove(self.disable_initiator_tag)
585
411
            self.disable_initiator_tag = None
586
 
        self.expires = None
587
412
        if getattr(self, "checker_initiator_tag", False):
588
413
            gobject.source_remove(self.checker_initiator_tag)
589
414
            self.checker_initiator_tag = None
590
415
        self.stop_checker()
 
416
        if self.disable_hook:
 
417
            self.disable_hook(self)
591
418
        self.enabled = False
592
419
        # Do not run this again if called by a gobject.timeout_add
593
420
        return False
594
421
    
595
422
    def __del__(self):
 
423
        self.disable_hook = None
596
424
        self.disable()
597
425
    
598
 
    def init_checker(self):
599
 
        # Schedule a new checker to be started an 'interval' from now,
600
 
        # and every interval from then on.
601
 
        self.checker_initiator_tag = (gobject.timeout_add
602
 
                                      (self.interval_milliseconds(),
603
 
                                       self.start_checker))
604
 
        # Schedule a disable() when 'timeout' has passed
605
 
        self.disable_initiator_tag = (gobject.timeout_add
606
 
                                   (self.timeout_milliseconds(),
607
 
                                    self.disable))
608
 
        # Also start a new checker *right now*.
609
 
        self.start_checker()
610
 
    
611
426
    def checker_callback(self, pid, condition, command):
612
427
        """The checker has completed, so take appropriate actions."""
613
428
        self.checker_callback_tag = None
614
429
        self.checker = None
615
430
        if os.WIFEXITED(condition):
616
 
            self.last_checker_status = os.WEXITSTATUS(condition)
617
 
            if self.last_checker_status == 0:
 
431
            exitstatus = os.WEXITSTATUS(condition)
 
432
            if exitstatus == 0:
618
433
                logger.info("Checker for %(name)s succeeded",
619
434
                            vars(self))
620
435
                self.checked_ok()
622
437
                logger.info("Checker for %(name)s failed",
623
438
                            vars(self))
624
439
        else:
625
 
            self.last_checker_status = -1
626
440
            logger.warning("Checker for %(name)s crashed?",
627
441
                           vars(self))
628
442
    
629
 
    def checked_ok(self, timeout=None):
 
443
    def checked_ok(self):
630
444
        """Bump up the timeout for this client.
631
445
        
632
446
        This should only be called when the client has been seen,
633
447
        alive and well.
634
448
        """
635
 
        if timeout is None:
636
 
            timeout = self.timeout
637
449
        self.last_checked_ok = datetime.datetime.utcnow()
638
 
        if self.disable_initiator_tag is not None:
639
 
            gobject.source_remove(self.disable_initiator_tag)
640
 
        if getattr(self, "enabled", False):
641
 
            self.disable_initiator_tag = (gobject.timeout_add
642
 
                                          (timedelta_to_milliseconds
643
 
                                           (timeout), self.disable))
644
 
            self.expires = datetime.datetime.utcnow() + timeout
 
450
        gobject.source_remove(self.disable_initiator_tag)
 
451
        self.disable_initiator_tag = (gobject.timeout_add
 
452
                                      (self.timeout_milliseconds(),
 
453
                                       self.disable))
645
454
    
646
455
    def need_approval(self):
647
456
        self.last_approval_request = datetime.datetime.utcnow()
687
496
                                       'replace')))
688
497
                    for attr in
689
498
                    self.runtime_expansions)
690
 
                
 
499
 
691
500
                try:
692
501
                    command = self.checker_command % escaped_attrs
693
502
                except TypeError as error:
739
548
                raise
740
549
        self.checker = None
741
550
 
742
 
 
743
551
def dbus_service_property(dbus_interface, signature="v",
744
552
                          access="readwrite", byte_arrays=False):
745
553
    """Decorators for marking methods of a DBusObjectWithProperties to
791
599
 
792
600
class DBusObjectWithProperties(dbus.service.Object):
793
601
    """A D-Bus object with properties.
794
 
    
 
602
 
795
603
    Classes inheriting from this can use the dbus_service_property
796
604
    decorator to expose methods as D-Bus properties.  It exposes the
797
605
    standard Get(), Set(), and GetAll() methods on the D-Bus.
804
612
    def _get_all_dbus_properties(self):
805
613
        """Returns a generator of (name, attribute) pairs
806
614
        """
807
 
        return ((prop.__get__(self)._dbus_name, prop.__get__(self))
808
 
                for cls in self.__class__.__mro__
 
615
        return ((prop._dbus_name, prop)
809
616
                for name, prop in
810
 
                inspect.getmembers(cls, self._is_dbus_property))
 
617
                inspect.getmembers(self, self._is_dbus_property))
811
618
    
812
619
    def _get_dbus_property(self, interface_name, property_name):
813
620
        """Returns a bound method if one exists which is a D-Bus
814
621
        property with the specified name and interface.
815
622
        """
816
 
        for cls in  self.__class__.__mro__:
817
 
            for name, value in (inspect.getmembers
818
 
                                (cls, self._is_dbus_property)):
819
 
                if (value._dbus_name == property_name
820
 
                    and value._dbus_interface == interface_name):
821
 
                    return value.__get__(self)
822
 
        
 
623
        for name in (property_name,
 
624
                     property_name + "_dbus_property"):
 
625
            prop = getattr(self, name, None)
 
626
            if (prop is None
 
627
                or not self._is_dbus_property(prop)
 
628
                or prop._dbus_name != property_name
 
629
                or (interface_name and prop._dbus_interface
 
630
                    and interface_name != prop._dbus_interface)):
 
631
                continue
 
632
            return prop
823
633
        # No such property
824
634
        raise DBusPropertyNotFound(self.dbus_object_path + ":"
825
635
                                   + interface_name + "."
859
669
    def GetAll(self, interface_name):
860
670
        """Standard D-Bus property GetAll() method, see D-Bus
861
671
        standard.
862
 
        
 
672
 
863
673
        Note: Will not include properties with access="write".
864
674
        """
865
 
        properties = {}
 
675
        all = {}
866
676
        for name, prop in self._get_all_dbus_properties():
867
677
            if (interface_name
868
678
                and interface_name != prop._dbus_interface):
873
683
                continue
874
684
            value = prop()
875
685
            if not hasattr(value, "variant_level"):
876
 
                properties[name] = value
 
686
                all[name] = value
877
687
                continue
878
 
            properties[name] = type(value)(value, variant_level=
879
 
                                           value.variant_level+1)
880
 
        return dbus.Dictionary(properties, signature="sv")
 
688
            all[name] = type(value)(value, variant_level=
 
689
                                    value.variant_level+1)
 
690
        return dbus.Dictionary(all, signature="sv")
881
691
    
882
692
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
883
693
                         out_signature="s",
927
737
        return xmlstring
928
738
 
929
739
 
930
 
def datetime_to_dbus (dt, variant_level=0):
931
 
    """Convert a UTC datetime.datetime() to a D-Bus type."""
932
 
    if dt is None:
933
 
        return dbus.String("", variant_level = variant_level)
934
 
    return dbus.String(dt.isoformat(),
935
 
                       variant_level=variant_level)
936
 
 
937
 
 
938
 
class AlternateDBusNamesMetaclass(DBusObjectWithProperties
939
 
                                  .__metaclass__):
940
 
    """Applied to an empty subclass of a D-Bus object, this metaclass
941
 
    will add additional D-Bus attributes matching a certain pattern.
942
 
    """
943
 
    def __new__(mcs, name, bases, attr):
944
 
        # Go through all the base classes which could have D-Bus
945
 
        # methods, signals, or properties in them
946
 
        for base in (b for b in bases
947
 
                     if issubclass(b, dbus.service.Object)):
948
 
            # Go though all attributes of the base class
949
 
            for attrname, attribute in inspect.getmembers(base):
950
 
                # Ignore non-D-Bus attributes, and D-Bus attributes
951
 
                # with the wrong interface name
952
 
                if (not hasattr(attribute, "_dbus_interface")
953
 
                    or not attribute._dbus_interface
954
 
                    .startswith("se.recompile.Mandos")):
955
 
                    continue
956
 
                # Create an alternate D-Bus interface name based on
957
 
                # the current name
958
 
                alt_interface = (attribute._dbus_interface
959
 
                                 .replace("se.recompile.Mandos",
960
 
                                          "se.bsnet.fukt.Mandos"))
961
 
                # Is this a D-Bus signal?
962
 
                if getattr(attribute, "_dbus_is_signal", False):
963
 
                    # Extract the original non-method function by
964
 
                    # black magic
965
 
                    nonmethod_func = (dict(
966
 
                            zip(attribute.func_code.co_freevars,
967
 
                                attribute.__closure__))["func"]
968
 
                                      .cell_contents)
969
 
                    # Create a new, but exactly alike, function
970
 
                    # object, and decorate it to be a new D-Bus signal
971
 
                    # with the alternate D-Bus interface name
972
 
                    new_function = (dbus.service.signal
973
 
                                    (alt_interface,
974
 
                                     attribute._dbus_signature)
975
 
                                    (types.FunctionType(
976
 
                                nonmethod_func.func_code,
977
 
                                nonmethod_func.func_globals,
978
 
                                nonmethod_func.func_name,
979
 
                                nonmethod_func.func_defaults,
980
 
                                nonmethod_func.func_closure)))
981
 
                    # Define a creator of a function to call both the
982
 
                    # old and new functions, so both the old and new
983
 
                    # signals gets sent when the function is called
984
 
                    def fixscope(func1, func2):
985
 
                        """This function is a scope container to pass
986
 
                        func1 and func2 to the "call_both" function
987
 
                        outside of its arguments"""
988
 
                        def call_both(*args, **kwargs):
989
 
                            """This function will emit two D-Bus
990
 
                            signals by calling func1 and func2"""
991
 
                            func1(*args, **kwargs)
992
 
                            func2(*args, **kwargs)
993
 
                        return call_both
994
 
                    # Create the "call_both" function and add it to
995
 
                    # the class
996
 
                    attr[attrname] = fixscope(attribute,
997
 
                                              new_function)
998
 
                # Is this a D-Bus method?
999
 
                elif getattr(attribute, "_dbus_is_method", False):
1000
 
                    # Create a new, but exactly alike, function
1001
 
                    # object.  Decorate it to be a new D-Bus method
1002
 
                    # with the alternate D-Bus interface name.  Add it
1003
 
                    # to the class.
1004
 
                    attr[attrname] = (dbus.service.method
1005
 
                                      (alt_interface,
1006
 
                                       attribute._dbus_in_signature,
1007
 
                                       attribute._dbus_out_signature)
1008
 
                                      (types.FunctionType
1009
 
                                       (attribute.func_code,
1010
 
                                        attribute.func_globals,
1011
 
                                        attribute.func_name,
1012
 
                                        attribute.func_defaults,
1013
 
                                        attribute.func_closure)))
1014
 
                # Is this a D-Bus property?
1015
 
                elif getattr(attribute, "_dbus_is_property", False):
1016
 
                    # Create a new, but exactly alike, function
1017
 
                    # object, and decorate it to be a new D-Bus
1018
 
                    # property with the alternate D-Bus interface
1019
 
                    # name.  Add it to the class.
1020
 
                    attr[attrname] = (dbus_service_property
1021
 
                                      (alt_interface,
1022
 
                                       attribute._dbus_signature,
1023
 
                                       attribute._dbus_access,
1024
 
                                       attribute
1025
 
                                       ._dbus_get_args_options
1026
 
                                       ["byte_arrays"])
1027
 
                                      (types.FunctionType
1028
 
                                       (attribute.func_code,
1029
 
                                        attribute.func_globals,
1030
 
                                        attribute.func_name,
1031
 
                                        attribute.func_defaults,
1032
 
                                        attribute.func_closure)))
1033
 
        return type.__new__(mcs, name, bases, attr)
1034
 
 
1035
 
 
1036
740
class ClientDBus(Client, DBusObjectWithProperties):
1037
741
    """A Client class using D-Bus
1038
742
    
1047
751
    # dbus.service.Object doesn't use super(), so we can't either.
1048
752
    
1049
753
    def __init__(self, bus = None, *args, **kwargs):
 
754
        self._approvals_pending = 0
1050
755
        self.bus = bus
1051
756
        Client.__init__(self, *args, **kwargs)
1052
 
        self._approvals_pending = 0
1053
 
        
1054
 
        self._approvals_pending = 0
1055
757
        # Only now, when this client is initialized, can it show up on
1056
758
        # the D-Bus
1057
759
        client_object_name = unicode(self.name).translate(
1062
764
        DBusObjectWithProperties.__init__(self, self.bus,
1063
765
                                          self.dbus_object_path)
1064
766
        
1065
 
    def notifychangeproperty(transform_func,
1066
 
                             dbus_name, type_func=lambda x: x,
1067
 
                             variant_level=1):
1068
 
        """ Modify a variable so that it's a property which announces
1069
 
        its changes to DBus.
1070
 
        
1071
 
        transform_fun: Function that takes a value and a variant_level
1072
 
                       and transforms it to a D-Bus type.
1073
 
        dbus_name: D-Bus name of the variable
1074
 
        type_func: Function that transform the value before sending it
1075
 
                   to the D-Bus.  Default: no transform
1076
 
        variant_level: D-Bus variant level.  Default: 1
1077
 
        """
1078
 
        attrname = "_{0}".format(dbus_name)
1079
 
        def setter(self, value):
1080
 
            if hasattr(self, "dbus_object_path"):
1081
 
                if (not hasattr(self, attrname) or
1082
 
                    type_func(getattr(self, attrname, None))
1083
 
                    != type_func(value)):
1084
 
                    dbus_value = transform_func(type_func(value),
1085
 
                                                variant_level
1086
 
                                                =variant_level)
1087
 
                    self.PropertyChanged(dbus.String(dbus_name),
1088
 
                                         dbus_value)
1089
 
            setattr(self, attrname, value)
1090
 
        
1091
 
        return property(lambda self: getattr(self, attrname), setter)
1092
 
    
1093
 
    
1094
 
    expires = notifychangeproperty(datetime_to_dbus, "Expires")
1095
 
    approvals_pending = notifychangeproperty(dbus.Boolean,
1096
 
                                             "ApprovalPending",
1097
 
                                             type_func = bool)
1098
 
    enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1099
 
    last_enabled = notifychangeproperty(datetime_to_dbus,
1100
 
                                        "LastEnabled")
1101
 
    checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",
1102
 
                                   type_func = lambda checker:
1103
 
                                       checker is not None)
1104
 
    last_checked_ok = notifychangeproperty(datetime_to_dbus,
1105
 
                                           "LastCheckedOK")
1106
 
    last_approval_request = notifychangeproperty(
1107
 
        datetime_to_dbus, "LastApprovalRequest")
1108
 
    approved_by_default = notifychangeproperty(dbus.Boolean,
1109
 
                                               "ApprovedByDefault")
1110
 
    approval_delay = notifychangeproperty(dbus.UInt64,
1111
 
                                          "ApprovalDelay",
1112
 
                                          type_func =
1113
 
                                          timedelta_to_milliseconds)
1114
 
    approval_duration = notifychangeproperty(
1115
 
        dbus.UInt64, "ApprovalDuration",
1116
 
        type_func = timedelta_to_milliseconds)
1117
 
    host = notifychangeproperty(dbus.String, "Host")
1118
 
    timeout = notifychangeproperty(dbus.UInt64, "Timeout",
1119
 
                                   type_func =
1120
 
                                   timedelta_to_milliseconds)
1121
 
    extended_timeout = notifychangeproperty(
1122
 
        dbus.UInt64, "ExtendedTimeout",
1123
 
        type_func = timedelta_to_milliseconds)
1124
 
    interval = notifychangeproperty(dbus.UInt64,
1125
 
                                    "Interval",
1126
 
                                    type_func =
1127
 
                                    timedelta_to_milliseconds)
1128
 
    checker_command = notifychangeproperty(dbus.String, "Checker")
1129
 
    
1130
 
    del notifychangeproperty
 
767
    def _get_approvals_pending(self):
 
768
        return self._approvals_pending
 
769
    def _set_approvals_pending(self, value):
 
770
        old_value = self._approvals_pending
 
771
        self._approvals_pending = value
 
772
        bval = bool(value)
 
773
        if (hasattr(self, "dbus_object_path")
 
774
            and bval is not bool(old_value)):
 
775
            dbus_bool = dbus.Boolean(bval, variant_level=1)
 
776
            self.PropertyChanged(dbus.String("ApprovalPending"),
 
777
                                 dbus_bool)
 
778
 
 
779
    approvals_pending = property(_get_approvals_pending,
 
780
                                 _set_approvals_pending)
 
781
    del _get_approvals_pending, _set_approvals_pending
 
782
    
 
783
    @staticmethod
 
784
    def _datetime_to_dbus(dt, variant_level=0):
 
785
        """Convert a UTC datetime.datetime() to a D-Bus type."""
 
786
        return dbus.String(dt.isoformat(),
 
787
                           variant_level=variant_level)
 
788
    
 
789
    def enable(self):
 
790
        oldstate = getattr(self, "enabled", False)
 
791
        r = Client.enable(self)
 
792
        if oldstate != self.enabled:
 
793
            # Emit D-Bus signals
 
794
            self.PropertyChanged(dbus.String("Enabled"),
 
795
                                 dbus.Boolean(True, variant_level=1))
 
796
            self.PropertyChanged(
 
797
                dbus.String("LastEnabled"),
 
798
                self._datetime_to_dbus(self.last_enabled,
 
799
                                       variant_level=1))
 
800
        return r
 
801
    
 
802
    def disable(self, quiet = False):
 
803
        oldstate = getattr(self, "enabled", False)
 
804
        r = Client.disable(self, quiet=quiet)
 
805
        if not quiet and oldstate != self.enabled:
 
806
            # Emit D-Bus signal
 
807
            self.PropertyChanged(dbus.String("Enabled"),
 
808
                                 dbus.Boolean(False, variant_level=1))
 
809
        return r
1131
810
    
1132
811
    def __del__(self, *args, **kwargs):
1133
812
        try:
1142
821
                         *args, **kwargs):
1143
822
        self.checker_callback_tag = None
1144
823
        self.checker = None
 
824
        # Emit D-Bus signal
 
825
        self.PropertyChanged(dbus.String("CheckerRunning"),
 
826
                             dbus.Boolean(False, variant_level=1))
1145
827
        if os.WIFEXITED(condition):
1146
828
            exitstatus = os.WEXITSTATUS(condition)
1147
829
            # Emit D-Bus signal
1157
839
        return Client.checker_callback(self, pid, condition, command,
1158
840
                                       *args, **kwargs)
1159
841
    
 
842
    def checked_ok(self, *args, **kwargs):
 
843
        Client.checked_ok(self, *args, **kwargs)
 
844
        # Emit D-Bus signal
 
845
        self.PropertyChanged(
 
846
            dbus.String("LastCheckedOK"),
 
847
            (self._datetime_to_dbus(self.last_checked_ok,
 
848
                                    variant_level=1)))
 
849
    
 
850
    def need_approval(self, *args, **kwargs):
 
851
        r = Client.need_approval(self, *args, **kwargs)
 
852
        # Emit D-Bus signal
 
853
        self.PropertyChanged(
 
854
            dbus.String("LastApprovalRequest"),
 
855
            (self._datetime_to_dbus(self.last_approval_request,
 
856
                                    variant_level=1)))
 
857
        return r
 
858
    
1160
859
    def start_checker(self, *args, **kwargs):
1161
860
        old_checker = self.checker
1162
861
        if self.checker is not None:
1169
868
            and old_checker_pid != self.checker.pid):
1170
869
            # Emit D-Bus signal
1171
870
            self.CheckerStarted(self.current_checker_command)
 
871
            self.PropertyChanged(
 
872
                dbus.String("CheckerRunning"),
 
873
                dbus.Boolean(True, variant_level=1))
1172
874
        return r
1173
875
    
 
876
    def stop_checker(self, *args, **kwargs):
 
877
        old_checker = getattr(self, "checker", None)
 
878
        r = Client.stop_checker(self, *args, **kwargs)
 
879
        if (old_checker is not None
 
880
            and getattr(self, "checker", None) is None):
 
881
            self.PropertyChanged(dbus.String("CheckerRunning"),
 
882
                                 dbus.Boolean(False, variant_level=1))
 
883
        return r
 
884
 
1174
885
    def _reset_approved(self):
1175
 
        self.approved = None
 
886
        self._approved = None
1176
887
        return False
1177
888
    
1178
889
    def approve(self, value=True):
1179
890
        self.send_changedstate()
1180
 
        self.approved = value
1181
 
        gobject.timeout_add(timedelta_to_milliseconds
 
891
        self._approved = value
 
892
        gobject.timeout_add(self._timedelta_to_milliseconds
1182
893
                            (self.approval_duration),
1183
894
                            self._reset_approved)
1184
895
    
1185
896
    
1186
897
    ## D-Bus methods, signals & properties
1187
 
    _interface = "se.recompile.Mandos.Client"
 
898
    _interface = "se.bsnet.fukt.Mandos.Client"
1188
899
    
1189
900
    ## Signals
1190
901
    
1227
938
        "D-Bus signal"
1228
939
        return self.need_approval()
1229
940
    
1230
 
    # NeRwequest - signal
1231
 
    @dbus.service.signal(_interface, signature="s")
1232
 
    def NewRequest(self, ip):
1233
 
        """D-Bus signal
1234
 
        Is sent after a client request a password.
1235
 
        """
1236
 
        pass
1237
 
    
1238
941
    ## Methods
1239
942
    
1240
943
    # Approve - method
1284
987
        if value is None:       # get
1285
988
            return dbus.Boolean(self.approved_by_default)
1286
989
        self.approved_by_default = bool(value)
 
990
        # Emit D-Bus signal
 
991
        self.PropertyChanged(dbus.String("ApprovedByDefault"),
 
992
                             dbus.Boolean(value, variant_level=1))
1287
993
    
1288
994
    # ApprovalDelay - property
1289
995
    @dbus_service_property(_interface, signature="t",
1292
998
        if value is None:       # get
1293
999
            return dbus.UInt64(self.approval_delay_milliseconds())
1294
1000
        self.approval_delay = datetime.timedelta(0, 0, 0, value)
 
1001
        # Emit D-Bus signal
 
1002
        self.PropertyChanged(dbus.String("ApprovalDelay"),
 
1003
                             dbus.UInt64(value, variant_level=1))
1295
1004
    
1296
1005
    # ApprovalDuration - property
1297
1006
    @dbus_service_property(_interface, signature="t",
1298
1007
                           access="readwrite")
1299
1008
    def ApprovalDuration_dbus_property(self, value=None):
1300
1009
        if value is None:       # get
1301
 
            return dbus.UInt64(timedelta_to_milliseconds(
 
1010
            return dbus.UInt64(self._timedelta_to_milliseconds(
1302
1011
                    self.approval_duration))
1303
1012
        self.approval_duration = datetime.timedelta(0, 0, 0, value)
 
1013
        # Emit D-Bus signal
 
1014
        self.PropertyChanged(dbus.String("ApprovalDuration"),
 
1015
                             dbus.UInt64(value, variant_level=1))
1304
1016
    
1305
1017
    # Name - property
1306
1018
    @dbus_service_property(_interface, signature="s", access="read")
1318
1030
    def Host_dbus_property(self, value=None):
1319
1031
        if value is None:       # get
1320
1032
            return dbus.String(self.host)
1321
 
        self.host = unicode(value)
 
1033
        self.host = value
 
1034
        # Emit D-Bus signal
 
1035
        self.PropertyChanged(dbus.String("Host"),
 
1036
                             dbus.String(value, variant_level=1))
1322
1037
    
1323
1038
    # Created - property
1324
1039
    @dbus_service_property(_interface, signature="s", access="read")
1325
1040
    def Created_dbus_property(self):
1326
 
        return datetime_to_dbus(self.created)
 
1041
        return dbus.String(self._datetime_to_dbus(self.created))
1327
1042
    
1328
1043
    # LastEnabled - property
1329
1044
    @dbus_service_property(_interface, signature="s", access="read")
1330
1045
    def LastEnabled_dbus_property(self):
1331
 
        return datetime_to_dbus(self.last_enabled)
 
1046
        if self.last_enabled is None:
 
1047
            return dbus.String("")
 
1048
        return dbus.String(self._datetime_to_dbus(self.last_enabled))
1332
1049
    
1333
1050
    # Enabled - property
1334
1051
    @dbus_service_property(_interface, signature="b",
1348
1065
        if value is not None:
1349
1066
            self.checked_ok()
1350
1067
            return
1351
 
        return datetime_to_dbus(self.last_checked_ok)
1352
 
    
1353
 
    # Expires - property
1354
 
    @dbus_service_property(_interface, signature="s", access="read")
1355
 
    def Expires_dbus_property(self):
1356
 
        return datetime_to_dbus(self.expires)
 
1068
        if self.last_checked_ok is None:
 
1069
            return dbus.String("")
 
1070
        return dbus.String(self._datetime_to_dbus(self
 
1071
                                                  .last_checked_ok))
1357
1072
    
1358
1073
    # LastApprovalRequest - property
1359
1074
    @dbus_service_property(_interface, signature="s", access="read")
1360
1075
    def LastApprovalRequest_dbus_property(self):
1361
 
        return datetime_to_dbus(self.last_approval_request)
 
1076
        if self.last_approval_request is None:
 
1077
            return dbus.String("")
 
1078
        return dbus.String(self.
 
1079
                           _datetime_to_dbus(self
 
1080
                                             .last_approval_request))
1362
1081
    
1363
1082
    # Timeout - property
1364
1083
    @dbus_service_property(_interface, signature="t",
1367
1086
        if value is None:       # get
1368
1087
            return dbus.UInt64(self.timeout_milliseconds())
1369
1088
        self.timeout = datetime.timedelta(0, 0, 0, value)
 
1089
        # Emit D-Bus signal
 
1090
        self.PropertyChanged(dbus.String("Timeout"),
 
1091
                             dbus.UInt64(value, variant_level=1))
 
1092
        if getattr(self, "disable_initiator_tag", None) is None:
 
1093
            return
1370
1094
        # Reschedule timeout
1371
 
        if self.enabled:
1372
 
            now = datetime.datetime.utcnow()
1373
 
            time_to_die = timedelta_to_milliseconds(
1374
 
                (self.last_checked_ok + self.timeout) - now)
1375
 
            if time_to_die <= 0:
1376
 
                # The timeout has passed
1377
 
                self.disable()
1378
 
            else:
1379
 
                self.expires = (now +
1380
 
                                datetime.timedelta(milliseconds =
1381
 
                                                   time_to_die))
1382
 
                if (getattr(self, "disable_initiator_tag", None)
1383
 
                    is None):
1384
 
                    return
1385
 
                gobject.source_remove(self.disable_initiator_tag)
1386
 
                self.disable_initiator_tag = (gobject.timeout_add
1387
 
                                              (time_to_die,
1388
 
                                               self.disable))
1389
 
    
1390
 
    # ExtendedTimeout - property
1391
 
    @dbus_service_property(_interface, signature="t",
1392
 
                           access="readwrite")
1393
 
    def ExtendedTimeout_dbus_property(self, value=None):
1394
 
        if value is None:       # get
1395
 
            return dbus.UInt64(self.extended_timeout_milliseconds())
1396
 
        self.extended_timeout = datetime.timedelta(0, 0, 0, value)
 
1095
        gobject.source_remove(self.disable_initiator_tag)
 
1096
        self.disable_initiator_tag = None
 
1097
        time_to_die = (self.
 
1098
                       _timedelta_to_milliseconds((self
 
1099
                                                   .last_checked_ok
 
1100
                                                   + self.timeout)
 
1101
                                                  - datetime.datetime
 
1102
                                                  .utcnow()))
 
1103
        if time_to_die <= 0:
 
1104
            # The timeout has passed
 
1105
            self.disable()
 
1106
        else:
 
1107
            self.disable_initiator_tag = (gobject.timeout_add
 
1108
                                          (time_to_die, self.disable))
1397
1109
    
1398
1110
    # Interval - property
1399
1111
    @dbus_service_property(_interface, signature="t",
1402
1114
        if value is None:       # get
1403
1115
            return dbus.UInt64(self.interval_milliseconds())
1404
1116
        self.interval = datetime.timedelta(0, 0, 0, value)
 
1117
        # Emit D-Bus signal
 
1118
        self.PropertyChanged(dbus.String("Interval"),
 
1119
                             dbus.UInt64(value, variant_level=1))
1405
1120
        if getattr(self, "checker_initiator_tag", None) is None:
1406
1121
            return
1407
 
        if self.enabled:
1408
 
            # Reschedule checker run
1409
 
            gobject.source_remove(self.checker_initiator_tag)
1410
 
            self.checker_initiator_tag = (gobject.timeout_add
1411
 
                                          (value, self.start_checker))
1412
 
            self.start_checker()    # Start one now, too
1413
 
    
 
1122
        # Reschedule checker run
 
1123
        gobject.source_remove(self.checker_initiator_tag)
 
1124
        self.checker_initiator_tag = (gobject.timeout_add
 
1125
                                      (value, self.start_checker))
 
1126
        self.start_checker()    # Start one now, too
 
1127
 
1414
1128
    # Checker - property
1415
1129
    @dbus_service_property(_interface, signature="s",
1416
1130
                           access="readwrite")
1417
1131
    def Checker_dbus_property(self, value=None):
1418
1132
        if value is None:       # get
1419
1133
            return dbus.String(self.checker_command)
1420
 
        self.checker_command = unicode(value)
 
1134
        self.checker_command = value
 
1135
        # Emit D-Bus signal
 
1136
        self.PropertyChanged(dbus.String("Checker"),
 
1137
                             dbus.String(self.checker_command,
 
1138
                                         variant_level=1))
1421
1139
    
1422
1140
    # CheckerRunning - property
1423
1141
    @dbus_service_property(_interface, signature="b",
1450
1168
        self._pipe.send(('init', fpr, address))
1451
1169
        if not self._pipe.recv():
1452
1170
            raise KeyError()
1453
 
    
 
1171
 
1454
1172
    def __getattribute__(self, name):
1455
 
        if name == '_pipe':
 
1173
        if(name == '_pipe'):
1456
1174
            return super(ProxyClient, self).__getattribute__(name)
1457
1175
        self._pipe.send(('getattr', name))
1458
1176
        data = self._pipe.recv()
1463
1181
                self._pipe.send(('funcall', name, args, kwargs))
1464
1182
                return self._pipe.recv()[1]
1465
1183
            return func
1466
 
    
 
1184
 
1467
1185
    def __setattr__(self, name, value):
1468
 
        if name == '_pipe':
 
1186
        if(name == '_pipe'):
1469
1187
            return super(ProxyClient, self).__setattr__(name, value)
1470
1188
        self._pipe.send(('setattr', name, value))
1471
1189
 
1472
1190
 
1473
 
class ClientDBusTransitional(ClientDBus):
1474
 
    __metaclass__ = AlternateDBusNamesMetaclass
1475
 
 
1476
 
 
1477
1191
class ClientHandler(socketserver.BaseRequestHandler, object):
1478
1192
    """A class to handle client connections.
1479
1193
    
1486
1200
                        unicode(self.client_address))
1487
1201
            logger.debug("Pipe FD: %d",
1488
1202
                         self.server.child_pipe.fileno())
1489
 
            
 
1203
 
1490
1204
            session = (gnutls.connection
1491
1205
                       .ClientSession(self.request,
1492
1206
                                      gnutls.connection
1493
1207
                                      .X509Credentials()))
1494
 
            
 
1208
 
1495
1209
            # Note: gnutls.connection.X509Credentials is really a
1496
1210
            # generic GnuTLS certificate credentials object so long as
1497
1211
            # no X.509 keys are added to it.  Therefore, we can use it
1498
1212
            # here despite using OpenPGP certificates.
1499
 
            
 
1213
 
1500
1214
            #priority = ':'.join(("NONE", "+VERS-TLS1.1",
1501
1215
            #                      "+AES-256-CBC", "+SHA1",
1502
1216
            #                      "+COMP-NULL", "+CTYPE-OPENPGP",
1508
1222
            (gnutls.library.functions
1509
1223
             .gnutls_priority_set_direct(session._c_object,
1510
1224
                                         priority, None))
1511
 
            
 
1225
 
1512
1226
            # Start communication using the Mandos protocol
1513
1227
            # Get protocol number
1514
1228
            line = self.request.makefile().readline()
1519
1233
            except (ValueError, IndexError, RuntimeError) as error:
1520
1234
                logger.error("Unknown protocol version: %s", error)
1521
1235
                return
1522
 
            
 
1236
 
1523
1237
            # Start GnuTLS connection
1524
1238
            try:
1525
1239
                session.handshake()
1529
1243
                # established.  Just abandon the request.
1530
1244
                return
1531
1245
            logger.debug("Handshake succeeded")
1532
 
            
 
1246
 
1533
1247
            approval_required = False
1534
1248
            try:
1535
1249
                try:
1540
1254
                    logger.warning("Bad certificate: %s", error)
1541
1255
                    return
1542
1256
                logger.debug("Fingerprint: %s", fpr)
1543
 
                
 
1257
 
1544
1258
                try:
1545
1259
                    client = ProxyClient(child_pipe, fpr,
1546
1260
                                         self.client_address)
1547
1261
                except KeyError:
1548
1262
                    return
1549
1263
                
1550
 
                if self.server.use_dbus:
1551
 
                    # Emit D-Bus signal
1552
 
                    client.NewRequest(str(self.client_address))
1553
 
                
1554
1264
                if client.approval_delay:
1555
1265
                    delay = client.approval_delay
1556
1266
                    client.approvals_pending += 1
1562
1272
                                       client.name)
1563
1273
                        if self.server.use_dbus:
1564
1274
                            # Emit D-Bus signal
1565
 
                            client.Rejected("Disabled")
 
1275
                            client.Rejected("Disabled")                    
1566
1276
                        return
1567
1277
                    
1568
 
                    if client.approved or not client.approval_delay:
 
1278
                    if client._approved or not client.approval_delay:
1569
1279
                        #We are approved or approval is disabled
1570
1280
                        break
1571
 
                    elif client.approved is None:
 
1281
                    elif client._approved is None:
1572
1282
                        logger.info("Client %s needs approval",
1573
1283
                                    client.name)
1574
1284
                        if self.server.use_dbus:
1585
1295
                        return
1586
1296
                    
1587
1297
                    #wait until timeout or approved
 
1298
                    #x = float(client._timedelta_to_milliseconds(delay))
1588
1299
                    time = datetime.datetime.now()
1589
1300
                    client.changedstate.acquire()
1590
 
                    (client.changedstate.wait
1591
 
                     (float(client.timedelta_to_milliseconds(delay)
1592
 
                            / 1000)))
 
1301
                    client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))
1593
1302
                    client.changedstate.release()
1594
1303
                    time2 = datetime.datetime.now()
1595
1304
                    if (time2 - time) >= delay:
1617
1326
                                 sent, len(client.secret)
1618
1327
                                 - (sent_size + sent))
1619
1328
                    sent_size += sent
1620
 
                
 
1329
 
1621
1330
                logger.info("Sending secret to %s", client.name)
1622
 
                # bump the timeout using extended_timeout
1623
 
                client.checked_ok(client.extended_timeout)
 
1331
                # bump the timeout as if seen
 
1332
                client.checked_ok()
1624
1333
                if self.server.use_dbus:
1625
1334
                    # Emit D-Bus signal
1626
1335
                    client.GotSecret()
1693
1402
        # Convert the buffer to a Python bytestring
1694
1403
        fpr = ctypes.string_at(buf, buf_len.value)
1695
1404
        # Convert the bytestring to hexadecimal notation
1696
 
        hex_fpr = binascii.hexlify(fpr).upper()
 
1405
        hex_fpr = ''.join("%02X" % ord(char) for char in fpr)
1697
1406
        return hex_fpr
1698
1407
 
1699
1408
 
1702
1411
    def sub_process_main(self, request, address):
1703
1412
        try:
1704
1413
            self.finish_request(request, address)
1705
 
        except Exception:
 
1414
        except:
1706
1415
            self.handle_error(request, address)
1707
1416
        self.close_request(request)
1708
 
    
 
1417
            
1709
1418
    def process_request(self, request, address):
1710
1419
        """Start a new process to process the request."""
1711
 
        proc = multiprocessing.Process(target = self.sub_process_main,
1712
 
                                       args = (request,
1713
 
                                               address))
1714
 
        proc.start()
1715
 
        return proc
1716
 
 
 
1420
        multiprocessing.Process(target = self.sub_process_main,
 
1421
                                args = (request, address)).start()
1717
1422
 
1718
1423
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
1719
1424
    """ adds a pipe to the MixIn """
1723
1428
        This function creates a new pipe in self.pipe
1724
1429
        """
1725
1430
        parent_pipe, self.child_pipe = multiprocessing.Pipe()
1726
 
        
1727
 
        proc = MultiprocessingMixIn.process_request(self, request,
1728
 
                                                    client_address)
 
1431
 
 
1432
        super(MultiprocessingMixInWithPipe,
 
1433
              self).process_request(request, client_address)
1729
1434
        self.child_pipe.close()
1730
 
        self.add_pipe(parent_pipe, proc)
1731
 
    
1732
 
    def add_pipe(self, parent_pipe, proc):
 
1435
        self.add_pipe(parent_pipe)
 
1436
 
 
1437
    def add_pipe(self, parent_pipe):
1733
1438
        """Dummy function; override as necessary"""
1734
1439
        raise NotImplementedError
1735
1440
 
1736
 
 
1737
1441
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
1738
1442
                     socketserver.TCPServer, object):
1739
1443
    """IPv6-capable TCP server.  Accepts 'None' as address and/or port
1813
1517
        self.enabled = False
1814
1518
        self.clients = clients
1815
1519
        if self.clients is None:
1816
 
            self.clients = {}
 
1520
            self.clients = set()
1817
1521
        self.use_dbus = use_dbus
1818
1522
        self.gnutls_priority = gnutls_priority
1819
1523
        IPv6_TCPServer.__init__(self, server_address,
1823
1527
    def server_activate(self):
1824
1528
        if self.enabled:
1825
1529
            return socketserver.TCPServer.server_activate(self)
1826
 
    
1827
1530
    def enable(self):
1828
1531
        self.enabled = True
1829
 
    
1830
 
    def add_pipe(self, parent_pipe, proc):
 
1532
    def add_pipe(self, parent_pipe):
1831
1533
        # Call "handle_ipc" for both data and EOF events
1832
1534
        gobject.io_add_watch(parent_pipe.fileno(),
1833
1535
                             gobject.IO_IN | gobject.IO_HUP,
1834
1536
                             functools.partial(self.handle_ipc,
1835
 
                                               parent_pipe =
1836
 
                                               parent_pipe,
1837
 
                                               proc = proc))
1838
 
    
 
1537
                                               parent_pipe = parent_pipe))
 
1538
        
1839
1539
    def handle_ipc(self, source, condition, parent_pipe=None,
1840
 
                   proc = None, client_object=None):
 
1540
                   client_object=None):
1841
1541
        condition_names = {
1842
1542
            gobject.IO_IN: "IN",   # There is data to read.
1843
1543
            gobject.IO_OUT: "OUT", # Data can be written (without
1852
1552
                                       for cond, name in
1853
1553
                                       condition_names.iteritems()
1854
1554
                                       if cond & condition)
1855
 
        # error, or the other end of multiprocessing.Pipe has closed
 
1555
        # error or the other end of multiprocessing.Pipe has closed
1856
1556
        if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):
1857
 
            # Wait for other process to exit
1858
 
            proc.join()
1859
1557
            return False
1860
1558
        
1861
1559
        # Read a request from the child
1866
1564
            fpr = request[1]
1867
1565
            address = request[2]
1868
1566
            
1869
 
            for c in self.clients.itervalues():
 
1567
            for c in self.clients:
1870
1568
                if c.fingerprint == fpr:
1871
1569
                    client = c
1872
1570
                    break
1875
1573
                            "dress: %s", fpr, address)
1876
1574
                if self.use_dbus:
1877
1575
                    # Emit D-Bus signal
1878
 
                    mandos_dbus_service.ClientNotFound(fpr,
1879
 
                                                       address[0])
 
1576
                    mandos_dbus_service.ClientNotFound(fpr, address[0])
1880
1577
                parent_pipe.send(False)
1881
1578
                return False
1882
1579
            
1883
1580
            gobject.io_add_watch(parent_pipe.fileno(),
1884
1581
                                 gobject.IO_IN | gobject.IO_HUP,
1885
1582
                                 functools.partial(self.handle_ipc,
1886
 
                                                   parent_pipe =
1887
 
                                                   parent_pipe,
1888
 
                                                   proc = proc,
1889
 
                                                   client_object =
1890
 
                                                   client))
 
1583
                                                   parent_pipe = parent_pipe,
 
1584
                                                   client_object = client))
1891
1585
            parent_pipe.send(True)
1892
 
            # remove the old hook in favor of the new above hook on
1893
 
            # same fileno
 
1586
            # remove the old hook in favor of the new above hook on same fileno
1894
1587
            return False
1895
1588
        if command == 'funcall':
1896
1589
            funcname = request[1]
1897
1590
            args = request[2]
1898
1591
            kwargs = request[3]
1899
1592
            
1900
 
            parent_pipe.send(('data', getattr(client_object,
1901
 
                                              funcname)(*args,
1902
 
                                                         **kwargs)))
1903
 
        
 
1593
            parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))
 
1594
 
1904
1595
        if command == 'getattr':
1905
1596
            attrname = request[1]
1906
1597
            if callable(client_object.__getattribute__(attrname)):
1907
1598
                parent_pipe.send(('function',))
1908
1599
            else:
1909
 
                parent_pipe.send(('data', client_object
1910
 
                                  .__getattribute__(attrname)))
 
1600
                parent_pipe.send(('data', client_object.__getattribute__(attrname)))
1911
1601
        
1912
1602
        if command == 'setattr':
1913
1603
            attrname = request[1]
1914
1604
            value = request[2]
1915
1605
            setattr(client_object, attrname, value)
1916
 
        
 
1606
 
1917
1607
        return True
1918
1608
 
1919
1609
 
1956
1646
    return timevalue
1957
1647
 
1958
1648
 
 
1649
def if_nametoindex(interface):
 
1650
    """Call the C function if_nametoindex(), or equivalent
 
1651
    
 
1652
    Note: This function cannot accept a unicode string."""
 
1653
    global if_nametoindex
 
1654
    try:
 
1655
        if_nametoindex = (ctypes.cdll.LoadLibrary
 
1656
                          (ctypes.util.find_library("c"))
 
1657
                          .if_nametoindex)
 
1658
    except (OSError, AttributeError):
 
1659
        logger.warning("Doing if_nametoindex the hard way")
 
1660
        def if_nametoindex(interface):
 
1661
            "Get an interface index the hard way, i.e. using fcntl()"
 
1662
            SIOCGIFINDEX = 0x8933  # From /usr/include/linux/sockios.h
 
1663
            with contextlib.closing(socket.socket()) as s:
 
1664
                ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
 
1665
                                    struct.pack(str("16s16x"),
 
1666
                                                interface))
 
1667
            interface_index = struct.unpack(str("I"),
 
1668
                                            ifreq[16:20])[0]
 
1669
            return interface_index
 
1670
    return if_nametoindex(interface)
 
1671
 
 
1672
 
1959
1673
def daemon(nochdir = False, noclose = False):
1960
1674
    """See daemon(3).  Standard BSD Unix function.
1961
1675
    
2016
1730
                        " system bus interface")
2017
1731
    parser.add_argument("--no-ipv6", action="store_false",
2018
1732
                        dest="use_ipv6", help="Do not use IPv6")
2019
 
    parser.add_argument("--no-restore", action="store_false",
2020
 
                        dest="restore", help="Do not restore stored"
2021
 
                        " state")
2022
 
    parser.add_argument("--statedir", metavar="DIR",
2023
 
                        help="Directory to save/restore state in")
2024
 
    
2025
1733
    options = parser.parse_args()
2026
1734
    
2027
1735
    if options.check:
2040
1748
                        "use_dbus": "True",
2041
1749
                        "use_ipv6": "True",
2042
1750
                        "debuglevel": "",
2043
 
                        "restore": "True",
2044
 
                        "statedir": "/var/lib/mandos"
2045
1751
                        }
2046
1752
    
2047
1753
    # Parse config file for server-global settings
2064
1770
    # options, if set.
2065
1771
    for option in ("interface", "address", "port", "debug",
2066
1772
                   "priority", "servicename", "configdir",
2067
 
                   "use_dbus", "use_ipv6", "debuglevel", "restore",
2068
 
                   "statedir"):
 
1773
                   "use_dbus", "use_ipv6", "debuglevel"):
2069
1774
        value = getattr(options, option)
2070
1775
        if value is not None:
2071
1776
            server_settings[option] = value
2083
1788
    debuglevel = server_settings["debuglevel"]
2084
1789
    use_dbus = server_settings["use_dbus"]
2085
1790
    use_ipv6 = server_settings["use_ipv6"]
2086
 
    stored_state_path = os.path.join(server_settings["statedir"],
2087
 
                                     stored_state_file)
2088
 
    
2089
 
    if debug:
2090
 
        initlogger(debug, logging.DEBUG)
2091
 
    else:
2092
 
        if not debuglevel:
2093
 
            initlogger(debug)
2094
 
        else:
2095
 
            level = getattr(logging, debuglevel.upper())
2096
 
            initlogger(debug, level)
2097
 
    
 
1791
 
2098
1792
    if server_settings["servicename"] != "Mandos":
2099
1793
        syslogger.setFormatter(logging.Formatter
2100
1794
                               ('Mandos (%s) [%%(process)d]:'
2102
1796
                                % server_settings["servicename"]))
2103
1797
    
2104
1798
    # Parse config file with clients
2105
 
    client_config = configparser.SafeConfigParser(Client
2106
 
                                                  .client_defaults)
 
1799
    client_defaults = { "timeout": "1h",
 
1800
                        "interval": "5m",
 
1801
                        "checker": "fping -q -- %%(host)s",
 
1802
                        "host": "",
 
1803
                        "approval_delay": "0s",
 
1804
                        "approval_duration": "1s",
 
1805
                        }
 
1806
    client_config = configparser.SafeConfigParser(client_defaults)
2107
1807
    client_config.read(os.path.join(server_settings["configdir"],
2108
1808
                                    "clients.conf"))
2109
1809
    
2147
1847
        if error[0] != errno.EPERM:
2148
1848
            raise error
2149
1849
    
 
1850
    if not debug and not debuglevel:
 
1851
        syslogger.setLevel(logging.WARNING)
 
1852
        console.setLevel(logging.WARNING)
 
1853
    if debuglevel:
 
1854
        level = getattr(logging, debuglevel.upper())
 
1855
        syslogger.setLevel(level)
 
1856
        console.setLevel(level)
 
1857
 
2150
1858
    if debug:
2151
1859
        # Enable all possible GnuTLS debugging
2152
1860
        
2166
1874
        os.dup2(null, sys.stdin.fileno())
2167
1875
        if null > 2:
2168
1876
            os.close(null)
 
1877
    else:
 
1878
        # No console logging
 
1879
        logger.removeHandler(console)
2169
1880
    
2170
1881
    # Need to fork before connecting to D-Bus
2171
1882
    if not debug:
2172
1883
        # Close all input and output, do double fork, etc.
2173
1884
        daemon()
2174
1885
    
2175
 
    gobject.threads_init()
2176
 
    
2177
1886
    global main_loop
2178
1887
    # From the Avahi example code
2179
1888
    DBusGMainLoop(set_as_default=True )
2182
1891
    # End of Avahi example code
2183
1892
    if use_dbus:
2184
1893
        try:
2185
 
            bus_name = dbus.service.BusName("se.recompile.Mandos",
 
1894
            bus_name = dbus.service.BusName("se.bsnet.fukt.Mandos",
2186
1895
                                            bus, do_not_queue=True)
2187
 
            old_bus_name = (dbus.service.BusName
2188
 
                            ("se.bsnet.fukt.Mandos", bus,
2189
 
                             do_not_queue=True))
2190
1896
        except dbus.exceptions.NameExistsException as e:
2191
1897
            logger.error(unicode(e) + ", disabling D-Bus")
2192
1898
            use_dbus = False
2193
1899
            server_settings["use_dbus"] = False
2194
1900
            tcp_server.use_dbus = False
2195
1901
    protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2196
 
    service = AvahiServiceToSyslog(name =
2197
 
                                   server_settings["servicename"],
2198
 
                                   servicetype = "_mandos._tcp",
2199
 
                                   protocol = protocol, bus = bus)
 
1902
    service = AvahiService(name = server_settings["servicename"],
 
1903
                           servicetype = "_mandos._tcp",
 
1904
                           protocol = protocol, bus = bus)
2200
1905
    if server_settings["interface"]:
2201
1906
        service.interface = (if_nametoindex
2202
1907
                             (str(server_settings["interface"])))
2206
1911
    
2207
1912
    client_class = Client
2208
1913
    if use_dbus:
2209
 
        client_class = functools.partial(ClientDBusTransitional,
2210
 
                                         bus = bus)
2211
 
    
2212
 
    client_settings = Client.config_parser(client_config)
2213
 
    old_client_settings = {}
2214
 
    clients_data = {}
2215
 
    
2216
 
    # Get client data and settings from last running state.
2217
 
    if server_settings["restore"]:
2218
 
        try:
2219
 
            with open(stored_state_path, "rb") as stored_state:
2220
 
                clients_data, old_client_settings = (pickle.load
2221
 
                                                     (stored_state))
2222
 
            os.remove(stored_state_path)
2223
 
        except IOError as e:
2224
 
            logger.warning("Could not load persistent state: {0}"
2225
 
                           .format(e))
2226
 
            if e.errno != errno.ENOENT:
2227
 
                raise
2228
 
        except EOFError as e:
2229
 
            logger.warning("Could not load persistent state: "
2230
 
                           "EOFError: {0}".format(e))
2231
 
    
2232
 
    with PGPEngine() as pgp:
2233
 
        for client_name, client in clients_data.iteritems():
2234
 
            # Decide which value to use after restoring saved state.
2235
 
            # We have three different values: Old config file,
2236
 
            # new config file, and saved state.
2237
 
            # New config value takes precedence if it differs from old
2238
 
            # config value, otherwise use saved state.
2239
 
            for name, value in client_settings[client_name].items():
2240
 
                try:
2241
 
                    # For each value in new config, check if it
2242
 
                    # differs from the old config value (Except for
2243
 
                    # the "secret" attribute)
2244
 
                    if (name != "secret" and
2245
 
                        value != old_client_settings[client_name]
2246
 
                        [name]):
2247
 
                        client[name] = value
2248
 
                except KeyError:
2249
 
                    pass
2250
 
            
2251
 
            # Clients who has passed its expire date can still be
2252
 
            # enabled if its last checker was successful.  Clients
2253
 
            # whose checker failed before we stored its state is
2254
 
            # assumed to have failed all checkers during downtime.
2255
 
            if client["enabled"]:
2256
 
                if datetime.datetime.utcnow() >= client["expires"]:
2257
 
                    if not client["last_checked_ok"]:
2258
 
                        logger.warning(
2259
 
                            "disabling client {0} - Client never "
2260
 
                            "performed a successfull checker"
2261
 
                            .format(client["name"]))
2262
 
                        client["enabled"] = False
2263
 
                    elif client["last_checker_status"] != 0:
2264
 
                        logger.warning(
2265
 
                            "disabling client {0} - Client "
2266
 
                            "last checker failed with error code {1}"
2267
 
                            .format(client["name"],
2268
 
                                    client["last_checker_status"]))
2269
 
                        client["enabled"] = False
2270
 
                    else:
2271
 
                        client["expires"] = (datetime.datetime
2272
 
                                             .utcnow()
2273
 
                                             + client["timeout"])
2274
 
                        logger.debug("Last checker succeeded,"
2275
 
                                     " keeping {0} enabled"
2276
 
                                     .format(client["name"]))
 
1914
        client_class = functools.partial(ClientDBus, bus = bus)
 
1915
    def client_config_items(config, section):
 
1916
        special_settings = {
 
1917
            "approved_by_default":
 
1918
                lambda: config.getboolean(section,
 
1919
                                          "approved_by_default"),
 
1920
            }
 
1921
        for name, value in config.items(section):
2277
1922
            try:
2278
 
                client["secret"] = (
2279
 
                    pgp.decrypt(client["encrypted_secret"],
2280
 
                                client_settings[client_name]
2281
 
                                ["secret"]))
2282
 
            except PGPError:
2283
 
                # If decryption fails, we use secret from new settings
2284
 
                logger.debug("Failed to decrypt {0} old secret"
2285
 
                             .format(client_name))
2286
 
                client["secret"] = (
2287
 
                    client_settings[client_name]["secret"])
2288
 
 
2289
 
    
2290
 
    # Add/remove clients based on new changes made to config
2291
 
    for client_name in (set(old_client_settings)
2292
 
                        - set(client_settings)):
2293
 
        del clients_data[client_name]
2294
 
    for client_name in (set(client_settings)
2295
 
                        - set(old_client_settings)):
2296
 
        clients_data[client_name] = client_settings[client_name]
2297
 
 
2298
 
    # Create clients all clients
2299
 
    for client_name, client in clients_data.iteritems():
2300
 
        tcp_server.clients[client_name] = client_class(
2301
 
            name = client_name, settings = client)
2302
 
    
 
1923
                yield (name, special_settings[name]())
 
1924
            except KeyError:
 
1925
                yield (name, value)
 
1926
    
 
1927
    tcp_server.clients.update(set(
 
1928
            client_class(name = section,
 
1929
                         config= dict(client_config_items(
 
1930
                        client_config, section)))
 
1931
            for section in client_config.sections()))
2303
1932
    if not tcp_server.clients:
2304
1933
        logger.warning("No clients defined")
2305
1934
        
2316
1945
            # "pidfile" was never created
2317
1946
            pass
2318
1947
        del pidfilename
 
1948
        
2319
1949
        signal.signal(signal.SIGINT, signal.SIG_IGN)
2320
 
    
 
1950
 
2321
1951
    signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2322
1952
    signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
2323
1953
    
2326
1956
            """A D-Bus proxy object"""
2327
1957
            def __init__(self):
2328
1958
                dbus.service.Object.__init__(self, bus, "/")
2329
 
            _interface = "se.recompile.Mandos"
 
1959
            _interface = "se.bsnet.fukt.Mandos"
2330
1960
            
2331
1961
            @dbus.service.signal(_interface, signature="o")
2332
1962
            def ClientAdded(self, objpath):
2347
1977
            def GetAllClients(self):
2348
1978
                "D-Bus method"
2349
1979
                return dbus.Array(c.dbus_object_path
2350
 
                                  for c in
2351
 
                                  tcp_server.clients.itervalues())
 
1980
                                  for c in tcp_server.clients)
2352
1981
            
2353
1982
            @dbus.service.method(_interface,
2354
1983
                                 out_signature="a{oa{sv}}")
2356
1985
                "D-Bus method"
2357
1986
                return dbus.Dictionary(
2358
1987
                    ((c.dbus_object_path, c.GetAll(""))
2359
 
                     for c in tcp_server.clients.itervalues()),
 
1988
                     for c in tcp_server.clients),
2360
1989
                    signature="oa{sv}")
2361
1990
            
2362
1991
            @dbus.service.method(_interface, in_signature="o")
2363
1992
            def RemoveClient(self, object_path):
2364
1993
                "D-Bus method"
2365
 
                for c in tcp_server.clients.itervalues():
 
1994
                for c in tcp_server.clients:
2366
1995
                    if c.dbus_object_path == object_path:
2367
 
                        del tcp_server.clients[c.name]
 
1996
                        tcp_server.clients.remove(c)
2368
1997
                        c.remove_from_connection()
2369
1998
                        # Don't signal anything except ClientRemoved
2370
1999
                        c.disable(quiet=True)
2375
2004
            
2376
2005
            del _interface
2377
2006
        
2378
 
        class MandosDBusServiceTransitional(MandosDBusService):
2379
 
            __metaclass__ = AlternateDBusNamesMetaclass
2380
 
        mandos_dbus_service = MandosDBusServiceTransitional()
 
2007
        mandos_dbus_service = MandosDBusService()
2381
2008
    
2382
2009
    def cleanup():
2383
2010
        "Cleanup function; run on exit"
2384
2011
        service.cleanup()
2385
2012
        
2386
 
        multiprocessing.active_children()
2387
 
        if not (tcp_server.clients or client_settings):
2388
 
            return
2389
 
        
2390
 
        # Store client before exiting. Secrets are encrypted with key
2391
 
        # based on what config file has. If config file is
2392
 
        # removed/edited, old secret will thus be unrecovable.
2393
 
        clients = {}
2394
 
        with PGPEngine() as pgp:
2395
 
            for client in tcp_server.clients.itervalues():
2396
 
                key = client_settings[client.name]["secret"]
2397
 
                client.encrypted_secret = pgp.encrypt(client.secret,
2398
 
                                                      key)
2399
 
                client_dict = {}
2400
 
                
2401
 
                # A list of attributes that can not be pickled
2402
 
                # + secret.
2403
 
                exclude = set(("bus", "changedstate", "secret",
2404
 
                               "checker"))
2405
 
                for name, typ in (inspect.getmembers
2406
 
                                  (dbus.service.Object)):
2407
 
                    exclude.add(name)
2408
 
                
2409
 
                client_dict["encrypted_secret"] = (client
2410
 
                                                   .encrypted_secret)
2411
 
                for attr in client.client_structure:
2412
 
                    if attr not in exclude:
2413
 
                        client_dict[attr] = getattr(client, attr)
2414
 
                
2415
 
                clients[client.name] = client_dict
2416
 
                del client_settings[client.name]["secret"]
2417
 
        
2418
 
        try:
2419
 
            tempfd, tempname = tempfile.mkstemp(suffix=".pickle",
2420
 
                                                prefix="clients-",
2421
 
                                                dir=os.path.dirname
2422
 
                                                (stored_state_path))
2423
 
            with os.fdopen(tempfd, "wb") as stored_state:
2424
 
                pickle.dump((clients, client_settings), stored_state)
2425
 
            os.rename(tempname, stored_state_path)
2426
 
        except (IOError, OSError) as e:
2427
 
            logger.warning("Could not save persistent state: {0}"
2428
 
                           .format(e))
2429
 
            if not debug:
2430
 
                try:
2431
 
                    os.remove(tempname)
2432
 
                except NameError:
2433
 
                    pass
2434
 
            if e.errno not in set((errno.ENOENT, errno.EACCES,
2435
 
                                   errno.EEXIST)):
2436
 
                raise e
2437
 
        
2438
 
        # Delete all clients, and settings from config
2439
2013
        while tcp_server.clients:
2440
 
            name, client = tcp_server.clients.popitem()
 
2014
            client = tcp_server.clients.pop()
2441
2015
            if use_dbus:
2442
2016
                client.remove_from_connection()
 
2017
            client.disable_hook = None
2443
2018
            # Don't signal anything except ClientRemoved
2444
2019
            client.disable(quiet=True)
2445
2020
            if use_dbus:
2446
2021
                # Emit D-Bus signal
2447
 
                mandos_dbus_service.ClientRemoved(client
2448
 
                                                  .dbus_object_path,
 
2022
                mandos_dbus_service.ClientRemoved(client.dbus_object_path,
2449
2023
                                                  client.name)
2450
 
        client_settings.clear()
2451
2024
    
2452
2025
    atexit.register(cleanup)
2453
2026
    
2454
 
    for client in tcp_server.clients.itervalues():
 
2027
    for client in tcp_server.clients:
2455
2028
        if use_dbus:
2456
2029
            # Emit D-Bus signal
2457
2030
            mandos_dbus_service.ClientAdded(client.dbus_object_path)
2458
 
        # Need to initiate checking of clients
2459
 
        if client.enabled:
2460
 
            client.init_checker()
 
2031
        client.enable()
2461
2032
    
2462
2033
    tcp_server.enable()
2463
2034
    tcp_server.server_activate()