/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos

  • Committer: Teddy Hogeborn
  • Date: 2011-11-26 22:22:20 UTC
  • mto: (518.1.8 mandos-persistent)
  • mto: This revision was merged to the branch mainline in revision 524.
  • Revision ID: teddy@recompile.se-20111126222220-1ubwjpb5ugqnrhec
Directory with persistent state can now be changed with the "statedir"
option.  The state directory /var/lib/mandos now gets created on
installation.  Added documentation about "restore" and "statedir"
options.

* Makefile (USER, GROUP, STATEDIR): New.
  (maintainer-clean): Also remove "statedir".
  (run-server): Replaced "--no-restore" with "--statedir=statedir".
  (statedir): New.
  (install-server): Make $(STATEDIR) directory.
* debian/mandos.dirs (var/lib/mandos): Added.
* debian/mandos.postinst: Fix ownership of /var/lib/mandos.
* mandos: New --statedir option.
  (stored_state_path): Not global anymore.
  (stored_state_file): New global.
* mandos.conf: Fix whitespace.
  (restore, statedir): Added.
* mandos.conf.xml (OPTIONS, EXAMPLE): Added "restore" and "statedir".
  mandos.xml (SYNOPSIS, OPTIONS): Added "--statedir".
  (FILES): Added "/var/lib/mandos".

Show diffs side-by-side

added added

removed removed

Lines of Context:
11
11
# "AvahiService" class, and some lines in "main".
12
12
13
13
# Everything else is
14
 
# Copyright © 2008-2012 Teddy Hogeborn
15
 
# Copyright © 2008-2012 Björn Påhlsson
 
14
# Copyright © 2008-2011 Teddy Hogeborn
 
15
# Copyright © 2008-2011 Björn Påhlsson
16
16
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
34
34
from __future__ import (division, absolute_import, print_function,
35
35
                        unicode_literals)
36
36
 
37
 
from future_builtins import *
38
 
 
39
37
import SocketServer as socketserver
40
38
import socket
41
39
import argparse
67
65
import types
68
66
import binascii
69
67
import tempfile
70
 
import itertools
71
68
 
72
69
import dbus
73
70
import dbus.service
88
85
    except ImportError:
89
86
        SO_BINDTODEVICE = None
90
87
 
91
 
version = "1.5.3"
 
88
 
 
89
version = "1.4.1"
92
90
stored_state_file = "clients.pickle"
93
91
 
94
92
logger = logging.getLogger()
113
111
        return interface_index
114
112
 
115
113
 
116
 
def initlogger(debug, level=logging.WARNING):
 
114
def initlogger(level=logging.WARNING):
117
115
    """init logger and add loglevel"""
118
116
    
119
117
    syslogger.setFormatter(logging.Formatter
121
119
                            ' %(message)s'))
122
120
    logger.addHandler(syslogger)
123
121
    
124
 
    if debug:
125
 
        console = logging.StreamHandler()
126
 
        console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
127
 
                                               ' [%(process)d]:'
128
 
                                               ' %(levelname)s:'
129
 
                                               ' %(message)s'))
130
 
        logger.addHandler(console)
 
122
    console = logging.StreamHandler()
 
123
    console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
 
124
                                           ' [%(process)d]:'
 
125
                                           ' %(levelname)s:'
 
126
                                           ' %(message)s'))
 
127
    logger.addHandler(console)
131
128
    logger.setLevel(level)
132
129
 
133
130
 
134
 
class PGPError(Exception):
135
 
    """Exception if encryption/decryption fails"""
 
131
class CryptoError(Exception):
136
132
    pass
137
133
 
138
134
 
139
 
class PGPEngine(object):
 
135
class Crypto(object):
140
136
    """A simple class for OpenPGP symmetric encryption & decryption"""
141
137
    def __init__(self):
142
138
        self.gnupg = GnuPGInterface.GnuPG()
145
141
        self.gnupg.options.meta_interactive = False
146
142
        self.gnupg.options.homedir = self.tempdir
147
143
        self.gnupg.options.extra_args.extend(['--force-mdc',
148
 
                                              '--quiet',
149
 
                                              '--no-use-agent'])
 
144
                                              '--quiet'])
150
145
    
151
146
    def __enter__(self):
152
147
        return self
178
173
    
179
174
    def encrypt(self, data, password):
180
175
        self.gnupg.passphrase = self.password_encode(password)
181
 
        with open(os.devnull, "w") as devnull:
 
176
        with open(os.devnull) as devnull:
182
177
            try:
183
178
                proc = self.gnupg.run(['--symmetric'],
184
179
                                      create_fhs=['stdin', 'stdout'],
189
184
                    ciphertext = f.read()
190
185
                proc.wait()
191
186
            except IOError as e:
192
 
                raise PGPError(e)
 
187
                raise CryptoError(e)
193
188
        self.gnupg.passphrase = None
194
189
        return ciphertext
195
190
    
196
191
    def decrypt(self, data, password):
197
192
        self.gnupg.passphrase = self.password_encode(password)
198
 
        with open(os.devnull, "w") as devnull:
 
193
        with open(os.devnull) as devnull:
199
194
            try:
200
195
                proc = self.gnupg.run(['--decrypt'],
201
196
                                      create_fhs=['stdin', 'stdout'],
202
197
                                      attach_fhs={'stderr': devnull})
203
 
                with contextlib.closing(proc.handles['stdin']) as f:
 
198
                with contextlib.closing(proc.handles['stdin'] ) as f:
204
199
                    f.write(data)
205
200
                with contextlib.closing(proc.handles['stdout']) as f:
206
201
                    decrypted_plaintext = f.read()
207
202
                proc.wait()
208
203
            except IOError as e:
209
 
                raise PGPError(e)
 
204
                raise CryptoError(e)
210
205
        self.gnupg.passphrase = None
211
206
        return decrypted_plaintext
212
207
 
213
208
 
 
209
 
214
210
class AvahiError(Exception):
215
211
    def __init__(self, value, *args, **kwargs):
216
212
        self.value = value
245
241
    server: D-Bus Server
246
242
    bus: dbus.SystemBus()
247
243
    """
248
 
    
249
244
    def __init__(self, interface = avahi.IF_UNSPEC, name = None,
250
245
                 servicetype = None, port = None, TXT = None,
251
246
                 domain = "", host = "", max_renames = 32768,
264
259
        self.server = None
265
260
        self.bus = bus
266
261
        self.entry_group_state_changed_match = None
267
 
    
268
262
    def rename(self):
269
263
        """Derived from the Avahi example code"""
270
264
        if self.rename_count >= self.max_renames:
280
274
        try:
281
275
            self.add()
282
276
        except dbus.exceptions.DBusException as error:
283
 
            logger.critical("D-Bus Exception", exc_info=error)
 
277
            logger.critical("DBusException: %s", error)
284
278
            self.cleanup()
285
279
            os._exit(1)
286
280
        self.rename_count += 1
287
 
    
288
281
    def remove(self):
289
282
        """Derived from the Avahi example code"""
290
283
        if self.entry_group_state_changed_match is not None:
292
285
            self.entry_group_state_changed_match = None
293
286
        if self.group is not None:
294
287
            self.group.Reset()
295
 
    
296
288
    def add(self):
297
289
        """Derived from the Avahi example code"""
298
290
        self.remove()
315
307
            dbus.UInt16(self.port),
316
308
            avahi.string_array_to_txt_array(self.TXT))
317
309
        self.group.Commit()
318
 
    
319
310
    def entry_group_state_changed(self, state, error):
320
311
        """Derived from the Avahi example code"""
321
312
        logger.debug("Avahi entry group state change: %i", state)
328
319
        elif state == avahi.ENTRY_GROUP_FAILURE:
329
320
            logger.critical("Avahi: Error in group state changed %s",
330
321
                            unicode(error))
331
 
            raise AvahiGroupError("State changed: {0!s}"
332
 
                                  .format(error))
333
 
    
 
322
            raise AvahiGroupError("State changed: %s"
 
323
                                  % unicode(error))
334
324
    def cleanup(self):
335
325
        """Derived from the Avahi example code"""
336
326
        if self.group is not None:
341
331
                pass
342
332
            self.group = None
343
333
        self.remove()
344
 
    
345
334
    def server_state_changed(self, state, error=None):
346
335
        """Derived from the Avahi example code"""
347
336
        logger.debug("Avahi server state change: %i", state)
366
355
                logger.debug("Unknown state: %r", state)
367
356
            else:
368
357
                logger.debug("Unknown state: %r: %r", state, error)
369
 
    
370
358
    def activate(self):
371
359
        """Derived from the Avahi example code"""
372
360
        if self.server is None:
379
367
                                 self.server_state_changed)
380
368
        self.server_state_changed(self.server.GetState())
381
369
 
382
 
 
383
370
class AvahiServiceToSyslog(AvahiService):
384
371
    def rename(self):
385
372
        """Add the new name to the syslog messages"""
386
373
        ret = AvahiService.rename(self)
387
374
        syslogger.setFormatter(logging.Formatter
388
 
                               ('Mandos ({0}) [%(process)d]:'
389
 
                                ' %(levelname)s: %(message)s'
390
 
                                .format(self.name)))
 
375
                               ('Mandos (%s) [%%(process)d]:'
 
376
                                ' %%(levelname)s: %%(message)s'
 
377
                                % self.name))
391
378
        return ret
392
379
 
393
 
 
394
 
def timedelta_to_milliseconds(td):
 
380
def _timedelta_to_milliseconds(td):
395
381
    "Convert a datetime.timedelta() to milliseconds"
396
382
    return ((td.days * 24 * 60 * 60 * 1000)
397
383
            + (td.seconds * 1000)
398
384
            + (td.microseconds // 1000))
399
 
 
400
 
 
 
385
        
401
386
class Client(object):
402
387
    """A representation of a client host served by this server.
403
388
    
404
389
    Attributes:
405
 
    approved:   bool(); 'None' if not yet approved/disapproved
 
390
    _approved:   bool(); 'None' if not yet approved/disapproved
406
391
    approval_delay: datetime.timedelta(); Time to wait for approval
407
392
    approval_duration: datetime.timedelta(); Duration of one approval
408
393
    checker:    subprocess.Popen(); a running checker process used
426
411
    interval:   datetime.timedelta(); How often to start a new checker
427
412
    last_approval_request: datetime.datetime(); (UTC) or None
428
413
    last_checked_ok: datetime.datetime(); (UTC) or None
 
414
 
429
415
    last_checker_status: integer between 0 and 255 reflecting exit
430
416
                         status of last checker. -1 reflects crashed
431
 
                         checker, -2 means no checker completed yet.
432
 
    last_enabled: datetime.datetime(); (UTC) or None
 
417
                         checker, or None.
 
418
    last_enabled: datetime.datetime(); (UTC)
433
419
    name:       string; from the config file, used in log messages and
434
420
                        D-Bus identifiers
435
421
    secret:     bytestring; sent verbatim (over TLS) to client
436
422
    timeout:    datetime.timedelta(); How long from last_checked_ok
437
423
                                      until this client is disabled
438
 
    extended_timeout:   extra long timeout when secret has been sent
 
424
    extended_timeout:   extra long timeout when password has been sent
439
425
    runtime_expansions: Allowed attributes for runtime expansion.
440
426
    expires:    datetime.datetime(); time (UTC) when a client will be
441
427
                disabled, or None
442
428
    """
443
429
    
444
430
    runtime_expansions = ("approval_delay", "approval_duration",
445
 
                          "created", "enabled", "expires",
446
 
                          "fingerprint", "host", "interval",
447
 
                          "last_approval_request", "last_checked_ok",
 
431
                          "created", "enabled", "fingerprint",
 
432
                          "host", "interval", "last_checked_ok",
448
433
                          "last_enabled", "name", "timeout")
449
 
    client_defaults = { "timeout": "5m",
450
 
                        "extended_timeout": "15m",
451
 
                        "interval": "2m",
452
 
                        "checker": "fping -q -- %%(host)s",
453
 
                        "host": "",
454
 
                        "approval_delay": "0s",
455
 
                        "approval_duration": "1s",
456
 
                        "approved_by_default": "True",
457
 
                        "enabled": "True",
458
 
                        }
459
434
    
460
435
    def timeout_milliseconds(self):
461
436
        "Return the 'timeout' attribute in milliseconds"
462
 
        return timedelta_to_milliseconds(self.timeout)
 
437
        return _timedelta_to_milliseconds(self.timeout)
463
438
    
464
439
    def extended_timeout_milliseconds(self):
465
440
        "Return the 'extended_timeout' attribute in milliseconds"
466
 
        return timedelta_to_milliseconds(self.extended_timeout)
 
441
        return _timedelta_to_milliseconds(self.extended_timeout)
467
442
    
468
443
    def interval_milliseconds(self):
469
444
        "Return the 'interval' attribute in milliseconds"
470
 
        return timedelta_to_milliseconds(self.interval)
 
445
        return _timedelta_to_milliseconds(self.interval)
471
446
    
472
447
    def approval_delay_milliseconds(self):
473
 
        return timedelta_to_milliseconds(self.approval_delay)
474
 
    
475
 
    @staticmethod
476
 
    def config_parser(config):
477
 
        """Construct a new dict of client settings of this form:
478
 
        { client_name: {setting_name: value, ...}, ...}
479
 
        with exceptions for any special settings as defined above.
480
 
        NOTE: Must be a pure function. Must return the same result
481
 
        value given the same arguments.
482
 
        """
483
 
        settings = {}
484
 
        for client_name in config.sections():
485
 
            section = dict(config.items(client_name))
486
 
            client = settings[client_name] = {}
487
 
            
488
 
            client["host"] = section["host"]
489
 
            # Reformat values from string types to Python types
490
 
            client["approved_by_default"] = config.getboolean(
491
 
                client_name, "approved_by_default")
492
 
            client["enabled"] = config.getboolean(client_name,
493
 
                                                  "enabled")
494
 
            
495
 
            client["fingerprint"] = (section["fingerprint"].upper()
496
 
                                     .replace(" ", ""))
497
 
            if "secret" in section:
498
 
                client["secret"] = section["secret"].decode("base64")
499
 
            elif "secfile" in section:
500
 
                with open(os.path.expanduser(os.path.expandvars
501
 
                                             (section["secfile"])),
502
 
                          "rb") as secfile:
503
 
                    client["secret"] = secfile.read()
504
 
            else:
505
 
                raise TypeError("No secret or secfile for section {0}"
506
 
                                .format(section))
507
 
            client["timeout"] = string_to_delta(section["timeout"])
508
 
            client["extended_timeout"] = string_to_delta(
509
 
                section["extended_timeout"])
510
 
            client["interval"] = string_to_delta(section["interval"])
511
 
            client["approval_delay"] = string_to_delta(
512
 
                section["approval_delay"])
513
 
            client["approval_duration"] = string_to_delta(
514
 
                section["approval_duration"])
515
 
            client["checker_command"] = section["checker"]
516
 
            client["last_approval_request"] = None
517
 
            client["last_checked_ok"] = None
518
 
            client["last_checker_status"] = -2
519
 
        
520
 
        return settings
521
 
    
522
 
    def __init__(self, settings, name = None):
 
448
        return _timedelta_to_milliseconds(self.approval_delay)
 
449
    
 
450
    def __init__(self, name = None, config=None):
 
451
        """Note: the 'checker' key in 'config' sets the
 
452
        'checker_command' attribute and *not* the 'checker'
 
453
        attribute."""
523
454
        self.name = name
524
 
        # adding all client settings
525
 
        for setting, value in settings.iteritems():
526
 
            setattr(self, setting, value)
527
 
        
528
 
        if self.enabled:
529
 
            if not hasattr(self, "last_enabled"):
530
 
                self.last_enabled = datetime.datetime.utcnow()
531
 
            if not hasattr(self, "expires"):
532
 
                self.expires = (datetime.datetime.utcnow()
533
 
                                + self.timeout)
534
 
        else:
535
 
            self.last_enabled = None
536
 
            self.expires = None
537
 
        
 
455
        if config is None:
 
456
            config = {}
538
457
        logger.debug("Creating client %r", self.name)
539
458
        # Uppercase and remove spaces from fingerprint for later
540
459
        # comparison purposes with return value from the fingerprint()
541
460
        # function
 
461
        self.fingerprint = (config["fingerprint"].upper()
 
462
                            .replace(" ", ""))
542
463
        logger.debug("  Fingerprint: %s", self.fingerprint)
543
 
        self.created = settings.get("created",
544
 
                                    datetime.datetime.utcnow())
545
 
        
546
 
        # attributes specific for this server instance
 
464
        if "secret" in config:
 
465
            self.secret = config["secret"].decode("base64")
 
466
        elif "secfile" in config:
 
467
            with open(os.path.expanduser(os.path.expandvars
 
468
                                         (config["secfile"])),
 
469
                      "rb") as secfile:
 
470
                self.secret = secfile.read()
 
471
        else:
 
472
            raise TypeError("No secret or secfile for client %s"
 
473
                            % self.name)
 
474
        self.host = config.get("host", "")
 
475
        self.created = datetime.datetime.utcnow()
 
476
        self.enabled = True
 
477
        self.last_approval_request = None
 
478
        self.last_enabled = datetime.datetime.utcnow()
 
479
        self.last_checked_ok = None
 
480
        self.last_checker_status = None
 
481
        self.timeout = string_to_delta(config["timeout"])
 
482
        self.extended_timeout = string_to_delta(config
 
483
                                                ["extended_timeout"])
 
484
        self.interval = string_to_delta(config["interval"])
547
485
        self.checker = None
548
486
        self.checker_initiator_tag = None
549
487
        self.disable_initiator_tag = None
 
488
        self.expires = datetime.datetime.utcnow() + self.timeout
550
489
        self.checker_callback_tag = None
 
490
        self.checker_command = config["checker"]
551
491
        self.current_checker_command = None
552
 
        self.approved = None
 
492
        self._approved = None
 
493
        self.approved_by_default = config.get("approved_by_default",
 
494
                                              True)
553
495
        self.approvals_pending = 0
 
496
        self.approval_delay = string_to_delta(
 
497
            config["approval_delay"])
 
498
        self.approval_duration = string_to_delta(
 
499
            config["approval_duration"])
554
500
        self.changedstate = (multiprocessing_manager
555
501
                             .Condition(multiprocessing_manager
556
502
                                        .Lock()))
576
522
        if getattr(self, "enabled", False):
577
523
            # Already enabled
578
524
            return
 
525
        self.send_changedstate()
579
526
        self.expires = datetime.datetime.utcnow() + self.timeout
580
527
        self.enabled = True
581
528
        self.last_enabled = datetime.datetime.utcnow()
582
529
        self.init_checker()
583
 
        self.send_changedstate()
584
530
    
585
531
    def disable(self, quiet=True):
586
532
        """Disable this client."""
587
533
        if not getattr(self, "enabled", False):
588
534
            return False
589
535
        if not quiet:
 
536
            self.send_changedstate()
 
537
        if not quiet:
590
538
            logger.info("Disabling client %s", self.name)
591
 
        if getattr(self, "disable_initiator_tag", None) is not None:
 
539
        if getattr(self, "disable_initiator_tag", False):
592
540
            gobject.source_remove(self.disable_initiator_tag)
593
541
            self.disable_initiator_tag = None
594
542
        self.expires = None
595
 
        if getattr(self, "checker_initiator_tag", None) is not None:
 
543
        if getattr(self, "checker_initiator_tag", False):
596
544
            gobject.source_remove(self.checker_initiator_tag)
597
545
            self.checker_initiator_tag = None
598
546
        self.stop_checker()
599
547
        self.enabled = False
600
 
        if not quiet:
601
 
            self.send_changedstate()
602
548
        # Do not run this again if called by a gobject.timeout_add
603
549
        return False
604
550
    
608
554
    def init_checker(self):
609
555
        # Schedule a new checker to be started an 'interval' from now,
610
556
        # and every interval from then on.
611
 
        if self.checker_initiator_tag is not None:
612
 
            gobject.source_remove(self.checker_initiator_tag)
613
557
        self.checker_initiator_tag = (gobject.timeout_add
614
558
                                      (self.interval_milliseconds(),
615
559
                                       self.start_checker))
616
560
        # Schedule a disable() when 'timeout' has passed
617
 
        if self.disable_initiator_tag is not None:
618
 
            gobject.source_remove(self.disable_initiator_tag)
619
561
        self.disable_initiator_tag = (gobject.timeout_add
620
562
                                   (self.timeout_milliseconds(),
621
563
                                    self.disable))
627
569
        self.checker_callback_tag = None
628
570
        self.checker = None
629
571
        if os.WIFEXITED(condition):
630
 
            self.last_checker_status = os.WEXITSTATUS(condition)
 
572
            self.last_checker_status =  os.WEXITSTATUS(condition)
631
573
            if self.last_checker_status == 0:
632
574
                logger.info("Checker for %(name)s succeeded",
633
575
                            vars(self))
640
582
            logger.warning("Checker for %(name)s crashed?",
641
583
                           vars(self))
642
584
    
643
 
    def checked_ok(self):
644
 
        """Assert that the client has been seen, alive and well."""
645
 
        self.last_checked_ok = datetime.datetime.utcnow()
646
 
        self.last_checker_status = 0
647
 
        self.bump_timeout()
648
 
    
649
 
    def bump_timeout(self, timeout=None):
650
 
        """Bump up the timeout for this client."""
 
585
    def checked_ok(self, timeout=None):
 
586
        """Bump up the timeout for this client.
 
587
        
 
588
        This should only be called when the client has been seen,
 
589
        alive and well.
 
590
        """
651
591
        if timeout is None:
652
592
            timeout = self.timeout
 
593
        self.last_checked_ok = datetime.datetime.utcnow()
653
594
        if self.disable_initiator_tag is not None:
654
595
            gobject.source_remove(self.disable_initiator_tag)
655
 
            self.disable_initiator_tag = None
656
596
        if getattr(self, "enabled", False):
657
597
            self.disable_initiator_tag = (gobject.timeout_add
658
 
                                          (timedelta_to_milliseconds
 
598
                                          (_timedelta_to_milliseconds
659
599
                                           (timeout), self.disable))
660
600
            self.expires = datetime.datetime.utcnow() + timeout
661
601
    
668
608
        If a checker already exists, leave it running and do
669
609
        nothing."""
670
610
        # The reason for not killing a running checker is that if we
671
 
        # did that, and if a checker (for some reason) started running
672
 
        # slowly and taking more than 'interval' time, then the client
673
 
        # would inevitably timeout, since no checker would get a
674
 
        # chance to run to completion.  If we instead leave running
 
611
        # did that, then if a checker (for some reason) started
 
612
        # running slowly and taking more than 'interval' time, the
 
613
        # client would inevitably timeout, since no checker would get
 
614
        # a chance to run to completion.  If we instead leave running
675
615
        # checkers alone, the checker would have to take more time
676
616
        # than 'timeout' for the client to be disabled, which is as it
677
617
        # should be.
691
631
                                      self.current_checker_command)
692
632
        # Start a new checker if needed
693
633
        if self.checker is None:
694
 
            # Escape attributes for the shell
695
 
            escaped_attrs = dict(
696
 
                (attr, re.escape(unicode(getattr(self, attr))))
697
 
                for attr in
698
 
                self.runtime_expansions)
699
634
            try:
700
 
                command = self.checker_command % escaped_attrs
701
 
            except TypeError as error:
702
 
                logger.error('Could not format string "%s"',
703
 
                             self.checker_command, exc_info=error)
704
 
                return True # Try again later
 
635
                # In case checker_command has exactly one % operator
 
636
                command = self.checker_command % self.host
 
637
            except TypeError:
 
638
                # Escape attributes for the shell
 
639
                escaped_attrs = dict(
 
640
                    (attr,
 
641
                     re.escape(unicode(str(getattr(self, attr, "")),
 
642
                                       errors=
 
643
                                       'replace')))
 
644
                    for attr in
 
645
                    self.runtime_expansions)
 
646
                
 
647
                try:
 
648
                    command = self.checker_command % escaped_attrs
 
649
                except TypeError as error:
 
650
                    logger.error('Could not format string "%s":'
 
651
                                 ' %s', self.checker_command, error)
 
652
                    return True # Try again later
705
653
            self.current_checker_command = command
706
654
            try:
707
655
                logger.info("Starting checker %r for %s",
713
661
                self.checker = subprocess.Popen(command,
714
662
                                                close_fds=True,
715
663
                                                shell=True, cwd="/")
 
664
                self.checker_callback_tag = (gobject.child_watch_add
 
665
                                             (self.checker.pid,
 
666
                                              self.checker_callback,
 
667
                                              data=command))
 
668
                # The checker may have completed before the gobject
 
669
                # watch was added.  Check for this.
 
670
                pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
 
671
                if pid:
 
672
                    gobject.source_remove(self.checker_callback_tag)
 
673
                    self.checker_callback(pid, status, command)
716
674
            except OSError as error:
717
 
                logger.error("Failed to start subprocess",
718
 
                             exc_info=error)
719
 
            self.checker_callback_tag = (gobject.child_watch_add
720
 
                                         (self.checker.pid,
721
 
                                          self.checker_callback,
722
 
                                          data=command))
723
 
            # The checker may have completed before the gobject
724
 
            # watch was added.  Check for this.
725
 
            pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
726
 
            if pid:
727
 
                gobject.source_remove(self.checker_callback_tag)
728
 
                self.checker_callback(pid, status, command)
 
675
                logger.error("Failed to start subprocess: %s",
 
676
                             error)
729
677
        # Re-run this periodically if run by gobject.timeout_add
730
678
        return True
731
679
    
738
686
            return
739
687
        logger.debug("Stopping checker for %(name)s", vars(self))
740
688
        try:
741
 
            self.checker.terminate()
 
689
            os.kill(self.checker.pid, signal.SIGTERM)
742
690
            #time.sleep(0.5)
743
691
            #if self.checker.poll() is None:
744
 
            #    self.checker.kill()
 
692
            #    os.kill(self.checker.pid, signal.SIGKILL)
745
693
        except OSError as error:
746
694
            if error.errno != errno.ESRCH: # No such process
747
695
                raise
764
712
    # "Set" method, so we fail early here:
765
713
    if byte_arrays and signature != "ay":
766
714
        raise ValueError("Byte arrays not supported for non-'ay'"
767
 
                         " signature {0!r}".format(signature))
 
715
                         " signature %r" % signature)
768
716
    def decorator(func):
769
717
        func._dbus_is_property = True
770
718
        func._dbus_interface = dbus_interface
778
726
    return decorator
779
727
 
780
728
 
781
 
def dbus_interface_annotations(dbus_interface):
782
 
    """Decorator for marking functions returning interface annotations
783
 
    
784
 
    Usage:
785
 
    
786
 
    @dbus_interface_annotations("org.example.Interface")
787
 
    def _foo(self):  # Function name does not matter
788
 
        return {"org.freedesktop.DBus.Deprecated": "true",
789
 
                "org.freedesktop.DBus.Property.EmitsChangedSignal":
790
 
                    "false"}
791
 
    """
792
 
    def decorator(func):
793
 
        func._dbus_is_interface = True
794
 
        func._dbus_interface = dbus_interface
795
 
        func._dbus_name = dbus_interface
796
 
        return func
797
 
    return decorator
798
 
 
799
 
 
800
 
def dbus_annotations(annotations):
801
 
    """Decorator to annotate D-Bus methods, signals or properties
802
 
    Usage:
803
 
    
804
 
    @dbus_service_property("org.example.Interface", signature="b",
805
 
                           access="r")
806
 
    @dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",
807
 
                        "org.freedesktop.DBus.Property."
808
 
                        "EmitsChangedSignal": "false"})
809
 
    def Property_dbus_property(self):
810
 
        return dbus.Boolean(False)
811
 
    """
812
 
    def decorator(func):
813
 
        func._dbus_annotations = annotations
814
 
        return func
815
 
    return decorator
816
 
 
817
 
 
818
729
class DBusPropertyException(dbus.exceptions.DBusException):
819
730
    """A base class for D-Bus property-related exceptions
820
731
    """
843
754
    """
844
755
    
845
756
    @staticmethod
846
 
    def _is_dbus_thing(thing):
847
 
        """Returns a function testing if an attribute is a D-Bus thing
848
 
        
849
 
        If called like _is_dbus_thing("method") it returns a function
850
 
        suitable for use as predicate to inspect.getmembers().
851
 
        """
852
 
        return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),
853
 
                                   False)
 
757
    def _is_dbus_property(obj):
 
758
        return getattr(obj, "_dbus_is_property", False)
854
759
    
855
 
    def _get_all_dbus_things(self, thing):
 
760
    def _get_all_dbus_properties(self):
856
761
        """Returns a generator of (name, attribute) pairs
857
762
        """
858
 
        return ((getattr(athing.__get__(self), "_dbus_name",
859
 
                         name),
860
 
                 athing.__get__(self))
 
763
        return ((prop.__get__(self)._dbus_name, prop.__get__(self))
861
764
                for cls in self.__class__.__mro__
862
 
                for name, athing in
863
 
                inspect.getmembers(cls,
864
 
                                   self._is_dbus_thing(thing)))
 
765
                for name, prop in
 
766
                inspect.getmembers(cls, self._is_dbus_property))
865
767
    
866
768
    def _get_dbus_property(self, interface_name, property_name):
867
769
        """Returns a bound method if one exists which is a D-Bus
869
771
        """
870
772
        for cls in  self.__class__.__mro__:
871
773
            for name, value in (inspect.getmembers
872
 
                                (cls,
873
 
                                 self._is_dbus_thing("property"))):
 
774
                                (cls, self._is_dbus_property)):
874
775
                if (value._dbus_name == property_name
875
776
                    and value._dbus_interface == interface_name):
876
777
                    return value.__get__(self)
905
806
            # signatures other than "ay".
906
807
            if prop._dbus_signature != "ay":
907
808
                raise ValueError
908
 
            value = dbus.ByteArray(b''.join(chr(byte)
909
 
                                            for byte in value))
 
809
            value = dbus.ByteArray(''.join(unichr(byte)
 
810
                                           for byte in value))
910
811
        prop(value)
911
812
    
912
813
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
918
819
        Note: Will not include properties with access="write".
919
820
        """
920
821
        properties = {}
921
 
        for name, prop in self._get_all_dbus_things("property"):
 
822
        for name, prop in self._get_all_dbus_properties():
922
823
            if (interface_name
923
824
                and interface_name != prop._dbus_interface):
924
825
                # Interface non-empty but did not match
939
840
                         path_keyword='object_path',
940
841
                         connection_keyword='connection')
941
842
    def Introspect(self, object_path, connection):
942
 
        """Overloading of standard D-Bus method.
943
 
        
944
 
        Inserts property tags and interface annotation tags.
 
843
        """Standard D-Bus method, overloaded to insert property tags.
945
844
        """
946
845
        xmlstring = dbus.service.Object.Introspect(self, object_path,
947
846
                                                   connection)
954
853
                e.setAttribute("access", prop._dbus_access)
955
854
                return e
956
855
            for if_tag in document.getElementsByTagName("interface"):
957
 
                # Add property tags
958
856
                for tag in (make_tag(document, name, prop)
959
857
                            for name, prop
960
 
                            in self._get_all_dbus_things("property")
 
858
                            in self._get_all_dbus_properties()
961
859
                            if prop._dbus_interface
962
860
                            == if_tag.getAttribute("name")):
963
861
                    if_tag.appendChild(tag)
964
 
                # Add annotation tags
965
 
                for typ in ("method", "signal", "property"):
966
 
                    for tag in if_tag.getElementsByTagName(typ):
967
 
                        annots = dict()
968
 
                        for name, prop in (self.
969
 
                                           _get_all_dbus_things(typ)):
970
 
                            if (name == tag.getAttribute("name")
971
 
                                and prop._dbus_interface
972
 
                                == if_tag.getAttribute("name")):
973
 
                                annots.update(getattr
974
 
                                              (prop,
975
 
                                               "_dbus_annotations",
976
 
                                               {}))
977
 
                        for name, value in annots.iteritems():
978
 
                            ann_tag = document.createElement(
979
 
                                "annotation")
980
 
                            ann_tag.setAttribute("name", name)
981
 
                            ann_tag.setAttribute("value", value)
982
 
                            tag.appendChild(ann_tag)
983
 
                # Add interface annotation tags
984
 
                for annotation, value in dict(
985
 
                    itertools.chain.from_iterable(
986
 
                        annotations().iteritems()
987
 
                        for name, annotations in
988
 
                        self._get_all_dbus_things("interface")
989
 
                        if name == if_tag.getAttribute("name")
990
 
                        )).iteritems():
991
 
                    ann_tag = document.createElement("annotation")
992
 
                    ann_tag.setAttribute("name", annotation)
993
 
                    ann_tag.setAttribute("value", value)
994
 
                    if_tag.appendChild(ann_tag)
995
862
                # Add the names to the return values for the
996
863
                # "org.freedesktop.DBus.Properties" methods
997
864
                if (if_tag.getAttribute("name")
1012
879
        except (AttributeError, xml.dom.DOMException,
1013
880
                xml.parsers.expat.ExpatError) as error:
1014
881
            logger.error("Failed to override Introspection method",
1015
 
                         exc_info=error)
 
882
                         error)
1016
883
        return xmlstring
1017
884
 
1018
885
 
1024
891
                       variant_level=variant_level)
1025
892
 
1026
893
 
1027
 
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
1028
 
    """A class decorator; applied to a subclass of
1029
 
    dbus.service.Object, it will add alternate D-Bus attributes with
1030
 
    interface names according to the "alt_interface_names" mapping.
1031
 
    Usage:
1032
 
    
1033
 
    @alternate_dbus_names({"org.example.Interface":
1034
 
                               "net.example.AlternateInterface"})
1035
 
    class SampleDBusObject(dbus.service.Object):
1036
 
        @dbus.service.method("org.example.Interface")
1037
 
        def SampleDBusMethod():
1038
 
            pass
1039
 
    
1040
 
    The above "SampleDBusMethod" on "SampleDBusObject" will be
1041
 
    reachable via two interfaces: "org.example.Interface" and
1042
 
    "net.example.AlternateInterface", the latter of which will have
1043
 
    its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
1044
 
    "true", unless "deprecate" is passed with a False value.
1045
 
    
1046
 
    This works for methods and signals, and also for D-Bus properties
1047
 
    (from DBusObjectWithProperties) and interfaces (from the
1048
 
    dbus_interface_annotations decorator).
 
894
class AlternateDBusNamesMetaclass(DBusObjectWithProperties
 
895
                                  .__metaclass__):
 
896
    """Applied to an empty subclass of a D-Bus object, this metaclass
 
897
    will add additional D-Bus attributes matching a certain pattern.
1049
898
    """
1050
 
    def wrapper(cls):
1051
 
        for orig_interface_name, alt_interface_name in (
1052
 
            alt_interface_names.iteritems()):
1053
 
            attr = {}
1054
 
            interface_names = set()
1055
 
            # Go though all attributes of the class
1056
 
            for attrname, attribute in inspect.getmembers(cls):
 
899
    def __new__(mcs, name, bases, attr):
 
900
        # Go through all the base classes which could have D-Bus
 
901
        # methods, signals, or properties in them
 
902
        for base in (b for b in bases
 
903
                     if issubclass(b, dbus.service.Object)):
 
904
            # Go though all attributes of the base class
 
905
            for attrname, attribute in inspect.getmembers(base):
1057
906
                # Ignore non-D-Bus attributes, and D-Bus attributes
1058
907
                # with the wrong interface name
1059
908
                if (not hasattr(attribute, "_dbus_interface")
1060
909
                    or not attribute._dbus_interface
1061
 
                    .startswith(orig_interface_name)):
 
910
                    .startswith("se.recompile.Mandos")):
1062
911
                    continue
1063
912
                # Create an alternate D-Bus interface name based on
1064
913
                # the current name
1065
914
                alt_interface = (attribute._dbus_interface
1066
 
                                 .replace(orig_interface_name,
1067
 
                                          alt_interface_name))
1068
 
                interface_names.add(alt_interface)
 
915
                                 .replace("se.recompile.Mandos",
 
916
                                          "se.bsnet.fukt.Mandos"))
1069
917
                # Is this a D-Bus signal?
1070
918
                if getattr(attribute, "_dbus_is_signal", False):
1071
919
                    # Extract the original non-method function by
1086
934
                                nonmethod_func.func_name,
1087
935
                                nonmethod_func.func_defaults,
1088
936
                                nonmethod_func.func_closure)))
1089
 
                    # Copy annotations, if any
1090
 
                    try:
1091
 
                        new_function._dbus_annotations = (
1092
 
                            dict(attribute._dbus_annotations))
1093
 
                    except AttributeError:
1094
 
                        pass
1095
937
                    # Define a creator of a function to call both the
1096
 
                    # original and alternate functions, so both the
1097
 
                    # original and alternate signals gets sent when
1098
 
                    # the function is called
 
938
                    # old and new functions, so both the old and new
 
939
                    # signals gets sent when the function is called
1099
940
                    def fixscope(func1, func2):
1100
941
                        """This function is a scope container to pass
1101
942
                        func1 and func2 to the "call_both" function
1108
949
                        return call_both
1109
950
                    # Create the "call_both" function and add it to
1110
951
                    # the class
1111
 
                    attr[attrname] = fixscope(attribute, new_function)
 
952
                    attr[attrname] = fixscope(attribute,
 
953
                                              new_function)
1112
954
                # Is this a D-Bus method?
1113
955
                elif getattr(attribute, "_dbus_is_method", False):
1114
956
                    # Create a new, but exactly alike, function
1125
967
                                        attribute.func_name,
1126
968
                                        attribute.func_defaults,
1127
969
                                        attribute.func_closure)))
1128
 
                    # Copy annotations, if any
1129
 
                    try:
1130
 
                        attr[attrname]._dbus_annotations = (
1131
 
                            dict(attribute._dbus_annotations))
1132
 
                    except AttributeError:
1133
 
                        pass
1134
970
                # Is this a D-Bus property?
1135
971
                elif getattr(attribute, "_dbus_is_property", False):
1136
972
                    # Create a new, but exactly alike, function
1150
986
                                        attribute.func_name,
1151
987
                                        attribute.func_defaults,
1152
988
                                        attribute.func_closure)))
1153
 
                    # Copy annotations, if any
1154
 
                    try:
1155
 
                        attr[attrname]._dbus_annotations = (
1156
 
                            dict(attribute._dbus_annotations))
1157
 
                    except AttributeError:
1158
 
                        pass
1159
 
                # Is this a D-Bus interface?
1160
 
                elif getattr(attribute, "_dbus_is_interface", False):
1161
 
                    # Create a new, but exactly alike, function
1162
 
                    # object.  Decorate it to be a new D-Bus interface
1163
 
                    # with the alternate D-Bus interface name.  Add it
1164
 
                    # to the class.
1165
 
                    attr[attrname] = (dbus_interface_annotations
1166
 
                                      (alt_interface)
1167
 
                                      (types.FunctionType
1168
 
                                       (attribute.func_code,
1169
 
                                        attribute.func_globals,
1170
 
                                        attribute.func_name,
1171
 
                                        attribute.func_defaults,
1172
 
                                        attribute.func_closure)))
1173
 
            if deprecate:
1174
 
                # Deprecate all alternate interfaces
1175
 
                iname="_AlternateDBusNames_interface_annotation{0}"
1176
 
                for interface_name in interface_names:
1177
 
                    @dbus_interface_annotations(interface_name)
1178
 
                    def func(self):
1179
 
                        return { "org.freedesktop.DBus.Deprecated":
1180
 
                                     "true" }
1181
 
                    # Find an unused name
1182
 
                    for aname in (iname.format(i)
1183
 
                                  for i in itertools.count()):
1184
 
                        if aname not in attr:
1185
 
                            attr[aname] = func
1186
 
                            break
1187
 
            if interface_names:
1188
 
                # Replace the class with a new subclass of it with
1189
 
                # methods, signals, etc. as created above.
1190
 
                cls = type(b"{0}Alternate".format(cls.__name__),
1191
 
                           (cls,), attr)
1192
 
        return cls
1193
 
    return wrapper
1194
 
 
1195
 
 
1196
 
@alternate_dbus_interfaces({"se.recompile.Mandos":
1197
 
                                "se.bsnet.fukt.Mandos"})
 
989
        return type.__new__(mcs, name, bases, attr)
 
990
 
 
991
 
1198
992
class ClientDBus(Client, DBusObjectWithProperties):
1199
993
    """A Client class using D-Bus
1200
994
    
1211
1005
    def __init__(self, bus = None, *args, **kwargs):
1212
1006
        self.bus = bus
1213
1007
        Client.__init__(self, *args, **kwargs)
 
1008
        
 
1009
        self._approvals_pending = 0
1214
1010
        # Only now, when this client is initialized, can it show up on
1215
1011
        # the D-Bus
1216
1012
        client_object_name = unicode(self.name).translate(
1220
1016
                                 ("/clients/" + client_object_name))
1221
1017
        DBusObjectWithProperties.__init__(self, self.bus,
1222
1018
                                          self.dbus_object_path)
1223
 
    
 
1019
        
1224
1020
    def notifychangeproperty(transform_func,
1225
1021
                             dbus_name, type_func=lambda x: x,
1226
1022
                             variant_level=1):
1249
1045
        
1250
1046
        return property(lambda self: getattr(self, attrname), setter)
1251
1047
    
 
1048
    
1252
1049
    expires = notifychangeproperty(datetime_to_dbus, "Expires")
1253
1050
    approvals_pending = notifychangeproperty(dbus.Boolean,
1254
1051
                                             "ApprovalPending",
1261
1058
                                       checker is not None)
1262
1059
    last_checked_ok = notifychangeproperty(datetime_to_dbus,
1263
1060
                                           "LastCheckedOK")
1264
 
    last_checker_status = notifychangeproperty(dbus.Int16,
1265
 
                                               "LastCheckerStatus")
1266
1061
    last_approval_request = notifychangeproperty(
1267
1062
        datetime_to_dbus, "LastApprovalRequest")
1268
1063
    approved_by_default = notifychangeproperty(dbus.Boolean,
1269
1064
                                               "ApprovedByDefault")
1270
 
    approval_delay = notifychangeproperty(dbus.UInt64,
 
1065
    approval_delay = notifychangeproperty(dbus.UInt16,
1271
1066
                                          "ApprovalDelay",
1272
1067
                                          type_func =
1273
 
                                          timedelta_to_milliseconds)
 
1068
                                          _timedelta_to_milliseconds)
1274
1069
    approval_duration = notifychangeproperty(
1275
 
        dbus.UInt64, "ApprovalDuration",
1276
 
        type_func = timedelta_to_milliseconds)
 
1070
        dbus.UInt16, "ApprovalDuration",
 
1071
        type_func = _timedelta_to_milliseconds)
1277
1072
    host = notifychangeproperty(dbus.String, "Host")
1278
 
    timeout = notifychangeproperty(dbus.UInt64, "Timeout",
 
1073
    timeout = notifychangeproperty(dbus.UInt16, "Timeout",
1279
1074
                                   type_func =
1280
 
                                   timedelta_to_milliseconds)
 
1075
                                   _timedelta_to_milliseconds)
1281
1076
    extended_timeout = notifychangeproperty(
1282
 
        dbus.UInt64, "ExtendedTimeout",
1283
 
        type_func = timedelta_to_milliseconds)
1284
 
    interval = notifychangeproperty(dbus.UInt64,
 
1077
        dbus.UInt16, "ExtendedTimeout",
 
1078
        type_func = _timedelta_to_milliseconds)
 
1079
    interval = notifychangeproperty(dbus.UInt16,
1285
1080
                                    "Interval",
1286
1081
                                    type_func =
1287
 
                                    timedelta_to_milliseconds)
 
1082
                                    _timedelta_to_milliseconds)
1288
1083
    checker_command = notifychangeproperty(dbus.String, "Checker")
1289
1084
    
1290
1085
    del notifychangeproperty
1332
1127
        return r
1333
1128
    
1334
1129
    def _reset_approved(self):
1335
 
        self.approved = None
 
1130
        self._approved = None
1336
1131
        return False
1337
1132
    
1338
1133
    def approve(self, value=True):
1339
 
        self.approved = value
1340
 
        gobject.timeout_add(timedelta_to_milliseconds
 
1134
        self.send_changedstate()
 
1135
        self._approved = value
 
1136
        gobject.timeout_add(_timedelta_to_milliseconds
1341
1137
                            (self.approval_duration),
1342
1138
                            self._reset_approved)
1343
 
        self.send_changedstate()
 
1139
    
1344
1140
    
1345
1141
    ## D-Bus methods, signals & properties
1346
1142
    _interface = "se.recompile.Mandos.Client"
1347
1143
    
1348
 
    ## Interfaces
1349
 
    
1350
 
    @dbus_interface_annotations(_interface)
1351
 
    def _foo(self):
1352
 
        return { "org.freedesktop.DBus.Property.EmitsChangedSignal":
1353
 
                     "false"}
1354
 
    
1355
1144
    ## Signals
1356
1145
    
1357
1146
    # CheckerCompleted - signal
1393
1182
        "D-Bus signal"
1394
1183
        return self.need_approval()
1395
1184
    
 
1185
    # NeRwequest - signal
 
1186
    @dbus.service.signal(_interface, signature="s")
 
1187
    def NewRequest(self, ip):
 
1188
        """D-Bus signal
 
1189
        Is sent after a client request a password.
 
1190
        """
 
1191
        pass
 
1192
    
1396
1193
    ## Methods
1397
1194
    
1398
1195
    # Approve - method
1456
1253
                           access="readwrite")
1457
1254
    def ApprovalDuration_dbus_property(self, value=None):
1458
1255
        if value is None:       # get
1459
 
            return dbus.UInt64(timedelta_to_milliseconds(
 
1256
            return dbus.UInt64(_timedelta_to_milliseconds(
1460
1257
                    self.approval_duration))
1461
1258
        self.approval_duration = datetime.timedelta(0, 0, 0, value)
1462
1259
    
1476
1273
    def Host_dbus_property(self, value=None):
1477
1274
        if value is None:       # get
1478
1275
            return dbus.String(self.host)
1479
 
        self.host = unicode(value)
 
1276
        self.host = value
1480
1277
    
1481
1278
    # Created - property
1482
1279
    @dbus_service_property(_interface, signature="s", access="read")
1483
1280
    def Created_dbus_property(self):
1484
 
        return datetime_to_dbus(self.created)
 
1281
        return dbus.String(datetime_to_dbus(self.created))
1485
1282
    
1486
1283
    # LastEnabled - property
1487
1284
    @dbus_service_property(_interface, signature="s", access="read")
1508
1305
            return
1509
1306
        return datetime_to_dbus(self.last_checked_ok)
1510
1307
    
1511
 
    # LastCheckerStatus - property
1512
 
    @dbus_service_property(_interface, signature="n",
1513
 
                           access="read")
1514
 
    def LastCheckerStatus_dbus_property(self):
1515
 
        return dbus.Int16(self.last_checker_status)
1516
 
    
1517
1308
    # Expires - property
1518
1309
    @dbus_service_property(_interface, signature="s", access="read")
1519
1310
    def Expires_dbus_property(self):
1530
1321
    def Timeout_dbus_property(self, value=None):
1531
1322
        if value is None:       # get
1532
1323
            return dbus.UInt64(self.timeout_milliseconds())
1533
 
        old_timeout = self.timeout
1534
1324
        self.timeout = datetime.timedelta(0, 0, 0, value)
1535
 
        # Reschedule disabling
1536
 
        if self.enabled:
1537
 
            now = datetime.datetime.utcnow()
1538
 
            self.expires += self.timeout - old_timeout
1539
 
            if self.expires <= now:
1540
 
                # The timeout has passed
1541
 
                self.disable()
1542
 
            else:
1543
 
                if (getattr(self, "disable_initiator_tag", None)
1544
 
                    is None):
1545
 
                    return
1546
 
                gobject.source_remove(self.disable_initiator_tag)
1547
 
                self.disable_initiator_tag = (
1548
 
                    gobject.timeout_add(
1549
 
                        timedelta_to_milliseconds(self.expires - now),
1550
 
                        self.disable))
 
1325
        if getattr(self, "disable_initiator_tag", None) is None:
 
1326
            return
 
1327
        # Reschedule timeout
 
1328
        gobject.source_remove(self.disable_initiator_tag)
 
1329
        self.disable_initiator_tag = None
 
1330
        self.expires = None
 
1331
        time_to_die = _timedelta_to_milliseconds((self
 
1332
                                                  .last_checked_ok
 
1333
                                                  + self.timeout)
 
1334
                                                 - datetime.datetime
 
1335
                                                 .utcnow())
 
1336
        if time_to_die <= 0:
 
1337
            # The timeout has passed
 
1338
            self.disable()
 
1339
        else:
 
1340
            self.expires = (datetime.datetime.utcnow()
 
1341
                            + datetime.timedelta(milliseconds =
 
1342
                                                 time_to_die))
 
1343
            self.disable_initiator_tag = (gobject.timeout_add
 
1344
                                          (time_to_die, self.disable))
1551
1345
    
1552
1346
    # ExtendedTimeout - property
1553
1347
    @dbus_service_property(_interface, signature="t",
1566
1360
        self.interval = datetime.timedelta(0, 0, 0, value)
1567
1361
        if getattr(self, "checker_initiator_tag", None) is None:
1568
1362
            return
1569
 
        if self.enabled:
1570
 
            # Reschedule checker run
1571
 
            gobject.source_remove(self.checker_initiator_tag)
1572
 
            self.checker_initiator_tag = (gobject.timeout_add
1573
 
                                          (value, self.start_checker))
1574
 
            self.start_checker()    # Start one now, too
 
1363
        # Reschedule checker run
 
1364
        gobject.source_remove(self.checker_initiator_tag)
 
1365
        self.checker_initiator_tag = (gobject.timeout_add
 
1366
                                      (value, self.start_checker))
 
1367
        self.start_checker()    # Start one now, too
1575
1368
    
1576
1369
    # Checker - property
1577
1370
    @dbus_service_property(_interface, signature="s",
1579
1372
    def Checker_dbus_property(self, value=None):
1580
1373
        if value is None:       # get
1581
1374
            return dbus.String(self.checker_command)
1582
 
        self.checker_command = unicode(value)
 
1375
        self.checker_command = value
1583
1376
    
1584
1377
    # CheckerRunning - property
1585
1378
    @dbus_service_property(_interface, signature="b",
1614
1407
            raise KeyError()
1615
1408
    
1616
1409
    def __getattribute__(self, name):
1617
 
        if name == '_pipe':
 
1410
        if(name == '_pipe'):
1618
1411
            return super(ProxyClient, self).__getattribute__(name)
1619
1412
        self._pipe.send(('getattr', name))
1620
1413
        data = self._pipe.recv()
1627
1420
            return func
1628
1421
    
1629
1422
    def __setattr__(self, name, value):
1630
 
        if name == '_pipe':
 
1423
        if(name == '_pipe'):
1631
1424
            return super(ProxyClient, self).__setattr__(name, value)
1632
1425
        self._pipe.send(('setattr', name, value))
1633
1426
 
1634
1427
 
 
1428
class ClientDBusTransitional(ClientDBus):
 
1429
    __metaclass__ = AlternateDBusNamesMetaclass
 
1430
 
 
1431
 
1635
1432
class ClientHandler(socketserver.BaseRequestHandler, object):
1636
1433
    """A class to handle client connections.
1637
1434
    
1698
1495
                    logger.warning("Bad certificate: %s", error)
1699
1496
                    return
1700
1497
                logger.debug("Fingerprint: %s", fpr)
 
1498
                if self.server.use_dbus:
 
1499
                    # Emit D-Bus signal
 
1500
                    client.NewRequest(str(self.client_address))
1701
1501
                
1702
1502
                try:
1703
1503
                    client = ProxyClient(child_pipe, fpr,
1719
1519
                            client.Rejected("Disabled")
1720
1520
                        return
1721
1521
                    
1722
 
                    if client.approved or not client.approval_delay:
 
1522
                    if client._approved or not client.approval_delay:
1723
1523
                        #We are approved or approval is disabled
1724
1524
                        break
1725
 
                    elif client.approved is None:
 
1525
                    elif client._approved is None:
1726
1526
                        logger.info("Client %s needs approval",
1727
1527
                                    client.name)
1728
1528
                        if self.server.use_dbus:
1741
1541
                    #wait until timeout or approved
1742
1542
                    time = datetime.datetime.now()
1743
1543
                    client.changedstate.acquire()
1744
 
                    client.changedstate.wait(
1745
 
                        float(timedelta_to_milliseconds(delay)
1746
 
                              / 1000))
 
1544
                    (client.changedstate.wait
 
1545
                     (float(client._timedelta_to_milliseconds(delay)
 
1546
                            / 1000)))
1747
1547
                    client.changedstate.release()
1748
1548
                    time2 = datetime.datetime.now()
1749
1549
                    if (time2 - time) >= delay:
1765
1565
                    try:
1766
1566
                        sent = session.send(client.secret[sent_size:])
1767
1567
                    except gnutls.errors.GNUTLSError as error:
1768
 
                        logger.warning("gnutls send failed",
1769
 
                                       exc_info=error)
 
1568
                        logger.warning("gnutls send failed")
1770
1569
                        return
1771
1570
                    logger.debug("Sent: %d, remaining: %d",
1772
1571
                                 sent, len(client.secret)
1775
1574
                
1776
1575
                logger.info("Sending secret to %s", client.name)
1777
1576
                # bump the timeout using extended_timeout
1778
 
                client.bump_timeout(client.extended_timeout)
 
1577
                client.checked_ok(client.extended_timeout)
1779
1578
                if self.server.use_dbus:
1780
1579
                    # Emit D-Bus signal
1781
1580
                    client.GotSecret()
1786
1585
                try:
1787
1586
                    session.bye()
1788
1587
                except gnutls.errors.GNUTLSError as error:
1789
 
                    logger.warning("GnuTLS bye failed",
1790
 
                                   exc_info=error)
 
1588
                    logger.warning("GnuTLS bye failed")
1791
1589
    
1792
1590
    @staticmethod
1793
1591
    def peer_certificate(session):
1858
1656
    def sub_process_main(self, request, address):
1859
1657
        try:
1860
1658
            self.finish_request(request, address)
1861
 
        except Exception:
 
1659
        except:
1862
1660
            self.handle_error(request, address)
1863
1661
        self.close_request(request)
1864
1662
    
1865
1663
    def process_request(self, request, address):
1866
1664
        """Start a new process to process the request."""
1867
1665
        proc = multiprocessing.Process(target = self.sub_process_main,
1868
 
                                       args = (request, address))
 
1666
                                       args = (request,
 
1667
                                               address))
1869
1668
        proc.start()
1870
1669
        return proc
1871
1670
 
1921
1720
                                           str(self.interface
1922
1721
                                               + '\0'))
1923
1722
                except socket.error as error:
1924
 
                    if error.errno == errno.EPERM:
 
1723
                    if error[0] == errno.EPERM:
1925
1724
                        logger.error("No permission to"
1926
1725
                                     " bind to interface %s",
1927
1726
                                     self.interface)
1928
 
                    elif error.errno == errno.ENOPROTOOPT:
 
1727
                    elif error[0] == errno.ENOPROTOOPT:
1929
1728
                        logger.error("SO_BINDTODEVICE not available;"
1930
1729
                                     " cannot bind to interface %s",
1931
1730
                                     self.interface)
1932
 
                    elif error.errno == errno.ENODEV:
1933
 
                        logger.error("Interface %s does not"
1934
 
                                     " exist, cannot bind",
1935
 
                                     self.interface)
1936
1731
                    else:
1937
1732
                        raise
1938
1733
        # Only bind(2) the socket if we really need to.
1997
1792
    
1998
1793
    def handle_ipc(self, source, condition, parent_pipe=None,
1999
1794
                   proc = None, client_object=None):
 
1795
        condition_names = {
 
1796
            gobject.IO_IN: "IN",   # There is data to read.
 
1797
            gobject.IO_OUT: "OUT", # Data can be written (without
 
1798
                                    # blocking).
 
1799
            gobject.IO_PRI: "PRI", # There is urgent data to read.
 
1800
            gobject.IO_ERR: "ERR", # Error condition.
 
1801
            gobject.IO_HUP: "HUP"  # Hung up (the connection has been
 
1802
                                    # broken, usually for pipes and
 
1803
                                    # sockets).
 
1804
            }
 
1805
        conditions_string = ' | '.join(name
 
1806
                                       for cond, name in
 
1807
                                       condition_names.iteritems()
 
1808
                                       if cond & condition)
2000
1809
        # error, or the other end of multiprocessing.Pipe has closed
2001
 
        if condition & (gobject.IO_ERR | gobject.IO_HUP):
 
1810
        if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):
2002
1811
            # Wait for other process to exit
2003
1812
            proc.join()
2004
1813
            return False
2094
1903
            elif suffix == "w":
2095
1904
                delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
2096
1905
            else:
2097
 
                raise ValueError("Unknown suffix {0!r}"
2098
 
                                 .format(suffix))
 
1906
                raise ValueError("Unknown suffix %r" % suffix)
2099
1907
        except (ValueError, IndexError) as e:
2100
1908
            raise ValueError(*(e.args))
2101
1909
        timevalue += delta
2115
1923
        sys.exit()
2116
1924
    if not noclose:
2117
1925
        # Close all standard open file descriptors
2118
 
        null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
 
1926
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
2119
1927
        if not stat.S_ISCHR(os.fstat(null).st_mode):
2120
1928
            raise OSError(errno.ENODEV,
2121
 
                          "{0} not a character device"
2122
 
                          .format(os.devnull))
 
1929
                          "%s not a character device"
 
1930
                          % os.path.devnull)
2123
1931
        os.dup2(null, sys.stdin.fileno())
2124
1932
        os.dup2(null, sys.stdout.fileno())
2125
1933
        os.dup2(null, sys.stderr.fileno())
2134
1942
    
2135
1943
    parser = argparse.ArgumentParser()
2136
1944
    parser.add_argument("-v", "--version", action="version",
2137
 
                        version = "%(prog)s {0}".format(version),
 
1945
                        version = "%%(prog)s %s" % version,
2138
1946
                        help="show version number and exit")
2139
1947
    parser.add_argument("-i", "--interface", metavar="IF",
2140
1948
                        help="Bind to interface IF")
2233
2041
                                     stored_state_file)
2234
2042
    
2235
2043
    if debug:
2236
 
        initlogger(debug, logging.DEBUG)
 
2044
        initlogger(logging.DEBUG)
2237
2045
    else:
2238
2046
        if not debuglevel:
2239
 
            initlogger(debug)
 
2047
            initlogger()
2240
2048
        else:
2241
2049
            level = getattr(logging, debuglevel.upper())
2242
 
            initlogger(debug, level)
 
2050
            initlogger(level)
2243
2051
    
2244
2052
    if server_settings["servicename"] != "Mandos":
2245
2053
        syslogger.setFormatter(logging.Formatter
2246
 
                               ('Mandos ({0}) [%(process)d]:'
2247
 
                                ' %(levelname)s: %(message)s'
2248
 
                                .format(server_settings
2249
 
                                        ["servicename"])))
 
2054
                               ('Mandos (%s) [%%(process)d]:'
 
2055
                                ' %%(levelname)s: %%(message)s'
 
2056
                                % server_settings["servicename"]))
2250
2057
    
2251
2058
    # Parse config file with clients
2252
 
    client_config = configparser.SafeConfigParser(Client
2253
 
                                                  .client_defaults)
 
2059
    client_defaults = { "timeout": "5m",
 
2060
                        "extended_timeout": "15m",
 
2061
                        "interval": "2m",
 
2062
                        "checker": "fping -q -- %%(host)s",
 
2063
                        "host": "",
 
2064
                        "approval_delay": "0s",
 
2065
                        "approval_duration": "1s",
 
2066
                        }
 
2067
    client_config = configparser.SafeConfigParser(client_defaults)
2254
2068
    client_config.read(os.path.join(server_settings["configdir"],
2255
2069
                                    "clients.conf"))
2256
2070
    
2270
2084
        pidfilename = "/var/run/mandos.pid"
2271
2085
        try:
2272
2086
            pidfile = open(pidfilename, "w")
2273
 
        except IOError as e:
2274
 
            logger.error("Could not open file %r", pidfilename,
2275
 
                         exc_info=e)
 
2087
        except IOError:
 
2088
            logger.error("Could not open file %r", pidfilename)
2276
2089
    
2277
 
    for name in ("_mandos", "mandos", "nobody"):
 
2090
    try:
 
2091
        uid = pwd.getpwnam("_mandos").pw_uid
 
2092
        gid = pwd.getpwnam("_mandos").pw_gid
 
2093
    except KeyError:
2278
2094
        try:
2279
 
            uid = pwd.getpwnam(name).pw_uid
2280
 
            gid = pwd.getpwnam(name).pw_gid
2281
 
            break
 
2095
            uid = pwd.getpwnam("mandos").pw_uid
 
2096
            gid = pwd.getpwnam("mandos").pw_gid
2282
2097
        except KeyError:
2283
 
            continue
2284
 
    else:
2285
 
        uid = 65534
2286
 
        gid = 65534
 
2098
            try:
 
2099
                uid = pwd.getpwnam("nobody").pw_uid
 
2100
                gid = pwd.getpwnam("nobody").pw_gid
 
2101
            except KeyError:
 
2102
                uid = 65534
 
2103
                gid = 65534
2287
2104
    try:
2288
2105
        os.setgid(gid)
2289
2106
        os.setuid(uid)
2290
2107
    except OSError as error:
2291
 
        if error.errno != errno.EPERM:
 
2108
        if error[0] != errno.EPERM:
2292
2109
            raise error
2293
2110
    
2294
2111
    if debug:
2306
2123
         .gnutls_global_set_log_function(debug_gnutls))
2307
2124
        
2308
2125
        # Redirect stdin so all checkers get /dev/null
2309
 
        null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
 
2126
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
2310
2127
        os.dup2(null, sys.stdin.fileno())
2311
2128
        if null > 2:
2312
2129
            os.close(null)
 
2130
    else:
 
2131
        # No console logging
 
2132
        logger.removeHandler(console)
2313
2133
    
2314
2134
    # Need to fork before connecting to D-Bus
2315
2135
    if not debug:
2316
2136
        # Close all input and output, do double fork, etc.
2317
2137
        daemon()
2318
2138
    
2319
 
    gobject.threads_init()
2320
 
    
2321
2139
    global main_loop
2322
2140
    # From the Avahi example code
2323
 
    DBusGMainLoop(set_as_default=True)
 
2141
    DBusGMainLoop(set_as_default=True )
2324
2142
    main_loop = gobject.MainLoop()
2325
2143
    bus = dbus.SystemBus()
2326
2144
    # End of Avahi example code
2332
2150
                            ("se.bsnet.fukt.Mandos", bus,
2333
2151
                             do_not_queue=True))
2334
2152
        except dbus.exceptions.NameExistsException as e:
2335
 
            logger.error("Disabling D-Bus:", exc_info=e)
 
2153
            logger.error(unicode(e) + ", disabling D-Bus")
2336
2154
            use_dbus = False
2337
2155
            server_settings["use_dbus"] = False
2338
2156
            tcp_server.use_dbus = False
2350
2168
    
2351
2169
    client_class = Client
2352
2170
    if use_dbus:
2353
 
        client_class = functools.partial(ClientDBus, bus = bus)
2354
 
    
2355
 
    client_settings = Client.config_parser(client_config)
 
2171
        client_class = functools.partial(ClientDBusTransitional,
 
2172
                                         bus = bus)
 
2173
    
 
2174
    special_settings = {
 
2175
        # Some settings need to be accessd by special methods;
 
2176
        # booleans need .getboolean(), etc.  Here is a list of them:
 
2177
        "approved_by_default":
 
2178
            lambda section:
 
2179
            client_config.getboolean(section, "approved_by_default"),
 
2180
        }
 
2181
    # Construct a new dict of client settings of this form:
 
2182
    # { client_name: {setting_name: value, ...}, ...}
 
2183
    # with exceptions for any special settings as defined above
 
2184
    client_settings = dict((clientname,
 
2185
                           dict((setting,
 
2186
                                 (value
 
2187
                                  if setting not in special_settings
 
2188
                                  else special_settings[setting]
 
2189
                                  (clientname)))
 
2190
                                for setting, value in
 
2191
                                client_config.items(clientname)))
 
2192
                          for clientname in client_config.sections())
 
2193
    
2356
2194
    old_client_settings = {}
2357
 
    clients_data = {}
 
2195
    clients_data = []
2358
2196
    
2359
2197
    # Get client data and settings from last running state.
2360
2198
    if server_settings["restore"]:
2364
2202
                                                     (stored_state))
2365
2203
            os.remove(stored_state_path)
2366
2204
        except IOError as e:
2367
 
            if e.errno == errno.ENOENT:
2368
 
                logger.warning("Could not load persistent state: {0}"
2369
 
                                .format(os.strerror(e.errno)))
2370
 
            else:
2371
 
                logger.critical("Could not load persistent state:",
2372
 
                                exc_info=e)
 
2205
            logger.warning("Could not load persistent state: {0}"
 
2206
                           .format(e))
 
2207
            if e.errno != errno.ENOENT:
2373
2208
                raise
2374
 
        except EOFError as e:
2375
 
            logger.warning("Could not load persistent state: "
2376
 
                           "EOFError:", exc_info=e)
2377
2209
    
2378
 
    with PGPEngine() as pgp:
2379
 
        for client_name, client in clients_data.iteritems():
 
2210
    with Crypto() as crypt:
 
2211
        for client in clients_data:
 
2212
            client_name = client["name"]
 
2213
            
2380
2214
            # Decide which value to use after restoring saved state.
2381
2215
            # We have three different values: Old config file,
2382
2216
            # new config file, and saved state.
2390
2224
                    if (name != "secret" and
2391
2225
                        value != old_client_settings[client_name]
2392
2226
                        [name]):
2393
 
                        client[name] = value
 
2227
                        setattr(client, name, value)
2394
2228
                except KeyError:
2395
2229
                    pass
2396
2230
            
2397
2231
            # Clients who has passed its expire date can still be
2398
 
            # enabled if its last checker was successful.  Clients
2399
 
            # whose checker succeeded before we stored its state is
2400
 
            # assumed to have successfully run all checkers during
2401
 
            # downtime.
2402
 
            if client["enabled"]:
2403
 
                if datetime.datetime.utcnow() >= client["expires"]:
2404
 
                    if not client["last_checked_ok"]:
2405
 
                        logger.warning(
2406
 
                            "disabling client {0} - Client never "
2407
 
                            "performed a successful checker"
2408
 
                            .format(client_name))
2409
 
                        client["enabled"] = False
2410
 
                    elif client["last_checker_status"] != 0:
2411
 
                        logger.warning(
2412
 
                            "disabling client {0} - Client "
2413
 
                            "last checker failed with error code {1}"
2414
 
                            .format(client_name,
2415
 
                                    client["last_checker_status"]))
 
2232
            # enabled if its last checker was sucessful.  Clients
 
2233
            # whose checker failed before we stored its state is
 
2234
            # assumed to have failed all checkers during downtime.
 
2235
            if client["enabled"] and client["last_checked_ok"]:
 
2236
                if ((datetime.datetime.utcnow()
 
2237
                     - client["last_checked_ok"])
 
2238
                    > client["interval"]):
 
2239
                    if client["last_checker_status"] != 0:
2416
2240
                        client["enabled"] = False
2417
2241
                    else:
2418
2242
                        client["expires"] = (datetime.datetime
2419
2243
                                             .utcnow()
2420
2244
                                             + client["timeout"])
2421
 
                        logger.debug("Last checker succeeded,"
2422
 
                                     " keeping {0} enabled"
2423
 
                                     .format(client_name))
 
2245
            
 
2246
            client["changedstate"] = (multiprocessing_manager
 
2247
                                      .Condition
 
2248
                                      (multiprocessing_manager
 
2249
                                       .Lock()))
 
2250
            if use_dbus:
 
2251
                new_client = (ClientDBusTransitional.__new__
 
2252
                              (ClientDBusTransitional))
 
2253
                tcp_server.clients[client_name] = new_client
 
2254
                new_client.bus = bus
 
2255
                for name, value in client.iteritems():
 
2256
                    setattr(new_client, name, value)
 
2257
                client_object_name = unicode(client_name).translate(
 
2258
                    {ord("."): ord("_"),
 
2259
                     ord("-"): ord("_")})
 
2260
                new_client.dbus_object_path = (dbus.ObjectPath
 
2261
                                               ("/clients/"
 
2262
                                                + client_object_name))
 
2263
                DBusObjectWithProperties.__init__(new_client,
 
2264
                                                  new_client.bus,
 
2265
                                                  new_client
 
2266
                                                  .dbus_object_path)
 
2267
            else:
 
2268
                tcp_server.clients[client_name] = (Client.__new__
 
2269
                                                   (Client))
 
2270
                for name, value in client.iteritems():
 
2271
                    setattr(tcp_server.clients[client_name],
 
2272
                            name, value)
 
2273
            
2424
2274
            try:
2425
 
                client["secret"] = (
2426
 
                    pgp.decrypt(client["encrypted_secret"],
2427
 
                                client_settings[client_name]
2428
 
                                ["secret"]))
2429
 
            except PGPError:
 
2275
                tcp_server.clients[client_name].secret = (
 
2276
                    crypt.decrypt(tcp_server.clients[client_name]
 
2277
                                  .encrypted_secret,
 
2278
                                  client_settings[client_name]
 
2279
                                  ["secret"]))
 
2280
            except CryptoError:
2430
2281
                # If decryption fails, we use secret from new settings
2431
 
                logger.debug("Failed to decrypt {0} old secret"
2432
 
                             .format(client_name))
2433
 
                client["secret"] = (
 
2282
                tcp_server.clients[client_name].secret = (
2434
2283
                    client_settings[client_name]["secret"])
2435
2284
    
2436
 
    # Add/remove clients based on new changes made to config
2437
 
    for client_name in (set(old_client_settings)
2438
 
                        - set(client_settings)):
2439
 
        del clients_data[client_name]
2440
 
    for client_name in (set(client_settings)
2441
 
                        - set(old_client_settings)):
2442
 
        clients_data[client_name] = client_settings[client_name]
2443
 
    
2444
 
    # Create all client objects
2445
 
    for client_name, client in clients_data.iteritems():
2446
 
        tcp_server.clients[client_name] = client_class(
2447
 
            name = client_name, settings = client)
 
2285
    # Create/remove clients based on new changes made to config
 
2286
    for clientname in set(old_client_settings) - set(client_settings):
 
2287
        del tcp_server.clients[clientname]
 
2288
    for clientname in set(client_settings) - set(old_client_settings):
 
2289
        tcp_server.clients[clientname] = (client_class(name
 
2290
                                                       = clientname,
 
2291
                                                       config =
 
2292
                                                       client_settings
 
2293
                                                       [clientname]))
2448
2294
    
2449
2295
    if not tcp_server.clients:
2450
2296
        logger.warning("No clients defined")
2451
 
    
 
2297
        
2452
2298
    if not debug:
2453
2299
        try:
2454
2300
            with pidfile:
2462
2308
            # "pidfile" was never created
2463
2309
            pass
2464
2310
        del pidfilename
 
2311
        
 
2312
        signal.signal(signal.SIGINT, signal.SIG_IGN)
2465
2313
    
2466
2314
    signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2467
2315
    signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
2468
2316
    
2469
2317
    if use_dbus:
2470
 
        @alternate_dbus_interfaces({"se.recompile.Mandos":
2471
 
                                        "se.bsnet.fukt.Mandos"})
2472
 
        class MandosDBusService(DBusObjectWithProperties):
 
2318
        class MandosDBusService(dbus.service.Object):
2473
2319
            """A D-Bus proxy object"""
2474
2320
            def __init__(self):
2475
2321
                dbus.service.Object.__init__(self, bus, "/")
2476
2322
            _interface = "se.recompile.Mandos"
2477
2323
            
2478
 
            @dbus_interface_annotations(_interface)
2479
 
            def _foo(self):
2480
 
                return { "org.freedesktop.DBus.Property"
2481
 
                         ".EmitsChangedSignal":
2482
 
                             "false"}
2483
 
            
2484
2324
            @dbus.service.signal(_interface, signature="o")
2485
2325
            def ClientAdded(self, objpath):
2486
2326
                "D-Bus signal"
2528
2368
            
2529
2369
            del _interface
2530
2370
        
2531
 
        mandos_dbus_service = MandosDBusService()
 
2371
        class MandosDBusServiceTransitional(MandosDBusService):
 
2372
            __metaclass__ = AlternateDBusNamesMetaclass
 
2373
        mandos_dbus_service = MandosDBusServiceTransitional()
2532
2374
    
2533
2375
    def cleanup():
2534
2376
        "Cleanup function; run on exit"
2541
2383
        # Store client before exiting. Secrets are encrypted with key
2542
2384
        # based on what config file has. If config file is
2543
2385
        # removed/edited, old secret will thus be unrecovable.
2544
 
        clients = {}
2545
 
        with PGPEngine() as pgp:
 
2386
        clients = []
 
2387
        with Crypto() as crypt:
2546
2388
            for client in tcp_server.clients.itervalues():
2547
2389
                key = client_settings[client.name]["secret"]
2548
 
                client.encrypted_secret = pgp.encrypt(client.secret,
2549
 
                                                      key)
 
2390
                client.encrypted_secret = crypt.encrypt(client.secret,
 
2391
                                                        key)
2550
2392
                client_dict = {}
2551
2393
                
2552
 
                # A list of attributes that can not be pickled
2553
 
                # + secret.
2554
 
                exclude = set(("bus", "changedstate", "secret",
2555
 
                               "checker"))
 
2394
                # A list of attributes that will not be stored when
 
2395
                # shutting down.
 
2396
                exclude = set(("bus", "changedstate", "secret"))
2556
2397
                for name, typ in (inspect.getmembers
2557
2398
                                  (dbus.service.Object)):
2558
2399
                    exclude.add(name)
2563
2404
                    if attr not in exclude:
2564
2405
                        client_dict[attr] = getattr(client, attr)
2565
2406
                
2566
 
                clients[client.name] = client_dict
 
2407
                clients.append(client_dict)
2567
2408
                del client_settings[client.name]["secret"]
2568
2409
        
2569
2410
        try:
2570
 
            with (tempfile.NamedTemporaryFile
2571
 
                  (mode='wb', suffix=".pickle", prefix='clients-',
2572
 
                   dir=os.path.dirname(stored_state_path),
2573
 
                   delete=False)) as stored_state:
 
2411
            with os.fdopen(os.open(stored_state_path,
 
2412
                                   os.O_CREAT|os.O_WRONLY|os.O_TRUNC,
 
2413
                                   0600), "wb") as stored_state:
2574
2414
                pickle.dump((clients, client_settings), stored_state)
2575
 
                tempname=stored_state.name
2576
 
            os.rename(tempname, stored_state_path)
2577
2415
        except (IOError, OSError) as e:
2578
 
            if not debug:
2579
 
                try:
2580
 
                    os.remove(tempname)
2581
 
                except NameError:
2582
 
                    pass
2583
 
            if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
2584
 
                logger.warning("Could not save persistent state: {0}"
2585
 
                               .format(os.strerror(e.errno)))
2586
 
            else:
2587
 
                logger.warning("Could not save persistent state:",
2588
 
                               exc_info=e)
2589
 
                raise e
 
2416
            logger.warning("Could not save persistent state: {0}"
 
2417
                           .format(e))
 
2418
            if e.errno not in (errno.ENOENT, errno.EACCES):
 
2419
                raise
2590
2420
        
2591
2421
        # Delete all clients, and settings from config
2592
2422
        while tcp_server.clients:
2619
2449
    service.port = tcp_server.socket.getsockname()[1]
2620
2450
    if use_ipv6:
2621
2451
        logger.info("Now listening on address %r, port %d,"
2622
 
                    " flowinfo %d, scope_id %d",
2623
 
                    *tcp_server.socket.getsockname())
 
2452
                    " flowinfo %d, scope_id %d"
 
2453
                    % tcp_server.socket.getsockname())
2624
2454
    else:                       # IPv4
2625
 
        logger.info("Now listening on address %r, port %d",
2626
 
                    *tcp_server.socket.getsockname())
 
2455
        logger.info("Now listening on address %r, port %d"
 
2456
                    % tcp_server.socket.getsockname())
2627
2457
    
2628
2458
    #service.interface = tcp_server.socket.getsockname()[3]
2629
2459
    
2632
2462
        try:
2633
2463
            service.activate()
2634
2464
        except dbus.exceptions.DBusException as error:
2635
 
            logger.critical("D-Bus Exception", exc_info=error)
 
2465
            logger.critical("DBusException: %s", error)
2636
2466
            cleanup()
2637
2467
            sys.exit(1)
2638
2468
        # End of Avahi example code
2645
2475
        logger.debug("Starting main loop")
2646
2476
        main_loop.run()
2647
2477
    except AvahiError as error:
2648
 
        logger.critical("Avahi Error", exc_info=error)
 
2478
        logger.critical("AvahiError: %s", error)
2649
2479
        cleanup()
2650
2480
        sys.exit(1)
2651
2481
    except KeyboardInterrupt:
2656
2486
    # Must run before the D-Bus bus name gets deregistered
2657
2487
    cleanup()
2658
2488
 
 
2489
 
2659
2490
if __name__ == '__main__':
2660
2491
    main()