/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos

  • Committer: Teddy Hogeborn
  • Date: 2011-11-26 23:08:17 UTC
  • mto: (518.1.8 mandos-persistent)
  • mto: This revision was merged to the branch mainline in revision 524.
  • Revision ID: teddy@recompile.se-20111126230817-tv08v831s2yltbkd
Make "enabled" a client config option.

* DBUS-API: Fix wording on "Expires" option.
* clients.conf (enabled): New.
* mandos (Client): "last_enabled" can now be None.
  (Client.__init__): Get "enabled" from config.  Only set
                     "last_enabled" and "expires" if enabled.
  (ClientDBus.Created_dbus_property): Removed redundant dbus.String().
  (ClientDBus.Interval_dbus_property): If changed, only reschedule
                                       checker if enabled.
  (main/special_settings): Added "enabled".
* mandos-clients.conf (OPTIONS): Added "enabled".

Show diffs side-by-side

added added

removed removed

Lines of Context:
11
11
# "AvahiService" class, and some lines in "main".
12
12
13
13
# Everything else is
14
 
# Copyright © 2008,2009 Teddy Hogeborn
15
 
# Copyright © 2008,2009 Björn Påhlsson
 
14
# Copyright © 2008-2011 Teddy Hogeborn
 
15
# Copyright © 2008-2011 Björn Påhlsson
16
16
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
28
28
# along with this program.  If not, see
29
29
# <http://www.gnu.org/licenses/>.
30
30
31
 
# Contact the authors at <mandos@fukt.bsnet.se>.
 
31
# Contact the authors at <mandos@recompile.se>.
32
32
33
33
 
34
 
from __future__ import division, with_statement, absolute_import
 
34
from __future__ import (division, absolute_import, print_function,
 
35
                        unicode_literals)
35
36
 
36
37
import SocketServer as socketserver
37
38
import socket
38
 
import optparse
 
39
import argparse
39
40
import datetime
40
41
import errno
41
42
import gnutls.crypto
61
62
import functools
62
63
import cPickle as pickle
63
64
import multiprocessing
 
65
import types
 
66
import binascii
 
67
import tempfile
64
68
 
65
69
import dbus
66
70
import dbus.service
71
75
import ctypes.util
72
76
import xml.dom.minidom
73
77
import inspect
 
78
import GnuPGInterface
74
79
 
75
80
try:
76
81
    SO_BINDTODEVICE = socket.SO_BINDTODEVICE
81
86
        SO_BINDTODEVICE = None
82
87
 
83
88
 
84
 
version = "1.0.14"
 
89
version = "1.4.1"
 
90
stored_state_file = "clients.pickle"
85
91
 
86
 
logger = logging.Logger(u'mandos')
 
92
logger = logging.getLogger()
87
93
syslogger = (logging.handlers.SysLogHandler
88
94
             (facility = logging.handlers.SysLogHandler.LOG_DAEMON,
89
 
              address = "/dev/log"))
90
 
syslogger.setFormatter(logging.Formatter
91
 
                       (u'Mandos [%(process)d]: %(levelname)s:'
92
 
                        u' %(message)s'))
93
 
logger.addHandler(syslogger)
94
 
 
95
 
console = logging.StreamHandler()
96
 
console.setFormatter(logging.Formatter(u'%(name)s [%(process)d]:'
97
 
                                       u' %(levelname)s:'
98
 
                                       u' %(message)s'))
99
 
logger.addHandler(console)
 
95
              address = str("/dev/log")))
 
96
 
 
97
try:
 
98
    if_nametoindex = (ctypes.cdll.LoadLibrary
 
99
                      (ctypes.util.find_library("c"))
 
100
                      .if_nametoindex)
 
101
except (OSError, AttributeError):
 
102
    def if_nametoindex(interface):
 
103
        "Get an interface index the hard way, i.e. using fcntl()"
 
104
        SIOCGIFINDEX = 0x8933  # From /usr/include/linux/sockios.h
 
105
        with contextlib.closing(socket.socket()) as s:
 
106
            ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
 
107
                                struct.pack(str("16s16x"),
 
108
                                            interface))
 
109
        interface_index = struct.unpack(str("I"),
 
110
                                        ifreq[16:20])[0]
 
111
        return interface_index
 
112
 
 
113
 
 
114
def initlogger(level=logging.WARNING):
 
115
    """init logger and add loglevel"""
 
116
    
 
117
    syslogger.setFormatter(logging.Formatter
 
118
                           ('Mandos [%(process)d]: %(levelname)s:'
 
119
                            ' %(message)s'))
 
120
    logger.addHandler(syslogger)
 
121
    
 
122
    console = logging.StreamHandler()
 
123
    console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
 
124
                                           ' [%(process)d]:'
 
125
                                           ' %(levelname)s:'
 
126
                                           ' %(message)s'))
 
127
    logger.addHandler(console)
 
128
    logger.setLevel(level)
 
129
 
 
130
 
 
131
class CryptoError(Exception):
 
132
    pass
 
133
 
 
134
 
 
135
class Crypto(object):
 
136
    """A simple class for OpenPGP symmetric encryption & decryption"""
 
137
    def __init__(self):
 
138
        self.gnupg = GnuPGInterface.GnuPG()
 
139
        self.tempdir = tempfile.mkdtemp(prefix="mandos-")
 
140
        self.gnupg = GnuPGInterface.GnuPG()
 
141
        self.gnupg.options.meta_interactive = False
 
142
        self.gnupg.options.homedir = self.tempdir
 
143
        self.gnupg.options.extra_args.extend(['--force-mdc',
 
144
                                              '--quiet'])
 
145
    
 
146
    def __enter__(self):
 
147
        return self
 
148
    
 
149
    def __exit__ (self, exc_type, exc_value, traceback):
 
150
        self._cleanup()
 
151
        return False
 
152
    
 
153
    def __del__(self):
 
154
        self._cleanup()
 
155
    
 
156
    def _cleanup(self):
 
157
        if self.tempdir is not None:
 
158
            # Delete contents of tempdir
 
159
            for root, dirs, files in os.walk(self.tempdir,
 
160
                                             topdown = False):
 
161
                for filename in files:
 
162
                    os.remove(os.path.join(root, filename))
 
163
                for dirname in dirs:
 
164
                    os.rmdir(os.path.join(root, dirname))
 
165
            # Remove tempdir
 
166
            os.rmdir(self.tempdir)
 
167
            self.tempdir = None
 
168
    
 
169
    def password_encode(self, password):
 
170
        # Passphrase can not be empty and can not contain newlines or
 
171
        # NUL bytes.  So we prefix it and hex encode it.
 
172
        return b"mandos" + binascii.hexlify(password)
 
173
    
 
174
    def encrypt(self, data, password):
 
175
        self.gnupg.passphrase = self.password_encode(password)
 
176
        with open(os.devnull) as devnull:
 
177
            try:
 
178
                proc = self.gnupg.run(['--symmetric'],
 
179
                                      create_fhs=['stdin', 'stdout'],
 
180
                                      attach_fhs={'stderr': devnull})
 
181
                with contextlib.closing(proc.handles['stdin']) as f:
 
182
                    f.write(data)
 
183
                with contextlib.closing(proc.handles['stdout']) as f:
 
184
                    ciphertext = f.read()
 
185
                proc.wait()
 
186
            except IOError as e:
 
187
                raise CryptoError(e)
 
188
        self.gnupg.passphrase = None
 
189
        return ciphertext
 
190
    
 
191
    def decrypt(self, data, password):
 
192
        self.gnupg.passphrase = self.password_encode(password)
 
193
        with open(os.devnull) as devnull:
 
194
            try:
 
195
                proc = self.gnupg.run(['--decrypt'],
 
196
                                      create_fhs=['stdin', 'stdout'],
 
197
                                      attach_fhs={'stderr': devnull})
 
198
                with contextlib.closing(proc.handles['stdin'] ) as f:
 
199
                    f.write(data)
 
200
                with contextlib.closing(proc.handles['stdout']) as f:
 
201
                    decrypted_plaintext = f.read()
 
202
                proc.wait()
 
203
            except IOError as e:
 
204
                raise CryptoError(e)
 
205
        self.gnupg.passphrase = None
 
206
        return decrypted_plaintext
 
207
 
 
208
 
100
209
 
101
210
class AvahiError(Exception):
102
211
    def __init__(self, value, *args, **kwargs):
118
227
    Attributes:
119
228
    interface: integer; avahi.IF_UNSPEC or an interface index.
120
229
               Used to optionally bind to the specified interface.
121
 
    name: string; Example: u'Mandos'
122
 
    type: string; Example: u'_mandos._tcp'.
 
230
    name: string; Example: 'Mandos'
 
231
    type: string; Example: '_mandos._tcp'.
123
232
                  See <http://www.dns-sd.org/ServiceTypes.html>
124
233
    port: integer; what port to announce
125
234
    TXT: list of strings; TXT record for the service
134
243
    """
135
244
    def __init__(self, interface = avahi.IF_UNSPEC, name = None,
136
245
                 servicetype = None, port = None, TXT = None,
137
 
                 domain = u"", host = u"", max_renames = 32768,
 
246
                 domain = "", host = "", max_renames = 32768,
138
247
                 protocol = avahi.PROTO_UNSPEC, bus = None):
139
248
        self.interface = interface
140
249
        self.name = name
149
258
        self.group = None       # our entry group
150
259
        self.server = None
151
260
        self.bus = bus
 
261
        self.entry_group_state_changed_match = None
152
262
    def rename(self):
153
263
        """Derived from the Avahi example code"""
154
264
        if self.rename_count >= self.max_renames:
155
 
            logger.critical(u"No suitable Zeroconf service name found"
156
 
                            u" after %i retries, exiting.",
 
265
            logger.critical("No suitable Zeroconf service name found"
 
266
                            " after %i retries, exiting.",
157
267
                            self.rename_count)
158
 
            raise AvahiServiceError(u"Too many renames")
159
 
        self.name = self.server.GetAlternativeServiceName(self.name)
160
 
        logger.info(u"Changing Zeroconf service name to %r ...",
161
 
                    unicode(self.name))
162
 
        syslogger.setFormatter(logging.Formatter
163
 
                               (u'Mandos (%s) [%%(process)d]:'
164
 
                                u' %%(levelname)s: %%(message)s'
165
 
                                % self.name))
 
268
            raise AvahiServiceError("Too many renames")
 
269
        self.name = unicode(self.server
 
270
                            .GetAlternativeServiceName(self.name))
 
271
        logger.info("Changing Zeroconf service name to %r ...",
 
272
                    self.name)
166
273
        self.remove()
167
 
        self.add()
 
274
        try:
 
275
            self.add()
 
276
        except dbus.exceptions.DBusException as error:
 
277
            logger.critical("DBusException: %s", error)
 
278
            self.cleanup()
 
279
            os._exit(1)
168
280
        self.rename_count += 1
169
281
    def remove(self):
170
282
        """Derived from the Avahi example code"""
 
283
        if self.entry_group_state_changed_match is not None:
 
284
            self.entry_group_state_changed_match.remove()
 
285
            self.entry_group_state_changed_match = None
171
286
        if self.group is not None:
172
287
            self.group.Reset()
173
288
    def add(self):
174
289
        """Derived from the Avahi example code"""
 
290
        self.remove()
175
291
        if self.group is None:
176
292
            self.group = dbus.Interface(
177
293
                self.bus.get_object(avahi.DBUS_NAME,
178
294
                                    self.server.EntryGroupNew()),
179
295
                avahi.DBUS_INTERFACE_ENTRY_GROUP)
180
 
            self.group.connect_to_signal('StateChanged',
181
 
                                         self
182
 
                                         .entry_group_state_changed)
183
 
        logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
 
296
        self.entry_group_state_changed_match = (
 
297
            self.group.connect_to_signal(
 
298
                'StateChanged', self.entry_group_state_changed))
 
299
        logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
184
300
                     self.name, self.type)
185
301
        self.group.AddService(
186
302
            self.interface,
193
309
        self.group.Commit()
194
310
    def entry_group_state_changed(self, state, error):
195
311
        """Derived from the Avahi example code"""
196
 
        logger.debug(u"Avahi state change: %i", state)
 
312
        logger.debug("Avahi entry group state change: %i", state)
197
313
        
198
314
        if state == avahi.ENTRY_GROUP_ESTABLISHED:
199
 
            logger.debug(u"Zeroconf service established.")
 
315
            logger.debug("Zeroconf service established.")
200
316
        elif state == avahi.ENTRY_GROUP_COLLISION:
201
 
            logger.warning(u"Zeroconf service name collision.")
 
317
            logger.info("Zeroconf service name collision.")
202
318
            self.rename()
203
319
        elif state == avahi.ENTRY_GROUP_FAILURE:
204
 
            logger.critical(u"Avahi: Error in group state changed %s",
 
320
            logger.critical("Avahi: Error in group state changed %s",
205
321
                            unicode(error))
206
 
            raise AvahiGroupError(u"State changed: %s"
 
322
            raise AvahiGroupError("State changed: %s"
207
323
                                  % unicode(error))
208
324
    def cleanup(self):
209
325
        """Derived from the Avahi example code"""
210
326
        if self.group is not None:
211
 
            self.group.Free()
 
327
            try:
 
328
                self.group.Free()
 
329
            except (dbus.exceptions.UnknownMethodException,
 
330
                    dbus.exceptions.DBusException):
 
331
                pass
212
332
            self.group = None
213
 
    def server_state_changed(self, state):
 
333
        self.remove()
 
334
    def server_state_changed(self, state, error=None):
214
335
        """Derived from the Avahi example code"""
215
 
        if state == avahi.SERVER_COLLISION:
216
 
            logger.error(u"Zeroconf server name collision")
217
 
            self.remove()
 
336
        logger.debug("Avahi server state change: %i", state)
 
337
        bad_states = { avahi.SERVER_INVALID:
 
338
                           "Zeroconf server invalid",
 
339
                       avahi.SERVER_REGISTERING: None,
 
340
                       avahi.SERVER_COLLISION:
 
341
                           "Zeroconf server name collision",
 
342
                       avahi.SERVER_FAILURE:
 
343
                           "Zeroconf server failure" }
 
344
        if state in bad_states:
 
345
            if bad_states[state] is not None:
 
346
                if error is None:
 
347
                    logger.error(bad_states[state])
 
348
                else:
 
349
                    logger.error(bad_states[state] + ": %r", error)
 
350
            self.cleanup()
218
351
        elif state == avahi.SERVER_RUNNING:
219
352
            self.add()
 
353
        else:
 
354
            if error is None:
 
355
                logger.debug("Unknown state: %r", state)
 
356
            else:
 
357
                logger.debug("Unknown state: %r: %r", state, error)
220
358
    def activate(self):
221
359
        """Derived from the Avahi example code"""
222
360
        if self.server is None:
223
361
            self.server = dbus.Interface(
224
362
                self.bus.get_object(avahi.DBUS_NAME,
225
 
                                    avahi.DBUS_PATH_SERVER),
 
363
                                    avahi.DBUS_PATH_SERVER,
 
364
                                    follow_name_owner_changes=True),
226
365
                avahi.DBUS_INTERFACE_SERVER)
227
 
        self.server.connect_to_signal(u"StateChanged",
 
366
        self.server.connect_to_signal("StateChanged",
228
367
                                 self.server_state_changed)
229
368
        self.server_state_changed(self.server.GetState())
230
369
 
 
370
class AvahiServiceToSyslog(AvahiService):
 
371
    def rename(self):
 
372
        """Add the new name to the syslog messages"""
 
373
        ret = AvahiService.rename(self)
 
374
        syslogger.setFormatter(logging.Formatter
 
375
                               ('Mandos (%s) [%%(process)d]:'
 
376
                                ' %%(levelname)s: %%(message)s'
 
377
                                % self.name))
 
378
        return ret
231
379
 
 
380
def _timedelta_to_milliseconds(td):
 
381
    "Convert a datetime.timedelta() to milliseconds"
 
382
    return ((td.days * 24 * 60 * 60 * 1000)
 
383
            + (td.seconds * 1000)
 
384
            + (td.microseconds // 1000))
 
385
        
232
386
class Client(object):
233
387
    """A representation of a client host served by this server.
234
388
    
235
389
    Attributes:
236
 
    name:       string; from the config file, used in log messages and
237
 
                        D-Bus identifiers
 
390
    _approved:   bool(); 'None' if not yet approved/disapproved
 
391
    approval_delay: datetime.timedelta(); Time to wait for approval
 
392
    approval_duration: datetime.timedelta(); Duration of one approval
 
393
    checker:    subprocess.Popen(); a running checker process used
 
394
                                    to see if the client lives.
 
395
                                    'None' if no process is running.
 
396
    checker_callback_tag: a gobject event source tag, or None
 
397
    checker_command: string; External command which is run to check
 
398
                     if client lives.  %() expansions are done at
 
399
                     runtime with vars(self) as dict, so that for
 
400
                     instance %(name)s can be used in the command.
 
401
    checker_initiator_tag: a gobject event source tag, or None
 
402
    created:    datetime.datetime(); (UTC) object creation
 
403
    client_structure: Object describing what attributes a client has
 
404
                      and is used for storing the client at exit
 
405
    current_checker_command: string; current running checker_command
 
406
    disable_initiator_tag: a gobject event source tag, or None
 
407
    enabled:    bool()
238
408
    fingerprint: string (40 or 32 hexadecimal digits); used to
239
409
                 uniquely identify the client
240
 
    secret:     bytestring; sent verbatim (over TLS) to client
241
410
    host:       string; available for use by the checker command
242
 
    created:    datetime.datetime(); (UTC) object creation
243
 
    last_enabled: datetime.datetime(); (UTC)
244
 
    enabled:    bool()
 
411
    interval:   datetime.timedelta(); How often to start a new checker
 
412
    last_approval_request: datetime.datetime(); (UTC) or None
245
413
    last_checked_ok: datetime.datetime(); (UTC) or None
 
414
 
 
415
    last_checker_status: integer between 0 and 255 reflecting exit
 
416
                         status of last checker. -1 reflects crashed
 
417
                         checker, or None.
 
418
    last_enabled: datetime.datetime(); (UTC) or None
 
419
    name:       string; from the config file, used in log messages and
 
420
                        D-Bus identifiers
 
421
    secret:     bytestring; sent verbatim (over TLS) to client
246
422
    timeout:    datetime.timedelta(); How long from last_checked_ok
247
423
                                      until this client is disabled
248
 
    interval:   datetime.timedelta(); How often to start a new checker
249
 
    disable_hook:  If set, called by disable() as disable_hook(self)
250
 
    checker:    subprocess.Popen(); a running checker process used
251
 
                                    to see if the client lives.
252
 
                                    'None' if no process is running.
253
 
    checker_initiator_tag: a gobject event source tag, or None
254
 
    disable_initiator_tag: - '' -
255
 
    checker_callback_tag:  - '' -
256
 
    checker_command: string; External command which is run to check if
257
 
                     client lives.  %() expansions are done at
258
 
                     runtime with vars(self) as dict, so that for
259
 
                     instance %(name)s can be used in the command.
260
 
    current_checker_command: string; current running checker_command
261
 
    approved_delay: datetime.timedelta(); Time to wait for approval
262
 
    _approved:   bool(); 'None' if not yet approved/disapproved
263
 
    approved_duration: datetime.timedelta(); Duration of one approval
 
424
    extended_timeout:   extra long timeout when password has been sent
 
425
    runtime_expansions: Allowed attributes for runtime expansion.
 
426
    expires:    datetime.datetime(); time (UTC) when a client will be
 
427
                disabled, or None
264
428
    """
265
429
    
266
 
    @staticmethod
267
 
    def _timedelta_to_milliseconds(td):
268
 
        "Convert a datetime.timedelta() to milliseconds"
269
 
        return ((td.days * 24 * 60 * 60 * 1000)
270
 
                + (td.seconds * 1000)
271
 
                + (td.microseconds // 1000))
 
430
    runtime_expansions = ("approval_delay", "approval_duration",
 
431
                          "created", "enabled", "fingerprint",
 
432
                          "host", "interval", "last_checked_ok",
 
433
                          "last_enabled", "name", "timeout")
272
434
    
273
435
    def timeout_milliseconds(self):
274
436
        "Return the 'timeout' attribute in milliseconds"
275
 
        return self._timedelta_to_milliseconds(self.timeout)
 
437
        return _timedelta_to_milliseconds(self.timeout)
 
438
    
 
439
    def extended_timeout_milliseconds(self):
 
440
        "Return the 'extended_timeout' attribute in milliseconds"
 
441
        return _timedelta_to_milliseconds(self.extended_timeout)
276
442
    
277
443
    def interval_milliseconds(self):
278
444
        "Return the 'interval' attribute in milliseconds"
279
 
        return self._timedelta_to_milliseconds(self.interval)
280
 
 
281
 
    def approved_delay_milliseconds(self):
282
 
        return self._timedelta_to_milliseconds(self.approved_delay)
283
 
    
284
 
    def __init__(self, name = None, disable_hook=None, config=None):
 
445
        return _timedelta_to_milliseconds(self.interval)
 
446
    
 
447
    def approval_delay_milliseconds(self):
 
448
        return _timedelta_to_milliseconds(self.approval_delay)
 
449
    
 
450
    def __init__(self, name = None, config=None):
285
451
        """Note: the 'checker' key in 'config' sets the
286
452
        'checker_command' attribute and *not* the 'checker'
287
453
        attribute."""
288
454
        self.name = name
289
455
        if config is None:
290
456
            config = {}
291
 
        logger.debug(u"Creating client %r", self.name)
 
457
        logger.debug("Creating client %r", self.name)
292
458
        # Uppercase and remove spaces from fingerprint for later
293
459
        # comparison purposes with return value from the fingerprint()
294
460
        # function
295
 
        self.fingerprint = (config[u"fingerprint"].upper()
296
 
                            .replace(u" ", u""))
297
 
        logger.debug(u"  Fingerprint: %s", self.fingerprint)
298
 
        if u"secret" in config:
299
 
            self.secret = config[u"secret"].decode(u"base64")
300
 
        elif u"secfile" in config:
 
461
        self.fingerprint = (config["fingerprint"].upper()
 
462
                            .replace(" ", ""))
 
463
        logger.debug("  Fingerprint: %s", self.fingerprint)
 
464
        if "secret" in config:
 
465
            self.secret = config["secret"].decode("base64")
 
466
        elif "secfile" in config:
301
467
            with open(os.path.expanduser(os.path.expandvars
302
 
                                         (config[u"secfile"])),
 
468
                                         (config["secfile"])),
303
469
                      "rb") as secfile:
304
470
                self.secret = secfile.read()
305
471
        else:
306
 
            #XXX Need to allow secret on demand!
307
 
            raise TypeError(u"No secret or secfile for client %s"
 
472
            raise TypeError("No secret or secfile for client %s"
308
473
                            % self.name)
309
 
        self.host = config.get(u"host", u"")
 
474
        self.host = config.get("host", "")
310
475
        self.created = datetime.datetime.utcnow()
311
 
        self.enabled = False
312
 
        self.last_enabled = None
 
476
        self.enabled = config.get("enabled", True)
 
477
        self.last_approval_request = None
 
478
        if self.enabled:
 
479
            self.last_enabled = datetime.datetime.utcnow()
 
480
        else:
 
481
            self.last_enabled = None
313
482
        self.last_checked_ok = None
314
 
        self.timeout = string_to_delta(config[u"timeout"])
315
 
        self.interval = string_to_delta(config[u"interval"])
316
 
        self.disable_hook = disable_hook
 
483
        self.last_checker_status = None
 
484
        self.timeout = string_to_delta(config["timeout"])
 
485
        self.extended_timeout = string_to_delta(config
 
486
                                                ["extended_timeout"])
 
487
        self.interval = string_to_delta(config["interval"])
317
488
        self.checker = None
318
489
        self.checker_initiator_tag = None
319
490
        self.disable_initiator_tag = None
 
491
        if self.enabled:
 
492
            self.expires = datetime.datetime.utcnow() + self.timeout
 
493
        else:
 
494
            self.expires = None
320
495
        self.checker_callback_tag = None
321
 
        self.checker_command = config[u"checker"]
 
496
        self.checker_command = config["checker"]
322
497
        self.current_checker_command = None
323
 
        self.last_connect = None
 
498
        self._approved = None
 
499
        self.approved_by_default = config.get("approved_by_default",
 
500
                                              True)
324
501
        self.approvals_pending = 0
325
 
        self._approved = None
326
 
        self.approved_by_default = config.get(u"approved_by_default",
327
 
                                              False)
328
 
        self.approved_delay = string_to_delta(
329
 
            config[u"approved_delay"])
330
 
        self.approved_duration = string_to_delta(
331
 
            config[u"approved_duration"])
332
 
        self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())
333
 
 
 
502
        self.approval_delay = string_to_delta(
 
503
            config["approval_delay"])
 
504
        self.approval_duration = string_to_delta(
 
505
            config["approval_duration"])
 
506
        self.changedstate = (multiprocessing_manager
 
507
                             .Condition(multiprocessing_manager
 
508
                                        .Lock()))
 
509
        self.client_structure = [attr for attr in
 
510
                                 self.__dict__.iterkeys()
 
511
                                 if not attr.startswith("_")]
 
512
        self.client_structure.append("client_structure")
 
513
        
 
514
        for name, t in inspect.getmembers(type(self),
 
515
                                          lambda obj:
 
516
                                              isinstance(obj,
 
517
                                                         property)):
 
518
            if not name.startswith("_"):
 
519
                self.client_structure.append(name)
 
520
    
 
521
    # Send notice to process children that client state has changed
334
522
    def send_changedstate(self):
335
 
        self.changedstate.acquire()
336
 
        self.changedstate.notify_all()
337
 
        self.changedstate.release()
338
 
        
 
523
        with self.changedstate:
 
524
            self.changedstate.notify_all()
 
525
    
339
526
    def enable(self):
340
527
        """Start this client's checker and timeout hooks"""
341
 
        if getattr(self, u"enabled", False):
 
528
        if getattr(self, "enabled", False):
342
529
            # Already enabled
343
530
            return
344
531
        self.send_changedstate()
 
532
        self.expires = datetime.datetime.utcnow() + self.timeout
 
533
        self.enabled = True
345
534
        self.last_enabled = datetime.datetime.utcnow()
 
535
        self.init_checker()
 
536
    
 
537
    def disable(self, quiet=True):
 
538
        """Disable this client."""
 
539
        if not getattr(self, "enabled", False):
 
540
            return False
 
541
        if not quiet:
 
542
            self.send_changedstate()
 
543
        if not quiet:
 
544
            logger.info("Disabling client %s", self.name)
 
545
        if getattr(self, "disable_initiator_tag", False):
 
546
            gobject.source_remove(self.disable_initiator_tag)
 
547
            self.disable_initiator_tag = None
 
548
        self.expires = None
 
549
        if getattr(self, "checker_initiator_tag", False):
 
550
            gobject.source_remove(self.checker_initiator_tag)
 
551
            self.checker_initiator_tag = None
 
552
        self.stop_checker()
 
553
        self.enabled = False
 
554
        # Do not run this again if called by a gobject.timeout_add
 
555
        return False
 
556
    
 
557
    def __del__(self):
 
558
        self.disable()
 
559
    
 
560
    def init_checker(self):
346
561
        # Schedule a new checker to be started an 'interval' from now,
347
562
        # and every interval from then on.
348
563
        self.checker_initiator_tag = (gobject.timeout_add
352
567
        self.disable_initiator_tag = (gobject.timeout_add
353
568
                                   (self.timeout_milliseconds(),
354
569
                                    self.disable))
355
 
        self.enabled = True
356
570
        # Also start a new checker *right now*.
357
571
        self.start_checker()
358
572
    
359
 
    def disable(self, quiet=True):
360
 
        """Disable this client."""
361
 
        if not getattr(self, "enabled", False):
362
 
            return False
363
 
        if not quiet:
364
 
            self.send_changedstate()
365
 
        if not quiet:
366
 
            logger.info(u"Disabling client %s", self.name)
367
 
        if getattr(self, u"disable_initiator_tag", False):
368
 
            gobject.source_remove(self.disable_initiator_tag)
369
 
            self.disable_initiator_tag = None
370
 
        if getattr(self, u"checker_initiator_tag", False):
371
 
            gobject.source_remove(self.checker_initiator_tag)
372
 
            self.checker_initiator_tag = None
373
 
        self.stop_checker()
374
 
        if self.disable_hook:
375
 
            self.disable_hook(self)
376
 
        self.enabled = False
377
 
        # Do not run this again if called by a gobject.timeout_add
378
 
        return False
379
 
    
380
 
    def __del__(self):
381
 
        self.disable_hook = None
382
 
        self.disable()
383
 
    
384
573
    def checker_callback(self, pid, condition, command):
385
574
        """The checker has completed, so take appropriate actions."""
386
575
        self.checker_callback_tag = None
387
576
        self.checker = None
388
577
        if os.WIFEXITED(condition):
389
 
            exitstatus = os.WEXITSTATUS(condition)
390
 
            if exitstatus == 0:
391
 
                logger.info(u"Checker for %(name)s succeeded",
 
578
            self.last_checker_status =  os.WEXITSTATUS(condition)
 
579
            if self.last_checker_status == 0:
 
580
                logger.info("Checker for %(name)s succeeded",
392
581
                            vars(self))
393
582
                self.checked_ok()
394
583
            else:
395
 
                logger.info(u"Checker for %(name)s failed",
 
584
                logger.info("Checker for %(name)s failed",
396
585
                            vars(self))
397
586
        else:
398
 
            logger.warning(u"Checker for %(name)s crashed?",
 
587
            self.last_checker_status = -1
 
588
            logger.warning("Checker for %(name)s crashed?",
399
589
                           vars(self))
400
590
    
401
 
    def checked_ok(self):
 
591
    def checked_ok(self, timeout=None):
402
592
        """Bump up the timeout for this client.
403
593
        
404
594
        This should only be called when the client has been seen,
405
595
        alive and well.
406
596
        """
 
597
        if timeout is None:
 
598
            timeout = self.timeout
407
599
        self.last_checked_ok = datetime.datetime.utcnow()
408
 
        gobject.source_remove(self.disable_initiator_tag)
409
 
        self.disable_initiator_tag = (gobject.timeout_add
410
 
                                      (self.timeout_milliseconds(),
411
 
                                       self.disable))
 
600
        if self.disable_initiator_tag is not None:
 
601
            gobject.source_remove(self.disable_initiator_tag)
 
602
        if getattr(self, "enabled", False):
 
603
            self.disable_initiator_tag = (gobject.timeout_add
 
604
                                          (_timedelta_to_milliseconds
 
605
                                           (timeout), self.disable))
 
606
            self.expires = datetime.datetime.utcnow() + timeout
 
607
    
 
608
    def need_approval(self):
 
609
        self.last_approval_request = datetime.datetime.utcnow()
412
610
    
413
611
    def start_checker(self):
414
612
        """Start a new checker subprocess if one is not running.
427
625
        # If a checker exists, make sure it is not a zombie
428
626
        try:
429
627
            pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
430
 
        except (AttributeError, OSError), error:
 
628
        except (AttributeError, OSError) as error:
431
629
            if (isinstance(error, OSError)
432
630
                and error.errno != errno.ECHILD):
433
631
                raise error
434
632
        else:
435
633
            if pid:
436
 
                logger.warning(u"Checker was a zombie")
 
634
                logger.warning("Checker was a zombie")
437
635
                gobject.source_remove(self.checker_callback_tag)
438
636
                self.checker_callback(pid, status,
439
637
                                      self.current_checker_command)
444
642
                command = self.checker_command % self.host
445
643
            except TypeError:
446
644
                # Escape attributes for the shell
447
 
                escaped_attrs = dict((key,
448
 
                                      re.escape(unicode(str(val),
449
 
                                                        errors=
450
 
                                                        u'replace')))
451
 
                                     for key, val in
452
 
                                     vars(self).iteritems())
 
645
                escaped_attrs = dict(
 
646
                    (attr,
 
647
                     re.escape(unicode(str(getattr(self, attr, "")),
 
648
                                       errors=
 
649
                                       'replace')))
 
650
                    for attr in
 
651
                    self.runtime_expansions)
 
652
                
453
653
                try:
454
654
                    command = self.checker_command % escaped_attrs
455
 
                except TypeError, error:
456
 
                    logger.error(u'Could not format string "%s":'
457
 
                                 u' %s', self.checker_command, error)
 
655
                except TypeError as error:
 
656
                    logger.error('Could not format string "%s":'
 
657
                                 ' %s', self.checker_command, error)
458
658
                    return True # Try again later
459
659
            self.current_checker_command = command
460
660
            try:
461
 
                logger.info(u"Starting checker %r for %s",
 
661
                logger.info("Starting checker %r for %s",
462
662
                            command, self.name)
463
663
                # We don't need to redirect stdout and stderr, since
464
664
                # in normal mode, that is already done by daemon(),
466
666
                # always replaced by /dev/null.)
467
667
                self.checker = subprocess.Popen(command,
468
668
                                                close_fds=True,
469
 
                                                shell=True, cwd=u"/")
 
669
                                                shell=True, cwd="/")
470
670
                self.checker_callback_tag = (gobject.child_watch_add
471
671
                                             (self.checker.pid,
472
672
                                              self.checker_callback,
477
677
                if pid:
478
678
                    gobject.source_remove(self.checker_callback_tag)
479
679
                    self.checker_callback(pid, status, command)
480
 
            except OSError, error:
481
 
                logger.error(u"Failed to start subprocess: %s",
 
680
            except OSError as error:
 
681
                logger.error("Failed to start subprocess: %s",
482
682
                             error)
483
683
        # Re-run this periodically if run by gobject.timeout_add
484
684
        return True
488
688
        if self.checker_callback_tag:
489
689
            gobject.source_remove(self.checker_callback_tag)
490
690
            self.checker_callback_tag = None
491
 
        if getattr(self, u"checker", None) is None:
 
691
        if getattr(self, "checker", None) is None:
492
692
            return
493
 
        logger.debug(u"Stopping checker for %(name)s", vars(self))
 
693
        logger.debug("Stopping checker for %(name)s", vars(self))
494
694
        try:
495
695
            os.kill(self.checker.pid, signal.SIGTERM)
496
696
            #time.sleep(0.5)
497
697
            #if self.checker.poll() is None:
498
698
            #    os.kill(self.checker.pid, signal.SIGKILL)
499
 
        except OSError, error:
 
699
        except OSError as error:
500
700
            if error.errno != errno.ESRCH: # No such process
501
701
                raise
502
702
        self.checker = None
503
703
 
504
 
def dbus_service_property(dbus_interface, signature=u"v",
505
 
                          access=u"readwrite", byte_arrays=False):
 
704
 
 
705
def dbus_service_property(dbus_interface, signature="v",
 
706
                          access="readwrite", byte_arrays=False):
506
707
    """Decorators for marking methods of a DBusObjectWithProperties to
507
708
    become properties on the D-Bus.
508
709
    
515
716
    """
516
717
    # Encoding deeply encoded byte arrays is not supported yet by the
517
718
    # "Set" method, so we fail early here:
518
 
    if byte_arrays and signature != u"ay":
519
 
        raise ValueError(u"Byte arrays not supported for non-'ay'"
520
 
                         u" signature %r" % signature)
 
719
    if byte_arrays and signature != "ay":
 
720
        raise ValueError("Byte arrays not supported for non-'ay'"
 
721
                         " signature %r" % signature)
521
722
    def decorator(func):
522
723
        func._dbus_is_property = True
523
724
        func._dbus_interface = dbus_interface
524
725
        func._dbus_signature = signature
525
726
        func._dbus_access = access
526
727
        func._dbus_name = func.__name__
527
 
        if func._dbus_name.endswith(u"_dbus_property"):
 
728
        if func._dbus_name.endswith("_dbus_property"):
528
729
            func._dbus_name = func._dbus_name[:-14]
529
 
        func._dbus_get_args_options = {u'byte_arrays': byte_arrays }
 
730
        func._dbus_get_args_options = {'byte_arrays': byte_arrays }
530
731
        return func
531
732
    return decorator
532
733
 
552
753
 
553
754
class DBusObjectWithProperties(dbus.service.Object):
554
755
    """A D-Bus object with properties.
555
 
 
 
756
    
556
757
    Classes inheriting from this can use the dbus_service_property
557
758
    decorator to expose methods as D-Bus properties.  It exposes the
558
759
    standard Get(), Set(), and GetAll() methods on the D-Bus.
560
761
    
561
762
    @staticmethod
562
763
    def _is_dbus_property(obj):
563
 
        return getattr(obj, u"_dbus_is_property", False)
 
764
        return getattr(obj, "_dbus_is_property", False)
564
765
    
565
766
    def _get_all_dbus_properties(self):
566
767
        """Returns a generator of (name, attribute) pairs
567
768
        """
568
 
        return ((prop._dbus_name, prop)
 
769
        return ((prop.__get__(self)._dbus_name, prop.__get__(self))
 
770
                for cls in self.__class__.__mro__
569
771
                for name, prop in
570
 
                inspect.getmembers(self, self._is_dbus_property))
 
772
                inspect.getmembers(cls, self._is_dbus_property))
571
773
    
572
774
    def _get_dbus_property(self, interface_name, property_name):
573
775
        """Returns a bound method if one exists which is a D-Bus
574
776
        property with the specified name and interface.
575
777
        """
576
 
        for name in (property_name,
577
 
                     property_name + u"_dbus_property"):
578
 
            prop = getattr(self, name, None)
579
 
            if (prop is None
580
 
                or not self._is_dbus_property(prop)
581
 
                or prop._dbus_name != property_name
582
 
                or (interface_name and prop._dbus_interface
583
 
                    and interface_name != prop._dbus_interface)):
584
 
                continue
585
 
            return prop
 
778
        for cls in  self.__class__.__mro__:
 
779
            for name, value in (inspect.getmembers
 
780
                                (cls, self._is_dbus_property)):
 
781
                if (value._dbus_name == property_name
 
782
                    and value._dbus_interface == interface_name):
 
783
                    return value.__get__(self)
 
784
        
586
785
        # No such property
587
 
        raise DBusPropertyNotFound(self.dbus_object_path + u":"
588
 
                                   + interface_name + u"."
 
786
        raise DBusPropertyNotFound(self.dbus_object_path + ":"
 
787
                                   + interface_name + "."
589
788
                                   + property_name)
590
789
    
591
 
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ss",
592
 
                         out_signature=u"v")
 
790
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
 
791
                         out_signature="v")
593
792
    def Get(self, interface_name, property_name):
594
793
        """Standard D-Bus property Get() method, see D-Bus standard.
595
794
        """
596
795
        prop = self._get_dbus_property(interface_name, property_name)
597
 
        if prop._dbus_access == u"write":
 
796
        if prop._dbus_access == "write":
598
797
            raise DBusPropertyAccessException(property_name)
599
798
        value = prop()
600
 
        if not hasattr(value, u"variant_level"):
 
799
        if not hasattr(value, "variant_level"):
601
800
            return value
602
801
        return type(value)(value, variant_level=value.variant_level+1)
603
802
    
604
 
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ssv")
 
803
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
605
804
    def Set(self, interface_name, property_name, value):
606
805
        """Standard D-Bus property Set() method, see D-Bus standard.
607
806
        """
608
807
        prop = self._get_dbus_property(interface_name, property_name)
609
 
        if prop._dbus_access == u"read":
 
808
        if prop._dbus_access == "read":
610
809
            raise DBusPropertyAccessException(property_name)
611
 
        if prop._dbus_get_args_options[u"byte_arrays"]:
 
810
        if prop._dbus_get_args_options["byte_arrays"]:
612
811
            # The byte_arrays option is not supported yet on
613
812
            # signatures other than "ay".
614
 
            if prop._dbus_signature != u"ay":
 
813
            if prop._dbus_signature != "ay":
615
814
                raise ValueError
616
815
            value = dbus.ByteArray(''.join(unichr(byte)
617
816
                                           for byte in value))
618
817
        prop(value)
619
818
    
620
 
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"s",
621
 
                         out_signature=u"a{sv}")
 
819
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
 
820
                         out_signature="a{sv}")
622
821
    def GetAll(self, interface_name):
623
822
        """Standard D-Bus property GetAll() method, see D-Bus
624
823
        standard.
625
 
 
 
824
        
626
825
        Note: Will not include properties with access="write".
627
826
        """
628
 
        all = {}
 
827
        properties = {}
629
828
        for name, prop in self._get_all_dbus_properties():
630
829
            if (interface_name
631
830
                and interface_name != prop._dbus_interface):
632
831
                # Interface non-empty but did not match
633
832
                continue
634
833
            # Ignore write-only properties
635
 
            if prop._dbus_access == u"write":
 
834
            if prop._dbus_access == "write":
636
835
                continue
637
836
            value = prop()
638
 
            if not hasattr(value, u"variant_level"):
639
 
                all[name] = value
 
837
            if not hasattr(value, "variant_level"):
 
838
                properties[name] = value
640
839
                continue
641
 
            all[name] = type(value)(value, variant_level=
642
 
                                    value.variant_level+1)
643
 
        return dbus.Dictionary(all, signature=u"sv")
 
840
            properties[name] = type(value)(value, variant_level=
 
841
                                           value.variant_level+1)
 
842
        return dbus.Dictionary(properties, signature="sv")
644
843
    
645
844
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
646
 
                         out_signature=u"s",
 
845
                         out_signature="s",
647
846
                         path_keyword='object_path',
648
847
                         connection_keyword='connection')
649
848
    def Introspect(self, object_path, connection):
654
853
        try:
655
854
            document = xml.dom.minidom.parseString(xmlstring)
656
855
            def make_tag(document, name, prop):
657
 
                e = document.createElement(u"property")
658
 
                e.setAttribute(u"name", name)
659
 
                e.setAttribute(u"type", prop._dbus_signature)
660
 
                e.setAttribute(u"access", prop._dbus_access)
 
856
                e = document.createElement("property")
 
857
                e.setAttribute("name", name)
 
858
                e.setAttribute("type", prop._dbus_signature)
 
859
                e.setAttribute("access", prop._dbus_access)
661
860
                return e
662
 
            for if_tag in document.getElementsByTagName(u"interface"):
 
861
            for if_tag in document.getElementsByTagName("interface"):
663
862
                for tag in (make_tag(document, name, prop)
664
863
                            for name, prop
665
864
                            in self._get_all_dbus_properties()
666
865
                            if prop._dbus_interface
667
 
                            == if_tag.getAttribute(u"name")):
 
866
                            == if_tag.getAttribute("name")):
668
867
                    if_tag.appendChild(tag)
669
868
                # Add the names to the return values for the
670
869
                # "org.freedesktop.DBus.Properties" methods
671
 
                if (if_tag.getAttribute(u"name")
672
 
                    == u"org.freedesktop.DBus.Properties"):
673
 
                    for cn in if_tag.getElementsByTagName(u"method"):
674
 
                        if cn.getAttribute(u"name") == u"Get":
675
 
                            for arg in cn.getElementsByTagName(u"arg"):
676
 
                                if (arg.getAttribute(u"direction")
677
 
                                    == u"out"):
678
 
                                    arg.setAttribute(u"name", u"value")
679
 
                        elif cn.getAttribute(u"name") == u"GetAll":
680
 
                            for arg in cn.getElementsByTagName(u"arg"):
681
 
                                if (arg.getAttribute(u"direction")
682
 
                                    == u"out"):
683
 
                                    arg.setAttribute(u"name", u"props")
684
 
            xmlstring = document.toxml(u"utf-8")
 
870
                if (if_tag.getAttribute("name")
 
871
                    == "org.freedesktop.DBus.Properties"):
 
872
                    for cn in if_tag.getElementsByTagName("method"):
 
873
                        if cn.getAttribute("name") == "Get":
 
874
                            for arg in cn.getElementsByTagName("arg"):
 
875
                                if (arg.getAttribute("direction")
 
876
                                    == "out"):
 
877
                                    arg.setAttribute("name", "value")
 
878
                        elif cn.getAttribute("name") == "GetAll":
 
879
                            for arg in cn.getElementsByTagName("arg"):
 
880
                                if (arg.getAttribute("direction")
 
881
                                    == "out"):
 
882
                                    arg.setAttribute("name", "props")
 
883
            xmlstring = document.toxml("utf-8")
685
884
            document.unlink()
686
885
        except (AttributeError, xml.dom.DOMException,
687
 
                xml.parsers.expat.ExpatError), error:
688
 
            logger.error(u"Failed to override Introspection method",
 
886
                xml.parsers.expat.ExpatError) as error:
 
887
            logger.error("Failed to override Introspection method",
689
888
                         error)
690
889
        return xmlstring
691
890
 
692
891
 
 
892
def datetime_to_dbus (dt, variant_level=0):
 
893
    """Convert a UTC datetime.datetime() to a D-Bus type."""
 
894
    if dt is None:
 
895
        return dbus.String("", variant_level = variant_level)
 
896
    return dbus.String(dt.isoformat(),
 
897
                       variant_level=variant_level)
 
898
 
 
899
 
 
900
class AlternateDBusNamesMetaclass(DBusObjectWithProperties
 
901
                                  .__metaclass__):
 
902
    """Applied to an empty subclass of a D-Bus object, this metaclass
 
903
    will add additional D-Bus attributes matching a certain pattern.
 
904
    """
 
905
    def __new__(mcs, name, bases, attr):
 
906
        # Go through all the base classes which could have D-Bus
 
907
        # methods, signals, or properties in them
 
908
        for base in (b for b in bases
 
909
                     if issubclass(b, dbus.service.Object)):
 
910
            # Go though all attributes of the base class
 
911
            for attrname, attribute in inspect.getmembers(base):
 
912
                # Ignore non-D-Bus attributes, and D-Bus attributes
 
913
                # with the wrong interface name
 
914
                if (not hasattr(attribute, "_dbus_interface")
 
915
                    or not attribute._dbus_interface
 
916
                    .startswith("se.recompile.Mandos")):
 
917
                    continue
 
918
                # Create an alternate D-Bus interface name based on
 
919
                # the current name
 
920
                alt_interface = (attribute._dbus_interface
 
921
                                 .replace("se.recompile.Mandos",
 
922
                                          "se.bsnet.fukt.Mandos"))
 
923
                # Is this a D-Bus signal?
 
924
                if getattr(attribute, "_dbus_is_signal", False):
 
925
                    # Extract the original non-method function by
 
926
                    # black magic
 
927
                    nonmethod_func = (dict(
 
928
                            zip(attribute.func_code.co_freevars,
 
929
                                attribute.__closure__))["func"]
 
930
                                      .cell_contents)
 
931
                    # Create a new, but exactly alike, function
 
932
                    # object, and decorate it to be a new D-Bus signal
 
933
                    # with the alternate D-Bus interface name
 
934
                    new_function = (dbus.service.signal
 
935
                                    (alt_interface,
 
936
                                     attribute._dbus_signature)
 
937
                                    (types.FunctionType(
 
938
                                nonmethod_func.func_code,
 
939
                                nonmethod_func.func_globals,
 
940
                                nonmethod_func.func_name,
 
941
                                nonmethod_func.func_defaults,
 
942
                                nonmethod_func.func_closure)))
 
943
                    # Define a creator of a function to call both the
 
944
                    # old and new functions, so both the old and new
 
945
                    # signals gets sent when the function is called
 
946
                    def fixscope(func1, func2):
 
947
                        """This function is a scope container to pass
 
948
                        func1 and func2 to the "call_both" function
 
949
                        outside of its arguments"""
 
950
                        def call_both(*args, **kwargs):
 
951
                            """This function will emit two D-Bus
 
952
                            signals by calling func1 and func2"""
 
953
                            func1(*args, **kwargs)
 
954
                            func2(*args, **kwargs)
 
955
                        return call_both
 
956
                    # Create the "call_both" function and add it to
 
957
                    # the class
 
958
                    attr[attrname] = fixscope(attribute,
 
959
                                              new_function)
 
960
                # Is this a D-Bus method?
 
961
                elif getattr(attribute, "_dbus_is_method", False):
 
962
                    # Create a new, but exactly alike, function
 
963
                    # object.  Decorate it to be a new D-Bus method
 
964
                    # with the alternate D-Bus interface name.  Add it
 
965
                    # to the class.
 
966
                    attr[attrname] = (dbus.service.method
 
967
                                      (alt_interface,
 
968
                                       attribute._dbus_in_signature,
 
969
                                       attribute._dbus_out_signature)
 
970
                                      (types.FunctionType
 
971
                                       (attribute.func_code,
 
972
                                        attribute.func_globals,
 
973
                                        attribute.func_name,
 
974
                                        attribute.func_defaults,
 
975
                                        attribute.func_closure)))
 
976
                # Is this a D-Bus property?
 
977
                elif getattr(attribute, "_dbus_is_property", False):
 
978
                    # Create a new, but exactly alike, function
 
979
                    # object, and decorate it to be a new D-Bus
 
980
                    # property with the alternate D-Bus interface
 
981
                    # name.  Add it to the class.
 
982
                    attr[attrname] = (dbus_service_property
 
983
                                      (alt_interface,
 
984
                                       attribute._dbus_signature,
 
985
                                       attribute._dbus_access,
 
986
                                       attribute
 
987
                                       ._dbus_get_args_options
 
988
                                       ["byte_arrays"])
 
989
                                      (types.FunctionType
 
990
                                       (attribute.func_code,
 
991
                                        attribute.func_globals,
 
992
                                        attribute.func_name,
 
993
                                        attribute.func_defaults,
 
994
                                        attribute.func_closure)))
 
995
        return type.__new__(mcs, name, bases, attr)
 
996
 
 
997
 
693
998
class ClientDBus(Client, DBusObjectWithProperties):
694
999
    """A Client class using D-Bus
695
1000
    
697
1002
    dbus_object_path: dbus.ObjectPath
698
1003
    bus: dbus.SystemBus()
699
1004
    """
 
1005
    
 
1006
    runtime_expansions = (Client.runtime_expansions
 
1007
                          + ("dbus_object_path",))
 
1008
    
700
1009
    # dbus.service.Object doesn't use super(), so we can't either.
701
1010
    
702
1011
    def __init__(self, bus = None, *args, **kwargs):
703
1012
        self.bus = bus
704
1013
        Client.__init__(self, *args, **kwargs)
 
1014
        
 
1015
        self._approvals_pending = 0
705
1016
        # Only now, when this client is initialized, can it show up on
706
1017
        # the D-Bus
 
1018
        client_object_name = unicode(self.name).translate(
 
1019
            {ord("."): ord("_"),
 
1020
             ord("-"): ord("_")})
707
1021
        self.dbus_object_path = (dbus.ObjectPath
708
 
                                 (u"/clients/"
709
 
                                  + self.name.replace(u".", u"_")))
 
1022
                                 ("/clients/" + client_object_name))
710
1023
        DBusObjectWithProperties.__init__(self, self.bus,
711
1024
                                          self.dbus_object_path)
712
 
    
713
 
    @staticmethod
714
 
    def _datetime_to_dbus(dt, variant_level=0):
715
 
        """Convert a UTC datetime.datetime() to a D-Bus type."""
716
 
        return dbus.String(dt.isoformat(),
717
 
                           variant_level=variant_level)
718
 
    
719
 
    def enable(self):
720
 
        oldstate = getattr(self, u"enabled", False)
721
 
        r = Client.enable(self)
722
 
        if oldstate != self.enabled:
723
 
            # Emit D-Bus signals
724
 
            self.PropertyChanged(dbus.String(u"enabled"),
725
 
                                 dbus.Boolean(True, variant_level=1))
726
 
            self.PropertyChanged(
727
 
                dbus.String(u"last_enabled"),
728
 
                self._datetime_to_dbus(self.last_enabled,
729
 
                                       variant_level=1))
730
 
        return r
731
 
    
732
 
    def disable(self, quiet = False):
733
 
        oldstate = getattr(self, u"enabled", False)
734
 
        r = Client.disable(self, quiet=quiet)
735
 
        if not quiet and oldstate != self.enabled:
736
 
            # Emit D-Bus signal
737
 
            self.PropertyChanged(dbus.String(u"enabled"),
738
 
                                 dbus.Boolean(False, variant_level=1))
739
 
        return r
 
1025
        
 
1026
    def notifychangeproperty(transform_func,
 
1027
                             dbus_name, type_func=lambda x: x,
 
1028
                             variant_level=1):
 
1029
        """ Modify a variable so that it's a property which announces
 
1030
        its changes to DBus.
 
1031
        
 
1032
        transform_fun: Function that takes a value and a variant_level
 
1033
                       and transforms it to a D-Bus type.
 
1034
        dbus_name: D-Bus name of the variable
 
1035
        type_func: Function that transform the value before sending it
 
1036
                   to the D-Bus.  Default: no transform
 
1037
        variant_level: D-Bus variant level.  Default: 1
 
1038
        """
 
1039
        attrname = "_{0}".format(dbus_name)
 
1040
        def setter(self, value):
 
1041
            if hasattr(self, "dbus_object_path"):
 
1042
                if (not hasattr(self, attrname) or
 
1043
                    type_func(getattr(self, attrname, None))
 
1044
                    != type_func(value)):
 
1045
                    dbus_value = transform_func(type_func(value),
 
1046
                                                variant_level
 
1047
                                                =variant_level)
 
1048
                    self.PropertyChanged(dbus.String(dbus_name),
 
1049
                                         dbus_value)
 
1050
            setattr(self, attrname, value)
 
1051
        
 
1052
        return property(lambda self: getattr(self, attrname), setter)
 
1053
    
 
1054
    
 
1055
    expires = notifychangeproperty(datetime_to_dbus, "Expires")
 
1056
    approvals_pending = notifychangeproperty(dbus.Boolean,
 
1057
                                             "ApprovalPending",
 
1058
                                             type_func = bool)
 
1059
    enabled = notifychangeproperty(dbus.Boolean, "Enabled")
 
1060
    last_enabled = notifychangeproperty(datetime_to_dbus,
 
1061
                                        "LastEnabled")
 
1062
    checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",
 
1063
                                   type_func = lambda checker:
 
1064
                                       checker is not None)
 
1065
    last_checked_ok = notifychangeproperty(datetime_to_dbus,
 
1066
                                           "LastCheckedOK")
 
1067
    last_approval_request = notifychangeproperty(
 
1068
        datetime_to_dbus, "LastApprovalRequest")
 
1069
    approved_by_default = notifychangeproperty(dbus.Boolean,
 
1070
                                               "ApprovedByDefault")
 
1071
    approval_delay = notifychangeproperty(dbus.UInt16,
 
1072
                                          "ApprovalDelay",
 
1073
                                          type_func =
 
1074
                                          _timedelta_to_milliseconds)
 
1075
    approval_duration = notifychangeproperty(
 
1076
        dbus.UInt16, "ApprovalDuration",
 
1077
        type_func = _timedelta_to_milliseconds)
 
1078
    host = notifychangeproperty(dbus.String, "Host")
 
1079
    timeout = notifychangeproperty(dbus.UInt16, "Timeout",
 
1080
                                   type_func =
 
1081
                                   _timedelta_to_milliseconds)
 
1082
    extended_timeout = notifychangeproperty(
 
1083
        dbus.UInt16, "ExtendedTimeout",
 
1084
        type_func = _timedelta_to_milliseconds)
 
1085
    interval = notifychangeproperty(dbus.UInt16,
 
1086
                                    "Interval",
 
1087
                                    type_func =
 
1088
                                    _timedelta_to_milliseconds)
 
1089
    checker_command = notifychangeproperty(dbus.String, "Checker")
 
1090
    
 
1091
    del notifychangeproperty
740
1092
    
741
1093
    def __del__(self, *args, **kwargs):
742
1094
        try:
743
1095
            self.remove_from_connection()
744
1096
        except LookupError:
745
1097
            pass
746
 
        if hasattr(DBusObjectWithProperties, u"__del__"):
 
1098
        if hasattr(DBusObjectWithProperties, "__del__"):
747
1099
            DBusObjectWithProperties.__del__(self, *args, **kwargs)
748
1100
        Client.__del__(self, *args, **kwargs)
749
1101
    
751
1103
                         *args, **kwargs):
752
1104
        self.checker_callback_tag = None
753
1105
        self.checker = None
754
 
        # Emit D-Bus signal
755
 
        self.PropertyChanged(dbus.String(u"checker_running"),
756
 
                             dbus.Boolean(False, variant_level=1))
757
1106
        if os.WIFEXITED(condition):
758
1107
            exitstatus = os.WEXITSTATUS(condition)
759
1108
            # Emit D-Bus signal
769
1118
        return Client.checker_callback(self, pid, condition, command,
770
1119
                                       *args, **kwargs)
771
1120
    
772
 
    def checked_ok(self, *args, **kwargs):
773
 
        r = Client.checked_ok(self, *args, **kwargs)
774
 
        # Emit D-Bus signal
775
 
        self.PropertyChanged(
776
 
            dbus.String(u"last_checked_ok"),
777
 
            (self._datetime_to_dbus(self.last_checked_ok,
778
 
                                    variant_level=1)))
779
 
        return r
780
 
    
781
1121
    def start_checker(self, *args, **kwargs):
782
1122
        old_checker = self.checker
783
1123
        if self.checker is not None:
790
1130
            and old_checker_pid != self.checker.pid):
791
1131
            # Emit D-Bus signal
792
1132
            self.CheckerStarted(self.current_checker_command)
793
 
            self.PropertyChanged(
794
 
                dbus.String(u"checker_running"),
795
 
                dbus.Boolean(True, variant_level=1))
796
1133
        return r
797
1134
    
798
 
    def stop_checker(self, *args, **kwargs):
799
 
        old_checker = getattr(self, u"checker", None)
800
 
        r = Client.stop_checker(self, *args, **kwargs)
801
 
        if (old_checker is not None
802
 
            and getattr(self, u"checker", None) is None):
803
 
            self.PropertyChanged(dbus.String(u"checker_running"),
804
 
                                 dbus.Boolean(False, variant_level=1))
805
 
        return r
806
 
 
807
1135
    def _reset_approved(self):
808
1136
        self._approved = None
809
1137
        return False
810
1138
    
811
1139
    def approve(self, value=True):
 
1140
        self.send_changedstate()
812
1141
        self._approved = value
813
 
        gobject.timeout_add(self._timedelta_to_milliseconds(self.approved_duration, self._reset_approved))
814
 
 
815
 
    def approved_pending(self):
816
 
        return self.approvals_pending > 0
817
 
 
 
1142
        gobject.timeout_add(_timedelta_to_milliseconds
 
1143
                            (self.approval_duration),
 
1144
                            self._reset_approved)
 
1145
    
818
1146
    
819
1147
    ## D-Bus methods, signals & properties
820
 
    _interface = u"se.bsnet.fukt.Mandos.Client"
 
1148
    _interface = "se.recompile.Mandos.Client"
821
1149
    
822
1150
    ## Signals
823
1151
    
824
1152
    # CheckerCompleted - signal
825
 
    @dbus.service.signal(_interface, signature=u"nxs")
 
1153
    @dbus.service.signal(_interface, signature="nxs")
826
1154
    def CheckerCompleted(self, exitcode, waitstatus, command):
827
1155
        "D-Bus signal"
828
1156
        pass
829
1157
    
830
1158
    # CheckerStarted - signal
831
 
    @dbus.service.signal(_interface, signature=u"s")
 
1159
    @dbus.service.signal(_interface, signature="s")
832
1160
    def CheckerStarted(self, command):
833
1161
        "D-Bus signal"
834
1162
        pass
835
1163
    
836
1164
    # PropertyChanged - signal
837
 
    @dbus.service.signal(_interface, signature=u"sv")
 
1165
    @dbus.service.signal(_interface, signature="sv")
838
1166
    def PropertyChanged(self, property, value):
839
1167
        "D-Bus signal"
840
1168
        pass
841
1169
    
842
1170
    # GotSecret - signal
843
 
    # Is sent after succesfull transfer of secret from mandos-server to mandos-client
844
1171
    @dbus.service.signal(_interface)
845
1172
    def GotSecret(self):
846
 
        "D-Bus signal"
 
1173
        """D-Bus signal
 
1174
        Is sent after a successful transfer of secret from the Mandos
 
1175
        server to mandos-client
 
1176
        """
847
1177
        pass
848
1178
    
849
1179
    # Rejected - signal
850
 
    @dbus.service.signal(_interface, signature=u"s")
 
1180
    @dbus.service.signal(_interface, signature="s")
851
1181
    def Rejected(self, reason):
852
1182
        "D-Bus signal"
853
1183
        pass
854
1184
    
855
1185
    # NeedApproval - signal
856
 
    @dbus.service.signal(_interface, signature=u"db")
 
1186
    @dbus.service.signal(_interface, signature="tb")
857
1187
    def NeedApproval(self, timeout, default):
858
1188
        "D-Bus signal"
 
1189
        return self.need_approval()
 
1190
    
 
1191
    # NeRwequest - signal
 
1192
    @dbus.service.signal(_interface, signature="s")
 
1193
    def NewRequest(self, ip):
 
1194
        """D-Bus signal
 
1195
        Is sent after a client request a password.
 
1196
        """
859
1197
        pass
860
1198
    
861
1199
    ## Methods
862
 
 
 
1200
    
863
1201
    # Approve - method
864
 
    @dbus.service.method(_interface, in_signature=u"b")
 
1202
    @dbus.service.method(_interface, in_signature="b")
865
1203
    def Approve(self, value):
866
1204
        self.approve(value)
867
 
 
 
1205
    
868
1206
    # CheckedOK - method
869
1207
    @dbus.service.method(_interface)
870
1208
    def CheckedOK(self):
871
 
        return self.checked_ok()
 
1209
        self.checked_ok()
872
1210
    
873
1211
    # Enable - method
874
1212
    @dbus.service.method(_interface)
895
1233
    
896
1234
    ## Properties
897
1235
    
898
 
    # approved_pending - property
899
 
    @dbus_service_property(_interface, signature=u"b", access=u"read")
900
 
    def approved_pending_dbus_property(self):
901
 
        return dbus.Boolean(self.approved_pending())
902
 
    
903
 
    # approved_by_default - property
904
 
    @dbus_service_property(_interface, signature=u"b",
905
 
                           access=u"readwrite")
906
 
    def approved_by_default_dbus_property(self):
907
 
        return dbus.Boolean(self.approved_by_default)
908
 
    
909
 
    # approved_delay - property
910
 
    @dbus_service_property(_interface, signature=u"t",
911
 
                           access=u"readwrite")
912
 
    def approved_delay_dbus_property(self):
913
 
        return dbus.UInt64(self.approved_delay_milliseconds())
914
 
    
915
 
    # approved_duration - property
916
 
    @dbus_service_property(_interface, signature=u"t",
917
 
                           access=u"readwrite")
918
 
    def approved_duration_dbus_property(self):
919
 
        return dbus.UInt64(self._timedelta_to_milliseconds(
920
 
                self.approved_duration))
921
 
    
922
 
    # name - property
923
 
    @dbus_service_property(_interface, signature=u"s", access=u"read")
924
 
    def name_dbus_property(self):
 
1236
    # ApprovalPending - property
 
1237
    @dbus_service_property(_interface, signature="b", access="read")
 
1238
    def ApprovalPending_dbus_property(self):
 
1239
        return dbus.Boolean(bool(self.approvals_pending))
 
1240
    
 
1241
    # ApprovedByDefault - property
 
1242
    @dbus_service_property(_interface, signature="b",
 
1243
                           access="readwrite")
 
1244
    def ApprovedByDefault_dbus_property(self, value=None):
 
1245
        if value is None:       # get
 
1246
            return dbus.Boolean(self.approved_by_default)
 
1247
        self.approved_by_default = bool(value)
 
1248
    
 
1249
    # ApprovalDelay - property
 
1250
    @dbus_service_property(_interface, signature="t",
 
1251
                           access="readwrite")
 
1252
    def ApprovalDelay_dbus_property(self, value=None):
 
1253
        if value is None:       # get
 
1254
            return dbus.UInt64(self.approval_delay_milliseconds())
 
1255
        self.approval_delay = datetime.timedelta(0, 0, 0, value)
 
1256
    
 
1257
    # ApprovalDuration - property
 
1258
    @dbus_service_property(_interface, signature="t",
 
1259
                           access="readwrite")
 
1260
    def ApprovalDuration_dbus_property(self, value=None):
 
1261
        if value is None:       # get
 
1262
            return dbus.UInt64(_timedelta_to_milliseconds(
 
1263
                    self.approval_duration))
 
1264
        self.approval_duration = datetime.timedelta(0, 0, 0, value)
 
1265
    
 
1266
    # Name - property
 
1267
    @dbus_service_property(_interface, signature="s", access="read")
 
1268
    def Name_dbus_property(self):
925
1269
        return dbus.String(self.name)
926
1270
    
927
 
    # fingerprint - property
928
 
    @dbus_service_property(_interface, signature=u"s", access=u"read")
929
 
    def fingerprint_dbus_property(self):
 
1271
    # Fingerprint - property
 
1272
    @dbus_service_property(_interface, signature="s", access="read")
 
1273
    def Fingerprint_dbus_property(self):
930
1274
        return dbus.String(self.fingerprint)
931
1275
    
932
 
    # host - property
933
 
    @dbus_service_property(_interface, signature=u"s",
934
 
                           access=u"readwrite")
935
 
    def host_dbus_property(self, value=None):
 
1276
    # Host - property
 
1277
    @dbus_service_property(_interface, signature="s",
 
1278
                           access="readwrite")
 
1279
    def Host_dbus_property(self, value=None):
936
1280
        if value is None:       # get
937
1281
            return dbus.String(self.host)
938
1282
        self.host = value
939
 
        # Emit D-Bus signal
940
 
        self.PropertyChanged(dbus.String(u"host"),
941
 
                             dbus.String(value, variant_level=1))
942
 
    
943
 
    # created - property
944
 
    @dbus_service_property(_interface, signature=u"s", access=u"read")
945
 
    def created_dbus_property(self):
946
 
        return dbus.String(self._datetime_to_dbus(self.created))
947
 
    
948
 
    # last_enabled - property
949
 
    @dbus_service_property(_interface, signature=u"s", access=u"read")
950
 
    def last_enabled_dbus_property(self):
951
 
        if self.last_enabled is None:
952
 
            return dbus.String(u"")
953
 
        return dbus.String(self._datetime_to_dbus(self.last_enabled))
954
 
    
955
 
    # enabled - property
956
 
    @dbus_service_property(_interface, signature=u"b",
957
 
                           access=u"readwrite")
958
 
    def enabled_dbus_property(self, value=None):
 
1283
    
 
1284
    # Created - property
 
1285
    @dbus_service_property(_interface, signature="s", access="read")
 
1286
    def Created_dbus_property(self):
 
1287
        return datetime_to_dbus(self.created)
 
1288
    
 
1289
    # LastEnabled - property
 
1290
    @dbus_service_property(_interface, signature="s", access="read")
 
1291
    def LastEnabled_dbus_property(self):
 
1292
        return datetime_to_dbus(self.last_enabled)
 
1293
    
 
1294
    # Enabled - property
 
1295
    @dbus_service_property(_interface, signature="b",
 
1296
                           access="readwrite")
 
1297
    def Enabled_dbus_property(self, value=None):
959
1298
        if value is None:       # get
960
1299
            return dbus.Boolean(self.enabled)
961
1300
        if value:
963
1302
        else:
964
1303
            self.disable()
965
1304
    
966
 
    # last_checked_ok - property
967
 
    @dbus_service_property(_interface, signature=u"s",
968
 
                           access=u"readwrite")
969
 
    def last_checked_ok_dbus_property(self, value=None):
 
1305
    # LastCheckedOK - property
 
1306
    @dbus_service_property(_interface, signature="s",
 
1307
                           access="readwrite")
 
1308
    def LastCheckedOK_dbus_property(self, value=None):
970
1309
        if value is not None:
971
1310
            self.checked_ok()
972
1311
            return
973
 
        if self.last_checked_ok is None:
974
 
            return dbus.String(u"")
975
 
        return dbus.String(self._datetime_to_dbus(self
976
 
                                                  .last_checked_ok))
977
 
    
978
 
    # timeout - property
979
 
    @dbus_service_property(_interface, signature=u"t",
980
 
                           access=u"readwrite")
981
 
    def timeout_dbus_property(self, value=None):
 
1312
        return datetime_to_dbus(self.last_checked_ok)
 
1313
    
 
1314
    # Expires - property
 
1315
    @dbus_service_property(_interface, signature="s", access="read")
 
1316
    def Expires_dbus_property(self):
 
1317
        return datetime_to_dbus(self.expires)
 
1318
    
 
1319
    # LastApprovalRequest - property
 
1320
    @dbus_service_property(_interface, signature="s", access="read")
 
1321
    def LastApprovalRequest_dbus_property(self):
 
1322
        return datetime_to_dbus(self.last_approval_request)
 
1323
    
 
1324
    # Timeout - property
 
1325
    @dbus_service_property(_interface, signature="t",
 
1326
                           access="readwrite")
 
1327
    def Timeout_dbus_property(self, value=None):
982
1328
        if value is None:       # get
983
1329
            return dbus.UInt64(self.timeout_milliseconds())
984
1330
        self.timeout = datetime.timedelta(0, 0, 0, value)
985
 
        # Emit D-Bus signal
986
 
        self.PropertyChanged(dbus.String(u"timeout"),
987
 
                             dbus.UInt64(value, variant_level=1))
988
 
        if getattr(self, u"disable_initiator_tag", None) is None:
 
1331
        if getattr(self, "disable_initiator_tag", None) is None:
989
1332
            return
990
1333
        # Reschedule timeout
991
1334
        gobject.source_remove(self.disable_initiator_tag)
992
1335
        self.disable_initiator_tag = None
993
 
        time_to_die = (self.
994
 
                       _timedelta_to_milliseconds((self
995
 
                                                   .last_checked_ok
996
 
                                                   + self.timeout)
997
 
                                                  - datetime.datetime
998
 
                                                  .utcnow()))
 
1336
        self.expires = None
 
1337
        time_to_die = _timedelta_to_milliseconds((self
 
1338
                                                  .last_checked_ok
 
1339
                                                  + self.timeout)
 
1340
                                                 - datetime.datetime
 
1341
                                                 .utcnow())
999
1342
        if time_to_die <= 0:
1000
1343
            # The timeout has passed
1001
1344
            self.disable()
1002
1345
        else:
 
1346
            self.expires = (datetime.datetime.utcnow()
 
1347
                            + datetime.timedelta(milliseconds =
 
1348
                                                 time_to_die))
1003
1349
            self.disable_initiator_tag = (gobject.timeout_add
1004
1350
                                          (time_to_die, self.disable))
1005
1351
    
1006
 
    # interval - property
1007
 
    @dbus_service_property(_interface, signature=u"t",
1008
 
                           access=u"readwrite")
1009
 
    def interval_dbus_property(self, value=None):
 
1352
    # ExtendedTimeout - property
 
1353
    @dbus_service_property(_interface, signature="t",
 
1354
                           access="readwrite")
 
1355
    def ExtendedTimeout_dbus_property(self, value=None):
 
1356
        if value is None:       # get
 
1357
            return dbus.UInt64(self.extended_timeout_milliseconds())
 
1358
        self.extended_timeout = datetime.timedelta(0, 0, 0, value)
 
1359
    
 
1360
    # Interval - property
 
1361
    @dbus_service_property(_interface, signature="t",
 
1362
                           access="readwrite")
 
1363
    def Interval_dbus_property(self, value=None):
1010
1364
        if value is None:       # get
1011
1365
            return dbus.UInt64(self.interval_milliseconds())
1012
1366
        self.interval = datetime.timedelta(0, 0, 0, value)
1013
 
        # Emit D-Bus signal
1014
 
        self.PropertyChanged(dbus.String(u"interval"),
1015
 
                             dbus.UInt64(value, variant_level=1))
1016
 
        if getattr(self, u"checker_initiator_tag", None) is None:
 
1367
        if getattr(self, "checker_initiator_tag", None) is None:
1017
1368
            return
1018
 
        # Reschedule checker run
1019
 
        gobject.source_remove(self.checker_initiator_tag)
1020
 
        self.checker_initiator_tag = (gobject.timeout_add
1021
 
                                      (value, self.start_checker))
1022
 
        self.start_checker()    # Start one now, too
1023
 
 
1024
 
    # checker - property
1025
 
    @dbus_service_property(_interface, signature=u"s",
1026
 
                           access=u"readwrite")
1027
 
    def checker_dbus_property(self, value=None):
 
1369
        if self.enabled:
 
1370
            # Reschedule checker run
 
1371
            gobject.source_remove(self.checker_initiator_tag)
 
1372
            self.checker_initiator_tag = (gobject.timeout_add
 
1373
                                          (value, self.start_checker))
 
1374
            self.start_checker()    # Start one now, too
 
1375
    
 
1376
    # Checker - property
 
1377
    @dbus_service_property(_interface, signature="s",
 
1378
                           access="readwrite")
 
1379
    def Checker_dbus_property(self, value=None):
1028
1380
        if value is None:       # get
1029
1381
            return dbus.String(self.checker_command)
1030
1382
        self.checker_command = value
1031
 
        # Emit D-Bus signal
1032
 
        self.PropertyChanged(dbus.String(u"checker"),
1033
 
                             dbus.String(self.checker_command,
1034
 
                                         variant_level=1))
1035
1383
    
1036
 
    # checker_running - property
1037
 
    @dbus_service_property(_interface, signature=u"b",
1038
 
                           access=u"readwrite")
1039
 
    def checker_running_dbus_property(self, value=None):
 
1384
    # CheckerRunning - property
 
1385
    @dbus_service_property(_interface, signature="b",
 
1386
                           access="readwrite")
 
1387
    def CheckerRunning_dbus_property(self, value=None):
1040
1388
        if value is None:       # get
1041
1389
            return dbus.Boolean(self.checker is not None)
1042
1390
        if value:
1044
1392
        else:
1045
1393
            self.stop_checker()
1046
1394
    
1047
 
    # object_path - property
1048
 
    @dbus_service_property(_interface, signature=u"o", access=u"read")
1049
 
    def object_path_dbus_property(self):
 
1395
    # ObjectPath - property
 
1396
    @dbus_service_property(_interface, signature="o", access="read")
 
1397
    def ObjectPath_dbus_property(self):
1050
1398
        return self.dbus_object_path # is already a dbus.ObjectPath
1051
1399
    
1052
 
    # secret = property
1053
 
    @dbus_service_property(_interface, signature=u"ay",
1054
 
                           access=u"write", byte_arrays=True)
1055
 
    def secret_dbus_property(self, value):
 
1400
    # Secret = property
 
1401
    @dbus_service_property(_interface, signature="ay",
 
1402
                           access="write", byte_arrays=True)
 
1403
    def Secret_dbus_property(self, value):
1056
1404
        self.secret = str(value)
1057
1405
    
1058
1406
    del _interface
1064
1412
        self._pipe.send(('init', fpr, address))
1065
1413
        if not self._pipe.recv():
1066
1414
            raise KeyError()
1067
 
 
 
1415
    
1068
1416
    def __getattribute__(self, name):
1069
1417
        if(name == '_pipe'):
1070
1418
            return super(ProxyClient, self).__getattribute__(name)
1077
1425
                self._pipe.send(('funcall', name, args, kwargs))
1078
1426
                return self._pipe.recv()[1]
1079
1427
            return func
1080
 
 
 
1428
    
1081
1429
    def __setattr__(self, name, value):
1082
1430
        if(name == '_pipe'):
1083
1431
            return super(ProxyClient, self).__setattr__(name, value)
1084
1432
        self._pipe.send(('setattr', name, value))
1085
1433
 
1086
1434
 
 
1435
class ClientDBusTransitional(ClientDBus):
 
1436
    __metaclass__ = AlternateDBusNamesMetaclass
 
1437
 
 
1438
 
1087
1439
class ClientHandler(socketserver.BaseRequestHandler, object):
1088
1440
    """A class to handle client connections.
1089
1441
    
1092
1444
    
1093
1445
    def handle(self):
1094
1446
        with contextlib.closing(self.server.child_pipe) as child_pipe:
1095
 
            logger.info(u"TCP connection from: %s",
 
1447
            logger.info("TCP connection from: %s",
1096
1448
                        unicode(self.client_address))
1097
 
            logger.debug(u"Pipe FD: %d",
 
1449
            logger.debug("Pipe FD: %d",
1098
1450
                         self.server.child_pipe.fileno())
1099
 
 
 
1451
            
1100
1452
            session = (gnutls.connection
1101
1453
                       .ClientSession(self.request,
1102
1454
                                      gnutls.connection
1103
1455
                                      .X509Credentials()))
1104
 
 
 
1456
            
1105
1457
            # Note: gnutls.connection.X509Credentials is really a
1106
1458
            # generic GnuTLS certificate credentials object so long as
1107
1459
            # no X.509 keys are added to it.  Therefore, we can use it
1108
1460
            # here despite using OpenPGP certificates.
1109
 
 
1110
 
            #priority = u':'.join((u"NONE", u"+VERS-TLS1.1",
1111
 
            #                      u"+AES-256-CBC", u"+SHA1",
1112
 
            #                      u"+COMP-NULL", u"+CTYPE-OPENPGP",
1113
 
            #                      u"+DHE-DSS"))
 
1461
            
 
1462
            #priority = ':'.join(("NONE", "+VERS-TLS1.1",
 
1463
            #                      "+AES-256-CBC", "+SHA1",
 
1464
            #                      "+COMP-NULL", "+CTYPE-OPENPGP",
 
1465
            #                      "+DHE-DSS"))
1114
1466
            # Use a fallback default, since this MUST be set.
1115
1467
            priority = self.server.gnutls_priority
1116
1468
            if priority is None:
1117
 
                priority = u"NORMAL"
 
1469
                priority = "NORMAL"
1118
1470
            (gnutls.library.functions
1119
1471
             .gnutls_priority_set_direct(session._c_object,
1120
1472
                                         priority, None))
1121
 
 
 
1473
            
1122
1474
            # Start communication using the Mandos protocol
1123
1475
            # Get protocol number
1124
1476
            line = self.request.makefile().readline()
1125
 
            logger.debug(u"Protocol version: %r", line)
 
1477
            logger.debug("Protocol version: %r", line)
1126
1478
            try:
1127
1479
                if int(line.strip().split()[0]) > 1:
1128
1480
                    raise RuntimeError
1129
 
            except (ValueError, IndexError, RuntimeError), error:
1130
 
                logger.error(u"Unknown protocol version: %s", error)
 
1481
            except (ValueError, IndexError, RuntimeError) as error:
 
1482
                logger.error("Unknown protocol version: %s", error)
1131
1483
                return
1132
 
 
 
1484
            
1133
1485
            # Start GnuTLS connection
1134
1486
            try:
1135
1487
                session.handshake()
1136
 
            except gnutls.errors.GNUTLSError, error:
1137
 
                logger.warning(u"Handshake failed: %s", error)
 
1488
            except gnutls.errors.GNUTLSError as error:
 
1489
                logger.warning("Handshake failed: %s", error)
1138
1490
                # Do not run session.bye() here: the session is not
1139
1491
                # established.  Just abandon the request.
1140
1492
                return
1141
 
            logger.debug(u"Handshake succeeded")
1142
 
 
 
1493
            logger.debug("Handshake succeeded")
 
1494
            
1143
1495
            approval_required = False
1144
1496
            try:
1145
1497
                try:
1146
1498
                    fpr = self.fingerprint(self.peer_certificate
1147
1499
                                           (session))
1148
 
                except (TypeError, gnutls.errors.GNUTLSError), error:
1149
 
                    logger.warning(u"Bad certificate: %s", error)
 
1500
                except (TypeError,
 
1501
                        gnutls.errors.GNUTLSError) as error:
 
1502
                    logger.warning("Bad certificate: %s", error)
1150
1503
                    return
1151
 
                logger.debug(u"Fingerprint: %s", fpr)
1152
 
 
 
1504
                logger.debug("Fingerprint: %s", fpr)
 
1505
                if self.server.use_dbus:
 
1506
                    # Emit D-Bus signal
 
1507
                    client.NewRequest(str(self.client_address))
 
1508
                
1153
1509
                try:
1154
1510
                    client = ProxyClient(child_pipe, fpr,
1155
1511
                                         self.client_address)
1156
1512
                except KeyError:
1157
1513
                    return
1158
1514
                
1159
 
                if client.approved_delay:
1160
 
                    delay = client.approved_delay
 
1515
                if client.approval_delay:
 
1516
                    delay = client.approval_delay
1161
1517
                    client.approvals_pending += 1
1162
1518
                    approval_required = True
1163
1519
                
1164
1520
                while True:
1165
1521
                    if not client.enabled:
1166
 
                        logger.warning(u"Client %s is disabled",
 
1522
                        logger.info("Client %s is disabled",
1167
1523
                                       client.name)
1168
1524
                        if self.server.use_dbus:
1169
1525
                            # Emit D-Bus signal
1170
 
                            client.Rejected("Disabled")                    
 
1526
                            client.Rejected("Disabled")
1171
1527
                        return
1172
1528
                    
1173
 
                    if client._approved or not client.approved_delay:
 
1529
                    if client._approved or not client.approval_delay:
1174
1530
                        #We are approved or approval is disabled
1175
1531
                        break
1176
1532
                    elif client._approved is None:
1177
 
                        logger.info(u"Client %s need approval",
 
1533
                        logger.info("Client %s needs approval",
1178
1534
                                    client.name)
1179
1535
                        if self.server.use_dbus:
1180
1536
                            # Emit D-Bus signal
1181
1537
                            client.NeedApproval(
1182
 
                                client.approved_delay_milliseconds(),
 
1538
                                client.approval_delay_milliseconds(),
1183
1539
                                client.approved_by_default)
1184
1540
                    else:
1185
 
                        logger.warning(u"Client %s was not approved",
 
1541
                        logger.warning("Client %s was not approved",
1186
1542
                                       client.name)
1187
1543
                        if self.server.use_dbus:
1188
1544
                            # Emit D-Bus signal
1189
 
                            client.Rejected("Disapproved")
 
1545
                            client.Rejected("Denied")
1190
1546
                        return
1191
1547
                    
1192
1548
                    #wait until timeout or approved
1193
 
                    #x = float(client._timedelta_to_milliseconds(delay))
1194
1549
                    time = datetime.datetime.now()
1195
1550
                    client.changedstate.acquire()
1196
 
                    client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))
 
1551
                    (client.changedstate.wait
 
1552
                     (float(client._timedelta_to_milliseconds(delay)
 
1553
                            / 1000)))
1197
1554
                    client.changedstate.release()
1198
1555
                    time2 = datetime.datetime.now()
1199
1556
                    if (time2 - time) >= delay:
1203
1560
                                           client.name)
1204
1561
                            if self.server.use_dbus:
1205
1562
                                # Emit D-Bus signal
1206
 
                                client.Rejected("Time out")
 
1563
                                client.Rejected("Approval timed out")
1207
1564
                            return
1208
1565
                        else:
1209
1566
                            break
1212
1569
                
1213
1570
                sent_size = 0
1214
1571
                while sent_size < len(client.secret):
1215
 
                    # XXX handle session exception
1216
 
                    sent = session.send(client.secret[sent_size:])
1217
 
                    logger.debug(u"Sent: %d, remaining: %d",
 
1572
                    try:
 
1573
                        sent = session.send(client.secret[sent_size:])
 
1574
                    except gnutls.errors.GNUTLSError as error:
 
1575
                        logger.warning("gnutls send failed")
 
1576
                        return
 
1577
                    logger.debug("Sent: %d, remaining: %d",
1218
1578
                                 sent, len(client.secret)
1219
1579
                                 - (sent_size + sent))
1220
1580
                    sent_size += sent
1221
 
 
1222
 
                logger.info(u"Sending secret to %s", client.name)
1223
 
                # bump the timeout as if seen
1224
 
                client.checked_ok()
 
1581
                
 
1582
                logger.info("Sending secret to %s", client.name)
 
1583
                # bump the timeout using extended_timeout
 
1584
                client.checked_ok(client.extended_timeout)
1225
1585
                if self.server.use_dbus:
1226
1586
                    # Emit D-Bus signal
1227
1587
                    client.GotSecret()
1229
1589
            finally:
1230
1590
                if approval_required:
1231
1591
                    client.approvals_pending -= 1
1232
 
                session.bye()
 
1592
                try:
 
1593
                    session.bye()
 
1594
                except gnutls.errors.GNUTLSError as error:
 
1595
                    logger.warning("GnuTLS bye failed")
1233
1596
    
1234
1597
    @staticmethod
1235
1598
    def peer_certificate(session):
1245
1608
                     .gnutls_certificate_get_peers
1246
1609
                     (session._c_object, ctypes.byref(list_size)))
1247
1610
        if not bool(cert_list) and list_size.value != 0:
1248
 
            raise gnutls.errors.GNUTLSError(u"error getting peer"
1249
 
                                            u" certificate")
 
1611
            raise gnutls.errors.GNUTLSError("error getting peer"
 
1612
                                            " certificate")
1250
1613
        if list_size.value == 0:
1251
1614
            return None
1252
1615
        cert = cert_list[0]
1278
1641
        if crtverify.value != 0:
1279
1642
            gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1280
1643
            raise (gnutls.errors.CertificateSecurityError
1281
 
                   (u"Verify failed"))
 
1644
                   ("Verify failed"))
1282
1645
        # New buffer for the fingerprint
1283
1646
        buf = ctypes.create_string_buffer(20)
1284
1647
        buf_len = ctypes.c_size_t()
1291
1654
        # Convert the buffer to a Python bytestring
1292
1655
        fpr = ctypes.string_at(buf, buf_len.value)
1293
1656
        # Convert the bytestring to hexadecimal notation
1294
 
        hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
 
1657
        hex_fpr = binascii.hexlify(fpr).upper()
1295
1658
        return hex_fpr
1296
1659
 
1297
1660
 
1303
1666
        except:
1304
1667
            self.handle_error(request, address)
1305
1668
        self.close_request(request)
1306
 
            
 
1669
    
1307
1670
    def process_request(self, request, address):
1308
1671
        """Start a new process to process the request."""
1309
 
        multiprocessing.Process(target = self.sub_process_main,
1310
 
                                args = (request, address)).start()
 
1672
        proc = multiprocessing.Process(target = self.sub_process_main,
 
1673
                                       args = (request,
 
1674
                                               address))
 
1675
        proc.start()
 
1676
        return proc
 
1677
 
1311
1678
 
1312
1679
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
1313
1680
    """ adds a pipe to the MixIn """
1317
1684
        This function creates a new pipe in self.pipe
1318
1685
        """
1319
1686
        parent_pipe, self.child_pipe = multiprocessing.Pipe()
1320
 
 
1321
 
        super(MultiprocessingMixInWithPipe,
1322
 
              self).process_request(request, client_address)
 
1687
        
 
1688
        proc = MultiprocessingMixIn.process_request(self, request,
 
1689
                                                    client_address)
1323
1690
        self.child_pipe.close()
1324
 
        self.add_pipe(parent_pipe)
1325
 
        
1326
 
    def add_pipe(self, parent_pipe):
 
1691
        self.add_pipe(parent_pipe, proc)
 
1692
    
 
1693
    def add_pipe(self, parent_pipe, proc):
1327
1694
        """Dummy function; override as necessary"""
1328
 
        pass
 
1695
        raise NotImplementedError
 
1696
 
1329
1697
 
1330
1698
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
1331
1699
                     socketserver.TCPServer, object):
1349
1717
        bind to an address or port if they were not specified."""
1350
1718
        if self.interface is not None:
1351
1719
            if SO_BINDTODEVICE is None:
1352
 
                logger.error(u"SO_BINDTODEVICE does not exist;"
1353
 
                             u" cannot bind to interface %s",
 
1720
                logger.error("SO_BINDTODEVICE does not exist;"
 
1721
                             " cannot bind to interface %s",
1354
1722
                             self.interface)
1355
1723
            else:
1356
1724
                try:
1357
1725
                    self.socket.setsockopt(socket.SOL_SOCKET,
1358
1726
                                           SO_BINDTODEVICE,
1359
1727
                                           str(self.interface
1360
 
                                               + u'\0'))
1361
 
                except socket.error, error:
 
1728
                                               + '\0'))
 
1729
                except socket.error as error:
1362
1730
                    if error[0] == errno.EPERM:
1363
 
                        logger.error(u"No permission to"
1364
 
                                     u" bind to interface %s",
 
1731
                        logger.error("No permission to"
 
1732
                                     " bind to interface %s",
1365
1733
                                     self.interface)
1366
1734
                    elif error[0] == errno.ENOPROTOOPT:
1367
 
                        logger.error(u"SO_BINDTODEVICE not available;"
1368
 
                                     u" cannot bind to interface %s",
 
1735
                        logger.error("SO_BINDTODEVICE not available;"
 
1736
                                     " cannot bind to interface %s",
1369
1737
                                     self.interface)
1370
1738
                    else:
1371
1739
                        raise
1373
1741
        if self.server_address[0] or self.server_address[1]:
1374
1742
            if not self.server_address[0]:
1375
1743
                if self.address_family == socket.AF_INET6:
1376
 
                    any_address = u"::" # in6addr_any
 
1744
                    any_address = "::" # in6addr_any
1377
1745
                else:
1378
1746
                    any_address = socket.INADDR_ANY
1379
1747
                self.server_address = (any_address,
1406
1774
        self.enabled = False
1407
1775
        self.clients = clients
1408
1776
        if self.clients is None:
1409
 
            self.clients = set()
 
1777
            self.clients = {}
1410
1778
        self.use_dbus = use_dbus
1411
1779
        self.gnutls_priority = gnutls_priority
1412
1780
        IPv6_TCPServer.__init__(self, server_address,
1416
1784
    def server_activate(self):
1417
1785
        if self.enabled:
1418
1786
            return socketserver.TCPServer.server_activate(self)
 
1787
    
1419
1788
    def enable(self):
1420
1789
        self.enabled = True
1421
 
    def add_pipe(self, parent_pipe):
 
1790
    
 
1791
    def add_pipe(self, parent_pipe, proc):
1422
1792
        # Call "handle_ipc" for both data and EOF events
1423
1793
        gobject.io_add_watch(parent_pipe.fileno(),
1424
1794
                             gobject.IO_IN | gobject.IO_HUP,
1425
1795
                             functools.partial(self.handle_ipc,
1426
 
                                               parent_pipe = parent_pipe))
1427
 
        
 
1796
                                               parent_pipe =
 
1797
                                               parent_pipe,
 
1798
                                               proc = proc))
 
1799
    
1428
1800
    def handle_ipc(self, source, condition, parent_pipe=None,
1429
 
                   client_object=None):
 
1801
                   proc = None, client_object=None):
1430
1802
        condition_names = {
1431
 
            gobject.IO_IN: u"IN",   # There is data to read.
1432
 
            gobject.IO_OUT: u"OUT", # Data can be written (without
 
1803
            gobject.IO_IN: "IN",   # There is data to read.
 
1804
            gobject.IO_OUT: "OUT", # Data can be written (without
1433
1805
                                    # blocking).
1434
 
            gobject.IO_PRI: u"PRI", # There is urgent data to read.
1435
 
            gobject.IO_ERR: u"ERR", # Error condition.
1436
 
            gobject.IO_HUP: u"HUP"  # Hung up (the connection has been
 
1806
            gobject.IO_PRI: "PRI", # There is urgent data to read.
 
1807
            gobject.IO_ERR: "ERR", # Error condition.
 
1808
            gobject.IO_HUP: "HUP"  # Hung up (the connection has been
1437
1809
                                    # broken, usually for pipes and
1438
1810
                                    # sockets).
1439
1811
            }
1441
1813
                                       for cond, name in
1442
1814
                                       condition_names.iteritems()
1443
1815
                                       if cond & condition)
1444
 
        logger.debug(u"Handling IPC: FD = %d, condition = %s", source,
1445
 
                     conditions_string)
1446
 
 
1447
 
        # error or the other end of multiprocessing.Pipe has closed
1448
 
        if condition & gobject.IO_HUP or condition & gobject.IO_ERR:
 
1816
        # error, or the other end of multiprocessing.Pipe has closed
 
1817
        if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):
 
1818
            # Wait for other process to exit
 
1819
            proc.join()
1449
1820
            return False
1450
1821
        
1451
1822
        # Read a request from the child
1452
1823
        request = parent_pipe.recv()
1453
 
        logger.debug(u"IPC request: %s", repr(request))
1454
1824
        command = request[0]
1455
1825
        
1456
1826
        if command == 'init':
1457
1827
            fpr = request[1]
1458
1828
            address = request[2]
1459
1829
            
1460
 
            for c in self.clients:
 
1830
            for c in self.clients.itervalues():
1461
1831
                if c.fingerprint == fpr:
1462
1832
                    client = c
1463
1833
                    break
1464
1834
            else:
1465
 
                logger.warning(u"Client not found for fingerprint: %s, ad"
1466
 
                               u"dress: %s", fpr, address)
 
1835
                logger.info("Client not found for fingerprint: %s, ad"
 
1836
                            "dress: %s", fpr, address)
1467
1837
                if self.use_dbus:
1468
1838
                    # Emit D-Bus signal
1469
 
                    mandos_dbus_service.ClientNotFound(fpr, address)
 
1839
                    mandos_dbus_service.ClientNotFound(fpr,
 
1840
                                                       address[0])
1470
1841
                parent_pipe.send(False)
1471
1842
                return False
1472
1843
            
1473
1844
            gobject.io_add_watch(parent_pipe.fileno(),
1474
1845
                                 gobject.IO_IN | gobject.IO_HUP,
1475
1846
                                 functools.partial(self.handle_ipc,
1476
 
                                                   parent_pipe = parent_pipe,
1477
 
                                                   client_object = client))
 
1847
                                                   parent_pipe =
 
1848
                                                   parent_pipe,
 
1849
                                                   proc = proc,
 
1850
                                                   client_object =
 
1851
                                                   client))
1478
1852
            parent_pipe.send(True)
1479
 
            # remove the old hook in favor of the new above hook on same fileno
 
1853
            # remove the old hook in favor of the new above hook on
 
1854
            # same fileno
1480
1855
            return False
1481
1856
        if command == 'funcall':
1482
1857
            funcname = request[1]
1483
1858
            args = request[2]
1484
1859
            kwargs = request[3]
1485
1860
            
1486
 
            parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))
1487
 
 
 
1861
            parent_pipe.send(('data', getattr(client_object,
 
1862
                                              funcname)(*args,
 
1863
                                                         **kwargs)))
 
1864
        
1488
1865
        if command == 'getattr':
1489
1866
            attrname = request[1]
1490
1867
            if callable(client_object.__getattribute__(attrname)):
1491
1868
                parent_pipe.send(('function',))
1492
1869
            else:
1493
 
                parent_pipe.send(('data', client_object.__getattribute__(attrname)))
1494
 
 
 
1870
                parent_pipe.send(('data', client_object
 
1871
                                  .__getattribute__(attrname)))
 
1872
        
1495
1873
        if command == 'setattr':
1496
1874
            attrname = request[1]
1497
1875
            value = request[2]
1498
1876
            setattr(client_object, attrname, value)
1499
 
            
 
1877
        
1500
1878
        return True
1501
1879
 
1502
1880
 
1503
1881
def string_to_delta(interval):
1504
1882
    """Parse a string and return a datetime.timedelta
1505
1883
    
1506
 
    >>> string_to_delta(u'7d')
 
1884
    >>> string_to_delta('7d')
1507
1885
    datetime.timedelta(7)
1508
 
    >>> string_to_delta(u'60s')
 
1886
    >>> string_to_delta('60s')
1509
1887
    datetime.timedelta(0, 60)
1510
 
    >>> string_to_delta(u'60m')
 
1888
    >>> string_to_delta('60m')
1511
1889
    datetime.timedelta(0, 3600)
1512
 
    >>> string_to_delta(u'24h')
 
1890
    >>> string_to_delta('24h')
1513
1891
    datetime.timedelta(1)
1514
 
    >>> string_to_delta(u'1w')
 
1892
    >>> string_to_delta('1w')
1515
1893
    datetime.timedelta(7)
1516
 
    >>> string_to_delta(u'5m 30s')
 
1894
    >>> string_to_delta('5m 30s')
1517
1895
    datetime.timedelta(0, 330)
1518
1896
    """
1519
1897
    timevalue = datetime.timedelta(0)
1521
1899
        try:
1522
1900
            suffix = unicode(s[-1])
1523
1901
            value = int(s[:-1])
1524
 
            if suffix == u"d":
 
1902
            if suffix == "d":
1525
1903
                delta = datetime.timedelta(value)
1526
 
            elif suffix == u"s":
 
1904
            elif suffix == "s":
1527
1905
                delta = datetime.timedelta(0, value)
1528
 
            elif suffix == u"m":
 
1906
            elif suffix == "m":
1529
1907
                delta = datetime.timedelta(0, 0, 0, 0, value)
1530
 
            elif suffix == u"h":
 
1908
            elif suffix == "h":
1531
1909
                delta = datetime.timedelta(0, 0, 0, 0, 0, value)
1532
 
            elif suffix == u"w":
 
1910
            elif suffix == "w":
1533
1911
                delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
1534
1912
            else:
1535
 
                raise ValueError(u"Unknown suffix %r" % suffix)
1536
 
        except (ValueError, IndexError), e:
1537
 
            raise ValueError(e.message)
 
1913
                raise ValueError("Unknown suffix %r" % suffix)
 
1914
        except (ValueError, IndexError) as e:
 
1915
            raise ValueError(*(e.args))
1538
1916
        timevalue += delta
1539
1917
    return timevalue
1540
1918
 
1541
1919
 
1542
 
def if_nametoindex(interface):
1543
 
    """Call the C function if_nametoindex(), or equivalent
1544
 
    
1545
 
    Note: This function cannot accept a unicode string."""
1546
 
    global if_nametoindex
1547
 
    try:
1548
 
        if_nametoindex = (ctypes.cdll.LoadLibrary
1549
 
                          (ctypes.util.find_library(u"c"))
1550
 
                          .if_nametoindex)
1551
 
    except (OSError, AttributeError):
1552
 
        logger.warning(u"Doing if_nametoindex the hard way")
1553
 
        def if_nametoindex(interface):
1554
 
            "Get an interface index the hard way, i.e. using fcntl()"
1555
 
            SIOCGIFINDEX = 0x8933  # From /usr/include/linux/sockios.h
1556
 
            with contextlib.closing(socket.socket()) as s:
1557
 
                ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
1558
 
                                    struct.pack(str(u"16s16x"),
1559
 
                                                interface))
1560
 
            interface_index = struct.unpack(str(u"I"),
1561
 
                                            ifreq[16:20])[0]
1562
 
            return interface_index
1563
 
    return if_nametoindex(interface)
1564
 
 
1565
 
 
1566
1920
def daemon(nochdir = False, noclose = False):
1567
1921
    """See daemon(3).  Standard BSD Unix function.
1568
1922
    
1571
1925
        sys.exit()
1572
1926
    os.setsid()
1573
1927
    if not nochdir:
1574
 
        os.chdir(u"/")
 
1928
        os.chdir("/")
1575
1929
    if os.fork():
1576
1930
        sys.exit()
1577
1931
    if not noclose:
1579
1933
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1580
1934
        if not stat.S_ISCHR(os.fstat(null).st_mode):
1581
1935
            raise OSError(errno.ENODEV,
1582
 
                          u"%s not a character device"
 
1936
                          "%s not a character device"
1583
1937
                          % os.path.devnull)
1584
1938
        os.dup2(null, sys.stdin.fileno())
1585
1939
        os.dup2(null, sys.stdout.fileno())
1593
1947
    ##################################################################
1594
1948
    # Parsing of options, both command line and config file
1595
1949
    
1596
 
    parser = optparse.OptionParser(version = "%%prog %s" % version)
1597
 
    parser.add_option("-i", u"--interface", type=u"string",
1598
 
                      metavar="IF", help=u"Bind to interface IF")
1599
 
    parser.add_option("-a", u"--address", type=u"string",
1600
 
                      help=u"Address to listen for requests on")
1601
 
    parser.add_option("-p", u"--port", type=u"int",
1602
 
                      help=u"Port number to receive requests on")
1603
 
    parser.add_option("--check", action=u"store_true",
1604
 
                      help=u"Run self-test")
1605
 
    parser.add_option("--debug", action=u"store_true",
1606
 
                      help=u"Debug mode; run in foreground and log to"
1607
 
                      u" terminal")
1608
 
    parser.add_option("--priority", type=u"string", help=u"GnuTLS"
1609
 
                      u" priority string (see GnuTLS documentation)")
1610
 
    parser.add_option("--servicename", type=u"string",
1611
 
                      metavar=u"NAME", help=u"Zeroconf service name")
1612
 
    parser.add_option("--configdir", type=u"string",
1613
 
                      default=u"/etc/mandos", metavar=u"DIR",
1614
 
                      help=u"Directory to search for configuration"
1615
 
                      u" files")
1616
 
    parser.add_option("--no-dbus", action=u"store_false",
1617
 
                      dest=u"use_dbus", help=u"Do not provide D-Bus"
1618
 
                      u" system bus interface")
1619
 
    parser.add_option("--no-ipv6", action=u"store_false",
1620
 
                      dest=u"use_ipv6", help=u"Do not use IPv6")
1621
 
    options = parser.parse_args()[0]
 
1950
    parser = argparse.ArgumentParser()
 
1951
    parser.add_argument("-v", "--version", action="version",
 
1952
                        version = "%%(prog)s %s" % version,
 
1953
                        help="show version number and exit")
 
1954
    parser.add_argument("-i", "--interface", metavar="IF",
 
1955
                        help="Bind to interface IF")
 
1956
    parser.add_argument("-a", "--address",
 
1957
                        help="Address to listen for requests on")
 
1958
    parser.add_argument("-p", "--port", type=int,
 
1959
                        help="Port number to receive requests on")
 
1960
    parser.add_argument("--check", action="store_true",
 
1961
                        help="Run self-test")
 
1962
    parser.add_argument("--debug", action="store_true",
 
1963
                        help="Debug mode; run in foreground and log"
 
1964
                        " to terminal")
 
1965
    parser.add_argument("--debuglevel", metavar="LEVEL",
 
1966
                        help="Debug level for stdout output")
 
1967
    parser.add_argument("--priority", help="GnuTLS"
 
1968
                        " priority string (see GnuTLS documentation)")
 
1969
    parser.add_argument("--servicename",
 
1970
                        metavar="NAME", help="Zeroconf service name")
 
1971
    parser.add_argument("--configdir",
 
1972
                        default="/etc/mandos", metavar="DIR",
 
1973
                        help="Directory to search for configuration"
 
1974
                        " files")
 
1975
    parser.add_argument("--no-dbus", action="store_false",
 
1976
                        dest="use_dbus", help="Do not provide D-Bus"
 
1977
                        " system bus interface")
 
1978
    parser.add_argument("--no-ipv6", action="store_false",
 
1979
                        dest="use_ipv6", help="Do not use IPv6")
 
1980
    parser.add_argument("--no-restore", action="store_false",
 
1981
                        dest="restore", help="Do not restore stored"
 
1982
                        " state")
 
1983
    parser.add_argument("--statedir", metavar="DIR",
 
1984
                        help="Directory to save/restore state in")
 
1985
    
 
1986
    options = parser.parse_args()
1622
1987
    
1623
1988
    if options.check:
1624
1989
        import doctest
1626
1991
        sys.exit()
1627
1992
    
1628
1993
    # Default values for config file for server-global settings
1629
 
    server_defaults = { u"interface": u"",
1630
 
                        u"address": u"",
1631
 
                        u"port": u"",
1632
 
                        u"debug": u"False",
1633
 
                        u"priority":
1634
 
                        u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
1635
 
                        u"servicename": u"Mandos",
1636
 
                        u"use_dbus": u"True",
1637
 
                        u"use_ipv6": u"True",
 
1994
    server_defaults = { "interface": "",
 
1995
                        "address": "",
 
1996
                        "port": "",
 
1997
                        "debug": "False",
 
1998
                        "priority":
 
1999
                        "SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
 
2000
                        "servicename": "Mandos",
 
2001
                        "use_dbus": "True",
 
2002
                        "use_ipv6": "True",
 
2003
                        "debuglevel": "",
 
2004
                        "restore": "True",
 
2005
                        "statedir": "/var/lib/mandos"
1638
2006
                        }
1639
2007
    
1640
2008
    # Parse config file for server-global settings
1641
2009
    server_config = configparser.SafeConfigParser(server_defaults)
1642
2010
    del server_defaults
1643
2011
    server_config.read(os.path.join(options.configdir,
1644
 
                                    u"mandos.conf"))
 
2012
                                    "mandos.conf"))
1645
2013
    # Convert the SafeConfigParser object to a dict
1646
2014
    server_settings = server_config.defaults()
1647
2015
    # Use the appropriate methods on the non-string config options
1648
 
    for option in (u"debug", u"use_dbus", u"use_ipv6"):
1649
 
        server_settings[option] = server_config.getboolean(u"DEFAULT",
 
2016
    for option in ("debug", "use_dbus", "use_ipv6"):
 
2017
        server_settings[option] = server_config.getboolean("DEFAULT",
1650
2018
                                                           option)
1651
2019
    if server_settings["port"]:
1652
 
        server_settings["port"] = server_config.getint(u"DEFAULT",
1653
 
                                                       u"port")
 
2020
        server_settings["port"] = server_config.getint("DEFAULT",
 
2021
                                                       "port")
1654
2022
    del server_config
1655
2023
    
1656
2024
    # Override the settings from the config file with command line
1657
2025
    # options, if set.
1658
 
    for option in (u"interface", u"address", u"port", u"debug",
1659
 
                   u"priority", u"servicename", u"configdir",
1660
 
                   u"use_dbus", u"use_ipv6"):
 
2026
    for option in ("interface", "address", "port", "debug",
 
2027
                   "priority", "servicename", "configdir",
 
2028
                   "use_dbus", "use_ipv6", "debuglevel", "restore",
 
2029
                   "statedir"):
1661
2030
        value = getattr(options, option)
1662
2031
        if value is not None:
1663
2032
            server_settings[option] = value
1671
2040
    ##################################################################
1672
2041
    
1673
2042
    # For convenience
1674
 
    debug = server_settings[u"debug"]
1675
 
    use_dbus = server_settings[u"use_dbus"]
1676
 
    use_ipv6 = server_settings[u"use_ipv6"]
1677
 
    
1678
 
    if not debug:
1679
 
        syslogger.setLevel(logging.WARNING)
1680
 
        console.setLevel(logging.WARNING)
1681
 
    
1682
 
    if server_settings[u"servicename"] != u"Mandos":
 
2043
    debug = server_settings["debug"]
 
2044
    debuglevel = server_settings["debuglevel"]
 
2045
    use_dbus = server_settings["use_dbus"]
 
2046
    use_ipv6 = server_settings["use_ipv6"]
 
2047
    stored_state_path = os.path.join(server_settings["statedir"],
 
2048
                                     stored_state_file)
 
2049
    
 
2050
    if debug:
 
2051
        initlogger(logging.DEBUG)
 
2052
    else:
 
2053
        if not debuglevel:
 
2054
            initlogger()
 
2055
        else:
 
2056
            level = getattr(logging, debuglevel.upper())
 
2057
            initlogger(level)
 
2058
    
 
2059
    if server_settings["servicename"] != "Mandos":
1683
2060
        syslogger.setFormatter(logging.Formatter
1684
 
                               (u'Mandos (%s) [%%(process)d]:'
1685
 
                                u' %%(levelname)s: %%(message)s'
1686
 
                                % server_settings[u"servicename"]))
 
2061
                               ('Mandos (%s) [%%(process)d]:'
 
2062
                                ' %%(levelname)s: %%(message)s'
 
2063
                                % server_settings["servicename"]))
1687
2064
    
1688
2065
    # Parse config file with clients
1689
 
    client_defaults = { u"timeout": u"1h",
1690
 
                        u"interval": u"5m",
1691
 
                        u"checker": u"fping -q -- %%(host)s",
1692
 
                        u"host": u"",
1693
 
                        u"approved_delay": u"5m",
1694
 
                        u"approved_duration": u"1s",
 
2066
    client_defaults = { "timeout": "5m",
 
2067
                        "extended_timeout": "15m",
 
2068
                        "interval": "2m",
 
2069
                        "checker": "fping -q -- %%(host)s",
 
2070
                        "host": "",
 
2071
                        "approval_delay": "0s",
 
2072
                        "approval_duration": "1s",
1695
2073
                        }
1696
2074
    client_config = configparser.SafeConfigParser(client_defaults)
1697
 
    client_config.read(os.path.join(server_settings[u"configdir"],
1698
 
                                    u"clients.conf"))
 
2075
    client_config.read(os.path.join(server_settings["configdir"],
 
2076
                                    "clients.conf"))
1699
2077
    
1700
2078
    global mandos_dbus_service
1701
2079
    mandos_dbus_service = None
1702
2080
    
1703
 
    tcp_server = MandosServer((server_settings[u"address"],
1704
 
                               server_settings[u"port"]),
 
2081
    tcp_server = MandosServer((server_settings["address"],
 
2082
                               server_settings["port"]),
1705
2083
                              ClientHandler,
1706
 
                              interface=server_settings[u"interface"],
 
2084
                              interface=(server_settings["interface"]
 
2085
                                         or None),
1707
2086
                              use_ipv6=use_ipv6,
1708
2087
                              gnutls_priority=
1709
 
                              server_settings[u"priority"],
 
2088
                              server_settings["priority"],
1710
2089
                              use_dbus=use_dbus)
1711
 
    pidfilename = u"/var/run/mandos.pid"
1712
 
    try:
1713
 
        pidfile = open(pidfilename, u"w")
1714
 
    except IOError:
1715
 
        logger.error(u"Could not open file %r", pidfilename)
 
2090
    if not debug:
 
2091
        pidfilename = "/var/run/mandos.pid"
 
2092
        try:
 
2093
            pidfile = open(pidfilename, "w")
 
2094
        except IOError:
 
2095
            logger.error("Could not open file %r", pidfilename)
1716
2096
    
1717
2097
    try:
1718
 
        uid = pwd.getpwnam(u"_mandos").pw_uid
1719
 
        gid = pwd.getpwnam(u"_mandos").pw_gid
 
2098
        uid = pwd.getpwnam("_mandos").pw_uid
 
2099
        gid = pwd.getpwnam("_mandos").pw_gid
1720
2100
    except KeyError:
1721
2101
        try:
1722
 
            uid = pwd.getpwnam(u"mandos").pw_uid
1723
 
            gid = pwd.getpwnam(u"mandos").pw_gid
 
2102
            uid = pwd.getpwnam("mandos").pw_uid
 
2103
            gid = pwd.getpwnam("mandos").pw_gid
1724
2104
        except KeyError:
1725
2105
            try:
1726
 
                uid = pwd.getpwnam(u"nobody").pw_uid
1727
 
                gid = pwd.getpwnam(u"nobody").pw_gid
 
2106
                uid = pwd.getpwnam("nobody").pw_uid
 
2107
                gid = pwd.getpwnam("nobody").pw_gid
1728
2108
            except KeyError:
1729
2109
                uid = 65534
1730
2110
                gid = 65534
1731
2111
    try:
1732
2112
        os.setgid(gid)
1733
2113
        os.setuid(uid)
1734
 
    except OSError, error:
 
2114
    except OSError as error:
1735
2115
        if error[0] != errno.EPERM:
1736
2116
            raise error
1737
2117
    
1738
 
    # Enable all possible GnuTLS debugging
1739
2118
    if debug:
 
2119
        # Enable all possible GnuTLS debugging
 
2120
        
1740
2121
        # "Use a log level over 10 to enable all debugging options."
1741
2122
        # - GnuTLS manual
1742
2123
        gnutls.library.functions.gnutls_global_set_log_level(11)
1743
2124
        
1744
2125
        @gnutls.library.types.gnutls_log_func
1745
2126
        def debug_gnutls(level, string):
1746
 
            logger.debug(u"GnuTLS: %s", string[:-1])
 
2127
            logger.debug("GnuTLS: %s", string[:-1])
1747
2128
        
1748
2129
        (gnutls.library.functions
1749
2130
         .gnutls_global_set_log_function(debug_gnutls))
 
2131
        
 
2132
        # Redirect stdin so all checkers get /dev/null
 
2133
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
 
2134
        os.dup2(null, sys.stdin.fileno())
 
2135
        if null > 2:
 
2136
            os.close(null)
 
2137
    else:
 
2138
        # No console logging
 
2139
        logger.removeHandler(console)
 
2140
    
 
2141
    # Need to fork before connecting to D-Bus
 
2142
    if not debug:
 
2143
        # Close all input and output, do double fork, etc.
 
2144
        daemon()
1750
2145
    
1751
2146
    global main_loop
1752
2147
    # From the Avahi example code
1756
2151
    # End of Avahi example code
1757
2152
    if use_dbus:
1758
2153
        try:
1759
 
            bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos",
 
2154
            bus_name = dbus.service.BusName("se.recompile.Mandos",
1760
2155
                                            bus, do_not_queue=True)
1761
 
        except dbus.exceptions.NameExistsException, e:
1762
 
            logger.error(unicode(e) + u", disabling D-Bus")
 
2156
            old_bus_name = (dbus.service.BusName
 
2157
                            ("se.bsnet.fukt.Mandos", bus,
 
2158
                             do_not_queue=True))
 
2159
        except dbus.exceptions.NameExistsException as e:
 
2160
            logger.error(unicode(e) + ", disabling D-Bus")
1763
2161
            use_dbus = False
1764
 
            server_settings[u"use_dbus"] = False
 
2162
            server_settings["use_dbus"] = False
1765
2163
            tcp_server.use_dbus = False
1766
2164
    protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
1767
 
    service = AvahiService(name = server_settings[u"servicename"],
1768
 
                           servicetype = u"_mandos._tcp",
1769
 
                           protocol = protocol, bus = bus)
 
2165
    service = AvahiServiceToSyslog(name =
 
2166
                                   server_settings["servicename"],
 
2167
                                   servicetype = "_mandos._tcp",
 
2168
                                   protocol = protocol, bus = bus)
1770
2169
    if server_settings["interface"]:
1771
2170
        service.interface = (if_nametoindex
1772
 
                             (str(server_settings[u"interface"])))
1773
 
 
 
2171
                             (str(server_settings["interface"])))
 
2172
    
1774
2173
    global multiprocessing_manager
1775
2174
    multiprocessing_manager = multiprocessing.Manager()
1776
2175
    
1777
2176
    client_class = Client
1778
2177
    if use_dbus:
1779
 
        client_class = functools.partial(ClientDBus, bus = bus)
1780
 
    def client_config_items(config, section):
1781
 
        special_settings = {
1782
 
            "approved_by_default":
1783
 
                lambda: config.getboolean(section,
1784
 
                                          "approved_by_default"),
1785
 
            }
1786
 
        for name, value in config.items(section):
 
2178
        client_class = functools.partial(ClientDBusTransitional,
 
2179
                                         bus = bus)
 
2180
    
 
2181
    special_settings = {
 
2182
        # Some settings need to be accessd by special methods;
 
2183
        # booleans need .getboolean(), etc.  Here is a list of them:
 
2184
        "approved_by_default":
 
2185
            lambda section:
 
2186
            client_config.getboolean(section, "approved_by_default"),
 
2187
        "enabled":
 
2188
            lambda section:
 
2189
            client_config.getboolean(section, "enabled"),
 
2190
        }
 
2191
    # Construct a new dict of client settings of this form:
 
2192
    # { client_name: {setting_name: value, ...}, ...}
 
2193
    # with exceptions for any special settings as defined above
 
2194
    client_settings = dict((clientname,
 
2195
                           dict((setting,
 
2196
                                 (value
 
2197
                                  if setting not in special_settings
 
2198
                                  else special_settings[setting]
 
2199
                                  (clientname)))
 
2200
                                for setting, value in
 
2201
                                client_config.items(clientname)))
 
2202
                          for clientname in client_config.sections())
 
2203
    
 
2204
    old_client_settings = {}
 
2205
    clients_data = []
 
2206
    
 
2207
    # Get client data and settings from last running state.
 
2208
    if server_settings["restore"]:
 
2209
        try:
 
2210
            with open(stored_state_path, "rb") as stored_state:
 
2211
                clients_data, old_client_settings = (pickle.load
 
2212
                                                     (stored_state))
 
2213
            os.remove(stored_state_path)
 
2214
        except IOError as e:
 
2215
            logger.warning("Could not load persistent state: {0}"
 
2216
                           .format(e))
 
2217
            if e.errno != errno.ENOENT:
 
2218
                raise
 
2219
    
 
2220
    with Crypto() as crypt:
 
2221
        for client in clients_data:
 
2222
            client_name = client["name"]
 
2223
            
 
2224
            # Decide which value to use after restoring saved state.
 
2225
            # We have three different values: Old config file,
 
2226
            # new config file, and saved state.
 
2227
            # New config value takes precedence if it differs from old
 
2228
            # config value, otherwise use saved state.
 
2229
            for name, value in client_settings[client_name].items():
 
2230
                try:
 
2231
                    # For each value in new config, check if it
 
2232
                    # differs from the old config value (Except for
 
2233
                    # the "secret" attribute)
 
2234
                    if (name != "secret" and
 
2235
                        value != old_client_settings[client_name]
 
2236
                        [name]):
 
2237
                        setattr(client, name, value)
 
2238
                except KeyError:
 
2239
                    pass
 
2240
            
 
2241
            # Clients who has passed its expire date can still be
 
2242
            # enabled if its last checker was sucessful.  Clients
 
2243
            # whose checker failed before we stored its state is
 
2244
            # assumed to have failed all checkers during downtime.
 
2245
            if client["enabled"] and client["last_checked_ok"]:
 
2246
                if ((datetime.datetime.utcnow()
 
2247
                     - client["last_checked_ok"])
 
2248
                    > client["interval"]):
 
2249
                    if client["last_checker_status"] != 0:
 
2250
                        client["enabled"] = False
 
2251
                    else:
 
2252
                        client["expires"] = (datetime.datetime
 
2253
                                             .utcnow()
 
2254
                                             + client["timeout"])
 
2255
            
 
2256
            client["changedstate"] = (multiprocessing_manager
 
2257
                                      .Condition
 
2258
                                      (multiprocessing_manager
 
2259
                                       .Lock()))
 
2260
            if use_dbus:
 
2261
                new_client = (ClientDBusTransitional.__new__
 
2262
                              (ClientDBusTransitional))
 
2263
                tcp_server.clients[client_name] = new_client
 
2264
                new_client.bus = bus
 
2265
                for name, value in client.iteritems():
 
2266
                    setattr(new_client, name, value)
 
2267
                client_object_name = unicode(client_name).translate(
 
2268
                    {ord("."): ord("_"),
 
2269
                     ord("-"): ord("_")})
 
2270
                new_client.dbus_object_path = (dbus.ObjectPath
 
2271
                                               ("/clients/"
 
2272
                                                + client_object_name))
 
2273
                DBusObjectWithProperties.__init__(new_client,
 
2274
                                                  new_client.bus,
 
2275
                                                  new_client
 
2276
                                                  .dbus_object_path)
 
2277
            else:
 
2278
                tcp_server.clients[client_name] = (Client.__new__
 
2279
                                                   (Client))
 
2280
                for name, value in client.iteritems():
 
2281
                    setattr(tcp_server.clients[client_name],
 
2282
                            name, value)
 
2283
            
1787
2284
            try:
1788
 
                yield (name, special_settings[name]())
1789
 
            except KeyError:
1790
 
                yield (name, value)
1791
 
    
1792
 
    tcp_server.clients.update(set(
1793
 
            client_class(name = section,
1794
 
                         config= dict(client_config_items(
1795
 
                        client_config, section)))
1796
 
            for section in client_config.sections()))
 
2285
                tcp_server.clients[client_name].secret = (
 
2286
                    crypt.decrypt(tcp_server.clients[client_name]
 
2287
                                  .encrypted_secret,
 
2288
                                  client_settings[client_name]
 
2289
                                  ["secret"]))
 
2290
            except CryptoError:
 
2291
                # If decryption fails, we use secret from new settings
 
2292
                tcp_server.clients[client_name].secret = (
 
2293
                    client_settings[client_name]["secret"])
 
2294
    
 
2295
    # Create/remove clients based on new changes made to config
 
2296
    for clientname in set(old_client_settings) - set(client_settings):
 
2297
        del tcp_server.clients[clientname]
 
2298
    for clientname in set(client_settings) - set(old_client_settings):
 
2299
        tcp_server.clients[clientname] = (client_class(name
 
2300
                                                       = clientname,
 
2301
                                                       config =
 
2302
                                                       client_settings
 
2303
                                                       [clientname]))
 
2304
    
1797
2305
    if not tcp_server.clients:
1798
 
        logger.warning(u"No clients defined")
1799
 
    
1800
 
    if debug:
1801
 
        # Redirect stdin so all checkers get /dev/null
1802
 
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1803
 
        os.dup2(null, sys.stdin.fileno())
1804
 
        if null > 2:
1805
 
            os.close(null)
1806
 
    else:
1807
 
        # No console logging
1808
 
        logger.removeHandler(console)
1809
 
        # Close all input and output, do double fork, etc.
1810
 
        daemon()
1811
 
    
1812
 
    try:
1813
 
        with pidfile:
1814
 
            pid = os.getpid()
1815
 
            pidfile.write(str(pid) + "\n")
1816
 
        del pidfile
1817
 
    except IOError:
1818
 
        logger.error(u"Could not write to file %r with PID %d",
1819
 
                     pidfilename, pid)
1820
 
    except NameError:
1821
 
        # "pidfile" was never created
1822
 
        pass
1823
 
    del pidfilename
1824
 
    
 
2306
        logger.warning("No clients defined")
 
2307
        
1825
2308
    if not debug:
 
2309
        try:
 
2310
            with pidfile:
 
2311
                pid = os.getpid()
 
2312
                pidfile.write(str(pid) + "\n".encode("utf-8"))
 
2313
            del pidfile
 
2314
        except IOError:
 
2315
            logger.error("Could not write to file %r with PID %d",
 
2316
                         pidfilename, pid)
 
2317
        except NameError:
 
2318
            # "pidfile" was never created
 
2319
            pass
 
2320
        del pidfilename
 
2321
        
1826
2322
        signal.signal(signal.SIGINT, signal.SIG_IGN)
 
2323
    
1827
2324
    signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
1828
2325
    signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
1829
2326
    
1831
2328
        class MandosDBusService(dbus.service.Object):
1832
2329
            """A D-Bus proxy object"""
1833
2330
            def __init__(self):
1834
 
                dbus.service.Object.__init__(self, bus, u"/")
1835
 
            _interface = u"se.bsnet.fukt.Mandos"
 
2331
                dbus.service.Object.__init__(self, bus, "/")
 
2332
            _interface = "se.recompile.Mandos"
1836
2333
            
1837
 
            @dbus.service.signal(_interface, signature=u"o")
 
2334
            @dbus.service.signal(_interface, signature="o")
1838
2335
            def ClientAdded(self, objpath):
1839
2336
                "D-Bus signal"
1840
2337
                pass
1841
2338
            
1842
 
            @dbus.service.signal(_interface, signature=u"ss")
 
2339
            @dbus.service.signal(_interface, signature="ss")
1843
2340
            def ClientNotFound(self, fingerprint, address):
1844
2341
                "D-Bus signal"
1845
2342
                pass
1846
2343
            
1847
 
            @dbus.service.signal(_interface, signature=u"os")
 
2344
            @dbus.service.signal(_interface, signature="os")
1848
2345
            def ClientRemoved(self, objpath, name):
1849
2346
                "D-Bus signal"
1850
2347
                pass
1851
2348
            
1852
 
            @dbus.service.method(_interface, out_signature=u"ao")
 
2349
            @dbus.service.method(_interface, out_signature="ao")
1853
2350
            def GetAllClients(self):
1854
2351
                "D-Bus method"
1855
2352
                return dbus.Array(c.dbus_object_path
1856
 
                                  for c in tcp_server.clients)
 
2353
                                  for c in
 
2354
                                  tcp_server.clients.itervalues())
1857
2355
            
1858
2356
            @dbus.service.method(_interface,
1859
 
                                 out_signature=u"a{oa{sv}}")
 
2357
                                 out_signature="a{oa{sv}}")
1860
2358
            def GetAllClientsWithProperties(self):
1861
2359
                "D-Bus method"
1862
2360
                return dbus.Dictionary(
1863
 
                    ((c.dbus_object_path, c.GetAll(u""))
1864
 
                     for c in tcp_server.clients),
1865
 
                    signature=u"oa{sv}")
 
2361
                    ((c.dbus_object_path, c.GetAll(""))
 
2362
                     for c in tcp_server.clients.itervalues()),
 
2363
                    signature="oa{sv}")
1866
2364
            
1867
 
            @dbus.service.method(_interface, in_signature=u"o")
 
2365
            @dbus.service.method(_interface, in_signature="o")
1868
2366
            def RemoveClient(self, object_path):
1869
2367
                "D-Bus method"
1870
 
                for c in tcp_server.clients:
 
2368
                for c in tcp_server.clients.itervalues():
1871
2369
                    if c.dbus_object_path == object_path:
1872
 
                        tcp_server.clients.remove(c)
 
2370
                        del tcp_server.clients[c.name]
1873
2371
                        c.remove_from_connection()
1874
2372
                        # Don't signal anything except ClientRemoved
1875
2373
                        c.disable(quiet=True)
1880
2378
            
1881
2379
            del _interface
1882
2380
        
1883
 
        mandos_dbus_service = MandosDBusService()
 
2381
        class MandosDBusServiceTransitional(MandosDBusService):
 
2382
            __metaclass__ = AlternateDBusNamesMetaclass
 
2383
        mandos_dbus_service = MandosDBusServiceTransitional()
1884
2384
    
1885
2385
    def cleanup():
1886
2386
        "Cleanup function; run on exit"
1887
2387
        service.cleanup()
1888
2388
        
 
2389
        multiprocessing.active_children()
 
2390
        if not (tcp_server.clients or client_settings):
 
2391
            return
 
2392
        
 
2393
        # Store client before exiting. Secrets are encrypted with key
 
2394
        # based on what config file has. If config file is
 
2395
        # removed/edited, old secret will thus be unrecovable.
 
2396
        clients = []
 
2397
        with Crypto() as crypt:
 
2398
            for client in tcp_server.clients.itervalues():
 
2399
                key = client_settings[client.name]["secret"]
 
2400
                client.encrypted_secret = crypt.encrypt(client.secret,
 
2401
                                                        key)
 
2402
                client_dict = {}
 
2403
                
 
2404
                # A list of attributes that will not be stored when
 
2405
                # shutting down.
 
2406
                exclude = set(("bus", "changedstate", "secret"))
 
2407
                for name, typ in (inspect.getmembers
 
2408
                                  (dbus.service.Object)):
 
2409
                    exclude.add(name)
 
2410
                
 
2411
                client_dict["encrypted_secret"] = (client
 
2412
                                                   .encrypted_secret)
 
2413
                for attr in client.client_structure:
 
2414
                    if attr not in exclude:
 
2415
                        client_dict[attr] = getattr(client, attr)
 
2416
                
 
2417
                clients.append(client_dict)
 
2418
                del client_settings[client.name]["secret"]
 
2419
        
 
2420
        try:
 
2421
            with os.fdopen(os.open(stored_state_path,
 
2422
                                   os.O_CREAT|os.O_WRONLY|os.O_TRUNC,
 
2423
                                   0600), "wb") as stored_state:
 
2424
                pickle.dump((clients, client_settings), stored_state)
 
2425
        except (IOError, OSError) as e:
 
2426
            logger.warning("Could not save persistent state: {0}"
 
2427
                           .format(e))
 
2428
            if e.errno not in (errno.ENOENT, errno.EACCES):
 
2429
                raise
 
2430
        
 
2431
        # Delete all clients, and settings from config
1889
2432
        while tcp_server.clients:
1890
 
            client = tcp_server.clients.pop()
 
2433
            name, client = tcp_server.clients.popitem()
1891
2434
            if use_dbus:
1892
2435
                client.remove_from_connection()
1893
 
            client.disable_hook = None
1894
2436
            # Don't signal anything except ClientRemoved
1895
2437
            client.disable(quiet=True)
1896
2438
            if use_dbus:
1897
2439
                # Emit D-Bus signal
1898
 
                mandos_dbus_service.ClientRemoved(client.dbus_object_path,
 
2440
                mandos_dbus_service.ClientRemoved(client
 
2441
                                                  .dbus_object_path,
1899
2442
                                                  client.name)
 
2443
        client_settings.clear()
1900
2444
    
1901
2445
    atexit.register(cleanup)
1902
2446
    
1903
 
    for client in tcp_server.clients:
 
2447
    for client in tcp_server.clients.itervalues():
1904
2448
        if use_dbus:
1905
2449
            # Emit D-Bus signal
1906
2450
            mandos_dbus_service.ClientAdded(client.dbus_object_path)
1907
 
        client.enable()
 
2451
        # Need to initiate checking of clients
 
2452
        if client.enabled:
 
2453
            client.init_checker()
1908
2454
    
1909
2455
    tcp_server.enable()
1910
2456
    tcp_server.server_activate()
1912
2458
    # Find out what port we got
1913
2459
    service.port = tcp_server.socket.getsockname()[1]
1914
2460
    if use_ipv6:
1915
 
        logger.info(u"Now listening on address %r, port %d,"
 
2461
        logger.info("Now listening on address %r, port %d,"
1916
2462
                    " flowinfo %d, scope_id %d"
1917
2463
                    % tcp_server.socket.getsockname())
1918
2464
    else:                       # IPv4
1919
 
        logger.info(u"Now listening on address %r, port %d"
 
2465
        logger.info("Now listening on address %r, port %d"
1920
2466
                    % tcp_server.socket.getsockname())
1921
2467
    
1922
2468
    #service.interface = tcp_server.socket.getsockname()[3]
1925
2471
        # From the Avahi example code
1926
2472
        try:
1927
2473
            service.activate()
1928
 
        except dbus.exceptions.DBusException, error:
1929
 
            logger.critical(u"DBusException: %s", error)
 
2474
        except dbus.exceptions.DBusException as error:
 
2475
            logger.critical("DBusException: %s", error)
1930
2476
            cleanup()
1931
2477
            sys.exit(1)
1932
2478
        # End of Avahi example code
1936
2482
                             (tcp_server.handle_request
1937
2483
                              (*args[2:], **kwargs) or True))
1938
2484
        
1939
 
        logger.debug(u"Starting main loop")
 
2485
        logger.debug("Starting main loop")
1940
2486
        main_loop.run()
1941
 
    except AvahiError, error:
1942
 
        logger.critical(u"AvahiError: %s", error)
 
2487
    except AvahiError as error:
 
2488
        logger.critical("AvahiError: %s", error)
1943
2489
        cleanup()
1944
2490
        sys.exit(1)
1945
2491
    except KeyboardInterrupt:
1946
2492
        if debug:
1947
 
            print >> sys.stderr
1948
 
        logger.debug(u"Server received KeyboardInterrupt")
1949
 
    logger.debug(u"Server exiting")
 
2493
            print("", file=sys.stderr)
 
2494
        logger.debug("Server received KeyboardInterrupt")
 
2495
    logger.debug("Server exiting")
1950
2496
    # Must run before the D-Bus bus name gets deregistered
1951
2497
    cleanup()
1952
2498
 
 
2499
 
1953
2500
if __name__ == '__main__':
1954
2501
    main()