/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos

  • Committer: Teddy Hogeborn
  • Date: 2012-01-01 05:42:51 UTC
  • mfrom: (237.4.22 release)
  • Revision ID: teddy@recompile.se-20120101054251-26jflhej4znq2mzq
Merge from release branch.

Show diffs side-by-side

added added

removed removed

Lines of Context:
6
6
# This program is partly derived from an example program for an Avahi
7
7
# service publisher, downloaded from
8
8
# <http://avahi.org/wiki/PythonPublishExample>.  This includes the
9
 
# methods "add" and "remove" in the "AvahiService" class, the
10
 
# "server_state_changed" and "entry_group_state_changed" functions,
11
 
# and some lines in "main".
 
9
# methods "add", "remove", "server_state_changed",
 
10
# "entry_group_state_changed", "cleanup", and "activate" in the
 
11
# "AvahiService" class, and some lines in "main".
12
12
13
13
# Everything else is
14
 
# Copyright © 2008,2009 Teddy Hogeborn
15
 
# Copyright © 2008,2009 Björn Påhlsson
 
14
# Copyright © 2008-2012 Teddy Hogeborn
 
15
# Copyright © 2008-2012 Björn Påhlsson
16
16
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
28
28
# along with this program.  If not, see
29
29
# <http://www.gnu.org/licenses/>.
30
30
31
 
# Contact the authors at <mandos@fukt.bsnet.se>.
 
31
# Contact the authors at <mandos@recompile.se>.
32
32
33
33
 
34
 
from __future__ import division, with_statement, absolute_import
 
34
from __future__ import (division, absolute_import, print_function,
 
35
                        unicode_literals)
35
36
 
36
 
import SocketServer
 
37
import SocketServer as socketserver
37
38
import socket
38
 
import optparse
 
39
import argparse
39
40
import datetime
40
41
import errno
41
42
import gnutls.crypto
44
45
import gnutls.library.functions
45
46
import gnutls.library.constants
46
47
import gnutls.library.types
47
 
import ConfigParser
 
48
import ConfigParser as configparser
48
49
import sys
49
50
import re
50
51
import os
51
52
import signal
52
 
from sets import Set
53
53
import subprocess
54
54
import atexit
55
55
import stat
56
56
import logging
57
57
import logging.handlers
58
58
import pwd
59
 
from contextlib import closing
 
59
import contextlib
 
60
import struct
 
61
import fcntl
 
62
import functools
 
63
import cPickle as pickle
 
64
import multiprocessing
 
65
import types
 
66
import binascii
 
67
import tempfile
60
68
 
61
69
import dbus
62
70
import dbus.service
65
73
from dbus.mainloop.glib import DBusGMainLoop
66
74
import ctypes
67
75
import ctypes.util
68
 
 
69
 
version = "1.0.6"
70
 
 
71
 
logger = logging.Logger('mandos')
 
76
import xml.dom.minidom
 
77
import inspect
 
78
import GnuPGInterface
 
79
 
 
80
try:
 
81
    SO_BINDTODEVICE = socket.SO_BINDTODEVICE
 
82
except AttributeError:
 
83
    try:
 
84
        from IN import SO_BINDTODEVICE
 
85
    except ImportError:
 
86
        SO_BINDTODEVICE = None
 
87
 
 
88
version = "1.5.0"
 
89
stored_state_file = "clients.pickle"
 
90
 
 
91
logger = logging.getLogger()
72
92
syslogger = (logging.handlers.SysLogHandler
73
93
             (facility = logging.handlers.SysLogHandler.LOG_DAEMON,
74
 
              address = "/dev/log"))
75
 
syslogger.setFormatter(logging.Formatter
76
 
                       ('Mandos [%(process)d]: %(levelname)s:'
77
 
                        ' %(message)s'))
78
 
logger.addHandler(syslogger)
79
 
 
80
 
console = logging.StreamHandler()
81
 
console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'
82
 
                                       ' %(levelname)s: %(message)s'))
83
 
logger.addHandler(console)
 
94
              address = str("/dev/log")))
 
95
 
 
96
try:
 
97
    if_nametoindex = (ctypes.cdll.LoadLibrary
 
98
                      (ctypes.util.find_library("c"))
 
99
                      .if_nametoindex)
 
100
except (OSError, AttributeError):
 
101
    def if_nametoindex(interface):
 
102
        "Get an interface index the hard way, i.e. using fcntl()"
 
103
        SIOCGIFINDEX = 0x8933  # From /usr/include/linux/sockios.h
 
104
        with contextlib.closing(socket.socket()) as s:
 
105
            ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
 
106
                                struct.pack(str("16s16x"),
 
107
                                            interface))
 
108
        interface_index = struct.unpack(str("I"),
 
109
                                        ifreq[16:20])[0]
 
110
        return interface_index
 
111
 
 
112
 
 
113
def initlogger(debug, level=logging.WARNING):
 
114
    """init logger and add loglevel"""
 
115
    
 
116
    syslogger.setFormatter(logging.Formatter
 
117
                           ('Mandos [%(process)d]: %(levelname)s:'
 
118
                            ' %(message)s'))
 
119
    logger.addHandler(syslogger)
 
120
    
 
121
    if debug:
 
122
        console = logging.StreamHandler()
 
123
        console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
 
124
                                               ' [%(process)d]:'
 
125
                                               ' %(levelname)s:'
 
126
                                               ' %(message)s'))
 
127
        logger.addHandler(console)
 
128
    logger.setLevel(level)
 
129
 
 
130
 
 
131
class PGPError(Exception):
 
132
    """Exception if encryption/decryption fails"""
 
133
    pass
 
134
 
 
135
 
 
136
class PGPEngine(object):
 
137
    """A simple class for OpenPGP symmetric encryption & decryption"""
 
138
    def __init__(self):
 
139
        self.gnupg = GnuPGInterface.GnuPG()
 
140
        self.tempdir = tempfile.mkdtemp(prefix="mandos-")
 
141
        self.gnupg = GnuPGInterface.GnuPG()
 
142
        self.gnupg.options.meta_interactive = False
 
143
        self.gnupg.options.homedir = self.tempdir
 
144
        self.gnupg.options.extra_args.extend(['--force-mdc',
 
145
                                              '--quiet',
 
146
                                              '--no-use-agent'])
 
147
    
 
148
    def __enter__(self):
 
149
        return self
 
150
    
 
151
    def __exit__ (self, exc_type, exc_value, traceback):
 
152
        self._cleanup()
 
153
        return False
 
154
    
 
155
    def __del__(self):
 
156
        self._cleanup()
 
157
    
 
158
    def _cleanup(self):
 
159
        if self.tempdir is not None:
 
160
            # Delete contents of tempdir
 
161
            for root, dirs, files in os.walk(self.tempdir,
 
162
                                             topdown = False):
 
163
                for filename in files:
 
164
                    os.remove(os.path.join(root, filename))
 
165
                for dirname in dirs:
 
166
                    os.rmdir(os.path.join(root, dirname))
 
167
            # Remove tempdir
 
168
            os.rmdir(self.tempdir)
 
169
            self.tempdir = None
 
170
    
 
171
    def password_encode(self, password):
 
172
        # Passphrase can not be empty and can not contain newlines or
 
173
        # NUL bytes.  So we prefix it and hex encode it.
 
174
        return b"mandos" + binascii.hexlify(password)
 
175
    
 
176
    def encrypt(self, data, password):
 
177
        self.gnupg.passphrase = self.password_encode(password)
 
178
        with open(os.devnull) as devnull:
 
179
            try:
 
180
                proc = self.gnupg.run(['--symmetric'],
 
181
                                      create_fhs=['stdin', 'stdout'],
 
182
                                      attach_fhs={'stderr': devnull})
 
183
                with contextlib.closing(proc.handles['stdin']) as f:
 
184
                    f.write(data)
 
185
                with contextlib.closing(proc.handles['stdout']) as f:
 
186
                    ciphertext = f.read()
 
187
                proc.wait()
 
188
            except IOError as e:
 
189
                raise PGPError(e)
 
190
        self.gnupg.passphrase = None
 
191
        return ciphertext
 
192
    
 
193
    def decrypt(self, data, password):
 
194
        self.gnupg.passphrase = self.password_encode(password)
 
195
        with open(os.devnull) as devnull:
 
196
            try:
 
197
                proc = self.gnupg.run(['--decrypt'],
 
198
                                      create_fhs=['stdin', 'stdout'],
 
199
                                      attach_fhs={'stderr': devnull})
 
200
                with contextlib.closing(proc.handles['stdin'] ) as f:
 
201
                    f.write(data)
 
202
                with contextlib.closing(proc.handles['stdout']) as f:
 
203
                    decrypted_plaintext = f.read()
 
204
                proc.wait()
 
205
            except IOError as e:
 
206
                raise PGPError(e)
 
207
        self.gnupg.passphrase = None
 
208
        return decrypted_plaintext
 
209
 
 
210
 
84
211
 
85
212
class AvahiError(Exception):
86
213
    def __init__(self, value, *args, **kwargs):
98
225
 
99
226
class AvahiService(object):
100
227
    """An Avahi (Zeroconf) service.
 
228
    
101
229
    Attributes:
102
230
    interface: integer; avahi.IF_UNSPEC or an interface index.
103
231
               Used to optionally bind to the specified interface.
111
239
    max_renames: integer; maximum number of renames
112
240
    rename_count: integer; counter so we only rename after collisions
113
241
                  a sensible number of times
 
242
    group: D-Bus Entry Group
 
243
    server: D-Bus Server
 
244
    bus: dbus.SystemBus()
114
245
    """
115
246
    def __init__(self, interface = avahi.IF_UNSPEC, name = None,
116
247
                 servicetype = None, port = None, TXT = None,
117
248
                 domain = "", host = "", max_renames = 32768,
118
 
                 protocol = avahi.PROTO_UNSPEC):
 
249
                 protocol = avahi.PROTO_UNSPEC, bus = None):
119
250
        self.interface = interface
120
251
        self.name = name
121
252
        self.type = servicetype
126
257
        self.rename_count = 0
127
258
        self.max_renames = max_renames
128
259
        self.protocol = protocol
 
260
        self.group = None       # our entry group
 
261
        self.server = None
 
262
        self.bus = bus
 
263
        self.entry_group_state_changed_match = None
129
264
    def rename(self):
130
265
        """Derived from the Avahi example code"""
131
266
        if self.rename_count >= self.max_renames:
132
 
            logger.critical(u"No suitable Zeroconf service name found"
133
 
                            u" after %i retries, exiting.",
 
267
            logger.critical("No suitable Zeroconf service name found"
 
268
                            " after %i retries, exiting.",
134
269
                            self.rename_count)
135
 
            raise AvahiServiceError(u"Too many renames")
136
 
        self.name = server.GetAlternativeServiceName(self.name)
137
 
        logger.info(u"Changing Zeroconf service name to %r ...",
138
 
                    str(self.name))
139
 
        syslogger.setFormatter(logging.Formatter
140
 
                               ('Mandos (%s): %%(levelname)s:'
141
 
                                ' %%(message)s' % self.name))
 
270
            raise AvahiServiceError("Too many renames")
 
271
        self.name = unicode(self.server
 
272
                            .GetAlternativeServiceName(self.name))
 
273
        logger.info("Changing Zeroconf service name to %r ...",
 
274
                    self.name)
142
275
        self.remove()
143
 
        self.add()
 
276
        try:
 
277
            self.add()
 
278
        except dbus.exceptions.DBusException as error:
 
279
            logger.critical("DBusException: %s", error)
 
280
            self.cleanup()
 
281
            os._exit(1)
144
282
        self.rename_count += 1
145
283
    def remove(self):
146
284
        """Derived from the Avahi example code"""
147
 
        if group is not None:
148
 
            group.Reset()
 
285
        if self.entry_group_state_changed_match is not None:
 
286
            self.entry_group_state_changed_match.remove()
 
287
            self.entry_group_state_changed_match = None
 
288
        if self.group is not None:
 
289
            self.group.Reset()
149
290
    def add(self):
150
291
        """Derived from the Avahi example code"""
151
 
        global group
152
 
        if group is None:
153
 
            group = dbus.Interface(bus.get_object
154
 
                                   (avahi.DBUS_NAME,
155
 
                                    server.EntryGroupNew()),
156
 
                                   avahi.DBUS_INTERFACE_ENTRY_GROUP)
157
 
            group.connect_to_signal('StateChanged',
158
 
                                    entry_group_state_changed)
159
 
        logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
160
 
                     service.name, service.type)
161
 
        group.AddService(
162
 
                self.interface,         # interface
163
 
                self.protocol,          # protocol
164
 
                dbus.UInt32(0),         # flags
165
 
                self.name, self.type,
166
 
                self.domain, self.host,
167
 
                dbus.UInt16(self.port),
168
 
                avahi.string_array_to_txt_array(self.TXT))
169
 
        group.Commit()
170
 
 
171
 
# From the Avahi example code:
172
 
group = None                            # our entry group
173
 
# End of Avahi example code
174
 
 
175
 
 
176
 
def _datetime_to_dbus(dt, variant_level=0):
177
 
    """Convert a UTC datetime.datetime() to a D-Bus type."""
178
 
    return dbus.String(dt.isoformat(), variant_level=variant_level)
179
 
 
180
 
 
181
 
class Client(dbus.service.Object):
 
292
        self.remove()
 
293
        if self.group is None:
 
294
            self.group = dbus.Interface(
 
295
                self.bus.get_object(avahi.DBUS_NAME,
 
296
                                    self.server.EntryGroupNew()),
 
297
                avahi.DBUS_INTERFACE_ENTRY_GROUP)
 
298
        self.entry_group_state_changed_match = (
 
299
            self.group.connect_to_signal(
 
300
                'StateChanged', self.entry_group_state_changed))
 
301
        logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
 
302
                     self.name, self.type)
 
303
        self.group.AddService(
 
304
            self.interface,
 
305
            self.protocol,
 
306
            dbus.UInt32(0),     # flags
 
307
            self.name, self.type,
 
308
            self.domain, self.host,
 
309
            dbus.UInt16(self.port),
 
310
            avahi.string_array_to_txt_array(self.TXT))
 
311
        self.group.Commit()
 
312
    def entry_group_state_changed(self, state, error):
 
313
        """Derived from the Avahi example code"""
 
314
        logger.debug("Avahi entry group state change: %i", state)
 
315
        
 
316
        if state == avahi.ENTRY_GROUP_ESTABLISHED:
 
317
            logger.debug("Zeroconf service established.")
 
318
        elif state == avahi.ENTRY_GROUP_COLLISION:
 
319
            logger.info("Zeroconf service name collision.")
 
320
            self.rename()
 
321
        elif state == avahi.ENTRY_GROUP_FAILURE:
 
322
            logger.critical("Avahi: Error in group state changed %s",
 
323
                            unicode(error))
 
324
            raise AvahiGroupError("State changed: %s"
 
325
                                  % unicode(error))
 
326
    def cleanup(self):
 
327
        """Derived from the Avahi example code"""
 
328
        if self.group is not None:
 
329
            try:
 
330
                self.group.Free()
 
331
            except (dbus.exceptions.UnknownMethodException,
 
332
                    dbus.exceptions.DBusException):
 
333
                pass
 
334
            self.group = None
 
335
        self.remove()
 
336
    def server_state_changed(self, state, error=None):
 
337
        """Derived from the Avahi example code"""
 
338
        logger.debug("Avahi server state change: %i", state)
 
339
        bad_states = { avahi.SERVER_INVALID:
 
340
                           "Zeroconf server invalid",
 
341
                       avahi.SERVER_REGISTERING: None,
 
342
                       avahi.SERVER_COLLISION:
 
343
                           "Zeroconf server name collision",
 
344
                       avahi.SERVER_FAILURE:
 
345
                           "Zeroconf server failure" }
 
346
        if state in bad_states:
 
347
            if bad_states[state] is not None:
 
348
                if error is None:
 
349
                    logger.error(bad_states[state])
 
350
                else:
 
351
                    logger.error(bad_states[state] + ": %r", error)
 
352
            self.cleanup()
 
353
        elif state == avahi.SERVER_RUNNING:
 
354
            self.add()
 
355
        else:
 
356
            if error is None:
 
357
                logger.debug("Unknown state: %r", state)
 
358
            else:
 
359
                logger.debug("Unknown state: %r: %r", state, error)
 
360
    def activate(self):
 
361
        """Derived from the Avahi example code"""
 
362
        if self.server is None:
 
363
            self.server = dbus.Interface(
 
364
                self.bus.get_object(avahi.DBUS_NAME,
 
365
                                    avahi.DBUS_PATH_SERVER,
 
366
                                    follow_name_owner_changes=True),
 
367
                avahi.DBUS_INTERFACE_SERVER)
 
368
        self.server.connect_to_signal("StateChanged",
 
369
                                 self.server_state_changed)
 
370
        self.server_state_changed(self.server.GetState())
 
371
 
 
372
class AvahiServiceToSyslog(AvahiService):
 
373
    def rename(self):
 
374
        """Add the new name to the syslog messages"""
 
375
        ret = AvahiService.rename(self)
 
376
        syslogger.setFormatter(logging.Formatter
 
377
                               ('Mandos (%s) [%%(process)d]:'
 
378
                                ' %%(levelname)s: %%(message)s'
 
379
                                % self.name))
 
380
        return ret
 
381
 
 
382
def timedelta_to_milliseconds(td):
 
383
    "Convert a datetime.timedelta() to milliseconds"
 
384
    return ((td.days * 24 * 60 * 60 * 1000)
 
385
            + (td.seconds * 1000)
 
386
            + (td.microseconds // 1000))
 
387
        
 
388
class Client(object):
182
389
    """A representation of a client host served by this server.
 
390
    
183
391
    Attributes:
184
 
    name:       string; from the config file, used in log messages and
185
 
                        D-Bus identifiers
186
 
    fingerprint: string (40 or 32 hexadecimal digits); used to
187
 
                 uniquely identify the client
188
 
    secret:     bytestring; sent verbatim (over TLS) to client
189
 
    host:       string; available for use by the checker command
190
 
    created:    datetime.datetime(); (UTC) object creation
191
 
    last_enabled: datetime.datetime(); (UTC)
192
 
    enabled:    bool()
193
 
    last_checked_ok: datetime.datetime(); (UTC) or None
194
 
    timeout:    datetime.timedelta(); How long from last_checked_ok
195
 
                                      until this client is invalid
196
 
    interval:   datetime.timedelta(); How often to start a new checker
197
 
    disable_hook:  If set, called by disable() as disable_hook(self)
 
392
    approved:   bool(); 'None' if not yet approved/disapproved
 
393
    approval_delay: datetime.timedelta(); Time to wait for approval
 
394
    approval_duration: datetime.timedelta(); Duration of one approval
198
395
    checker:    subprocess.Popen(); a running checker process used
199
396
                                    to see if the client lives.
200
397
                                    'None' if no process is running.
201
 
    checker_initiator_tag: a gobject event source tag, or None
202
 
    disable_initiator_tag:    - '' -
203
 
    checker_callback_tag:  - '' -
204
 
    checker_command: string; External command which is run to check if
205
 
                     client lives.  %() expansions are done at
 
398
    checker_callback_tag: a gobject event source tag, or None
 
399
    checker_command: string; External command which is run to check
 
400
                     if client lives.  %() expansions are done at
206
401
                     runtime with vars(self) as dict, so that for
207
402
                     instance %(name)s can be used in the command.
 
403
    checker_initiator_tag: a gobject event source tag, or None
 
404
    created:    datetime.datetime(); (UTC) object creation
 
405
    client_structure: Object describing what attributes a client has
 
406
                      and is used for storing the client at exit
208
407
    current_checker_command: string; current running checker_command
209
 
    use_dbus: bool(); Whether to provide D-Bus interface and signals
210
 
    dbus_object_path: dbus.ObjectPath ; only set if self.use_dbus
 
408
    disable_initiator_tag: a gobject event source tag, or None
 
409
    enabled:    bool()
 
410
    fingerprint: string (40 or 32 hexadecimal digits); used to
 
411
                 uniquely identify the client
 
412
    host:       string; available for use by the checker command
 
413
    interval:   datetime.timedelta(); How often to start a new checker
 
414
    last_approval_request: datetime.datetime(); (UTC) or None
 
415
    last_checked_ok: datetime.datetime(); (UTC) or None
 
416
    last_checker_status: integer between 0 and 255 reflecting exit
 
417
                         status of last checker. -1 reflects crashed
 
418
                         checker, or None.
 
419
    last_enabled: datetime.datetime(); (UTC) or None
 
420
    name:       string; from the config file, used in log messages and
 
421
                        D-Bus identifiers
 
422
    secret:     bytestring; sent verbatim (over TLS) to client
 
423
    timeout:    datetime.timedelta(); How long from last_checked_ok
 
424
                                      until this client is disabled
 
425
    extended_timeout:   extra long timeout when password has been sent
 
426
    runtime_expansions: Allowed attributes for runtime expansion.
 
427
    expires:    datetime.datetime(); time (UTC) when a client will be
 
428
                disabled, or None
211
429
    """
 
430
    
 
431
    runtime_expansions = ("approval_delay", "approval_duration",
 
432
                          "created", "enabled", "fingerprint",
 
433
                          "host", "interval", "last_checked_ok",
 
434
                          "last_enabled", "name", "timeout")
 
435
    client_defaults = { "timeout": "5m",
 
436
                        "extended_timeout": "15m",
 
437
                        "interval": "2m",
 
438
                        "checker": "fping -q -- %%(host)s",
 
439
                        "host": "",
 
440
                        "approval_delay": "0s",
 
441
                        "approval_duration": "1s",
 
442
                        "approved_by_default": "True",
 
443
                        "enabled": "True",
 
444
                        }
 
445
    
212
446
    def timeout_milliseconds(self):
213
447
        "Return the 'timeout' attribute in milliseconds"
214
 
        return ((self.timeout.days * 24 * 60 * 60 * 1000)
215
 
                + (self.timeout.seconds * 1000)
216
 
                + (self.timeout.microseconds // 1000))
 
448
        return timedelta_to_milliseconds(self.timeout)
 
449
    
 
450
    def extended_timeout_milliseconds(self):
 
451
        "Return the 'extended_timeout' attribute in milliseconds"
 
452
        return timedelta_to_milliseconds(self.extended_timeout)
217
453
    
218
454
    def interval_milliseconds(self):
219
455
        "Return the 'interval' attribute in milliseconds"
220
 
        return ((self.interval.days * 24 * 60 * 60 * 1000)
221
 
                + (self.interval.seconds * 1000)
222
 
                + (self.interval.microseconds // 1000))
 
456
        return timedelta_to_milliseconds(self.interval)
223
457
    
224
 
    def __init__(self, name = None, disable_hook=None, config=None,
225
 
                 use_dbus=True):
 
458
    def approval_delay_milliseconds(self):
 
459
        return timedelta_to_milliseconds(self.approval_delay)
 
460
 
 
461
    @staticmethod
 
462
    def config_parser(config):
 
463
        """Construct a new dict of client settings of this form:
 
464
        { client_name: {setting_name: value, ...}, ...}
 
465
        with exceptions for any special settings as defined above.
 
466
        NOTE: Must be a pure function. Must return the same result
 
467
        value given the same arguments.
 
468
        """
 
469
        settings = {}
 
470
        for client_name in config.sections():
 
471
            section = dict(config.items(client_name))
 
472
            client = settings[client_name] = {}
 
473
            
 
474
            client["host"] = section["host"]
 
475
            # Reformat values from string types to Python types
 
476
            client["approved_by_default"] = config.getboolean(
 
477
                client_name, "approved_by_default")
 
478
            client["enabled"] = config.getboolean(client_name,
 
479
                                                  "enabled")
 
480
            
 
481
            client["fingerprint"] = (section["fingerprint"].upper()
 
482
                                     .replace(" ", ""))
 
483
            if "secret" in section:
 
484
                client["secret"] = section["secret"].decode("base64")
 
485
            elif "secfile" in section:
 
486
                with open(os.path.expanduser(os.path.expandvars
 
487
                                             (section["secfile"])),
 
488
                          "rb") as secfile:
 
489
                    client["secret"] = secfile.read()
 
490
            else:
 
491
                raise TypeError("No secret or secfile for section %s"
 
492
                                % section)
 
493
            client["timeout"] = string_to_delta(section["timeout"])
 
494
            client["extended_timeout"] = string_to_delta(
 
495
                section["extended_timeout"])
 
496
            client["interval"] = string_to_delta(section["interval"])
 
497
            client["approval_delay"] = string_to_delta(
 
498
                section["approval_delay"])
 
499
            client["approval_duration"] = string_to_delta(
 
500
                section["approval_duration"])
 
501
            client["checker_command"] = section["checker"]
 
502
            client["last_approval_request"] = None
 
503
            client["last_checked_ok"] = None
 
504
            client["last_checker_status"] = None
 
505
        
 
506
        return settings
 
507
        
 
508
        
 
509
    def __init__(self, settings, name = None):
226
510
        """Note: the 'checker' key in 'config' sets the
227
511
        'checker_command' attribute and *not* the 'checker'
228
512
        attribute."""
229
513
        self.name = name
230
 
        if config is None:
231
 
            config = {}
232
 
        logger.debug(u"Creating client %r", self.name)
233
 
        self.use_dbus = False   # During __init__
 
514
        # adding all client settings
 
515
        for setting, value in settings.iteritems():
 
516
            setattr(self, setting, value)
 
517
        
 
518
        if self.enabled:
 
519
            if not hasattr(self, "last_enabled"):
 
520
                self.last_enabled = datetime.datetime.utcnow()
 
521
            if not hasattr(self, "expires"):
 
522
                self.expires = (datetime.datetime.utcnow()
 
523
                                + self.timeout)
 
524
        else:
 
525
            self.last_enabled = None
 
526
            self.expires = None
 
527
       
 
528
        logger.debug("Creating client %r", self.name)
234
529
        # Uppercase and remove spaces from fingerprint for later
235
530
        # comparison purposes with return value from the fingerprint()
236
531
        # function
237
 
        self.fingerprint = (config["fingerprint"].upper()
238
 
                            .replace(u" ", u""))
239
 
        logger.debug(u"  Fingerprint: %s", self.fingerprint)
240
 
        if "secret" in config:
241
 
            self.secret = config["secret"].decode(u"base64")
242
 
        elif "secfile" in config:
243
 
            with closing(open(os.path.expanduser
244
 
                              (os.path.expandvars
245
 
                               (config["secfile"])))) as secfile:
246
 
                self.secret = secfile.read()
247
 
        else:
248
 
            raise TypeError(u"No secret or secfile for client %s"
249
 
                            % self.name)
250
 
        self.host = config.get("host", "")
251
 
        self.created = datetime.datetime.utcnow()
252
 
        self.enabled = False
253
 
        self.last_enabled = None
254
 
        self.last_checked_ok = None
255
 
        self.timeout = string_to_delta(config["timeout"])
256
 
        self.interval = string_to_delta(config["interval"])
257
 
        self.disable_hook = disable_hook
 
532
        logger.debug("  Fingerprint: %s", self.fingerprint)
 
533
        self.created = settings.get("created",
 
534
                                    datetime.datetime.utcnow())
 
535
 
 
536
        # attributes specific for this server instance
258
537
        self.checker = None
259
538
        self.checker_initiator_tag = None
260
539
        self.disable_initiator_tag = None
261
540
        self.checker_callback_tag = None
262
 
        self.checker_command = config["checker"]
263
541
        self.current_checker_command = None
264
 
        self.last_connect = None
265
 
        # Only now, when this client is initialized, can it show up on
266
 
        # the D-Bus
267
 
        self.use_dbus = use_dbus
268
 
        if self.use_dbus:
269
 
            self.dbus_object_path = (dbus.ObjectPath
270
 
                                     ("/clients/"
271
 
                                      + self.name.replace(".", "_")))
272
 
            dbus.service.Object.__init__(self, bus,
273
 
                                         self.dbus_object_path)
 
542
        self.approved = None
 
543
        self.approvals_pending = 0
 
544
        self.changedstate = (multiprocessing_manager
 
545
                             .Condition(multiprocessing_manager
 
546
                                        .Lock()))
 
547
        self.client_structure = [attr for attr in
 
548
                                 self.__dict__.iterkeys()
 
549
                                 if not attr.startswith("_")]
 
550
        self.client_structure.append("client_structure")
 
551
        
 
552
        for name, t in inspect.getmembers(type(self),
 
553
                                          lambda obj:
 
554
                                              isinstance(obj,
 
555
                                                         property)):
 
556
            if not name.startswith("_"):
 
557
                self.client_structure.append(name)
 
558
    
 
559
    # Send notice to process children that client state has changed
 
560
    def send_changedstate(self):
 
561
        with self.changedstate:
 
562
            self.changedstate.notify_all()
274
563
    
275
564
    def enable(self):
276
565
        """Start this client's checker and timeout hooks"""
 
566
        if getattr(self, "enabled", False):
 
567
            # Already enabled
 
568
            return
 
569
        self.send_changedstate()
 
570
        self.expires = datetime.datetime.utcnow() + self.timeout
 
571
        self.enabled = True
277
572
        self.last_enabled = datetime.datetime.utcnow()
 
573
        self.init_checker()
 
574
    
 
575
    def disable(self, quiet=True):
 
576
        """Disable this client."""
 
577
        if not getattr(self, "enabled", False):
 
578
            return False
 
579
        if not quiet:
 
580
            self.send_changedstate()
 
581
        if not quiet:
 
582
            logger.info("Disabling client %s", self.name)
 
583
        if getattr(self, "disable_initiator_tag", False):
 
584
            gobject.source_remove(self.disable_initiator_tag)
 
585
            self.disable_initiator_tag = None
 
586
        self.expires = None
 
587
        if getattr(self, "checker_initiator_tag", False):
 
588
            gobject.source_remove(self.checker_initiator_tag)
 
589
            self.checker_initiator_tag = None
 
590
        self.stop_checker()
 
591
        self.enabled = False
 
592
        # Do not run this again if called by a gobject.timeout_add
 
593
        return False
 
594
    
 
595
    def __del__(self):
 
596
        self.disable()
 
597
    
 
598
    def init_checker(self):
278
599
        # Schedule a new checker to be started an 'interval' from now,
279
600
        # and every interval from then on.
280
601
        self.checker_initiator_tag = (gobject.timeout_add
281
602
                                      (self.interval_milliseconds(),
282
603
                                       self.start_checker))
283
 
        # Also start a new checker *right now*.
284
 
        self.start_checker()
285
604
        # Schedule a disable() when 'timeout' has passed
286
605
        self.disable_initiator_tag = (gobject.timeout_add
287
606
                                   (self.timeout_milliseconds(),
288
607
                                    self.disable))
289
 
        self.enabled = True
290
 
        if self.use_dbus:
291
 
            # Emit D-Bus signals
292
 
            self.PropertyChanged(dbus.String(u"enabled"),
293
 
                                 dbus.Boolean(True, variant_level=1))
294
 
            self.PropertyChanged(dbus.String(u"last_enabled"),
295
 
                                 (_datetime_to_dbus(self.last_enabled,
296
 
                                                    variant_level=1)))
297
 
    
298
 
    def disable(self):
299
 
        """Disable this client."""
300
 
        if not getattr(self, "enabled", False):
301
 
            return False
302
 
        logger.info(u"Disabling client %s", self.name)
303
 
        if getattr(self, "disable_initiator_tag", False):
304
 
            gobject.source_remove(self.disable_initiator_tag)
305
 
            self.disable_initiator_tag = None
306
 
        if getattr(self, "checker_initiator_tag", False):
307
 
            gobject.source_remove(self.checker_initiator_tag)
308
 
            self.checker_initiator_tag = None
309
 
        self.stop_checker()
310
 
        if self.disable_hook:
311
 
            self.disable_hook(self)
312
 
        self.enabled = False
313
 
        if self.use_dbus:
314
 
            # Emit D-Bus signal
315
 
            self.PropertyChanged(dbus.String(u"enabled"),
316
 
                                 dbus.Boolean(False, variant_level=1))
317
 
        # Do not run this again if called by a gobject.timeout_add
318
 
        return False
319
 
    
320
 
    def __del__(self):
321
 
        self.disable_hook = None
322
 
        self.disable()
 
608
        # Also start a new checker *right now*.
 
609
        self.start_checker()
323
610
    
324
611
    def checker_callback(self, pid, condition, command):
325
612
        """The checker has completed, so take appropriate actions."""
326
613
        self.checker_callback_tag = None
327
614
        self.checker = None
328
 
        if self.use_dbus:
329
 
            # Emit D-Bus signal
330
 
            self.PropertyChanged(dbus.String(u"checker_running"),
331
 
                                 dbus.Boolean(False, variant_level=1))
332
615
        if os.WIFEXITED(condition):
333
 
            exitstatus = os.WEXITSTATUS(condition)
334
 
            if exitstatus == 0:
335
 
                logger.info(u"Checker for %(name)s succeeded",
 
616
            self.last_checker_status = os.WEXITSTATUS(condition)
 
617
            if self.last_checker_status == 0:
 
618
                logger.info("Checker for %(name)s succeeded",
336
619
                            vars(self))
337
620
                self.checked_ok()
338
621
            else:
339
 
                logger.info(u"Checker for %(name)s failed",
 
622
                logger.info("Checker for %(name)s failed",
340
623
                            vars(self))
341
 
            if self.use_dbus:
342
 
                # Emit D-Bus signal
343
 
                self.CheckerCompleted(dbus.Int16(exitstatus),
344
 
                                      dbus.Int64(condition),
345
 
                                      dbus.String(command))
346
624
        else:
347
 
            logger.warning(u"Checker for %(name)s crashed?",
 
625
            self.last_checker_status = -1
 
626
            logger.warning("Checker for %(name)s crashed?",
348
627
                           vars(self))
349
 
            if self.use_dbus:
350
 
                # Emit D-Bus signal
351
 
                self.CheckerCompleted(dbus.Int16(-1),
352
 
                                      dbus.Int64(condition),
353
 
                                      dbus.String(command))
354
628
    
355
 
    def checked_ok(self):
 
629
    def checked_ok(self, timeout=None):
356
630
        """Bump up the timeout for this client.
 
631
        
357
632
        This should only be called when the client has been seen,
358
633
        alive and well.
359
634
        """
 
635
        if timeout is None:
 
636
            timeout = self.timeout
360
637
        self.last_checked_ok = datetime.datetime.utcnow()
361
 
        gobject.source_remove(self.disable_initiator_tag)
362
 
        self.disable_initiator_tag = (gobject.timeout_add
363
 
                                      (self.timeout_milliseconds(),
364
 
                                       self.disable))
365
 
        if self.use_dbus:
366
 
            # Emit D-Bus signal
367
 
            self.PropertyChanged(
368
 
                dbus.String(u"last_checked_ok"),
369
 
                (_datetime_to_dbus(self.last_checked_ok,
370
 
                                   variant_level=1)))
 
638
        if self.disable_initiator_tag is not None:
 
639
            gobject.source_remove(self.disable_initiator_tag)
 
640
        if getattr(self, "enabled", False):
 
641
            self.disable_initiator_tag = (gobject.timeout_add
 
642
                                          (timedelta_to_milliseconds
 
643
                                           (timeout), self.disable))
 
644
            self.expires = datetime.datetime.utcnow() + timeout
 
645
    
 
646
    def need_approval(self):
 
647
        self.last_approval_request = datetime.datetime.utcnow()
371
648
    
372
649
    def start_checker(self):
373
650
        """Start a new checker subprocess if one is not running.
 
651
        
374
652
        If a checker already exists, leave it running and do
375
653
        nothing."""
376
654
        # The reason for not killing a running checker is that if we
379
657
        # client would inevitably timeout, since no checker would get
380
658
        # a chance to run to completion.  If we instead leave running
381
659
        # checkers alone, the checker would have to take more time
382
 
        # than 'timeout' for the client to be declared invalid, which
383
 
        # is as it should be.
 
660
        # than 'timeout' for the client to be disabled, which is as it
 
661
        # should be.
384
662
        
385
663
        # If a checker exists, make sure it is not a zombie
386
 
        if self.checker is not None:
 
664
        try:
387
665
            pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
 
666
        except (AttributeError, OSError) as error:
 
667
            if (isinstance(error, OSError)
 
668
                and error.errno != errno.ECHILD):
 
669
                raise error
 
670
        else:
388
671
            if pid:
389
672
                logger.warning("Checker was a zombie")
390
673
                gobject.source_remove(self.checker_callback_tag)
397
680
                command = self.checker_command % self.host
398
681
            except TypeError:
399
682
                # Escape attributes for the shell
400
 
                escaped_attrs = dict((key, re.escape(str(val)))
401
 
                                     for key, val in
402
 
                                     vars(self).iteritems())
 
683
                escaped_attrs = dict(
 
684
                    (attr,
 
685
                     re.escape(unicode(str(getattr(self, attr, "")),
 
686
                                       errors=
 
687
                                       'replace')))
 
688
                    for attr in
 
689
                    self.runtime_expansions)
 
690
                
403
691
                try:
404
692
                    command = self.checker_command % escaped_attrs
405
 
                except TypeError, error:
406
 
                    logger.error(u'Could not format string "%s":'
407
 
                                 u' %s', self.checker_command, error)
 
693
                except TypeError as error:
 
694
                    logger.error('Could not format string "%s":'
 
695
                                 ' %s', self.checker_command, error)
408
696
                    return True # Try again later
409
 
                self.current_checker_command = command
 
697
            self.current_checker_command = command
410
698
            try:
411
 
                logger.info(u"Starting checker %r for %s",
 
699
                logger.info("Starting checker %r for %s",
412
700
                            command, self.name)
413
701
                # We don't need to redirect stdout and stderr, since
414
702
                # in normal mode, that is already done by daemon(),
417
705
                self.checker = subprocess.Popen(command,
418
706
                                                close_fds=True,
419
707
                                                shell=True, cwd="/")
420
 
                if self.use_dbus:
421
 
                    # Emit D-Bus signal
422
 
                    self.CheckerStarted(command)
423
 
                    self.PropertyChanged(
424
 
                        dbus.String("checker_running"),
425
 
                        dbus.Boolean(True, variant_level=1))
426
708
                self.checker_callback_tag = (gobject.child_watch_add
427
709
                                             (self.checker.pid,
428
710
                                              self.checker_callback,
433
715
                if pid:
434
716
                    gobject.source_remove(self.checker_callback_tag)
435
717
                    self.checker_callback(pid, status, command)
436
 
            except OSError, error:
437
 
                logger.error(u"Failed to start subprocess: %s",
 
718
            except OSError as error:
 
719
                logger.error("Failed to start subprocess: %s",
438
720
                             error)
439
721
        # Re-run this periodically if run by gobject.timeout_add
440
722
        return True
446
728
            self.checker_callback_tag = None
447
729
        if getattr(self, "checker", None) is None:
448
730
            return
449
 
        logger.debug(u"Stopping checker for %(name)s", vars(self))
 
731
        logger.debug("Stopping checker for %(name)s", vars(self))
450
732
        try:
451
733
            os.kill(self.checker.pid, signal.SIGTERM)
452
 
            #os.sleep(0.5)
 
734
            #time.sleep(0.5)
453
735
            #if self.checker.poll() is None:
454
736
            #    os.kill(self.checker.pid, signal.SIGKILL)
455
 
        except OSError, error:
 
737
        except OSError as error:
456
738
            if error.errno != errno.ESRCH: # No such process
457
739
                raise
458
740
        self.checker = None
459
 
        if self.use_dbus:
460
 
            self.PropertyChanged(dbus.String(u"checker_running"),
461
 
                                 dbus.Boolean(False, variant_level=1))
462
 
    
463
 
    def still_valid(self):
464
 
        """Has the timeout not yet passed for this client?"""
465
 
        if not getattr(self, "enabled", False):
466
 
            return False
467
 
        now = datetime.datetime.utcnow()
468
 
        if self.last_checked_ok is None:
469
 
            return now < (self.created + self.timeout)
470
 
        else:
471
 
            return now < (self.last_checked_ok + self.timeout)
472
 
    
473
 
    ## D-Bus methods & signals
474
 
    _interface = u"se.bsnet.fukt.Mandos.Client"
475
 
    
476
 
    # CheckedOK - method
477
 
    CheckedOK = dbus.service.method(_interface)(checked_ok)
478
 
    CheckedOK.__name__ = "CheckedOK"
 
741
 
 
742
 
 
743
def dbus_service_property(dbus_interface, signature="v",
 
744
                          access="readwrite", byte_arrays=False):
 
745
    """Decorators for marking methods of a DBusObjectWithProperties to
 
746
    become properties on the D-Bus.
 
747
    
 
748
    The decorated method will be called with no arguments by "Get"
 
749
    and with one argument by "Set".
 
750
    
 
751
    The parameters, where they are supported, are the same as
 
752
    dbus.service.method, except there is only "signature", since the
 
753
    type from Get() and the type sent to Set() is the same.
 
754
    """
 
755
    # Encoding deeply encoded byte arrays is not supported yet by the
 
756
    # "Set" method, so we fail early here:
 
757
    if byte_arrays and signature != "ay":
 
758
        raise ValueError("Byte arrays not supported for non-'ay'"
 
759
                         " signature %r" % signature)
 
760
    def decorator(func):
 
761
        func._dbus_is_property = True
 
762
        func._dbus_interface = dbus_interface
 
763
        func._dbus_signature = signature
 
764
        func._dbus_access = access
 
765
        func._dbus_name = func.__name__
 
766
        if func._dbus_name.endswith("_dbus_property"):
 
767
            func._dbus_name = func._dbus_name[:-14]
 
768
        func._dbus_get_args_options = {'byte_arrays': byte_arrays }
 
769
        return func
 
770
    return decorator
 
771
 
 
772
 
 
773
class DBusPropertyException(dbus.exceptions.DBusException):
 
774
    """A base class for D-Bus property-related exceptions
 
775
    """
 
776
    def __unicode__(self):
 
777
        return unicode(str(self))
 
778
 
 
779
 
 
780
class DBusPropertyAccessException(DBusPropertyException):
 
781
    """A property's access permissions disallows an operation.
 
782
    """
 
783
    pass
 
784
 
 
785
 
 
786
class DBusPropertyNotFound(DBusPropertyException):
 
787
    """An attempt was made to access a non-existing property.
 
788
    """
 
789
    pass
 
790
 
 
791
 
 
792
class DBusObjectWithProperties(dbus.service.Object):
 
793
    """A D-Bus object with properties.
 
794
    
 
795
    Classes inheriting from this can use the dbus_service_property
 
796
    decorator to expose methods as D-Bus properties.  It exposes the
 
797
    standard Get(), Set(), and GetAll() methods on the D-Bus.
 
798
    """
 
799
    
 
800
    @staticmethod
 
801
    def _is_dbus_property(obj):
 
802
        return getattr(obj, "_dbus_is_property", False)
 
803
    
 
804
    def _get_all_dbus_properties(self):
 
805
        """Returns a generator of (name, attribute) pairs
 
806
        """
 
807
        return ((prop.__get__(self)._dbus_name, prop.__get__(self))
 
808
                for cls in self.__class__.__mro__
 
809
                for name, prop in
 
810
                inspect.getmembers(cls, self._is_dbus_property))
 
811
    
 
812
    def _get_dbus_property(self, interface_name, property_name):
 
813
        """Returns a bound method if one exists which is a D-Bus
 
814
        property with the specified name and interface.
 
815
        """
 
816
        for cls in  self.__class__.__mro__:
 
817
            for name, value in (inspect.getmembers
 
818
                                (cls, self._is_dbus_property)):
 
819
                if (value._dbus_name == property_name
 
820
                    and value._dbus_interface == interface_name):
 
821
                    return value.__get__(self)
 
822
        
 
823
        # No such property
 
824
        raise DBusPropertyNotFound(self.dbus_object_path + ":"
 
825
                                   + interface_name + "."
 
826
                                   + property_name)
 
827
    
 
828
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
 
829
                         out_signature="v")
 
830
    def Get(self, interface_name, property_name):
 
831
        """Standard D-Bus property Get() method, see D-Bus standard.
 
832
        """
 
833
        prop = self._get_dbus_property(interface_name, property_name)
 
834
        if prop._dbus_access == "write":
 
835
            raise DBusPropertyAccessException(property_name)
 
836
        value = prop()
 
837
        if not hasattr(value, "variant_level"):
 
838
            return value
 
839
        return type(value)(value, variant_level=value.variant_level+1)
 
840
    
 
841
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
 
842
    def Set(self, interface_name, property_name, value):
 
843
        """Standard D-Bus property Set() method, see D-Bus standard.
 
844
        """
 
845
        prop = self._get_dbus_property(interface_name, property_name)
 
846
        if prop._dbus_access == "read":
 
847
            raise DBusPropertyAccessException(property_name)
 
848
        if prop._dbus_get_args_options["byte_arrays"]:
 
849
            # The byte_arrays option is not supported yet on
 
850
            # signatures other than "ay".
 
851
            if prop._dbus_signature != "ay":
 
852
                raise ValueError
 
853
            value = dbus.ByteArray(b''.join(chr(byte)
 
854
                                            for byte in value))
 
855
        prop(value)
 
856
    
 
857
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
 
858
                         out_signature="a{sv}")
 
859
    def GetAll(self, interface_name):
 
860
        """Standard D-Bus property GetAll() method, see D-Bus
 
861
        standard.
 
862
        
 
863
        Note: Will not include properties with access="write".
 
864
        """
 
865
        properties = {}
 
866
        for name, prop in self._get_all_dbus_properties():
 
867
            if (interface_name
 
868
                and interface_name != prop._dbus_interface):
 
869
                # Interface non-empty but did not match
 
870
                continue
 
871
            # Ignore write-only properties
 
872
            if prop._dbus_access == "write":
 
873
                continue
 
874
            value = prop()
 
875
            if not hasattr(value, "variant_level"):
 
876
                properties[name] = value
 
877
                continue
 
878
            properties[name] = type(value)(value, variant_level=
 
879
                                           value.variant_level+1)
 
880
        return dbus.Dictionary(properties, signature="sv")
 
881
    
 
882
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
 
883
                         out_signature="s",
 
884
                         path_keyword='object_path',
 
885
                         connection_keyword='connection')
 
886
    def Introspect(self, object_path, connection):
 
887
        """Standard D-Bus method, overloaded to insert property tags.
 
888
        """
 
889
        xmlstring = dbus.service.Object.Introspect(self, object_path,
 
890
                                                   connection)
 
891
        try:
 
892
            document = xml.dom.minidom.parseString(xmlstring)
 
893
            def make_tag(document, name, prop):
 
894
                e = document.createElement("property")
 
895
                e.setAttribute("name", name)
 
896
                e.setAttribute("type", prop._dbus_signature)
 
897
                e.setAttribute("access", prop._dbus_access)
 
898
                return e
 
899
            for if_tag in document.getElementsByTagName("interface"):
 
900
                for tag in (make_tag(document, name, prop)
 
901
                            for name, prop
 
902
                            in self._get_all_dbus_properties()
 
903
                            if prop._dbus_interface
 
904
                            == if_tag.getAttribute("name")):
 
905
                    if_tag.appendChild(tag)
 
906
                # Add the names to the return values for the
 
907
                # "org.freedesktop.DBus.Properties" methods
 
908
                if (if_tag.getAttribute("name")
 
909
                    == "org.freedesktop.DBus.Properties"):
 
910
                    for cn in if_tag.getElementsByTagName("method"):
 
911
                        if cn.getAttribute("name") == "Get":
 
912
                            for arg in cn.getElementsByTagName("arg"):
 
913
                                if (arg.getAttribute("direction")
 
914
                                    == "out"):
 
915
                                    arg.setAttribute("name", "value")
 
916
                        elif cn.getAttribute("name") == "GetAll":
 
917
                            for arg in cn.getElementsByTagName("arg"):
 
918
                                if (arg.getAttribute("direction")
 
919
                                    == "out"):
 
920
                                    arg.setAttribute("name", "props")
 
921
            xmlstring = document.toxml("utf-8")
 
922
            document.unlink()
 
923
        except (AttributeError, xml.dom.DOMException,
 
924
                xml.parsers.expat.ExpatError) as error:
 
925
            logger.error("Failed to override Introspection method",
 
926
                         error)
 
927
        return xmlstring
 
928
 
 
929
 
 
930
def datetime_to_dbus (dt, variant_level=0):
 
931
    """Convert a UTC datetime.datetime() to a D-Bus type."""
 
932
    if dt is None:
 
933
        return dbus.String("", variant_level = variant_level)
 
934
    return dbus.String(dt.isoformat(),
 
935
                       variant_level=variant_level)
 
936
 
 
937
 
 
938
class AlternateDBusNamesMetaclass(DBusObjectWithProperties
 
939
                                  .__metaclass__):
 
940
    """Applied to an empty subclass of a D-Bus object, this metaclass
 
941
    will add additional D-Bus attributes matching a certain pattern.
 
942
    """
 
943
    def __new__(mcs, name, bases, attr):
 
944
        # Go through all the base classes which could have D-Bus
 
945
        # methods, signals, or properties in them
 
946
        for base in (b for b in bases
 
947
                     if issubclass(b, dbus.service.Object)):
 
948
            # Go though all attributes of the base class
 
949
            for attrname, attribute in inspect.getmembers(base):
 
950
                # Ignore non-D-Bus attributes, and D-Bus attributes
 
951
                # with the wrong interface name
 
952
                if (not hasattr(attribute, "_dbus_interface")
 
953
                    or not attribute._dbus_interface
 
954
                    .startswith("se.recompile.Mandos")):
 
955
                    continue
 
956
                # Create an alternate D-Bus interface name based on
 
957
                # the current name
 
958
                alt_interface = (attribute._dbus_interface
 
959
                                 .replace("se.recompile.Mandos",
 
960
                                          "se.bsnet.fukt.Mandos"))
 
961
                # Is this a D-Bus signal?
 
962
                if getattr(attribute, "_dbus_is_signal", False):
 
963
                    # Extract the original non-method function by
 
964
                    # black magic
 
965
                    nonmethod_func = (dict(
 
966
                            zip(attribute.func_code.co_freevars,
 
967
                                attribute.__closure__))["func"]
 
968
                                      .cell_contents)
 
969
                    # Create a new, but exactly alike, function
 
970
                    # object, and decorate it to be a new D-Bus signal
 
971
                    # with the alternate D-Bus interface name
 
972
                    new_function = (dbus.service.signal
 
973
                                    (alt_interface,
 
974
                                     attribute._dbus_signature)
 
975
                                    (types.FunctionType(
 
976
                                nonmethod_func.func_code,
 
977
                                nonmethod_func.func_globals,
 
978
                                nonmethod_func.func_name,
 
979
                                nonmethod_func.func_defaults,
 
980
                                nonmethod_func.func_closure)))
 
981
                    # Define a creator of a function to call both the
 
982
                    # old and new functions, so both the old and new
 
983
                    # signals gets sent when the function is called
 
984
                    def fixscope(func1, func2):
 
985
                        """This function is a scope container to pass
 
986
                        func1 and func2 to the "call_both" function
 
987
                        outside of its arguments"""
 
988
                        def call_both(*args, **kwargs):
 
989
                            """This function will emit two D-Bus
 
990
                            signals by calling func1 and func2"""
 
991
                            func1(*args, **kwargs)
 
992
                            func2(*args, **kwargs)
 
993
                        return call_both
 
994
                    # Create the "call_both" function and add it to
 
995
                    # the class
 
996
                    attr[attrname] = fixscope(attribute,
 
997
                                              new_function)
 
998
                # Is this a D-Bus method?
 
999
                elif getattr(attribute, "_dbus_is_method", False):
 
1000
                    # Create a new, but exactly alike, function
 
1001
                    # object.  Decorate it to be a new D-Bus method
 
1002
                    # with the alternate D-Bus interface name.  Add it
 
1003
                    # to the class.
 
1004
                    attr[attrname] = (dbus.service.method
 
1005
                                      (alt_interface,
 
1006
                                       attribute._dbus_in_signature,
 
1007
                                       attribute._dbus_out_signature)
 
1008
                                      (types.FunctionType
 
1009
                                       (attribute.func_code,
 
1010
                                        attribute.func_globals,
 
1011
                                        attribute.func_name,
 
1012
                                        attribute.func_defaults,
 
1013
                                        attribute.func_closure)))
 
1014
                # Is this a D-Bus property?
 
1015
                elif getattr(attribute, "_dbus_is_property", False):
 
1016
                    # Create a new, but exactly alike, function
 
1017
                    # object, and decorate it to be a new D-Bus
 
1018
                    # property with the alternate D-Bus interface
 
1019
                    # name.  Add it to the class.
 
1020
                    attr[attrname] = (dbus_service_property
 
1021
                                      (alt_interface,
 
1022
                                       attribute._dbus_signature,
 
1023
                                       attribute._dbus_access,
 
1024
                                       attribute
 
1025
                                       ._dbus_get_args_options
 
1026
                                       ["byte_arrays"])
 
1027
                                      (types.FunctionType
 
1028
                                       (attribute.func_code,
 
1029
                                        attribute.func_globals,
 
1030
                                        attribute.func_name,
 
1031
                                        attribute.func_defaults,
 
1032
                                        attribute.func_closure)))
 
1033
        return type.__new__(mcs, name, bases, attr)
 
1034
 
 
1035
 
 
1036
class ClientDBus(Client, DBusObjectWithProperties):
 
1037
    """A Client class using D-Bus
 
1038
    
 
1039
    Attributes:
 
1040
    dbus_object_path: dbus.ObjectPath
 
1041
    bus: dbus.SystemBus()
 
1042
    """
 
1043
    
 
1044
    runtime_expansions = (Client.runtime_expansions
 
1045
                          + ("dbus_object_path",))
 
1046
    
 
1047
    # dbus.service.Object doesn't use super(), so we can't either.
 
1048
    
 
1049
    def __init__(self, bus = None, *args, **kwargs):
 
1050
        self.bus = bus
 
1051
        Client.__init__(self, *args, **kwargs)
 
1052
        self._approvals_pending = 0
 
1053
        
 
1054
        self._approvals_pending = 0
 
1055
        # Only now, when this client is initialized, can it show up on
 
1056
        # the D-Bus
 
1057
        client_object_name = unicode(self.name).translate(
 
1058
            {ord("."): ord("_"),
 
1059
             ord("-"): ord("_")})
 
1060
        self.dbus_object_path = (dbus.ObjectPath
 
1061
                                 ("/clients/" + client_object_name))
 
1062
        DBusObjectWithProperties.__init__(self, self.bus,
 
1063
                                          self.dbus_object_path)
 
1064
        
 
1065
    def notifychangeproperty(transform_func,
 
1066
                             dbus_name, type_func=lambda x: x,
 
1067
                             variant_level=1):
 
1068
        """ Modify a variable so that it's a property which announces
 
1069
        its changes to DBus.
 
1070
        
 
1071
        transform_fun: Function that takes a value and a variant_level
 
1072
                       and transforms it to a D-Bus type.
 
1073
        dbus_name: D-Bus name of the variable
 
1074
        type_func: Function that transform the value before sending it
 
1075
                   to the D-Bus.  Default: no transform
 
1076
        variant_level: D-Bus variant level.  Default: 1
 
1077
        """
 
1078
        attrname = "_{0}".format(dbus_name)
 
1079
        def setter(self, value):
 
1080
            if hasattr(self, "dbus_object_path"):
 
1081
                if (not hasattr(self, attrname) or
 
1082
                    type_func(getattr(self, attrname, None))
 
1083
                    != type_func(value)):
 
1084
                    dbus_value = transform_func(type_func(value),
 
1085
                                                variant_level
 
1086
                                                =variant_level)
 
1087
                    self.PropertyChanged(dbus.String(dbus_name),
 
1088
                                         dbus_value)
 
1089
            setattr(self, attrname, value)
 
1090
        
 
1091
        return property(lambda self: getattr(self, attrname), setter)
 
1092
    
 
1093
    
 
1094
    expires = notifychangeproperty(datetime_to_dbus, "Expires")
 
1095
    approvals_pending = notifychangeproperty(dbus.Boolean,
 
1096
                                             "ApprovalPending",
 
1097
                                             type_func = bool)
 
1098
    enabled = notifychangeproperty(dbus.Boolean, "Enabled")
 
1099
    last_enabled = notifychangeproperty(datetime_to_dbus,
 
1100
                                        "LastEnabled")
 
1101
    checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",
 
1102
                                   type_func = lambda checker:
 
1103
                                       checker is not None)
 
1104
    last_checked_ok = notifychangeproperty(datetime_to_dbus,
 
1105
                                           "LastCheckedOK")
 
1106
    last_approval_request = notifychangeproperty(
 
1107
        datetime_to_dbus, "LastApprovalRequest")
 
1108
    approved_by_default = notifychangeproperty(dbus.Boolean,
 
1109
                                               "ApprovedByDefault")
 
1110
    approval_delay = notifychangeproperty(dbus.UInt64,
 
1111
                                          "ApprovalDelay",
 
1112
                                          type_func =
 
1113
                                          timedelta_to_milliseconds)
 
1114
    approval_duration = notifychangeproperty(
 
1115
        dbus.UInt64, "ApprovalDuration",
 
1116
        type_func = timedelta_to_milliseconds)
 
1117
    host = notifychangeproperty(dbus.String, "Host")
 
1118
    timeout = notifychangeproperty(dbus.UInt64, "Timeout",
 
1119
                                   type_func =
 
1120
                                   timedelta_to_milliseconds)
 
1121
    extended_timeout = notifychangeproperty(
 
1122
        dbus.UInt64, "ExtendedTimeout",
 
1123
        type_func = timedelta_to_milliseconds)
 
1124
    interval = notifychangeproperty(dbus.UInt64,
 
1125
                                    "Interval",
 
1126
                                    type_func =
 
1127
                                    timedelta_to_milliseconds)
 
1128
    checker_command = notifychangeproperty(dbus.String, "Checker")
 
1129
    
 
1130
    del notifychangeproperty
 
1131
    
 
1132
    def __del__(self, *args, **kwargs):
 
1133
        try:
 
1134
            self.remove_from_connection()
 
1135
        except LookupError:
 
1136
            pass
 
1137
        if hasattr(DBusObjectWithProperties, "__del__"):
 
1138
            DBusObjectWithProperties.__del__(self, *args, **kwargs)
 
1139
        Client.__del__(self, *args, **kwargs)
 
1140
    
 
1141
    def checker_callback(self, pid, condition, command,
 
1142
                         *args, **kwargs):
 
1143
        self.checker_callback_tag = None
 
1144
        self.checker = None
 
1145
        if os.WIFEXITED(condition):
 
1146
            exitstatus = os.WEXITSTATUS(condition)
 
1147
            # Emit D-Bus signal
 
1148
            self.CheckerCompleted(dbus.Int16(exitstatus),
 
1149
                                  dbus.Int64(condition),
 
1150
                                  dbus.String(command))
 
1151
        else:
 
1152
            # Emit D-Bus signal
 
1153
            self.CheckerCompleted(dbus.Int16(-1),
 
1154
                                  dbus.Int64(condition),
 
1155
                                  dbus.String(command))
 
1156
        
 
1157
        return Client.checker_callback(self, pid, condition, command,
 
1158
                                       *args, **kwargs)
 
1159
    
 
1160
    def start_checker(self, *args, **kwargs):
 
1161
        old_checker = self.checker
 
1162
        if self.checker is not None:
 
1163
            old_checker_pid = self.checker.pid
 
1164
        else:
 
1165
            old_checker_pid = None
 
1166
        r = Client.start_checker(self, *args, **kwargs)
 
1167
        # Only if new checker process was started
 
1168
        if (self.checker is not None
 
1169
            and old_checker_pid != self.checker.pid):
 
1170
            # Emit D-Bus signal
 
1171
            self.CheckerStarted(self.current_checker_command)
 
1172
        return r
 
1173
    
 
1174
    def _reset_approved(self):
 
1175
        self.approved = None
 
1176
        return False
 
1177
    
 
1178
    def approve(self, value=True):
 
1179
        self.send_changedstate()
 
1180
        self.approved = value
 
1181
        gobject.timeout_add(timedelta_to_milliseconds
 
1182
                            (self.approval_duration),
 
1183
                            self._reset_approved)
 
1184
    
 
1185
    
 
1186
    ## D-Bus methods, signals & properties
 
1187
    _interface = "se.recompile.Mandos.Client"
 
1188
    
 
1189
    ## Signals
479
1190
    
480
1191
    # CheckerCompleted - signal
481
1192
    @dbus.service.signal(_interface, signature="nxs")
489
1200
        "D-Bus signal"
490
1201
        pass
491
1202
    
492
 
    # GetAllProperties - method
493
 
    @dbus.service.method(_interface, out_signature="a{sv}")
494
 
    def GetAllProperties(self):
495
 
        "D-Bus method"
496
 
        return dbus.Dictionary({
497
 
                dbus.String("name"):
498
 
                    dbus.String(self.name, variant_level=1),
499
 
                dbus.String("fingerprint"):
500
 
                    dbus.String(self.fingerprint, variant_level=1),
501
 
                dbus.String("host"):
502
 
                    dbus.String(self.host, variant_level=1),
503
 
                dbus.String("created"):
504
 
                    _datetime_to_dbus(self.created, variant_level=1),
505
 
                dbus.String("last_enabled"):
506
 
                    (_datetime_to_dbus(self.last_enabled,
507
 
                                       variant_level=1)
508
 
                     if self.last_enabled is not None
509
 
                     else dbus.Boolean(False, variant_level=1)),
510
 
                dbus.String("enabled"):
511
 
                    dbus.Boolean(self.enabled, variant_level=1),
512
 
                dbus.String("last_checked_ok"):
513
 
                    (_datetime_to_dbus(self.last_checked_ok,
514
 
                                       variant_level=1)
515
 
                     if self.last_checked_ok is not None
516
 
                     else dbus.Boolean (False, variant_level=1)),
517
 
                dbus.String("timeout"):
518
 
                    dbus.UInt64(self.timeout_milliseconds(),
519
 
                                variant_level=1),
520
 
                dbus.String("interval"):
521
 
                    dbus.UInt64(self.interval_milliseconds(),
522
 
                                variant_level=1),
523
 
                dbus.String("checker"):
524
 
                    dbus.String(self.checker_command,
525
 
                                variant_level=1),
526
 
                dbus.String("checker_running"):
527
 
                    dbus.Boolean(self.checker is not None,
528
 
                                 variant_level=1),
529
 
                dbus.String("object_path"):
530
 
                    dbus.ObjectPath(self.dbus_object_path,
531
 
                                    variant_level=1)
532
 
                }, signature="sv")
533
 
    
534
 
    # IsStillValid - method
535
 
    IsStillValid = (dbus.service.method(_interface, out_signature="b")
536
 
                    (still_valid))
537
 
    IsStillValid.__name__ = "IsStillValid"
538
 
    
539
1203
    # PropertyChanged - signal
540
1204
    @dbus.service.signal(_interface, signature="sv")
541
1205
    def PropertyChanged(self, property, value):
542
1206
        "D-Bus signal"
543
1207
        pass
544
1208
    
545
 
    # SetChecker - method
546
 
    @dbus.service.method(_interface, in_signature="s")
547
 
    def SetChecker(self, checker):
548
 
        "D-Bus setter method"
549
 
        self.checker_command = checker
550
 
        # Emit D-Bus signal
551
 
        self.PropertyChanged(dbus.String(u"checker"),
552
 
                             dbus.String(self.checker_command,
553
 
                                         variant_level=1))
554
 
    
555
 
    # SetHost - method
556
 
    @dbus.service.method(_interface, in_signature="s")
557
 
    def SetHost(self, host):
558
 
        "D-Bus setter method"
559
 
        self.host = host
560
 
        # Emit D-Bus signal
561
 
        self.PropertyChanged(dbus.String(u"host"),
562
 
                             dbus.String(self.host, variant_level=1))
563
 
    
564
 
    # SetInterval - method
565
 
    @dbus.service.method(_interface, in_signature="t")
566
 
    def SetInterval(self, milliseconds):
567
 
        self.interval = datetime.timedelta(0, 0, 0, milliseconds)
568
 
        # Emit D-Bus signal
569
 
        self.PropertyChanged(dbus.String(u"interval"),
570
 
                             (dbus.UInt64(self.interval_milliseconds(),
571
 
                                          variant_level=1)))
572
 
    
573
 
    # SetSecret - method
574
 
    @dbus.service.method(_interface, in_signature="ay",
575
 
                         byte_arrays=True)
576
 
    def SetSecret(self, secret):
577
 
        "D-Bus setter method"
578
 
        self.secret = str(secret)
579
 
    
580
 
    # SetTimeout - method
581
 
    @dbus.service.method(_interface, in_signature="t")
582
 
    def SetTimeout(self, milliseconds):
583
 
        self.timeout = datetime.timedelta(0, 0, 0, milliseconds)
584
 
        # Emit D-Bus signal
585
 
        self.PropertyChanged(dbus.String(u"timeout"),
586
 
                             (dbus.UInt64(self.timeout_milliseconds(),
587
 
                                          variant_level=1)))
 
1209
    # GotSecret - signal
 
1210
    @dbus.service.signal(_interface)
 
1211
    def GotSecret(self):
 
1212
        """D-Bus signal
 
1213
        Is sent after a successful transfer of secret from the Mandos
 
1214
        server to mandos-client
 
1215
        """
 
1216
        pass
 
1217
    
 
1218
    # Rejected - signal
 
1219
    @dbus.service.signal(_interface, signature="s")
 
1220
    def Rejected(self, reason):
 
1221
        "D-Bus signal"
 
1222
        pass
 
1223
    
 
1224
    # NeedApproval - signal
 
1225
    @dbus.service.signal(_interface, signature="tb")
 
1226
    def NeedApproval(self, timeout, default):
 
1227
        "D-Bus signal"
 
1228
        return self.need_approval()
 
1229
    
 
1230
    # NeRwequest - signal
 
1231
    @dbus.service.signal(_interface, signature="s")
 
1232
    def NewRequest(self, ip):
 
1233
        """D-Bus signal
 
1234
        Is sent after a client request a password.
 
1235
        """
 
1236
        pass
 
1237
    
 
1238
    ## Methods
 
1239
    
 
1240
    # Approve - method
 
1241
    @dbus.service.method(_interface, in_signature="b")
 
1242
    def Approve(self, value):
 
1243
        self.approve(value)
 
1244
    
 
1245
    # CheckedOK - method
 
1246
    @dbus.service.method(_interface)
 
1247
    def CheckedOK(self):
 
1248
        self.checked_ok()
588
1249
    
589
1250
    # Enable - method
590
 
    Enable = dbus.service.method(_interface)(enable)
591
 
    Enable.__name__ = "Enable"
 
1251
    @dbus.service.method(_interface)
 
1252
    def Enable(self):
 
1253
        "D-Bus method"
 
1254
        self.enable()
592
1255
    
593
1256
    # StartChecker - method
594
1257
    @dbus.service.method(_interface)
603
1266
        self.disable()
604
1267
    
605
1268
    # StopChecker - method
606
 
    StopChecker = dbus.service.method(_interface)(stop_checker)
607
 
    StopChecker.__name__ = "StopChecker"
 
1269
    @dbus.service.method(_interface)
 
1270
    def StopChecker(self):
 
1271
        self.stop_checker()
 
1272
    
 
1273
    ## Properties
 
1274
    
 
1275
    # ApprovalPending - property
 
1276
    @dbus_service_property(_interface, signature="b", access="read")
 
1277
    def ApprovalPending_dbus_property(self):
 
1278
        return dbus.Boolean(bool(self.approvals_pending))
 
1279
    
 
1280
    # ApprovedByDefault - property
 
1281
    @dbus_service_property(_interface, signature="b",
 
1282
                           access="readwrite")
 
1283
    def ApprovedByDefault_dbus_property(self, value=None):
 
1284
        if value is None:       # get
 
1285
            return dbus.Boolean(self.approved_by_default)
 
1286
        self.approved_by_default = bool(value)
 
1287
    
 
1288
    # ApprovalDelay - property
 
1289
    @dbus_service_property(_interface, signature="t",
 
1290
                           access="readwrite")
 
1291
    def ApprovalDelay_dbus_property(self, value=None):
 
1292
        if value is None:       # get
 
1293
            return dbus.UInt64(self.approval_delay_milliseconds())
 
1294
        self.approval_delay = datetime.timedelta(0, 0, 0, value)
 
1295
    
 
1296
    # ApprovalDuration - property
 
1297
    @dbus_service_property(_interface, signature="t",
 
1298
                           access="readwrite")
 
1299
    def ApprovalDuration_dbus_property(self, value=None):
 
1300
        if value is None:       # get
 
1301
            return dbus.UInt64(timedelta_to_milliseconds(
 
1302
                    self.approval_duration))
 
1303
        self.approval_duration = datetime.timedelta(0, 0, 0, value)
 
1304
    
 
1305
    # Name - property
 
1306
    @dbus_service_property(_interface, signature="s", access="read")
 
1307
    def Name_dbus_property(self):
 
1308
        return dbus.String(self.name)
 
1309
    
 
1310
    # Fingerprint - property
 
1311
    @dbus_service_property(_interface, signature="s", access="read")
 
1312
    def Fingerprint_dbus_property(self):
 
1313
        return dbus.String(self.fingerprint)
 
1314
    
 
1315
    # Host - property
 
1316
    @dbus_service_property(_interface, signature="s",
 
1317
                           access="readwrite")
 
1318
    def Host_dbus_property(self, value=None):
 
1319
        if value is None:       # get
 
1320
            return dbus.String(self.host)
 
1321
        self.host = unicode(value)
 
1322
    
 
1323
    # Created - property
 
1324
    @dbus_service_property(_interface, signature="s", access="read")
 
1325
    def Created_dbus_property(self):
 
1326
        return datetime_to_dbus(self.created)
 
1327
    
 
1328
    # LastEnabled - property
 
1329
    @dbus_service_property(_interface, signature="s", access="read")
 
1330
    def LastEnabled_dbus_property(self):
 
1331
        return datetime_to_dbus(self.last_enabled)
 
1332
    
 
1333
    # Enabled - property
 
1334
    @dbus_service_property(_interface, signature="b",
 
1335
                           access="readwrite")
 
1336
    def Enabled_dbus_property(self, value=None):
 
1337
        if value is None:       # get
 
1338
            return dbus.Boolean(self.enabled)
 
1339
        if value:
 
1340
            self.enable()
 
1341
        else:
 
1342
            self.disable()
 
1343
    
 
1344
    # LastCheckedOK - property
 
1345
    @dbus_service_property(_interface, signature="s",
 
1346
                           access="readwrite")
 
1347
    def LastCheckedOK_dbus_property(self, value=None):
 
1348
        if value is not None:
 
1349
            self.checked_ok()
 
1350
            return
 
1351
        return datetime_to_dbus(self.last_checked_ok)
 
1352
    
 
1353
    # Expires - property
 
1354
    @dbus_service_property(_interface, signature="s", access="read")
 
1355
    def Expires_dbus_property(self):
 
1356
        return datetime_to_dbus(self.expires)
 
1357
    
 
1358
    # LastApprovalRequest - property
 
1359
    @dbus_service_property(_interface, signature="s", access="read")
 
1360
    def LastApprovalRequest_dbus_property(self):
 
1361
        return datetime_to_dbus(self.last_approval_request)
 
1362
    
 
1363
    # Timeout - property
 
1364
    @dbus_service_property(_interface, signature="t",
 
1365
                           access="readwrite")
 
1366
    def Timeout_dbus_property(self, value=None):
 
1367
        if value is None:       # get
 
1368
            return dbus.UInt64(self.timeout_milliseconds())
 
1369
        self.timeout = datetime.timedelta(0, 0, 0, value)
 
1370
        # Reschedule timeout
 
1371
        if self.enabled:
 
1372
            now = datetime.datetime.utcnow()
 
1373
            time_to_die = timedelta_to_milliseconds(
 
1374
                (self.last_checked_ok + self.timeout) - now)
 
1375
            if time_to_die <= 0:
 
1376
                # The timeout has passed
 
1377
                self.disable()
 
1378
            else:
 
1379
                self.expires = (now +
 
1380
                                datetime.timedelta(milliseconds =
 
1381
                                                   time_to_die))
 
1382
                if (getattr(self, "disable_initiator_tag", None)
 
1383
                    is None):
 
1384
                    return
 
1385
                gobject.source_remove(self.disable_initiator_tag)
 
1386
                self.disable_initiator_tag = (gobject.timeout_add
 
1387
                                              (time_to_die,
 
1388
                                               self.disable))
 
1389
    
 
1390
    # ExtendedTimeout - property
 
1391
    @dbus_service_property(_interface, signature="t",
 
1392
                           access="readwrite")
 
1393
    def ExtendedTimeout_dbus_property(self, value=None):
 
1394
        if value is None:       # get
 
1395
            return dbus.UInt64(self.extended_timeout_milliseconds())
 
1396
        self.extended_timeout = datetime.timedelta(0, 0, 0, value)
 
1397
    
 
1398
    # Interval - property
 
1399
    @dbus_service_property(_interface, signature="t",
 
1400
                           access="readwrite")
 
1401
    def Interval_dbus_property(self, value=None):
 
1402
        if value is None:       # get
 
1403
            return dbus.UInt64(self.interval_milliseconds())
 
1404
        self.interval = datetime.timedelta(0, 0, 0, value)
 
1405
        if getattr(self, "checker_initiator_tag", None) is None:
 
1406
            return
 
1407
        if self.enabled:
 
1408
            # Reschedule checker run
 
1409
            gobject.source_remove(self.checker_initiator_tag)
 
1410
            self.checker_initiator_tag = (gobject.timeout_add
 
1411
                                          (value, self.start_checker))
 
1412
            self.start_checker()    # Start one now, too
 
1413
    
 
1414
    # Checker - property
 
1415
    @dbus_service_property(_interface, signature="s",
 
1416
                           access="readwrite")
 
1417
    def Checker_dbus_property(self, value=None):
 
1418
        if value is None:       # get
 
1419
            return dbus.String(self.checker_command)
 
1420
        self.checker_command = unicode(value)
 
1421
    
 
1422
    # CheckerRunning - property
 
1423
    @dbus_service_property(_interface, signature="b",
 
1424
                           access="readwrite")
 
1425
    def CheckerRunning_dbus_property(self, value=None):
 
1426
        if value is None:       # get
 
1427
            return dbus.Boolean(self.checker is not None)
 
1428
        if value:
 
1429
            self.start_checker()
 
1430
        else:
 
1431
            self.stop_checker()
 
1432
    
 
1433
    # ObjectPath - property
 
1434
    @dbus_service_property(_interface, signature="o", access="read")
 
1435
    def ObjectPath_dbus_property(self):
 
1436
        return self.dbus_object_path # is already a dbus.ObjectPath
 
1437
    
 
1438
    # Secret = property
 
1439
    @dbus_service_property(_interface, signature="ay",
 
1440
                           access="write", byte_arrays=True)
 
1441
    def Secret_dbus_property(self, value):
 
1442
        self.secret = str(value)
608
1443
    
609
1444
    del _interface
610
1445
 
611
1446
 
612
 
def peer_certificate(session):
613
 
    "Return the peer's OpenPGP certificate as a bytestring"
614
 
    # If not an OpenPGP certificate...
615
 
    if (gnutls.library.functions
616
 
        .gnutls_certificate_type_get(session._c_object)
617
 
        != gnutls.library.constants.GNUTLS_CRT_OPENPGP):
618
 
        # ...do the normal thing
619
 
        return session.peer_certificate
620
 
    list_size = ctypes.c_uint(1)
621
 
    cert_list = (gnutls.library.functions
622
 
                 .gnutls_certificate_get_peers
623
 
                 (session._c_object, ctypes.byref(list_size)))
624
 
    if not bool(cert_list) and list_size.value != 0:
625
 
        raise gnutls.errors.GNUTLSError("error getting peer"
626
 
                                        " certificate")
627
 
    if list_size.value == 0:
628
 
        return None
629
 
    cert = cert_list[0]
630
 
    return ctypes.string_at(cert.data, cert.size)
631
 
 
632
 
 
633
 
def fingerprint(openpgp):
634
 
    "Convert an OpenPGP bytestring to a hexdigit fingerprint string"
635
 
    # New GnuTLS "datum" with the OpenPGP public key
636
 
    datum = (gnutls.library.types
637
 
             .gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
638
 
                                         ctypes.POINTER
639
 
                                         (ctypes.c_ubyte)),
640
 
                             ctypes.c_uint(len(openpgp))))
641
 
    # New empty GnuTLS certificate
642
 
    crt = gnutls.library.types.gnutls_openpgp_crt_t()
643
 
    (gnutls.library.functions
644
 
     .gnutls_openpgp_crt_init(ctypes.byref(crt)))
645
 
    # Import the OpenPGP public key into the certificate
646
 
    (gnutls.library.functions
647
 
     .gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
648
 
                                gnutls.library.constants
649
 
                                .GNUTLS_OPENPGP_FMT_RAW))
650
 
    # Verify the self signature in the key
651
 
    crtverify = ctypes.c_uint()
652
 
    (gnutls.library.functions
653
 
     .gnutls_openpgp_crt_verify_self(crt, 0, ctypes.byref(crtverify)))
654
 
    if crtverify.value != 0:
655
 
        gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
656
 
        raise gnutls.errors.CertificateSecurityError("Verify failed")
657
 
    # New buffer for the fingerprint
658
 
    buf = ctypes.create_string_buffer(20)
659
 
    buf_len = ctypes.c_size_t()
660
 
    # Get the fingerprint from the certificate into the buffer
661
 
    (gnutls.library.functions
662
 
     .gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
663
 
                                         ctypes.byref(buf_len)))
664
 
    # Deinit the certificate
665
 
    gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
666
 
    # Convert the buffer to a Python bytestring
667
 
    fpr = ctypes.string_at(buf, buf_len.value)
668
 
    # Convert the bytestring to hexadecimal notation
669
 
    hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
670
 
    return hex_fpr
671
 
 
672
 
 
673
 
class TCP_handler(SocketServer.BaseRequestHandler, object):
674
 
    """A TCP request handler class.
675
 
    Instantiated by IPv6_TCPServer for each request to handle it.
 
1447
class ProxyClient(object):
 
1448
    def __init__(self, child_pipe, fpr, address):
 
1449
        self._pipe = child_pipe
 
1450
        self._pipe.send(('init', fpr, address))
 
1451
        if not self._pipe.recv():
 
1452
            raise KeyError()
 
1453
    
 
1454
    def __getattribute__(self, name):
 
1455
        if name == '_pipe':
 
1456
            return super(ProxyClient, self).__getattribute__(name)
 
1457
        self._pipe.send(('getattr', name))
 
1458
        data = self._pipe.recv()
 
1459
        if data[0] == 'data':
 
1460
            return data[1]
 
1461
        if data[0] == 'function':
 
1462
            def func(*args, **kwargs):
 
1463
                self._pipe.send(('funcall', name, args, kwargs))
 
1464
                return self._pipe.recv()[1]
 
1465
            return func
 
1466
    
 
1467
    def __setattr__(self, name, value):
 
1468
        if name == '_pipe':
 
1469
            return super(ProxyClient, self).__setattr__(name, value)
 
1470
        self._pipe.send(('setattr', name, value))
 
1471
 
 
1472
 
 
1473
class ClientDBusTransitional(ClientDBus):
 
1474
    __metaclass__ = AlternateDBusNamesMetaclass
 
1475
 
 
1476
 
 
1477
class ClientHandler(socketserver.BaseRequestHandler, object):
 
1478
    """A class to handle client connections.
 
1479
    
 
1480
    Instantiated once for each connection to handle it.
676
1481
    Note: This will run in its own forked process."""
677
1482
    
678
1483
    def handle(self):
679
 
        logger.info(u"TCP connection from: %s",
680
 
                    unicode(self.client_address))
681
 
        session = (gnutls.connection
682
 
                   .ClientSession(self.request,
683
 
                                  gnutls.connection
684
 
                                  .X509Credentials()))
685
 
        
686
 
        line = self.request.makefile().readline()
687
 
        logger.debug(u"Protocol version: %r", line)
688
 
        try:
689
 
            if int(line.strip().split()[0]) > 1:
690
 
                raise RuntimeError
691
 
        except (ValueError, IndexError, RuntimeError), error:
692
 
            logger.error(u"Unknown protocol version: %s", error)
693
 
            return
694
 
        
695
 
        # Note: gnutls.connection.X509Credentials is really a generic
696
 
        # GnuTLS certificate credentials object so long as no X.509
697
 
        # keys are added to it.  Therefore, we can use it here despite
698
 
        # using OpenPGP certificates.
699
 
        
700
 
        #priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
701
 
        #                     "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
702
 
        #                     "+DHE-DSS"))
703
 
        # Use a fallback default, since this MUST be set.
704
 
        priority = self.server.settings.get("priority", "NORMAL")
705
 
        (gnutls.library.functions
706
 
         .gnutls_priority_set_direct(session._c_object,
707
 
                                     priority, None))
708
 
        
709
 
        try:
710
 
            session.handshake()
711
 
        except gnutls.errors.GNUTLSError, error:
712
 
            logger.warning(u"Handshake failed: %s", error)
713
 
            # Do not run session.bye() here: the session is not
714
 
            # established.  Just abandon the request.
715
 
            return
716
 
        logger.debug(u"Handshake succeeded")
717
 
        try:
718
 
            fpr = fingerprint(peer_certificate(session))
719
 
        except (TypeError, gnutls.errors.GNUTLSError), error:
720
 
            logger.warning(u"Bad certificate: %s", error)
721
 
            session.bye()
722
 
            return
723
 
        logger.debug(u"Fingerprint: %s", fpr)
724
 
        
725
 
        for c in self.server.clients:
726
 
            if c.fingerprint == fpr:
727
 
                client = c
728
 
                break
729
 
        else:
730
 
            logger.warning(u"Client not found for fingerprint: %s",
731
 
                           fpr)
732
 
            session.bye()
733
 
            return
734
 
        # Have to check if client.still_valid(), since it is possible
735
 
        # that the client timed out while establishing the GnuTLS
736
 
        # session.
737
 
        if not client.still_valid():
738
 
            logger.warning(u"Client %(name)s is invalid",
739
 
                           vars(client))
740
 
            session.bye()
741
 
            return
742
 
        ## This won't work here, since we're in a fork.
743
 
        # client.checked_ok()
744
 
        sent_size = 0
745
 
        while sent_size < len(client.secret):
746
 
            sent = session.send(client.secret[sent_size:])
747
 
            logger.debug(u"Sent: %d, remaining: %d",
748
 
                         sent, len(client.secret)
749
 
                         - (sent_size + sent))
750
 
            sent_size += sent
751
 
        session.bye()
752
 
 
753
 
 
754
 
class IPv6_TCPServer(SocketServer.ForkingMixIn,
755
 
                     SocketServer.TCPServer, object):
 
1484
        with contextlib.closing(self.server.child_pipe) as child_pipe:
 
1485
            logger.info("TCP connection from: %s",
 
1486
                        unicode(self.client_address))
 
1487
            logger.debug("Pipe FD: %d",
 
1488
                         self.server.child_pipe.fileno())
 
1489
            
 
1490
            session = (gnutls.connection
 
1491
                       .ClientSession(self.request,
 
1492
                                      gnutls.connection
 
1493
                                      .X509Credentials()))
 
1494
            
 
1495
            # Note: gnutls.connection.X509Credentials is really a
 
1496
            # generic GnuTLS certificate credentials object so long as
 
1497
            # no X.509 keys are added to it.  Therefore, we can use it
 
1498
            # here despite using OpenPGP certificates.
 
1499
            
 
1500
            #priority = ':'.join(("NONE", "+VERS-TLS1.1",
 
1501
            #                      "+AES-256-CBC", "+SHA1",
 
1502
            #                      "+COMP-NULL", "+CTYPE-OPENPGP",
 
1503
            #                      "+DHE-DSS"))
 
1504
            # Use a fallback default, since this MUST be set.
 
1505
            priority = self.server.gnutls_priority
 
1506
            if priority is None:
 
1507
                priority = "NORMAL"
 
1508
            (gnutls.library.functions
 
1509
             .gnutls_priority_set_direct(session._c_object,
 
1510
                                         priority, None))
 
1511
            
 
1512
            # Start communication using the Mandos protocol
 
1513
            # Get protocol number
 
1514
            line = self.request.makefile().readline()
 
1515
            logger.debug("Protocol version: %r", line)
 
1516
            try:
 
1517
                if int(line.strip().split()[0]) > 1:
 
1518
                    raise RuntimeError
 
1519
            except (ValueError, IndexError, RuntimeError) as error:
 
1520
                logger.error("Unknown protocol version: %s", error)
 
1521
                return
 
1522
            
 
1523
            # Start GnuTLS connection
 
1524
            try:
 
1525
                session.handshake()
 
1526
            except gnutls.errors.GNUTLSError as error:
 
1527
                logger.warning("Handshake failed: %s", error)
 
1528
                # Do not run session.bye() here: the session is not
 
1529
                # established.  Just abandon the request.
 
1530
                return
 
1531
            logger.debug("Handshake succeeded")
 
1532
            
 
1533
            approval_required = False
 
1534
            try:
 
1535
                try:
 
1536
                    fpr = self.fingerprint(self.peer_certificate
 
1537
                                           (session))
 
1538
                except (TypeError,
 
1539
                        gnutls.errors.GNUTLSError) as error:
 
1540
                    logger.warning("Bad certificate: %s", error)
 
1541
                    return
 
1542
                logger.debug("Fingerprint: %s", fpr)
 
1543
                
 
1544
                try:
 
1545
                    client = ProxyClient(child_pipe, fpr,
 
1546
                                         self.client_address)
 
1547
                except KeyError:
 
1548
                    return
 
1549
                
 
1550
                if self.server.use_dbus:
 
1551
                    # Emit D-Bus signal
 
1552
                    client.NewRequest(str(self.client_address))
 
1553
                
 
1554
                if client.approval_delay:
 
1555
                    delay = client.approval_delay
 
1556
                    client.approvals_pending += 1
 
1557
                    approval_required = True
 
1558
                
 
1559
                while True:
 
1560
                    if not client.enabled:
 
1561
                        logger.info("Client %s is disabled",
 
1562
                                       client.name)
 
1563
                        if self.server.use_dbus:
 
1564
                            # Emit D-Bus signal
 
1565
                            client.Rejected("Disabled")
 
1566
                        return
 
1567
                    
 
1568
                    if client.approved or not client.approval_delay:
 
1569
                        #We are approved or approval is disabled
 
1570
                        break
 
1571
                    elif client.approved is None:
 
1572
                        logger.info("Client %s needs approval",
 
1573
                                    client.name)
 
1574
                        if self.server.use_dbus:
 
1575
                            # Emit D-Bus signal
 
1576
                            client.NeedApproval(
 
1577
                                client.approval_delay_milliseconds(),
 
1578
                                client.approved_by_default)
 
1579
                    else:
 
1580
                        logger.warning("Client %s was not approved",
 
1581
                                       client.name)
 
1582
                        if self.server.use_dbus:
 
1583
                            # Emit D-Bus signal
 
1584
                            client.Rejected("Denied")
 
1585
                        return
 
1586
                    
 
1587
                    #wait until timeout or approved
 
1588
                    time = datetime.datetime.now()
 
1589
                    client.changedstate.acquire()
 
1590
                    (client.changedstate.wait
 
1591
                     (float(client.timedelta_to_milliseconds(delay)
 
1592
                            / 1000)))
 
1593
                    client.changedstate.release()
 
1594
                    time2 = datetime.datetime.now()
 
1595
                    if (time2 - time) >= delay:
 
1596
                        if not client.approved_by_default:
 
1597
                            logger.warning("Client %s timed out while"
 
1598
                                           " waiting for approval",
 
1599
                                           client.name)
 
1600
                            if self.server.use_dbus:
 
1601
                                # Emit D-Bus signal
 
1602
                                client.Rejected("Approval timed out")
 
1603
                            return
 
1604
                        else:
 
1605
                            break
 
1606
                    else:
 
1607
                        delay -= time2 - time
 
1608
                
 
1609
                sent_size = 0
 
1610
                while sent_size < len(client.secret):
 
1611
                    try:
 
1612
                        sent = session.send(client.secret[sent_size:])
 
1613
                    except gnutls.errors.GNUTLSError as error:
 
1614
                        logger.warning("gnutls send failed")
 
1615
                        return
 
1616
                    logger.debug("Sent: %d, remaining: %d",
 
1617
                                 sent, len(client.secret)
 
1618
                                 - (sent_size + sent))
 
1619
                    sent_size += sent
 
1620
                
 
1621
                logger.info("Sending secret to %s", client.name)
 
1622
                # bump the timeout using extended_timeout
 
1623
                client.checked_ok(client.extended_timeout)
 
1624
                if self.server.use_dbus:
 
1625
                    # Emit D-Bus signal
 
1626
                    client.GotSecret()
 
1627
            
 
1628
            finally:
 
1629
                if approval_required:
 
1630
                    client.approvals_pending -= 1
 
1631
                try:
 
1632
                    session.bye()
 
1633
                except gnutls.errors.GNUTLSError as error:
 
1634
                    logger.warning("GnuTLS bye failed")
 
1635
    
 
1636
    @staticmethod
 
1637
    def peer_certificate(session):
 
1638
        "Return the peer's OpenPGP certificate as a bytestring"
 
1639
        # If not an OpenPGP certificate...
 
1640
        if (gnutls.library.functions
 
1641
            .gnutls_certificate_type_get(session._c_object)
 
1642
            != gnutls.library.constants.GNUTLS_CRT_OPENPGP):
 
1643
            # ...do the normal thing
 
1644
            return session.peer_certificate
 
1645
        list_size = ctypes.c_uint(1)
 
1646
        cert_list = (gnutls.library.functions
 
1647
                     .gnutls_certificate_get_peers
 
1648
                     (session._c_object, ctypes.byref(list_size)))
 
1649
        if not bool(cert_list) and list_size.value != 0:
 
1650
            raise gnutls.errors.GNUTLSError("error getting peer"
 
1651
                                            " certificate")
 
1652
        if list_size.value == 0:
 
1653
            return None
 
1654
        cert = cert_list[0]
 
1655
        return ctypes.string_at(cert.data, cert.size)
 
1656
    
 
1657
    @staticmethod
 
1658
    def fingerprint(openpgp):
 
1659
        "Convert an OpenPGP bytestring to a hexdigit fingerprint"
 
1660
        # New GnuTLS "datum" with the OpenPGP public key
 
1661
        datum = (gnutls.library.types
 
1662
                 .gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
 
1663
                                             ctypes.POINTER
 
1664
                                             (ctypes.c_ubyte)),
 
1665
                                 ctypes.c_uint(len(openpgp))))
 
1666
        # New empty GnuTLS certificate
 
1667
        crt = gnutls.library.types.gnutls_openpgp_crt_t()
 
1668
        (gnutls.library.functions
 
1669
         .gnutls_openpgp_crt_init(ctypes.byref(crt)))
 
1670
        # Import the OpenPGP public key into the certificate
 
1671
        (gnutls.library.functions
 
1672
         .gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
 
1673
                                    gnutls.library.constants
 
1674
                                    .GNUTLS_OPENPGP_FMT_RAW))
 
1675
        # Verify the self signature in the key
 
1676
        crtverify = ctypes.c_uint()
 
1677
        (gnutls.library.functions
 
1678
         .gnutls_openpgp_crt_verify_self(crt, 0,
 
1679
                                         ctypes.byref(crtverify)))
 
1680
        if crtverify.value != 0:
 
1681
            gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
 
1682
            raise (gnutls.errors.CertificateSecurityError
 
1683
                   ("Verify failed"))
 
1684
        # New buffer for the fingerprint
 
1685
        buf = ctypes.create_string_buffer(20)
 
1686
        buf_len = ctypes.c_size_t()
 
1687
        # Get the fingerprint from the certificate into the buffer
 
1688
        (gnutls.library.functions
 
1689
         .gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
 
1690
                                             ctypes.byref(buf_len)))
 
1691
        # Deinit the certificate
 
1692
        gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
 
1693
        # Convert the buffer to a Python bytestring
 
1694
        fpr = ctypes.string_at(buf, buf_len.value)
 
1695
        # Convert the bytestring to hexadecimal notation
 
1696
        hex_fpr = binascii.hexlify(fpr).upper()
 
1697
        return hex_fpr
 
1698
 
 
1699
 
 
1700
class MultiprocessingMixIn(object):
 
1701
    """Like socketserver.ThreadingMixIn, but with multiprocessing"""
 
1702
    def sub_process_main(self, request, address):
 
1703
        try:
 
1704
            self.finish_request(request, address)
 
1705
        except Exception:
 
1706
            self.handle_error(request, address)
 
1707
        self.close_request(request)
 
1708
    
 
1709
    def process_request(self, request, address):
 
1710
        """Start a new process to process the request."""
 
1711
        proc = multiprocessing.Process(target = self.sub_process_main,
 
1712
                                       args = (request,
 
1713
                                               address))
 
1714
        proc.start()
 
1715
        return proc
 
1716
 
 
1717
 
 
1718
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
 
1719
    """ adds a pipe to the MixIn """
 
1720
    def process_request(self, request, client_address):
 
1721
        """Overrides and wraps the original process_request().
 
1722
        
 
1723
        This function creates a new pipe in self.pipe
 
1724
        """
 
1725
        parent_pipe, self.child_pipe = multiprocessing.Pipe()
 
1726
        
 
1727
        proc = MultiprocessingMixIn.process_request(self, request,
 
1728
                                                    client_address)
 
1729
        self.child_pipe.close()
 
1730
        self.add_pipe(parent_pipe, proc)
 
1731
    
 
1732
    def add_pipe(self, parent_pipe, proc):
 
1733
        """Dummy function; override as necessary"""
 
1734
        raise NotImplementedError
 
1735
 
 
1736
 
 
1737
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
 
1738
                     socketserver.TCPServer, object):
756
1739
    """IPv6-capable TCP server.  Accepts 'None' as address and/or port
 
1740
    
757
1741
    Attributes:
758
 
        settings:       Server settings
759
 
        clients:        Set() of Client objects
760
1742
        enabled:        Boolean; whether this server is activated yet
 
1743
        interface:      None or a network interface name (string)
 
1744
        use_ipv6:       Boolean; to use IPv6 or not
761
1745
    """
762
 
    address_family = socket.AF_INET6
763
 
    def __init__(self, *args, **kwargs):
764
 
        if "settings" in kwargs:
765
 
            self.settings = kwargs["settings"]
766
 
            del kwargs["settings"]
767
 
        if "clients" in kwargs:
768
 
            self.clients = kwargs["clients"]
769
 
            del kwargs["clients"]
770
 
        if "use_ipv6" in kwargs:
771
 
            if not kwargs["use_ipv6"]:
772
 
                self.address_family = socket.AF_INET
773
 
            del kwargs["use_ipv6"]
774
 
        self.enabled = False
775
 
        super(IPv6_TCPServer, self).__init__(*args, **kwargs)
 
1746
    def __init__(self, server_address, RequestHandlerClass,
 
1747
                 interface=None, use_ipv6=True):
 
1748
        self.interface = interface
 
1749
        if use_ipv6:
 
1750
            self.address_family = socket.AF_INET6
 
1751
        socketserver.TCPServer.__init__(self, server_address,
 
1752
                                        RequestHandlerClass)
776
1753
    def server_bind(self):
777
1754
        """This overrides the normal server_bind() function
778
1755
        to bind to an interface if one was specified, and also NOT to
779
1756
        bind to an address or port if they were not specified."""
780
 
        if self.settings["interface"]:
781
 
            # 25 is from /usr/include/asm-i486/socket.h
782
 
            SO_BINDTODEVICE = getattr(socket, "SO_BINDTODEVICE", 25)
783
 
            try:
784
 
                self.socket.setsockopt(socket.SOL_SOCKET,
785
 
                                       SO_BINDTODEVICE,
786
 
                                       self.settings["interface"])
787
 
            except socket.error, error:
788
 
                if error[0] == errno.EPERM:
789
 
                    logger.error(u"No permission to"
790
 
                                 u" bind to interface %s",
791
 
                                 self.settings["interface"])
792
 
                else:
793
 
                    raise
 
1757
        if self.interface is not None:
 
1758
            if SO_BINDTODEVICE is None:
 
1759
                logger.error("SO_BINDTODEVICE does not exist;"
 
1760
                             " cannot bind to interface %s",
 
1761
                             self.interface)
 
1762
            else:
 
1763
                try:
 
1764
                    self.socket.setsockopt(socket.SOL_SOCKET,
 
1765
                                           SO_BINDTODEVICE,
 
1766
                                           str(self.interface
 
1767
                                               + '\0'))
 
1768
                except socket.error as error:
 
1769
                    if error[0] == errno.EPERM:
 
1770
                        logger.error("No permission to"
 
1771
                                     " bind to interface %s",
 
1772
                                     self.interface)
 
1773
                    elif error[0] == errno.ENOPROTOOPT:
 
1774
                        logger.error("SO_BINDTODEVICE not available;"
 
1775
                                     " cannot bind to interface %s",
 
1776
                                     self.interface)
 
1777
                    else:
 
1778
                        raise
794
1779
        # Only bind(2) the socket if we really need to.
795
1780
        if self.server_address[0] or self.server_address[1]:
796
1781
            if not self.server_address[0]:
803
1788
            elif not self.server_address[1]:
804
1789
                self.server_address = (self.server_address[0],
805
1790
                                       0)
806
 
#                 if self.settings["interface"]:
 
1791
#                 if self.interface:
807
1792
#                     self.server_address = (self.server_address[0],
808
1793
#                                            0, # port
809
1794
#                                            0, # flowinfo
810
1795
#                                            if_nametoindex
811
 
#                                            (self.settings
812
 
#                                             ["interface"]))
813
 
            return super(IPv6_TCPServer, self).server_bind()
 
1796
#                                            (self.interface))
 
1797
            return socketserver.TCPServer.server_bind(self)
 
1798
 
 
1799
 
 
1800
class MandosServer(IPv6_TCPServer):
 
1801
    """Mandos server.
 
1802
    
 
1803
    Attributes:
 
1804
        clients:        set of Client objects
 
1805
        gnutls_priority GnuTLS priority string
 
1806
        use_dbus:       Boolean; to emit D-Bus signals or not
 
1807
    
 
1808
    Assumes a gobject.MainLoop event loop.
 
1809
    """
 
1810
    def __init__(self, server_address, RequestHandlerClass,
 
1811
                 interface=None, use_ipv6=True, clients=None,
 
1812
                 gnutls_priority=None, use_dbus=True):
 
1813
        self.enabled = False
 
1814
        self.clients = clients
 
1815
        if self.clients is None:
 
1816
            self.clients = {}
 
1817
        self.use_dbus = use_dbus
 
1818
        self.gnutls_priority = gnutls_priority
 
1819
        IPv6_TCPServer.__init__(self, server_address,
 
1820
                                RequestHandlerClass,
 
1821
                                interface = interface,
 
1822
                                use_ipv6 = use_ipv6)
814
1823
    def server_activate(self):
815
1824
        if self.enabled:
816
 
            return super(IPv6_TCPServer, self).server_activate()
 
1825
            return socketserver.TCPServer.server_activate(self)
 
1826
    
817
1827
    def enable(self):
818
1828
        self.enabled = True
 
1829
    
 
1830
    def add_pipe(self, parent_pipe, proc):
 
1831
        # Call "handle_ipc" for both data and EOF events
 
1832
        gobject.io_add_watch(parent_pipe.fileno(),
 
1833
                             gobject.IO_IN | gobject.IO_HUP,
 
1834
                             functools.partial(self.handle_ipc,
 
1835
                                               parent_pipe =
 
1836
                                               parent_pipe,
 
1837
                                               proc = proc))
 
1838
    
 
1839
    def handle_ipc(self, source, condition, parent_pipe=None,
 
1840
                   proc = None, client_object=None):
 
1841
        condition_names = {
 
1842
            gobject.IO_IN: "IN",   # There is data to read.
 
1843
            gobject.IO_OUT: "OUT", # Data can be written (without
 
1844
                                    # blocking).
 
1845
            gobject.IO_PRI: "PRI", # There is urgent data to read.
 
1846
            gobject.IO_ERR: "ERR", # Error condition.
 
1847
            gobject.IO_HUP: "HUP"  # Hung up (the connection has been
 
1848
                                    # broken, usually for pipes and
 
1849
                                    # sockets).
 
1850
            }
 
1851
        conditions_string = ' | '.join(name
 
1852
                                       for cond, name in
 
1853
                                       condition_names.iteritems()
 
1854
                                       if cond & condition)
 
1855
        # error, or the other end of multiprocessing.Pipe has closed
 
1856
        if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):
 
1857
            # Wait for other process to exit
 
1858
            proc.join()
 
1859
            return False
 
1860
        
 
1861
        # Read a request from the child
 
1862
        request = parent_pipe.recv()
 
1863
        command = request[0]
 
1864
        
 
1865
        if command == 'init':
 
1866
            fpr = request[1]
 
1867
            address = request[2]
 
1868
            
 
1869
            for c in self.clients.itervalues():
 
1870
                if c.fingerprint == fpr:
 
1871
                    client = c
 
1872
                    break
 
1873
            else:
 
1874
                logger.info("Client not found for fingerprint: %s, ad"
 
1875
                            "dress: %s", fpr, address)
 
1876
                if self.use_dbus:
 
1877
                    # Emit D-Bus signal
 
1878
                    mandos_dbus_service.ClientNotFound(fpr,
 
1879
                                                       address[0])
 
1880
                parent_pipe.send(False)
 
1881
                return False
 
1882
            
 
1883
            gobject.io_add_watch(parent_pipe.fileno(),
 
1884
                                 gobject.IO_IN | gobject.IO_HUP,
 
1885
                                 functools.partial(self.handle_ipc,
 
1886
                                                   parent_pipe =
 
1887
                                                   parent_pipe,
 
1888
                                                   proc = proc,
 
1889
                                                   client_object =
 
1890
                                                   client))
 
1891
            parent_pipe.send(True)
 
1892
            # remove the old hook in favor of the new above hook on
 
1893
            # same fileno
 
1894
            return False
 
1895
        if command == 'funcall':
 
1896
            funcname = request[1]
 
1897
            args = request[2]
 
1898
            kwargs = request[3]
 
1899
            
 
1900
            parent_pipe.send(('data', getattr(client_object,
 
1901
                                              funcname)(*args,
 
1902
                                                         **kwargs)))
 
1903
        
 
1904
        if command == 'getattr':
 
1905
            attrname = request[1]
 
1906
            if callable(client_object.__getattribute__(attrname)):
 
1907
                parent_pipe.send(('function',))
 
1908
            else:
 
1909
                parent_pipe.send(('data', client_object
 
1910
                                  .__getattribute__(attrname)))
 
1911
        
 
1912
        if command == 'setattr':
 
1913
            attrname = request[1]
 
1914
            value = request[2]
 
1915
            setattr(client_object, attrname, value)
 
1916
        
 
1917
        return True
819
1918
 
820
1919
 
821
1920
def string_to_delta(interval):
829
1928
    datetime.timedelta(0, 3600)
830
1929
    >>> string_to_delta('24h')
831
1930
    datetime.timedelta(1)
832
 
    >>> string_to_delta(u'1w')
 
1931
    >>> string_to_delta('1w')
833
1932
    datetime.timedelta(7)
834
1933
    >>> string_to_delta('5m 30s')
835
1934
    datetime.timedelta(0, 330)
839
1938
        try:
840
1939
            suffix = unicode(s[-1])
841
1940
            value = int(s[:-1])
842
 
            if suffix == u"d":
 
1941
            if suffix == "d":
843
1942
                delta = datetime.timedelta(value)
844
 
            elif suffix == u"s":
 
1943
            elif suffix == "s":
845
1944
                delta = datetime.timedelta(0, value)
846
 
            elif suffix == u"m":
 
1945
            elif suffix == "m":
847
1946
                delta = datetime.timedelta(0, 0, 0, 0, value)
848
 
            elif suffix == u"h":
 
1947
            elif suffix == "h":
849
1948
                delta = datetime.timedelta(0, 0, 0, 0, 0, value)
850
 
            elif suffix == u"w":
 
1949
            elif suffix == "w":
851
1950
                delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
852
1951
            else:
853
 
                raise ValueError
854
 
        except (ValueError, IndexError):
855
 
            raise ValueError
 
1952
                raise ValueError("Unknown suffix %r" % suffix)
 
1953
        except (ValueError, IndexError) as e:
 
1954
            raise ValueError(*(e.args))
856
1955
        timevalue += delta
857
1956
    return timevalue
858
1957
 
859
1958
 
860
 
def server_state_changed(state):
861
 
    """Derived from the Avahi example code"""
862
 
    if state == avahi.SERVER_COLLISION:
863
 
        logger.error(u"Zeroconf server name collision")
864
 
        service.remove()
865
 
    elif state == avahi.SERVER_RUNNING:
866
 
        service.add()
867
 
 
868
 
 
869
 
def entry_group_state_changed(state, error):
870
 
    """Derived from the Avahi example code"""
871
 
    logger.debug(u"Avahi state change: %i", state)
872
 
    
873
 
    if state == avahi.ENTRY_GROUP_ESTABLISHED:
874
 
        logger.debug(u"Zeroconf service established.")
875
 
    elif state == avahi.ENTRY_GROUP_COLLISION:
876
 
        logger.warning(u"Zeroconf service name collision.")
877
 
        service.rename()
878
 
    elif state == avahi.ENTRY_GROUP_FAILURE:
879
 
        logger.critical(u"Avahi: Error in group state changed %s",
880
 
                        unicode(error))
881
 
        raise AvahiGroupError(u"State changed: %s" % unicode(error))
882
 
 
883
 
def if_nametoindex(interface):
884
 
    """Call the C function if_nametoindex(), or equivalent"""
885
 
    global if_nametoindex
886
 
    try:
887
 
        if_nametoindex = (ctypes.cdll.LoadLibrary
888
 
                          (ctypes.util.find_library("c"))
889
 
                          .if_nametoindex)
890
 
    except (OSError, AttributeError):
891
 
        if "struct" not in sys.modules:
892
 
            import struct
893
 
        if "fcntl" not in sys.modules:
894
 
            import fcntl
895
 
        def if_nametoindex(interface):
896
 
            "Get an interface index the hard way, i.e. using fcntl()"
897
 
            SIOCGIFINDEX = 0x8933  # From /usr/include/linux/sockios.h
898
 
            with closing(socket.socket()) as s:
899
 
                ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
900
 
                                    struct.pack("16s16x", interface))
901
 
            interface_index = struct.unpack("I", ifreq[16:20])[0]
902
 
            return interface_index
903
 
    return if_nametoindex(interface)
904
 
 
905
 
 
906
1959
def daemon(nochdir = False, noclose = False):
907
1960
    """See daemon(3).  Standard BSD Unix function.
 
1961
    
908
1962
    This should really exist as os.daemon, but it doesn't (yet)."""
909
1963
    if os.fork():
910
1964
        sys.exit()
918
1972
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
919
1973
        if not stat.S_ISCHR(os.fstat(null).st_mode):
920
1974
            raise OSError(errno.ENODEV,
921
 
                          "/dev/null not a character device")
 
1975
                          "%s not a character device"
 
1976
                          % os.path.devnull)
922
1977
        os.dup2(null, sys.stdin.fileno())
923
1978
        os.dup2(null, sys.stdout.fileno())
924
1979
        os.dup2(null, sys.stderr.fileno())
927
1982
 
928
1983
 
929
1984
def main():
930
 
    parser = optparse.OptionParser(version = "%%prog %s" % version)
931
 
    parser.add_option("-i", "--interface", type="string",
932
 
                      metavar="IF", help="Bind to interface IF")
933
 
    parser.add_option("-a", "--address", type="string",
934
 
                      help="Address to listen for requests on")
935
 
    parser.add_option("-p", "--port", type="int",
936
 
                      help="Port number to receive requests on")
937
 
    parser.add_option("--check", action="store_true",
938
 
                      help="Run self-test")
939
 
    parser.add_option("--debug", action="store_true",
940
 
                      help="Debug mode; run in foreground and log to"
941
 
                      " terminal")
942
 
    parser.add_option("--priority", type="string", help="GnuTLS"
943
 
                      " priority string (see GnuTLS documentation)")
944
 
    parser.add_option("--servicename", type="string", metavar="NAME",
945
 
                      help="Zeroconf service name")
946
 
    parser.add_option("--configdir", type="string",
947
 
                      default="/etc/mandos", metavar="DIR",
948
 
                      help="Directory to search for configuration"
949
 
                      " files")
950
 
    parser.add_option("--no-dbus", action="store_false",
951
 
                      dest="use_dbus",
952
 
                      help=optparse.SUPPRESS_HELP) # XXX: Not done yet
953
 
    parser.add_option("--no-ipv6", action="store_false",
954
 
                      dest="use_ipv6", help="Do not use IPv6")
955
 
    options = parser.parse_args()[0]
 
1985
    
 
1986
    ##################################################################
 
1987
    # Parsing of options, both command line and config file
 
1988
    
 
1989
    parser = argparse.ArgumentParser()
 
1990
    parser.add_argument("-v", "--version", action="version",
 
1991
                        version = "%%(prog)s %s" % version,
 
1992
                        help="show version number and exit")
 
1993
    parser.add_argument("-i", "--interface", metavar="IF",
 
1994
                        help="Bind to interface IF")
 
1995
    parser.add_argument("-a", "--address",
 
1996
                        help="Address to listen for requests on")
 
1997
    parser.add_argument("-p", "--port", type=int,
 
1998
                        help="Port number to receive requests on")
 
1999
    parser.add_argument("--check", action="store_true",
 
2000
                        help="Run self-test")
 
2001
    parser.add_argument("--debug", action="store_true",
 
2002
                        help="Debug mode; run in foreground and log"
 
2003
                        " to terminal")
 
2004
    parser.add_argument("--debuglevel", metavar="LEVEL",
 
2005
                        help="Debug level for stdout output")
 
2006
    parser.add_argument("--priority", help="GnuTLS"
 
2007
                        " priority string (see GnuTLS documentation)")
 
2008
    parser.add_argument("--servicename",
 
2009
                        metavar="NAME", help="Zeroconf service name")
 
2010
    parser.add_argument("--configdir",
 
2011
                        default="/etc/mandos", metavar="DIR",
 
2012
                        help="Directory to search for configuration"
 
2013
                        " files")
 
2014
    parser.add_argument("--no-dbus", action="store_false",
 
2015
                        dest="use_dbus", help="Do not provide D-Bus"
 
2016
                        " system bus interface")
 
2017
    parser.add_argument("--no-ipv6", action="store_false",
 
2018
                        dest="use_ipv6", help="Do not use IPv6")
 
2019
    parser.add_argument("--no-restore", action="store_false",
 
2020
                        dest="restore", help="Do not restore stored"
 
2021
                        " state")
 
2022
    parser.add_argument("--statedir", metavar="DIR",
 
2023
                        help="Directory to save/restore state in")
 
2024
    
 
2025
    options = parser.parse_args()
956
2026
    
957
2027
    if options.check:
958
2028
        import doctest
969
2039
                        "servicename": "Mandos",
970
2040
                        "use_dbus": "True",
971
2041
                        "use_ipv6": "True",
 
2042
                        "debuglevel": "",
 
2043
                        "restore": "True",
 
2044
                        "statedir": "/var/lib/mandos"
972
2045
                        }
973
2046
    
974
2047
    # Parse config file for server-global settings
975
 
    server_config = ConfigParser.SafeConfigParser(server_defaults)
 
2048
    server_config = configparser.SafeConfigParser(server_defaults)
976
2049
    del server_defaults
977
 
    server_config.read(os.path.join(options.configdir, "mandos.conf"))
 
2050
    server_config.read(os.path.join(options.configdir,
 
2051
                                    "mandos.conf"))
978
2052
    # Convert the SafeConfigParser object to a dict
979
2053
    server_settings = server_config.defaults()
980
2054
    # Use the appropriate methods on the non-string config options
981
 
    server_settings["debug"] = server_config.getboolean("DEFAULT",
982
 
                                                        "debug")
983
 
    server_settings["use_dbus"] = server_config.getboolean("DEFAULT",
984
 
                                                           "use_dbus")
985
 
    server_settings["use_ipv6"] = server_config.getboolean("DEFAULT",
986
 
                                                           "use_ipv6")
 
2055
    for option in ("debug", "use_dbus", "use_ipv6"):
 
2056
        server_settings[option] = server_config.getboolean("DEFAULT",
 
2057
                                                           option)
987
2058
    if server_settings["port"]:
988
2059
        server_settings["port"] = server_config.getint("DEFAULT",
989
2060
                                                       "port")
993
2064
    # options, if set.
994
2065
    for option in ("interface", "address", "port", "debug",
995
2066
                   "priority", "servicename", "configdir",
996
 
                   "use_dbus", "use_ipv6"):
 
2067
                   "use_dbus", "use_ipv6", "debuglevel", "restore",
 
2068
                   "statedir"):
997
2069
        value = getattr(options, option)
998
2070
        if value is not None:
999
2071
            server_settings[option] = value
1000
2072
    del options
 
2073
    # Force all strings to be unicode
 
2074
    for option in server_settings.keys():
 
2075
        if type(server_settings[option]) is str:
 
2076
            server_settings[option] = unicode(server_settings[option])
1001
2077
    # Now we have our good server settings in "server_settings"
1002
2078
    
 
2079
    ##################################################################
 
2080
    
1003
2081
    # For convenience
1004
2082
    debug = server_settings["debug"]
 
2083
    debuglevel = server_settings["debuglevel"]
1005
2084
    use_dbus = server_settings["use_dbus"]
1006
 
    use_dbus = False            # XXX: Not done yet
1007
2085
    use_ipv6 = server_settings["use_ipv6"]
 
2086
    stored_state_path = os.path.join(server_settings["statedir"],
 
2087
                                     stored_state_file)
1008
2088
    
1009
 
    if not debug:
1010
 
        syslogger.setLevel(logging.WARNING)
1011
 
        console.setLevel(logging.WARNING)
 
2089
    if debug:
 
2090
        initlogger(debug, logging.DEBUG)
 
2091
    else:
 
2092
        if not debuglevel:
 
2093
            initlogger(debug)
 
2094
        else:
 
2095
            level = getattr(logging, debuglevel.upper())
 
2096
            initlogger(debug, level)
1012
2097
    
1013
2098
    if server_settings["servicename"] != "Mandos":
1014
2099
        syslogger.setFormatter(logging.Formatter
1015
 
                               ('Mandos (%s): %%(levelname)s:'
1016
 
                                ' %%(message)s'
 
2100
                               ('Mandos (%s) [%%(process)d]:'
 
2101
                                ' %%(levelname)s: %%(message)s'
1017
2102
                                % server_settings["servicename"]))
1018
2103
    
1019
2104
    # Parse config file with clients
1020
 
    client_defaults = { "timeout": "1h",
1021
 
                        "interval": "5m",
1022
 
                        "checker": "fping -q -- %%(host)s",
1023
 
                        "host": "",
1024
 
                        }
1025
 
    client_config = ConfigParser.SafeConfigParser(client_defaults)
 
2105
    client_config = configparser.SafeConfigParser(Client
 
2106
                                                  .client_defaults)
1026
2107
    client_config.read(os.path.join(server_settings["configdir"],
1027
2108
                                    "clients.conf"))
1028
2109
    
1029
 
    clients = Set()
1030
 
    tcp_server = IPv6_TCPServer((server_settings["address"],
1031
 
                                 server_settings["port"]),
1032
 
                                TCP_handler,
1033
 
                                settings=server_settings,
1034
 
                                clients=clients, use_ipv6=use_ipv6)
1035
 
    pidfilename = "/var/run/mandos.pid"
1036
 
    try:
1037
 
        pidfile = open(pidfilename, "w")
1038
 
    except IOError:
1039
 
        logger.error("Could not open file %r", pidfilename)
 
2110
    global mandos_dbus_service
 
2111
    mandos_dbus_service = None
 
2112
    
 
2113
    tcp_server = MandosServer((server_settings["address"],
 
2114
                               server_settings["port"]),
 
2115
                              ClientHandler,
 
2116
                              interface=(server_settings["interface"]
 
2117
                                         or None),
 
2118
                              use_ipv6=use_ipv6,
 
2119
                              gnutls_priority=
 
2120
                              server_settings["priority"],
 
2121
                              use_dbus=use_dbus)
 
2122
    if not debug:
 
2123
        pidfilename = "/var/run/mandos.pid"
 
2124
        try:
 
2125
            pidfile = open(pidfilename, "w")
 
2126
        except IOError:
 
2127
            logger.error("Could not open file %r", pidfilename)
1040
2128
    
1041
2129
    try:
1042
2130
        uid = pwd.getpwnam("_mandos").pw_uid
1048
2136
        except KeyError:
1049
2137
            try:
1050
2138
                uid = pwd.getpwnam("nobody").pw_uid
1051
 
                gid = pwd.getpwnam("nogroup").pw_gid
 
2139
                gid = pwd.getpwnam("nobody").pw_gid
1052
2140
            except KeyError:
1053
2141
                uid = 65534
1054
2142
                gid = 65534
1055
2143
    try:
1056
2144
        os.setgid(gid)
1057
2145
        os.setuid(uid)
1058
 
    except OSError, error:
 
2146
    except OSError as error:
1059
2147
        if error[0] != errno.EPERM:
1060
2148
            raise error
1061
2149
    
1062
 
    # Enable all possible GnuTLS debugging
1063
2150
    if debug:
 
2151
        # Enable all possible GnuTLS debugging
 
2152
        
1064
2153
        # "Use a log level over 10 to enable all debugging options."
1065
2154
        # - GnuTLS manual
1066
2155
        gnutls.library.functions.gnutls_global_set_log_level(11)
1071
2160
        
1072
2161
        (gnutls.library.functions
1073
2162
         .gnutls_global_set_log_function(debug_gnutls))
1074
 
    
1075
 
    global service
1076
 
    protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
1077
 
    service = AvahiService(name = server_settings["servicename"],
1078
 
                           servicetype = "_mandos._tcp",
1079
 
                           protocol = protocol)
1080
 
    if server_settings["interface"]:
1081
 
        service.interface = (if_nametoindex
1082
 
                             (server_settings["interface"]))
 
2163
        
 
2164
        # Redirect stdin so all checkers get /dev/null
 
2165
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
 
2166
        os.dup2(null, sys.stdin.fileno())
 
2167
        if null > 2:
 
2168
            os.close(null)
 
2169
    
 
2170
    # Need to fork before connecting to D-Bus
 
2171
    if not debug:
 
2172
        # Close all input and output, do double fork, etc.
 
2173
        daemon()
 
2174
    
 
2175
    gobject.threads_init()
1083
2176
    
1084
2177
    global main_loop
1085
 
    global bus
1086
 
    global server
1087
2178
    # From the Avahi example code
1088
2179
    DBusGMainLoop(set_as_default=True )
1089
2180
    main_loop = gobject.MainLoop()
1090
2181
    bus = dbus.SystemBus()
1091
 
    server = dbus.Interface(bus.get_object(avahi.DBUS_NAME,
1092
 
                                           avahi.DBUS_PATH_SERVER),
1093
 
                            avahi.DBUS_INTERFACE_SERVER)
1094
2182
    # End of Avahi example code
1095
2183
    if use_dbus:
1096
 
        bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos", bus)
1097
 
    
1098
 
    clients.update(Set(Client(name = section,
1099
 
                              config
1100
 
                              = dict(client_config.items(section)),
1101
 
                              use_dbus = use_dbus)
1102
 
                       for section in client_config.sections()))
1103
 
    if not clients:
1104
 
        logger.warning(u"No clients defined")
1105
 
    
1106
 
    if debug:
1107
 
        # Redirect stdin so all checkers get /dev/null
1108
 
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1109
 
        os.dup2(null, sys.stdin.fileno())
1110
 
        if null > 2:
1111
 
            os.close(null)
1112
 
    else:
1113
 
        # No console logging
1114
 
        logger.removeHandler(console)
1115
 
        # Close all input and output, do double fork, etc.
1116
 
        daemon()
1117
 
    
1118
 
    try:
1119
 
        pid = os.getpid()
1120
 
        pidfile.write(str(pid) + "\n")
1121
 
        pidfile.close()
1122
 
        del pidfile
1123
 
    except IOError:
1124
 
        logger.error(u"Could not write to file %r with PID %d",
1125
 
                     pidfilename, pid)
1126
 
    except NameError:
1127
 
        # "pidfile" was never created
1128
 
        pass
1129
 
    del pidfilename
1130
 
    
1131
 
    def cleanup():
1132
 
        "Cleanup function; run on exit"
1133
 
        global group
1134
 
        # From the Avahi example code
1135
 
        if not group is None:
1136
 
            group.Free()
1137
 
            group = None
1138
 
        # End of Avahi example code
 
2184
        try:
 
2185
            bus_name = dbus.service.BusName("se.recompile.Mandos",
 
2186
                                            bus, do_not_queue=True)
 
2187
            old_bus_name = (dbus.service.BusName
 
2188
                            ("se.bsnet.fukt.Mandos", bus,
 
2189
                             do_not_queue=True))
 
2190
        except dbus.exceptions.NameExistsException as e:
 
2191
            logger.error(unicode(e) + ", disabling D-Bus")
 
2192
            use_dbus = False
 
2193
            server_settings["use_dbus"] = False
 
2194
            tcp_server.use_dbus = False
 
2195
    protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
 
2196
    service = AvahiServiceToSyslog(name =
 
2197
                                   server_settings["servicename"],
 
2198
                                   servicetype = "_mandos._tcp",
 
2199
                                   protocol = protocol, bus = bus)
 
2200
    if server_settings["interface"]:
 
2201
        service.interface = (if_nametoindex
 
2202
                             (str(server_settings["interface"])))
 
2203
    
 
2204
    global multiprocessing_manager
 
2205
    multiprocessing_manager = multiprocessing.Manager()
 
2206
    
 
2207
    client_class = Client
 
2208
    if use_dbus:
 
2209
        client_class = functools.partial(ClientDBusTransitional,
 
2210
                                         bus = bus)
 
2211
    
 
2212
    client_settings = Client.config_parser(client_config)
 
2213
    old_client_settings = {}
 
2214
    clients_data = {}
 
2215
    
 
2216
    # Get client data and settings from last running state.
 
2217
    if server_settings["restore"]:
 
2218
        try:
 
2219
            with open(stored_state_path, "rb") as stored_state:
 
2220
                clients_data, old_client_settings = (pickle.load
 
2221
                                                     (stored_state))
 
2222
            os.remove(stored_state_path)
 
2223
        except IOError as e:
 
2224
            logger.warning("Could not load persistent state: {0}"
 
2225
                           .format(e))
 
2226
            if e.errno != errno.ENOENT:
 
2227
                raise
 
2228
        except EOFError as e:
 
2229
            logger.warning("Could not load persistent state: "
 
2230
                           "EOFError: {0}".format(e))
 
2231
    
 
2232
    with PGPEngine() as pgp:
 
2233
        for client_name, client in clients_data.iteritems():
 
2234
            # Decide which value to use after restoring saved state.
 
2235
            # We have three different values: Old config file,
 
2236
            # new config file, and saved state.
 
2237
            # New config value takes precedence if it differs from old
 
2238
            # config value, otherwise use saved state.
 
2239
            for name, value in client_settings[client_name].items():
 
2240
                try:
 
2241
                    # For each value in new config, check if it
 
2242
                    # differs from the old config value (Except for
 
2243
                    # the "secret" attribute)
 
2244
                    if (name != "secret" and
 
2245
                        value != old_client_settings[client_name]
 
2246
                        [name]):
 
2247
                        client[name] = value
 
2248
                except KeyError:
 
2249
                    pass
 
2250
            
 
2251
            # Clients who has passed its expire date can still be
 
2252
            # enabled if its last checker was successful.  Clients
 
2253
            # whose checker failed before we stored its state is
 
2254
            # assumed to have failed all checkers during downtime.
 
2255
            if client["enabled"]:
 
2256
                if datetime.datetime.utcnow() >= client["expires"]:
 
2257
                    if not client["last_checked_ok"]:
 
2258
                        logger.warning(
 
2259
                            "disabling client {0} - Client never "
 
2260
                            "performed a successfull checker"
 
2261
                            .format(client["name"]))
 
2262
                        client["enabled"] = False
 
2263
                    elif client["last_checker_status"] != 0:
 
2264
                        logger.warning(
 
2265
                            "disabling client {0} - Client "
 
2266
                            "last checker failed with error code {1}"
 
2267
                            .format(client["name"],
 
2268
                                    client["last_checker_status"]))
 
2269
                        client["enabled"] = False
 
2270
                    else:
 
2271
                        client["expires"] = (datetime.datetime
 
2272
                                             .utcnow()
 
2273
                                             + client["timeout"])
 
2274
                        logger.debug("Last checker succeeded,"
 
2275
                                     " keeping {0} enabled"
 
2276
                                     .format(client["name"]))
 
2277
            try:
 
2278
                client["secret"] = (
 
2279
                    pgp.decrypt(client["encrypted_secret"],
 
2280
                                client_settings[client_name]
 
2281
                                ["secret"]))
 
2282
            except PGPError:
 
2283
                # If decryption fails, we use secret from new settings
 
2284
                logger.debug("Failed to decrypt {0} old secret"
 
2285
                             .format(client_name))
 
2286
                client["secret"] = (
 
2287
                    client_settings[client_name]["secret"])
 
2288
 
 
2289
    
 
2290
    # Add/remove clients based on new changes made to config
 
2291
    for client_name in (set(old_client_settings)
 
2292
                        - set(client_settings)):
 
2293
        del clients_data[client_name]
 
2294
    for client_name in (set(client_settings)
 
2295
                        - set(old_client_settings)):
 
2296
        clients_data[client_name] = client_settings[client_name]
 
2297
 
 
2298
    # Create clients all clients
 
2299
    for client_name, client in clients_data.iteritems():
 
2300
        tcp_server.clients[client_name] = client_class(
 
2301
            name = client_name, settings = client)
 
2302
    
 
2303
    if not tcp_server.clients:
 
2304
        logger.warning("No clients defined")
1139
2305
        
1140
 
        while clients:
1141
 
            client = clients.pop()
1142
 
            client.disable_hook = None
1143
 
            client.disable()
1144
 
    
1145
 
    atexit.register(cleanup)
1146
 
    
1147
2306
    if not debug:
 
2307
        try:
 
2308
            with pidfile:
 
2309
                pid = os.getpid()
 
2310
                pidfile.write(str(pid) + "\n".encode("utf-8"))
 
2311
            del pidfile
 
2312
        except IOError:
 
2313
            logger.error("Could not write to file %r with PID %d",
 
2314
                         pidfilename, pid)
 
2315
        except NameError:
 
2316
            # "pidfile" was never created
 
2317
            pass
 
2318
        del pidfilename
1148
2319
        signal.signal(signal.SIGINT, signal.SIG_IGN)
 
2320
    
1149
2321
    signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
1150
2322
    signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
1151
2323
    
1152
2324
    if use_dbus:
1153
 
        class MandosServer(dbus.service.Object):
 
2325
        class MandosDBusService(dbus.service.Object):
1154
2326
            """A D-Bus proxy object"""
1155
2327
            def __init__(self):
1156
2328
                dbus.service.Object.__init__(self, bus, "/")
1157
 
            _interface = u"se.bsnet.fukt.Mandos"
1158
 
            
1159
 
            @dbus.service.signal(_interface, signature="oa{sv}")
1160
 
            def ClientAdded(self, objpath, properties):
 
2329
            _interface = "se.recompile.Mandos"
 
2330
            
 
2331
            @dbus.service.signal(_interface, signature="o")
 
2332
            def ClientAdded(self, objpath):
 
2333
                "D-Bus signal"
 
2334
                pass
 
2335
            
 
2336
            @dbus.service.signal(_interface, signature="ss")
 
2337
            def ClientNotFound(self, fingerprint, address):
1161
2338
                "D-Bus signal"
1162
2339
                pass
1163
2340
            
1169
2346
            @dbus.service.method(_interface, out_signature="ao")
1170
2347
            def GetAllClients(self):
1171
2348
                "D-Bus method"
1172
 
                return dbus.Array(c.dbus_object_path for c in clients)
 
2349
                return dbus.Array(c.dbus_object_path
 
2350
                                  for c in
 
2351
                                  tcp_server.clients.itervalues())
1173
2352
            
1174
 
            @dbus.service.method(_interface, out_signature="a{oa{sv}}")
 
2353
            @dbus.service.method(_interface,
 
2354
                                 out_signature="a{oa{sv}}")
1175
2355
            def GetAllClientsWithProperties(self):
1176
2356
                "D-Bus method"
1177
2357
                return dbus.Dictionary(
1178
 
                    ((c.dbus_object_path, c.GetAllProperties())
1179
 
                     for c in clients),
 
2358
                    ((c.dbus_object_path, c.GetAll(""))
 
2359
                     for c in tcp_server.clients.itervalues()),
1180
2360
                    signature="oa{sv}")
1181
2361
            
1182
2362
            @dbus.service.method(_interface, in_signature="o")
1183
2363
            def RemoveClient(self, object_path):
1184
2364
                "D-Bus method"
1185
 
                for c in clients:
 
2365
                for c in tcp_server.clients.itervalues():
1186
2366
                    if c.dbus_object_path == object_path:
1187
 
                        clients.remove(c)
 
2367
                        del tcp_server.clients[c.name]
 
2368
                        c.remove_from_connection()
1188
2369
                        # Don't signal anything except ClientRemoved
1189
 
                        c.use_dbus = False
1190
 
                        c.disable()
 
2370
                        c.disable(quiet=True)
1191
2371
                        # Emit D-Bus signal
1192
2372
                        self.ClientRemoved(object_path, c.name)
1193
2373
                        return
1194
 
                raise KeyError
 
2374
                raise KeyError(object_path)
1195
2375
            
1196
2376
            del _interface
1197
2377
        
1198
 
        mandos_server = MandosServer()
1199
 
    
1200
 
    for client in clients:
 
2378
        class MandosDBusServiceTransitional(MandosDBusService):
 
2379
            __metaclass__ = AlternateDBusNamesMetaclass
 
2380
        mandos_dbus_service = MandosDBusServiceTransitional()
 
2381
    
 
2382
    def cleanup():
 
2383
        "Cleanup function; run on exit"
 
2384
        service.cleanup()
 
2385
        
 
2386
        multiprocessing.active_children()
 
2387
        if not (tcp_server.clients or client_settings):
 
2388
            return
 
2389
        
 
2390
        # Store client before exiting. Secrets are encrypted with key
 
2391
        # based on what config file has. If config file is
 
2392
        # removed/edited, old secret will thus be unrecovable.
 
2393
        clients = {}
 
2394
        with PGPEngine() as pgp:
 
2395
            for client in tcp_server.clients.itervalues():
 
2396
                key = client_settings[client.name]["secret"]
 
2397
                client.encrypted_secret = pgp.encrypt(client.secret,
 
2398
                                                      key)
 
2399
                client_dict = {}
 
2400
                
 
2401
                # A list of attributes that can not be pickled
 
2402
                # + secret.
 
2403
                exclude = set(("bus", "changedstate", "secret",
 
2404
                               "checker"))
 
2405
                for name, typ in (inspect.getmembers
 
2406
                                  (dbus.service.Object)):
 
2407
                    exclude.add(name)
 
2408
                
 
2409
                client_dict["encrypted_secret"] = (client
 
2410
                                                   .encrypted_secret)
 
2411
                for attr in client.client_structure:
 
2412
                    if attr not in exclude:
 
2413
                        client_dict[attr] = getattr(client, attr)
 
2414
                
 
2415
                clients[client.name] = client_dict
 
2416
                del client_settings[client.name]["secret"]
 
2417
        
 
2418
        try:
 
2419
            tempfd, tempname = tempfile.mkstemp(suffix=".pickle",
 
2420
                                                prefix="clients-",
 
2421
                                                dir=os.path.dirname
 
2422
                                                (stored_state_path))
 
2423
            with os.fdopen(tempfd, "wb") as stored_state:
 
2424
                pickle.dump((clients, client_settings), stored_state)
 
2425
            os.rename(tempname, stored_state_path)
 
2426
        except (IOError, OSError) as e:
 
2427
            logger.warning("Could not save persistent state: {0}"
 
2428
                           .format(e))
 
2429
            if not debug:
 
2430
                try:
 
2431
                    os.remove(tempname)
 
2432
                except NameError:
 
2433
                    pass
 
2434
            if e.errno not in set((errno.ENOENT, errno.EACCES,
 
2435
                                   errno.EEXIST)):
 
2436
                raise e
 
2437
        
 
2438
        # Delete all clients, and settings from config
 
2439
        while tcp_server.clients:
 
2440
            name, client = tcp_server.clients.popitem()
 
2441
            if use_dbus:
 
2442
                client.remove_from_connection()
 
2443
            # Don't signal anything except ClientRemoved
 
2444
            client.disable(quiet=True)
 
2445
            if use_dbus:
 
2446
                # Emit D-Bus signal
 
2447
                mandos_dbus_service.ClientRemoved(client
 
2448
                                                  .dbus_object_path,
 
2449
                                                  client.name)
 
2450
        client_settings.clear()
 
2451
    
 
2452
    atexit.register(cleanup)
 
2453
    
 
2454
    for client in tcp_server.clients.itervalues():
1201
2455
        if use_dbus:
1202
2456
            # Emit D-Bus signal
1203
 
            mandos_server.ClientAdded(client.dbus_object_path,
1204
 
                                      client.GetAllProperties())
1205
 
        client.enable()
 
2457
            mandos_dbus_service.ClientAdded(client.dbus_object_path)
 
2458
        # Need to initiate checking of clients
 
2459
        if client.enabled:
 
2460
            client.init_checker()
1206
2461
    
1207
2462
    tcp_server.enable()
1208
2463
    tcp_server.server_activate()
1210
2465
    # Find out what port we got
1211
2466
    service.port = tcp_server.socket.getsockname()[1]
1212
2467
    if use_ipv6:
1213
 
        logger.info(u"Now listening on address %r, port %d,"
 
2468
        logger.info("Now listening on address %r, port %d,"
1214
2469
                    " flowinfo %d, scope_id %d"
1215
2470
                    % tcp_server.socket.getsockname())
1216
2471
    else:                       # IPv4
1217
 
        logger.info(u"Now listening on address %r, port %d"
 
2472
        logger.info("Now listening on address %r, port %d"
1218
2473
                    % tcp_server.socket.getsockname())
1219
2474
    
1220
2475
    #service.interface = tcp_server.socket.getsockname()[3]
1221
2476
    
1222
2477
    try:
1223
2478
        # From the Avahi example code
1224
 
        server.connect_to_signal("StateChanged", server_state_changed)
1225
2479
        try:
1226
 
            server_state_changed(server.GetState())
1227
 
        except dbus.exceptions.DBusException, error:
1228
 
            logger.critical(u"DBusException: %s", error)
 
2480
            service.activate()
 
2481
        except dbus.exceptions.DBusException as error:
 
2482
            logger.critical("DBusException: %s", error)
 
2483
            cleanup()
1229
2484
            sys.exit(1)
1230
2485
        # End of Avahi example code
1231
2486
        
1234
2489
                             (tcp_server.handle_request
1235
2490
                              (*args[2:], **kwargs) or True))
1236
2491
        
1237
 
        logger.debug(u"Starting main loop")
 
2492
        logger.debug("Starting main loop")
1238
2493
        main_loop.run()
1239
 
    except AvahiError, error:
1240
 
        logger.critical(u"AvahiError: %s", error)
 
2494
    except AvahiError as error:
 
2495
        logger.critical("AvahiError: %s", error)
 
2496
        cleanup()
1241
2497
        sys.exit(1)
1242
2498
    except KeyboardInterrupt:
1243
2499
        if debug:
1244
 
            print >> sys.stderr
 
2500
            print("", file=sys.stderr)
1245
2501
        logger.debug("Server received KeyboardInterrupt")
1246
2502
    logger.debug("Server exiting")
 
2503
    # Must run before the D-Bus bus name gets deregistered
 
2504
    cleanup()
1247
2505
 
1248
2506
if __name__ == '__main__':
1249
2507
    main()