/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos

  • Committer: Teddy Hogeborn
  • Date: 2012-01-01 05:42:51 UTC
  • mfrom: (237.4.22 release)
  • Revision ID: teddy@recompile.se-20120101054251-26jflhej4znq2mzq
Merge from release branch.

Show diffs side-by-side

added added

removed removed

Lines of Context:
34
34
from __future__ import (division, absolute_import, print_function,
35
35
                        unicode_literals)
36
36
 
37
 
from future_builtins import *
38
 
 
39
37
import SocketServer as socketserver
40
38
import socket
41
39
import argparse
67
65
import types
68
66
import binascii
69
67
import tempfile
70
 
import itertools
71
68
 
72
69
import dbus
73
70
import dbus.service
88
85
    except ImportError:
89
86
        SO_BINDTODEVICE = None
90
87
 
91
 
version = "1.5.5"
 
88
version = "1.5.0"
92
89
stored_state_file = "clients.pickle"
93
90
 
94
91
logger = logging.getLogger()
151
148
    def __enter__(self):
152
149
        return self
153
150
    
154
 
    def __exit__(self, exc_type, exc_value, traceback):
 
151
    def __exit__ (self, exc_type, exc_value, traceback):
155
152
        self._cleanup()
156
153
        return False
157
154
    
178
175
    
179
176
    def encrypt(self, data, password):
180
177
        self.gnupg.passphrase = self.password_encode(password)
181
 
        with open(os.devnull, "w") as devnull:
 
178
        with open(os.devnull) as devnull:
182
179
            try:
183
180
                proc = self.gnupg.run(['--symmetric'],
184
181
                                      create_fhs=['stdin', 'stdout'],
195
192
    
196
193
    def decrypt(self, data, password):
197
194
        self.gnupg.passphrase = self.password_encode(password)
198
 
        with open(os.devnull, "w") as devnull:
 
195
        with open(os.devnull) as devnull:
199
196
            try:
200
197
                proc = self.gnupg.run(['--decrypt'],
201
198
                                      create_fhs=['stdin', 'stdout'],
202
199
                                      attach_fhs={'stderr': devnull})
203
 
                with contextlib.closing(proc.handles['stdin']) as f:
 
200
                with contextlib.closing(proc.handles['stdin'] ) as f:
204
201
                    f.write(data)
205
202
                with contextlib.closing(proc.handles['stdout']) as f:
206
203
                    decrypted_plaintext = f.read()
211
208
        return decrypted_plaintext
212
209
 
213
210
 
 
211
 
214
212
class AvahiError(Exception):
215
213
    def __init__(self, value, *args, **kwargs):
216
214
        self.value = value
245
243
    server: D-Bus Server
246
244
    bus: dbus.SystemBus()
247
245
    """
248
 
    
249
246
    def __init__(self, interface = avahi.IF_UNSPEC, name = None,
250
247
                 servicetype = None, port = None, TXT = None,
251
248
                 domain = "", host = "", max_renames = 32768,
264
261
        self.server = None
265
262
        self.bus = bus
266
263
        self.entry_group_state_changed_match = None
267
 
    
268
264
    def rename(self):
269
265
        """Derived from the Avahi example code"""
270
266
        if self.rename_count >= self.max_renames:
280
276
        try:
281
277
            self.add()
282
278
        except dbus.exceptions.DBusException as error:
283
 
            logger.critical("D-Bus Exception", exc_info=error)
 
279
            logger.critical("DBusException: %s", error)
284
280
            self.cleanup()
285
281
            os._exit(1)
286
282
        self.rename_count += 1
287
 
    
288
283
    def remove(self):
289
284
        """Derived from the Avahi example code"""
290
285
        if self.entry_group_state_changed_match is not None:
292
287
            self.entry_group_state_changed_match = None
293
288
        if self.group is not None:
294
289
            self.group.Reset()
295
 
    
296
290
    def add(self):
297
291
        """Derived from the Avahi example code"""
298
292
        self.remove()
315
309
            dbus.UInt16(self.port),
316
310
            avahi.string_array_to_txt_array(self.TXT))
317
311
        self.group.Commit()
318
 
    
319
312
    def entry_group_state_changed(self, state, error):
320
313
        """Derived from the Avahi example code"""
321
314
        logger.debug("Avahi entry group state change: %i", state)
328
321
        elif state == avahi.ENTRY_GROUP_FAILURE:
329
322
            logger.critical("Avahi: Error in group state changed %s",
330
323
                            unicode(error))
331
 
            raise AvahiGroupError("State changed: {0!s}"
332
 
                                  .format(error))
333
 
    
 
324
            raise AvahiGroupError("State changed: %s"
 
325
                                  % unicode(error))
334
326
    def cleanup(self):
335
327
        """Derived from the Avahi example code"""
336
328
        if self.group is not None:
341
333
                pass
342
334
            self.group = None
343
335
        self.remove()
344
 
    
345
336
    def server_state_changed(self, state, error=None):
346
337
        """Derived from the Avahi example code"""
347
338
        logger.debug("Avahi server state change: %i", state)
366
357
                logger.debug("Unknown state: %r", state)
367
358
            else:
368
359
                logger.debug("Unknown state: %r: %r", state, error)
369
 
    
370
360
    def activate(self):
371
361
        """Derived from the Avahi example code"""
372
362
        if self.server is None:
379
369
                                 self.server_state_changed)
380
370
        self.server_state_changed(self.server.GetState())
381
371
 
382
 
 
383
372
class AvahiServiceToSyslog(AvahiService):
384
373
    def rename(self):
385
374
        """Add the new name to the syslog messages"""
386
375
        ret = AvahiService.rename(self)
387
376
        syslogger.setFormatter(logging.Formatter
388
 
                               ('Mandos ({0}) [%(process)d]:'
389
 
                                ' %(levelname)s: %(message)s'
390
 
                                .format(self.name)))
 
377
                               ('Mandos (%s) [%%(process)d]:'
 
378
                                ' %%(levelname)s: %%(message)s'
 
379
                                % self.name))
391
380
        return ret
392
381
 
393
 
 
394
382
def timedelta_to_milliseconds(td):
395
383
    "Convert a datetime.timedelta() to milliseconds"
396
384
    return ((td.days * 24 * 60 * 60 * 1000)
397
385
            + (td.seconds * 1000)
398
386
            + (td.microseconds // 1000))
399
 
 
400
 
 
 
387
        
401
388
class Client(object):
402
389
    """A representation of a client host served by this server.
403
390
    
428
415
    last_checked_ok: datetime.datetime(); (UTC) or None
429
416
    last_checker_status: integer between 0 and 255 reflecting exit
430
417
                         status of last checker. -1 reflects crashed
431
 
                         checker, -2 means no checker completed yet.
 
418
                         checker, or None.
432
419
    last_enabled: datetime.datetime(); (UTC) or None
433
420
    name:       string; from the config file, used in log messages and
434
421
                        D-Bus identifiers
435
422
    secret:     bytestring; sent verbatim (over TLS) to client
436
423
    timeout:    datetime.timedelta(); How long from last_checked_ok
437
424
                                      until this client is disabled
438
 
    extended_timeout:   extra long timeout when secret has been sent
 
425
    extended_timeout:   extra long timeout when password has been sent
439
426
    runtime_expansions: Allowed attributes for runtime expansion.
440
427
    expires:    datetime.datetime(); time (UTC) when a client will be
441
428
                disabled, or None
442
429
    """
443
430
    
444
431
    runtime_expansions = ("approval_delay", "approval_duration",
445
 
                          "created", "enabled", "expires",
446
 
                          "fingerprint", "host", "interval",
447
 
                          "last_approval_request", "last_checked_ok",
 
432
                          "created", "enabled", "fingerprint",
 
433
                          "host", "interval", "last_checked_ok",
448
434
                          "last_enabled", "name", "timeout")
449
435
    client_defaults = { "timeout": "5m",
450
436
                        "extended_timeout": "15m",
471
457
    
472
458
    def approval_delay_milliseconds(self):
473
459
        return timedelta_to_milliseconds(self.approval_delay)
474
 
    
 
460
 
475
461
    @staticmethod
476
462
    def config_parser(config):
477
463
        """Construct a new dict of client settings of this form:
502
488
                          "rb") as secfile:
503
489
                    client["secret"] = secfile.read()
504
490
            else:
505
 
                raise TypeError("No secret or secfile for section {0}"
506
 
                                .format(section))
 
491
                raise TypeError("No secret or secfile for section %s"
 
492
                                % section)
507
493
            client["timeout"] = string_to_delta(section["timeout"])
508
494
            client["extended_timeout"] = string_to_delta(
509
495
                section["extended_timeout"])
515
501
            client["checker_command"] = section["checker"]
516
502
            client["last_approval_request"] = None
517
503
            client["last_checked_ok"] = None
518
 
            client["last_checker_status"] = -2
 
504
            client["last_checker_status"] = None
519
505
        
520
506
        return settings
521
 
    
 
507
        
 
508
        
522
509
    def __init__(self, settings, name = None):
 
510
        """Note: the 'checker' key in 'config' sets the
 
511
        'checker_command' attribute and *not* the 'checker'
 
512
        attribute."""
523
513
        self.name = name
524
514
        # adding all client settings
525
515
        for setting, value in settings.iteritems():
534
524
        else:
535
525
            self.last_enabled = None
536
526
            self.expires = None
537
 
        
 
527
       
538
528
        logger.debug("Creating client %r", self.name)
539
529
        # Uppercase and remove spaces from fingerprint for later
540
530
        # comparison purposes with return value from the fingerprint()
542
532
        logger.debug("  Fingerprint: %s", self.fingerprint)
543
533
        self.created = settings.get("created",
544
534
                                    datetime.datetime.utcnow())
545
 
        
 
535
 
546
536
        # attributes specific for this server instance
547
537
        self.checker = None
548
538
        self.checker_initiator_tag = None
576
566
        if getattr(self, "enabled", False):
577
567
            # Already enabled
578
568
            return
 
569
        self.send_changedstate()
579
570
        self.expires = datetime.datetime.utcnow() + self.timeout
580
571
        self.enabled = True
581
572
        self.last_enabled = datetime.datetime.utcnow()
582
573
        self.init_checker()
583
 
        self.send_changedstate()
584
574
    
585
575
    def disable(self, quiet=True):
586
576
        """Disable this client."""
587
577
        if not getattr(self, "enabled", False):
588
578
            return False
589
579
        if not quiet:
 
580
            self.send_changedstate()
 
581
        if not quiet:
590
582
            logger.info("Disabling client %s", self.name)
591
 
        if getattr(self, "disable_initiator_tag", None) is not None:
 
583
        if getattr(self, "disable_initiator_tag", False):
592
584
            gobject.source_remove(self.disable_initiator_tag)
593
585
            self.disable_initiator_tag = None
594
586
        self.expires = None
595
 
        if getattr(self, "checker_initiator_tag", None) is not None:
 
587
        if getattr(self, "checker_initiator_tag", False):
596
588
            gobject.source_remove(self.checker_initiator_tag)
597
589
            self.checker_initiator_tag = None
598
590
        self.stop_checker()
599
591
        self.enabled = False
600
 
        if not quiet:
601
 
            self.send_changedstate()
602
592
        # Do not run this again if called by a gobject.timeout_add
603
593
        return False
604
594
    
608
598
    def init_checker(self):
609
599
        # Schedule a new checker to be started an 'interval' from now,
610
600
        # and every interval from then on.
611
 
        if self.checker_initiator_tag is not None:
612
 
            gobject.source_remove(self.checker_initiator_tag)
613
601
        self.checker_initiator_tag = (gobject.timeout_add
614
602
                                      (self.interval_milliseconds(),
615
603
                                       self.start_checker))
616
604
        # Schedule a disable() when 'timeout' has passed
617
 
        if self.disable_initiator_tag is not None:
618
 
            gobject.source_remove(self.disable_initiator_tag)
619
605
        self.disable_initiator_tag = (gobject.timeout_add
620
606
                                   (self.timeout_milliseconds(),
621
607
                                    self.disable))
640
626
            logger.warning("Checker for %(name)s crashed?",
641
627
                           vars(self))
642
628
    
643
 
    def checked_ok(self):
644
 
        """Assert that the client has been seen, alive and well."""
645
 
        self.last_checked_ok = datetime.datetime.utcnow()
646
 
        self.last_checker_status = 0
647
 
        self.bump_timeout()
648
 
    
649
 
    def bump_timeout(self, timeout=None):
650
 
        """Bump up the timeout for this client."""
 
629
    def checked_ok(self, timeout=None):
 
630
        """Bump up the timeout for this client.
 
631
        
 
632
        This should only be called when the client has been seen,
 
633
        alive and well.
 
634
        """
651
635
        if timeout is None:
652
636
            timeout = self.timeout
 
637
        self.last_checked_ok = datetime.datetime.utcnow()
653
638
        if self.disable_initiator_tag is not None:
654
639
            gobject.source_remove(self.disable_initiator_tag)
655
 
            self.disable_initiator_tag = None
656
640
        if getattr(self, "enabled", False):
657
641
            self.disable_initiator_tag = (gobject.timeout_add
658
642
                                          (timedelta_to_milliseconds
668
652
        If a checker already exists, leave it running and do
669
653
        nothing."""
670
654
        # The reason for not killing a running checker is that if we
671
 
        # did that, and if a checker (for some reason) started running
672
 
        # slowly and taking more than 'interval' time, then the client
673
 
        # would inevitably timeout, since no checker would get a
674
 
        # chance to run to completion.  If we instead leave running
 
655
        # did that, then if a checker (for some reason) started
 
656
        # running slowly and taking more than 'interval' time, the
 
657
        # client would inevitably timeout, since no checker would get
 
658
        # a chance to run to completion.  If we instead leave running
675
659
        # checkers alone, the checker would have to take more time
676
660
        # than 'timeout' for the client to be disabled, which is as it
677
661
        # should be.
691
675
                                      self.current_checker_command)
692
676
        # Start a new checker if needed
693
677
        if self.checker is None:
694
 
            # Escape attributes for the shell
695
 
            escaped_attrs = dict(
696
 
                (attr, re.escape(unicode(getattr(self, attr))))
697
 
                for attr in
698
 
                self.runtime_expansions)
699
678
            try:
700
 
                command = self.checker_command % escaped_attrs
701
 
            except TypeError as error:
702
 
                logger.error('Could not format string "%s"',
703
 
                             self.checker_command, exc_info=error)
704
 
                return True # Try again later
 
679
                # In case checker_command has exactly one % operator
 
680
                command = self.checker_command % self.host
 
681
            except TypeError:
 
682
                # Escape attributes for the shell
 
683
                escaped_attrs = dict(
 
684
                    (attr,
 
685
                     re.escape(unicode(str(getattr(self, attr, "")),
 
686
                                       errors=
 
687
                                       'replace')))
 
688
                    for attr in
 
689
                    self.runtime_expansions)
 
690
                
 
691
                try:
 
692
                    command = self.checker_command % escaped_attrs
 
693
                except TypeError as error:
 
694
                    logger.error('Could not format string "%s":'
 
695
                                 ' %s', self.checker_command, error)
 
696
                    return True # Try again later
705
697
            self.current_checker_command = command
706
698
            try:
707
699
                logger.info("Starting checker %r for %s",
713
705
                self.checker = subprocess.Popen(command,
714
706
                                                close_fds=True,
715
707
                                                shell=True, cwd="/")
 
708
                self.checker_callback_tag = (gobject.child_watch_add
 
709
                                             (self.checker.pid,
 
710
                                              self.checker_callback,
 
711
                                              data=command))
 
712
                # The checker may have completed before the gobject
 
713
                # watch was added.  Check for this.
 
714
                pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
 
715
                if pid:
 
716
                    gobject.source_remove(self.checker_callback_tag)
 
717
                    self.checker_callback(pid, status, command)
716
718
            except OSError as error:
717
 
                logger.error("Failed to start subprocess",
718
 
                             exc_info=error)
719
 
            self.checker_callback_tag = (gobject.child_watch_add
720
 
                                         (self.checker.pid,
721
 
                                          self.checker_callback,
722
 
                                          data=command))
723
 
            # The checker may have completed before the gobject
724
 
            # watch was added.  Check for this.
725
 
            pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
726
 
            if pid:
727
 
                gobject.source_remove(self.checker_callback_tag)
728
 
                self.checker_callback(pid, status, command)
 
719
                logger.error("Failed to start subprocess: %s",
 
720
                             error)
729
721
        # Re-run this periodically if run by gobject.timeout_add
730
722
        return True
731
723
    
738
730
            return
739
731
        logger.debug("Stopping checker for %(name)s", vars(self))
740
732
        try:
741
 
            self.checker.terminate()
 
733
            os.kill(self.checker.pid, signal.SIGTERM)
742
734
            #time.sleep(0.5)
743
735
            #if self.checker.poll() is None:
744
 
            #    self.checker.kill()
 
736
            #    os.kill(self.checker.pid, signal.SIGKILL)
745
737
        except OSError as error:
746
738
            if error.errno != errno.ESRCH: # No such process
747
739
                raise
764
756
    # "Set" method, so we fail early here:
765
757
    if byte_arrays and signature != "ay":
766
758
        raise ValueError("Byte arrays not supported for non-'ay'"
767
 
                         " signature {0!r}".format(signature))
 
759
                         " signature %r" % signature)
768
760
    def decorator(func):
769
761
        func._dbus_is_property = True
770
762
        func._dbus_interface = dbus_interface
778
770
    return decorator
779
771
 
780
772
 
781
 
def dbus_interface_annotations(dbus_interface):
782
 
    """Decorator for marking functions returning interface annotations
783
 
    
784
 
    Usage:
785
 
    
786
 
    @dbus_interface_annotations("org.example.Interface")
787
 
    def _foo(self):  # Function name does not matter
788
 
        return {"org.freedesktop.DBus.Deprecated": "true",
789
 
                "org.freedesktop.DBus.Property.EmitsChangedSignal":
790
 
                    "false"}
791
 
    """
792
 
    def decorator(func):
793
 
        func._dbus_is_interface = True
794
 
        func._dbus_interface = dbus_interface
795
 
        func._dbus_name = dbus_interface
796
 
        return func
797
 
    return decorator
798
 
 
799
 
 
800
 
def dbus_annotations(annotations):
801
 
    """Decorator to annotate D-Bus methods, signals or properties
802
 
    Usage:
803
 
    
804
 
    @dbus_service_property("org.example.Interface", signature="b",
805
 
                           access="r")
806
 
    @dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",
807
 
                        "org.freedesktop.DBus.Property."
808
 
                        "EmitsChangedSignal": "false"})
809
 
    def Property_dbus_property(self):
810
 
        return dbus.Boolean(False)
811
 
    """
812
 
    def decorator(func):
813
 
        func._dbus_annotations = annotations
814
 
        return func
815
 
    return decorator
816
 
 
817
 
 
818
773
class DBusPropertyException(dbus.exceptions.DBusException):
819
774
    """A base class for D-Bus property-related exceptions
820
775
    """
843
798
    """
844
799
    
845
800
    @staticmethod
846
 
    def _is_dbus_thing(thing):
847
 
        """Returns a function testing if an attribute is a D-Bus thing
848
 
        
849
 
        If called like _is_dbus_thing("method") it returns a function
850
 
        suitable for use as predicate to inspect.getmembers().
851
 
        """
852
 
        return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),
853
 
                                   False)
 
801
    def _is_dbus_property(obj):
 
802
        return getattr(obj, "_dbus_is_property", False)
854
803
    
855
 
    def _get_all_dbus_things(self, thing):
 
804
    def _get_all_dbus_properties(self):
856
805
        """Returns a generator of (name, attribute) pairs
857
806
        """
858
 
        return ((getattr(athing.__get__(self), "_dbus_name",
859
 
                         name),
860
 
                 athing.__get__(self))
 
807
        return ((prop.__get__(self)._dbus_name, prop.__get__(self))
861
808
                for cls in self.__class__.__mro__
862
 
                for name, athing in
863
 
                inspect.getmembers(cls,
864
 
                                   self._is_dbus_thing(thing)))
 
809
                for name, prop in
 
810
                inspect.getmembers(cls, self._is_dbus_property))
865
811
    
866
812
    def _get_dbus_property(self, interface_name, property_name):
867
813
        """Returns a bound method if one exists which is a D-Bus
869
815
        """
870
816
        for cls in  self.__class__.__mro__:
871
817
            for name, value in (inspect.getmembers
872
 
                                (cls,
873
 
                                 self._is_dbus_thing("property"))):
 
818
                                (cls, self._is_dbus_property)):
874
819
                if (value._dbus_name == property_name
875
820
                    and value._dbus_interface == interface_name):
876
821
                    return value.__get__(self)
918
863
        Note: Will not include properties with access="write".
919
864
        """
920
865
        properties = {}
921
 
        for name, prop in self._get_all_dbus_things("property"):
 
866
        for name, prop in self._get_all_dbus_properties():
922
867
            if (interface_name
923
868
                and interface_name != prop._dbus_interface):
924
869
                # Interface non-empty but did not match
939
884
                         path_keyword='object_path',
940
885
                         connection_keyword='connection')
941
886
    def Introspect(self, object_path, connection):
942
 
        """Overloading of standard D-Bus method.
943
 
        
944
 
        Inserts property tags and interface annotation tags.
 
887
        """Standard D-Bus method, overloaded to insert property tags.
945
888
        """
946
889
        xmlstring = dbus.service.Object.Introspect(self, object_path,
947
890
                                                   connection)
954
897
                e.setAttribute("access", prop._dbus_access)
955
898
                return e
956
899
            for if_tag in document.getElementsByTagName("interface"):
957
 
                # Add property tags
958
900
                for tag in (make_tag(document, name, prop)
959
901
                            for name, prop
960
 
                            in self._get_all_dbus_things("property")
 
902
                            in self._get_all_dbus_properties()
961
903
                            if prop._dbus_interface
962
904
                            == if_tag.getAttribute("name")):
963
905
                    if_tag.appendChild(tag)
964
 
                # Add annotation tags
965
 
                for typ in ("method", "signal", "property"):
966
 
                    for tag in if_tag.getElementsByTagName(typ):
967
 
                        annots = dict()
968
 
                        for name, prop in (self.
969
 
                                           _get_all_dbus_things(typ)):
970
 
                            if (name == tag.getAttribute("name")
971
 
                                and prop._dbus_interface
972
 
                                == if_tag.getAttribute("name")):
973
 
                                annots.update(getattr
974
 
                                              (prop,
975
 
                                               "_dbus_annotations",
976
 
                                               {}))
977
 
                        for name, value in annots.iteritems():
978
 
                            ann_tag = document.createElement(
979
 
                                "annotation")
980
 
                            ann_tag.setAttribute("name", name)
981
 
                            ann_tag.setAttribute("value", value)
982
 
                            tag.appendChild(ann_tag)
983
 
                # Add interface annotation tags
984
 
                for annotation, value in dict(
985
 
                    itertools.chain.from_iterable(
986
 
                        annotations().iteritems()
987
 
                        for name, annotations in
988
 
                        self._get_all_dbus_things("interface")
989
 
                        if name == if_tag.getAttribute("name")
990
 
                        )).iteritems():
991
 
                    ann_tag = document.createElement("annotation")
992
 
                    ann_tag.setAttribute("name", annotation)
993
 
                    ann_tag.setAttribute("value", value)
994
 
                    if_tag.appendChild(ann_tag)
995
906
                # Add the names to the return values for the
996
907
                # "org.freedesktop.DBus.Properties" methods
997
908
                if (if_tag.getAttribute("name")
1012
923
        except (AttributeError, xml.dom.DOMException,
1013
924
                xml.parsers.expat.ExpatError) as error:
1014
925
            logger.error("Failed to override Introspection method",
1015
 
                         exc_info=error)
 
926
                         error)
1016
927
        return xmlstring
1017
928
 
1018
929
 
1019
 
def datetime_to_dbus(dt, variant_level=0):
 
930
def datetime_to_dbus (dt, variant_level=0):
1020
931
    """Convert a UTC datetime.datetime() to a D-Bus type."""
1021
932
    if dt is None:
1022
933
        return dbus.String("", variant_level = variant_level)
1024
935
                       variant_level=variant_level)
1025
936
 
1026
937
 
1027
 
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
1028
 
    """A class decorator; applied to a subclass of
1029
 
    dbus.service.Object, it will add alternate D-Bus attributes with
1030
 
    interface names according to the "alt_interface_names" mapping.
1031
 
    Usage:
1032
 
    
1033
 
    @alternate_dbus_interfaces({"org.example.Interface":
1034
 
                                    "net.example.AlternateInterface"})
1035
 
    class SampleDBusObject(dbus.service.Object):
1036
 
        @dbus.service.method("org.example.Interface")
1037
 
        def SampleDBusMethod():
1038
 
            pass
1039
 
    
1040
 
    The above "SampleDBusMethod" on "SampleDBusObject" will be
1041
 
    reachable via two interfaces: "org.example.Interface" and
1042
 
    "net.example.AlternateInterface", the latter of which will have
1043
 
    its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
1044
 
    "true", unless "deprecate" is passed with a False value.
1045
 
    
1046
 
    This works for methods and signals, and also for D-Bus properties
1047
 
    (from DBusObjectWithProperties) and interfaces (from the
1048
 
    dbus_interface_annotations decorator).
 
938
class AlternateDBusNamesMetaclass(DBusObjectWithProperties
 
939
                                  .__metaclass__):
 
940
    """Applied to an empty subclass of a D-Bus object, this metaclass
 
941
    will add additional D-Bus attributes matching a certain pattern.
1049
942
    """
1050
 
    def wrapper(cls):
1051
 
        for orig_interface_name, alt_interface_name in (
1052
 
            alt_interface_names.iteritems()):
1053
 
            attr = {}
1054
 
            interface_names = set()
1055
 
            # Go though all attributes of the class
1056
 
            for attrname, attribute in inspect.getmembers(cls):
 
943
    def __new__(mcs, name, bases, attr):
 
944
        # Go through all the base classes which could have D-Bus
 
945
        # methods, signals, or properties in them
 
946
        for base in (b for b in bases
 
947
                     if issubclass(b, dbus.service.Object)):
 
948
            # Go though all attributes of the base class
 
949
            for attrname, attribute in inspect.getmembers(base):
1057
950
                # Ignore non-D-Bus attributes, and D-Bus attributes
1058
951
                # with the wrong interface name
1059
952
                if (not hasattr(attribute, "_dbus_interface")
1060
953
                    or not attribute._dbus_interface
1061
 
                    .startswith(orig_interface_name)):
 
954
                    .startswith("se.recompile.Mandos")):
1062
955
                    continue
1063
956
                # Create an alternate D-Bus interface name based on
1064
957
                # the current name
1065
958
                alt_interface = (attribute._dbus_interface
1066
 
                                 .replace(orig_interface_name,
1067
 
                                          alt_interface_name))
1068
 
                interface_names.add(alt_interface)
 
959
                                 .replace("se.recompile.Mandos",
 
960
                                          "se.bsnet.fukt.Mandos"))
1069
961
                # Is this a D-Bus signal?
1070
962
                if getattr(attribute, "_dbus_is_signal", False):
1071
963
                    # Extract the original non-method function by
1086
978
                                nonmethod_func.func_name,
1087
979
                                nonmethod_func.func_defaults,
1088
980
                                nonmethod_func.func_closure)))
1089
 
                    # Copy annotations, if any
1090
 
                    try:
1091
 
                        new_function._dbus_annotations = (
1092
 
                            dict(attribute._dbus_annotations))
1093
 
                    except AttributeError:
1094
 
                        pass
1095
981
                    # Define a creator of a function to call both the
1096
 
                    # original and alternate functions, so both the
1097
 
                    # original and alternate signals gets sent when
1098
 
                    # the function is called
 
982
                    # old and new functions, so both the old and new
 
983
                    # signals gets sent when the function is called
1099
984
                    def fixscope(func1, func2):
1100
985
                        """This function is a scope container to pass
1101
986
                        func1 and func2 to the "call_both" function
1108
993
                        return call_both
1109
994
                    # Create the "call_both" function and add it to
1110
995
                    # the class
1111
 
                    attr[attrname] = fixscope(attribute, new_function)
 
996
                    attr[attrname] = fixscope(attribute,
 
997
                                              new_function)
1112
998
                # Is this a D-Bus method?
1113
999
                elif getattr(attribute, "_dbus_is_method", False):
1114
1000
                    # Create a new, but exactly alike, function
1125
1011
                                        attribute.func_name,
1126
1012
                                        attribute.func_defaults,
1127
1013
                                        attribute.func_closure)))
1128
 
                    # Copy annotations, if any
1129
 
                    try:
1130
 
                        attr[attrname]._dbus_annotations = (
1131
 
                            dict(attribute._dbus_annotations))
1132
 
                    except AttributeError:
1133
 
                        pass
1134
1014
                # Is this a D-Bus property?
1135
1015
                elif getattr(attribute, "_dbus_is_property", False):
1136
1016
                    # Create a new, but exactly alike, function
1150
1030
                                        attribute.func_name,
1151
1031
                                        attribute.func_defaults,
1152
1032
                                        attribute.func_closure)))
1153
 
                    # Copy annotations, if any
1154
 
                    try:
1155
 
                        attr[attrname]._dbus_annotations = (
1156
 
                            dict(attribute._dbus_annotations))
1157
 
                    except AttributeError:
1158
 
                        pass
1159
 
                # Is this a D-Bus interface?
1160
 
                elif getattr(attribute, "_dbus_is_interface", False):
1161
 
                    # Create a new, but exactly alike, function
1162
 
                    # object.  Decorate it to be a new D-Bus interface
1163
 
                    # with the alternate D-Bus interface name.  Add it
1164
 
                    # to the class.
1165
 
                    attr[attrname] = (dbus_interface_annotations
1166
 
                                      (alt_interface)
1167
 
                                      (types.FunctionType
1168
 
                                       (attribute.func_code,
1169
 
                                        attribute.func_globals,
1170
 
                                        attribute.func_name,
1171
 
                                        attribute.func_defaults,
1172
 
                                        attribute.func_closure)))
1173
 
            if deprecate:
1174
 
                # Deprecate all alternate interfaces
1175
 
                iname="_AlternateDBusNames_interface_annotation{0}"
1176
 
                for interface_name in interface_names:
1177
 
                    @dbus_interface_annotations(interface_name)
1178
 
                    def func(self):
1179
 
                        return { "org.freedesktop.DBus.Deprecated":
1180
 
                                     "true" }
1181
 
                    # Find an unused name
1182
 
                    for aname in (iname.format(i)
1183
 
                                  for i in itertools.count()):
1184
 
                        if aname not in attr:
1185
 
                            attr[aname] = func
1186
 
                            break
1187
 
            if interface_names:
1188
 
                # Replace the class with a new subclass of it with
1189
 
                # methods, signals, etc. as created above.
1190
 
                cls = type(b"{0}Alternate".format(cls.__name__),
1191
 
                           (cls,), attr)
1192
 
        return cls
1193
 
    return wrapper
1194
 
 
1195
 
 
1196
 
@alternate_dbus_interfaces({"se.recompile.Mandos":
1197
 
                                "se.bsnet.fukt.Mandos"})
 
1033
        return type.__new__(mcs, name, bases, attr)
 
1034
 
 
1035
 
1198
1036
class ClientDBus(Client, DBusObjectWithProperties):
1199
1037
    """A Client class using D-Bus
1200
1038
    
1211
1049
    def __init__(self, bus = None, *args, **kwargs):
1212
1050
        self.bus = bus
1213
1051
        Client.__init__(self, *args, **kwargs)
 
1052
        self._approvals_pending = 0
 
1053
        
 
1054
        self._approvals_pending = 0
1214
1055
        # Only now, when this client is initialized, can it show up on
1215
1056
        # the D-Bus
1216
1057
        client_object_name = unicode(self.name).translate(
1220
1061
                                 ("/clients/" + client_object_name))
1221
1062
        DBusObjectWithProperties.__init__(self, self.bus,
1222
1063
                                          self.dbus_object_path)
1223
 
    
 
1064
        
1224
1065
    def notifychangeproperty(transform_func,
1225
1066
                             dbus_name, type_func=lambda x: x,
1226
1067
                             variant_level=1):
1249
1090
        
1250
1091
        return property(lambda self: getattr(self, attrname), setter)
1251
1092
    
 
1093
    
1252
1094
    expires = notifychangeproperty(datetime_to_dbus, "Expires")
1253
1095
    approvals_pending = notifychangeproperty(dbus.Boolean,
1254
1096
                                             "ApprovalPending",
1261
1103
                                       checker is not None)
1262
1104
    last_checked_ok = notifychangeproperty(datetime_to_dbus,
1263
1105
                                           "LastCheckedOK")
1264
 
    last_checker_status = notifychangeproperty(dbus.Int16,
1265
 
                                               "LastCheckerStatus")
1266
1106
    last_approval_request = notifychangeproperty(
1267
1107
        datetime_to_dbus, "LastApprovalRequest")
1268
1108
    approved_by_default = notifychangeproperty(dbus.Boolean,
1336
1176
        return False
1337
1177
    
1338
1178
    def approve(self, value=True):
 
1179
        self.send_changedstate()
1339
1180
        self.approved = value
1340
1181
        gobject.timeout_add(timedelta_to_milliseconds
1341
1182
                            (self.approval_duration),
1342
1183
                            self._reset_approved)
1343
 
        self.send_changedstate()
 
1184
    
1344
1185
    
1345
1186
    ## D-Bus methods, signals & properties
1346
1187
    _interface = "se.recompile.Mandos.Client"
1347
1188
    
1348
 
    ## Interfaces
1349
 
    
1350
 
    @dbus_interface_annotations(_interface)
1351
 
    def _foo(self):
1352
 
        return { "org.freedesktop.DBus.Property.EmitsChangedSignal":
1353
 
                     "false"}
1354
 
    
1355
1189
    ## Signals
1356
1190
    
1357
1191
    # CheckerCompleted - signal
1393
1227
        "D-Bus signal"
1394
1228
        return self.need_approval()
1395
1229
    
 
1230
    # NeRwequest - signal
 
1231
    @dbus.service.signal(_interface, signature="s")
 
1232
    def NewRequest(self, ip):
 
1233
        """D-Bus signal
 
1234
        Is sent after a client request a password.
 
1235
        """
 
1236
        pass
 
1237
    
1396
1238
    ## Methods
1397
1239
    
1398
1240
    # Approve - method
1508
1350
            return
1509
1351
        return datetime_to_dbus(self.last_checked_ok)
1510
1352
    
1511
 
    # LastCheckerStatus - property
1512
 
    @dbus_service_property(_interface, signature="n",
1513
 
                           access="read")
1514
 
    def LastCheckerStatus_dbus_property(self):
1515
 
        return dbus.Int16(self.last_checker_status)
1516
 
    
1517
1353
    # Expires - property
1518
1354
    @dbus_service_property(_interface, signature="s", access="read")
1519
1355
    def Expires_dbus_property(self):
1530
1366
    def Timeout_dbus_property(self, value=None):
1531
1367
        if value is None:       # get
1532
1368
            return dbus.UInt64(self.timeout_milliseconds())
1533
 
        old_timeout = self.timeout
1534
1369
        self.timeout = datetime.timedelta(0, 0, 0, value)
1535
 
        # Reschedule disabling
 
1370
        # Reschedule timeout
1536
1371
        if self.enabled:
1537
1372
            now = datetime.datetime.utcnow()
1538
 
            self.expires += self.timeout - old_timeout
1539
 
            if self.expires <= now:
 
1373
            time_to_die = timedelta_to_milliseconds(
 
1374
                (self.last_checked_ok + self.timeout) - now)
 
1375
            if time_to_die <= 0:
1540
1376
                # The timeout has passed
1541
1377
                self.disable()
1542
1378
            else:
 
1379
                self.expires = (now +
 
1380
                                datetime.timedelta(milliseconds =
 
1381
                                                   time_to_die))
1543
1382
                if (getattr(self, "disable_initiator_tag", None)
1544
1383
                    is None):
1545
1384
                    return
1546
1385
                gobject.source_remove(self.disable_initiator_tag)
1547
 
                self.disable_initiator_tag = (
1548
 
                    gobject.timeout_add(
1549
 
                        timedelta_to_milliseconds(self.expires - now),
1550
 
                        self.disable))
 
1386
                self.disable_initiator_tag = (gobject.timeout_add
 
1387
                                              (time_to_die,
 
1388
                                               self.disable))
1551
1389
    
1552
1390
    # ExtendedTimeout - property
1553
1391
    @dbus_service_property(_interface, signature="t",
1632
1470
        self._pipe.send(('setattr', name, value))
1633
1471
 
1634
1472
 
 
1473
class ClientDBusTransitional(ClientDBus):
 
1474
    __metaclass__ = AlternateDBusNamesMetaclass
 
1475
 
 
1476
 
1635
1477
class ClientHandler(socketserver.BaseRequestHandler, object):
1636
1478
    """A class to handle client connections.
1637
1479
    
1705
1547
                except KeyError:
1706
1548
                    return
1707
1549
                
 
1550
                if self.server.use_dbus:
 
1551
                    # Emit D-Bus signal
 
1552
                    client.NewRequest(str(self.client_address))
 
1553
                
1708
1554
                if client.approval_delay:
1709
1555
                    delay = client.approval_delay
1710
1556
                    client.approvals_pending += 1
1741
1587
                    #wait until timeout or approved
1742
1588
                    time = datetime.datetime.now()
1743
1589
                    client.changedstate.acquire()
1744
 
                    client.changedstate.wait(
1745
 
                        float(timedelta_to_milliseconds(delay)
1746
 
                              / 1000))
 
1590
                    (client.changedstate.wait
 
1591
                     (float(client.timedelta_to_milliseconds(delay)
 
1592
                            / 1000)))
1747
1593
                    client.changedstate.release()
1748
1594
                    time2 = datetime.datetime.now()
1749
1595
                    if (time2 - time) >= delay:
1765
1611
                    try:
1766
1612
                        sent = session.send(client.secret[sent_size:])
1767
1613
                    except gnutls.errors.GNUTLSError as error:
1768
 
                        logger.warning("gnutls send failed",
1769
 
                                       exc_info=error)
 
1614
                        logger.warning("gnutls send failed")
1770
1615
                        return
1771
1616
                    logger.debug("Sent: %d, remaining: %d",
1772
1617
                                 sent, len(client.secret)
1775
1620
                
1776
1621
                logger.info("Sending secret to %s", client.name)
1777
1622
                # bump the timeout using extended_timeout
1778
 
                client.bump_timeout(client.extended_timeout)
 
1623
                client.checked_ok(client.extended_timeout)
1779
1624
                if self.server.use_dbus:
1780
1625
                    # Emit D-Bus signal
1781
1626
                    client.GotSecret()
1786
1631
                try:
1787
1632
                    session.bye()
1788
1633
                except gnutls.errors.GNUTLSError as error:
1789
 
                    logger.warning("GnuTLS bye failed",
1790
 
                                   exc_info=error)
 
1634
                    logger.warning("GnuTLS bye failed")
1791
1635
    
1792
1636
    @staticmethod
1793
1637
    def peer_certificate(session):
1865
1709
    def process_request(self, request, address):
1866
1710
        """Start a new process to process the request."""
1867
1711
        proc = multiprocessing.Process(target = self.sub_process_main,
1868
 
                                       args = (request, address))
 
1712
                                       args = (request,
 
1713
                                               address))
1869
1714
        proc.start()
1870
1715
        return proc
1871
1716
 
1899
1744
        use_ipv6:       Boolean; to use IPv6 or not
1900
1745
    """
1901
1746
    def __init__(self, server_address, RequestHandlerClass,
1902
 
                 interface=None, use_ipv6=True, socketfd=None):
1903
 
        """If socketfd is set, use that file descriptor instead of
1904
 
        creating a new one with socket.socket().
1905
 
        """
 
1747
                 interface=None, use_ipv6=True):
1906
1748
        self.interface = interface
1907
1749
        if use_ipv6:
1908
1750
            self.address_family = socket.AF_INET6
1909
 
        if socketfd is not None:
1910
 
            # Save the file descriptor
1911
 
            self.socketfd = socketfd
1912
 
            # Save the original socket.socket() function
1913
 
            self.socket_socket = socket.socket
1914
 
            # To implement --socket, we monkey patch socket.socket.
1915
 
            # 
1916
 
            # (When socketserver.TCPServer is a new-style class, we
1917
 
            # could make self.socket into a property instead of monkey
1918
 
            # patching socket.socket.)
1919
 
            # 
1920
 
            # Create a one-time-only replacement for socket.socket()
1921
 
            @functools.wraps(socket.socket)
1922
 
            def socket_wrapper(*args, **kwargs):
1923
 
                # Restore original function so subsequent calls are
1924
 
                # not affected.
1925
 
                socket.socket = self.socket_socket
1926
 
                del self.socket_socket
1927
 
                # This time only, return a new socket object from the
1928
 
                # saved file descriptor.
1929
 
                return socket.fromfd(self.socketfd, *args, **kwargs)
1930
 
            # Replace socket.socket() function with wrapper
1931
 
            socket.socket = socket_wrapper
1932
 
        # The socketserver.TCPServer.__init__ will call
1933
 
        # socket.socket(), which might be our replacement,
1934
 
        # socket_wrapper(), if socketfd was set.
1935
1751
        socketserver.TCPServer.__init__(self, server_address,
1936
1752
                                        RequestHandlerClass)
1937
 
    
1938
1753
    def server_bind(self):
1939
1754
        """This overrides the normal server_bind() function
1940
1755
        to bind to an interface if one was specified, and also NOT to
1951
1766
                                           str(self.interface
1952
1767
                                               + '\0'))
1953
1768
                except socket.error as error:
1954
 
                    if error.errno == errno.EPERM:
 
1769
                    if error[0] == errno.EPERM:
1955
1770
                        logger.error("No permission to"
1956
1771
                                     " bind to interface %s",
1957
1772
                                     self.interface)
1958
 
                    elif error.errno == errno.ENOPROTOOPT:
 
1773
                    elif error[0] == errno.ENOPROTOOPT:
1959
1774
                        logger.error("SO_BINDTODEVICE not available;"
1960
1775
                                     " cannot bind to interface %s",
1961
1776
                                     self.interface)
1962
 
                    elif error.errno == errno.ENODEV:
1963
 
                        logger.error("Interface %s does not"
1964
 
                                     " exist, cannot bind",
1965
 
                                     self.interface)
1966
1777
                    else:
1967
1778
                        raise
1968
1779
        # Only bind(2) the socket if we really need to.
1998
1809
    """
1999
1810
    def __init__(self, server_address, RequestHandlerClass,
2000
1811
                 interface=None, use_ipv6=True, clients=None,
2001
 
                 gnutls_priority=None, use_dbus=True, socketfd=None):
 
1812
                 gnutls_priority=None, use_dbus=True):
2002
1813
        self.enabled = False
2003
1814
        self.clients = clients
2004
1815
        if self.clients is None:
2008
1819
        IPv6_TCPServer.__init__(self, server_address,
2009
1820
                                RequestHandlerClass,
2010
1821
                                interface = interface,
2011
 
                                use_ipv6 = use_ipv6,
2012
 
                                socketfd = socketfd)
 
1822
                                use_ipv6 = use_ipv6)
2013
1823
    def server_activate(self):
2014
1824
        if self.enabled:
2015
1825
            return socketserver.TCPServer.server_activate(self)
2028
1838
    
2029
1839
    def handle_ipc(self, source, condition, parent_pipe=None,
2030
1840
                   proc = None, client_object=None):
 
1841
        condition_names = {
 
1842
            gobject.IO_IN: "IN",   # There is data to read.
 
1843
            gobject.IO_OUT: "OUT", # Data can be written (without
 
1844
                                    # blocking).
 
1845
            gobject.IO_PRI: "PRI", # There is urgent data to read.
 
1846
            gobject.IO_ERR: "ERR", # Error condition.
 
1847
            gobject.IO_HUP: "HUP"  # Hung up (the connection has been
 
1848
                                    # broken, usually for pipes and
 
1849
                                    # sockets).
 
1850
            }
 
1851
        conditions_string = ' | '.join(name
 
1852
                                       for cond, name in
 
1853
                                       condition_names.iteritems()
 
1854
                                       if cond & condition)
2031
1855
        # error, or the other end of multiprocessing.Pipe has closed
2032
 
        if condition & (gobject.IO_ERR | gobject.IO_HUP):
 
1856
        if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):
2033
1857
            # Wait for other process to exit
2034
1858
            proc.join()
2035
1859
            return False
2125
1949
            elif suffix == "w":
2126
1950
                delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
2127
1951
            else:
2128
 
                raise ValueError("Unknown suffix {0!r}"
2129
 
                                 .format(suffix))
 
1952
                raise ValueError("Unknown suffix %r" % suffix)
2130
1953
        except (ValueError, IndexError) as e:
2131
1954
            raise ValueError(*(e.args))
2132
1955
        timevalue += delta
2146
1969
        sys.exit()
2147
1970
    if not noclose:
2148
1971
        # Close all standard open file descriptors
2149
 
        null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
 
1972
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
2150
1973
        if not stat.S_ISCHR(os.fstat(null).st_mode):
2151
1974
            raise OSError(errno.ENODEV,
2152
 
                          "{0} not a character device"
2153
 
                          .format(os.devnull))
 
1975
                          "%s not a character device"
 
1976
                          % os.path.devnull)
2154
1977
        os.dup2(null, sys.stdin.fileno())
2155
1978
        os.dup2(null, sys.stdout.fileno())
2156
1979
        os.dup2(null, sys.stderr.fileno())
2165
1988
    
2166
1989
    parser = argparse.ArgumentParser()
2167
1990
    parser.add_argument("-v", "--version", action="version",
2168
 
                        version = "%(prog)s {0}".format(version),
 
1991
                        version = "%%(prog)s %s" % version,
2169
1992
                        help="show version number and exit")
2170
1993
    parser.add_argument("-i", "--interface", metavar="IF",
2171
1994
                        help="Bind to interface IF")
2196
2019
    parser.add_argument("--no-restore", action="store_false",
2197
2020
                        dest="restore", help="Do not restore stored"
2198
2021
                        " state")
2199
 
    parser.add_argument("--socket", type=int,
2200
 
                        help="Specify a file descriptor to a network"
2201
 
                        " socket to use instead of creating one")
2202
2022
    parser.add_argument("--statedir", metavar="DIR",
2203
2023
                        help="Directory to save/restore state in")
2204
2024
    
2221
2041
                        "use_ipv6": "True",
2222
2042
                        "debuglevel": "",
2223
2043
                        "restore": "True",
2224
 
                        "socket": "",
2225
2044
                        "statedir": "/var/lib/mandos"
2226
2045
                        }
2227
2046
    
2239
2058
    if server_settings["port"]:
2240
2059
        server_settings["port"] = server_config.getint("DEFAULT",
2241
2060
                                                       "port")
2242
 
    if server_settings["socket"]:
2243
 
        server_settings["socket"] = server_config.getint("DEFAULT",
2244
 
                                                         "socket")
2245
 
        # Later, stdin will, and stdout and stderr might, be dup'ed
2246
 
        # over with an opened os.devnull.  But we don't want this to
2247
 
        # happen with a supplied network socket.
2248
 
        if 0 <= server_settings["socket"] <= 2:
2249
 
            server_settings["socket"] = os.dup(server_settings
2250
 
                                               ["socket"])
2251
2061
    del server_config
2252
2062
    
2253
2063
    # Override the settings from the config file with command line
2255
2065
    for option in ("interface", "address", "port", "debug",
2256
2066
                   "priority", "servicename", "configdir",
2257
2067
                   "use_dbus", "use_ipv6", "debuglevel", "restore",
2258
 
                   "statedir", "socket"):
 
2068
                   "statedir"):
2259
2069
        value = getattr(options, option)
2260
2070
        if value is not None:
2261
2071
            server_settings[option] = value
2287
2097
    
2288
2098
    if server_settings["servicename"] != "Mandos":
2289
2099
        syslogger.setFormatter(logging.Formatter
2290
 
                               ('Mandos ({0}) [%(process)d]:'
2291
 
                                ' %(levelname)s: %(message)s'
2292
 
                                .format(server_settings
2293
 
                                        ["servicename"])))
 
2100
                               ('Mandos (%s) [%%(process)d]:'
 
2101
                                ' %%(levelname)s: %%(message)s'
 
2102
                                % server_settings["servicename"]))
2294
2103
    
2295
2104
    # Parse config file with clients
2296
2105
    client_config = configparser.SafeConfigParser(Client
2309
2118
                              use_ipv6=use_ipv6,
2310
2119
                              gnutls_priority=
2311
2120
                              server_settings["priority"],
2312
 
                              use_dbus=use_dbus,
2313
 
                              socketfd=(server_settings["socket"]
2314
 
                                        or None))
 
2121
                              use_dbus=use_dbus)
2315
2122
    if not debug:
2316
2123
        pidfilename = "/var/run/mandos.pid"
2317
2124
        try:
2318
2125
            pidfile = open(pidfilename, "w")
2319
 
        except IOError as e:
2320
 
            logger.error("Could not open file %r", pidfilename,
2321
 
                         exc_info=e)
 
2126
        except IOError:
 
2127
            logger.error("Could not open file %r", pidfilename)
2322
2128
    
2323
 
    for name in ("_mandos", "mandos", "nobody"):
 
2129
    try:
 
2130
        uid = pwd.getpwnam("_mandos").pw_uid
 
2131
        gid = pwd.getpwnam("_mandos").pw_gid
 
2132
    except KeyError:
2324
2133
        try:
2325
 
            uid = pwd.getpwnam(name).pw_uid
2326
 
            gid = pwd.getpwnam(name).pw_gid
2327
 
            break
 
2134
            uid = pwd.getpwnam("mandos").pw_uid
 
2135
            gid = pwd.getpwnam("mandos").pw_gid
2328
2136
        except KeyError:
2329
 
            continue
2330
 
    else:
2331
 
        uid = 65534
2332
 
        gid = 65534
 
2137
            try:
 
2138
                uid = pwd.getpwnam("nobody").pw_uid
 
2139
                gid = pwd.getpwnam("nobody").pw_gid
 
2140
            except KeyError:
 
2141
                uid = 65534
 
2142
                gid = 65534
2333
2143
    try:
2334
2144
        os.setgid(gid)
2335
2145
        os.setuid(uid)
2336
2146
    except OSError as error:
2337
 
        if error.errno != errno.EPERM:
 
2147
        if error[0] != errno.EPERM:
2338
2148
            raise error
2339
2149
    
2340
2150
    if debug:
2352
2162
         .gnutls_global_set_log_function(debug_gnutls))
2353
2163
        
2354
2164
        # Redirect stdin so all checkers get /dev/null
2355
 
        null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
 
2165
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
2356
2166
        os.dup2(null, sys.stdin.fileno())
2357
2167
        if null > 2:
2358
2168
            os.close(null)
2362
2172
        # Close all input and output, do double fork, etc.
2363
2173
        daemon()
2364
2174
    
2365
 
    # multiprocessing will use threads, so before we use gobject we
2366
 
    # need to inform gobject that threads will be used.
2367
2175
    gobject.threads_init()
2368
2176
    
2369
2177
    global main_loop
2370
2178
    # From the Avahi example code
2371
 
    DBusGMainLoop(set_as_default=True)
 
2179
    DBusGMainLoop(set_as_default=True )
2372
2180
    main_loop = gobject.MainLoop()
2373
2181
    bus = dbus.SystemBus()
2374
2182
    # End of Avahi example code
2380
2188
                            ("se.bsnet.fukt.Mandos", bus,
2381
2189
                             do_not_queue=True))
2382
2190
        except dbus.exceptions.NameExistsException as e:
2383
 
            logger.error("Disabling D-Bus:", exc_info=e)
 
2191
            logger.error(unicode(e) + ", disabling D-Bus")
2384
2192
            use_dbus = False
2385
2193
            server_settings["use_dbus"] = False
2386
2194
            tcp_server.use_dbus = False
2398
2206
    
2399
2207
    client_class = Client
2400
2208
    if use_dbus:
2401
 
        client_class = functools.partial(ClientDBus, bus = bus)
 
2209
        client_class = functools.partial(ClientDBusTransitional,
 
2210
                                         bus = bus)
2402
2211
    
2403
2212
    client_settings = Client.config_parser(client_config)
2404
2213
    old_client_settings = {}
2412
2221
                                                     (stored_state))
2413
2222
            os.remove(stored_state_path)
2414
2223
        except IOError as e:
2415
 
            if e.errno == errno.ENOENT:
2416
 
                logger.warning("Could not load persistent state: {0}"
2417
 
                                .format(os.strerror(e.errno)))
2418
 
            else:
2419
 
                logger.critical("Could not load persistent state:",
2420
 
                                exc_info=e)
 
2224
            logger.warning("Could not load persistent state: {0}"
 
2225
                           .format(e))
 
2226
            if e.errno != errno.ENOENT:
2421
2227
                raise
2422
2228
        except EOFError as e:
2423
2229
            logger.warning("Could not load persistent state: "
2424
 
                           "EOFError:", exc_info=e)
 
2230
                           "EOFError: {0}".format(e))
2425
2231
    
2426
2232
    with PGPEngine() as pgp:
2427
2233
        for client_name, client in clients_data.iteritems():
2444
2250
            
2445
2251
            # Clients who has passed its expire date can still be
2446
2252
            # enabled if its last checker was successful.  Clients
2447
 
            # whose checker succeeded before we stored its state is
2448
 
            # assumed to have successfully run all checkers during
2449
 
            # downtime.
 
2253
            # whose checker failed before we stored its state is
 
2254
            # assumed to have failed all checkers during downtime.
2450
2255
            if client["enabled"]:
2451
2256
                if datetime.datetime.utcnow() >= client["expires"]:
2452
2257
                    if not client["last_checked_ok"]:
2453
2258
                        logger.warning(
2454
2259
                            "disabling client {0} - Client never "
2455
 
                            "performed a successful checker"
2456
 
                            .format(client_name))
 
2260
                            "performed a successfull checker"
 
2261
                            .format(client["name"]))
2457
2262
                        client["enabled"] = False
2458
2263
                    elif client["last_checker_status"] != 0:
2459
2264
                        logger.warning(
2460
2265
                            "disabling client {0} - Client "
2461
2266
                            "last checker failed with error code {1}"
2462
 
                            .format(client_name,
 
2267
                            .format(client["name"],
2463
2268
                                    client["last_checker_status"]))
2464
2269
                        client["enabled"] = False
2465
2270
                    else:
2468
2273
                                             + client["timeout"])
2469
2274
                        logger.debug("Last checker succeeded,"
2470
2275
                                     " keeping {0} enabled"
2471
 
                                     .format(client_name))
 
2276
                                     .format(client["name"]))
2472
2277
            try:
2473
2278
                client["secret"] = (
2474
2279
                    pgp.decrypt(client["encrypted_secret"],
2480
2285
                             .format(client_name))
2481
2286
                client["secret"] = (
2482
2287
                    client_settings[client_name]["secret"])
 
2288
 
2483
2289
    
2484
2290
    # Add/remove clients based on new changes made to config
2485
2291
    for client_name in (set(old_client_settings)
2488
2294
    for client_name in (set(client_settings)
2489
2295
                        - set(old_client_settings)):
2490
2296
        clients_data[client_name] = client_settings[client_name]
2491
 
    
2492
 
    # Create all client objects
 
2297
 
 
2298
    # Create clients all clients
2493
2299
    for client_name, client in clients_data.iteritems():
2494
2300
        tcp_server.clients[client_name] = client_class(
2495
2301
            name = client_name, settings = client)
2496
2302
    
2497
2303
    if not tcp_server.clients:
2498
2304
        logger.warning("No clients defined")
2499
 
    
 
2305
        
2500
2306
    if not debug:
2501
2307
        try:
2502
2308
            with pidfile:
2510
2316
            # "pidfile" was never created
2511
2317
            pass
2512
2318
        del pidfilename
 
2319
        signal.signal(signal.SIGINT, signal.SIG_IGN)
2513
2320
    
2514
2321
    signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2515
2322
    signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
2516
2323
    
2517
2324
    if use_dbus:
2518
 
        @alternate_dbus_interfaces({"se.recompile.Mandos":
2519
 
                                        "se.bsnet.fukt.Mandos"})
2520
 
        class MandosDBusService(DBusObjectWithProperties):
 
2325
        class MandosDBusService(dbus.service.Object):
2521
2326
            """A D-Bus proxy object"""
2522
2327
            def __init__(self):
2523
2328
                dbus.service.Object.__init__(self, bus, "/")
2524
2329
            _interface = "se.recompile.Mandos"
2525
2330
            
2526
 
            @dbus_interface_annotations(_interface)
2527
 
            def _foo(self):
2528
 
                return { "org.freedesktop.DBus.Property"
2529
 
                         ".EmitsChangedSignal":
2530
 
                             "false"}
2531
 
            
2532
2331
            @dbus.service.signal(_interface, signature="o")
2533
2332
            def ClientAdded(self, objpath):
2534
2333
                "D-Bus signal"
2576
2375
            
2577
2376
            del _interface
2578
2377
        
2579
 
        mandos_dbus_service = MandosDBusService()
 
2378
        class MandosDBusServiceTransitional(MandosDBusService):
 
2379
            __metaclass__ = AlternateDBusNamesMetaclass
 
2380
        mandos_dbus_service = MandosDBusServiceTransitional()
2580
2381
    
2581
2382
    def cleanup():
2582
2383
        "Cleanup function; run on exit"
2615
2416
                del client_settings[client.name]["secret"]
2616
2417
        
2617
2418
        try:
2618
 
            with (tempfile.NamedTemporaryFile
2619
 
                  (mode='wb', suffix=".pickle", prefix='clients-',
2620
 
                   dir=os.path.dirname(stored_state_path),
2621
 
                   delete=False)) as stored_state:
 
2419
            tempfd, tempname = tempfile.mkstemp(suffix=".pickle",
 
2420
                                                prefix="clients-",
 
2421
                                                dir=os.path.dirname
 
2422
                                                (stored_state_path))
 
2423
            with os.fdopen(tempfd, "wb") as stored_state:
2622
2424
                pickle.dump((clients, client_settings), stored_state)
2623
 
                tempname=stored_state.name
2624
2425
            os.rename(tempname, stored_state_path)
2625
2426
        except (IOError, OSError) as e:
 
2427
            logger.warning("Could not save persistent state: {0}"
 
2428
                           .format(e))
2626
2429
            if not debug:
2627
2430
                try:
2628
2431
                    os.remove(tempname)
2629
2432
                except NameError:
2630
2433
                    pass
2631
 
            if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
2632
 
                logger.warning("Could not save persistent state: {0}"
2633
 
                               .format(os.strerror(e.errno)))
2634
 
            else:
2635
 
                logger.warning("Could not save persistent state:",
2636
 
                               exc_info=e)
 
2434
            if e.errno not in set((errno.ENOENT, errno.EACCES,
 
2435
                                   errno.EEXIST)):
2637
2436
                raise e
2638
2437
        
2639
2438
        # Delete all clients, and settings from config
2667
2466
    service.port = tcp_server.socket.getsockname()[1]
2668
2467
    if use_ipv6:
2669
2468
        logger.info("Now listening on address %r, port %d,"
2670
 
                    " flowinfo %d, scope_id %d",
2671
 
                    *tcp_server.socket.getsockname())
 
2469
                    " flowinfo %d, scope_id %d"
 
2470
                    % tcp_server.socket.getsockname())
2672
2471
    else:                       # IPv4
2673
 
        logger.info("Now listening on address %r, port %d",
2674
 
                    *tcp_server.socket.getsockname())
 
2472
        logger.info("Now listening on address %r, port %d"
 
2473
                    % tcp_server.socket.getsockname())
2675
2474
    
2676
2475
    #service.interface = tcp_server.socket.getsockname()[3]
2677
2476
    
2680
2479
        try:
2681
2480
            service.activate()
2682
2481
        except dbus.exceptions.DBusException as error:
2683
 
            logger.critical("D-Bus Exception", exc_info=error)
 
2482
            logger.critical("DBusException: %s", error)
2684
2483
            cleanup()
2685
2484
            sys.exit(1)
2686
2485
        # End of Avahi example code
2693
2492
        logger.debug("Starting main loop")
2694
2493
        main_loop.run()
2695
2494
    except AvahiError as error:
2696
 
        logger.critical("Avahi Error", exc_info=error)
 
2495
        logger.critical("AvahiError: %s", error)
2697
2496
        cleanup()
2698
2497
        sys.exit(1)
2699
2498
    except KeyboardInterrupt: