/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos

  • Committer: teddy at recompile
  • Date: 2012-01-01 17:38:33 UTC
  • Revision ID: teddy@recompile.se-20120101173833-ai39bif1w0ftuyyh
* Makefile (install-server): Add intro(8mandos) man page.
* network-hooks.d/bridge: Add copyright info and year.
* network-hooks.d/openvpn: - '' -
* network-hooks.d/wireless: - '' -

Show diffs side-by-side

added added

removed removed

Lines of Context:
11
11
# "AvahiService" class, and some lines in "main".
12
12
13
13
# Everything else is
14
 
# Copyright © 2008-2011 Teddy Hogeborn
15
 
# Copyright © 2008-2011 Björn Påhlsson
 
14
# Copyright © 2008-2012 Teddy Hogeborn
 
15
# Copyright © 2008-2012 Björn Påhlsson
16
16
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
28
28
# along with this program.  If not, see
29
29
# <http://www.gnu.org/licenses/>.
30
30
31
 
# Contact the authors at <mandos@fukt.bsnet.se>.
 
31
# Contact the authors at <mandos@recompile.se>.
32
32
33
33
 
34
34
from __future__ import (division, absolute_import, print_function,
62
62
import functools
63
63
import cPickle as pickle
64
64
import multiprocessing
 
65
import types
 
66
import binascii
 
67
import tempfile
65
68
 
66
69
import dbus
67
70
import dbus.service
72
75
import ctypes.util
73
76
import xml.dom.minidom
74
77
import inspect
 
78
import GnuPGInterface
75
79
 
76
80
try:
77
81
    SO_BINDTODEVICE = socket.SO_BINDTODEVICE
81
85
    except ImportError:
82
86
        SO_BINDTODEVICE = None
83
87
 
84
 
 
85
 
version = "1.3.0"
86
 
 
87
 
#logger = logging.getLogger('mandos')
88
 
logger = logging.Logger('mandos')
 
88
version = "1.5.0"
 
89
stored_state_file = "clients.pickle"
 
90
 
 
91
logger = logging.getLogger()
89
92
syslogger = (logging.handlers.SysLogHandler
90
93
             (facility = logging.handlers.SysLogHandler.LOG_DAEMON,
91
94
              address = str("/dev/log")))
92
 
syslogger.setFormatter(logging.Formatter
93
 
                       ('Mandos [%(process)d]: %(levelname)s:'
94
 
                        ' %(message)s'))
95
 
logger.addHandler(syslogger)
96
 
 
97
 
console = logging.StreamHandler()
98
 
console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'
99
 
                                       ' %(levelname)s:'
100
 
                                       ' %(message)s'))
101
 
logger.addHandler(console)
 
95
 
 
96
try:
 
97
    if_nametoindex = (ctypes.cdll.LoadLibrary
 
98
                      (ctypes.util.find_library("c"))
 
99
                      .if_nametoindex)
 
100
except (OSError, AttributeError):
 
101
    def if_nametoindex(interface):
 
102
        "Get an interface index the hard way, i.e. using fcntl()"
 
103
        SIOCGIFINDEX = 0x8933  # From /usr/include/linux/sockios.h
 
104
        with contextlib.closing(socket.socket()) as s:
 
105
            ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
 
106
                                struct.pack(str("16s16x"),
 
107
                                            interface))
 
108
        interface_index = struct.unpack(str("I"),
 
109
                                        ifreq[16:20])[0]
 
110
        return interface_index
 
111
 
 
112
 
 
113
def initlogger(debug, level=logging.WARNING):
 
114
    """init logger and add loglevel"""
 
115
    
 
116
    syslogger.setFormatter(logging.Formatter
 
117
                           ('Mandos [%(process)d]: %(levelname)s:'
 
118
                            ' %(message)s'))
 
119
    logger.addHandler(syslogger)
 
120
    
 
121
    if debug:
 
122
        console = logging.StreamHandler()
 
123
        console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
 
124
                                               ' [%(process)d]:'
 
125
                                               ' %(levelname)s:'
 
126
                                               ' %(message)s'))
 
127
        logger.addHandler(console)
 
128
    logger.setLevel(level)
 
129
 
 
130
 
 
131
class PGPError(Exception):
 
132
    """Exception if encryption/decryption fails"""
 
133
    pass
 
134
 
 
135
 
 
136
class PGPEngine(object):
 
137
    """A simple class for OpenPGP symmetric encryption & decryption"""
 
138
    def __init__(self):
 
139
        self.gnupg = GnuPGInterface.GnuPG()
 
140
        self.tempdir = tempfile.mkdtemp(prefix="mandos-")
 
141
        self.gnupg = GnuPGInterface.GnuPG()
 
142
        self.gnupg.options.meta_interactive = False
 
143
        self.gnupg.options.homedir = self.tempdir
 
144
        self.gnupg.options.extra_args.extend(['--force-mdc',
 
145
                                              '--quiet',
 
146
                                              '--no-use-agent'])
 
147
    
 
148
    def __enter__(self):
 
149
        return self
 
150
    
 
151
    def __exit__ (self, exc_type, exc_value, traceback):
 
152
        self._cleanup()
 
153
        return False
 
154
    
 
155
    def __del__(self):
 
156
        self._cleanup()
 
157
    
 
158
    def _cleanup(self):
 
159
        if self.tempdir is not None:
 
160
            # Delete contents of tempdir
 
161
            for root, dirs, files in os.walk(self.tempdir,
 
162
                                             topdown = False):
 
163
                for filename in files:
 
164
                    os.remove(os.path.join(root, filename))
 
165
                for dirname in dirs:
 
166
                    os.rmdir(os.path.join(root, dirname))
 
167
            # Remove tempdir
 
168
            os.rmdir(self.tempdir)
 
169
            self.tempdir = None
 
170
    
 
171
    def password_encode(self, password):
 
172
        # Passphrase can not be empty and can not contain newlines or
 
173
        # NUL bytes.  So we prefix it and hex encode it.
 
174
        return b"mandos" + binascii.hexlify(password)
 
175
    
 
176
    def encrypt(self, data, password):
 
177
        self.gnupg.passphrase = self.password_encode(password)
 
178
        with open(os.devnull) as devnull:
 
179
            try:
 
180
                proc = self.gnupg.run(['--symmetric'],
 
181
                                      create_fhs=['stdin', 'stdout'],
 
182
                                      attach_fhs={'stderr': devnull})
 
183
                with contextlib.closing(proc.handles['stdin']) as f:
 
184
                    f.write(data)
 
185
                with contextlib.closing(proc.handles['stdout']) as f:
 
186
                    ciphertext = f.read()
 
187
                proc.wait()
 
188
            except IOError as e:
 
189
                raise PGPError(e)
 
190
        self.gnupg.passphrase = None
 
191
        return ciphertext
 
192
    
 
193
    def decrypt(self, data, password):
 
194
        self.gnupg.passphrase = self.password_encode(password)
 
195
        with open(os.devnull) as devnull:
 
196
            try:
 
197
                proc = self.gnupg.run(['--decrypt'],
 
198
                                      create_fhs=['stdin', 'stdout'],
 
199
                                      attach_fhs={'stderr': devnull})
 
200
                with contextlib.closing(proc.handles['stdin'] ) as f:
 
201
                    f.write(data)
 
202
                with contextlib.closing(proc.handles['stdout']) as f:
 
203
                    decrypted_plaintext = f.read()
 
204
                proc.wait()
 
205
            except IOError as e:
 
206
                raise PGPError(e)
 
207
        self.gnupg.passphrase = None
 
208
        return decrypted_plaintext
 
209
 
 
210
 
102
211
 
103
212
class AvahiError(Exception):
104
213
    def __init__(self, value, *args, **kwargs):
151
260
        self.group = None       # our entry group
152
261
        self.server = None
153
262
        self.bus = bus
 
263
        self.entry_group_state_changed_match = None
154
264
    def rename(self):
155
265
        """Derived from the Avahi example code"""
156
266
        if self.rename_count >= self.max_renames:
158
268
                            " after %i retries, exiting.",
159
269
                            self.rename_count)
160
270
            raise AvahiServiceError("Too many renames")
161
 
        self.name = unicode(self.server.GetAlternativeServiceName(self.name))
 
271
        self.name = unicode(self.server
 
272
                            .GetAlternativeServiceName(self.name))
162
273
        logger.info("Changing Zeroconf service name to %r ...",
163
274
                    self.name)
164
 
        syslogger.setFormatter(logging.Formatter
165
 
                               ('Mandos (%s) [%%(process)d]:'
166
 
                                ' %%(levelname)s: %%(message)s'
167
 
                                % self.name))
168
275
        self.remove()
169
276
        try:
170
277
            self.add()
171
 
        except dbus.exceptions.DBusException, error:
 
278
        except dbus.exceptions.DBusException as error:
172
279
            logger.critical("DBusException: %s", error)
173
280
            self.cleanup()
174
281
            os._exit(1)
175
282
        self.rename_count += 1
176
283
    def remove(self):
177
284
        """Derived from the Avahi example code"""
 
285
        if self.entry_group_state_changed_match is not None:
 
286
            self.entry_group_state_changed_match.remove()
 
287
            self.entry_group_state_changed_match = None
178
288
        if self.group is not None:
179
289
            self.group.Reset()
180
290
    def add(self):
181
291
        """Derived from the Avahi example code"""
 
292
        self.remove()
182
293
        if self.group is None:
183
294
            self.group = dbus.Interface(
184
295
                self.bus.get_object(avahi.DBUS_NAME,
185
296
                                    self.server.EntryGroupNew()),
186
297
                avahi.DBUS_INTERFACE_ENTRY_GROUP)
187
 
            self.group.connect_to_signal('StateChanged',
188
 
                                         self
189
 
                                         .entry_group_state_changed)
 
298
        self.entry_group_state_changed_match = (
 
299
            self.group.connect_to_signal(
 
300
                'StateChanged', self.entry_group_state_changed))
190
301
        logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
191
302
                     self.name, self.type)
192
303
        self.group.AddService(
215
326
    def cleanup(self):
216
327
        """Derived from the Avahi example code"""
217
328
        if self.group is not None:
218
 
            self.group.Free()
 
329
            try:
 
330
                self.group.Free()
 
331
            except (dbus.exceptions.UnknownMethodException,
 
332
                    dbus.exceptions.DBusException):
 
333
                pass
219
334
            self.group = None
220
 
    def server_state_changed(self, state):
 
335
        self.remove()
 
336
    def server_state_changed(self, state, error=None):
221
337
        """Derived from the Avahi example code"""
222
338
        logger.debug("Avahi server state change: %i", state)
223
 
        if state == avahi.SERVER_COLLISION:
224
 
            logger.error("Zeroconf server name collision")
225
 
            self.remove()
 
339
        bad_states = { avahi.SERVER_INVALID:
 
340
                           "Zeroconf server invalid",
 
341
                       avahi.SERVER_REGISTERING: None,
 
342
                       avahi.SERVER_COLLISION:
 
343
                           "Zeroconf server name collision",
 
344
                       avahi.SERVER_FAILURE:
 
345
                           "Zeroconf server failure" }
 
346
        if state in bad_states:
 
347
            if bad_states[state] is not None:
 
348
                if error is None:
 
349
                    logger.error(bad_states[state])
 
350
                else:
 
351
                    logger.error(bad_states[state] + ": %r", error)
 
352
            self.cleanup()
226
353
        elif state == avahi.SERVER_RUNNING:
227
354
            self.add()
 
355
        else:
 
356
            if error is None:
 
357
                logger.debug("Unknown state: %r", state)
 
358
            else:
 
359
                logger.debug("Unknown state: %r: %r", state, error)
228
360
    def activate(self):
229
361
        """Derived from the Avahi example code"""
230
362
        if self.server is None:
231
363
            self.server = dbus.Interface(
232
364
                self.bus.get_object(avahi.DBUS_NAME,
233
 
                                    avahi.DBUS_PATH_SERVER),
 
365
                                    avahi.DBUS_PATH_SERVER,
 
366
                                    follow_name_owner_changes=True),
234
367
                avahi.DBUS_INTERFACE_SERVER)
235
368
        self.server.connect_to_signal("StateChanged",
236
369
                                 self.server_state_changed)
237
370
        self.server_state_changed(self.server.GetState())
238
371
 
 
372
class AvahiServiceToSyslog(AvahiService):
 
373
    def rename(self):
 
374
        """Add the new name to the syslog messages"""
 
375
        ret = AvahiService.rename(self)
 
376
        syslogger.setFormatter(logging.Formatter
 
377
                               ('Mandos (%s) [%%(process)d]:'
 
378
                                ' %%(levelname)s: %%(message)s'
 
379
                                % self.name))
 
380
        return ret
239
381
 
 
382
def timedelta_to_milliseconds(td):
 
383
    "Convert a datetime.timedelta() to milliseconds"
 
384
    return ((td.days * 24 * 60 * 60 * 1000)
 
385
            + (td.seconds * 1000)
 
386
            + (td.microseconds // 1000))
 
387
        
240
388
class Client(object):
241
389
    """A representation of a client host served by this server.
242
390
    
243
391
    Attributes:
244
 
    _approved:   bool(); 'None' if not yet approved/disapproved
 
392
    approved:   bool(); 'None' if not yet approved/disapproved
245
393
    approval_delay: datetime.timedelta(); Time to wait for approval
246
394
    approval_duration: datetime.timedelta(); Duration of one approval
247
395
    checker:    subprocess.Popen(); a running checker process used
254
402
                     instance %(name)s can be used in the command.
255
403
    checker_initiator_tag: a gobject event source tag, or None
256
404
    created:    datetime.datetime(); (UTC) object creation
 
405
    client_structure: Object describing what attributes a client has
 
406
                      and is used for storing the client at exit
257
407
    current_checker_command: string; current running checker_command
258
 
    disable_hook:  If set, called by disable() as disable_hook(self)
259
408
    disable_initiator_tag: a gobject event source tag, or None
260
409
    enabled:    bool()
261
410
    fingerprint: string (40 or 32 hexadecimal digits); used to
264
413
    interval:   datetime.timedelta(); How often to start a new checker
265
414
    last_approval_request: datetime.datetime(); (UTC) or None
266
415
    last_checked_ok: datetime.datetime(); (UTC) or None
267
 
    last_enabled: datetime.datetime(); (UTC)
 
416
    last_checker_status: integer between 0 and 255 reflecting exit
 
417
                         status of last checker. -1 reflects crashed
 
418
                         checker, or None.
 
419
    last_enabled: datetime.datetime(); (UTC) or None
268
420
    name:       string; from the config file, used in log messages and
269
421
                        D-Bus identifiers
270
422
    secret:     bytestring; sent verbatim (over TLS) to client
271
423
    timeout:    datetime.timedelta(); How long from last_checked_ok
272
424
                                      until this client is disabled
 
425
    extended_timeout:   extra long timeout when password has been sent
273
426
    runtime_expansions: Allowed attributes for runtime expansion.
 
427
    expires:    datetime.datetime(); time (UTC) when a client will be
 
428
                disabled, or None
274
429
    """
275
430
    
276
431
    runtime_expansions = ("approval_delay", "approval_duration",
277
432
                          "created", "enabled", "fingerprint",
278
433
                          "host", "interval", "last_checked_ok",
279
434
                          "last_enabled", "name", "timeout")
280
 
    
281
 
    @staticmethod
282
 
    def _timedelta_to_milliseconds(td):
283
 
        "Convert a datetime.timedelta() to milliseconds"
284
 
        return ((td.days * 24 * 60 * 60 * 1000)
285
 
                + (td.seconds * 1000)
286
 
                + (td.microseconds // 1000))
 
435
    client_defaults = { "timeout": "5m",
 
436
                        "extended_timeout": "15m",
 
437
                        "interval": "2m",
 
438
                        "checker": "fping -q -- %%(host)s",
 
439
                        "host": "",
 
440
                        "approval_delay": "0s",
 
441
                        "approval_duration": "1s",
 
442
                        "approved_by_default": "True",
 
443
                        "enabled": "True",
 
444
                        }
287
445
    
288
446
    def timeout_milliseconds(self):
289
447
        "Return the 'timeout' attribute in milliseconds"
290
 
        return self._timedelta_to_milliseconds(self.timeout)
 
448
        return timedelta_to_milliseconds(self.timeout)
 
449
    
 
450
    def extended_timeout_milliseconds(self):
 
451
        "Return the 'extended_timeout' attribute in milliseconds"
 
452
        return timedelta_to_milliseconds(self.extended_timeout)
291
453
    
292
454
    def interval_milliseconds(self):
293
455
        "Return the 'interval' attribute in milliseconds"
294
 
        return self._timedelta_to_milliseconds(self.interval)
295
 
 
 
456
        return timedelta_to_milliseconds(self.interval)
 
457
    
296
458
    def approval_delay_milliseconds(self):
297
 
        return self._timedelta_to_milliseconds(self.approval_delay)
298
 
    
299
 
    def __init__(self, name = None, disable_hook=None, config=None):
 
459
        return timedelta_to_milliseconds(self.approval_delay)
 
460
 
 
461
    @staticmethod
 
462
    def config_parser(config):
 
463
        """Construct a new dict of client settings of this form:
 
464
        { client_name: {setting_name: value, ...}, ...}
 
465
        with exceptions for any special settings as defined above.
 
466
        NOTE: Must be a pure function. Must return the same result
 
467
        value given the same arguments.
 
468
        """
 
469
        settings = {}
 
470
        for client_name in config.sections():
 
471
            section = dict(config.items(client_name))
 
472
            client = settings[client_name] = {}
 
473
            
 
474
            client["host"] = section["host"]
 
475
            # Reformat values from string types to Python types
 
476
            client["approved_by_default"] = config.getboolean(
 
477
                client_name, "approved_by_default")
 
478
            client["enabled"] = config.getboolean(client_name,
 
479
                                                  "enabled")
 
480
            
 
481
            client["fingerprint"] = (section["fingerprint"].upper()
 
482
                                     .replace(" ", ""))
 
483
            if "secret" in section:
 
484
                client["secret"] = section["secret"].decode("base64")
 
485
            elif "secfile" in section:
 
486
                with open(os.path.expanduser(os.path.expandvars
 
487
                                             (section["secfile"])),
 
488
                          "rb") as secfile:
 
489
                    client["secret"] = secfile.read()
 
490
            else:
 
491
                raise TypeError("No secret or secfile for section %s"
 
492
                                % section)
 
493
            client["timeout"] = string_to_delta(section["timeout"])
 
494
            client["extended_timeout"] = string_to_delta(
 
495
                section["extended_timeout"])
 
496
            client["interval"] = string_to_delta(section["interval"])
 
497
            client["approval_delay"] = string_to_delta(
 
498
                section["approval_delay"])
 
499
            client["approval_duration"] = string_to_delta(
 
500
                section["approval_duration"])
 
501
            client["checker_command"] = section["checker"]
 
502
            client["last_approval_request"] = None
 
503
            client["last_checked_ok"] = None
 
504
            client["last_checker_status"] = None
 
505
        
 
506
        return settings
 
507
        
 
508
        
 
509
    def __init__(self, settings, name = None):
300
510
        """Note: the 'checker' key in 'config' sets the
301
511
        'checker_command' attribute and *not* the 'checker'
302
512
        attribute."""
303
513
        self.name = name
304
 
        if config is None:
305
 
            config = {}
 
514
        # adding all client settings
 
515
        for setting, value in settings.iteritems():
 
516
            setattr(self, setting, value)
 
517
        
 
518
        if self.enabled:
 
519
            if not hasattr(self, "last_enabled"):
 
520
                self.last_enabled = datetime.datetime.utcnow()
 
521
            if not hasattr(self, "expires"):
 
522
                self.expires = (datetime.datetime.utcnow()
 
523
                                + self.timeout)
 
524
        else:
 
525
            self.last_enabled = None
 
526
            self.expires = None
 
527
       
306
528
        logger.debug("Creating client %r", self.name)
307
529
        # Uppercase and remove spaces from fingerprint for later
308
530
        # comparison purposes with return value from the fingerprint()
309
531
        # function
310
 
        self.fingerprint = (config["fingerprint"].upper()
311
 
                            .replace(" ", ""))
312
532
        logger.debug("  Fingerprint: %s", self.fingerprint)
313
 
        if "secret" in config:
314
 
            self.secret = config["secret"].decode("base64")
315
 
        elif "secfile" in config:
316
 
            with open(os.path.expanduser(os.path.expandvars
317
 
                                         (config["secfile"])),
318
 
                      "rb") as secfile:
319
 
                self.secret = secfile.read()
320
 
        else:
321
 
            raise TypeError("No secret or secfile for client %s"
322
 
                            % self.name)
323
 
        self.host = config.get("host", "")
324
 
        self.created = datetime.datetime.utcnow()
325
 
        self.enabled = False
326
 
        self.last_approval_request = None
327
 
        self.last_enabled = None
328
 
        self.last_checked_ok = None
329
 
        self.timeout = string_to_delta(config["timeout"])
330
 
        self.interval = string_to_delta(config["interval"])
331
 
        self.disable_hook = disable_hook
 
533
        self.created = settings.get("created",
 
534
                                    datetime.datetime.utcnow())
 
535
 
 
536
        # attributes specific for this server instance
332
537
        self.checker = None
333
538
        self.checker_initiator_tag = None
334
539
        self.disable_initiator_tag = None
335
540
        self.checker_callback_tag = None
336
 
        self.checker_command = config["checker"]
337
541
        self.current_checker_command = None
338
 
        self.last_connect = None
339
 
        self._approved = None
340
 
        self.approved_by_default = config.get("approved_by_default",
341
 
                                              True)
 
542
        self.approved = None
342
543
        self.approvals_pending = 0
343
 
        self.approval_delay = string_to_delta(
344
 
            config["approval_delay"])
345
 
        self.approval_duration = string_to_delta(
346
 
            config["approval_duration"])
347
 
        self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())
 
544
        self.changedstate = (multiprocessing_manager
 
545
                             .Condition(multiprocessing_manager
 
546
                                        .Lock()))
 
547
        self.client_structure = [attr for attr in
 
548
                                 self.__dict__.iterkeys()
 
549
                                 if not attr.startswith("_")]
 
550
        self.client_structure.append("client_structure")
 
551
        
 
552
        for name, t in inspect.getmembers(type(self),
 
553
                                          lambda obj:
 
554
                                              isinstance(obj,
 
555
                                                         property)):
 
556
            if not name.startswith("_"):
 
557
                self.client_structure.append(name)
348
558
    
 
559
    # Send notice to process children that client state has changed
349
560
    def send_changedstate(self):
350
 
        self.changedstate.acquire()
351
 
        self.changedstate.notify_all()
352
 
        self.changedstate.release()
353
 
        
 
561
        with self.changedstate:
 
562
            self.changedstate.notify_all()
 
563
    
354
564
    def enable(self):
355
565
        """Start this client's checker and timeout hooks"""
356
566
        if getattr(self, "enabled", False):
357
567
            # Already enabled
358
568
            return
359
569
        self.send_changedstate()
 
570
        self.expires = datetime.datetime.utcnow() + self.timeout
 
571
        self.enabled = True
360
572
        self.last_enabled = datetime.datetime.utcnow()
361
 
        # Schedule a new checker to be started an 'interval' from now,
362
 
        # and every interval from then on.
363
 
        self.checker_initiator_tag = (gobject.timeout_add
364
 
                                      (self.interval_milliseconds(),
365
 
                                       self.start_checker))
366
 
        # Schedule a disable() when 'timeout' has passed
367
 
        self.disable_initiator_tag = (gobject.timeout_add
368
 
                                   (self.timeout_milliseconds(),
369
 
                                    self.disable))
370
 
        self.enabled = True
371
 
        # Also start a new checker *right now*.
372
 
        self.start_checker()
 
573
        self.init_checker()
373
574
    
374
575
    def disable(self, quiet=True):
375
576
        """Disable this client."""
382
583
        if getattr(self, "disable_initiator_tag", False):
383
584
            gobject.source_remove(self.disable_initiator_tag)
384
585
            self.disable_initiator_tag = None
 
586
        self.expires = None
385
587
        if getattr(self, "checker_initiator_tag", False):
386
588
            gobject.source_remove(self.checker_initiator_tag)
387
589
            self.checker_initiator_tag = None
388
590
        self.stop_checker()
389
 
        if self.disable_hook:
390
 
            self.disable_hook(self)
391
591
        self.enabled = False
392
592
        # Do not run this again if called by a gobject.timeout_add
393
593
        return False
394
594
    
395
595
    def __del__(self):
396
 
        self.disable_hook = None
397
596
        self.disable()
398
597
    
 
598
    def init_checker(self):
 
599
        # Schedule a new checker to be started an 'interval' from now,
 
600
        # and every interval from then on.
 
601
        self.checker_initiator_tag = (gobject.timeout_add
 
602
                                      (self.interval_milliseconds(),
 
603
                                       self.start_checker))
 
604
        # Schedule a disable() when 'timeout' has passed
 
605
        self.disable_initiator_tag = (gobject.timeout_add
 
606
                                   (self.timeout_milliseconds(),
 
607
                                    self.disable))
 
608
        # Also start a new checker *right now*.
 
609
        self.start_checker()
 
610
    
399
611
    def checker_callback(self, pid, condition, command):
400
612
        """The checker has completed, so take appropriate actions."""
401
613
        self.checker_callback_tag = None
402
614
        self.checker = None
403
615
        if os.WIFEXITED(condition):
404
 
            exitstatus = os.WEXITSTATUS(condition)
405
 
            if exitstatus == 0:
 
616
            self.last_checker_status = os.WEXITSTATUS(condition)
 
617
            if self.last_checker_status == 0:
406
618
                logger.info("Checker for %(name)s succeeded",
407
619
                            vars(self))
408
620
                self.checked_ok()
410
622
                logger.info("Checker for %(name)s failed",
411
623
                            vars(self))
412
624
        else:
 
625
            self.last_checker_status = -1
413
626
            logger.warning("Checker for %(name)s crashed?",
414
627
                           vars(self))
415
628
    
416
 
    def checked_ok(self):
 
629
    def checked_ok(self, timeout=None):
417
630
        """Bump up the timeout for this client.
418
631
        
419
632
        This should only be called when the client has been seen,
420
633
        alive and well.
421
634
        """
 
635
        if timeout is None:
 
636
            timeout = self.timeout
422
637
        self.last_checked_ok = datetime.datetime.utcnow()
423
 
        gobject.source_remove(self.disable_initiator_tag)
424
 
        self.disable_initiator_tag = (gobject.timeout_add
425
 
                                      (self.timeout_milliseconds(),
426
 
                                       self.disable))
 
638
        if self.disable_initiator_tag is not None:
 
639
            gobject.source_remove(self.disable_initiator_tag)
 
640
        if getattr(self, "enabled", False):
 
641
            self.disable_initiator_tag = (gobject.timeout_add
 
642
                                          (timedelta_to_milliseconds
 
643
                                           (timeout), self.disable))
 
644
            self.expires = datetime.datetime.utcnow() + timeout
427
645
    
428
646
    def need_approval(self):
429
647
        self.last_approval_request = datetime.datetime.utcnow()
445
663
        # If a checker exists, make sure it is not a zombie
446
664
        try:
447
665
            pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
448
 
        except (AttributeError, OSError), error:
 
666
        except (AttributeError, OSError) as error:
449
667
            if (isinstance(error, OSError)
450
668
                and error.errno != errno.ECHILD):
451
669
                raise error
469
687
                                       'replace')))
470
688
                    for attr in
471
689
                    self.runtime_expansions)
472
 
 
 
690
                
473
691
                try:
474
692
                    command = self.checker_command % escaped_attrs
475
 
                except TypeError, error:
 
693
                except TypeError as error:
476
694
                    logger.error('Could not format string "%s":'
477
695
                                 ' %s', self.checker_command, error)
478
696
                    return True # Try again later
497
715
                if pid:
498
716
                    gobject.source_remove(self.checker_callback_tag)
499
717
                    self.checker_callback(pid, status, command)
500
 
            except OSError, error:
 
718
            except OSError as error:
501
719
                logger.error("Failed to start subprocess: %s",
502
720
                             error)
503
721
        # Re-run this periodically if run by gobject.timeout_add
516
734
            #time.sleep(0.5)
517
735
            #if self.checker.poll() is None:
518
736
            #    os.kill(self.checker.pid, signal.SIGKILL)
519
 
        except OSError, error:
 
737
        except OSError as error:
520
738
            if error.errno != errno.ESRCH: # No such process
521
739
                raise
522
740
        self.checker = None
523
741
 
 
742
 
524
743
def dbus_service_property(dbus_interface, signature="v",
525
744
                          access="readwrite", byte_arrays=False):
526
745
    """Decorators for marking methods of a DBusObjectWithProperties to
572
791
 
573
792
class DBusObjectWithProperties(dbus.service.Object):
574
793
    """A D-Bus object with properties.
575
 
 
 
794
    
576
795
    Classes inheriting from this can use the dbus_service_property
577
796
    decorator to expose methods as D-Bus properties.  It exposes the
578
797
    standard Get(), Set(), and GetAll() methods on the D-Bus.
585
804
    def _get_all_dbus_properties(self):
586
805
        """Returns a generator of (name, attribute) pairs
587
806
        """
588
 
        return ((prop._dbus_name, prop)
 
807
        return ((prop.__get__(self)._dbus_name, prop.__get__(self))
 
808
                for cls in self.__class__.__mro__
589
809
                for name, prop in
590
 
                inspect.getmembers(self, self._is_dbus_property))
 
810
                inspect.getmembers(cls, self._is_dbus_property))
591
811
    
592
812
    def _get_dbus_property(self, interface_name, property_name):
593
813
        """Returns a bound method if one exists which is a D-Bus
594
814
        property with the specified name and interface.
595
815
        """
596
 
        for name in (property_name,
597
 
                     property_name + "_dbus_property"):
598
 
            prop = getattr(self, name, None)
599
 
            if (prop is None
600
 
                or not self._is_dbus_property(prop)
601
 
                or prop._dbus_name != property_name
602
 
                or (interface_name and prop._dbus_interface
603
 
                    and interface_name != prop._dbus_interface)):
604
 
                continue
605
 
            return prop
 
816
        for cls in  self.__class__.__mro__:
 
817
            for name, value in (inspect.getmembers
 
818
                                (cls, self._is_dbus_property)):
 
819
                if (value._dbus_name == property_name
 
820
                    and value._dbus_interface == interface_name):
 
821
                    return value.__get__(self)
 
822
        
606
823
        # No such property
607
824
        raise DBusPropertyNotFound(self.dbus_object_path + ":"
608
825
                                   + interface_name + "."
633
850
            # signatures other than "ay".
634
851
            if prop._dbus_signature != "ay":
635
852
                raise ValueError
636
 
            value = dbus.ByteArray(''.join(unichr(byte)
637
 
                                           for byte in value))
 
853
            value = dbus.ByteArray(b''.join(chr(byte)
 
854
                                            for byte in value))
638
855
        prop(value)
639
856
    
640
857
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
642
859
    def GetAll(self, interface_name):
643
860
        """Standard D-Bus property GetAll() method, see D-Bus
644
861
        standard.
645
 
 
 
862
        
646
863
        Note: Will not include properties with access="write".
647
864
        """
648
 
        all = {}
 
865
        properties = {}
649
866
        for name, prop in self._get_all_dbus_properties():
650
867
            if (interface_name
651
868
                and interface_name != prop._dbus_interface):
656
873
                continue
657
874
            value = prop()
658
875
            if not hasattr(value, "variant_level"):
659
 
                all[name] = value
 
876
                properties[name] = value
660
877
                continue
661
 
            all[name] = type(value)(value, variant_level=
662
 
                                    value.variant_level+1)
663
 
        return dbus.Dictionary(all, signature="sv")
 
878
            properties[name] = type(value)(value, variant_level=
 
879
                                           value.variant_level+1)
 
880
        return dbus.Dictionary(properties, signature="sv")
664
881
    
665
882
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
666
883
                         out_signature="s",
704
921
            xmlstring = document.toxml("utf-8")
705
922
            document.unlink()
706
923
        except (AttributeError, xml.dom.DOMException,
707
 
                xml.parsers.expat.ExpatError), error:
 
924
                xml.parsers.expat.ExpatError) as error:
708
925
            logger.error("Failed to override Introspection method",
709
926
                         error)
710
927
        return xmlstring
711
928
 
712
929
 
 
930
def datetime_to_dbus (dt, variant_level=0):
 
931
    """Convert a UTC datetime.datetime() to a D-Bus type."""
 
932
    if dt is None:
 
933
        return dbus.String("", variant_level = variant_level)
 
934
    return dbus.String(dt.isoformat(),
 
935
                       variant_level=variant_level)
 
936
 
 
937
 
 
938
class AlternateDBusNamesMetaclass(DBusObjectWithProperties
 
939
                                  .__metaclass__):
 
940
    """Applied to an empty subclass of a D-Bus object, this metaclass
 
941
    will add additional D-Bus attributes matching a certain pattern.
 
942
    """
 
943
    def __new__(mcs, name, bases, attr):
 
944
        # Go through all the base classes which could have D-Bus
 
945
        # methods, signals, or properties in them
 
946
        for base in (b for b in bases
 
947
                     if issubclass(b, dbus.service.Object)):
 
948
            # Go though all attributes of the base class
 
949
            for attrname, attribute in inspect.getmembers(base):
 
950
                # Ignore non-D-Bus attributes, and D-Bus attributes
 
951
                # with the wrong interface name
 
952
                if (not hasattr(attribute, "_dbus_interface")
 
953
                    or not attribute._dbus_interface
 
954
                    .startswith("se.recompile.Mandos")):
 
955
                    continue
 
956
                # Create an alternate D-Bus interface name based on
 
957
                # the current name
 
958
                alt_interface = (attribute._dbus_interface
 
959
                                 .replace("se.recompile.Mandos",
 
960
                                          "se.bsnet.fukt.Mandos"))
 
961
                # Is this a D-Bus signal?
 
962
                if getattr(attribute, "_dbus_is_signal", False):
 
963
                    # Extract the original non-method function by
 
964
                    # black magic
 
965
                    nonmethod_func = (dict(
 
966
                            zip(attribute.func_code.co_freevars,
 
967
                                attribute.__closure__))["func"]
 
968
                                      .cell_contents)
 
969
                    # Create a new, but exactly alike, function
 
970
                    # object, and decorate it to be a new D-Bus signal
 
971
                    # with the alternate D-Bus interface name
 
972
                    new_function = (dbus.service.signal
 
973
                                    (alt_interface,
 
974
                                     attribute._dbus_signature)
 
975
                                    (types.FunctionType(
 
976
                                nonmethod_func.func_code,
 
977
                                nonmethod_func.func_globals,
 
978
                                nonmethod_func.func_name,
 
979
                                nonmethod_func.func_defaults,
 
980
                                nonmethod_func.func_closure)))
 
981
                    # Define a creator of a function to call both the
 
982
                    # old and new functions, so both the old and new
 
983
                    # signals gets sent when the function is called
 
984
                    def fixscope(func1, func2):
 
985
                        """This function is a scope container to pass
 
986
                        func1 and func2 to the "call_both" function
 
987
                        outside of its arguments"""
 
988
                        def call_both(*args, **kwargs):
 
989
                            """This function will emit two D-Bus
 
990
                            signals by calling func1 and func2"""
 
991
                            func1(*args, **kwargs)
 
992
                            func2(*args, **kwargs)
 
993
                        return call_both
 
994
                    # Create the "call_both" function and add it to
 
995
                    # the class
 
996
                    attr[attrname] = fixscope(attribute,
 
997
                                              new_function)
 
998
                # Is this a D-Bus method?
 
999
                elif getattr(attribute, "_dbus_is_method", False):
 
1000
                    # Create a new, but exactly alike, function
 
1001
                    # object.  Decorate it to be a new D-Bus method
 
1002
                    # with the alternate D-Bus interface name.  Add it
 
1003
                    # to the class.
 
1004
                    attr[attrname] = (dbus.service.method
 
1005
                                      (alt_interface,
 
1006
                                       attribute._dbus_in_signature,
 
1007
                                       attribute._dbus_out_signature)
 
1008
                                      (types.FunctionType
 
1009
                                       (attribute.func_code,
 
1010
                                        attribute.func_globals,
 
1011
                                        attribute.func_name,
 
1012
                                        attribute.func_defaults,
 
1013
                                        attribute.func_closure)))
 
1014
                # Is this a D-Bus property?
 
1015
                elif getattr(attribute, "_dbus_is_property", False):
 
1016
                    # Create a new, but exactly alike, function
 
1017
                    # object, and decorate it to be a new D-Bus
 
1018
                    # property with the alternate D-Bus interface
 
1019
                    # name.  Add it to the class.
 
1020
                    attr[attrname] = (dbus_service_property
 
1021
                                      (alt_interface,
 
1022
                                       attribute._dbus_signature,
 
1023
                                       attribute._dbus_access,
 
1024
                                       attribute
 
1025
                                       ._dbus_get_args_options
 
1026
                                       ["byte_arrays"])
 
1027
                                      (types.FunctionType
 
1028
                                       (attribute.func_code,
 
1029
                                        attribute.func_globals,
 
1030
                                        attribute.func_name,
 
1031
                                        attribute.func_defaults,
 
1032
                                        attribute.func_closure)))
 
1033
        return type.__new__(mcs, name, bases, attr)
 
1034
 
 
1035
 
713
1036
class ClientDBus(Client, DBusObjectWithProperties):
714
1037
    """A Client class using D-Bus
715
1038
    
724
1047
    # dbus.service.Object doesn't use super(), so we can't either.
725
1048
    
726
1049
    def __init__(self, bus = None, *args, **kwargs):
727
 
        self._approvals_pending = 0
728
1050
        self.bus = bus
729
1051
        Client.__init__(self, *args, **kwargs)
 
1052
        self._approvals_pending = 0
 
1053
        
 
1054
        self._approvals_pending = 0
730
1055
        # Only now, when this client is initialized, can it show up on
731
1056
        # the D-Bus
732
1057
        client_object_name = unicode(self.name).translate(
737
1062
        DBusObjectWithProperties.__init__(self, self.bus,
738
1063
                                          self.dbus_object_path)
739
1064
        
740
 
    def _get_approvals_pending(self):
741
 
        return self._approvals_pending
742
 
    def _set_approvals_pending(self, value):
743
 
        old_value = self._approvals_pending
744
 
        self._approvals_pending = value
745
 
        bval = bool(value)
746
 
        if (hasattr(self, "dbus_object_path")
747
 
            and bval is not bool(old_value)):
748
 
            dbus_bool = dbus.Boolean(bval, variant_level=1)
749
 
            self.PropertyChanged(dbus.String("ApprovalPending"),
750
 
                                 dbus_bool)
751
 
 
752
 
    approvals_pending = property(_get_approvals_pending,
753
 
                                 _set_approvals_pending)
754
 
    del _get_approvals_pending, _set_approvals_pending
755
 
    
756
 
    @staticmethod
757
 
    def _datetime_to_dbus(dt, variant_level=0):
758
 
        """Convert a UTC datetime.datetime() to a D-Bus type."""
759
 
        return dbus.String(dt.isoformat(),
760
 
                           variant_level=variant_level)
761
 
    
762
 
    def enable(self):
763
 
        oldstate = getattr(self, "enabled", False)
764
 
        r = Client.enable(self)
765
 
        if oldstate != self.enabled:
766
 
            # Emit D-Bus signals
767
 
            self.PropertyChanged(dbus.String("Enabled"),
768
 
                                 dbus.Boolean(True, variant_level=1))
769
 
            self.PropertyChanged(
770
 
                dbus.String("LastEnabled"),
771
 
                self._datetime_to_dbus(self.last_enabled,
772
 
                                       variant_level=1))
773
 
        return r
774
 
    
775
 
    def disable(self, quiet = False):
776
 
        oldstate = getattr(self, "enabled", False)
777
 
        r = Client.disable(self, quiet=quiet)
778
 
        if not quiet and oldstate != self.enabled:
779
 
            # Emit D-Bus signal
780
 
            self.PropertyChanged(dbus.String("Enabled"),
781
 
                                 dbus.Boolean(False, variant_level=1))
782
 
        return r
 
1065
    def notifychangeproperty(transform_func,
 
1066
                             dbus_name, type_func=lambda x: x,
 
1067
                             variant_level=1):
 
1068
        """ Modify a variable so that it's a property which announces
 
1069
        its changes to DBus.
 
1070
        
 
1071
        transform_fun: Function that takes a value and a variant_level
 
1072
                       and transforms it to a D-Bus type.
 
1073
        dbus_name: D-Bus name of the variable
 
1074
        type_func: Function that transform the value before sending it
 
1075
                   to the D-Bus.  Default: no transform
 
1076
        variant_level: D-Bus variant level.  Default: 1
 
1077
        """
 
1078
        attrname = "_{0}".format(dbus_name)
 
1079
        def setter(self, value):
 
1080
            if hasattr(self, "dbus_object_path"):
 
1081
                if (not hasattr(self, attrname) or
 
1082
                    type_func(getattr(self, attrname, None))
 
1083
                    != type_func(value)):
 
1084
                    dbus_value = transform_func(type_func(value),
 
1085
                                                variant_level
 
1086
                                                =variant_level)
 
1087
                    self.PropertyChanged(dbus.String(dbus_name),
 
1088
                                         dbus_value)
 
1089
            setattr(self, attrname, value)
 
1090
        
 
1091
        return property(lambda self: getattr(self, attrname), setter)
 
1092
    
 
1093
    
 
1094
    expires = notifychangeproperty(datetime_to_dbus, "Expires")
 
1095
    approvals_pending = notifychangeproperty(dbus.Boolean,
 
1096
                                             "ApprovalPending",
 
1097
                                             type_func = bool)
 
1098
    enabled = notifychangeproperty(dbus.Boolean, "Enabled")
 
1099
    last_enabled = notifychangeproperty(datetime_to_dbus,
 
1100
                                        "LastEnabled")
 
1101
    checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",
 
1102
                                   type_func = lambda checker:
 
1103
                                       checker is not None)
 
1104
    last_checked_ok = notifychangeproperty(datetime_to_dbus,
 
1105
                                           "LastCheckedOK")
 
1106
    last_approval_request = notifychangeproperty(
 
1107
        datetime_to_dbus, "LastApprovalRequest")
 
1108
    approved_by_default = notifychangeproperty(dbus.Boolean,
 
1109
                                               "ApprovedByDefault")
 
1110
    approval_delay = notifychangeproperty(dbus.UInt64,
 
1111
                                          "ApprovalDelay",
 
1112
                                          type_func =
 
1113
                                          timedelta_to_milliseconds)
 
1114
    approval_duration = notifychangeproperty(
 
1115
        dbus.UInt64, "ApprovalDuration",
 
1116
        type_func = timedelta_to_milliseconds)
 
1117
    host = notifychangeproperty(dbus.String, "Host")
 
1118
    timeout = notifychangeproperty(dbus.UInt64, "Timeout",
 
1119
                                   type_func =
 
1120
                                   timedelta_to_milliseconds)
 
1121
    extended_timeout = notifychangeproperty(
 
1122
        dbus.UInt64, "ExtendedTimeout",
 
1123
        type_func = timedelta_to_milliseconds)
 
1124
    interval = notifychangeproperty(dbus.UInt64,
 
1125
                                    "Interval",
 
1126
                                    type_func =
 
1127
                                    timedelta_to_milliseconds)
 
1128
    checker_command = notifychangeproperty(dbus.String, "Checker")
 
1129
    
 
1130
    del notifychangeproperty
783
1131
    
784
1132
    def __del__(self, *args, **kwargs):
785
1133
        try:
794
1142
                         *args, **kwargs):
795
1143
        self.checker_callback_tag = None
796
1144
        self.checker = None
797
 
        # Emit D-Bus signal
798
 
        self.PropertyChanged(dbus.String("CheckerRunning"),
799
 
                             dbus.Boolean(False, variant_level=1))
800
1145
        if os.WIFEXITED(condition):
801
1146
            exitstatus = os.WEXITSTATUS(condition)
802
1147
            # Emit D-Bus signal
812
1157
        return Client.checker_callback(self, pid, condition, command,
813
1158
                                       *args, **kwargs)
814
1159
    
815
 
    def checked_ok(self, *args, **kwargs):
816
 
        r = Client.checked_ok(self, *args, **kwargs)
817
 
        # Emit D-Bus signal
818
 
        self.PropertyChanged(
819
 
            dbus.String("LastCheckedOK"),
820
 
            (self._datetime_to_dbus(self.last_checked_ok,
821
 
                                    variant_level=1)))
822
 
        return r
823
 
    
824
 
    def need_approval(self, *args, **kwargs):
825
 
        r = Client.need_approval(self, *args, **kwargs)
826
 
        # Emit D-Bus signal
827
 
        self.PropertyChanged(
828
 
            dbus.String("LastApprovalRequest"),
829
 
            (self._datetime_to_dbus(self.last_approval_request,
830
 
                                    variant_level=1)))
831
 
        return r
832
 
    
833
1160
    def start_checker(self, *args, **kwargs):
834
1161
        old_checker = self.checker
835
1162
        if self.checker is not None:
842
1169
            and old_checker_pid != self.checker.pid):
843
1170
            # Emit D-Bus signal
844
1171
            self.CheckerStarted(self.current_checker_command)
845
 
            self.PropertyChanged(
846
 
                dbus.String("CheckerRunning"),
847
 
                dbus.Boolean(True, variant_level=1))
848
1172
        return r
849
1173
    
850
 
    def stop_checker(self, *args, **kwargs):
851
 
        old_checker = getattr(self, "checker", None)
852
 
        r = Client.stop_checker(self, *args, **kwargs)
853
 
        if (old_checker is not None
854
 
            and getattr(self, "checker", None) is None):
855
 
            self.PropertyChanged(dbus.String("CheckerRunning"),
856
 
                                 dbus.Boolean(False, variant_level=1))
857
 
        return r
858
 
 
859
1174
    def _reset_approved(self):
860
 
        self._approved = None
 
1175
        self.approved = None
861
1176
        return False
862
1177
    
863
1178
    def approve(self, value=True):
864
1179
        self.send_changedstate()
865
 
        self._approved = value
866
 
        gobject.timeout_add(self._timedelta_to_milliseconds
 
1180
        self.approved = value
 
1181
        gobject.timeout_add(timedelta_to_milliseconds
867
1182
                            (self.approval_duration),
868
1183
                            self._reset_approved)
869
1184
    
870
1185
    
871
1186
    ## D-Bus methods, signals & properties
872
 
    _interface = "se.bsnet.fukt.Mandos.Client"
 
1187
    _interface = "se.recompile.Mandos.Client"
873
1188
    
874
1189
    ## Signals
875
1190
    
912
1227
        "D-Bus signal"
913
1228
        return self.need_approval()
914
1229
    
 
1230
    # NeRwequest - signal
 
1231
    @dbus.service.signal(_interface, signature="s")
 
1232
    def NewRequest(self, ip):
 
1233
        """D-Bus signal
 
1234
        Is sent after a client request a password.
 
1235
        """
 
1236
        pass
 
1237
    
915
1238
    ## Methods
916
1239
    
917
1240
    # Approve - method
922
1245
    # CheckedOK - method
923
1246
    @dbus.service.method(_interface)
924
1247
    def CheckedOK(self):
925
 
        return self.checked_ok()
 
1248
        self.checked_ok()
926
1249
    
927
1250
    # Enable - method
928
1251
    @dbus.service.method(_interface)
961
1284
        if value is None:       # get
962
1285
            return dbus.Boolean(self.approved_by_default)
963
1286
        self.approved_by_default = bool(value)
964
 
        # Emit D-Bus signal
965
 
        self.PropertyChanged(dbus.String("ApprovedByDefault"),
966
 
                             dbus.Boolean(value, variant_level=1))
967
1287
    
968
1288
    # ApprovalDelay - property
969
1289
    @dbus_service_property(_interface, signature="t",
972
1292
        if value is None:       # get
973
1293
            return dbus.UInt64(self.approval_delay_milliseconds())
974
1294
        self.approval_delay = datetime.timedelta(0, 0, 0, value)
975
 
        # Emit D-Bus signal
976
 
        self.PropertyChanged(dbus.String("ApprovalDelay"),
977
 
                             dbus.UInt64(value, variant_level=1))
978
1295
    
979
1296
    # ApprovalDuration - property
980
1297
    @dbus_service_property(_interface, signature="t",
981
1298
                           access="readwrite")
982
1299
    def ApprovalDuration_dbus_property(self, value=None):
983
1300
        if value is None:       # get
984
 
            return dbus.UInt64(self._timedelta_to_milliseconds(
 
1301
            return dbus.UInt64(timedelta_to_milliseconds(
985
1302
                    self.approval_duration))
986
1303
        self.approval_duration = datetime.timedelta(0, 0, 0, value)
987
 
        # Emit D-Bus signal
988
 
        self.PropertyChanged(dbus.String("ApprovalDuration"),
989
 
                             dbus.UInt64(value, variant_level=1))
990
1304
    
991
1305
    # Name - property
992
1306
    @dbus_service_property(_interface, signature="s", access="read")
1004
1318
    def Host_dbus_property(self, value=None):
1005
1319
        if value is None:       # get
1006
1320
            return dbus.String(self.host)
1007
 
        self.host = value
1008
 
        # Emit D-Bus signal
1009
 
        self.PropertyChanged(dbus.String("Host"),
1010
 
                             dbus.String(value, variant_level=1))
 
1321
        self.host = unicode(value)
1011
1322
    
1012
1323
    # Created - property
1013
1324
    @dbus_service_property(_interface, signature="s", access="read")
1014
1325
    def Created_dbus_property(self):
1015
 
        return dbus.String(self._datetime_to_dbus(self.created))
 
1326
        return datetime_to_dbus(self.created)
1016
1327
    
1017
1328
    # LastEnabled - property
1018
1329
    @dbus_service_property(_interface, signature="s", access="read")
1019
1330
    def LastEnabled_dbus_property(self):
1020
 
        if self.last_enabled is None:
1021
 
            return dbus.String("")
1022
 
        return dbus.String(self._datetime_to_dbus(self.last_enabled))
 
1331
        return datetime_to_dbus(self.last_enabled)
1023
1332
    
1024
1333
    # Enabled - property
1025
1334
    @dbus_service_property(_interface, signature="b",
1039
1348
        if value is not None:
1040
1349
            self.checked_ok()
1041
1350
            return
1042
 
        if self.last_checked_ok is None:
1043
 
            return dbus.String("")
1044
 
        return dbus.String(self._datetime_to_dbus(self
1045
 
                                                  .last_checked_ok))
 
1351
        return datetime_to_dbus(self.last_checked_ok)
 
1352
    
 
1353
    # Expires - property
 
1354
    @dbus_service_property(_interface, signature="s", access="read")
 
1355
    def Expires_dbus_property(self):
 
1356
        return datetime_to_dbus(self.expires)
1046
1357
    
1047
1358
    # LastApprovalRequest - property
1048
1359
    @dbus_service_property(_interface, signature="s", access="read")
1049
1360
    def LastApprovalRequest_dbus_property(self):
1050
 
        if self.last_approval_request is None:
1051
 
            return dbus.String("")
1052
 
        return dbus.String(self.
1053
 
                           _datetime_to_dbus(self
1054
 
                                             .last_approval_request))
 
1361
        return datetime_to_dbus(self.last_approval_request)
1055
1362
    
1056
1363
    # Timeout - property
1057
1364
    @dbus_service_property(_interface, signature="t",
1060
1367
        if value is None:       # get
1061
1368
            return dbus.UInt64(self.timeout_milliseconds())
1062
1369
        self.timeout = datetime.timedelta(0, 0, 0, value)
1063
 
        # Emit D-Bus signal
1064
 
        self.PropertyChanged(dbus.String("Timeout"),
1065
 
                             dbus.UInt64(value, variant_level=1))
1066
 
        if getattr(self, "disable_initiator_tag", None) is None:
1067
 
            return
1068
1370
        # Reschedule timeout
1069
 
        gobject.source_remove(self.disable_initiator_tag)
1070
 
        self.disable_initiator_tag = None
1071
 
        time_to_die = (self.
1072
 
                       _timedelta_to_milliseconds((self
1073
 
                                                   .last_checked_ok
1074
 
                                                   + self.timeout)
1075
 
                                                  - datetime.datetime
1076
 
                                                  .utcnow()))
1077
 
        if time_to_die <= 0:
1078
 
            # The timeout has passed
1079
 
            self.disable()
1080
 
        else:
1081
 
            self.disable_initiator_tag = (gobject.timeout_add
1082
 
                                          (time_to_die, self.disable))
 
1371
        if self.enabled:
 
1372
            now = datetime.datetime.utcnow()
 
1373
            time_to_die = timedelta_to_milliseconds(
 
1374
                (self.last_checked_ok + self.timeout) - now)
 
1375
            if time_to_die <= 0:
 
1376
                # The timeout has passed
 
1377
                self.disable()
 
1378
            else:
 
1379
                self.expires = (now +
 
1380
                                datetime.timedelta(milliseconds =
 
1381
                                                   time_to_die))
 
1382
                if (getattr(self, "disable_initiator_tag", None)
 
1383
                    is None):
 
1384
                    return
 
1385
                gobject.source_remove(self.disable_initiator_tag)
 
1386
                self.disable_initiator_tag = (gobject.timeout_add
 
1387
                                              (time_to_die,
 
1388
                                               self.disable))
 
1389
    
 
1390
    # ExtendedTimeout - property
 
1391
    @dbus_service_property(_interface, signature="t",
 
1392
                           access="readwrite")
 
1393
    def ExtendedTimeout_dbus_property(self, value=None):
 
1394
        if value is None:       # get
 
1395
            return dbus.UInt64(self.extended_timeout_milliseconds())
 
1396
        self.extended_timeout = datetime.timedelta(0, 0, 0, value)
1083
1397
    
1084
1398
    # Interval - property
1085
1399
    @dbus_service_property(_interface, signature="t",
1088
1402
        if value is None:       # get
1089
1403
            return dbus.UInt64(self.interval_milliseconds())
1090
1404
        self.interval = datetime.timedelta(0, 0, 0, value)
1091
 
        # Emit D-Bus signal
1092
 
        self.PropertyChanged(dbus.String("Interval"),
1093
 
                             dbus.UInt64(value, variant_level=1))
1094
1405
        if getattr(self, "checker_initiator_tag", None) is None:
1095
1406
            return
1096
 
        # Reschedule checker run
1097
 
        gobject.source_remove(self.checker_initiator_tag)
1098
 
        self.checker_initiator_tag = (gobject.timeout_add
1099
 
                                      (value, self.start_checker))
1100
 
        self.start_checker()    # Start one now, too
1101
 
 
 
1407
        if self.enabled:
 
1408
            # Reschedule checker run
 
1409
            gobject.source_remove(self.checker_initiator_tag)
 
1410
            self.checker_initiator_tag = (gobject.timeout_add
 
1411
                                          (value, self.start_checker))
 
1412
            self.start_checker()    # Start one now, too
 
1413
    
1102
1414
    # Checker - property
1103
1415
    @dbus_service_property(_interface, signature="s",
1104
1416
                           access="readwrite")
1105
1417
    def Checker_dbus_property(self, value=None):
1106
1418
        if value is None:       # get
1107
1419
            return dbus.String(self.checker_command)
1108
 
        self.checker_command = value
1109
 
        # Emit D-Bus signal
1110
 
        self.PropertyChanged(dbus.String("Checker"),
1111
 
                             dbus.String(self.checker_command,
1112
 
                                         variant_level=1))
 
1420
        self.checker_command = unicode(value)
1113
1421
    
1114
1422
    # CheckerRunning - property
1115
1423
    @dbus_service_property(_interface, signature="b",
1142
1450
        self._pipe.send(('init', fpr, address))
1143
1451
        if not self._pipe.recv():
1144
1452
            raise KeyError()
1145
 
 
 
1453
    
1146
1454
    def __getattribute__(self, name):
1147
 
        if(name == '_pipe'):
 
1455
        if name == '_pipe':
1148
1456
            return super(ProxyClient, self).__getattribute__(name)
1149
1457
        self._pipe.send(('getattr', name))
1150
1458
        data = self._pipe.recv()
1155
1463
                self._pipe.send(('funcall', name, args, kwargs))
1156
1464
                return self._pipe.recv()[1]
1157
1465
            return func
1158
 
 
 
1466
    
1159
1467
    def __setattr__(self, name, value):
1160
 
        if(name == '_pipe'):
 
1468
        if name == '_pipe':
1161
1469
            return super(ProxyClient, self).__setattr__(name, value)
1162
1470
        self._pipe.send(('setattr', name, value))
1163
1471
 
1164
1472
 
 
1473
class ClientDBusTransitional(ClientDBus):
 
1474
    __metaclass__ = AlternateDBusNamesMetaclass
 
1475
 
 
1476
 
1165
1477
class ClientHandler(socketserver.BaseRequestHandler, object):
1166
1478
    """A class to handle client connections.
1167
1479
    
1174
1486
                        unicode(self.client_address))
1175
1487
            logger.debug("Pipe FD: %d",
1176
1488
                         self.server.child_pipe.fileno())
1177
 
 
 
1489
            
1178
1490
            session = (gnutls.connection
1179
1491
                       .ClientSession(self.request,
1180
1492
                                      gnutls.connection
1181
1493
                                      .X509Credentials()))
1182
 
 
 
1494
            
1183
1495
            # Note: gnutls.connection.X509Credentials is really a
1184
1496
            # generic GnuTLS certificate credentials object so long as
1185
1497
            # no X.509 keys are added to it.  Therefore, we can use it
1186
1498
            # here despite using OpenPGP certificates.
1187
 
 
 
1499
            
1188
1500
            #priority = ':'.join(("NONE", "+VERS-TLS1.1",
1189
1501
            #                      "+AES-256-CBC", "+SHA1",
1190
1502
            #                      "+COMP-NULL", "+CTYPE-OPENPGP",
1196
1508
            (gnutls.library.functions
1197
1509
             .gnutls_priority_set_direct(session._c_object,
1198
1510
                                         priority, None))
1199
 
 
 
1511
            
1200
1512
            # Start communication using the Mandos protocol
1201
1513
            # Get protocol number
1202
1514
            line = self.request.makefile().readline()
1204
1516
            try:
1205
1517
                if int(line.strip().split()[0]) > 1:
1206
1518
                    raise RuntimeError
1207
 
            except (ValueError, IndexError, RuntimeError), error:
 
1519
            except (ValueError, IndexError, RuntimeError) as error:
1208
1520
                logger.error("Unknown protocol version: %s", error)
1209
1521
                return
1210
 
 
 
1522
            
1211
1523
            # Start GnuTLS connection
1212
1524
            try:
1213
1525
                session.handshake()
1214
 
            except gnutls.errors.GNUTLSError, error:
 
1526
            except gnutls.errors.GNUTLSError as error:
1215
1527
                logger.warning("Handshake failed: %s", error)
1216
1528
                # Do not run session.bye() here: the session is not
1217
1529
                # established.  Just abandon the request.
1218
1530
                return
1219
1531
            logger.debug("Handshake succeeded")
1220
 
 
 
1532
            
1221
1533
            approval_required = False
1222
1534
            try:
1223
1535
                try:
1224
1536
                    fpr = self.fingerprint(self.peer_certificate
1225
1537
                                           (session))
1226
 
                except (TypeError, gnutls.errors.GNUTLSError), error:
 
1538
                except (TypeError,
 
1539
                        gnutls.errors.GNUTLSError) as error:
1227
1540
                    logger.warning("Bad certificate: %s", error)
1228
1541
                    return
1229
1542
                logger.debug("Fingerprint: %s", fpr)
1230
 
 
 
1543
                
1231
1544
                try:
1232
1545
                    client = ProxyClient(child_pipe, fpr,
1233
1546
                                         self.client_address)
1234
1547
                except KeyError:
1235
1548
                    return
1236
1549
                
 
1550
                if self.server.use_dbus:
 
1551
                    # Emit D-Bus signal
 
1552
                    client.NewRequest(str(self.client_address))
 
1553
                
1237
1554
                if client.approval_delay:
1238
1555
                    delay = client.approval_delay
1239
1556
                    client.approvals_pending += 1
1241
1558
                
1242
1559
                while True:
1243
1560
                    if not client.enabled:
1244
 
                        logger.warning("Client %s is disabled",
 
1561
                        logger.info("Client %s is disabled",
1245
1562
                                       client.name)
1246
1563
                        if self.server.use_dbus:
1247
1564
                            # Emit D-Bus signal
1248
 
                            client.Rejected("Disabled")                    
 
1565
                            client.Rejected("Disabled")
1249
1566
                        return
1250
1567
                    
1251
 
                    if client._approved or not client.approval_delay:
 
1568
                    if client.approved or not client.approval_delay:
1252
1569
                        #We are approved or approval is disabled
1253
1570
                        break
1254
 
                    elif client._approved is None:
 
1571
                    elif client.approved is None:
1255
1572
                        logger.info("Client %s needs approval",
1256
1573
                                    client.name)
1257
1574
                        if self.server.use_dbus:
1268
1585
                        return
1269
1586
                    
1270
1587
                    #wait until timeout or approved
1271
 
                    #x = float(client._timedelta_to_milliseconds(delay))
1272
1588
                    time = datetime.datetime.now()
1273
1589
                    client.changedstate.acquire()
1274
 
                    client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))
 
1590
                    (client.changedstate.wait
 
1591
                     (float(client.timedelta_to_milliseconds(delay)
 
1592
                            / 1000)))
1275
1593
                    client.changedstate.release()
1276
1594
                    time2 = datetime.datetime.now()
1277
1595
                    if (time2 - time) >= delay:
1292
1610
                while sent_size < len(client.secret):
1293
1611
                    try:
1294
1612
                        sent = session.send(client.secret[sent_size:])
1295
 
                    except (gnutls.errors.GNUTLSError), error:
 
1613
                    except gnutls.errors.GNUTLSError as error:
1296
1614
                        logger.warning("gnutls send failed")
1297
1615
                        return
1298
1616
                    logger.debug("Sent: %d, remaining: %d",
1299
1617
                                 sent, len(client.secret)
1300
1618
                                 - (sent_size + sent))
1301
1619
                    sent_size += sent
1302
 
 
 
1620
                
1303
1621
                logger.info("Sending secret to %s", client.name)
1304
 
                # bump the timeout as if seen
1305
 
                client.checked_ok()
 
1622
                # bump the timeout using extended_timeout
 
1623
                client.checked_ok(client.extended_timeout)
1306
1624
                if self.server.use_dbus:
1307
1625
                    # Emit D-Bus signal
1308
1626
                    client.GotSecret()
1312
1630
                    client.approvals_pending -= 1
1313
1631
                try:
1314
1632
                    session.bye()
1315
 
                except (gnutls.errors.GNUTLSError), error:
 
1633
                except gnutls.errors.GNUTLSError as error:
1316
1634
                    logger.warning("GnuTLS bye failed")
1317
1635
    
1318
1636
    @staticmethod
1375
1693
        # Convert the buffer to a Python bytestring
1376
1694
        fpr = ctypes.string_at(buf, buf_len.value)
1377
1695
        # Convert the bytestring to hexadecimal notation
1378
 
        hex_fpr = ''.join("%02X" % ord(char) for char in fpr)
 
1696
        hex_fpr = binascii.hexlify(fpr).upper()
1379
1697
        return hex_fpr
1380
1698
 
1381
1699
 
1384
1702
    def sub_process_main(self, request, address):
1385
1703
        try:
1386
1704
            self.finish_request(request, address)
1387
 
        except:
 
1705
        except Exception:
1388
1706
            self.handle_error(request, address)
1389
1707
        self.close_request(request)
1390
 
            
 
1708
    
1391
1709
    def process_request(self, request, address):
1392
1710
        """Start a new process to process the request."""
1393
 
        multiprocessing.Process(target = self.sub_process_main,
1394
 
                                args = (request, address)).start()
 
1711
        proc = multiprocessing.Process(target = self.sub_process_main,
 
1712
                                       args = (request,
 
1713
                                               address))
 
1714
        proc.start()
 
1715
        return proc
 
1716
 
1395
1717
 
1396
1718
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
1397
1719
    """ adds a pipe to the MixIn """
1401
1723
        This function creates a new pipe in self.pipe
1402
1724
        """
1403
1725
        parent_pipe, self.child_pipe = multiprocessing.Pipe()
1404
 
 
1405
 
        super(MultiprocessingMixInWithPipe,
1406
 
              self).process_request(request, client_address)
 
1726
        
 
1727
        proc = MultiprocessingMixIn.process_request(self, request,
 
1728
                                                    client_address)
1407
1729
        self.child_pipe.close()
1408
 
        self.add_pipe(parent_pipe)
1409
 
 
1410
 
    def add_pipe(self, parent_pipe):
 
1730
        self.add_pipe(parent_pipe, proc)
 
1731
    
 
1732
    def add_pipe(self, parent_pipe, proc):
1411
1733
        """Dummy function; override as necessary"""
1412
1734
        raise NotImplementedError
1413
1735
 
 
1736
 
1414
1737
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
1415
1738
                     socketserver.TCPServer, object):
1416
1739
    """IPv6-capable TCP server.  Accepts 'None' as address and/or port
1442
1765
                                           SO_BINDTODEVICE,
1443
1766
                                           str(self.interface
1444
1767
                                               + '\0'))
1445
 
                except socket.error, error:
 
1768
                except socket.error as error:
1446
1769
                    if error[0] == errno.EPERM:
1447
1770
                        logger.error("No permission to"
1448
1771
                                     " bind to interface %s",
1490
1813
        self.enabled = False
1491
1814
        self.clients = clients
1492
1815
        if self.clients is None:
1493
 
            self.clients = set()
 
1816
            self.clients = {}
1494
1817
        self.use_dbus = use_dbus
1495
1818
        self.gnutls_priority = gnutls_priority
1496
1819
        IPv6_TCPServer.__init__(self, server_address,
1500
1823
    def server_activate(self):
1501
1824
        if self.enabled:
1502
1825
            return socketserver.TCPServer.server_activate(self)
 
1826
    
1503
1827
    def enable(self):
1504
1828
        self.enabled = True
1505
 
    def add_pipe(self, parent_pipe):
 
1829
    
 
1830
    def add_pipe(self, parent_pipe, proc):
1506
1831
        # Call "handle_ipc" for both data and EOF events
1507
1832
        gobject.io_add_watch(parent_pipe.fileno(),
1508
1833
                             gobject.IO_IN | gobject.IO_HUP,
1509
1834
                             functools.partial(self.handle_ipc,
1510
 
                                               parent_pipe = parent_pipe))
1511
 
        
 
1835
                                               parent_pipe =
 
1836
                                               parent_pipe,
 
1837
                                               proc = proc))
 
1838
    
1512
1839
    def handle_ipc(self, source, condition, parent_pipe=None,
1513
 
                   client_object=None):
 
1840
                   proc = None, client_object=None):
1514
1841
        condition_names = {
1515
1842
            gobject.IO_IN: "IN",   # There is data to read.
1516
1843
            gobject.IO_OUT: "OUT", # Data can be written (without
1525
1852
                                       for cond, name in
1526
1853
                                       condition_names.iteritems()
1527
1854
                                       if cond & condition)
1528
 
        # error or the other end of multiprocessing.Pipe has closed
 
1855
        # error, or the other end of multiprocessing.Pipe has closed
1529
1856
        if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):
 
1857
            # Wait for other process to exit
 
1858
            proc.join()
1530
1859
            return False
1531
1860
        
1532
1861
        # Read a request from the child
1537
1866
            fpr = request[1]
1538
1867
            address = request[2]
1539
1868
            
1540
 
            for c in self.clients:
 
1869
            for c in self.clients.itervalues():
1541
1870
                if c.fingerprint == fpr:
1542
1871
                    client = c
1543
1872
                    break
1544
1873
            else:
1545
 
                logger.warning("Client not found for fingerprint: %s, ad"
1546
 
                               "dress: %s", fpr, address)
 
1874
                logger.info("Client not found for fingerprint: %s, ad"
 
1875
                            "dress: %s", fpr, address)
1547
1876
                if self.use_dbus:
1548
1877
                    # Emit D-Bus signal
1549
 
                    mandos_dbus_service.ClientNotFound(fpr, address[0])
 
1878
                    mandos_dbus_service.ClientNotFound(fpr,
 
1879
                                                       address[0])
1550
1880
                parent_pipe.send(False)
1551
1881
                return False
1552
1882
            
1553
1883
            gobject.io_add_watch(parent_pipe.fileno(),
1554
1884
                                 gobject.IO_IN | gobject.IO_HUP,
1555
1885
                                 functools.partial(self.handle_ipc,
1556
 
                                                   parent_pipe = parent_pipe,
1557
 
                                                   client_object = client))
 
1886
                                                   parent_pipe =
 
1887
                                                   parent_pipe,
 
1888
                                                   proc = proc,
 
1889
                                                   client_object =
 
1890
                                                   client))
1558
1891
            parent_pipe.send(True)
1559
 
            # remove the old hook in favor of the new above hook on same fileno
 
1892
            # remove the old hook in favor of the new above hook on
 
1893
            # same fileno
1560
1894
            return False
1561
1895
        if command == 'funcall':
1562
1896
            funcname = request[1]
1563
1897
            args = request[2]
1564
1898
            kwargs = request[3]
1565
1899
            
1566
 
            parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))
1567
 
 
 
1900
            parent_pipe.send(('data', getattr(client_object,
 
1901
                                              funcname)(*args,
 
1902
                                                         **kwargs)))
 
1903
        
1568
1904
        if command == 'getattr':
1569
1905
            attrname = request[1]
1570
1906
            if callable(client_object.__getattribute__(attrname)):
1571
1907
                parent_pipe.send(('function',))
1572
1908
            else:
1573
 
                parent_pipe.send(('data', client_object.__getattribute__(attrname)))
 
1909
                parent_pipe.send(('data', client_object
 
1910
                                  .__getattribute__(attrname)))
1574
1911
        
1575
1912
        if command == 'setattr':
1576
1913
            attrname = request[1]
1577
1914
            value = request[2]
1578
1915
            setattr(client_object, attrname, value)
1579
 
 
 
1916
        
1580
1917
        return True
1581
1918
 
1582
1919
 
1613
1950
                delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
1614
1951
            else:
1615
1952
                raise ValueError("Unknown suffix %r" % suffix)
1616
 
        except (ValueError, IndexError), e:
 
1953
        except (ValueError, IndexError) as e:
1617
1954
            raise ValueError(*(e.args))
1618
1955
        timevalue += delta
1619
1956
    return timevalue
1620
1957
 
1621
1958
 
1622
 
def if_nametoindex(interface):
1623
 
    """Call the C function if_nametoindex(), or equivalent
1624
 
    
1625
 
    Note: This function cannot accept a unicode string."""
1626
 
    global if_nametoindex
1627
 
    try:
1628
 
        if_nametoindex = (ctypes.cdll.LoadLibrary
1629
 
                          (ctypes.util.find_library("c"))
1630
 
                          .if_nametoindex)
1631
 
    except (OSError, AttributeError):
1632
 
        logger.warning("Doing if_nametoindex the hard way")
1633
 
        def if_nametoindex(interface):
1634
 
            "Get an interface index the hard way, i.e. using fcntl()"
1635
 
            SIOCGIFINDEX = 0x8933  # From /usr/include/linux/sockios.h
1636
 
            with contextlib.closing(socket.socket()) as s:
1637
 
                ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
1638
 
                                    struct.pack(str("16s16x"),
1639
 
                                                interface))
1640
 
            interface_index = struct.unpack(str("I"),
1641
 
                                            ifreq[16:20])[0]
1642
 
            return interface_index
1643
 
    return if_nametoindex(interface)
1644
 
 
1645
 
 
1646
1959
def daemon(nochdir = False, noclose = False):
1647
1960
    """See daemon(3).  Standard BSD Unix function.
1648
1961
    
1703
2016
                        " system bus interface")
1704
2017
    parser.add_argument("--no-ipv6", action="store_false",
1705
2018
                        dest="use_ipv6", help="Do not use IPv6")
 
2019
    parser.add_argument("--no-restore", action="store_false",
 
2020
                        dest="restore", help="Do not restore stored"
 
2021
                        " state")
 
2022
    parser.add_argument("--statedir", metavar="DIR",
 
2023
                        help="Directory to save/restore state in")
 
2024
    
1706
2025
    options = parser.parse_args()
1707
2026
    
1708
2027
    if options.check:
1721
2040
                        "use_dbus": "True",
1722
2041
                        "use_ipv6": "True",
1723
2042
                        "debuglevel": "",
 
2043
                        "restore": "True",
 
2044
                        "statedir": "/var/lib/mandos"
1724
2045
                        }
1725
2046
    
1726
2047
    # Parse config file for server-global settings
1743
2064
    # options, if set.
1744
2065
    for option in ("interface", "address", "port", "debug",
1745
2066
                   "priority", "servicename", "configdir",
1746
 
                   "use_dbus", "use_ipv6", "debuglevel"):
 
2067
                   "use_dbus", "use_ipv6", "debuglevel", "restore",
 
2068
                   "statedir"):
1747
2069
        value = getattr(options, option)
1748
2070
        if value is not None:
1749
2071
            server_settings[option] = value
1761
2083
    debuglevel = server_settings["debuglevel"]
1762
2084
    use_dbus = server_settings["use_dbus"]
1763
2085
    use_ipv6 = server_settings["use_ipv6"]
1764
 
 
 
2086
    stored_state_path = os.path.join(server_settings["statedir"],
 
2087
                                     stored_state_file)
 
2088
    
 
2089
    if debug:
 
2090
        initlogger(debug, logging.DEBUG)
 
2091
    else:
 
2092
        if not debuglevel:
 
2093
            initlogger(debug)
 
2094
        else:
 
2095
            level = getattr(logging, debuglevel.upper())
 
2096
            initlogger(debug, level)
 
2097
    
1765
2098
    if server_settings["servicename"] != "Mandos":
1766
2099
        syslogger.setFormatter(logging.Formatter
1767
2100
                               ('Mandos (%s) [%%(process)d]:'
1769
2102
                                % server_settings["servicename"]))
1770
2103
    
1771
2104
    # Parse config file with clients
1772
 
    client_defaults = { "timeout": "1h",
1773
 
                        "interval": "5m",
1774
 
                        "checker": "fping -q -- %%(host)s",
1775
 
                        "host": "",
1776
 
                        "approval_delay": "0s",
1777
 
                        "approval_duration": "1s",
1778
 
                        }
1779
 
    client_config = configparser.SafeConfigParser(client_defaults)
 
2105
    client_config = configparser.SafeConfigParser(Client
 
2106
                                                  .client_defaults)
1780
2107
    client_config.read(os.path.join(server_settings["configdir"],
1781
2108
                                    "clients.conf"))
1782
2109
    
1816
2143
    try:
1817
2144
        os.setgid(gid)
1818
2145
        os.setuid(uid)
1819
 
    except OSError, error:
 
2146
    except OSError as error:
1820
2147
        if error[0] != errno.EPERM:
1821
2148
            raise error
1822
2149
    
1823
 
    if not debug and not debuglevel:
1824
 
        syslogger.setLevel(logging.WARNING)
1825
 
        console.setLevel(logging.WARNING)
1826
 
    if debuglevel:
1827
 
        level = getattr(logging, debuglevel.upper())
1828
 
        syslogger.setLevel(level)
1829
 
        console.setLevel(level)
1830
 
 
1831
2150
    if debug:
1832
2151
        # Enable all possible GnuTLS debugging
1833
2152
        
1847
2166
        os.dup2(null, sys.stdin.fileno())
1848
2167
        if null > 2:
1849
2168
            os.close(null)
1850
 
    else:
1851
 
        # No console logging
1852
 
        logger.removeHandler(console)
1853
2169
    
1854
2170
    # Need to fork before connecting to D-Bus
1855
2171
    if not debug:
1856
2172
        # Close all input and output, do double fork, etc.
1857
2173
        daemon()
1858
2174
    
 
2175
    gobject.threads_init()
 
2176
    
1859
2177
    global main_loop
1860
2178
    # From the Avahi example code
1861
2179
    DBusGMainLoop(set_as_default=True )
1864
2182
    # End of Avahi example code
1865
2183
    if use_dbus:
1866
2184
        try:
1867
 
            bus_name = dbus.service.BusName("se.bsnet.fukt.Mandos",
 
2185
            bus_name = dbus.service.BusName("se.recompile.Mandos",
1868
2186
                                            bus, do_not_queue=True)
1869
 
        except dbus.exceptions.NameExistsException, e:
 
2187
            old_bus_name = (dbus.service.BusName
 
2188
                            ("se.bsnet.fukt.Mandos", bus,
 
2189
                             do_not_queue=True))
 
2190
        except dbus.exceptions.NameExistsException as e:
1870
2191
            logger.error(unicode(e) + ", disabling D-Bus")
1871
2192
            use_dbus = False
1872
2193
            server_settings["use_dbus"] = False
1873
2194
            tcp_server.use_dbus = False
1874
2195
    protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
1875
 
    service = AvahiService(name = server_settings["servicename"],
1876
 
                           servicetype = "_mandos._tcp",
1877
 
                           protocol = protocol, bus = bus)
 
2196
    service = AvahiServiceToSyslog(name =
 
2197
                                   server_settings["servicename"],
 
2198
                                   servicetype = "_mandos._tcp",
 
2199
                                   protocol = protocol, bus = bus)
1878
2200
    if server_settings["interface"]:
1879
2201
        service.interface = (if_nametoindex
1880
2202
                             (str(server_settings["interface"])))
1884
2206
    
1885
2207
    client_class = Client
1886
2208
    if use_dbus:
1887
 
        client_class = functools.partial(ClientDBus, bus = bus)
1888
 
    def client_config_items(config, section):
1889
 
        special_settings = {
1890
 
            "approved_by_default":
1891
 
                lambda: config.getboolean(section,
1892
 
                                          "approved_by_default"),
1893
 
            }
1894
 
        for name, value in config.items(section):
 
2209
        client_class = functools.partial(ClientDBusTransitional,
 
2210
                                         bus = bus)
 
2211
    
 
2212
    client_settings = Client.config_parser(client_config)
 
2213
    old_client_settings = {}
 
2214
    clients_data = {}
 
2215
    
 
2216
    # Get client data and settings from last running state.
 
2217
    if server_settings["restore"]:
 
2218
        try:
 
2219
            with open(stored_state_path, "rb") as stored_state:
 
2220
                clients_data, old_client_settings = (pickle.load
 
2221
                                                     (stored_state))
 
2222
            os.remove(stored_state_path)
 
2223
        except IOError as e:
 
2224
            logger.warning("Could not load persistent state: {0}"
 
2225
                           .format(e))
 
2226
            if e.errno != errno.ENOENT:
 
2227
                raise
 
2228
        except EOFError as e:
 
2229
            logger.warning("Could not load persistent state: "
 
2230
                           "EOFError: {0}".format(e))
 
2231
    
 
2232
    with PGPEngine() as pgp:
 
2233
        for client_name, client in clients_data.iteritems():
 
2234
            # Decide which value to use after restoring saved state.
 
2235
            # We have three different values: Old config file,
 
2236
            # new config file, and saved state.
 
2237
            # New config value takes precedence if it differs from old
 
2238
            # config value, otherwise use saved state.
 
2239
            for name, value in client_settings[client_name].items():
 
2240
                try:
 
2241
                    # For each value in new config, check if it
 
2242
                    # differs from the old config value (Except for
 
2243
                    # the "secret" attribute)
 
2244
                    if (name != "secret" and
 
2245
                        value != old_client_settings[client_name]
 
2246
                        [name]):
 
2247
                        client[name] = value
 
2248
                except KeyError:
 
2249
                    pass
 
2250
            
 
2251
            # Clients who has passed its expire date can still be
 
2252
            # enabled if its last checker was successful.  Clients
 
2253
            # whose checker failed before we stored its state is
 
2254
            # assumed to have failed all checkers during downtime.
 
2255
            if client["enabled"]:
 
2256
                if datetime.datetime.utcnow() >= client["expires"]:
 
2257
                    if not client["last_checked_ok"]:
 
2258
                        logger.warning(
 
2259
                            "disabling client {0} - Client never "
 
2260
                            "performed a successfull checker"
 
2261
                            .format(client["name"]))
 
2262
                        client["enabled"] = False
 
2263
                    elif client["last_checker_status"] != 0:
 
2264
                        logger.warning(
 
2265
                            "disabling client {0} - Client "
 
2266
                            "last checker failed with error code {1}"
 
2267
                            .format(client["name"],
 
2268
                                    client["last_checker_status"]))
 
2269
                        client["enabled"] = False
 
2270
                    else:
 
2271
                        client["expires"] = (datetime.datetime
 
2272
                                             .utcnow()
 
2273
                                             + client["timeout"])
 
2274
                        logger.debug("Last checker succeeded,"
 
2275
                                     " keeping {0} enabled"
 
2276
                                     .format(client["name"]))
1895
2277
            try:
1896
 
                yield (name, special_settings[name]())
1897
 
            except KeyError:
1898
 
                yield (name, value)
1899
 
    
1900
 
    tcp_server.clients.update(set(
1901
 
            client_class(name = section,
1902
 
                         config= dict(client_config_items(
1903
 
                        client_config, section)))
1904
 
            for section in client_config.sections()))
 
2278
                client["secret"] = (
 
2279
                    pgp.decrypt(client["encrypted_secret"],
 
2280
                                client_settings[client_name]
 
2281
                                ["secret"]))
 
2282
            except PGPError:
 
2283
                # If decryption fails, we use secret from new settings
 
2284
                logger.debug("Failed to decrypt {0} old secret"
 
2285
                             .format(client_name))
 
2286
                client["secret"] = (
 
2287
                    client_settings[client_name]["secret"])
 
2288
 
 
2289
    
 
2290
    # Add/remove clients based on new changes made to config
 
2291
    for client_name in (set(old_client_settings)
 
2292
                        - set(client_settings)):
 
2293
        del clients_data[client_name]
 
2294
    for client_name in (set(client_settings)
 
2295
                        - set(old_client_settings)):
 
2296
        clients_data[client_name] = client_settings[client_name]
 
2297
 
 
2298
    # Create clients all clients
 
2299
    for client_name, client in clients_data.iteritems():
 
2300
        tcp_server.clients[client_name] = client_class(
 
2301
            name = client_name, settings = client)
 
2302
    
1905
2303
    if not tcp_server.clients:
1906
2304
        logger.warning("No clients defined")
1907
2305
        
1918
2316
            # "pidfile" was never created
1919
2317
            pass
1920
2318
        del pidfilename
1921
 
        
1922
2319
        signal.signal(signal.SIGINT, signal.SIG_IGN)
1923
 
 
 
2320
    
1924
2321
    signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
1925
2322
    signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
1926
2323
    
1929
2326
            """A D-Bus proxy object"""
1930
2327
            def __init__(self):
1931
2328
                dbus.service.Object.__init__(self, bus, "/")
1932
 
            _interface = "se.bsnet.fukt.Mandos"
 
2329
            _interface = "se.recompile.Mandos"
1933
2330
            
1934
2331
            @dbus.service.signal(_interface, signature="o")
1935
2332
            def ClientAdded(self, objpath):
1950
2347
            def GetAllClients(self):
1951
2348
                "D-Bus method"
1952
2349
                return dbus.Array(c.dbus_object_path
1953
 
                                  for c in tcp_server.clients)
 
2350
                                  for c in
 
2351
                                  tcp_server.clients.itervalues())
1954
2352
            
1955
2353
            @dbus.service.method(_interface,
1956
2354
                                 out_signature="a{oa{sv}}")
1958
2356
                "D-Bus method"
1959
2357
                return dbus.Dictionary(
1960
2358
                    ((c.dbus_object_path, c.GetAll(""))
1961
 
                     for c in tcp_server.clients),
 
2359
                     for c in tcp_server.clients.itervalues()),
1962
2360
                    signature="oa{sv}")
1963
2361
            
1964
2362
            @dbus.service.method(_interface, in_signature="o")
1965
2363
            def RemoveClient(self, object_path):
1966
2364
                "D-Bus method"
1967
 
                for c in tcp_server.clients:
 
2365
                for c in tcp_server.clients.itervalues():
1968
2366
                    if c.dbus_object_path == object_path:
1969
 
                        tcp_server.clients.remove(c)
 
2367
                        del tcp_server.clients[c.name]
1970
2368
                        c.remove_from_connection()
1971
2369
                        # Don't signal anything except ClientRemoved
1972
2370
                        c.disable(quiet=True)
1977
2375
            
1978
2376
            del _interface
1979
2377
        
1980
 
        mandos_dbus_service = MandosDBusService()
 
2378
        class MandosDBusServiceTransitional(MandosDBusService):
 
2379
            __metaclass__ = AlternateDBusNamesMetaclass
 
2380
        mandos_dbus_service = MandosDBusServiceTransitional()
1981
2381
    
1982
2382
    def cleanup():
1983
2383
        "Cleanup function; run on exit"
1984
2384
        service.cleanup()
1985
2385
        
 
2386
        multiprocessing.active_children()
 
2387
        if not (tcp_server.clients or client_settings):
 
2388
            return
 
2389
        
 
2390
        # Store client before exiting. Secrets are encrypted with key
 
2391
        # based on what config file has. If config file is
 
2392
        # removed/edited, old secret will thus be unrecovable.
 
2393
        clients = {}
 
2394
        with PGPEngine() as pgp:
 
2395
            for client in tcp_server.clients.itervalues():
 
2396
                key = client_settings[client.name]["secret"]
 
2397
                client.encrypted_secret = pgp.encrypt(client.secret,
 
2398
                                                      key)
 
2399
                client_dict = {}
 
2400
                
 
2401
                # A list of attributes that can not be pickled
 
2402
                # + secret.
 
2403
                exclude = set(("bus", "changedstate", "secret",
 
2404
                               "checker"))
 
2405
                for name, typ in (inspect.getmembers
 
2406
                                  (dbus.service.Object)):
 
2407
                    exclude.add(name)
 
2408
                
 
2409
                client_dict["encrypted_secret"] = (client
 
2410
                                                   .encrypted_secret)
 
2411
                for attr in client.client_structure:
 
2412
                    if attr not in exclude:
 
2413
                        client_dict[attr] = getattr(client, attr)
 
2414
                
 
2415
                clients[client.name] = client_dict
 
2416
                del client_settings[client.name]["secret"]
 
2417
        
 
2418
        try:
 
2419
            tempfd, tempname = tempfile.mkstemp(suffix=".pickle",
 
2420
                                                prefix="clients-",
 
2421
                                                dir=os.path.dirname
 
2422
                                                (stored_state_path))
 
2423
            with os.fdopen(tempfd, "wb") as stored_state:
 
2424
                pickle.dump((clients, client_settings), stored_state)
 
2425
            os.rename(tempname, stored_state_path)
 
2426
        except (IOError, OSError) as e:
 
2427
            logger.warning("Could not save persistent state: {0}"
 
2428
                           .format(e))
 
2429
            if not debug:
 
2430
                try:
 
2431
                    os.remove(tempname)
 
2432
                except NameError:
 
2433
                    pass
 
2434
            if e.errno not in set((errno.ENOENT, errno.EACCES,
 
2435
                                   errno.EEXIST)):
 
2436
                raise e
 
2437
        
 
2438
        # Delete all clients, and settings from config
1986
2439
        while tcp_server.clients:
1987
 
            client = tcp_server.clients.pop()
 
2440
            name, client = tcp_server.clients.popitem()
1988
2441
            if use_dbus:
1989
2442
                client.remove_from_connection()
1990
 
            client.disable_hook = None
1991
2443
            # Don't signal anything except ClientRemoved
1992
2444
            client.disable(quiet=True)
1993
2445
            if use_dbus:
1994
2446
                # Emit D-Bus signal
1995
 
                mandos_dbus_service.ClientRemoved(client.dbus_object_path,
 
2447
                mandos_dbus_service.ClientRemoved(client
 
2448
                                                  .dbus_object_path,
1996
2449
                                                  client.name)
 
2450
        client_settings.clear()
1997
2451
    
1998
2452
    atexit.register(cleanup)
1999
2453
    
2000
 
    for client in tcp_server.clients:
 
2454
    for client in tcp_server.clients.itervalues():
2001
2455
        if use_dbus:
2002
2456
            # Emit D-Bus signal
2003
2457
            mandos_dbus_service.ClientAdded(client.dbus_object_path)
2004
 
        client.enable()
 
2458
        # Need to initiate checking of clients
 
2459
        if client.enabled:
 
2460
            client.init_checker()
2005
2461
    
2006
2462
    tcp_server.enable()
2007
2463
    tcp_server.server_activate()
2022
2478
        # From the Avahi example code
2023
2479
        try:
2024
2480
            service.activate()
2025
 
        except dbus.exceptions.DBusException, error:
 
2481
        except dbus.exceptions.DBusException as error:
2026
2482
            logger.critical("DBusException: %s", error)
2027
2483
            cleanup()
2028
2484
            sys.exit(1)
2035
2491
        
2036
2492
        logger.debug("Starting main loop")
2037
2493
        main_loop.run()
2038
 
    except AvahiError, error:
 
2494
    except AvahiError as error:
2039
2495
        logger.critical("AvahiError: %s", error)
2040
2496
        cleanup()
2041
2497
        sys.exit(1)