/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos

  • Committer: teddy at recompile
  • Date: 2012-01-01 17:38:33 UTC
  • Revision ID: teddy@recompile.se-20120101173833-ai39bif1w0ftuyyh
* Makefile (install-server): Add intro(8mandos) man page.
* network-hooks.d/bridge: Add copyright info and year.
* network-hooks.d/openvpn: - '' -
* network-hooks.d/wireless: - '' -

Show diffs side-by-side

added added

removed removed

Lines of Context:
mandos
65
65
import types
66
66
import binascii
67
67
import tempfile
68
 
import itertools
69
68
 
70
69
import dbus
71
70
import dbus.service
86
85
    except ImportError:
87
86
        SO_BINDTODEVICE = None
88
87
 
89
 
version = "1.5.3"
 
88
version = "1.5.0"
90
89
stored_state_file = "clients.pickle"
91
90
 
92
91
logger = logging.getLogger()
176
175
    
177
176
    def encrypt(self, data, password):
178
177
        self.gnupg.passphrase = self.password_encode(password)
179
 
        with open(os.devnull, "w") as devnull:
 
178
        with open(os.devnull) as devnull:
180
179
            try:
181
180
                proc = self.gnupg.run(['--symmetric'],
182
181
                                      create_fhs=['stdin', 'stdout'],
193
192
    
194
193
    def decrypt(self, data, password):
195
194
        self.gnupg.passphrase = self.password_encode(password)
196
 
        with open(os.devnull, "w") as devnull:
 
195
        with open(os.devnull) as devnull:
197
196
            try:
198
197
                proc = self.gnupg.run(['--decrypt'],
199
198
                                      create_fhs=['stdin', 'stdout'],
200
199
                                      attach_fhs={'stderr': devnull})
201
 
                with contextlib.closing(proc.handles['stdin']) as f:
 
200
                with contextlib.closing(proc.handles['stdin'] ) as f:
202
201
                    f.write(data)
203
202
                with contextlib.closing(proc.handles['stdout']) as f:
204
203
                    decrypted_plaintext = f.read()
209
208
        return decrypted_plaintext
210
209
 
211
210
 
 
211
 
212
212
class AvahiError(Exception):
213
213
    def __init__(self, value, *args, **kwargs):
214
214
        self.value = value
243
243
    server: D-Bus Server
244
244
    bus: dbus.SystemBus()
245
245
    """
246
 
    
247
246
    def __init__(self, interface = avahi.IF_UNSPEC, name = None,
248
247
                 servicetype = None, port = None, TXT = None,
249
248
                 domain = "", host = "", max_renames = 32768,
262
261
        self.server = None
263
262
        self.bus = bus
264
263
        self.entry_group_state_changed_match = None
265
 
    
266
264
    def rename(self):
267
265
        """Derived from the Avahi example code"""
268
266
        if self.rename_count >= self.max_renames:
278
276
        try:
279
277
            self.add()
280
278
        except dbus.exceptions.DBusException as error:
281
 
            logger.critical("D-Bus Exception", exc_info=error)
 
279
            logger.critical("DBusException: %s", error)
282
280
            self.cleanup()
283
281
            os._exit(1)
284
282
        self.rename_count += 1
285
 
    
286
283
    def remove(self):
287
284
        """Derived from the Avahi example code"""
288
285
        if self.entry_group_state_changed_match is not None:
290
287
            self.entry_group_state_changed_match = None
291
288
        if self.group is not None:
292
289
            self.group.Reset()
293
 
    
294
290
    def add(self):
295
291
        """Derived from the Avahi example code"""
296
292
        self.remove()
313
309
            dbus.UInt16(self.port),
314
310
            avahi.string_array_to_txt_array(self.TXT))
315
311
        self.group.Commit()
316
 
    
317
312
    def entry_group_state_changed(self, state, error):
318
313
        """Derived from the Avahi example code"""
319
314
        logger.debug("Avahi entry group state change: %i", state)
326
321
        elif state == avahi.ENTRY_GROUP_FAILURE:
327
322
            logger.critical("Avahi: Error in group state changed %s",
328
323
                            unicode(error))
329
 
            raise AvahiGroupError("State changed: {0!s}"
330
 
                                  .format(error))
331
 
    
 
324
            raise AvahiGroupError("State changed: %s"
 
325
                                  % unicode(error))
332
326
    def cleanup(self):
333
327
        """Derived from the Avahi example code"""
334
328
        if self.group is not None:
339
333
                pass
340
334
            self.group = None
341
335
        self.remove()
342
 
    
343
336
    def server_state_changed(self, state, error=None):
344
337
        """Derived from the Avahi example code"""
345
338
        logger.debug("Avahi server state change: %i", state)
364
357
                logger.debug("Unknown state: %r", state)
365
358
            else:
366
359
                logger.debug("Unknown state: %r: %r", state, error)
367
 
    
368
360
    def activate(self):
369
361
        """Derived from the Avahi example code"""
370
362
        if self.server is None:
382
374
        """Add the new name to the syslog messages"""
383
375
        ret = AvahiService.rename(self)
384
376
        syslogger.setFormatter(logging.Formatter
385
 
                               ('Mandos ({0}) [%(process)d]:'
386
 
                                ' %(levelname)s: %(message)s'
387
 
                                .format(self.name)))
 
377
                               ('Mandos (%s) [%%(process)d]:'
 
378
                                ' %%(levelname)s: %%(message)s'
 
379
                                % self.name))
388
380
        return ret
389
381
 
390
382
def timedelta_to_milliseconds(td):
392
384
    return ((td.days * 24 * 60 * 60 * 1000)
393
385
            + (td.seconds * 1000)
394
386
            + (td.microseconds // 1000))
395
 
 
 
387
        
396
388
class Client(object):
397
389
    """A representation of a client host served by this server.
398
390
    
423
415
    last_checked_ok: datetime.datetime(); (UTC) or None
424
416
    last_checker_status: integer between 0 and 255 reflecting exit
425
417
                         status of last checker. -1 reflects crashed
426
 
                         checker, -2 means no checker completed yet.
 
418
                         checker, or None.
427
419
    last_enabled: datetime.datetime(); (UTC) or None
428
420
    name:       string; from the config file, used in log messages and
429
421
                        D-Bus identifiers
430
422
    secret:     bytestring; sent verbatim (over TLS) to client
431
423
    timeout:    datetime.timedelta(); How long from last_checked_ok
432
424
                                      until this client is disabled
433
 
    extended_timeout:   extra long timeout when secret has been sent
 
425
    extended_timeout:   extra long timeout when password has been sent
434
426
    runtime_expansions: Allowed attributes for runtime expansion.
435
427
    expires:    datetime.datetime(); time (UTC) when a client will be
436
428
                disabled, or None
465
457
    
466
458
    def approval_delay_milliseconds(self):
467
459
        return timedelta_to_milliseconds(self.approval_delay)
468
 
    
 
460
 
469
461
    @staticmethod
470
462
    def config_parser(config):
471
463
        """Construct a new dict of client settings of this form:
496
488
                          "rb") as secfile:
497
489
                    client["secret"] = secfile.read()
498
490
            else:
499
 
                raise TypeError("No secret or secfile for section {0}"
500
 
                                .format(section))
 
491
                raise TypeError("No secret or secfile for section %s"
 
492
                                % section)
501
493
            client["timeout"] = string_to_delta(section["timeout"])
502
494
            client["extended_timeout"] = string_to_delta(
503
495
                section["extended_timeout"])
509
501
            client["checker_command"] = section["checker"]
510
502
            client["last_approval_request"] = None
511
503
            client["last_checked_ok"] = None
512
 
            client["last_checker_status"] = -2
 
504
            client["last_checker_status"] = None
513
505
        
514
506
        return settings
515
 
    
 
507
        
 
508
        
516
509
    def __init__(self, settings, name = None):
 
510
        """Note: the 'checker' key in 'config' sets the
 
511
        'checker_command' attribute and *not* the 'checker'
 
512
        attribute."""
517
513
        self.name = name
518
514
        # adding all client settings
519
515
        for setting, value in settings.iteritems():
528
524
        else:
529
525
            self.last_enabled = None
530
526
            self.expires = None
531
 
        
 
527
       
532
528
        logger.debug("Creating client %r", self.name)
533
529
        # Uppercase and remove spaces from fingerprint for later
534
530
        # comparison purposes with return value from the fingerprint()
536
532
        logger.debug("  Fingerprint: %s", self.fingerprint)
537
533
        self.created = settings.get("created",
538
534
                                    datetime.datetime.utcnow())
539
 
        
 
535
 
540
536
        # attributes specific for this server instance
541
537
        self.checker = None
542
538
        self.checker_initiator_tag = None
630
626
            logger.warning("Checker for %(name)s crashed?",
631
627
                           vars(self))
632
628
    
633
 
    def checked_ok(self):
634
 
        """Assert that the client has been seen, alive and well."""
635
 
        self.last_checked_ok = datetime.datetime.utcnow()
636
 
        self.last_checker_status = 0
637
 
        self.bump_timeout()
638
 
    
639
 
    def bump_timeout(self, timeout=None):
640
 
        """Bump up the timeout for this client."""
 
629
    def checked_ok(self, timeout=None):
 
630
        """Bump up the timeout for this client.
 
631
        
 
632
        This should only be called when the client has been seen,
 
633
        alive and well.
 
634
        """
641
635
        if timeout is None:
642
636
            timeout = self.timeout
 
637
        self.last_checked_ok = datetime.datetime.utcnow()
643
638
        if self.disable_initiator_tag is not None:
644
639
            gobject.source_remove(self.disable_initiator_tag)
645
640
        if getattr(self, "enabled", False):
696
691
                try:
697
692
                    command = self.checker_command % escaped_attrs
698
693
                except TypeError as error:
699
 
                    logger.error('Could not format string "%s"',
700
 
                                 self.checker_command, exc_info=error)
 
694
                    logger.error('Could not format string "%s":'
 
695
                                 ' %s', self.checker_command, error)
701
696
                    return True # Try again later
702
697
            self.current_checker_command = command
703
698
            try:
721
716
                    gobject.source_remove(self.checker_callback_tag)
722
717
                    self.checker_callback(pid, status, command)
723
718
            except OSError as error:
724
 
                logger.error("Failed to start subprocess",
725
 
                             exc_info=error)
 
719
                logger.error("Failed to start subprocess: %s",
 
720
                             error)
726
721
        # Re-run this periodically if run by gobject.timeout_add
727
722
        return True
728
723
    
735
730
            return
736
731
        logger.debug("Stopping checker for %(name)s", vars(self))
737
732
        try:
738
 
            self.checker.terminate()
 
733
            os.kill(self.checker.pid, signal.SIGTERM)
739
734
            #time.sleep(0.5)
740
735
            #if self.checker.poll() is None:
741
 
            #    self.checker.kill()
 
736
            #    os.kill(self.checker.pid, signal.SIGKILL)
742
737
        except OSError as error:
743
738
            if error.errno != errno.ESRCH: # No such process
744
739
                raise
761
756
    # "Set" method, so we fail early here:
762
757
    if byte_arrays and signature != "ay":
763
758
        raise ValueError("Byte arrays not supported for non-'ay'"
764
 
                         " signature {0!r}".format(signature))
 
759
                         " signature %r" % signature)
765
760
    def decorator(func):
766
761
        func._dbus_is_property = True
767
762
        func._dbus_interface = dbus_interface
775
770
    return decorator
776
771
 
777
772
 
778
 
def dbus_interface_annotations(dbus_interface):
779
 
    """Decorator for marking functions returning interface annotations
780
 
    
781
 
    Usage:
782
 
    
783
 
    @dbus_interface_annotations("org.example.Interface")
784
 
    def _foo(self):  # Function name does not matter
785
 
        return {"org.freedesktop.DBus.Deprecated": "true",
786
 
                "org.freedesktop.DBus.Property.EmitsChangedSignal":
787
 
                    "false"}
788
 
    """
789
 
    def decorator(func):
790
 
        func._dbus_is_interface = True
791
 
        func._dbus_interface = dbus_interface
792
 
        func._dbus_name = dbus_interface
793
 
        return func
794
 
    return decorator
795
 
 
796
 
 
797
 
def dbus_annotations(annotations):
798
 
    """Decorator to annotate D-Bus methods, signals or properties
799
 
    Usage:
800
 
    
801
 
    @dbus_service_property("org.example.Interface", signature="b",
802
 
                           access="r")
803
 
    @dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",
804
 
                        "org.freedesktop.DBus.Property."
805
 
                        "EmitsChangedSignal": "false"})
806
 
    def Property_dbus_property(self):
807
 
        return dbus.Boolean(False)
808
 
    """
809
 
    def decorator(func):
810
 
        func._dbus_annotations = annotations
811
 
        return func
812
 
    return decorator
813
 
 
814
 
 
815
773
class DBusPropertyException(dbus.exceptions.DBusException):
816
774
    """A base class for D-Bus property-related exceptions
817
775
    """
840
798
    """
841
799
    
842
800
    @staticmethod
843
 
    def _is_dbus_thing(thing):
844
 
        """Returns a function testing if an attribute is a D-Bus thing
845
 
        
846
 
        If called like _is_dbus_thing("method") it returns a function
847
 
        suitable for use as predicate to inspect.getmembers().
848
 
        """
849
 
        return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),
850
 
                                   False)
 
801
    def _is_dbus_property(obj):
 
802
        return getattr(obj, "_dbus_is_property", False)
851
803
    
852
 
    def _get_all_dbus_things(self, thing):
 
804
    def _get_all_dbus_properties(self):
853
805
        """Returns a generator of (name, attribute) pairs
854
806
        """
855
 
        return ((getattr(athing.__get__(self), "_dbus_name",
856
 
                         name),
857
 
                 athing.__get__(self))
 
807
        return ((prop.__get__(self)._dbus_name, prop.__get__(self))
858
808
                for cls in self.__class__.__mro__
859
 
                for name, athing in
860
 
                inspect.getmembers(cls,
861
 
                                   self._is_dbus_thing(thing)))
 
809
                for name, prop in
 
810
                inspect.getmembers(cls, self._is_dbus_property))
862
811
    
863
812
    def _get_dbus_property(self, interface_name, property_name):
864
813
        """Returns a bound method if one exists which is a D-Bus
866
815
        """
867
816
        for cls in  self.__class__.__mro__:
868
817
            for name, value in (inspect.getmembers
869
 
                                (cls,
870
 
                                 self._is_dbus_thing("property"))):
 
818
                                (cls, self._is_dbus_property)):
871
819
                if (value._dbus_name == property_name
872
820
                    and value._dbus_interface == interface_name):
873
821
                    return value.__get__(self)
915
863
        Note: Will not include properties with access="write".
916
864
        """
917
865
        properties = {}
918
 
        for name, prop in self._get_all_dbus_things("property"):
 
866
        for name, prop in self._get_all_dbus_properties():
919
867
            if (interface_name
920
868
                and interface_name != prop._dbus_interface):
921
869
                # Interface non-empty but did not match
936
884
                         path_keyword='object_path',
937
885
                         connection_keyword='connection')
938
886
    def Introspect(self, object_path, connection):
939
 
        """Overloading of standard D-Bus method.
940
 
        
941
 
        Inserts property tags and interface annotation tags.
 
887
        """Standard D-Bus method, overloaded to insert property tags.
942
888
        """
943
889
        xmlstring = dbus.service.Object.Introspect(self, object_path,
944
890
                                                   connection)
951
897
                e.setAttribute("access", prop._dbus_access)
952
898
                return e
953
899
            for if_tag in document.getElementsByTagName("interface"):
954
 
                # Add property tags
955
900
                for tag in (make_tag(document, name, prop)
956
901
                            for name, prop
957
 
                            in self._get_all_dbus_things("property")
 
902
                            in self._get_all_dbus_properties()
958
903
                            if prop._dbus_interface
959
904
                            == if_tag.getAttribute("name")):
960
905
                    if_tag.appendChild(tag)
961
 
                # Add annotation tags
962
 
                for typ in ("method", "signal", "property"):
963
 
                    for tag in if_tag.getElementsByTagName(typ):
964
 
                        annots = dict()
965
 
                        for name, prop in (self.
966
 
                                           _get_all_dbus_things(typ)):
967
 
                            if (name == tag.getAttribute("name")
968
 
                                and prop._dbus_interface
969
 
                                == if_tag.getAttribute("name")):
970
 
                                annots.update(getattr
971
 
                                              (prop,
972
 
                                               "_dbus_annotations",
973
 
                                               {}))
974
 
                        for name, value in annots.iteritems():
975
 
                            ann_tag = document.createElement(
976
 
                                "annotation")
977
 
                            ann_tag.setAttribute("name", name)
978
 
                            ann_tag.setAttribute("value", value)
979
 
                            tag.appendChild(ann_tag)
980
 
                # Add interface annotation tags
981
 
                for annotation, value in dict(
982
 
                    itertools.chain(
983
 
                        *(annotations().iteritems()
984
 
                          for name, annotations in
985
 
                          self._get_all_dbus_things("interface")
986
 
                          if name == if_tag.getAttribute("name")
987
 
                          ))).iteritems():
988
 
                    ann_tag = document.createElement("annotation")
989
 
                    ann_tag.setAttribute("name", annotation)
990
 
                    ann_tag.setAttribute("value", value)
991
 
                    if_tag.appendChild(ann_tag)
992
906
                # Add the names to the return values for the
993
907
                # "org.freedesktop.DBus.Properties" methods
994
908
                if (if_tag.getAttribute("name")
1009
923
        except (AttributeError, xml.dom.DOMException,
1010
924
                xml.parsers.expat.ExpatError) as error:
1011
925
            logger.error("Failed to override Introspection method",
1012
 
                         exc_info=error)
 
926
                         error)
1013
927
        return xmlstring
1014
928
 
1015
929
 
1029
943
    def __new__(mcs, name, bases, attr):
1030
944
        # Go through all the base classes which could have D-Bus
1031
945
        # methods, signals, or properties in them
1032
 
        old_interface_names = []
1033
946
        for base in (b for b in bases
1034
947
                     if issubclass(b, dbus.service.Object)):
1035
948
            # Go though all attributes of the base class
1045
958
                alt_interface = (attribute._dbus_interface
1046
959
                                 .replace("se.recompile.Mandos",
1047
960
                                          "se.bsnet.fukt.Mandos"))
1048
 
                if alt_interface != attribute._dbus_interface:
1049
 
                    old_interface_names.append(alt_interface)
1050
961
                # Is this a D-Bus signal?
1051
962
                if getattr(attribute, "_dbus_is_signal", False):
1052
963
                    # Extract the original non-method function by
1067
978
                                nonmethod_func.func_name,
1068
979
                                nonmethod_func.func_defaults,
1069
980
                                nonmethod_func.func_closure)))
1070
 
                    # Copy annotations, if any
1071
 
                    try:
1072
 
                        new_function._dbus_annotations = (
1073
 
                            dict(attribute._dbus_annotations))
1074
 
                    except AttributeError:
1075
 
                        pass
1076
981
                    # Define a creator of a function to call both the
1077
982
                    # old and new functions, so both the old and new
1078
983
                    # signals gets sent when the function is called
1106
1011
                                        attribute.func_name,
1107
1012
                                        attribute.func_defaults,
1108
1013
                                        attribute.func_closure)))
1109
 
                    # Copy annotations, if any
1110
 
                    try:
1111
 
                        attr[attrname]._dbus_annotations = (
1112
 
                            dict(attribute._dbus_annotations))
1113
 
                    except AttributeError:
1114
 
                        pass
1115
1014
                # Is this a D-Bus property?
1116
1015
                elif getattr(attribute, "_dbus_is_property", False):
1117
1016
                    # Create a new, but exactly alike, function
1131
1030
                                        attribute.func_name,
1132
1031
                                        attribute.func_defaults,
1133
1032
                                        attribute.func_closure)))
1134
 
                    # Copy annotations, if any
1135
 
                    try:
1136
 
                        attr[attrname]._dbus_annotations = (
1137
 
                            dict(attribute._dbus_annotations))
1138
 
                    except AttributeError:
1139
 
                        pass
1140
 
                # Is this a D-Bus interface?
1141
 
                elif getattr(attribute, "_dbus_is_interface", False):
1142
 
                    # Create a new, but exactly alike, function
1143
 
                    # object.  Decorate it to be a new D-Bus interface
1144
 
                    # with the alternate D-Bus interface name.  Add it
1145
 
                    # to the class.
1146
 
                    attr[attrname] = (dbus_interface_annotations
1147
 
                                      (alt_interface)
1148
 
                                      (types.FunctionType
1149
 
                                       (attribute.func_code,
1150
 
                                        attribute.func_globals,
1151
 
                                        attribute.func_name,
1152
 
                                        attribute.func_defaults,
1153
 
                                        attribute.func_closure)))
1154
 
        # Deprecate all old interfaces
1155
 
        iname="_AlternateDBusNamesMetaclass_interface_annotation{0}"
1156
 
        for old_interface_name in old_interface_names:
1157
 
            @dbus_interface_annotations(old_interface_name)
1158
 
            def func(self):
1159
 
                return { "org.freedesktop.DBus.Deprecated": "true" }
1160
 
            # Find an unused name
1161
 
            for aname in (iname.format(i) for i in itertools.count()):
1162
 
                if aname not in attr:
1163
 
                    attr[aname] = func
1164
 
                    break
1165
1033
        return type.__new__(mcs, name, bases, attr)
1166
1034
 
1167
1035
 
1181
1049
    def __init__(self, bus = None, *args, **kwargs):
1182
1050
        self.bus = bus
1183
1051
        Client.__init__(self, *args, **kwargs)
 
1052
        self._approvals_pending = 0
 
1053
        
 
1054
        self._approvals_pending = 0
1184
1055
        # Only now, when this client is initialized, can it show up on
1185
1056
        # the D-Bus
1186
1057
        client_object_name = unicode(self.name).translate(
1190
1061
                                 ("/clients/" + client_object_name))
1191
1062
        DBusObjectWithProperties.__init__(self, self.bus,
1192
1063
                                          self.dbus_object_path)
1193
 
    
 
1064
        
1194
1065
    def notifychangeproperty(transform_func,
1195
1066
                             dbus_name, type_func=lambda x: x,
1196
1067
                             variant_level=1):
1219
1090
        
1220
1091
        return property(lambda self: getattr(self, attrname), setter)
1221
1092
    
 
1093
    
1222
1094
    expires = notifychangeproperty(datetime_to_dbus, "Expires")
1223
1095
    approvals_pending = notifychangeproperty(dbus.Boolean,
1224
1096
                                             "ApprovalPending",
1231
1103
                                       checker is not None)
1232
1104
    last_checked_ok = notifychangeproperty(datetime_to_dbus,
1233
1105
                                           "LastCheckedOK")
1234
 
    last_checker_status = notifychangeproperty(dbus.Int16,
1235
 
                                               "LastCheckerStatus")
1236
1106
    last_approval_request = notifychangeproperty(
1237
1107
        datetime_to_dbus, "LastApprovalRequest")
1238
1108
    approved_by_default = notifychangeproperty(dbus.Boolean,
1312
1182
                            (self.approval_duration),
1313
1183
                            self._reset_approved)
1314
1184
    
 
1185
    
1315
1186
    ## D-Bus methods, signals & properties
1316
1187
    _interface = "se.recompile.Mandos.Client"
1317
1188
    
1318
 
    ## Interfaces
1319
 
    
1320
 
    @dbus_interface_annotations(_interface)
1321
 
    def _foo(self):
1322
 
        return { "org.freedesktop.DBus.Property.EmitsChangedSignal":
1323
 
                     "false"}
1324
 
    
1325
1189
    ## Signals
1326
1190
    
1327
1191
    # CheckerCompleted - signal
1363
1227
        "D-Bus signal"
1364
1228
        return self.need_approval()
1365
1229
    
 
1230
    # NeRwequest - signal
 
1231
    @dbus.service.signal(_interface, signature="s")
 
1232
    def NewRequest(self, ip):
 
1233
        """D-Bus signal
 
1234
        Is sent after a client request a password.
 
1235
        """
 
1236
        pass
 
1237
    
1366
1238
    ## Methods
1367
1239
    
1368
1240
    # Approve - method
1478
1350
            return
1479
1351
        return datetime_to_dbus(self.last_checked_ok)
1480
1352
    
1481
 
    # LastCheckerStatus - property
1482
 
    @dbus_service_property(_interface, signature="n",
1483
 
                           access="read")
1484
 
    def LastCheckerStatus_dbus_property(self):
1485
 
        return dbus.Int16(self.last_checker_status)
1486
 
    
1487
1353
    # Expires - property
1488
1354
    @dbus_service_property(_interface, signature="s", access="read")
1489
1355
    def Expires_dbus_property(self):
1681
1547
                except KeyError:
1682
1548
                    return
1683
1549
                
 
1550
                if self.server.use_dbus:
 
1551
                    # Emit D-Bus signal
 
1552
                    client.NewRequest(str(self.client_address))
 
1553
                
1684
1554
                if client.approval_delay:
1685
1555
                    delay = client.approval_delay
1686
1556
                    client.approvals_pending += 1
1741
1611
                    try:
1742
1612
                        sent = session.send(client.secret[sent_size:])
1743
1613
                    except gnutls.errors.GNUTLSError as error:
1744
 
                        logger.warning("gnutls send failed",
1745
 
                                       exc_info=error)
 
1614
                        logger.warning("gnutls send failed")
1746
1615
                        return
1747
1616
                    logger.debug("Sent: %d, remaining: %d",
1748
1617
                                 sent, len(client.secret)
1751
1620
                
1752
1621
                logger.info("Sending secret to %s", client.name)
1753
1622
                # bump the timeout using extended_timeout
1754
 
                client.bump_timeout(client.extended_timeout)
 
1623
                client.checked_ok(client.extended_timeout)
1755
1624
                if self.server.use_dbus:
1756
1625
                    # Emit D-Bus signal
1757
1626
                    client.GotSecret()
1762
1631
                try:
1763
1632
                    session.bye()
1764
1633
                except gnutls.errors.GNUTLSError as error:
1765
 
                    logger.warning("GnuTLS bye failed",
1766
 
                                   exc_info=error)
 
1634
                    logger.warning("GnuTLS bye failed")
1767
1635
    
1768
1636
    @staticmethod
1769
1637
    def peer_certificate(session):
2081
1949
            elif suffix == "w":
2082
1950
                delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
2083
1951
            else:
2084
 
                raise ValueError("Unknown suffix {0!r}"
2085
 
                                 .format(suffix))
 
1952
                raise ValueError("Unknown suffix %r" % suffix)
2086
1953
        except (ValueError, IndexError) as e:
2087
1954
            raise ValueError(*(e.args))
2088
1955
        timevalue += delta
2102
1969
        sys.exit()
2103
1970
    if not noclose:
2104
1971
        # Close all standard open file descriptors
2105
 
        null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
 
1972
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
2106
1973
        if not stat.S_ISCHR(os.fstat(null).st_mode):
2107
1974
            raise OSError(errno.ENODEV,
2108
 
                          "{0} not a character device"
2109
 
                          .format(os.devnull))
 
1975
                          "%s not a character device"
 
1976
                          % os.path.devnull)
2110
1977
        os.dup2(null, sys.stdin.fileno())
2111
1978
        os.dup2(null, sys.stdout.fileno())
2112
1979
        os.dup2(null, sys.stderr.fileno())
2121
1988
    
2122
1989
    parser = argparse.ArgumentParser()
2123
1990
    parser.add_argument("-v", "--version", action="version",
2124
 
                        version = "%(prog)s {0}".format(version),
 
1991
                        version = "%%(prog)s %s" % version,
2125
1992
                        help="show version number and exit")
2126
1993
    parser.add_argument("-i", "--interface", metavar="IF",
2127
1994
                        help="Bind to interface IF")
2230
2097
    
2231
2098
    if server_settings["servicename"] != "Mandos":
2232
2099
        syslogger.setFormatter(logging.Formatter
2233
 
                               ('Mandos ({0}) [%(process)d]:'
2234
 
                                ' %(levelname)s: %(message)s'
2235
 
                                .format(server_settings
2236
 
                                        ["servicename"])))
 
2100
                               ('Mandos (%s) [%%(process)d]:'
 
2101
                                ' %%(levelname)s: %%(message)s'
 
2102
                                % server_settings["servicename"]))
2237
2103
    
2238
2104
    # Parse config file with clients
2239
2105
    client_config = configparser.SafeConfigParser(Client
2257
2123
        pidfilename = "/var/run/mandos.pid"
2258
2124
        try:
2259
2125
            pidfile = open(pidfilename, "w")
2260
 
        except IOError as e:
2261
 
            logger.error("Could not open file %r", pidfilename,
2262
 
                         exc_info=e)
 
2126
        except IOError:
 
2127
            logger.error("Could not open file %r", pidfilename)
2263
2128
    
2264
 
    for name in ("_mandos", "mandos", "nobody"):
 
2129
    try:
 
2130
        uid = pwd.getpwnam("_mandos").pw_uid
 
2131
        gid = pwd.getpwnam("_mandos").pw_gid
 
2132
    except KeyError:
2265
2133
        try:
2266
 
            uid = pwd.getpwnam(name).pw_uid
2267
 
            gid = pwd.getpwnam(name).pw_gid
2268
 
            break
 
2134
            uid = pwd.getpwnam("mandos").pw_uid
 
2135
            gid = pwd.getpwnam("mandos").pw_gid
2269
2136
        except KeyError:
2270
 
            continue
2271
 
    else:
2272
 
        uid = 65534
2273
 
        gid = 65534
 
2137
            try:
 
2138
                uid = pwd.getpwnam("nobody").pw_uid
 
2139
                gid = pwd.getpwnam("nobody").pw_gid
 
2140
            except KeyError:
 
2141
                uid = 65534
 
2142
                gid = 65534
2274
2143
    try:
2275
2144
        os.setgid(gid)
2276
2145
        os.setuid(uid)
2293
2162
         .gnutls_global_set_log_function(debug_gnutls))
2294
2163
        
2295
2164
        # Redirect stdin so all checkers get /dev/null
2296
 
        null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
 
2165
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
2297
2166
        os.dup2(null, sys.stdin.fileno())
2298
2167
        if null > 2:
2299
2168
            os.close(null)
2307
2176
    
2308
2177
    global main_loop
2309
2178
    # From the Avahi example code
2310
 
    DBusGMainLoop(set_as_default=True)
 
2179
    DBusGMainLoop(set_as_default=True )
2311
2180
    main_loop = gobject.MainLoop()
2312
2181
    bus = dbus.SystemBus()
2313
2182
    # End of Avahi example code
2319
2188
                            ("se.bsnet.fukt.Mandos", bus,
2320
2189
                             do_not_queue=True))
2321
2190
        except dbus.exceptions.NameExistsException as e:
2322
 
            logger.error("Disabling D-Bus:", exc_info=e)
 
2191
            logger.error(unicode(e) + ", disabling D-Bus")
2323
2192
            use_dbus = False
2324
2193
            server_settings["use_dbus"] = False
2325
2194
            tcp_server.use_dbus = False
2352
2221
                                                     (stored_state))
2353
2222
            os.remove(stored_state_path)
2354
2223
        except IOError as e:
2355
 
            if e.errno == errno.ENOENT:
2356
 
                logger.warning("Could not load persistent state: {0}"
2357
 
                                .format(os.strerror(e.errno)))
2358
 
            else:
2359
 
                logger.critical("Could not load persistent state:",
2360
 
                                exc_info=e)
 
2224
            logger.warning("Could not load persistent state: {0}"
 
2225
                           .format(e))
 
2226
            if e.errno != errno.ENOENT:
2361
2227
                raise
2362
2228
        except EOFError as e:
2363
2229
            logger.warning("Could not load persistent state: "
2364
 
                           "EOFError:", exc_info=e)
 
2230
                           "EOFError: {0}".format(e))
2365
2231
    
2366
2232
    with PGPEngine() as pgp:
2367
2233
        for client_name, client in clients_data.iteritems():
2384
2250
            
2385
2251
            # Clients who has passed its expire date can still be
2386
2252
            # enabled if its last checker was successful.  Clients
2387
 
            # whose checker succeeded before we stored its state is
2388
 
            # assumed to have successfully run all checkers during
2389
 
            # downtime.
 
2253
            # whose checker failed before we stored its state is
 
2254
            # assumed to have failed all checkers during downtime.
2390
2255
            if client["enabled"]:
2391
2256
                if datetime.datetime.utcnow() >= client["expires"]:
2392
2257
                    if not client["last_checked_ok"]:
2393
2258
                        logger.warning(
2394
2259
                            "disabling client {0} - Client never "
2395
 
                            "performed a successful checker"
2396
 
                            .format(client_name))
 
2260
                            "performed a successfull checker"
 
2261
                            .format(client["name"]))
2397
2262
                        client["enabled"] = False
2398
2263
                    elif client["last_checker_status"] != 0:
2399
2264
                        logger.warning(
2400
2265
                            "disabling client {0} - Client "
2401
2266
                            "last checker failed with error code {1}"
2402
 
                            .format(client_name,
 
2267
                            .format(client["name"],
2403
2268
                                    client["last_checker_status"]))
2404
2269
                        client["enabled"] = False
2405
2270
                    else:
2408
2273
                                             + client["timeout"])
2409
2274
                        logger.debug("Last checker succeeded,"
2410
2275
                                     " keeping {0} enabled"
2411
 
                                     .format(client_name))
 
2276
                                     .format(client["name"]))
2412
2277
            try:
2413
2278
                client["secret"] = (
2414
2279
                    pgp.decrypt(client["encrypted_secret"],
2420
2285
                             .format(client_name))
2421
2286
                client["secret"] = (
2422
2287
                    client_settings[client_name]["secret"])
 
2288
 
2423
2289
    
2424
2290
    # Add/remove clients based on new changes made to config
2425
2291
    for client_name in (set(old_client_settings)
2428
2294
    for client_name in (set(client_settings)
2429
2295
                        - set(old_client_settings)):
2430
2296
        clients_data[client_name] = client_settings[client_name]
2431
 
    
2432
 
    # Create all client objects
 
2297
 
 
2298
    # Create clients all clients
2433
2299
    for client_name, client in clients_data.iteritems():
2434
2300
        tcp_server.clients[client_name] = client_class(
2435
2301
            name = client_name, settings = client)
2436
2302
    
2437
2303
    if not tcp_server.clients:
2438
2304
        logger.warning("No clients defined")
2439
 
    
 
2305
        
2440
2306
    if not debug:
2441
2307
        try:
2442
2308
            with pidfile:
2456
2322
    signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
2457
2323
    
2458
2324
    if use_dbus:
2459
 
        class MandosDBusService(DBusObjectWithProperties):
 
2325
        class MandosDBusService(dbus.service.Object):
2460
2326
            """A D-Bus proxy object"""
2461
2327
            def __init__(self):
2462
2328
                dbus.service.Object.__init__(self, bus, "/")
2463
2329
            _interface = "se.recompile.Mandos"
2464
2330
            
2465
 
            @dbus_interface_annotations(_interface)
2466
 
            def _foo(self):
2467
 
                return { "org.freedesktop.DBus.Property"
2468
 
                         ".EmitsChangedSignal":
2469
 
                             "false"}
2470
 
            
2471
2331
            @dbus.service.signal(_interface, signature="o")
2472
2332
            def ClientAdded(self, objpath):
2473
2333
                "D-Bus signal"
2564
2424
                pickle.dump((clients, client_settings), stored_state)
2565
2425
            os.rename(tempname, stored_state_path)
2566
2426
        except (IOError, OSError) as e:
 
2427
            logger.warning("Could not save persistent state: {0}"
 
2428
                           .format(e))
2567
2429
            if not debug:
2568
2430
                try:
2569
2431
                    os.remove(tempname)
2570
2432
                except NameError:
2571
2433
                    pass
2572
 
            if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
2573
 
                logger.warning("Could not save persistent state: {0}"
2574
 
                               .format(os.strerror(e.errno)))
2575
 
            else:
2576
 
                logger.warning("Could not save persistent state:",
2577
 
                               exc_info=e)
 
2434
            if e.errno not in set((errno.ENOENT, errno.EACCES,
 
2435
                                   errno.EEXIST)):
2578
2436
                raise e
2579
2437
        
2580
2438
        # Delete all clients, and settings from config
2608
2466
    service.port = tcp_server.socket.getsockname()[1]
2609
2467
    if use_ipv6:
2610
2468
        logger.info("Now listening on address %r, port %d,"
2611
 
                    " flowinfo %d, scope_id %d",
2612
 
                    *tcp_server.socket.getsockname())
 
2469
                    " flowinfo %d, scope_id %d"
 
2470
                    % tcp_server.socket.getsockname())
2613
2471
    else:                       # IPv4
2614
 
        logger.info("Now listening on address %r, port %d",
2615
 
                    *tcp_server.socket.getsockname())
 
2472
        logger.info("Now listening on address %r, port %d"
 
2473
                    % tcp_server.socket.getsockname())
2616
2474
    
2617
2475
    #service.interface = tcp_server.socket.getsockname()[3]
2618
2476
    
2621
2479
        try:
2622
2480
            service.activate()
2623
2481
        except dbus.exceptions.DBusException as error:
2624
 
            logger.critical("D-Bus Exception", exc_info=error)
 
2482
            logger.critical("DBusException: %s", error)
2625
2483
            cleanup()
2626
2484
            sys.exit(1)
2627
2485
        # End of Avahi example code
2634
2492
        logger.debug("Starting main loop")
2635
2493
        main_loop.run()
2636
2494
    except AvahiError as error:
2637
 
        logger.critical("Avahi Error", exc_info=error)
 
2495
        logger.critical("AvahiError: %s", error)
2638
2496
        cleanup()
2639
2497
        sys.exit(1)
2640
2498
    except KeyboardInterrupt: