/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos

  • Committer: teddy at recompile
  • Date: 2012-01-01 17:38:33 UTC
  • Revision ID: teddy@recompile.se-20120101173833-ai39bif1w0ftuyyh
* Makefile (install-server): Add intro(8mandos) man page.
* network-hooks.d/bridge: Add copyright info and year.
* network-hooks.d/openvpn: - '' -
* network-hooks.d/wireless: - '' -

Show diffs side-by-side

added added

removed removed

Lines of Context:
1
 
#!/usr/bin/python2.7
 
1
#!/usr/bin/python
2
2
# -*- mode: python; coding: utf-8 -*-
3
3
4
4
# Mandos server - give out binary blobs to connecting clients.
11
11
# "AvahiService" class, and some lines in "main".
12
12
13
13
# Everything else is
14
 
# Copyright © 2008-2015 Teddy Hogeborn
15
 
# Copyright © 2008-2015 Björn Påhlsson
 
14
# Copyright © 2008-2012 Teddy Hogeborn
 
15
# Copyright © 2008-2012 Björn Påhlsson
16
16
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
34
34
from __future__ import (division, absolute_import, print_function,
35
35
                        unicode_literals)
36
36
 
37
 
from future_builtins import *
38
 
 
39
 
try:
40
 
    import SocketServer as socketserver
41
 
except ImportError:
42
 
    import socketserver
 
37
import SocketServer as socketserver
43
38
import socket
44
39
import argparse
45
40
import datetime
50
45
import gnutls.library.functions
51
46
import gnutls.library.constants
52
47
import gnutls.library.types
53
 
try:
54
 
    import ConfigParser as configparser
55
 
except ImportError:
56
 
    import configparser
 
48
import ConfigParser as configparser
57
49
import sys
58
50
import re
59
51
import os
68
60
import struct
69
61
import fcntl
70
62
import functools
71
 
try:
72
 
    import cPickle as pickle
73
 
except ImportError:
74
 
    import pickle
 
63
import cPickle as pickle
75
64
import multiprocessing
76
65
import types
77
66
import binascii
78
67
import tempfile
79
 
import itertools
80
 
import collections
81
 
import codecs
82
68
 
83
69
import dbus
84
70
import dbus.service
85
 
try:
86
 
    import gobject
87
 
except ImportError:
88
 
    from gi.repository import GObject as gobject
 
71
import gobject
89
72
import avahi
90
73
from dbus.mainloop.glib import DBusGMainLoop
91
74
import ctypes
92
75
import ctypes.util
93
76
import xml.dom.minidom
94
77
import inspect
 
78
import GnuPGInterface
95
79
 
96
80
try:
97
81
    SO_BINDTODEVICE = socket.SO_BINDTODEVICE
101
85
    except ImportError:
102
86
        SO_BINDTODEVICE = None
103
87
 
104
 
if sys.version_info.major == 2:
105
 
    str = unicode
106
 
 
107
 
version = "1.6.9"
 
88
version = "1.5.0"
108
89
stored_state_file = "clients.pickle"
109
90
 
110
91
logger = logging.getLogger()
111
 
syslogger = None
 
92
syslogger = (logging.handlers.SysLogHandler
 
93
             (facility = logging.handlers.SysLogHandler.LOG_DAEMON,
 
94
              address = str("/dev/log")))
112
95
 
113
96
try:
114
 
    if_nametoindex = ctypes.cdll.LoadLibrary(
115
 
        ctypes.util.find_library("c")).if_nametoindex
 
97
    if_nametoindex = (ctypes.cdll.LoadLibrary
 
98
                      (ctypes.util.find_library("c"))
 
99
                      .if_nametoindex)
116
100
except (OSError, AttributeError):
117
 
    
118
101
    def if_nametoindex(interface):
119
102
        "Get an interface index the hard way, i.e. using fcntl()"
120
103
        SIOCGIFINDEX = 0x8933  # From /usr/include/linux/sockios.h
121
104
        with contextlib.closing(socket.socket()) as s:
122
105
            ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
123
 
                                struct.pack(b"16s16x", interface))
124
 
        interface_index = struct.unpack("I", ifreq[16:20])[0]
 
106
                                struct.pack(str("16s16x"),
 
107
                                            interface))
 
108
        interface_index = struct.unpack(str("I"),
 
109
                                        ifreq[16:20])[0]
125
110
        return interface_index
126
111
 
127
112
 
128
113
def initlogger(debug, level=logging.WARNING):
129
114
    """init logger and add loglevel"""
130
115
    
131
 
    global syslogger
132
 
    syslogger = (logging.handlers.SysLogHandler(
133
 
        facility = logging.handlers.SysLogHandler.LOG_DAEMON,
134
 
        address = "/dev/log"))
135
116
    syslogger.setFormatter(logging.Formatter
136
117
                           ('Mandos [%(process)d]: %(levelname)s:'
137
118
                            ' %(message)s'))
154
135
 
155
136
class PGPEngine(object):
156
137
    """A simple class for OpenPGP symmetric encryption & decryption"""
157
 
    
158
138
    def __init__(self):
 
139
        self.gnupg = GnuPGInterface.GnuPG()
159
140
        self.tempdir = tempfile.mkdtemp(prefix="mandos-")
160
 
        self.gnupgargs = ['--batch',
161
 
                          '--home', self.tempdir,
162
 
                          '--force-mdc',
163
 
                          '--quiet',
164
 
                          '--no-use-agent']
 
141
        self.gnupg = GnuPGInterface.GnuPG()
 
142
        self.gnupg.options.meta_interactive = False
 
143
        self.gnupg.options.homedir = self.tempdir
 
144
        self.gnupg.options.extra_args.extend(['--force-mdc',
 
145
                                              '--quiet',
 
146
                                              '--no-use-agent'])
165
147
    
166
148
    def __enter__(self):
167
149
        return self
168
150
    
169
 
    def __exit__(self, exc_type, exc_value, traceback):
 
151
    def __exit__ (self, exc_type, exc_value, traceback):
170
152
        self._cleanup()
171
153
        return False
172
154
    
189
171
    def password_encode(self, password):
190
172
        # Passphrase can not be empty and can not contain newlines or
191
173
        # NUL bytes.  So we prefix it and hex encode it.
192
 
        encoded = b"mandos" + binascii.hexlify(password)
193
 
        if len(encoded) > 2048:
194
 
            # GnuPG can't handle long passwords, so encode differently
195
 
            encoded = (b"mandos" + password.replace(b"\\", b"\\\\")
196
 
                       .replace(b"\n", b"\\n")
197
 
                       .replace(b"\0", b"\\x00"))
198
 
        return encoded
 
174
        return b"mandos" + binascii.hexlify(password)
199
175
    
200
176
    def encrypt(self, data, password):
201
 
        passphrase = self.password_encode(password)
202
 
        with tempfile.NamedTemporaryFile(
203
 
                dir=self.tempdir) as passfile:
204
 
            passfile.write(passphrase)
205
 
            passfile.flush()
206
 
            proc = subprocess.Popen(['gpg', '--symmetric',
207
 
                                     '--passphrase-file',
208
 
                                     passfile.name]
209
 
                                    + self.gnupgargs,
210
 
                                    stdin = subprocess.PIPE,
211
 
                                    stdout = subprocess.PIPE,
212
 
                                    stderr = subprocess.PIPE)
213
 
            ciphertext, err = proc.communicate(input = data)
214
 
        if proc.returncode != 0:
215
 
            raise PGPError(err)
 
177
        self.gnupg.passphrase = self.password_encode(password)
 
178
        with open(os.devnull) as devnull:
 
179
            try:
 
180
                proc = self.gnupg.run(['--symmetric'],
 
181
                                      create_fhs=['stdin', 'stdout'],
 
182
                                      attach_fhs={'stderr': devnull})
 
183
                with contextlib.closing(proc.handles['stdin']) as f:
 
184
                    f.write(data)
 
185
                with contextlib.closing(proc.handles['stdout']) as f:
 
186
                    ciphertext = f.read()
 
187
                proc.wait()
 
188
            except IOError as e:
 
189
                raise PGPError(e)
 
190
        self.gnupg.passphrase = None
216
191
        return ciphertext
217
192
    
218
193
    def decrypt(self, data, password):
219
 
        passphrase = self.password_encode(password)
220
 
        with tempfile.NamedTemporaryFile(
221
 
                dir = self.tempdir) as passfile:
222
 
            passfile.write(passphrase)
223
 
            passfile.flush()
224
 
            proc = subprocess.Popen(['gpg', '--decrypt',
225
 
                                     '--passphrase-file',
226
 
                                     passfile.name]
227
 
                                    + self.gnupgargs,
228
 
                                    stdin = subprocess.PIPE,
229
 
                                    stdout = subprocess.PIPE,
230
 
                                    stderr = subprocess.PIPE)
231
 
            decrypted_plaintext, err = proc.communicate(input = data)
232
 
        if proc.returncode != 0:
233
 
            raise PGPError(err)
 
194
        self.gnupg.passphrase = self.password_encode(password)
 
195
        with open(os.devnull) as devnull:
 
196
            try:
 
197
                proc = self.gnupg.run(['--decrypt'],
 
198
                                      create_fhs=['stdin', 'stdout'],
 
199
                                      attach_fhs={'stderr': devnull})
 
200
                with contextlib.closing(proc.handles['stdin'] ) as f:
 
201
                    f.write(data)
 
202
                with contextlib.closing(proc.handles['stdout']) as f:
 
203
                    decrypted_plaintext = f.read()
 
204
                proc.wait()
 
205
            except IOError as e:
 
206
                raise PGPError(e)
 
207
        self.gnupg.passphrase = None
234
208
        return decrypted_plaintext
235
209
 
236
210
 
 
211
 
237
212
class AvahiError(Exception):
238
213
    def __init__(self, value, *args, **kwargs):
239
214
        self.value = value
240
 
        return super(AvahiError, self).__init__(value, *args,
241
 
                                                **kwargs)
242
 
 
 
215
        super(AvahiError, self).__init__(value, *args, **kwargs)
 
216
    def __unicode__(self):
 
217
        return unicode(repr(self.value))
243
218
 
244
219
class AvahiServiceError(AvahiError):
245
220
    pass
246
221
 
247
 
 
248
222
class AvahiGroupError(AvahiError):
249
223
    pass
250
224
 
257
231
               Used to optionally bind to the specified interface.
258
232
    name: string; Example: 'Mandos'
259
233
    type: string; Example: '_mandos._tcp'.
260
 
     See <https://www.iana.org/assignments/service-names-port-numbers>
 
234
                  See <http://www.dns-sd.org/ServiceTypes.html>
261
235
    port: integer; what port to announce
262
236
    TXT: list of strings; TXT record for the service
263
237
    domain: string; Domain to publish on, default to .local if empty.
269
243
    server: D-Bus Server
270
244
    bus: dbus.SystemBus()
271
245
    """
272
 
    
273
 
    def __init__(self,
274
 
                 interface = avahi.IF_UNSPEC,
275
 
                 name = None,
276
 
                 servicetype = None,
277
 
                 port = None,
278
 
                 TXT = None,
279
 
                 domain = "",
280
 
                 host = "",
281
 
                 max_renames = 32768,
282
 
                 protocol = avahi.PROTO_UNSPEC,
283
 
                 bus = None):
 
246
    def __init__(self, interface = avahi.IF_UNSPEC, name = None,
 
247
                 servicetype = None, port = None, TXT = None,
 
248
                 domain = "", host = "", max_renames = 32768,
 
249
                 protocol = avahi.PROTO_UNSPEC, bus = None):
284
250
        self.interface = interface
285
251
        self.name = name
286
252
        self.type = servicetype
295
261
        self.server = None
296
262
        self.bus = bus
297
263
        self.entry_group_state_changed_match = None
298
 
    
299
 
    def rename(self, remove=True):
 
264
    def rename(self):
300
265
        """Derived from the Avahi example code"""
301
266
        if self.rename_count >= self.max_renames:
302
267
            logger.critical("No suitable Zeroconf service name found"
303
268
                            " after %i retries, exiting.",
304
269
                            self.rename_count)
305
270
            raise AvahiServiceError("Too many renames")
306
 
        self.name = str(
307
 
            self.server.GetAlternativeServiceName(self.name))
308
 
        self.rename_count += 1
 
271
        self.name = unicode(self.server
 
272
                            .GetAlternativeServiceName(self.name))
309
273
        logger.info("Changing Zeroconf service name to %r ...",
310
274
                    self.name)
311
 
        if remove:
312
 
            self.remove()
 
275
        self.remove()
313
276
        try:
314
277
            self.add()
315
278
        except dbus.exceptions.DBusException as error:
316
 
            if (error.get_dbus_name()
317
 
                == "org.freedesktop.Avahi.CollisionError"):
318
 
                logger.info("Local Zeroconf service name collision.")
319
 
                return self.rename(remove=False)
320
 
            else:
321
 
                logger.critical("D-Bus Exception", exc_info=error)
322
 
                self.cleanup()
323
 
                os._exit(1)
324
 
    
 
279
            logger.critical("DBusException: %s", error)
 
280
            self.cleanup()
 
281
            os._exit(1)
 
282
        self.rename_count += 1
325
283
    def remove(self):
326
284
        """Derived from the Avahi example code"""
327
285
        if self.entry_group_state_changed_match is not None:
329
287
            self.entry_group_state_changed_match = None
330
288
        if self.group is not None:
331
289
            self.group.Reset()
332
 
    
333
290
    def add(self):
334
291
        """Derived from the Avahi example code"""
335
292
        self.remove()
352
309
            dbus.UInt16(self.port),
353
310
            avahi.string_array_to_txt_array(self.TXT))
354
311
        self.group.Commit()
355
 
    
356
312
    def entry_group_state_changed(self, state, error):
357
313
        """Derived from the Avahi example code"""
358
314
        logger.debug("Avahi entry group state change: %i", state)
364
320
            self.rename()
365
321
        elif state == avahi.ENTRY_GROUP_FAILURE:
366
322
            logger.critical("Avahi: Error in group state changed %s",
367
 
                            str(error))
368
 
            raise AvahiGroupError("State changed: {!s}".format(error))
369
 
    
 
323
                            unicode(error))
 
324
            raise AvahiGroupError("State changed: %s"
 
325
                                  % unicode(error))
370
326
    def cleanup(self):
371
327
        """Derived from the Avahi example code"""
372
328
        if self.group is not None:
377
333
                pass
378
334
            self.group = None
379
335
        self.remove()
380
 
    
381
336
    def server_state_changed(self, state, error=None):
382
337
        """Derived from the Avahi example code"""
383
338
        logger.debug("Avahi server state change: %i", state)
384
 
        bad_states = {
385
 
            avahi.SERVER_INVALID: "Zeroconf server invalid",
386
 
            avahi.SERVER_REGISTERING: None,
387
 
            avahi.SERVER_COLLISION: "Zeroconf server name collision",
388
 
            avahi.SERVER_FAILURE: "Zeroconf server failure",
389
 
        }
 
339
        bad_states = { avahi.SERVER_INVALID:
 
340
                           "Zeroconf server invalid",
 
341
                       avahi.SERVER_REGISTERING: None,
 
342
                       avahi.SERVER_COLLISION:
 
343
                           "Zeroconf server name collision",
 
344
                       avahi.SERVER_FAILURE:
 
345
                           "Zeroconf server failure" }
390
346
        if state in bad_states:
391
347
            if bad_states[state] is not None:
392
348
                if error is None:
395
351
                    logger.error(bad_states[state] + ": %r", error)
396
352
            self.cleanup()
397
353
        elif state == avahi.SERVER_RUNNING:
398
 
            try:
399
 
                self.add()
400
 
            except dbus.exceptions.DBusException as error:
401
 
                if (error.get_dbus_name()
402
 
                    == "org.freedesktop.Avahi.CollisionError"):
403
 
                    logger.info("Local Zeroconf service name"
404
 
                                " collision.")
405
 
                    return self.rename(remove=False)
406
 
                else:
407
 
                    logger.critical("D-Bus Exception", exc_info=error)
408
 
                    self.cleanup()
409
 
                    os._exit(1)
 
354
            self.add()
410
355
        else:
411
356
            if error is None:
412
357
                logger.debug("Unknown state: %r", state)
413
358
            else:
414
359
                logger.debug("Unknown state: %r: %r", state, error)
415
 
    
416
360
    def activate(self):
417
361
        """Derived from the Avahi example code"""
418
362
        if self.server is None:
422
366
                                    follow_name_owner_changes=True),
423
367
                avahi.DBUS_INTERFACE_SERVER)
424
368
        self.server.connect_to_signal("StateChanged",
425
 
                                      self.server_state_changed)
 
369
                                 self.server_state_changed)
426
370
        self.server_state_changed(self.server.GetState())
427
371
 
428
 
 
429
372
class AvahiServiceToSyslog(AvahiService):
430
 
    def rename(self, *args, **kwargs):
 
373
    def rename(self):
431
374
        """Add the new name to the syslog messages"""
432
 
        ret = AvahiService.rename(self, *args, **kwargs)
433
 
        syslogger.setFormatter(logging.Formatter(
434
 
            'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
435
 
            .format(self.name)))
 
375
        ret = AvahiService.rename(self)
 
376
        syslogger.setFormatter(logging.Formatter
 
377
                               ('Mandos (%s) [%%(process)d]:'
 
378
                                ' %%(levelname)s: %%(message)s'
 
379
                                % self.name))
436
380
        return ret
437
381
 
438
 
def call_pipe(connection,       # : multiprocessing.Connection
439
 
              func, *args, **kwargs):
440
 
    """This function is meant to be called by multiprocessing.Process
441
 
    
442
 
    This function runs func(*args, **kwargs), and writes the resulting
443
 
    return value on the provided multiprocessing.Connection.
444
 
    """
445
 
    connection.send(func(*args, **kwargs))
446
 
    connection.close()
447
 
 
 
382
def timedelta_to_milliseconds(td):
 
383
    "Convert a datetime.timedelta() to milliseconds"
 
384
    return ((td.days * 24 * 60 * 60 * 1000)
 
385
            + (td.seconds * 1000)
 
386
            + (td.microseconds // 1000))
 
387
        
448
388
class Client(object):
449
389
    """A representation of a client host served by this server.
450
390
    
475
415
    last_checked_ok: datetime.datetime(); (UTC) or None
476
416
    last_checker_status: integer between 0 and 255 reflecting exit
477
417
                         status of last checker. -1 reflects crashed
478
 
                         checker, -2 means no checker completed yet.
479
 
    last_checker_signal: The signal which killed the last checker, if
480
 
                         last_checker_status is -1
 
418
                         checker, or None.
481
419
    last_enabled: datetime.datetime(); (UTC) or None
482
420
    name:       string; from the config file, used in log messages and
483
421
                        D-Bus identifiers
484
422
    secret:     bytestring; sent verbatim (over TLS) to client
485
423
    timeout:    datetime.timedelta(); How long from last_checked_ok
486
424
                                      until this client is disabled
487
 
    extended_timeout:   extra long timeout when secret has been sent
 
425
    extended_timeout:   extra long timeout when password has been sent
488
426
    runtime_expansions: Allowed attributes for runtime expansion.
489
427
    expires:    datetime.datetime(); time (UTC) when a client will be
490
428
                disabled, or None
491
 
    server_settings: The server_settings dict from main()
492
429
    """
493
430
    
494
431
    runtime_expansions = ("approval_delay", "approval_duration",
495
 
                          "created", "enabled", "expires",
496
 
                          "fingerprint", "host", "interval",
497
 
                          "last_approval_request", "last_checked_ok",
 
432
                          "created", "enabled", "fingerprint",
 
433
                          "host", "interval", "last_checked_ok",
498
434
                          "last_enabled", "name", "timeout")
499
 
    client_defaults = {
500
 
        "timeout": "PT5M",
501
 
        "extended_timeout": "PT15M",
502
 
        "interval": "PT2M",
503
 
        "checker": "fping -q -- %%(host)s",
504
 
        "host": "",
505
 
        "approval_delay": "PT0S",
506
 
        "approval_duration": "PT1S",
507
 
        "approved_by_default": "True",
508
 
        "enabled": "True",
509
 
    }
510
 
    
 
435
    client_defaults = { "timeout": "5m",
 
436
                        "extended_timeout": "15m",
 
437
                        "interval": "2m",
 
438
                        "checker": "fping -q -- %%(host)s",
 
439
                        "host": "",
 
440
                        "approval_delay": "0s",
 
441
                        "approval_duration": "1s",
 
442
                        "approved_by_default": "True",
 
443
                        "enabled": "True",
 
444
                        }
 
445
    
 
446
    def timeout_milliseconds(self):
 
447
        "Return the 'timeout' attribute in milliseconds"
 
448
        return timedelta_to_milliseconds(self.timeout)
 
449
    
 
450
    def extended_timeout_milliseconds(self):
 
451
        "Return the 'extended_timeout' attribute in milliseconds"
 
452
        return timedelta_to_milliseconds(self.extended_timeout)
 
453
    
 
454
    def interval_milliseconds(self):
 
455
        "Return the 'interval' attribute in milliseconds"
 
456
        return timedelta_to_milliseconds(self.interval)
 
457
    
 
458
    def approval_delay_milliseconds(self):
 
459
        return timedelta_to_milliseconds(self.approval_delay)
 
460
 
511
461
    @staticmethod
512
462
    def config_parser(config):
513
463
        """Construct a new dict of client settings of this form:
528
478
            client["enabled"] = config.getboolean(client_name,
529
479
                                                  "enabled")
530
480
            
531
 
            # Uppercase and remove spaces from fingerprint for later
532
 
            # comparison purposes with return value from the
533
 
            # fingerprint() function
534
481
            client["fingerprint"] = (section["fingerprint"].upper()
535
482
                                     .replace(" ", ""))
536
483
            if "secret" in section:
541
488
                          "rb") as secfile:
542
489
                    client["secret"] = secfile.read()
543
490
            else:
544
 
                raise TypeError("No secret or secfile for section {}"
545
 
                                .format(section))
 
491
                raise TypeError("No secret or secfile for section %s"
 
492
                                % section)
546
493
            client["timeout"] = string_to_delta(section["timeout"])
547
494
            client["extended_timeout"] = string_to_delta(
548
495
                section["extended_timeout"])
554
501
            client["checker_command"] = section["checker"]
555
502
            client["last_approval_request"] = None
556
503
            client["last_checked_ok"] = None
557
 
            client["last_checker_status"] = -2
 
504
            client["last_checker_status"] = None
558
505
        
559
506
        return settings
560
 
    
561
 
    def __init__(self, settings, name = None, server_settings=None):
 
507
        
 
508
        
 
509
    def __init__(self, settings, name = None):
 
510
        """Note: the 'checker' key in 'config' sets the
 
511
        'checker_command' attribute and *not* the 'checker'
 
512
        attribute."""
562
513
        self.name = name
563
 
        if server_settings is None:
564
 
            server_settings = {}
565
 
        self.server_settings = server_settings
566
514
        # adding all client settings
567
 
        for setting, value in settings.items():
 
515
        for setting, value in settings.iteritems():
568
516
            setattr(self, setting, value)
569
517
        
570
518
        if self.enabled:
576
524
        else:
577
525
            self.last_enabled = None
578
526
            self.expires = None
579
 
        
 
527
       
580
528
        logger.debug("Creating client %r", self.name)
 
529
        # Uppercase and remove spaces from fingerprint for later
 
530
        # comparison purposes with return value from the fingerprint()
 
531
        # function
581
532
        logger.debug("  Fingerprint: %s", self.fingerprint)
582
533
        self.created = settings.get("created",
583
534
                                    datetime.datetime.utcnow())
584
 
        
 
535
 
585
536
        # attributes specific for this server instance
586
537
        self.checker = None
587
538
        self.checker_initiator_tag = None
590
541
        self.current_checker_command = None
591
542
        self.approved = None
592
543
        self.approvals_pending = 0
593
 
        self.changedstate = multiprocessing_manager.Condition(
594
 
            multiprocessing_manager.Lock())
595
 
        self.client_structure = [attr
596
 
                                 for attr in self.__dict__.iterkeys()
 
544
        self.changedstate = (multiprocessing_manager
 
545
                             .Condition(multiprocessing_manager
 
546
                                        .Lock()))
 
547
        self.client_structure = [attr for attr in
 
548
                                 self.__dict__.iterkeys()
597
549
                                 if not attr.startswith("_")]
598
550
        self.client_structure.append("client_structure")
599
551
        
600
 
        for name, t in inspect.getmembers(
601
 
                type(self), lambda obj: isinstance(obj, property)):
 
552
        for name, t in inspect.getmembers(type(self),
 
553
                                          lambda obj:
 
554
                                              isinstance(obj,
 
555
                                                         property)):
602
556
            if not name.startswith("_"):
603
557
                self.client_structure.append(name)
604
558
    
612
566
        if getattr(self, "enabled", False):
613
567
            # Already enabled
614
568
            return
 
569
        self.send_changedstate()
615
570
        self.expires = datetime.datetime.utcnow() + self.timeout
616
571
        self.enabled = True
617
572
        self.last_enabled = datetime.datetime.utcnow()
618
573
        self.init_checker()
619
 
        self.send_changedstate()
620
574
    
621
575
    def disable(self, quiet=True):
622
576
        """Disable this client."""
623
577
        if not getattr(self, "enabled", False):
624
578
            return False
625
579
        if not quiet:
 
580
            self.send_changedstate()
 
581
        if not quiet:
626
582
            logger.info("Disabling client %s", self.name)
627
 
        if getattr(self, "disable_initiator_tag", None) is not None:
 
583
        if getattr(self, "disable_initiator_tag", False):
628
584
            gobject.source_remove(self.disable_initiator_tag)
629
585
            self.disable_initiator_tag = None
630
586
        self.expires = None
631
 
        if getattr(self, "checker_initiator_tag", None) is not None:
 
587
        if getattr(self, "checker_initiator_tag", False):
632
588
            gobject.source_remove(self.checker_initiator_tag)
633
589
            self.checker_initiator_tag = None
634
590
        self.stop_checker()
635
591
        self.enabled = False
636
 
        if not quiet:
637
 
            self.send_changedstate()
638
592
        # Do not run this again if called by a gobject.timeout_add
639
593
        return False
640
594
    
644
598
    def init_checker(self):
645
599
        # Schedule a new checker to be started an 'interval' from now,
646
600
        # and every interval from then on.
647
 
        if self.checker_initiator_tag is not None:
648
 
            gobject.source_remove(self.checker_initiator_tag)
649
 
        self.checker_initiator_tag = gobject.timeout_add(
650
 
            int(self.interval.total_seconds() * 1000),
651
 
            self.start_checker)
 
601
        self.checker_initiator_tag = (gobject.timeout_add
 
602
                                      (self.interval_milliseconds(),
 
603
                                       self.start_checker))
652
604
        # Schedule a disable() when 'timeout' has passed
653
 
        if self.disable_initiator_tag is not None:
654
 
            gobject.source_remove(self.disable_initiator_tag)
655
 
        self.disable_initiator_tag = gobject.timeout_add(
656
 
            int(self.timeout.total_seconds() * 1000), self.disable)
 
605
        self.disable_initiator_tag = (gobject.timeout_add
 
606
                                   (self.timeout_milliseconds(),
 
607
                                    self.disable))
657
608
        # Also start a new checker *right now*.
658
609
        self.start_checker()
659
610
    
660
 
    def checker_callback(self, source, condition, connection,
661
 
                         command):
 
611
    def checker_callback(self, pid, condition, command):
662
612
        """The checker has completed, so take appropriate actions."""
663
613
        self.checker_callback_tag = None
664
614
        self.checker = None
665
 
        # Read return code from connection (see call_pipe)
666
 
        returncode = connection.recv()
667
 
        connection.close()
668
 
        
669
 
        if returncode >= 0:
670
 
            self.last_checker_status = returncode
671
 
            self.last_checker_signal = None
 
615
        if os.WIFEXITED(condition):
 
616
            self.last_checker_status = os.WEXITSTATUS(condition)
672
617
            if self.last_checker_status == 0:
673
618
                logger.info("Checker for %(name)s succeeded",
674
619
                            vars(self))
675
620
                self.checked_ok()
676
621
            else:
677
 
                logger.info("Checker for %(name)s failed", vars(self))
 
622
                logger.info("Checker for %(name)s failed",
 
623
                            vars(self))
678
624
        else:
679
625
            self.last_checker_status = -1
680
 
            self.last_checker_signal = -returncode
681
626
            logger.warning("Checker for %(name)s crashed?",
682
627
                           vars(self))
683
 
        return False
684
 
    
685
 
    def checked_ok(self):
686
 
        """Assert that the client has been seen, alive and well."""
687
 
        self.last_checked_ok = datetime.datetime.utcnow()
688
 
        self.last_checker_status = 0
689
 
        self.last_checker_signal = None
690
 
        self.bump_timeout()
691
 
    
692
 
    def bump_timeout(self, timeout=None):
693
 
        """Bump up the timeout for this client."""
 
628
    
 
629
    def checked_ok(self, timeout=None):
 
630
        """Bump up the timeout for this client.
 
631
        
 
632
        This should only be called when the client has been seen,
 
633
        alive and well.
 
634
        """
694
635
        if timeout is None:
695
636
            timeout = self.timeout
 
637
        self.last_checked_ok = datetime.datetime.utcnow()
696
638
        if self.disable_initiator_tag is not None:
697
639
            gobject.source_remove(self.disable_initiator_tag)
698
 
            self.disable_initiator_tag = None
699
640
        if getattr(self, "enabled", False):
700
 
            self.disable_initiator_tag = gobject.timeout_add(
701
 
                int(timeout.total_seconds() * 1000), self.disable)
 
641
            self.disable_initiator_tag = (gobject.timeout_add
 
642
                                          (timedelta_to_milliseconds
 
643
                                           (timeout), self.disable))
702
644
            self.expires = datetime.datetime.utcnow() + timeout
703
645
    
704
646
    def need_approval(self):
710
652
        If a checker already exists, leave it running and do
711
653
        nothing."""
712
654
        # The reason for not killing a running checker is that if we
713
 
        # did that, and if a checker (for some reason) started running
714
 
        # slowly and taking more than 'interval' time, then the client
715
 
        # would inevitably timeout, since no checker would get a
716
 
        # chance to run to completion.  If we instead leave running
 
655
        # did that, then if a checker (for some reason) started
 
656
        # running slowly and taking more than 'interval' time, the
 
657
        # client would inevitably timeout, since no checker would get
 
658
        # a chance to run to completion.  If we instead leave running
717
659
        # checkers alone, the checker would have to take more time
718
660
        # than 'timeout' for the client to be disabled, which is as it
719
661
        # should be.
720
662
        
721
 
        if self.checker is not None and not self.checker.is_alive():
722
 
            logger.warning("Checker was not alive; joining")
723
 
            self.checker.join()
724
 
            self.checker = None
 
663
        # If a checker exists, make sure it is not a zombie
 
664
        try:
 
665
            pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
 
666
        except (AttributeError, OSError) as error:
 
667
            if (isinstance(error, OSError)
 
668
                and error.errno != errno.ECHILD):
 
669
                raise error
 
670
        else:
 
671
            if pid:
 
672
                logger.warning("Checker was a zombie")
 
673
                gobject.source_remove(self.checker_callback_tag)
 
674
                self.checker_callback(pid, status,
 
675
                                      self.current_checker_command)
725
676
        # Start a new checker if needed
726
677
        if self.checker is None:
727
 
            # Escape attributes for the shell
728
 
            escaped_attrs = {
729
 
                attr: re.escape(str(getattr(self, attr)))
730
 
                for attr in self.runtime_expansions }
731
678
            try:
732
 
                command = self.checker_command % escaped_attrs
733
 
            except TypeError as error:
734
 
                logger.error('Could not format string "%s"',
735
 
                             self.checker_command,
736
 
                             exc_info=error)
737
 
                return True     # Try again later
 
679
                # In case checker_command has exactly one % operator
 
680
                command = self.checker_command % self.host
 
681
            except TypeError:
 
682
                # Escape attributes for the shell
 
683
                escaped_attrs = dict(
 
684
                    (attr,
 
685
                     re.escape(unicode(str(getattr(self, attr, "")),
 
686
                                       errors=
 
687
                                       'replace')))
 
688
                    for attr in
 
689
                    self.runtime_expansions)
 
690
                
 
691
                try:
 
692
                    command = self.checker_command % escaped_attrs
 
693
                except TypeError as error:
 
694
                    logger.error('Could not format string "%s":'
 
695
                                 ' %s', self.checker_command, error)
 
696
                    return True # Try again later
738
697
            self.current_checker_command = command
739
 
            logger.info("Starting checker %r for %s", command,
740
 
                        self.name)
741
 
            # We don't need to redirect stdout and stderr, since
742
 
            # in normal mode, that is already done by daemon(),
743
 
            # and in debug mode we don't want to.  (Stdin is
744
 
            # always replaced by /dev/null.)
745
 
            # The exception is when not debugging but nevertheless
746
 
            # running in the foreground; use the previously
747
 
            # created wnull.
748
 
            popen_args = { "close_fds": True,
749
 
                           "shell": True,
750
 
                           "cwd": "/" }
751
 
            if (not self.server_settings["debug"]
752
 
                and self.server_settings["foreground"]):
753
 
                popen_args.update({"stdout": wnull,
754
 
                                   "stderr": wnull })
755
 
            pipe = multiprocessing.Pipe(duplex = False)
756
 
            self.checker = multiprocessing.Process(
757
 
                target = call_pipe,
758
 
                args = (pipe[1], subprocess.call, command),
759
 
                kwargs = popen_args)
760
 
            self.checker.start()
761
 
            self.checker_callback_tag = gobject.io_add_watch(
762
 
                pipe[0].fileno(), gobject.IO_IN,
763
 
                self.checker_callback, pipe[0], command)
 
698
            try:
 
699
                logger.info("Starting checker %r for %s",
 
700
                            command, self.name)
 
701
                # We don't need to redirect stdout and stderr, since
 
702
                # in normal mode, that is already done by daemon(),
 
703
                # and in debug mode we don't want to.  (Stdin is
 
704
                # always replaced by /dev/null.)
 
705
                self.checker = subprocess.Popen(command,
 
706
                                                close_fds=True,
 
707
                                                shell=True, cwd="/")
 
708
                self.checker_callback_tag = (gobject.child_watch_add
 
709
                                             (self.checker.pid,
 
710
                                              self.checker_callback,
 
711
                                              data=command))
 
712
                # The checker may have completed before the gobject
 
713
                # watch was added.  Check for this.
 
714
                pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
 
715
                if pid:
 
716
                    gobject.source_remove(self.checker_callback_tag)
 
717
                    self.checker_callback(pid, status, command)
 
718
            except OSError as error:
 
719
                logger.error("Failed to start subprocess: %s",
 
720
                             error)
764
721
        # Re-run this periodically if run by gobject.timeout_add
765
722
        return True
766
723
    
772
729
        if getattr(self, "checker", None) is None:
773
730
            return
774
731
        logger.debug("Stopping checker for %(name)s", vars(self))
775
 
        self.checker.terminate()
 
732
        try:
 
733
            os.kill(self.checker.pid, signal.SIGTERM)
 
734
            #time.sleep(0.5)
 
735
            #if self.checker.poll() is None:
 
736
            #    os.kill(self.checker.pid, signal.SIGKILL)
 
737
        except OSError as error:
 
738
            if error.errno != errno.ESRCH: # No such process
 
739
                raise
776
740
        self.checker = None
777
741
 
778
742
 
779
 
def dbus_service_property(dbus_interface,
780
 
                          signature="v",
781
 
                          access="readwrite",
782
 
                          byte_arrays=False):
 
743
def dbus_service_property(dbus_interface, signature="v",
 
744
                          access="readwrite", byte_arrays=False):
783
745
    """Decorators for marking methods of a DBusObjectWithProperties to
784
746
    become properties on the D-Bus.
785
747
    
794
756
    # "Set" method, so we fail early here:
795
757
    if byte_arrays and signature != "ay":
796
758
        raise ValueError("Byte arrays not supported for non-'ay'"
797
 
                         " signature {!r}".format(signature))
798
 
    
 
759
                         " signature %r" % signature)
799
760
    def decorator(func):
800
761
        func._dbus_is_property = True
801
762
        func._dbus_interface = dbus_interface
806
767
            func._dbus_name = func._dbus_name[:-14]
807
768
        func._dbus_get_args_options = {'byte_arrays': byte_arrays }
808
769
        return func
809
 
    
810
 
    return decorator
811
 
 
812
 
 
813
 
def dbus_interface_annotations(dbus_interface):
814
 
    """Decorator for marking functions returning interface annotations
815
 
    
816
 
    Usage:
817
 
    
818
 
    @dbus_interface_annotations("org.example.Interface")
819
 
    def _foo(self):  # Function name does not matter
820
 
        return {"org.freedesktop.DBus.Deprecated": "true",
821
 
                "org.freedesktop.DBus.Property.EmitsChangedSignal":
822
 
                    "false"}
823
 
    """
824
 
    
825
 
    def decorator(func):
826
 
        func._dbus_is_interface = True
827
 
        func._dbus_interface = dbus_interface
828
 
        func._dbus_name = dbus_interface
829
 
        return func
830
 
    
831
 
    return decorator
832
 
 
833
 
 
834
 
def dbus_annotations(annotations):
835
 
    """Decorator to annotate D-Bus methods, signals or properties
836
 
    Usage:
837
 
    
838
 
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",
839
 
                       "org.freedesktop.DBus.Property."
840
 
                       "EmitsChangedSignal": "false"})
841
 
    @dbus_service_property("org.example.Interface", signature="b",
842
 
                           access="r")
843
 
    def Property_dbus_property(self):
844
 
        return dbus.Boolean(False)
845
 
    """
846
 
    
847
 
    def decorator(func):
848
 
        func._dbus_annotations = annotations
849
 
        return func
850
 
    
851
770
    return decorator
852
771
 
853
772
 
854
773
class DBusPropertyException(dbus.exceptions.DBusException):
855
774
    """A base class for D-Bus property-related exceptions
856
775
    """
857
 
    pass
 
776
    def __unicode__(self):
 
777
        return unicode(str(self))
858
778
 
859
779
 
860
780
class DBusPropertyAccessException(DBusPropertyException):
878
798
    """
879
799
    
880
800
    @staticmethod
881
 
    def _is_dbus_thing(thing):
882
 
        """Returns a function testing if an attribute is a D-Bus thing
883
 
        
884
 
        If called like _is_dbus_thing("method") it returns a function
885
 
        suitable for use as predicate to inspect.getmembers().
886
 
        """
887
 
        return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
888
 
                                   False)
 
801
    def _is_dbus_property(obj):
 
802
        return getattr(obj, "_dbus_is_property", False)
889
803
    
890
 
    def _get_all_dbus_things(self, thing):
 
804
    def _get_all_dbus_properties(self):
891
805
        """Returns a generator of (name, attribute) pairs
892
806
        """
893
 
        return ((getattr(athing.__get__(self), "_dbus_name", name),
894
 
                 athing.__get__(self))
 
807
        return ((prop.__get__(self)._dbus_name, prop.__get__(self))
895
808
                for cls in self.__class__.__mro__
896
 
                for name, athing in
897
 
                inspect.getmembers(cls, self._is_dbus_thing(thing)))
 
809
                for name, prop in
 
810
                inspect.getmembers(cls, self._is_dbus_property))
898
811
    
899
812
    def _get_dbus_property(self, interface_name, property_name):
900
813
        """Returns a bound method if one exists which is a D-Bus
901
814
        property with the specified name and interface.
902
815
        """
903
 
        for cls in self.__class__.__mro__:
904
 
            for name, value in inspect.getmembers(
905
 
                    cls, self._is_dbus_thing("property")):
 
816
        for cls in  self.__class__.__mro__:
 
817
            for name, value in (inspect.getmembers
 
818
                                (cls, self._is_dbus_property)):
906
819
                if (value._dbus_name == property_name
907
820
                    and value._dbus_interface == interface_name):
908
821
                    return value.__get__(self)
909
822
        
910
823
        # No such property
911
 
        raise DBusPropertyNotFound("{}:{}.{}".format(
912
 
            self.dbus_object_path, interface_name, property_name))
 
824
        raise DBusPropertyNotFound(self.dbus_object_path + ":"
 
825
                                   + interface_name + "."
 
826
                                   + property_name)
913
827
    
914
 
    @dbus.service.method(dbus.PROPERTIES_IFACE,
915
 
                         in_signature="ss",
 
828
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
916
829
                         out_signature="v")
917
830
    def Get(self, interface_name, property_name):
918
831
        """Standard D-Bus property Get() method, see D-Bus standard.
936
849
            # The byte_arrays option is not supported yet on
937
850
            # signatures other than "ay".
938
851
            if prop._dbus_signature != "ay":
939
 
                raise ValueError("Byte arrays not supported for non-"
940
 
                                 "'ay' signature {!r}"
941
 
                                 .format(prop._dbus_signature))
 
852
                raise ValueError
942
853
            value = dbus.ByteArray(b''.join(chr(byte)
943
854
                                            for byte in value))
944
855
        prop(value)
945
856
    
946
 
    @dbus.service.method(dbus.PROPERTIES_IFACE,
947
 
                         in_signature="s",
 
857
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
948
858
                         out_signature="a{sv}")
949
859
    def GetAll(self, interface_name):
950
860
        """Standard D-Bus property GetAll() method, see D-Bus
953
863
        Note: Will not include properties with access="write".
954
864
        """
955
865
        properties = {}
956
 
        for name, prop in self._get_all_dbus_things("property"):
 
866
        for name, prop in self._get_all_dbus_properties():
957
867
            if (interface_name
958
868
                and interface_name != prop._dbus_interface):
959
869
                # Interface non-empty but did not match
965
875
            if not hasattr(value, "variant_level"):
966
876
                properties[name] = value
967
877
                continue
968
 
            properties[name] = type(value)(
969
 
                value, variant_level = value.variant_level + 1)
 
878
            properties[name] = type(value)(value, variant_level=
 
879
                                           value.variant_level+1)
970
880
        return dbus.Dictionary(properties, signature="sv")
971
881
    
972
 
    @dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")
973
 
    def PropertiesChanged(self, interface_name, changed_properties,
974
 
                          invalidated_properties):
975
 
        """Standard D-Bus PropertiesChanged() signal, see D-Bus
976
 
        standard.
977
 
        """
978
 
        pass
979
 
    
980
882
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
981
883
                         out_signature="s",
982
884
                         path_keyword='object_path',
983
885
                         connection_keyword='connection')
984
886
    def Introspect(self, object_path, connection):
985
 
        """Overloading of standard D-Bus method.
986
 
        
987
 
        Inserts property tags and interface annotation tags.
 
887
        """Standard D-Bus method, overloaded to insert property tags.
988
888
        """
989
889
        xmlstring = dbus.service.Object.Introspect(self, object_path,
990
890
                                                   connection)
991
891
        try:
992
892
            document = xml.dom.minidom.parseString(xmlstring)
993
 
            
994
893
            def make_tag(document, name, prop):
995
894
                e = document.createElement("property")
996
895
                e.setAttribute("name", name)
997
896
                e.setAttribute("type", prop._dbus_signature)
998
897
                e.setAttribute("access", prop._dbus_access)
999
898
                return e
1000
 
            
1001
899
            for if_tag in document.getElementsByTagName("interface"):
1002
 
                # Add property tags
1003
900
                for tag in (make_tag(document, name, prop)
1004
901
                            for name, prop
1005
 
                            in self._get_all_dbus_things("property")
 
902
                            in self._get_all_dbus_properties()
1006
903
                            if prop._dbus_interface
1007
904
                            == if_tag.getAttribute("name")):
1008
905
                    if_tag.appendChild(tag)
1009
 
                # Add annotation tags
1010
 
                for typ in ("method", "signal", "property"):
1011
 
                    for tag in if_tag.getElementsByTagName(typ):
1012
 
                        annots = dict()
1013
 
                        for name, prop in (self.
1014
 
                                           _get_all_dbus_things(typ)):
1015
 
                            if (name == tag.getAttribute("name")
1016
 
                                and prop._dbus_interface
1017
 
                                == if_tag.getAttribute("name")):
1018
 
                                annots.update(getattr(
1019
 
                                    prop, "_dbus_annotations", {}))
1020
 
                        for name, value in annots.items():
1021
 
                            ann_tag = document.createElement(
1022
 
                                "annotation")
1023
 
                            ann_tag.setAttribute("name", name)
1024
 
                            ann_tag.setAttribute("value", value)
1025
 
                            tag.appendChild(ann_tag)
1026
 
                # Add interface annotation tags
1027
 
                for annotation, value in dict(
1028
 
                    itertools.chain.from_iterable(
1029
 
                        annotations().items()
1030
 
                        for name, annotations
1031
 
                        in self._get_all_dbus_things("interface")
1032
 
                        if name == if_tag.getAttribute("name")
1033
 
                        )).items():
1034
 
                    ann_tag = document.createElement("annotation")
1035
 
                    ann_tag.setAttribute("name", annotation)
1036
 
                    ann_tag.setAttribute("value", value)
1037
 
                    if_tag.appendChild(ann_tag)
1038
906
                # Add the names to the return values for the
1039
907
                # "org.freedesktop.DBus.Properties" methods
1040
908
                if (if_tag.getAttribute("name")
1055
923
        except (AttributeError, xml.dom.DOMException,
1056
924
                xml.parsers.expat.ExpatError) as error:
1057
925
            logger.error("Failed to override Introspection method",
1058
 
                         exc_info=error)
 
926
                         error)
1059
927
        return xmlstring
1060
928
 
1061
929
 
1062
 
def datetime_to_dbus(dt, variant_level=0):
 
930
def datetime_to_dbus (dt, variant_level=0):
1063
931
    """Convert a UTC datetime.datetime() to a D-Bus type."""
1064
932
    if dt is None:
1065
933
        return dbus.String("", variant_level = variant_level)
1066
 
    return dbus.String(dt.isoformat(), variant_level=variant_level)
1067
 
 
1068
 
 
1069
 
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
1070
 
    """A class decorator; applied to a subclass of
1071
 
    dbus.service.Object, it will add alternate D-Bus attributes with
1072
 
    interface names according to the "alt_interface_names" mapping.
1073
 
    Usage:
1074
 
    
1075
 
    @alternate_dbus_interfaces({"org.example.Interface":
1076
 
                                    "net.example.AlternateInterface"})
1077
 
    class SampleDBusObject(dbus.service.Object):
1078
 
        @dbus.service.method("org.example.Interface")
1079
 
        def SampleDBusMethod():
1080
 
            pass
1081
 
    
1082
 
    The above "SampleDBusMethod" on "SampleDBusObject" will be
1083
 
    reachable via two interfaces: "org.example.Interface" and
1084
 
    "net.example.AlternateInterface", the latter of which will have
1085
 
    its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
1086
 
    "true", unless "deprecate" is passed with a False value.
1087
 
    
1088
 
    This works for methods and signals, and also for D-Bus properties
1089
 
    (from DBusObjectWithProperties) and interfaces (from the
1090
 
    dbus_interface_annotations decorator).
 
934
    return dbus.String(dt.isoformat(),
 
935
                       variant_level=variant_level)
 
936
 
 
937
 
 
938
class AlternateDBusNamesMetaclass(DBusObjectWithProperties
 
939
                                  .__metaclass__):
 
940
    """Applied to an empty subclass of a D-Bus object, this metaclass
 
941
    will add additional D-Bus attributes matching a certain pattern.
1091
942
    """
1092
 
    
1093
 
    def wrapper(cls):
1094
 
        for orig_interface_name, alt_interface_name in (
1095
 
                alt_interface_names.items()):
1096
 
            attr = {}
1097
 
            interface_names = set()
1098
 
            # Go though all attributes of the class
1099
 
            for attrname, attribute in inspect.getmembers(cls):
 
943
    def __new__(mcs, name, bases, attr):
 
944
        # Go through all the base classes which could have D-Bus
 
945
        # methods, signals, or properties in them
 
946
        for base in (b for b in bases
 
947
                     if issubclass(b, dbus.service.Object)):
 
948
            # Go though all attributes of the base class
 
949
            for attrname, attribute in inspect.getmembers(base):
1100
950
                # Ignore non-D-Bus attributes, and D-Bus attributes
1101
951
                # with the wrong interface name
1102
952
                if (not hasattr(attribute, "_dbus_interface")
1103
 
                    or not attribute._dbus_interface.startswith(
1104
 
                        orig_interface_name)):
 
953
                    or not attribute._dbus_interface
 
954
                    .startswith("se.recompile.Mandos")):
1105
955
                    continue
1106
956
                # Create an alternate D-Bus interface name based on
1107
957
                # the current name
1108
 
                alt_interface = attribute._dbus_interface.replace(
1109
 
                    orig_interface_name, alt_interface_name)
1110
 
                interface_names.add(alt_interface)
 
958
                alt_interface = (attribute._dbus_interface
 
959
                                 .replace("se.recompile.Mandos",
 
960
                                          "se.bsnet.fukt.Mandos"))
1111
961
                # Is this a D-Bus signal?
1112
962
                if getattr(attribute, "_dbus_is_signal", False):
1113
 
                    if sys.version_info.major == 2:
1114
 
                        # Extract the original non-method undecorated
1115
 
                        # function by black magic
1116
 
                        nonmethod_func = (dict(
 
963
                    # Extract the original non-method function by
 
964
                    # black magic
 
965
                    nonmethod_func = (dict(
1117
966
                            zip(attribute.func_code.co_freevars,
1118
 
                                attribute.__closure__))
1119
 
                                          ["func"].cell_contents)
1120
 
                    else:
1121
 
                        nonmethod_func = attribute
 
967
                                attribute.__closure__))["func"]
 
968
                                      .cell_contents)
1122
969
                    # Create a new, but exactly alike, function
1123
970
                    # object, and decorate it to be a new D-Bus signal
1124
971
                    # with the alternate D-Bus interface name
1125
 
                    if sys.version_info.major == 2:
1126
 
                        new_function = types.FunctionType(
1127
 
                            nonmethod_func.func_code,
1128
 
                            nonmethod_func.func_globals,
1129
 
                            nonmethod_func.func_name,
1130
 
                            nonmethod_func.func_defaults,
1131
 
                            nonmethod_func.func_closure)
1132
 
                    else:
1133
 
                        new_function = types.FunctionType(
1134
 
                            nonmethod_func.__code__,
1135
 
                            nonmethod_func.__globals__,
1136
 
                            nonmethod_func.__name__,
1137
 
                            nonmethod_func.__defaults__,
1138
 
                            nonmethod_func.__closure__)
1139
 
                    new_function = (dbus.service.signal(
1140
 
                        alt_interface,
1141
 
                        attribute._dbus_signature)(new_function))
1142
 
                    # Copy annotations, if any
1143
 
                    try:
1144
 
                        new_function._dbus_annotations = dict(
1145
 
                            attribute._dbus_annotations)
1146
 
                    except AttributeError:
1147
 
                        pass
 
972
                    new_function = (dbus.service.signal
 
973
                                    (alt_interface,
 
974
                                     attribute._dbus_signature)
 
975
                                    (types.FunctionType(
 
976
                                nonmethod_func.func_code,
 
977
                                nonmethod_func.func_globals,
 
978
                                nonmethod_func.func_name,
 
979
                                nonmethod_func.func_defaults,
 
980
                                nonmethod_func.func_closure)))
1148
981
                    # Define a creator of a function to call both the
1149
 
                    # original and alternate functions, so both the
1150
 
                    # original and alternate signals gets sent when
1151
 
                    # the function is called
 
982
                    # old and new functions, so both the old and new
 
983
                    # signals gets sent when the function is called
1152
984
                    def fixscope(func1, func2):
1153
985
                        """This function is a scope container to pass
1154
986
                        func1 and func2 to the "call_both" function
1155
987
                        outside of its arguments"""
1156
 
                        
1157
988
                        def call_both(*args, **kwargs):
1158
989
                            """This function will emit two D-Bus
1159
990
                            signals by calling func1 and func2"""
1160
991
                            func1(*args, **kwargs)
1161
992
                            func2(*args, **kwargs)
1162
 
                        
1163
993
                        return call_both
1164
994
                    # Create the "call_both" function and add it to
1165
995
                    # the class
1166
 
                    attr[attrname] = fixscope(attribute, new_function)
 
996
                    attr[attrname] = fixscope(attribute,
 
997
                                              new_function)
1167
998
                # Is this a D-Bus method?
1168
999
                elif getattr(attribute, "_dbus_is_method", False):
1169
1000
                    # Create a new, but exactly alike, function
1170
1001
                    # object.  Decorate it to be a new D-Bus method
1171
1002
                    # with the alternate D-Bus interface name.  Add it
1172
1003
                    # to the class.
1173
 
                    attr[attrname] = (
1174
 
                        dbus.service.method(
1175
 
                            alt_interface,
1176
 
                            attribute._dbus_in_signature,
1177
 
                            attribute._dbus_out_signature)
1178
 
                        (types.FunctionType(attribute.func_code,
1179
 
                                            attribute.func_globals,
1180
 
                                            attribute.func_name,
1181
 
                                            attribute.func_defaults,
1182
 
                                            attribute.func_closure)))
1183
 
                    # Copy annotations, if any
1184
 
                    try:
1185
 
                        attr[attrname]._dbus_annotations = dict(
1186
 
                            attribute._dbus_annotations)
1187
 
                    except AttributeError:
1188
 
                        pass
 
1004
                    attr[attrname] = (dbus.service.method
 
1005
                                      (alt_interface,
 
1006
                                       attribute._dbus_in_signature,
 
1007
                                       attribute._dbus_out_signature)
 
1008
                                      (types.FunctionType
 
1009
                                       (attribute.func_code,
 
1010
                                        attribute.func_globals,
 
1011
                                        attribute.func_name,
 
1012
                                        attribute.func_defaults,
 
1013
                                        attribute.func_closure)))
1189
1014
                # Is this a D-Bus property?
1190
1015
                elif getattr(attribute, "_dbus_is_property", False):
1191
1016
                    # Create a new, but exactly alike, function
1192
1017
                    # object, and decorate it to be a new D-Bus
1193
1018
                    # property with the alternate D-Bus interface
1194
1019
                    # name.  Add it to the class.
1195
 
                    attr[attrname] = (dbus_service_property(
1196
 
                        alt_interface, attribute._dbus_signature,
1197
 
                        attribute._dbus_access,
1198
 
                        attribute._dbus_get_args_options
1199
 
                        ["byte_arrays"])
1200
 
                                      (types.FunctionType(
1201
 
                                          attribute.func_code,
1202
 
                                          attribute.func_globals,
1203
 
                                          attribute.func_name,
1204
 
                                          attribute.func_defaults,
1205
 
                                          attribute.func_closure)))
1206
 
                    # Copy annotations, if any
1207
 
                    try:
1208
 
                        attr[attrname]._dbus_annotations = dict(
1209
 
                            attribute._dbus_annotations)
1210
 
                    except AttributeError:
1211
 
                        pass
1212
 
                # Is this a D-Bus interface?
1213
 
                elif getattr(attribute, "_dbus_is_interface", False):
1214
 
                    # Create a new, but exactly alike, function
1215
 
                    # object.  Decorate it to be a new D-Bus interface
1216
 
                    # with the alternate D-Bus interface name.  Add it
1217
 
                    # to the class.
1218
 
                    attr[attrname] = (
1219
 
                        dbus_interface_annotations(alt_interface)
1220
 
                        (types.FunctionType(attribute.func_code,
1221
 
                                            attribute.func_globals,
1222
 
                                            attribute.func_name,
1223
 
                                            attribute.func_defaults,
1224
 
                                            attribute.func_closure)))
1225
 
            if deprecate:
1226
 
                # Deprecate all alternate interfaces
1227
 
                iname="_AlternateDBusNames_interface_annotation{}"
1228
 
                for interface_name in interface_names:
1229
 
                    
1230
 
                    @dbus_interface_annotations(interface_name)
1231
 
                    def func(self):
1232
 
                        return { "org.freedesktop.DBus.Deprecated":
1233
 
                                 "true" }
1234
 
                    # Find an unused name
1235
 
                    for aname in (iname.format(i)
1236
 
                                  for i in itertools.count()):
1237
 
                        if aname not in attr:
1238
 
                            attr[aname] = func
1239
 
                            break
1240
 
            if interface_names:
1241
 
                # Replace the class with a new subclass of it with
1242
 
                # methods, signals, etc. as created above.
1243
 
                cls = type(b"{}Alternate".format(cls.__name__),
1244
 
                           (cls, ), attr)
1245
 
        return cls
1246
 
    
1247
 
    return wrapper
1248
 
 
1249
 
 
1250
 
@alternate_dbus_interfaces({"se.recompile.Mandos":
1251
 
                            "se.bsnet.fukt.Mandos"})
 
1020
                    attr[attrname] = (dbus_service_property
 
1021
                                      (alt_interface,
 
1022
                                       attribute._dbus_signature,
 
1023
                                       attribute._dbus_access,
 
1024
                                       attribute
 
1025
                                       ._dbus_get_args_options
 
1026
                                       ["byte_arrays"])
 
1027
                                      (types.FunctionType
 
1028
                                       (attribute.func_code,
 
1029
                                        attribute.func_globals,
 
1030
                                        attribute.func_name,
 
1031
                                        attribute.func_defaults,
 
1032
                                        attribute.func_closure)))
 
1033
        return type.__new__(mcs, name, bases, attr)
 
1034
 
 
1035
 
1252
1036
class ClientDBus(Client, DBusObjectWithProperties):
1253
1037
    """A Client class using D-Bus
1254
1038
    
1258
1042
    """
1259
1043
    
1260
1044
    runtime_expansions = (Client.runtime_expansions
1261
 
                          + ("dbus_object_path", ))
1262
 
    
1263
 
    _interface = "se.recompile.Mandos.Client"
 
1045
                          + ("dbus_object_path",))
1264
1046
    
1265
1047
    # dbus.service.Object doesn't use super(), so we can't either.
1266
1048
    
1267
1049
    def __init__(self, bus = None, *args, **kwargs):
1268
1050
        self.bus = bus
1269
1051
        Client.__init__(self, *args, **kwargs)
 
1052
        self._approvals_pending = 0
 
1053
        
 
1054
        self._approvals_pending = 0
1270
1055
        # Only now, when this client is initialized, can it show up on
1271
1056
        # the D-Bus
1272
 
        client_object_name = str(self.name).translate(
 
1057
        client_object_name = unicode(self.name).translate(
1273
1058
            {ord("."): ord("_"),
1274
1059
             ord("-"): ord("_")})
1275
 
        self.dbus_object_path = dbus.ObjectPath(
1276
 
            "/clients/" + client_object_name)
 
1060
        self.dbus_object_path = (dbus.ObjectPath
 
1061
                                 ("/clients/" + client_object_name))
1277
1062
        DBusObjectWithProperties.__init__(self, self.bus,
1278
1063
                                          self.dbus_object_path)
1279
 
    
1280
 
    def notifychangeproperty(transform_func, dbus_name,
1281
 
                             type_func=lambda x: x,
1282
 
                             variant_level=1,
1283
 
                             invalidate_only=False,
1284
 
                             _interface=_interface):
 
1064
        
 
1065
    def notifychangeproperty(transform_func,
 
1066
                             dbus_name, type_func=lambda x: x,
 
1067
                             variant_level=1):
1285
1068
        """ Modify a variable so that it's a property which announces
1286
1069
        its changes to DBus.
1287
1070
        
1292
1075
                   to the D-Bus.  Default: no transform
1293
1076
        variant_level: D-Bus variant level.  Default: 1
1294
1077
        """
1295
 
        attrname = "_{}".format(dbus_name)
1296
 
        
 
1078
        attrname = "_{0}".format(dbus_name)
1297
1079
        def setter(self, value):
1298
1080
            if hasattr(self, "dbus_object_path"):
1299
1081
                if (not hasattr(self, attrname) or
1300
1082
                    type_func(getattr(self, attrname, None))
1301
1083
                    != type_func(value)):
1302
 
                    if invalidate_only:
1303
 
                        self.PropertiesChanged(
1304
 
                            _interface, dbus.Dictionary(),
1305
 
                            dbus.Array((dbus_name, )))
1306
 
                    else:
1307
 
                        dbus_value = transform_func(
1308
 
                            type_func(value),
1309
 
                            variant_level = variant_level)
1310
 
                        self.PropertyChanged(dbus.String(dbus_name),
1311
 
                                             dbus_value)
1312
 
                        self.PropertiesChanged(
1313
 
                            _interface,
1314
 
                            dbus.Dictionary({ dbus.String(dbus_name):
1315
 
                                              dbus_value }),
1316
 
                            dbus.Array())
 
1084
                    dbus_value = transform_func(type_func(value),
 
1085
                                                variant_level
 
1086
                                                =variant_level)
 
1087
                    self.PropertyChanged(dbus.String(dbus_name),
 
1088
                                         dbus_value)
1317
1089
            setattr(self, attrname, value)
1318
1090
        
1319
1091
        return property(lambda self: getattr(self, attrname), setter)
1320
1092
    
 
1093
    
1321
1094
    expires = notifychangeproperty(datetime_to_dbus, "Expires")
1322
1095
    approvals_pending = notifychangeproperty(dbus.Boolean,
1323
1096
                                             "ApprovalPending",
1325
1098
    enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1326
1099
    last_enabled = notifychangeproperty(datetime_to_dbus,
1327
1100
                                        "LastEnabled")
1328
 
    checker = notifychangeproperty(
1329
 
        dbus.Boolean, "CheckerRunning",
1330
 
        type_func = lambda checker: checker is not None)
 
1101
    checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",
 
1102
                                   type_func = lambda checker:
 
1103
                                       checker is not None)
1331
1104
    last_checked_ok = notifychangeproperty(datetime_to_dbus,
1332
1105
                                           "LastCheckedOK")
1333
 
    last_checker_status = notifychangeproperty(dbus.Int16,
1334
 
                                               "LastCheckerStatus")
1335
1106
    last_approval_request = notifychangeproperty(
1336
1107
        datetime_to_dbus, "LastApprovalRequest")
1337
1108
    approved_by_default = notifychangeproperty(dbus.Boolean,
1338
1109
                                               "ApprovedByDefault")
1339
 
    approval_delay = notifychangeproperty(
1340
 
        dbus.UInt64, "ApprovalDelay",
1341
 
        type_func = lambda td: td.total_seconds() * 1000)
 
1110
    approval_delay = notifychangeproperty(dbus.UInt64,
 
1111
                                          "ApprovalDelay",
 
1112
                                          type_func =
 
1113
                                          timedelta_to_milliseconds)
1342
1114
    approval_duration = notifychangeproperty(
1343
1115
        dbus.UInt64, "ApprovalDuration",
1344
 
        type_func = lambda td: td.total_seconds() * 1000)
 
1116
        type_func = timedelta_to_milliseconds)
1345
1117
    host = notifychangeproperty(dbus.String, "Host")
1346
 
    timeout = notifychangeproperty(
1347
 
        dbus.UInt64, "Timeout",
1348
 
        type_func = lambda td: td.total_seconds() * 1000)
 
1118
    timeout = notifychangeproperty(dbus.UInt64, "Timeout",
 
1119
                                   type_func =
 
1120
                                   timedelta_to_milliseconds)
1349
1121
    extended_timeout = notifychangeproperty(
1350
1122
        dbus.UInt64, "ExtendedTimeout",
1351
 
        type_func = lambda td: td.total_seconds() * 1000)
1352
 
    interval = notifychangeproperty(
1353
 
        dbus.UInt64, "Interval",
1354
 
        type_func = lambda td: td.total_seconds() * 1000)
 
1123
        type_func = timedelta_to_milliseconds)
 
1124
    interval = notifychangeproperty(dbus.UInt64,
 
1125
                                    "Interval",
 
1126
                                    type_func =
 
1127
                                    timedelta_to_milliseconds)
1355
1128
    checker_command = notifychangeproperty(dbus.String, "Checker")
1356
 
    secret = notifychangeproperty(dbus.ByteArray, "Secret",
1357
 
                                  invalidate_only=True)
1358
1129
    
1359
1130
    del notifychangeproperty
1360
1131
    
1367
1138
            DBusObjectWithProperties.__del__(self, *args, **kwargs)
1368
1139
        Client.__del__(self, *args, **kwargs)
1369
1140
    
1370
 
    def checker_callback(self, source, condition,
1371
 
                         connection, command, *args, **kwargs):
1372
 
        ret = Client.checker_callback(self, source, condition,
1373
 
                                      connection, command, *args,
1374
 
                                      **kwargs)
1375
 
        exitstatus = self.last_checker_status
1376
 
        if exitstatus >= 0:
 
1141
    def checker_callback(self, pid, condition, command,
 
1142
                         *args, **kwargs):
 
1143
        self.checker_callback_tag = None
 
1144
        self.checker = None
 
1145
        if os.WIFEXITED(condition):
 
1146
            exitstatus = os.WEXITSTATUS(condition)
1377
1147
            # Emit D-Bus signal
1378
1148
            self.CheckerCompleted(dbus.Int16(exitstatus),
1379
 
                                  dbus.Int64(0),
 
1149
                                  dbus.Int64(condition),
1380
1150
                                  dbus.String(command))
1381
1151
        else:
1382
1152
            # Emit D-Bus signal
1383
1153
            self.CheckerCompleted(dbus.Int16(-1),
1384
 
                                  dbus.Int64(
1385
 
                                      self.last_checker_signal),
 
1154
                                  dbus.Int64(condition),
1386
1155
                                  dbus.String(command))
1387
 
        return ret
 
1156
        
 
1157
        return Client.checker_callback(self, pid, condition, command,
 
1158
                                       *args, **kwargs)
1388
1159
    
1389
1160
    def start_checker(self, *args, **kwargs):
1390
 
        old_checker_pid = getattr(self.checker, "pid", None)
 
1161
        old_checker = self.checker
 
1162
        if self.checker is not None:
 
1163
            old_checker_pid = self.checker.pid
 
1164
        else:
 
1165
            old_checker_pid = None
1391
1166
        r = Client.start_checker(self, *args, **kwargs)
1392
1167
        # Only if new checker process was started
1393
1168
        if (self.checker is not None
1401
1176
        return False
1402
1177
    
1403
1178
    def approve(self, value=True):
 
1179
        self.send_changedstate()
1404
1180
        self.approved = value
1405
 
        gobject.timeout_add(int(self.approval_duration.total_seconds()
1406
 
                                * 1000), self._reset_approved)
1407
 
        self.send_changedstate()
 
1181
        gobject.timeout_add(timedelta_to_milliseconds
 
1182
                            (self.approval_duration),
 
1183
                            self._reset_approved)
 
1184
    
1408
1185
    
1409
1186
    ## D-Bus methods, signals & properties
1410
 
    
1411
 
    ## Interfaces
 
1187
    _interface = "se.recompile.Mandos.Client"
1412
1188
    
1413
1189
    ## Signals
1414
1190
    
1425
1201
        pass
1426
1202
    
1427
1203
    # PropertyChanged - signal
1428
 
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1429
1204
    @dbus.service.signal(_interface, signature="sv")
1430
1205
    def PropertyChanged(self, property, value):
1431
1206
        "D-Bus signal"
1452
1227
        "D-Bus signal"
1453
1228
        return self.need_approval()
1454
1229
    
 
1230
    # NeRwequest - signal
 
1231
    @dbus.service.signal(_interface, signature="s")
 
1232
    def NewRequest(self, ip):
 
1233
        """D-Bus signal
 
1234
        Is sent after a client request a password.
 
1235
        """
 
1236
        pass
 
1237
    
1455
1238
    ## Methods
1456
1239
    
1457
1240
    # Approve - method
1495
1278
        return dbus.Boolean(bool(self.approvals_pending))
1496
1279
    
1497
1280
    # ApprovedByDefault - property
1498
 
    @dbus_service_property(_interface,
1499
 
                           signature="b",
 
1281
    @dbus_service_property(_interface, signature="b",
1500
1282
                           access="readwrite")
1501
1283
    def ApprovedByDefault_dbus_property(self, value=None):
1502
1284
        if value is None:       # get
1504
1286
        self.approved_by_default = bool(value)
1505
1287
    
1506
1288
    # ApprovalDelay - property
1507
 
    @dbus_service_property(_interface,
1508
 
                           signature="t",
 
1289
    @dbus_service_property(_interface, signature="t",
1509
1290
                           access="readwrite")
1510
1291
    def ApprovalDelay_dbus_property(self, value=None):
1511
1292
        if value is None:       # get
1512
 
            return dbus.UInt64(self.approval_delay.total_seconds()
1513
 
                               * 1000)
 
1293
            return dbus.UInt64(self.approval_delay_milliseconds())
1514
1294
        self.approval_delay = datetime.timedelta(0, 0, 0, value)
1515
1295
    
1516
1296
    # ApprovalDuration - property
1517
 
    @dbus_service_property(_interface,
1518
 
                           signature="t",
 
1297
    @dbus_service_property(_interface, signature="t",
1519
1298
                           access="readwrite")
1520
1299
    def ApprovalDuration_dbus_property(self, value=None):
1521
1300
        if value is None:       # get
1522
 
            return dbus.UInt64(self.approval_duration.total_seconds()
1523
 
                               * 1000)
 
1301
            return dbus.UInt64(timedelta_to_milliseconds(
 
1302
                    self.approval_duration))
1524
1303
        self.approval_duration = datetime.timedelta(0, 0, 0, value)
1525
1304
    
1526
1305
    # Name - property
1534
1313
        return dbus.String(self.fingerprint)
1535
1314
    
1536
1315
    # Host - property
1537
 
    @dbus_service_property(_interface,
1538
 
                           signature="s",
 
1316
    @dbus_service_property(_interface, signature="s",
1539
1317
                           access="readwrite")
1540
1318
    def Host_dbus_property(self, value=None):
1541
1319
        if value is None:       # get
1542
1320
            return dbus.String(self.host)
1543
 
        self.host = str(value)
 
1321
        self.host = unicode(value)
1544
1322
    
1545
1323
    # Created - property
1546
1324
    @dbus_service_property(_interface, signature="s", access="read")
1553
1331
        return datetime_to_dbus(self.last_enabled)
1554
1332
    
1555
1333
    # Enabled - property
1556
 
    @dbus_service_property(_interface,
1557
 
                           signature="b",
 
1334
    @dbus_service_property(_interface, signature="b",
1558
1335
                           access="readwrite")
1559
1336
    def Enabled_dbus_property(self, value=None):
1560
1337
        if value is None:       # get
1565
1342
            self.disable()
1566
1343
    
1567
1344
    # LastCheckedOK - property
1568
 
    @dbus_service_property(_interface,
1569
 
                           signature="s",
 
1345
    @dbus_service_property(_interface, signature="s",
1570
1346
                           access="readwrite")
1571
1347
    def LastCheckedOK_dbus_property(self, value=None):
1572
1348
        if value is not None:
1574
1350
            return
1575
1351
        return datetime_to_dbus(self.last_checked_ok)
1576
1352
    
1577
 
    # LastCheckerStatus - property
1578
 
    @dbus_service_property(_interface, signature="n", access="read")
1579
 
    def LastCheckerStatus_dbus_property(self):
1580
 
        return dbus.Int16(self.last_checker_status)
1581
 
    
1582
1353
    # Expires - property
1583
1354
    @dbus_service_property(_interface, signature="s", access="read")
1584
1355
    def Expires_dbus_property(self):
1590
1361
        return datetime_to_dbus(self.last_approval_request)
1591
1362
    
1592
1363
    # Timeout - property
1593
 
    @dbus_service_property(_interface,
1594
 
                           signature="t",
 
1364
    @dbus_service_property(_interface, signature="t",
1595
1365
                           access="readwrite")
1596
1366
    def Timeout_dbus_property(self, value=None):
1597
1367
        if value is None:       # get
1598
 
            return dbus.UInt64(self.timeout.total_seconds() * 1000)
1599
 
        old_timeout = self.timeout
 
1368
            return dbus.UInt64(self.timeout_milliseconds())
1600
1369
        self.timeout = datetime.timedelta(0, 0, 0, value)
1601
 
        # Reschedule disabling
 
1370
        # Reschedule timeout
1602
1371
        if self.enabled:
1603
1372
            now = datetime.datetime.utcnow()
1604
 
            self.expires += self.timeout - old_timeout
1605
 
            if self.expires <= now:
 
1373
            time_to_die = timedelta_to_milliseconds(
 
1374
                (self.last_checked_ok + self.timeout) - now)
 
1375
            if time_to_die <= 0:
1606
1376
                # The timeout has passed
1607
1377
                self.disable()
1608
1378
            else:
 
1379
                self.expires = (now +
 
1380
                                datetime.timedelta(milliseconds =
 
1381
                                                   time_to_die))
1609
1382
                if (getattr(self, "disable_initiator_tag", None)
1610
1383
                    is None):
1611
1384
                    return
1612
1385
                gobject.source_remove(self.disable_initiator_tag)
1613
 
                self.disable_initiator_tag = gobject.timeout_add(
1614
 
                    int((self.expires - now).total_seconds() * 1000),
1615
 
                    self.disable)
 
1386
                self.disable_initiator_tag = (gobject.timeout_add
 
1387
                                              (time_to_die,
 
1388
                                               self.disable))
1616
1389
    
1617
1390
    # ExtendedTimeout - property
1618
 
    @dbus_service_property(_interface,
1619
 
                           signature="t",
 
1391
    @dbus_service_property(_interface, signature="t",
1620
1392
                           access="readwrite")
1621
1393
    def ExtendedTimeout_dbus_property(self, value=None):
1622
1394
        if value is None:       # get
1623
 
            return dbus.UInt64(self.extended_timeout.total_seconds()
1624
 
                               * 1000)
 
1395
            return dbus.UInt64(self.extended_timeout_milliseconds())
1625
1396
        self.extended_timeout = datetime.timedelta(0, 0, 0, value)
1626
1397
    
1627
1398
    # Interval - property
1628
 
    @dbus_service_property(_interface,
1629
 
                           signature="t",
 
1399
    @dbus_service_property(_interface, signature="t",
1630
1400
                           access="readwrite")
1631
1401
    def Interval_dbus_property(self, value=None):
1632
1402
        if value is None:       # get
1633
 
            return dbus.UInt64(self.interval.total_seconds() * 1000)
 
1403
            return dbus.UInt64(self.interval_milliseconds())
1634
1404
        self.interval = datetime.timedelta(0, 0, 0, value)
1635
1405
        if getattr(self, "checker_initiator_tag", None) is None:
1636
1406
            return
1637
1407
        if self.enabled:
1638
1408
            # Reschedule checker run
1639
1409
            gobject.source_remove(self.checker_initiator_tag)
1640
 
            self.checker_initiator_tag = gobject.timeout_add(
1641
 
                value, self.start_checker)
1642
 
            self.start_checker() # Start one now, too
 
1410
            self.checker_initiator_tag = (gobject.timeout_add
 
1411
                                          (value, self.start_checker))
 
1412
            self.start_checker()    # Start one now, too
1643
1413
    
1644
1414
    # Checker - property
1645
 
    @dbus_service_property(_interface,
1646
 
                           signature="s",
 
1415
    @dbus_service_property(_interface, signature="s",
1647
1416
                           access="readwrite")
1648
1417
    def Checker_dbus_property(self, value=None):
1649
1418
        if value is None:       # get
1650
1419
            return dbus.String(self.checker_command)
1651
 
        self.checker_command = str(value)
 
1420
        self.checker_command = unicode(value)
1652
1421
    
1653
1422
    # CheckerRunning - property
1654
 
    @dbus_service_property(_interface,
1655
 
                           signature="b",
 
1423
    @dbus_service_property(_interface, signature="b",
1656
1424
                           access="readwrite")
1657
1425
    def CheckerRunning_dbus_property(self, value=None):
1658
1426
        if value is None:       # get
1668
1436
        return self.dbus_object_path # is already a dbus.ObjectPath
1669
1437
    
1670
1438
    # Secret = property
1671
 
    @dbus_service_property(_interface,
1672
 
                           signature="ay",
1673
 
                           access="write",
1674
 
                           byte_arrays=True)
 
1439
    @dbus_service_property(_interface, signature="ay",
 
1440
                           access="write", byte_arrays=True)
1675
1441
    def Secret_dbus_property(self, value):
1676
 
        self.secret = bytes(value)
 
1442
        self.secret = str(value)
1677
1443
    
1678
1444
    del _interface
1679
1445
 
1683
1449
        self._pipe = child_pipe
1684
1450
        self._pipe.send(('init', fpr, address))
1685
1451
        if not self._pipe.recv():
1686
 
            raise KeyError(fpr)
 
1452
            raise KeyError()
1687
1453
    
1688
1454
    def __getattribute__(self, name):
1689
1455
        if name == '_pipe':
1693
1459
        if data[0] == 'data':
1694
1460
            return data[1]
1695
1461
        if data[0] == 'function':
1696
 
            
1697
1462
            def func(*args, **kwargs):
1698
1463
                self._pipe.send(('funcall', name, args, kwargs))
1699
1464
                return self._pipe.recv()[1]
1700
 
            
1701
1465
            return func
1702
1466
    
1703
1467
    def __setattr__(self, name, value):
1706
1470
        self._pipe.send(('setattr', name, value))
1707
1471
 
1708
1472
 
 
1473
class ClientDBusTransitional(ClientDBus):
 
1474
    __metaclass__ = AlternateDBusNamesMetaclass
 
1475
 
 
1476
 
1709
1477
class ClientHandler(socketserver.BaseRequestHandler, object):
1710
1478
    """A class to handle client connections.
1711
1479
    
1715
1483
    def handle(self):
1716
1484
        with contextlib.closing(self.server.child_pipe) as child_pipe:
1717
1485
            logger.info("TCP connection from: %s",
1718
 
                        str(self.client_address))
 
1486
                        unicode(self.client_address))
1719
1487
            logger.debug("Pipe FD: %d",
1720
1488
                         self.server.child_pipe.fileno())
1721
1489
            
1722
 
            session = gnutls.connection.ClientSession(
1723
 
                self.request, gnutls.connection .X509Credentials())
 
1490
            session = (gnutls.connection
 
1491
                       .ClientSession(self.request,
 
1492
                                      gnutls.connection
 
1493
                                      .X509Credentials()))
1724
1494
            
1725
1495
            # Note: gnutls.connection.X509Credentials is really a
1726
1496
            # generic GnuTLS certificate credentials object so long as
1735
1505
            priority = self.server.gnutls_priority
1736
1506
            if priority is None:
1737
1507
                priority = "NORMAL"
1738
 
            gnutls.library.functions.gnutls_priority_set_direct(
1739
 
                session._c_object, priority, None)
 
1508
            (gnutls.library.functions
 
1509
             .gnutls_priority_set_direct(session._c_object,
 
1510
                                         priority, None))
1740
1511
            
1741
1512
            # Start communication using the Mandos protocol
1742
1513
            # Get protocol number
1744
1515
            logger.debug("Protocol version: %r", line)
1745
1516
            try:
1746
1517
                if int(line.strip().split()[0]) > 1:
1747
 
                    raise RuntimeError(line)
 
1518
                    raise RuntimeError
1748
1519
            except (ValueError, IndexError, RuntimeError) as error:
1749
1520
                logger.error("Unknown protocol version: %s", error)
1750
1521
                return
1762
1533
            approval_required = False
1763
1534
            try:
1764
1535
                try:
1765
 
                    fpr = self.fingerprint(
1766
 
                        self.peer_certificate(session))
 
1536
                    fpr = self.fingerprint(self.peer_certificate
 
1537
                                           (session))
1767
1538
                except (TypeError,
1768
1539
                        gnutls.errors.GNUTLSError) as error:
1769
1540
                    logger.warning("Bad certificate: %s", error)
1776
1547
                except KeyError:
1777
1548
                    return
1778
1549
                
 
1550
                if self.server.use_dbus:
 
1551
                    # Emit D-Bus signal
 
1552
                    client.NewRequest(str(self.client_address))
 
1553
                
1779
1554
                if client.approval_delay:
1780
1555
                    delay = client.approval_delay
1781
1556
                    client.approvals_pending += 1
1784
1559
                while True:
1785
1560
                    if not client.enabled:
1786
1561
                        logger.info("Client %s is disabled",
1787
 
                                    client.name)
 
1562
                                       client.name)
1788
1563
                        if self.server.use_dbus:
1789
1564
                            # Emit D-Bus signal
1790
1565
                            client.Rejected("Disabled")
1799
1574
                        if self.server.use_dbus:
1800
1575
                            # Emit D-Bus signal
1801
1576
                            client.NeedApproval(
1802
 
                                client.approval_delay.total_seconds()
1803
 
                                * 1000, client.approved_by_default)
 
1577
                                client.approval_delay_milliseconds(),
 
1578
                                client.approved_by_default)
1804
1579
                    else:
1805
1580
                        logger.warning("Client %s was not approved",
1806
1581
                                       client.name)
1812
1587
                    #wait until timeout or approved
1813
1588
                    time = datetime.datetime.now()
1814
1589
                    client.changedstate.acquire()
1815
 
                    client.changedstate.wait(delay.total_seconds())
 
1590
                    (client.changedstate.wait
 
1591
                     (float(client.timedelta_to_milliseconds(delay)
 
1592
                            / 1000)))
1816
1593
                    client.changedstate.release()
1817
1594
                    time2 = datetime.datetime.now()
1818
1595
                    if (time2 - time) >= delay:
1834
1611
                    try:
1835
1612
                        sent = session.send(client.secret[sent_size:])
1836
1613
                    except gnutls.errors.GNUTLSError as error:
1837
 
                        logger.warning("gnutls send failed",
1838
 
                                       exc_info=error)
 
1614
                        logger.warning("gnutls send failed")
1839
1615
                        return
1840
 
                    logger.debug("Sent: %d, remaining: %d", sent,
1841
 
                                 len(client.secret) - (sent_size
1842
 
                                                       + sent))
 
1616
                    logger.debug("Sent: %d, remaining: %d",
 
1617
                                 sent, len(client.secret)
 
1618
                                 - (sent_size + sent))
1843
1619
                    sent_size += sent
1844
1620
                
1845
1621
                logger.info("Sending secret to %s", client.name)
1846
1622
                # bump the timeout using extended_timeout
1847
 
                client.bump_timeout(client.extended_timeout)
 
1623
                client.checked_ok(client.extended_timeout)
1848
1624
                if self.server.use_dbus:
1849
1625
                    # Emit D-Bus signal
1850
1626
                    client.GotSecret()
1855
1631
                try:
1856
1632
                    session.bye()
1857
1633
                except gnutls.errors.GNUTLSError as error:
1858
 
                    logger.warning("GnuTLS bye failed",
1859
 
                                   exc_info=error)
 
1634
                    logger.warning("GnuTLS bye failed")
1860
1635
    
1861
1636
    @staticmethod
1862
1637
    def peer_certificate(session):
1863
1638
        "Return the peer's OpenPGP certificate as a bytestring"
1864
1639
        # If not an OpenPGP certificate...
1865
 
        if (gnutls.library.functions.gnutls_certificate_type_get(
1866
 
                session._c_object)
 
1640
        if (gnutls.library.functions
 
1641
            .gnutls_certificate_type_get(session._c_object)
1867
1642
            != gnutls.library.constants.GNUTLS_CRT_OPENPGP):
1868
1643
            # ...do the normal thing
1869
1644
            return session.peer_certificate
1883
1658
    def fingerprint(openpgp):
1884
1659
        "Convert an OpenPGP bytestring to a hexdigit fingerprint"
1885
1660
        # New GnuTLS "datum" with the OpenPGP public key
1886
 
        datum = gnutls.library.types.gnutls_datum_t(
1887
 
            ctypes.cast(ctypes.c_char_p(openpgp),
1888
 
                        ctypes.POINTER(ctypes.c_ubyte)),
1889
 
            ctypes.c_uint(len(openpgp)))
 
1661
        datum = (gnutls.library.types
 
1662
                 .gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
 
1663
                                             ctypes.POINTER
 
1664
                                             (ctypes.c_ubyte)),
 
1665
                                 ctypes.c_uint(len(openpgp))))
1890
1666
        # New empty GnuTLS certificate
1891
1667
        crt = gnutls.library.types.gnutls_openpgp_crt_t()
1892
 
        gnutls.library.functions.gnutls_openpgp_crt_init(
1893
 
            ctypes.byref(crt))
 
1668
        (gnutls.library.functions
 
1669
         .gnutls_openpgp_crt_init(ctypes.byref(crt)))
1894
1670
        # Import the OpenPGP public key into the certificate
1895
 
        gnutls.library.functions.gnutls_openpgp_crt_import(
1896
 
            crt, ctypes.byref(datum),
1897
 
            gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
 
1671
        (gnutls.library.functions
 
1672
         .gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
 
1673
                                    gnutls.library.constants
 
1674
                                    .GNUTLS_OPENPGP_FMT_RAW))
1898
1675
        # Verify the self signature in the key
1899
1676
        crtverify = ctypes.c_uint()
1900
 
        gnutls.library.functions.gnutls_openpgp_crt_verify_self(
1901
 
            crt, 0, ctypes.byref(crtverify))
 
1677
        (gnutls.library.functions
 
1678
         .gnutls_openpgp_crt_verify_self(crt, 0,
 
1679
                                         ctypes.byref(crtverify)))
1902
1680
        if crtverify.value != 0:
1903
1681
            gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1904
 
            raise gnutls.errors.CertificateSecurityError(
1905
 
                "Verify failed")
 
1682
            raise (gnutls.errors.CertificateSecurityError
 
1683
                   ("Verify failed"))
1906
1684
        # New buffer for the fingerprint
1907
1685
        buf = ctypes.create_string_buffer(20)
1908
1686
        buf_len = ctypes.c_size_t()
1909
1687
        # Get the fingerprint from the certificate into the buffer
1910
 
        gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint(
1911
 
            crt, ctypes.byref(buf), ctypes.byref(buf_len))
 
1688
        (gnutls.library.functions
 
1689
         .gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
 
1690
                                             ctypes.byref(buf_len)))
1912
1691
        # Deinit the certificate
1913
1692
        gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1914
1693
        # Convert the buffer to a Python bytestring
1920
1699
 
1921
1700
class MultiprocessingMixIn(object):
1922
1701
    """Like socketserver.ThreadingMixIn, but with multiprocessing"""
1923
 
    
1924
1702
    def sub_process_main(self, request, address):
1925
1703
        try:
1926
1704
            self.finish_request(request, address)
1931
1709
    def process_request(self, request, address):
1932
1710
        """Start a new process to process the request."""
1933
1711
        proc = multiprocessing.Process(target = self.sub_process_main,
1934
 
                                       args = (request, address))
 
1712
                                       args = (request,
 
1713
                                               address))
1935
1714
        proc.start()
1936
1715
        return proc
1937
1716
 
1938
1717
 
1939
1718
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
1940
1719
    """ adds a pipe to the MixIn """
1941
 
    
1942
1720
    def process_request(self, request, client_address):
1943
1721
        """Overrides and wraps the original process_request().
1944
1722
        
1953
1731
    
1954
1732
    def add_pipe(self, parent_pipe, proc):
1955
1733
        """Dummy function; override as necessary"""
1956
 
        raise NotImplementedError()
 
1734
        raise NotImplementedError
1957
1735
 
1958
1736
 
1959
1737
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
1965
1743
        interface:      None or a network interface name (string)
1966
1744
        use_ipv6:       Boolean; to use IPv6 or not
1967
1745
    """
1968
 
    
1969
1746
    def __init__(self, server_address, RequestHandlerClass,
1970
 
                 interface=None,
1971
 
                 use_ipv6=True,
1972
 
                 socketfd=None):
1973
 
        """If socketfd is set, use that file descriptor instead of
1974
 
        creating a new one with socket.socket().
1975
 
        """
 
1747
                 interface=None, use_ipv6=True):
1976
1748
        self.interface = interface
1977
1749
        if use_ipv6:
1978
1750
            self.address_family = socket.AF_INET6
1979
 
        if socketfd is not None:
1980
 
            # Save the file descriptor
1981
 
            self.socketfd = socketfd
1982
 
            # Save the original socket.socket() function
1983
 
            self.socket_socket = socket.socket
1984
 
            # To implement --socket, we monkey patch socket.socket.
1985
 
            # 
1986
 
            # (When socketserver.TCPServer is a new-style class, we
1987
 
            # could make self.socket into a property instead of monkey
1988
 
            # patching socket.socket.)
1989
 
            # 
1990
 
            # Create a one-time-only replacement for socket.socket()
1991
 
            @functools.wraps(socket.socket)
1992
 
            def socket_wrapper(*args, **kwargs):
1993
 
                # Restore original function so subsequent calls are
1994
 
                # not affected.
1995
 
                socket.socket = self.socket_socket
1996
 
                del self.socket_socket
1997
 
                # This time only, return a new socket object from the
1998
 
                # saved file descriptor.
1999
 
                return socket.fromfd(self.socketfd, *args, **kwargs)
2000
 
            # Replace socket.socket() function with wrapper
2001
 
            socket.socket = socket_wrapper
2002
 
        # The socketserver.TCPServer.__init__ will call
2003
 
        # socket.socket(), which might be our replacement,
2004
 
        # socket_wrapper(), if socketfd was set.
2005
1751
        socketserver.TCPServer.__init__(self, server_address,
2006
1752
                                        RequestHandlerClass)
2007
 
    
2008
1753
    def server_bind(self):
2009
1754
        """This overrides the normal server_bind() function
2010
1755
        to bind to an interface if one was specified, and also NOT to
2016
1761
                             self.interface)
2017
1762
            else:
2018
1763
                try:
2019
 
                    self.socket.setsockopt(
2020
 
                        socket.SOL_SOCKET, SO_BINDTODEVICE,
2021
 
                        (self.interface + "\0").encode("utf-8"))
 
1764
                    self.socket.setsockopt(socket.SOL_SOCKET,
 
1765
                                           SO_BINDTODEVICE,
 
1766
                                           str(self.interface
 
1767
                                               + '\0'))
2022
1768
                except socket.error as error:
2023
 
                    if error.errno == errno.EPERM:
2024
 
                        logger.error("No permission to bind to"
2025
 
                                     " interface %s", self.interface)
2026
 
                    elif error.errno == errno.ENOPROTOOPT:
 
1769
                    if error[0] == errno.EPERM:
 
1770
                        logger.error("No permission to"
 
1771
                                     " bind to interface %s",
 
1772
                                     self.interface)
 
1773
                    elif error[0] == errno.ENOPROTOOPT:
2027
1774
                        logger.error("SO_BINDTODEVICE not available;"
2028
1775
                                     " cannot bind to interface %s",
2029
1776
                                     self.interface)
2030
 
                    elif error.errno == errno.ENODEV:
2031
 
                        logger.error("Interface %s does not exist,"
2032
 
                                     " cannot bind", self.interface)
2033
1777
                    else:
2034
1778
                        raise
2035
1779
        # Only bind(2) the socket if we really need to.
2038
1782
                if self.address_family == socket.AF_INET6:
2039
1783
                    any_address = "::" # in6addr_any
2040
1784
                else:
2041
 
                    any_address = "0.0.0.0" # INADDR_ANY
 
1785
                    any_address = socket.INADDR_ANY
2042
1786
                self.server_address = (any_address,
2043
1787
                                       self.server_address[1])
2044
1788
            elif not self.server_address[1]:
2045
 
                self.server_address = (self.server_address[0], 0)
 
1789
                self.server_address = (self.server_address[0],
 
1790
                                       0)
2046
1791
#                 if self.interface:
2047
1792
#                     self.server_address = (self.server_address[0],
2048
1793
#                                            0, # port
2062
1807
    
2063
1808
    Assumes a gobject.MainLoop event loop.
2064
1809
    """
2065
 
    
2066
1810
    def __init__(self, server_address, RequestHandlerClass,
2067
 
                 interface=None,
2068
 
                 use_ipv6=True,
2069
 
                 clients=None,
2070
 
                 gnutls_priority=None,
2071
 
                 use_dbus=True,
2072
 
                 socketfd=None):
 
1811
                 interface=None, use_ipv6=True, clients=None,
 
1812
                 gnutls_priority=None, use_dbus=True):
2073
1813
        self.enabled = False
2074
1814
        self.clients = clients
2075
1815
        if self.clients is None:
2079
1819
        IPv6_TCPServer.__init__(self, server_address,
2080
1820
                                RequestHandlerClass,
2081
1821
                                interface = interface,
2082
 
                                use_ipv6 = use_ipv6,
2083
 
                                socketfd = socketfd)
2084
 
    
 
1822
                                use_ipv6 = use_ipv6)
2085
1823
    def server_activate(self):
2086
1824
        if self.enabled:
2087
1825
            return socketserver.TCPServer.server_activate(self)
2091
1829
    
2092
1830
    def add_pipe(self, parent_pipe, proc):
2093
1831
        # Call "handle_ipc" for both data and EOF events
2094
 
        gobject.io_add_watch(
2095
 
            parent_pipe.fileno(),
2096
 
            gobject.IO_IN | gobject.IO_HUP,
2097
 
            functools.partial(self.handle_ipc,
2098
 
                              parent_pipe = parent_pipe,
2099
 
                              proc = proc))
 
1832
        gobject.io_add_watch(parent_pipe.fileno(),
 
1833
                             gobject.IO_IN | gobject.IO_HUP,
 
1834
                             functools.partial(self.handle_ipc,
 
1835
                                               parent_pipe =
 
1836
                                               parent_pipe,
 
1837
                                               proc = proc))
2100
1838
    
2101
 
    def handle_ipc(self, source, condition,
2102
 
                   parent_pipe=None,
2103
 
                   proc = None,
2104
 
                   client_object=None):
 
1839
    def handle_ipc(self, source, condition, parent_pipe=None,
 
1840
                   proc = None, client_object=None):
 
1841
        condition_names = {
 
1842
            gobject.IO_IN: "IN",   # There is data to read.
 
1843
            gobject.IO_OUT: "OUT", # Data can be written (without
 
1844
                                    # blocking).
 
1845
            gobject.IO_PRI: "PRI", # There is urgent data to read.
 
1846
            gobject.IO_ERR: "ERR", # Error condition.
 
1847
            gobject.IO_HUP: "HUP"  # Hung up (the connection has been
 
1848
                                    # broken, usually for pipes and
 
1849
                                    # sockets).
 
1850
            }
 
1851
        conditions_string = ' | '.join(name
 
1852
                                       for cond, name in
 
1853
                                       condition_names.iteritems()
 
1854
                                       if cond & condition)
2105
1855
        # error, or the other end of multiprocessing.Pipe has closed
2106
 
        if condition & (gobject.IO_ERR | gobject.IO_HUP):
 
1856
        if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):
2107
1857
            # Wait for other process to exit
2108
1858
            proc.join()
2109
1859
            return False
2130
1880
                parent_pipe.send(False)
2131
1881
                return False
2132
1882
            
2133
 
            gobject.io_add_watch(
2134
 
                parent_pipe.fileno(),
2135
 
                gobject.IO_IN | gobject.IO_HUP,
2136
 
                functools.partial(self.handle_ipc,
2137
 
                                  parent_pipe = parent_pipe,
2138
 
                                  proc = proc,
2139
 
                                  client_object = client))
 
1883
            gobject.io_add_watch(parent_pipe.fileno(),
 
1884
                                 gobject.IO_IN | gobject.IO_HUP,
 
1885
                                 functools.partial(self.handle_ipc,
 
1886
                                                   parent_pipe =
 
1887
                                                   parent_pipe,
 
1888
                                                   proc = proc,
 
1889
                                                   client_object =
 
1890
                                                   client))
2140
1891
            parent_pipe.send(True)
2141
1892
            # remove the old hook in favor of the new above hook on
2142
1893
            # same fileno
2148
1899
            
2149
1900
            parent_pipe.send(('data', getattr(client_object,
2150
1901
                                              funcname)(*args,
2151
 
                                                        **kwargs)))
 
1902
                                                         **kwargs)))
2152
1903
        
2153
1904
        if command == 'getattr':
2154
1905
            attrname = request[1]
2155
 
            if isinstance(client_object.__getattribute__(attrname),
2156
 
                          collections.Callable):
2157
 
                parent_pipe.send(('function', ))
 
1906
            if callable(client_object.__getattribute__(attrname)):
 
1907
                parent_pipe.send(('function',))
2158
1908
            else:
2159
 
                parent_pipe.send((
2160
 
                    'data', client_object.__getattribute__(attrname)))
 
1909
                parent_pipe.send(('data', client_object
 
1910
                                  .__getattribute__(attrname)))
2161
1911
        
2162
1912
        if command == 'setattr':
2163
1913
            attrname = request[1]
2167
1917
        return True
2168
1918
 
2169
1919
 
2170
 
def rfc3339_duration_to_delta(duration):
2171
 
    """Parse an RFC 3339 "duration" and return a datetime.timedelta
2172
 
    
2173
 
    >>> rfc3339_duration_to_delta("P7D")
2174
 
    datetime.timedelta(7)
2175
 
    >>> rfc3339_duration_to_delta("PT60S")
2176
 
    datetime.timedelta(0, 60)
2177
 
    >>> rfc3339_duration_to_delta("PT60M")
2178
 
    datetime.timedelta(0, 3600)
2179
 
    >>> rfc3339_duration_to_delta("PT24H")
2180
 
    datetime.timedelta(1)
2181
 
    >>> rfc3339_duration_to_delta("P1W")
2182
 
    datetime.timedelta(7)
2183
 
    >>> rfc3339_duration_to_delta("PT5M30S")
2184
 
    datetime.timedelta(0, 330)
2185
 
    >>> rfc3339_duration_to_delta("P1DT3M20S")
2186
 
    datetime.timedelta(1, 200)
2187
 
    """
2188
 
    
2189
 
    # Parsing an RFC 3339 duration with regular expressions is not
2190
 
    # possible - there would have to be multiple places for the same
2191
 
    # values, like seconds.  The current code, while more esoteric, is
2192
 
    # cleaner without depending on a parsing library.  If Python had a
2193
 
    # built-in library for parsing we would use it, but we'd like to
2194
 
    # avoid excessive use of external libraries.
2195
 
    
2196
 
    # New type for defining tokens, syntax, and semantics all-in-one
2197
 
    Token = collections.namedtuple("Token", (
2198
 
        "regexp",  # To match token; if "value" is not None, must have
2199
 
                   # a "group" containing digits
2200
 
        "value",   # datetime.timedelta or None
2201
 
        "followers"))           # Tokens valid after this token
2202
 
    # RFC 3339 "duration" tokens, syntax, and semantics; taken from
2203
 
    # the "duration" ABNF definition in RFC 3339, Appendix A.
2204
 
    token_end = Token(re.compile(r"$"), None, frozenset())
2205
 
    token_second = Token(re.compile(r"(\d+)S"),
2206
 
                         datetime.timedelta(seconds=1),
2207
 
                         frozenset((token_end, )))
2208
 
    token_minute = Token(re.compile(r"(\d+)M"),
2209
 
                         datetime.timedelta(minutes=1),
2210
 
                         frozenset((token_second, token_end)))
2211
 
    token_hour = Token(re.compile(r"(\d+)H"),
2212
 
                       datetime.timedelta(hours=1),
2213
 
                       frozenset((token_minute, token_end)))
2214
 
    token_time = Token(re.compile(r"T"),
2215
 
                       None,
2216
 
                       frozenset((token_hour, token_minute,
2217
 
                                  token_second)))
2218
 
    token_day = Token(re.compile(r"(\d+)D"),
2219
 
                      datetime.timedelta(days=1),
2220
 
                      frozenset((token_time, token_end)))
2221
 
    token_month = Token(re.compile(r"(\d+)M"),
2222
 
                        datetime.timedelta(weeks=4),
2223
 
                        frozenset((token_day, token_end)))
2224
 
    token_year = Token(re.compile(r"(\d+)Y"),
2225
 
                       datetime.timedelta(weeks=52),
2226
 
                       frozenset((token_month, token_end)))
2227
 
    token_week = Token(re.compile(r"(\d+)W"),
2228
 
                       datetime.timedelta(weeks=1),
2229
 
                       frozenset((token_end, )))
2230
 
    token_duration = Token(re.compile(r"P"), None,
2231
 
                           frozenset((token_year, token_month,
2232
 
                                      token_day, token_time,
2233
 
                                      token_week)))
2234
 
    # Define starting values
2235
 
    value = datetime.timedelta() # Value so far
2236
 
    found_token = None
2237
 
    followers = frozenset((token_duration, )) # Following valid tokens
2238
 
    s = duration                # String left to parse
2239
 
    # Loop until end token is found
2240
 
    while found_token is not token_end:
2241
 
        # Search for any currently valid tokens
2242
 
        for token in followers:
2243
 
            match = token.regexp.match(s)
2244
 
            if match is not None:
2245
 
                # Token found
2246
 
                if token.value is not None:
2247
 
                    # Value found, parse digits
2248
 
                    factor = int(match.group(1), 10)
2249
 
                    # Add to value so far
2250
 
                    value += factor * token.value
2251
 
                # Strip token from string
2252
 
                s = token.regexp.sub("", s, 1)
2253
 
                # Go to found token
2254
 
                found_token = token
2255
 
                # Set valid next tokens
2256
 
                followers = found_token.followers
2257
 
                break
2258
 
        else:
2259
 
            # No currently valid tokens were found
2260
 
            raise ValueError("Invalid RFC 3339 duration: {!r}"
2261
 
                             .format(duration))
2262
 
    # End token found
2263
 
    return value
2264
 
 
2265
 
 
2266
1920
def string_to_delta(interval):
2267
1921
    """Parse a string and return a datetime.timedelta
2268
1922
    
2279
1933
    >>> string_to_delta('5m 30s')
2280
1934
    datetime.timedelta(0, 330)
2281
1935
    """
2282
 
    
2283
 
    try:
2284
 
        return rfc3339_duration_to_delta(interval)
2285
 
    except ValueError:
2286
 
        pass
2287
 
    
2288
1936
    timevalue = datetime.timedelta(0)
2289
1937
    for s in interval.split():
2290
1938
        try:
2291
 
            suffix = s[-1]
 
1939
            suffix = unicode(s[-1])
2292
1940
            value = int(s[:-1])
2293
1941
            if suffix == "d":
2294
1942
                delta = datetime.timedelta(value)
2301
1949
            elif suffix == "w":
2302
1950
                delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
2303
1951
            else:
2304
 
                raise ValueError("Unknown suffix {!r}".format(suffix))
2305
 
        except IndexError as e:
 
1952
                raise ValueError("Unknown suffix %r" % suffix)
 
1953
        except (ValueError, IndexError) as e:
2306
1954
            raise ValueError(*(e.args))
2307
1955
        timevalue += delta
2308
1956
    return timevalue
2321
1969
        sys.exit()
2322
1970
    if not noclose:
2323
1971
        # Close all standard open file descriptors
2324
 
        null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
 
1972
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
2325
1973
        if not stat.S_ISCHR(os.fstat(null).st_mode):
2326
1974
            raise OSError(errno.ENODEV,
2327
 
                          "{} not a character device"
2328
 
                          .format(os.devnull))
 
1975
                          "%s not a character device"
 
1976
                          % os.path.devnull)
2329
1977
        os.dup2(null, sys.stdin.fileno())
2330
1978
        os.dup2(null, sys.stdout.fileno())
2331
1979
        os.dup2(null, sys.stderr.fileno())
2340
1988
    
2341
1989
    parser = argparse.ArgumentParser()
2342
1990
    parser.add_argument("-v", "--version", action="version",
2343
 
                        version = "%(prog)s {}".format(version),
 
1991
                        version = "%%(prog)s %s" % version,
2344
1992
                        help="show version number and exit")
2345
1993
    parser.add_argument("-i", "--interface", metavar="IF",
2346
1994
                        help="Bind to interface IF")
2352
2000
                        help="Run self-test")
2353
2001
    parser.add_argument("--debug", action="store_true",
2354
2002
                        help="Debug mode; run in foreground and log"
2355
 
                        " to terminal", default=None)
 
2003
                        " to terminal")
2356
2004
    parser.add_argument("--debuglevel", metavar="LEVEL",
2357
2005
                        help="Debug level for stdout output")
2358
2006
    parser.add_argument("--priority", help="GnuTLS"
2365
2013
                        " files")
2366
2014
    parser.add_argument("--no-dbus", action="store_false",
2367
2015
                        dest="use_dbus", help="Do not provide D-Bus"
2368
 
                        " system bus interface", default=None)
 
2016
                        " system bus interface")
2369
2017
    parser.add_argument("--no-ipv6", action="store_false",
2370
 
                        dest="use_ipv6", help="Do not use IPv6",
2371
 
                        default=None)
 
2018
                        dest="use_ipv6", help="Do not use IPv6")
2372
2019
    parser.add_argument("--no-restore", action="store_false",
2373
2020
                        dest="restore", help="Do not restore stored"
2374
 
                        " state", default=None)
2375
 
    parser.add_argument("--socket", type=int,
2376
 
                        help="Specify a file descriptor to a network"
2377
 
                        " socket to use instead of creating one")
 
2021
                        " state")
2378
2022
    parser.add_argument("--statedir", metavar="DIR",
2379
2023
                        help="Directory to save/restore state in")
2380
 
    parser.add_argument("--foreground", action="store_true",
2381
 
                        help="Run in foreground", default=None)
2382
 
    parser.add_argument("--no-zeroconf", action="store_false",
2383
 
                        dest="zeroconf", help="Do not use Zeroconf",
2384
 
                        default=None)
2385
2024
    
2386
2025
    options = parser.parse_args()
2387
2026
    
2388
2027
    if options.check:
2389
2028
        import doctest
2390
 
        fail_count, test_count = doctest.testmod()
2391
 
        sys.exit(os.EX_OK if fail_count == 0 else 1)
 
2029
        doctest.testmod()
 
2030
        sys.exit()
2392
2031
    
2393
2032
    # Default values for config file for server-global settings
2394
2033
    server_defaults = { "interface": "",
2396
2035
                        "port": "",
2397
2036
                        "debug": "False",
2398
2037
                        "priority":
2399
 
                        "SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2400
 
                        ":+SIGN-DSA-SHA256",
 
2038
                        "SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
2401
2039
                        "servicename": "Mandos",
2402
2040
                        "use_dbus": "True",
2403
2041
                        "use_ipv6": "True",
2404
2042
                        "debuglevel": "",
2405
2043
                        "restore": "True",
2406
 
                        "socket": "",
2407
 
                        "statedir": "/var/lib/mandos",
2408
 
                        "foreground": "False",
2409
 
                        "zeroconf": "True",
2410
 
                    }
 
2044
                        "statedir": "/var/lib/mandos"
 
2045
                        }
2411
2046
    
2412
2047
    # Parse config file for server-global settings
2413
2048
    server_config = configparser.SafeConfigParser(server_defaults)
2414
2049
    del server_defaults
2415
 
    server_config.read(os.path.join(options.configdir, "mandos.conf"))
 
2050
    server_config.read(os.path.join(options.configdir,
 
2051
                                    "mandos.conf"))
2416
2052
    # Convert the SafeConfigParser object to a dict
2417
2053
    server_settings = server_config.defaults()
2418
2054
    # Use the appropriate methods on the non-string config options
2419
 
    for option in ("debug", "use_dbus", "use_ipv6", "foreground"):
 
2055
    for option in ("debug", "use_dbus", "use_ipv6"):
2420
2056
        server_settings[option] = server_config.getboolean("DEFAULT",
2421
2057
                                                           option)
2422
2058
    if server_settings["port"]:
2423
2059
        server_settings["port"] = server_config.getint("DEFAULT",
2424
2060
                                                       "port")
2425
 
    if server_settings["socket"]:
2426
 
        server_settings["socket"] = server_config.getint("DEFAULT",
2427
 
                                                         "socket")
2428
 
        # Later, stdin will, and stdout and stderr might, be dup'ed
2429
 
        # over with an opened os.devnull.  But we don't want this to
2430
 
        # happen with a supplied network socket.
2431
 
        if 0 <= server_settings["socket"] <= 2:
2432
 
            server_settings["socket"] = os.dup(server_settings
2433
 
                                               ["socket"])
2434
2061
    del server_config
2435
2062
    
2436
2063
    # Override the settings from the config file with command line
2437
2064
    # options, if set.
2438
2065
    for option in ("interface", "address", "port", "debug",
2439
 
                   "priority", "servicename", "configdir", "use_dbus",
2440
 
                   "use_ipv6", "debuglevel", "restore", "statedir",
2441
 
                   "socket", "foreground", "zeroconf"):
 
2066
                   "priority", "servicename", "configdir",
 
2067
                   "use_dbus", "use_ipv6", "debuglevel", "restore",
 
2068
                   "statedir"):
2442
2069
        value = getattr(options, option)
2443
2070
        if value is not None:
2444
2071
            server_settings[option] = value
2445
2072
    del options
2446
2073
    # Force all strings to be unicode
2447
2074
    for option in server_settings.keys():
2448
 
        if isinstance(server_settings[option], bytes):
2449
 
            server_settings[option] = (server_settings[option]
2450
 
                                       .decode("utf-8"))
2451
 
    # Force all boolean options to be boolean
2452
 
    for option in ("debug", "use_dbus", "use_ipv6", "restore",
2453
 
                   "foreground", "zeroconf"):
2454
 
        server_settings[option] = bool(server_settings[option])
2455
 
    # Debug implies foreground
2456
 
    if server_settings["debug"]:
2457
 
        server_settings["foreground"] = True
 
2075
        if type(server_settings[option]) is str:
 
2076
            server_settings[option] = unicode(server_settings[option])
2458
2077
    # Now we have our good server settings in "server_settings"
2459
2078
    
2460
2079
    ##################################################################
2461
2080
    
2462
 
    if (not server_settings["zeroconf"]
2463
 
        and not (server_settings["port"]
2464
 
                 or server_settings["socket"] != "")):
2465
 
        parser.error("Needs port or socket to work without Zeroconf")
2466
 
    
2467
2081
    # For convenience
2468
2082
    debug = server_settings["debug"]
2469
2083
    debuglevel = server_settings["debuglevel"]
2471
2085
    use_ipv6 = server_settings["use_ipv6"]
2472
2086
    stored_state_path = os.path.join(server_settings["statedir"],
2473
2087
                                     stored_state_file)
2474
 
    foreground = server_settings["foreground"]
2475
 
    zeroconf = server_settings["zeroconf"]
2476
2088
    
2477
2089
    if debug:
2478
2090
        initlogger(debug, logging.DEBUG)
2484
2096
            initlogger(debug, level)
2485
2097
    
2486
2098
    if server_settings["servicename"] != "Mandos":
2487
 
        syslogger.setFormatter(
2488
 
            logging.Formatter('Mandos ({}) [%(process)d]:'
2489
 
                              ' %(levelname)s: %(message)s'.format(
2490
 
                                  server_settings["servicename"])))
 
2099
        syslogger.setFormatter(logging.Formatter
 
2100
                               ('Mandos (%s) [%%(process)d]:'
 
2101
                                ' %%(levelname)s: %%(message)s'
 
2102
                                % server_settings["servicename"]))
2491
2103
    
2492
2104
    # Parse config file with clients
2493
2105
    client_config = configparser.SafeConfigParser(Client
2498
2110
    global mandos_dbus_service
2499
2111
    mandos_dbus_service = None
2500
2112
    
2501
 
    socketfd = None
2502
 
    if server_settings["socket"] != "":
2503
 
        socketfd = server_settings["socket"]
2504
 
    tcp_server = MandosServer(
2505
 
        (server_settings["address"], server_settings["port"]),
2506
 
        ClientHandler,
2507
 
        interface=(server_settings["interface"] or None),
2508
 
        use_ipv6=use_ipv6,
2509
 
        gnutls_priority=server_settings["priority"],
2510
 
        use_dbus=use_dbus,
2511
 
        socketfd=socketfd)
2512
 
    if not foreground:
2513
 
        pidfilename = "/run/mandos.pid"
2514
 
        if not os.path.isdir("/run/."):
2515
 
            pidfilename = "/var/run/mandos.pid"
2516
 
        pidfile = None
 
2113
    tcp_server = MandosServer((server_settings["address"],
 
2114
                               server_settings["port"]),
 
2115
                              ClientHandler,
 
2116
                              interface=(server_settings["interface"]
 
2117
                                         or None),
 
2118
                              use_ipv6=use_ipv6,
 
2119
                              gnutls_priority=
 
2120
                              server_settings["priority"],
 
2121
                              use_dbus=use_dbus)
 
2122
    if not debug:
 
2123
        pidfilename = "/var/run/mandos.pid"
2517
2124
        try:
2518
 
            pidfile = codecs.open(pidfilename, "w", encoding="utf-8")
2519
 
        except IOError as e:
2520
 
            logger.error("Could not open file %r", pidfilename,
2521
 
                         exc_info=e)
 
2125
            pidfile = open(pidfilename, "w")
 
2126
        except IOError:
 
2127
            logger.error("Could not open file %r", pidfilename)
2522
2128
    
2523
 
    for name in ("_mandos", "mandos", "nobody"):
 
2129
    try:
 
2130
        uid = pwd.getpwnam("_mandos").pw_uid
 
2131
        gid = pwd.getpwnam("_mandos").pw_gid
 
2132
    except KeyError:
2524
2133
        try:
2525
 
            uid = pwd.getpwnam(name).pw_uid
2526
 
            gid = pwd.getpwnam(name).pw_gid
2527
 
            break
 
2134
            uid = pwd.getpwnam("mandos").pw_uid
 
2135
            gid = pwd.getpwnam("mandos").pw_gid
2528
2136
        except KeyError:
2529
 
            continue
2530
 
    else:
2531
 
        uid = 65534
2532
 
        gid = 65534
 
2137
            try:
 
2138
                uid = pwd.getpwnam("nobody").pw_uid
 
2139
                gid = pwd.getpwnam("nobody").pw_gid
 
2140
            except KeyError:
 
2141
                uid = 65534
 
2142
                gid = 65534
2533
2143
    try:
2534
2144
        os.setgid(gid)
2535
2145
        os.setuid(uid)
2536
2146
    except OSError as error:
2537
 
        if error.errno != errno.EPERM:
2538
 
            raise
 
2147
        if error[0] != errno.EPERM:
 
2148
            raise error
2539
2149
    
2540
2150
    if debug:
2541
2151
        # Enable all possible GnuTLS debugging
2548
2158
        def debug_gnutls(level, string):
2549
2159
            logger.debug("GnuTLS: %s", string[:-1])
2550
2160
        
2551
 
        gnutls.library.functions.gnutls_global_set_log_function(
2552
 
            debug_gnutls)
 
2161
        (gnutls.library.functions
 
2162
         .gnutls_global_set_log_function(debug_gnutls))
2553
2163
        
2554
2164
        # Redirect stdin so all checkers get /dev/null
2555
 
        null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
 
2165
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
2556
2166
        os.dup2(null, sys.stdin.fileno())
2557
2167
        if null > 2:
2558
2168
            os.close(null)
2559
2169
    
2560
2170
    # Need to fork before connecting to D-Bus
2561
 
    if not foreground:
 
2171
    if not debug:
2562
2172
        # Close all input and output, do double fork, etc.
2563
2173
        daemon()
2564
2174
    
2565
 
    # multiprocessing will use threads, so before we use gobject we
2566
 
    # need to inform gobject that threads will be used.
2567
2175
    gobject.threads_init()
2568
2176
    
2569
2177
    global main_loop
2570
2178
    # From the Avahi example code
2571
 
    DBusGMainLoop(set_as_default=True)
 
2179
    DBusGMainLoop(set_as_default=True )
2572
2180
    main_loop = gobject.MainLoop()
2573
2181
    bus = dbus.SystemBus()
2574
2182
    # End of Avahi example code
2575
2183
    if use_dbus:
2576
2184
        try:
2577
2185
            bus_name = dbus.service.BusName("se.recompile.Mandos",
2578
 
                                            bus,
2579
 
                                            do_not_queue=True)
2580
 
            old_bus_name = dbus.service.BusName(
2581
 
                "se.bsnet.fukt.Mandos", bus,
2582
 
                do_not_queue=True)
2583
 
        except dbus.exceptions.DBusException as e:
2584
 
            logger.error("Disabling D-Bus:", exc_info=e)
 
2186
                                            bus, do_not_queue=True)
 
2187
            old_bus_name = (dbus.service.BusName
 
2188
                            ("se.bsnet.fukt.Mandos", bus,
 
2189
                             do_not_queue=True))
 
2190
        except dbus.exceptions.NameExistsException as e:
 
2191
            logger.error(unicode(e) + ", disabling D-Bus")
2585
2192
            use_dbus = False
2586
2193
            server_settings["use_dbus"] = False
2587
2194
            tcp_server.use_dbus = False
2588
 
    if zeroconf:
2589
 
        protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2590
 
        service = AvahiServiceToSyslog(
2591
 
            name = server_settings["servicename"],
2592
 
            servicetype = "_mandos._tcp",
2593
 
            protocol = protocol,
2594
 
            bus = bus)
2595
 
        if server_settings["interface"]:
2596
 
            service.interface = if_nametoindex(
2597
 
                server_settings["interface"].encode("utf-8"))
 
2195
    protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
 
2196
    service = AvahiServiceToSyslog(name =
 
2197
                                   server_settings["servicename"],
 
2198
                                   servicetype = "_mandos._tcp",
 
2199
                                   protocol = protocol, bus = bus)
 
2200
    if server_settings["interface"]:
 
2201
        service.interface = (if_nametoindex
 
2202
                             (str(server_settings["interface"])))
2598
2203
    
2599
2204
    global multiprocessing_manager
2600
2205
    multiprocessing_manager = multiprocessing.Manager()
2601
2206
    
2602
2207
    client_class = Client
2603
2208
    if use_dbus:
2604
 
        client_class = functools.partial(ClientDBus, bus = bus)
 
2209
        client_class = functools.partial(ClientDBusTransitional,
 
2210
                                         bus = bus)
2605
2211
    
2606
2212
    client_settings = Client.config_parser(client_config)
2607
2213
    old_client_settings = {}
2608
2214
    clients_data = {}
2609
2215
    
2610
 
    # This is used to redirect stdout and stderr for checker processes
2611
 
    global wnull
2612
 
    wnull = open(os.devnull, "w") # A writable /dev/null
2613
 
    # Only used if server is running in foreground but not in debug
2614
 
    # mode
2615
 
    if debug or not foreground:
2616
 
        wnull.close()
2617
 
    
2618
2216
    # Get client data and settings from last running state.
2619
2217
    if server_settings["restore"]:
2620
2218
        try:
2621
2219
            with open(stored_state_path, "rb") as stored_state:
2622
 
                clients_data, old_client_settings = pickle.load(
2623
 
                    stored_state)
 
2220
                clients_data, old_client_settings = (pickle.load
 
2221
                                                     (stored_state))
2624
2222
            os.remove(stored_state_path)
2625
2223
        except IOError as e:
2626
 
            if e.errno == errno.ENOENT:
2627
 
                logger.warning("Could not load persistent state:"
2628
 
                               " {}".format(os.strerror(e.errno)))
2629
 
            else:
2630
 
                logger.critical("Could not load persistent state:",
2631
 
                                exc_info=e)
 
2224
            logger.warning("Could not load persistent state: {0}"
 
2225
                           .format(e))
 
2226
            if e.errno != errno.ENOENT:
2632
2227
                raise
2633
2228
        except EOFError as e:
2634
2229
            logger.warning("Could not load persistent state: "
2635
 
                           "EOFError:",
2636
 
                           exc_info=e)
 
2230
                           "EOFError: {0}".format(e))
2637
2231
    
2638
2232
    with PGPEngine() as pgp:
2639
 
        for client_name, client in clients_data.items():
2640
 
            # Skip removed clients
2641
 
            if client_name not in client_settings:
2642
 
                continue
2643
 
            
 
2233
        for client_name, client in clients_data.iteritems():
2644
2234
            # Decide which value to use after restoring saved state.
2645
2235
            # We have three different values: Old config file,
2646
2236
            # new config file, and saved state.
2651
2241
                    # For each value in new config, check if it
2652
2242
                    # differs from the old config value (Except for
2653
2243
                    # the "secret" attribute)
2654
 
                    if (name != "secret"
2655
 
                        and (value !=
2656
 
                             old_client_settings[client_name][name])):
 
2244
                    if (name != "secret" and
 
2245
                        value != old_client_settings[client_name]
 
2246
                        [name]):
2657
2247
                        client[name] = value
2658
2248
                except KeyError:
2659
2249
                    pass
2660
2250
            
2661
2251
            # Clients who has passed its expire date can still be
2662
 
            # enabled if its last checker was successful.  A Client
2663
 
            # whose checker succeeded before we stored its state is
2664
 
            # assumed to have successfully run all checkers during
2665
 
            # downtime.
 
2252
            # enabled if its last checker was successful.  Clients
 
2253
            # whose checker failed before we stored its state is
 
2254
            # assumed to have failed all checkers during downtime.
2666
2255
            if client["enabled"]:
2667
2256
                if datetime.datetime.utcnow() >= client["expires"]:
2668
2257
                    if not client["last_checked_ok"]:
2669
2258
                        logger.warning(
2670
 
                            "disabling client {} - Client never "
2671
 
                            "performed a successful checker".format(
2672
 
                                client_name))
 
2259
                            "disabling client {0} - Client never "
 
2260
                            "performed a successfull checker"
 
2261
                            .format(client["name"]))
2673
2262
                        client["enabled"] = False
2674
2263
                    elif client["last_checker_status"] != 0:
2675
2264
                        logger.warning(
2676
 
                            "disabling client {} - Client last"
2677
 
                            " checker failed with error code"
2678
 
                            " {}".format(
2679
 
                                client_name,
2680
 
                                client["last_checker_status"]))
 
2265
                            "disabling client {0} - Client "
 
2266
                            "last checker failed with error code {1}"
 
2267
                            .format(client["name"],
 
2268
                                    client["last_checker_status"]))
2681
2269
                        client["enabled"] = False
2682
2270
                    else:
2683
 
                        client["expires"] = (
2684
 
                            datetime.datetime.utcnow()
2685
 
                            + client["timeout"])
 
2271
                        client["expires"] = (datetime.datetime
 
2272
                                             .utcnow()
 
2273
                                             + client["timeout"])
2686
2274
                        logger.debug("Last checker succeeded,"
2687
 
                                     " keeping {} enabled".format(
2688
 
                                         client_name))
 
2275
                                     " keeping {0} enabled"
 
2276
                                     .format(client["name"]))
2689
2277
            try:
2690
 
                client["secret"] = pgp.decrypt(
2691
 
                    client["encrypted_secret"],
2692
 
                    client_settings[client_name]["secret"])
 
2278
                client["secret"] = (
 
2279
                    pgp.decrypt(client["encrypted_secret"],
 
2280
                                client_settings[client_name]
 
2281
                                ["secret"]))
2693
2282
            except PGPError:
2694
2283
                # If decryption fails, we use secret from new settings
2695
 
                logger.debug("Failed to decrypt {} old secret".format(
2696
 
                    client_name))
2697
 
                client["secret"] = (client_settings[client_name]
2698
 
                                    ["secret"])
 
2284
                logger.debug("Failed to decrypt {0} old secret"
 
2285
                             .format(client_name))
 
2286
                client["secret"] = (
 
2287
                    client_settings[client_name]["secret"])
 
2288
 
2699
2289
    
2700
2290
    # Add/remove clients based on new changes made to config
2701
2291
    for client_name in (set(old_client_settings)
2704
2294
    for client_name in (set(client_settings)
2705
2295
                        - set(old_client_settings)):
2706
2296
        clients_data[client_name] = client_settings[client_name]
2707
 
    
2708
 
    # Create all client objects
2709
 
    for client_name, client in clients_data.items():
 
2297
 
 
2298
    # Create clients all clients
 
2299
    for client_name, client in clients_data.iteritems():
2710
2300
        tcp_server.clients[client_name] = client_class(
2711
 
            name = client_name,
2712
 
            settings = client,
2713
 
            server_settings = server_settings)
 
2301
            name = client_name, settings = client)
2714
2302
    
2715
2303
    if not tcp_server.clients:
2716
2304
        logger.warning("No clients defined")
2717
 
    
2718
 
    if not foreground:
2719
 
        if pidfile is not None:
2720
 
            pid = os.getpid()
2721
 
            try:
2722
 
                with pidfile:
2723
 
                    print(pid, file=pidfile)
2724
 
            except IOError:
2725
 
                logger.error("Could not write to file %r with PID %d",
2726
 
                             pidfilename, pid)
2727
 
        del pidfile
 
2305
        
 
2306
    if not debug:
 
2307
        try:
 
2308
            with pidfile:
 
2309
                pid = os.getpid()
 
2310
                pidfile.write(str(pid) + "\n".encode("utf-8"))
 
2311
            del pidfile
 
2312
        except IOError:
 
2313
            logger.error("Could not write to file %r with PID %d",
 
2314
                         pidfilename, pid)
 
2315
        except NameError:
 
2316
            # "pidfile" was never created
 
2317
            pass
2728
2318
        del pidfilename
 
2319
        signal.signal(signal.SIGINT, signal.SIG_IGN)
2729
2320
    
2730
2321
    signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2731
2322
    signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
2732
2323
    
2733
2324
    if use_dbus:
2734
 
        
2735
 
        @alternate_dbus_interfaces(
2736
 
            { "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })
2737
 
        class MandosDBusService(DBusObjectWithProperties):
 
2325
        class MandosDBusService(dbus.service.Object):
2738
2326
            """A D-Bus proxy object"""
2739
 
            
2740
2327
            def __init__(self):
2741
2328
                dbus.service.Object.__init__(self, bus, "/")
2742
 
            
2743
2329
            _interface = "se.recompile.Mandos"
2744
2330
            
2745
 
            @dbus_interface_annotations(_interface)
2746
 
            def _foo(self):
2747
 
                return {
2748
 
                    "org.freedesktop.DBus.Property.EmitsChangedSignal":
2749
 
                    "false" }
2750
 
            
2751
2331
            @dbus.service.signal(_interface, signature="o")
2752
2332
            def ClientAdded(self, objpath):
2753
2333
                "D-Bus signal"
2766
2346
            @dbus.service.method(_interface, out_signature="ao")
2767
2347
            def GetAllClients(self):
2768
2348
                "D-Bus method"
2769
 
                return dbus.Array(c.dbus_object_path for c in
 
2349
                return dbus.Array(c.dbus_object_path
 
2350
                                  for c in
2770
2351
                                  tcp_server.clients.itervalues())
2771
2352
            
2772
2353
            @dbus.service.method(_interface,
2774
2355
            def GetAllClientsWithProperties(self):
2775
2356
                "D-Bus method"
2776
2357
                return dbus.Dictionary(
2777
 
                    { c.dbus_object_path: c.GetAll("")
2778
 
                      for c in tcp_server.clients.itervalues() },
 
2358
                    ((c.dbus_object_path, c.GetAll(""))
 
2359
                     for c in tcp_server.clients.itervalues()),
2779
2360
                    signature="oa{sv}")
2780
2361
            
2781
2362
            @dbus.service.method(_interface, in_signature="o")
2794
2375
            
2795
2376
            del _interface
2796
2377
        
2797
 
        mandos_dbus_service = MandosDBusService()
 
2378
        class MandosDBusServiceTransitional(MandosDBusService):
 
2379
            __metaclass__ = AlternateDBusNamesMetaclass
 
2380
        mandos_dbus_service = MandosDBusServiceTransitional()
2798
2381
    
2799
2382
    def cleanup():
2800
2383
        "Cleanup function; run on exit"
2801
 
        if zeroconf:
2802
 
            service.cleanup()
 
2384
        service.cleanup()
2803
2385
        
2804
2386
        multiprocessing.active_children()
2805
 
        wnull.close()
2806
2387
        if not (tcp_server.clients or client_settings):
2807
2388
            return
2808
2389
        
2819
2400
                
2820
2401
                # A list of attributes that can not be pickled
2821
2402
                # + secret.
2822
 
                exclude = { "bus", "changedstate", "secret",
2823
 
                            "checker", "server_settings" }
2824
 
                for name, typ in inspect.getmembers(dbus.service
2825
 
                                                    .Object):
 
2403
                exclude = set(("bus", "changedstate", "secret",
 
2404
                               "checker"))
 
2405
                for name, typ in (inspect.getmembers
 
2406
                                  (dbus.service.Object)):
2826
2407
                    exclude.add(name)
2827
2408
                
2828
2409
                client_dict["encrypted_secret"] = (client
2835
2416
                del client_settings[client.name]["secret"]
2836
2417
        
2837
2418
        try:
2838
 
            with tempfile.NamedTemporaryFile(
2839
 
                    mode='wb',
2840
 
                    suffix=".pickle",
2841
 
                    prefix='clients-',
2842
 
                    dir=os.path.dirname(stored_state_path),
2843
 
                    delete=False) as stored_state:
 
2419
            tempfd, tempname = tempfile.mkstemp(suffix=".pickle",
 
2420
                                                prefix="clients-",
 
2421
                                                dir=os.path.dirname
 
2422
                                                (stored_state_path))
 
2423
            with os.fdopen(tempfd, "wb") as stored_state:
2844
2424
                pickle.dump((clients, client_settings), stored_state)
2845
 
                tempname = stored_state.name
2846
2425
            os.rename(tempname, stored_state_path)
2847
2426
        except (IOError, OSError) as e:
 
2427
            logger.warning("Could not save persistent state: {0}"
 
2428
                           .format(e))
2848
2429
            if not debug:
2849
2430
                try:
2850
2431
                    os.remove(tempname)
2851
2432
                except NameError:
2852
2433
                    pass
2853
 
            if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
2854
 
                logger.warning("Could not save persistent state: {}"
2855
 
                               .format(os.strerror(e.errno)))
2856
 
            else:
2857
 
                logger.warning("Could not save persistent state:",
2858
 
                               exc_info=e)
2859
 
                raise
 
2434
            if e.errno not in set((errno.ENOENT, errno.EACCES,
 
2435
                                   errno.EEXIST)):
 
2436
                raise e
2860
2437
        
2861
2438
        # Delete all clients, and settings from config
2862
2439
        while tcp_server.clients:
2867
2444
            client.disable(quiet=True)
2868
2445
            if use_dbus:
2869
2446
                # Emit D-Bus signal
2870
 
                mandos_dbus_service.ClientRemoved(
2871
 
                    client.dbus_object_path, client.name)
 
2447
                mandos_dbus_service.ClientRemoved(client
 
2448
                                                  .dbus_object_path,
 
2449
                                                  client.name)
2872
2450
        client_settings.clear()
2873
2451
    
2874
2452
    atexit.register(cleanup)
2885
2463
    tcp_server.server_activate()
2886
2464
    
2887
2465
    # Find out what port we got
2888
 
    if zeroconf:
2889
 
        service.port = tcp_server.socket.getsockname()[1]
 
2466
    service.port = tcp_server.socket.getsockname()[1]
2890
2467
    if use_ipv6:
2891
2468
        logger.info("Now listening on address %r, port %d,"
2892
 
                    " flowinfo %d, scope_id %d",
2893
 
                    *tcp_server.socket.getsockname())
 
2469
                    " flowinfo %d, scope_id %d"
 
2470
                    % tcp_server.socket.getsockname())
2894
2471
    else:                       # IPv4
2895
 
        logger.info("Now listening on address %r, port %d",
2896
 
                    *tcp_server.socket.getsockname())
 
2472
        logger.info("Now listening on address %r, port %d"
 
2473
                    % tcp_server.socket.getsockname())
2897
2474
    
2898
2475
    #service.interface = tcp_server.socket.getsockname()[3]
2899
2476
    
2900
2477
    try:
2901
 
        if zeroconf:
2902
 
            # From the Avahi example code
2903
 
            try:
2904
 
                service.activate()
2905
 
            except dbus.exceptions.DBusException as error:
2906
 
                logger.critical("D-Bus Exception", exc_info=error)
2907
 
                cleanup()
2908
 
                sys.exit(1)
2909
 
            # End of Avahi example code
 
2478
        # From the Avahi example code
 
2479
        try:
 
2480
            service.activate()
 
2481
        except dbus.exceptions.DBusException as error:
 
2482
            logger.critical("DBusException: %s", error)
 
2483
            cleanup()
 
2484
            sys.exit(1)
 
2485
        # End of Avahi example code
2910
2486
        
2911
2487
        gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
2912
2488
                             lambda *args, **kwargs:
2916
2492
        logger.debug("Starting main loop")
2917
2493
        main_loop.run()
2918
2494
    except AvahiError as error:
2919
 
        logger.critical("Avahi Error", exc_info=error)
 
2495
        logger.critical("AvahiError: %s", error)
2920
2496
        cleanup()
2921
2497
        sys.exit(1)
2922
2498
    except KeyboardInterrupt:
2927
2503
    # Must run before the D-Bus bus name gets deregistered
2928
2504
    cleanup()
2929
2505
 
2930
 
 
2931
2506
if __name__ == '__main__':
2932
2507
    main()