/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos

  • Committer: Teddy Hogeborn
  • Date: 2012-05-06 16:13:00 UTC
  • Revision ID: teddy@recompile.se-20120506161300-43rls2rr4qub3zhw
* mandos: Use a class decorator instead of a metaclass to provide
          alternate D-Bus interface names on D-Bus object attributes.
  (alternate_dbus_interfaces): New class decorator.
  (AlternateDBusNamesMetaclass, ClientDBusTransitional,
   MandosDBusServiceTransitional): Removed; all users changed.
  (ClientDbus, MandosDBusService): Use new "alternate_dbus_interfaces"
                                   class decorator.

Show diffs side-by-side

added added

removed removed

Lines of Context:
11
11
# "AvahiService" class, and some lines in "main".
12
12
13
13
# Everything else is
14
 
# Copyright © 2008,2009 Teddy Hogeborn
15
 
# Copyright © 2008,2009 Björn Påhlsson
 
14
# Copyright © 2008-2012 Teddy Hogeborn
 
15
# Copyright © 2008-2012 Björn Påhlsson
16
16
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
28
28
# along with this program.  If not, see
29
29
# <http://www.gnu.org/licenses/>.
30
30
31
 
# Contact the authors at <mandos@fukt.bsnet.se>.
 
31
# Contact the authors at <mandos@recompile.se>.
32
32
33
33
 
34
 
from __future__ import division, with_statement, absolute_import
 
34
from __future__ import (division, absolute_import, print_function,
 
35
                        unicode_literals)
35
36
 
36
37
import SocketServer as socketserver
37
38
import socket
38
 
import optparse
 
39
import argparse
39
40
import datetime
40
41
import errno
41
42
import gnutls.crypto
55
56
import logging
56
57
import logging.handlers
57
58
import pwd
58
 
from contextlib import closing
 
59
import contextlib
59
60
import struct
60
61
import fcntl
61
62
import functools
 
63
import cPickle as pickle
 
64
import multiprocessing
 
65
import types
 
66
import binascii
 
67
import tempfile
 
68
import itertools
62
69
 
63
70
import dbus
64
71
import dbus.service
67
74
from dbus.mainloop.glib import DBusGMainLoop
68
75
import ctypes
69
76
import ctypes.util
 
77
import xml.dom.minidom
 
78
import inspect
 
79
import GnuPGInterface
70
80
 
71
81
try:
72
82
    SO_BINDTODEVICE = socket.SO_BINDTODEVICE
76
86
    except ImportError:
77
87
        SO_BINDTODEVICE = None
78
88
 
79
 
 
80
 
version = "1.0.11"
81
 
 
82
 
logger = logging.Logger(u'mandos')
 
89
version = "1.5.3"
 
90
stored_state_file = "clients.pickle"
 
91
 
 
92
logger = logging.getLogger()
83
93
syslogger = (logging.handlers.SysLogHandler
84
94
             (facility = logging.handlers.SysLogHandler.LOG_DAEMON,
85
 
              address = "/dev/log"))
86
 
syslogger.setFormatter(logging.Formatter
87
 
                       (u'Mandos [%(process)d]: %(levelname)s:'
88
 
                        u' %(message)s'))
89
 
logger.addHandler(syslogger)
90
 
 
91
 
console = logging.StreamHandler()
92
 
console.setFormatter(logging.Formatter(u'%(name)s [%(process)d]:'
93
 
                                       u' %(levelname)s:'
94
 
                                       u' %(message)s'))
95
 
logger.addHandler(console)
 
95
              address = str("/dev/log")))
 
96
 
 
97
try:
 
98
    if_nametoindex = (ctypes.cdll.LoadLibrary
 
99
                      (ctypes.util.find_library("c"))
 
100
                      .if_nametoindex)
 
101
except (OSError, AttributeError):
 
102
    def if_nametoindex(interface):
 
103
        "Get an interface index the hard way, i.e. using fcntl()"
 
104
        SIOCGIFINDEX = 0x8933  # From /usr/include/linux/sockios.h
 
105
        with contextlib.closing(socket.socket()) as s:
 
106
            ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
 
107
                                struct.pack(str("16s16x"),
 
108
                                            interface))
 
109
        interface_index = struct.unpack(str("I"),
 
110
                                        ifreq[16:20])[0]
 
111
        return interface_index
 
112
 
 
113
 
 
114
def initlogger(debug, level=logging.WARNING):
 
115
    """init logger and add loglevel"""
 
116
    
 
117
    syslogger.setFormatter(logging.Formatter
 
118
                           ('Mandos [%(process)d]: %(levelname)s:'
 
119
                            ' %(message)s'))
 
120
    logger.addHandler(syslogger)
 
121
    
 
122
    if debug:
 
123
        console = logging.StreamHandler()
 
124
        console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
 
125
                                               ' [%(process)d]:'
 
126
                                               ' %(levelname)s:'
 
127
                                               ' %(message)s'))
 
128
        logger.addHandler(console)
 
129
    logger.setLevel(level)
 
130
 
 
131
 
 
132
class PGPError(Exception):
 
133
    """Exception if encryption/decryption fails"""
 
134
    pass
 
135
 
 
136
 
 
137
class PGPEngine(object):
 
138
    """A simple class for OpenPGP symmetric encryption & decryption"""
 
139
    def __init__(self):
 
140
        self.gnupg = GnuPGInterface.GnuPG()
 
141
        self.tempdir = tempfile.mkdtemp(prefix="mandos-")
 
142
        self.gnupg = GnuPGInterface.GnuPG()
 
143
        self.gnupg.options.meta_interactive = False
 
144
        self.gnupg.options.homedir = self.tempdir
 
145
        self.gnupg.options.extra_args.extend(['--force-mdc',
 
146
                                              '--quiet',
 
147
                                              '--no-use-agent'])
 
148
    
 
149
    def __enter__(self):
 
150
        return self
 
151
    
 
152
    def __exit__ (self, exc_type, exc_value, traceback):
 
153
        self._cleanup()
 
154
        return False
 
155
    
 
156
    def __del__(self):
 
157
        self._cleanup()
 
158
    
 
159
    def _cleanup(self):
 
160
        if self.tempdir is not None:
 
161
            # Delete contents of tempdir
 
162
            for root, dirs, files in os.walk(self.tempdir,
 
163
                                             topdown = False):
 
164
                for filename in files:
 
165
                    os.remove(os.path.join(root, filename))
 
166
                for dirname in dirs:
 
167
                    os.rmdir(os.path.join(root, dirname))
 
168
            # Remove tempdir
 
169
            os.rmdir(self.tempdir)
 
170
            self.tempdir = None
 
171
    
 
172
    def password_encode(self, password):
 
173
        # Passphrase can not be empty and can not contain newlines or
 
174
        # NUL bytes.  So we prefix it and hex encode it.
 
175
        return b"mandos" + binascii.hexlify(password)
 
176
    
 
177
    def encrypt(self, data, password):
 
178
        self.gnupg.passphrase = self.password_encode(password)
 
179
        with open(os.devnull, "w") as devnull:
 
180
            try:
 
181
                proc = self.gnupg.run(['--symmetric'],
 
182
                                      create_fhs=['stdin', 'stdout'],
 
183
                                      attach_fhs={'stderr': devnull})
 
184
                with contextlib.closing(proc.handles['stdin']) as f:
 
185
                    f.write(data)
 
186
                with contextlib.closing(proc.handles['stdout']) as f:
 
187
                    ciphertext = f.read()
 
188
                proc.wait()
 
189
            except IOError as e:
 
190
                raise PGPError(e)
 
191
        self.gnupg.passphrase = None
 
192
        return ciphertext
 
193
    
 
194
    def decrypt(self, data, password):
 
195
        self.gnupg.passphrase = self.password_encode(password)
 
196
        with open(os.devnull, "w") as devnull:
 
197
            try:
 
198
                proc = self.gnupg.run(['--decrypt'],
 
199
                                      create_fhs=['stdin', 'stdout'],
 
200
                                      attach_fhs={'stderr': devnull})
 
201
                with contextlib.closing(proc.handles['stdin']) as f:
 
202
                    f.write(data)
 
203
                with contextlib.closing(proc.handles['stdout']) as f:
 
204
                    decrypted_plaintext = f.read()
 
205
                proc.wait()
 
206
            except IOError as e:
 
207
                raise PGPError(e)
 
208
        self.gnupg.passphrase = None
 
209
        return decrypted_plaintext
 
210
 
96
211
 
97
212
class AvahiError(Exception):
98
213
    def __init__(self, value, *args, **kwargs):
114
229
    Attributes:
115
230
    interface: integer; avahi.IF_UNSPEC or an interface index.
116
231
               Used to optionally bind to the specified interface.
117
 
    name: string; Example: u'Mandos'
118
 
    type: string; Example: u'_mandos._tcp'.
 
232
    name: string; Example: 'Mandos'
 
233
    type: string; Example: '_mandos._tcp'.
119
234
                  See <http://www.dns-sd.org/ServiceTypes.html>
120
235
    port: integer; what port to announce
121
236
    TXT: list of strings; TXT record for the service
128
243
    server: D-Bus Server
129
244
    bus: dbus.SystemBus()
130
245
    """
 
246
    
131
247
    def __init__(self, interface = avahi.IF_UNSPEC, name = None,
132
248
                 servicetype = None, port = None, TXT = None,
133
 
                 domain = u"", host = u"", max_renames = 32768,
 
249
                 domain = "", host = "", max_renames = 32768,
134
250
                 protocol = avahi.PROTO_UNSPEC, bus = None):
135
251
        self.interface = interface
136
252
        self.name = name
145
261
        self.group = None       # our entry group
146
262
        self.server = None
147
263
        self.bus = bus
 
264
        self.entry_group_state_changed_match = None
 
265
    
148
266
    def rename(self):
149
267
        """Derived from the Avahi example code"""
150
268
        if self.rename_count >= self.max_renames:
151
 
            logger.critical(u"No suitable Zeroconf service name found"
152
 
                            u" after %i retries, exiting.",
 
269
            logger.critical("No suitable Zeroconf service name found"
 
270
                            " after %i retries, exiting.",
153
271
                            self.rename_count)
154
 
            raise AvahiServiceError(u"Too many renames")
155
 
        self.name = self.server.GetAlternativeServiceName(self.name)
156
 
        logger.info(u"Changing Zeroconf service name to %r ...",
157
 
                    unicode(self.name))
158
 
        syslogger.setFormatter(logging.Formatter
159
 
                               (u'Mandos (%s) [%%(process)d]:'
160
 
                                u' %%(levelname)s: %%(message)s'
161
 
                                % self.name))
 
272
            raise AvahiServiceError("Too many renames")
 
273
        self.name = unicode(self.server
 
274
                            .GetAlternativeServiceName(self.name))
 
275
        logger.info("Changing Zeroconf service name to %r ...",
 
276
                    self.name)
162
277
        self.remove()
163
 
        self.add()
 
278
        try:
 
279
            self.add()
 
280
        except dbus.exceptions.DBusException as error:
 
281
            logger.critical("D-Bus Exception", exc_info=error)
 
282
            self.cleanup()
 
283
            os._exit(1)
164
284
        self.rename_count += 1
 
285
    
165
286
    def remove(self):
166
287
        """Derived from the Avahi example code"""
 
288
        if self.entry_group_state_changed_match is not None:
 
289
            self.entry_group_state_changed_match.remove()
 
290
            self.entry_group_state_changed_match = None
167
291
        if self.group is not None:
168
292
            self.group.Reset()
 
293
    
169
294
    def add(self):
170
295
        """Derived from the Avahi example code"""
 
296
        self.remove()
171
297
        if self.group is None:
172
298
            self.group = dbus.Interface(
173
299
                self.bus.get_object(avahi.DBUS_NAME,
174
300
                                    self.server.EntryGroupNew()),
175
301
                avahi.DBUS_INTERFACE_ENTRY_GROUP)
176
 
            self.group.connect_to_signal('StateChanged',
177
 
                                         self.entry_group_state_changed)
178
 
        logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
 
302
        self.entry_group_state_changed_match = (
 
303
            self.group.connect_to_signal(
 
304
                'StateChanged', self.entry_group_state_changed))
 
305
        logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
179
306
                     self.name, self.type)
180
307
        self.group.AddService(
181
308
            self.interface,
186
313
            dbus.UInt16(self.port),
187
314
            avahi.string_array_to_txt_array(self.TXT))
188
315
        self.group.Commit()
 
316
    
189
317
    def entry_group_state_changed(self, state, error):
190
318
        """Derived from the Avahi example code"""
191
 
        logger.debug(u"Avahi state change: %i", state)
 
319
        logger.debug("Avahi entry group state change: %i", state)
192
320
        
193
321
        if state == avahi.ENTRY_GROUP_ESTABLISHED:
194
 
            logger.debug(u"Zeroconf service established.")
 
322
            logger.debug("Zeroconf service established.")
195
323
        elif state == avahi.ENTRY_GROUP_COLLISION:
196
 
            logger.warning(u"Zeroconf service name collision.")
 
324
            logger.info("Zeroconf service name collision.")
197
325
            self.rename()
198
326
        elif state == avahi.ENTRY_GROUP_FAILURE:
199
 
            logger.critical(u"Avahi: Error in group state changed %s",
 
327
            logger.critical("Avahi: Error in group state changed %s",
200
328
                            unicode(error))
201
 
            raise AvahiGroupError(u"State changed: %s"
202
 
                                  % unicode(error))
 
329
            raise AvahiGroupError("State changed: {0!s}"
 
330
                                  .format(error))
 
331
    
203
332
    def cleanup(self):
204
333
        """Derived from the Avahi example code"""
205
334
        if self.group is not None:
206
 
            self.group.Free()
 
335
            try:
 
336
                self.group.Free()
 
337
            except (dbus.exceptions.UnknownMethodException,
 
338
                    dbus.exceptions.DBusException):
 
339
                pass
207
340
            self.group = None
208
 
    def server_state_changed(self, state):
 
341
        self.remove()
 
342
    
 
343
    def server_state_changed(self, state, error=None):
209
344
        """Derived from the Avahi example code"""
210
 
        if state == avahi.SERVER_COLLISION:
211
 
            logger.error(u"Zeroconf server name collision")
212
 
            self.remove()
 
345
        logger.debug("Avahi server state change: %i", state)
 
346
        bad_states = { avahi.SERVER_INVALID:
 
347
                           "Zeroconf server invalid",
 
348
                       avahi.SERVER_REGISTERING: None,
 
349
                       avahi.SERVER_COLLISION:
 
350
                           "Zeroconf server name collision",
 
351
                       avahi.SERVER_FAILURE:
 
352
                           "Zeroconf server failure" }
 
353
        if state in bad_states:
 
354
            if bad_states[state] is not None:
 
355
                if error is None:
 
356
                    logger.error(bad_states[state])
 
357
                else:
 
358
                    logger.error(bad_states[state] + ": %r", error)
 
359
            self.cleanup()
213
360
        elif state == avahi.SERVER_RUNNING:
214
361
            self.add()
 
362
        else:
 
363
            if error is None:
 
364
                logger.debug("Unknown state: %r", state)
 
365
            else:
 
366
                logger.debug("Unknown state: %r: %r", state, error)
 
367
    
215
368
    def activate(self):
216
369
        """Derived from the Avahi example code"""
217
370
        if self.server is None:
218
371
            self.server = dbus.Interface(
219
372
                self.bus.get_object(avahi.DBUS_NAME,
220
 
                                    avahi.DBUS_PATH_SERVER),
 
373
                                    avahi.DBUS_PATH_SERVER,
 
374
                                    follow_name_owner_changes=True),
221
375
                avahi.DBUS_INTERFACE_SERVER)
222
 
        self.server.connect_to_signal(u"StateChanged",
 
376
        self.server.connect_to_signal("StateChanged",
223
377
                                 self.server_state_changed)
224
378
        self.server_state_changed(self.server.GetState())
225
379
 
 
380
class AvahiServiceToSyslog(AvahiService):
 
381
    def rename(self):
 
382
        """Add the new name to the syslog messages"""
 
383
        ret = AvahiService.rename(self)
 
384
        syslogger.setFormatter(logging.Formatter
 
385
                               ('Mandos ({0}) [%(process)d]:'
 
386
                                ' %(levelname)s: %(message)s'
 
387
                                .format(self.name)))
 
388
        return ret
 
389
 
 
390
def timedelta_to_milliseconds(td):
 
391
    "Convert a datetime.timedelta() to milliseconds"
 
392
    return ((td.days * 24 * 60 * 60 * 1000)
 
393
            + (td.seconds * 1000)
 
394
            + (td.microseconds // 1000))
226
395
 
227
396
class Client(object):
228
397
    """A representation of a client host served by this server.
229
398
    
230
399
    Attributes:
231
 
    name:       string; from the config file, used in log messages and
232
 
                        D-Bus identifiers
233
 
    fingerprint: string (40 or 32 hexadecimal digits); used to
234
 
                 uniquely identify the client
235
 
    secret:     bytestring; sent verbatim (over TLS) to client
236
 
    host:       string; available for use by the checker command
237
 
    created:    datetime.datetime(); (UTC) object creation
238
 
    last_enabled: datetime.datetime(); (UTC)
239
 
    enabled:    bool()
240
 
    last_checked_ok: datetime.datetime(); (UTC) or None
241
 
    timeout:    datetime.timedelta(); How long from last_checked_ok
242
 
                                      until this client is invalid
243
 
    interval:   datetime.timedelta(); How often to start a new checker
244
 
    disable_hook:  If set, called by disable() as disable_hook(self)
 
400
    approved:   bool(); 'None' if not yet approved/disapproved
 
401
    approval_delay: datetime.timedelta(); Time to wait for approval
 
402
    approval_duration: datetime.timedelta(); Duration of one approval
245
403
    checker:    subprocess.Popen(); a running checker process used
246
404
                                    to see if the client lives.
247
405
                                    'None' if no process is running.
248
 
    checker_initiator_tag: a gobject event source tag, or None
249
 
    disable_initiator_tag:    - '' -
250
 
    checker_callback_tag:  - '' -
251
 
    checker_command: string; External command which is run to check if
252
 
                     client lives.  %() expansions are done at
 
406
    checker_callback_tag: a gobject event source tag, or None
 
407
    checker_command: string; External command which is run to check
 
408
                     if client lives.  %() expansions are done at
253
409
                     runtime with vars(self) as dict, so that for
254
410
                     instance %(name)s can be used in the command.
 
411
    checker_initiator_tag: a gobject event source tag, or None
 
412
    created:    datetime.datetime(); (UTC) object creation
 
413
    client_structure: Object describing what attributes a client has
 
414
                      and is used for storing the client at exit
255
415
    current_checker_command: string; current running checker_command
 
416
    disable_initiator_tag: a gobject event source tag, or None
 
417
    enabled:    bool()
 
418
    fingerprint: string (40 or 32 hexadecimal digits); used to
 
419
                 uniquely identify the client
 
420
    host:       string; available for use by the checker command
 
421
    interval:   datetime.timedelta(); How often to start a new checker
 
422
    last_approval_request: datetime.datetime(); (UTC) or None
 
423
    last_checked_ok: datetime.datetime(); (UTC) or None
 
424
    last_checker_status: integer between 0 and 255 reflecting exit
 
425
                         status of last checker. -1 reflects crashed
 
426
                         checker, -2 means no checker completed yet.
 
427
    last_enabled: datetime.datetime(); (UTC) or None
 
428
    name:       string; from the config file, used in log messages and
 
429
                        D-Bus identifiers
 
430
    secret:     bytestring; sent verbatim (over TLS) to client
 
431
    timeout:    datetime.timedelta(); How long from last_checked_ok
 
432
                                      until this client is disabled
 
433
    extended_timeout:   extra long timeout when secret has been sent
 
434
    runtime_expansions: Allowed attributes for runtime expansion.
 
435
    expires:    datetime.datetime(); time (UTC) when a client will be
 
436
                disabled, or None
256
437
    """
257
438
    
258
 
    @staticmethod
259
 
    def _datetime_to_milliseconds(dt):
260
 
        "Convert a datetime.datetime() to milliseconds"
261
 
        return ((dt.days * 24 * 60 * 60 * 1000)
262
 
                + (dt.seconds * 1000)
263
 
                + (dt.microseconds // 1000))
 
439
    runtime_expansions = ("approval_delay", "approval_duration",
 
440
                          "created", "enabled", "fingerprint",
 
441
                          "host", "interval", "last_checked_ok",
 
442
                          "last_enabled", "name", "timeout")
 
443
    client_defaults = { "timeout": "5m",
 
444
                        "extended_timeout": "15m",
 
445
                        "interval": "2m",
 
446
                        "checker": "fping -q -- %%(host)s",
 
447
                        "host": "",
 
448
                        "approval_delay": "0s",
 
449
                        "approval_duration": "1s",
 
450
                        "approved_by_default": "True",
 
451
                        "enabled": "True",
 
452
                        }
264
453
    
265
454
    def timeout_milliseconds(self):
266
455
        "Return the 'timeout' attribute in milliseconds"
267
 
        return self._datetime_to_milliseconds(self.timeout)
 
456
        return timedelta_to_milliseconds(self.timeout)
 
457
    
 
458
    def extended_timeout_milliseconds(self):
 
459
        "Return the 'extended_timeout' attribute in milliseconds"
 
460
        return timedelta_to_milliseconds(self.extended_timeout)
268
461
    
269
462
    def interval_milliseconds(self):
270
463
        "Return the 'interval' attribute in milliseconds"
271
 
        return self._datetime_to_milliseconds(self.interval)
272
 
    
273
 
    def __init__(self, name = None, disable_hook=None, config=None):
274
 
        """Note: the 'checker' key in 'config' sets the
275
 
        'checker_command' attribute and *not* the 'checker'
276
 
        attribute."""
 
464
        return timedelta_to_milliseconds(self.interval)
 
465
    
 
466
    def approval_delay_milliseconds(self):
 
467
        return timedelta_to_milliseconds(self.approval_delay)
 
468
    
 
469
    @staticmethod
 
470
    def config_parser(config):
 
471
        """Construct a new dict of client settings of this form:
 
472
        { client_name: {setting_name: value, ...}, ...}
 
473
        with exceptions for any special settings as defined above.
 
474
        NOTE: Must be a pure function. Must return the same result
 
475
        value given the same arguments.
 
476
        """
 
477
        settings = {}
 
478
        for client_name in config.sections():
 
479
            section = dict(config.items(client_name))
 
480
            client = settings[client_name] = {}
 
481
            
 
482
            client["host"] = section["host"]
 
483
            # Reformat values from string types to Python types
 
484
            client["approved_by_default"] = config.getboolean(
 
485
                client_name, "approved_by_default")
 
486
            client["enabled"] = config.getboolean(client_name,
 
487
                                                  "enabled")
 
488
            
 
489
            client["fingerprint"] = (section["fingerprint"].upper()
 
490
                                     .replace(" ", ""))
 
491
            if "secret" in section:
 
492
                client["secret"] = section["secret"].decode("base64")
 
493
            elif "secfile" in section:
 
494
                with open(os.path.expanduser(os.path.expandvars
 
495
                                             (section["secfile"])),
 
496
                          "rb") as secfile:
 
497
                    client["secret"] = secfile.read()
 
498
            else:
 
499
                raise TypeError("No secret or secfile for section {0}"
 
500
                                .format(section))
 
501
            client["timeout"] = string_to_delta(section["timeout"])
 
502
            client["extended_timeout"] = string_to_delta(
 
503
                section["extended_timeout"])
 
504
            client["interval"] = string_to_delta(section["interval"])
 
505
            client["approval_delay"] = string_to_delta(
 
506
                section["approval_delay"])
 
507
            client["approval_duration"] = string_to_delta(
 
508
                section["approval_duration"])
 
509
            client["checker_command"] = section["checker"]
 
510
            client["last_approval_request"] = None
 
511
            client["last_checked_ok"] = None
 
512
            client["last_checker_status"] = -2
 
513
        
 
514
        return settings
 
515
    
 
516
    def __init__(self, settings, name = None):
277
517
        self.name = name
278
 
        if config is None:
279
 
            config = {}
280
 
        logger.debug(u"Creating client %r", self.name)
 
518
        # adding all client settings
 
519
        for setting, value in settings.iteritems():
 
520
            setattr(self, setting, value)
 
521
        
 
522
        if self.enabled:
 
523
            if not hasattr(self, "last_enabled"):
 
524
                self.last_enabled = datetime.datetime.utcnow()
 
525
            if not hasattr(self, "expires"):
 
526
                self.expires = (datetime.datetime.utcnow()
 
527
                                + self.timeout)
 
528
        else:
 
529
            self.last_enabled = None
 
530
            self.expires = None
 
531
        
 
532
        logger.debug("Creating client %r", self.name)
281
533
        # Uppercase and remove spaces from fingerprint for later
282
534
        # comparison purposes with return value from the fingerprint()
283
535
        # function
284
 
        self.fingerprint = (config[u"fingerprint"].upper()
285
 
                            .replace(u" ", u""))
286
 
        logger.debug(u"  Fingerprint: %s", self.fingerprint)
287
 
        if u"secret" in config:
288
 
            self.secret = config[u"secret"].decode(u"base64")
289
 
        elif u"secfile" in config:
290
 
            with closing(open(os.path.expanduser
291
 
                              (os.path.expandvars
292
 
                               (config[u"secfile"])))) as secfile:
293
 
                self.secret = secfile.read()
294
 
        else:
295
 
            raise TypeError(u"No secret or secfile for client %s"
296
 
                            % self.name)
297
 
        self.host = config.get(u"host", u"")
298
 
        self.created = datetime.datetime.utcnow()
299
 
        self.enabled = False
300
 
        self.last_enabled = None
301
 
        self.last_checked_ok = None
302
 
        self.timeout = string_to_delta(config[u"timeout"])
303
 
        self.interval = string_to_delta(config[u"interval"])
304
 
        self.disable_hook = disable_hook
 
536
        logger.debug("  Fingerprint: %s", self.fingerprint)
 
537
        self.created = settings.get("created",
 
538
                                    datetime.datetime.utcnow())
 
539
        
 
540
        # attributes specific for this server instance
305
541
        self.checker = None
306
542
        self.checker_initiator_tag = None
307
543
        self.disable_initiator_tag = None
308
544
        self.checker_callback_tag = None
309
 
        self.checker_command = config[u"checker"]
310
545
        self.current_checker_command = None
311
 
        self.last_connect = None
 
546
        self.approved = None
 
547
        self.approvals_pending = 0
 
548
        self.changedstate = (multiprocessing_manager
 
549
                             .Condition(multiprocessing_manager
 
550
                                        .Lock()))
 
551
        self.client_structure = [attr for attr in
 
552
                                 self.__dict__.iterkeys()
 
553
                                 if not attr.startswith("_")]
 
554
        self.client_structure.append("client_structure")
 
555
        
 
556
        for name, t in inspect.getmembers(type(self),
 
557
                                          lambda obj:
 
558
                                              isinstance(obj,
 
559
                                                         property)):
 
560
            if not name.startswith("_"):
 
561
                self.client_structure.append(name)
 
562
    
 
563
    # Send notice to process children that client state has changed
 
564
    def send_changedstate(self):
 
565
        with self.changedstate:
 
566
            self.changedstate.notify_all()
312
567
    
313
568
    def enable(self):
314
569
        """Start this client's checker and timeout hooks"""
315
 
        if getattr(self, u"enabled", False):
 
570
        if getattr(self, "enabled", False):
316
571
            # Already enabled
317
572
            return
 
573
        self.send_changedstate()
 
574
        self.expires = datetime.datetime.utcnow() + self.timeout
 
575
        self.enabled = True
318
576
        self.last_enabled = datetime.datetime.utcnow()
 
577
        self.init_checker()
 
578
    
 
579
    def disable(self, quiet=True):
 
580
        """Disable this client."""
 
581
        if not getattr(self, "enabled", False):
 
582
            return False
 
583
        if not quiet:
 
584
            self.send_changedstate()
 
585
        if not quiet:
 
586
            logger.info("Disabling client %s", self.name)
 
587
        if getattr(self, "disable_initiator_tag", False):
 
588
            gobject.source_remove(self.disable_initiator_tag)
 
589
            self.disable_initiator_tag = None
 
590
        self.expires = None
 
591
        if getattr(self, "checker_initiator_tag", False):
 
592
            gobject.source_remove(self.checker_initiator_tag)
 
593
            self.checker_initiator_tag = None
 
594
        self.stop_checker()
 
595
        self.enabled = False
 
596
        # Do not run this again if called by a gobject.timeout_add
 
597
        return False
 
598
    
 
599
    def __del__(self):
 
600
        self.disable()
 
601
    
 
602
    def init_checker(self):
319
603
        # Schedule a new checker to be started an 'interval' from now,
320
604
        # and every interval from then on.
321
605
        self.checker_initiator_tag = (gobject.timeout_add
322
606
                                      (self.interval_milliseconds(),
323
607
                                       self.start_checker))
324
 
        # Also start a new checker *right now*.
325
 
        self.start_checker()
326
608
        # Schedule a disable() when 'timeout' has passed
327
609
        self.disable_initiator_tag = (gobject.timeout_add
328
610
                                   (self.timeout_milliseconds(),
329
611
                                    self.disable))
330
 
        self.enabled = True
331
 
    
332
 
    def disable(self):
333
 
        """Disable this client."""
334
 
        if not getattr(self, "enabled", False):
335
 
            return False
336
 
        logger.info(u"Disabling client %s", self.name)
337
 
        if getattr(self, u"disable_initiator_tag", False):
338
 
            gobject.source_remove(self.disable_initiator_tag)
339
 
            self.disable_initiator_tag = None
340
 
        if getattr(self, u"checker_initiator_tag", False):
341
 
            gobject.source_remove(self.checker_initiator_tag)
342
 
            self.checker_initiator_tag = None
343
 
        self.stop_checker()
344
 
        if self.disable_hook:
345
 
            self.disable_hook(self)
346
 
        self.enabled = False
347
 
        # Do not run this again if called by a gobject.timeout_add
348
 
        return False
349
 
    
350
 
    def __del__(self):
351
 
        self.disable_hook = None
352
 
        self.disable()
 
612
        # Also start a new checker *right now*.
 
613
        self.start_checker()
353
614
    
354
615
    def checker_callback(self, pid, condition, command):
355
616
        """The checker has completed, so take appropriate actions."""
356
617
        self.checker_callback_tag = None
357
618
        self.checker = None
358
619
        if os.WIFEXITED(condition):
359
 
            exitstatus = os.WEXITSTATUS(condition)
360
 
            if exitstatus == 0:
361
 
                logger.info(u"Checker for %(name)s succeeded",
 
620
            self.last_checker_status = os.WEXITSTATUS(condition)
 
621
            if self.last_checker_status == 0:
 
622
                logger.info("Checker for %(name)s succeeded",
362
623
                            vars(self))
363
624
                self.checked_ok()
364
625
            else:
365
 
                logger.info(u"Checker for %(name)s failed",
 
626
                logger.info("Checker for %(name)s failed",
366
627
                            vars(self))
367
628
        else:
368
 
            logger.warning(u"Checker for %(name)s crashed?",
 
629
            self.last_checker_status = -1
 
630
            logger.warning("Checker for %(name)s crashed?",
369
631
                           vars(self))
370
632
    
371
633
    def checked_ok(self):
372
 
        """Bump up the timeout for this client.
373
 
        
374
 
        This should only be called when the client has been seen,
375
 
        alive and well.
376
 
        """
 
634
        """Assert that the client has been seen, alive and well."""
377
635
        self.last_checked_ok = datetime.datetime.utcnow()
378
 
        gobject.source_remove(self.disable_initiator_tag)
379
 
        self.disable_initiator_tag = (gobject.timeout_add
380
 
                                      (self.timeout_milliseconds(),
381
 
                                       self.disable))
 
636
        self.last_checker_status = 0
 
637
        self.bump_timeout()
 
638
    
 
639
    def bump_timeout(self, timeout=None):
 
640
        """Bump up the timeout for this client."""
 
641
        if timeout is None:
 
642
            timeout = self.timeout
 
643
        if self.disable_initiator_tag is not None:
 
644
            gobject.source_remove(self.disable_initiator_tag)
 
645
        if getattr(self, "enabled", False):
 
646
            self.disable_initiator_tag = (gobject.timeout_add
 
647
                                          (timedelta_to_milliseconds
 
648
                                           (timeout), self.disable))
 
649
            self.expires = datetime.datetime.utcnow() + timeout
 
650
    
 
651
    def need_approval(self):
 
652
        self.last_approval_request = datetime.datetime.utcnow()
382
653
    
383
654
    def start_checker(self):
384
655
        """Start a new checker subprocess if one is not running.
391
662
        # client would inevitably timeout, since no checker would get
392
663
        # a chance to run to completion.  If we instead leave running
393
664
        # checkers alone, the checker would have to take more time
394
 
        # than 'timeout' for the client to be declared invalid, which
395
 
        # is as it should be.
 
665
        # than 'timeout' for the client to be disabled, which is as it
 
666
        # should be.
396
667
        
397
668
        # If a checker exists, make sure it is not a zombie
398
 
        if self.checker is not None:
 
669
        try:
399
670
            pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
 
671
        except (AttributeError, OSError) as error:
 
672
            if (isinstance(error, OSError)
 
673
                and error.errno != errno.ECHILD):
 
674
                raise error
 
675
        else:
400
676
            if pid:
401
 
                logger.warning(u"Checker was a zombie")
 
677
                logger.warning("Checker was a zombie")
402
678
                gobject.source_remove(self.checker_callback_tag)
403
679
                self.checker_callback(pid, status,
404
680
                                      self.current_checker_command)
409
685
                command = self.checker_command % self.host
410
686
            except TypeError:
411
687
                # Escape attributes for the shell
412
 
                escaped_attrs = dict((key,
413
 
                                      re.escape(unicode(str(val),
414
 
                                                        errors=
415
 
                                                        u'replace')))
416
 
                                     for key, val in
417
 
                                     vars(self).iteritems())
 
688
                escaped_attrs = dict(
 
689
                    (attr,
 
690
                     re.escape(unicode(str(getattr(self, attr, "")),
 
691
                                       errors=
 
692
                                       'replace')))
 
693
                    for attr in
 
694
                    self.runtime_expansions)
 
695
                
418
696
                try:
419
697
                    command = self.checker_command % escaped_attrs
420
 
                except TypeError, error:
421
 
                    logger.error(u'Could not format string "%s":'
422
 
                                 u' %s', self.checker_command, error)
 
698
                except TypeError as error:
 
699
                    logger.error('Could not format string "%s"',
 
700
                                 self.checker_command, exc_info=error)
423
701
                    return True # Try again later
424
702
            self.current_checker_command = command
425
703
            try:
426
 
                logger.info(u"Starting checker %r for %s",
 
704
                logger.info("Starting checker %r for %s",
427
705
                            command, self.name)
428
706
                # We don't need to redirect stdout and stderr, since
429
707
                # in normal mode, that is already done by daemon(),
431
709
                # always replaced by /dev/null.)
432
710
                self.checker = subprocess.Popen(command,
433
711
                                                close_fds=True,
434
 
                                                shell=True, cwd=u"/")
 
712
                                                shell=True, cwd="/")
435
713
                self.checker_callback_tag = (gobject.child_watch_add
436
714
                                             (self.checker.pid,
437
715
                                              self.checker_callback,
442
720
                if pid:
443
721
                    gobject.source_remove(self.checker_callback_tag)
444
722
                    self.checker_callback(pid, status, command)
445
 
            except OSError, error:
446
 
                logger.error(u"Failed to start subprocess: %s",
447
 
                             error)
 
723
            except OSError as error:
 
724
                logger.error("Failed to start subprocess",
 
725
                             exc_info=error)
448
726
        # Re-run this periodically if run by gobject.timeout_add
449
727
        return True
450
728
    
453
731
        if self.checker_callback_tag:
454
732
            gobject.source_remove(self.checker_callback_tag)
455
733
            self.checker_callback_tag = None
456
 
        if getattr(self, u"checker", None) is None:
 
734
        if getattr(self, "checker", None) is None:
457
735
            return
458
 
        logger.debug(u"Stopping checker for %(name)s", vars(self))
 
736
        logger.debug("Stopping checker for %(name)s", vars(self))
459
737
        try:
460
 
            os.kill(self.checker.pid, signal.SIGTERM)
461
 
            #os.sleep(0.5)
 
738
            self.checker.terminate()
 
739
            #time.sleep(0.5)
462
740
            #if self.checker.poll() is None:
463
 
            #    os.kill(self.checker.pid, signal.SIGKILL)
464
 
        except OSError, error:
 
741
            #    self.checker.kill()
 
742
        except OSError as error:
465
743
            if error.errno != errno.ESRCH: # No such process
466
744
                raise
467
745
        self.checker = None
468
 
    
469
 
    def still_valid(self):
470
 
        """Has the timeout not yet passed for this client?"""
471
 
        if not getattr(self, u"enabled", False):
472
 
            return False
473
 
        now = datetime.datetime.utcnow()
474
 
        if self.last_checked_ok is None:
475
 
            return now < (self.created + self.timeout)
476
 
        else:
477
 
            return now < (self.last_checked_ok + self.timeout)
478
 
 
479
 
 
480
 
class ClientDBus(Client, dbus.service.Object):
 
746
 
 
747
 
 
748
def dbus_service_property(dbus_interface, signature="v",
 
749
                          access="readwrite", byte_arrays=False):
 
750
    """Decorators for marking methods of a DBusObjectWithProperties to
 
751
    become properties on the D-Bus.
 
752
    
 
753
    The decorated method will be called with no arguments by "Get"
 
754
    and with one argument by "Set".
 
755
    
 
756
    The parameters, where they are supported, are the same as
 
757
    dbus.service.method, except there is only "signature", since the
 
758
    type from Get() and the type sent to Set() is the same.
 
759
    """
 
760
    # Encoding deeply encoded byte arrays is not supported yet by the
 
761
    # "Set" method, so we fail early here:
 
762
    if byte_arrays and signature != "ay":
 
763
        raise ValueError("Byte arrays not supported for non-'ay'"
 
764
                         " signature {0!r}".format(signature))
 
765
    def decorator(func):
 
766
        func._dbus_is_property = True
 
767
        func._dbus_interface = dbus_interface
 
768
        func._dbus_signature = signature
 
769
        func._dbus_access = access
 
770
        func._dbus_name = func.__name__
 
771
        if func._dbus_name.endswith("_dbus_property"):
 
772
            func._dbus_name = func._dbus_name[:-14]
 
773
        func._dbus_get_args_options = {'byte_arrays': byte_arrays }
 
774
        return func
 
775
    return decorator
 
776
 
 
777
 
 
778
def dbus_interface_annotations(dbus_interface):
 
779
    """Decorator for marking functions returning interface annotations
 
780
    
 
781
    Usage:
 
782
    
 
783
    @dbus_interface_annotations("org.example.Interface")
 
784
    def _foo(self):  # Function name does not matter
 
785
        return {"org.freedesktop.DBus.Deprecated": "true",
 
786
                "org.freedesktop.DBus.Property.EmitsChangedSignal":
 
787
                    "false"}
 
788
    """
 
789
    def decorator(func):
 
790
        func._dbus_is_interface = True
 
791
        func._dbus_interface = dbus_interface
 
792
        func._dbus_name = dbus_interface
 
793
        return func
 
794
    return decorator
 
795
 
 
796
 
 
797
def dbus_annotations(annotations):
 
798
    """Decorator to annotate D-Bus methods, signals or properties
 
799
    Usage:
 
800
    
 
801
    @dbus_service_property("org.example.Interface", signature="b",
 
802
                           access="r")
 
803
    @dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",
 
804
                        "org.freedesktop.DBus.Property."
 
805
                        "EmitsChangedSignal": "false"})
 
806
    def Property_dbus_property(self):
 
807
        return dbus.Boolean(False)
 
808
    """
 
809
    def decorator(func):
 
810
        func._dbus_annotations = annotations
 
811
        return func
 
812
    return decorator
 
813
 
 
814
 
 
815
class DBusPropertyException(dbus.exceptions.DBusException):
 
816
    """A base class for D-Bus property-related exceptions
 
817
    """
 
818
    def __unicode__(self):
 
819
        return unicode(str(self))
 
820
 
 
821
 
 
822
class DBusPropertyAccessException(DBusPropertyException):
 
823
    """A property's access permissions disallows an operation.
 
824
    """
 
825
    pass
 
826
 
 
827
 
 
828
class DBusPropertyNotFound(DBusPropertyException):
 
829
    """An attempt was made to access a non-existing property.
 
830
    """
 
831
    pass
 
832
 
 
833
 
 
834
class DBusObjectWithProperties(dbus.service.Object):
 
835
    """A D-Bus object with properties.
 
836
    
 
837
    Classes inheriting from this can use the dbus_service_property
 
838
    decorator to expose methods as D-Bus properties.  It exposes the
 
839
    standard Get(), Set(), and GetAll() methods on the D-Bus.
 
840
    """
 
841
    
 
842
    @staticmethod
 
843
    def _is_dbus_thing(thing):
 
844
        """Returns a function testing if an attribute is a D-Bus thing
 
845
        
 
846
        If called like _is_dbus_thing("method") it returns a function
 
847
        suitable for use as predicate to inspect.getmembers().
 
848
        """
 
849
        return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),
 
850
                                   False)
 
851
    
 
852
    def _get_all_dbus_things(self, thing):
 
853
        """Returns a generator of (name, attribute) pairs
 
854
        """
 
855
        return ((getattr(athing.__get__(self), "_dbus_name",
 
856
                         name),
 
857
                 athing.__get__(self))
 
858
                for cls in self.__class__.__mro__
 
859
                for name, athing in
 
860
                inspect.getmembers(cls,
 
861
                                   self._is_dbus_thing(thing)))
 
862
    
 
863
    def _get_dbus_property(self, interface_name, property_name):
 
864
        """Returns a bound method if one exists which is a D-Bus
 
865
        property with the specified name and interface.
 
866
        """
 
867
        for cls in  self.__class__.__mro__:
 
868
            for name, value in (inspect.getmembers
 
869
                                (cls,
 
870
                                 self._is_dbus_thing("property"))):
 
871
                if (value._dbus_name == property_name
 
872
                    and value._dbus_interface == interface_name):
 
873
                    return value.__get__(self)
 
874
        
 
875
        # No such property
 
876
        raise DBusPropertyNotFound(self.dbus_object_path + ":"
 
877
                                   + interface_name + "."
 
878
                                   + property_name)
 
879
    
 
880
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
 
881
                         out_signature="v")
 
882
    def Get(self, interface_name, property_name):
 
883
        """Standard D-Bus property Get() method, see D-Bus standard.
 
884
        """
 
885
        prop = self._get_dbus_property(interface_name, property_name)
 
886
        if prop._dbus_access == "write":
 
887
            raise DBusPropertyAccessException(property_name)
 
888
        value = prop()
 
889
        if not hasattr(value, "variant_level"):
 
890
            return value
 
891
        return type(value)(value, variant_level=value.variant_level+1)
 
892
    
 
893
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
 
894
    def Set(self, interface_name, property_name, value):
 
895
        """Standard D-Bus property Set() method, see D-Bus standard.
 
896
        """
 
897
        prop = self._get_dbus_property(interface_name, property_name)
 
898
        if prop._dbus_access == "read":
 
899
            raise DBusPropertyAccessException(property_name)
 
900
        if prop._dbus_get_args_options["byte_arrays"]:
 
901
            # The byte_arrays option is not supported yet on
 
902
            # signatures other than "ay".
 
903
            if prop._dbus_signature != "ay":
 
904
                raise ValueError
 
905
            value = dbus.ByteArray(b''.join(chr(byte)
 
906
                                            for byte in value))
 
907
        prop(value)
 
908
    
 
909
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
 
910
                         out_signature="a{sv}")
 
911
    def GetAll(self, interface_name):
 
912
        """Standard D-Bus property GetAll() method, see D-Bus
 
913
        standard.
 
914
        
 
915
        Note: Will not include properties with access="write".
 
916
        """
 
917
        properties = {}
 
918
        for name, prop in self._get_all_dbus_things("property"):
 
919
            if (interface_name
 
920
                and interface_name != prop._dbus_interface):
 
921
                # Interface non-empty but did not match
 
922
                continue
 
923
            # Ignore write-only properties
 
924
            if prop._dbus_access == "write":
 
925
                continue
 
926
            value = prop()
 
927
            if not hasattr(value, "variant_level"):
 
928
                properties[name] = value
 
929
                continue
 
930
            properties[name] = type(value)(value, variant_level=
 
931
                                           value.variant_level+1)
 
932
        return dbus.Dictionary(properties, signature="sv")
 
933
    
 
934
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
 
935
                         out_signature="s",
 
936
                         path_keyword='object_path',
 
937
                         connection_keyword='connection')
 
938
    def Introspect(self, object_path, connection):
 
939
        """Overloading of standard D-Bus method.
 
940
        
 
941
        Inserts property tags and interface annotation tags.
 
942
        """
 
943
        xmlstring = dbus.service.Object.Introspect(self, object_path,
 
944
                                                   connection)
 
945
        try:
 
946
            document = xml.dom.minidom.parseString(xmlstring)
 
947
            def make_tag(document, name, prop):
 
948
                e = document.createElement("property")
 
949
                e.setAttribute("name", name)
 
950
                e.setAttribute("type", prop._dbus_signature)
 
951
                e.setAttribute("access", prop._dbus_access)
 
952
                return e
 
953
            for if_tag in document.getElementsByTagName("interface"):
 
954
                # Add property tags
 
955
                for tag in (make_tag(document, name, prop)
 
956
                            for name, prop
 
957
                            in self._get_all_dbus_things("property")
 
958
                            if prop._dbus_interface
 
959
                            == if_tag.getAttribute("name")):
 
960
                    if_tag.appendChild(tag)
 
961
                # Add annotation tags
 
962
                for typ in ("method", "signal", "property"):
 
963
                    for tag in if_tag.getElementsByTagName(typ):
 
964
                        annots = dict()
 
965
                        for name, prop in (self.
 
966
                                           _get_all_dbus_things(typ)):
 
967
                            if (name == tag.getAttribute("name")
 
968
                                and prop._dbus_interface
 
969
                                == if_tag.getAttribute("name")):
 
970
                                annots.update(getattr
 
971
                                              (prop,
 
972
                                               "_dbus_annotations",
 
973
                                               {}))
 
974
                        for name, value in annots.iteritems():
 
975
                            ann_tag = document.createElement(
 
976
                                "annotation")
 
977
                            ann_tag.setAttribute("name", name)
 
978
                            ann_tag.setAttribute("value", value)
 
979
                            tag.appendChild(ann_tag)
 
980
                # Add interface annotation tags
 
981
                for annotation, value in dict(
 
982
                    itertools.chain(
 
983
                        *(annotations().iteritems()
 
984
                          for name, annotations in
 
985
                          self._get_all_dbus_things("interface")
 
986
                          if name == if_tag.getAttribute("name")
 
987
                          ))).iteritems():
 
988
                    ann_tag = document.createElement("annotation")
 
989
                    ann_tag.setAttribute("name", annotation)
 
990
                    ann_tag.setAttribute("value", value)
 
991
                    if_tag.appendChild(ann_tag)
 
992
                # Add the names to the return values for the
 
993
                # "org.freedesktop.DBus.Properties" methods
 
994
                if (if_tag.getAttribute("name")
 
995
                    == "org.freedesktop.DBus.Properties"):
 
996
                    for cn in if_tag.getElementsByTagName("method"):
 
997
                        if cn.getAttribute("name") == "Get":
 
998
                            for arg in cn.getElementsByTagName("arg"):
 
999
                                if (arg.getAttribute("direction")
 
1000
                                    == "out"):
 
1001
                                    arg.setAttribute("name", "value")
 
1002
                        elif cn.getAttribute("name") == "GetAll":
 
1003
                            for arg in cn.getElementsByTagName("arg"):
 
1004
                                if (arg.getAttribute("direction")
 
1005
                                    == "out"):
 
1006
                                    arg.setAttribute("name", "props")
 
1007
            xmlstring = document.toxml("utf-8")
 
1008
            document.unlink()
 
1009
        except (AttributeError, xml.dom.DOMException,
 
1010
                xml.parsers.expat.ExpatError) as error:
 
1011
            logger.error("Failed to override Introspection method",
 
1012
                         exc_info=error)
 
1013
        return xmlstring
 
1014
 
 
1015
 
 
1016
def datetime_to_dbus (dt, variant_level=0):
 
1017
    """Convert a UTC datetime.datetime() to a D-Bus type."""
 
1018
    if dt is None:
 
1019
        return dbus.String("", variant_level = variant_level)
 
1020
    return dbus.String(dt.isoformat(),
 
1021
                       variant_level=variant_level)
 
1022
 
 
1023
 
 
1024
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
 
1025
    """A class decorator; applied to a subclass of
 
1026
    dbus.service.Object, it will add alternate D-Bus attributes with
 
1027
    interface names according to the "alt_interface_names" mapping.
 
1028
    Usage:
 
1029
    
 
1030
    @alternate_dbus_names({"org.example.Interface":
 
1031
                               "net.example.AlternateInterface"})
 
1032
    class SampleDBusObject(dbus.service.Object):
 
1033
        @dbus.service.method("org.example.Interface")
 
1034
        def SampleDBusMethod():
 
1035
            pass
 
1036
    
 
1037
    The above "SampleDBusMethod" on "SampleDBusObject" will be
 
1038
    reachable via two interfaces: "org.example.Interface" and
 
1039
    "net.example.AlternateInterface", the latter of which will have
 
1040
    its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
 
1041
    "true", unless "deprecate" is passed with a False value.
 
1042
    
 
1043
    This works for methods and signals, and also for D-Bus properties
 
1044
    (from DBusObjectWithProperties) and interfaces (from the
 
1045
    dbus_interface_annotations decorator).
 
1046
    """
 
1047
    def wrapper(cls):
 
1048
        for orig_interface_name, alt_interface_name in (
 
1049
            alt_interface_names.iteritems()):
 
1050
            attr = {}
 
1051
            interface_names = set()
 
1052
            # Go though all attributes of the class
 
1053
            for attrname, attribute in inspect.getmembers(cls):
 
1054
                # Ignore non-D-Bus attributes, and D-Bus attributes
 
1055
                # with the wrong interface name
 
1056
                if (not hasattr(attribute, "_dbus_interface")
 
1057
                    or not attribute._dbus_interface
 
1058
                    .startswith(orig_interface_name)):
 
1059
                    continue
 
1060
                # Create an alternate D-Bus interface name based on
 
1061
                # the current name
 
1062
                alt_interface = (attribute._dbus_interface
 
1063
                                 .replace(orig_interface_name,
 
1064
                                          alt_interface_name))
 
1065
                interface_names.add(alt_interface)
 
1066
                # Is this a D-Bus signal?
 
1067
                if getattr(attribute, "_dbus_is_signal", False):
 
1068
                    # Extract the original non-method function by
 
1069
                    # black magic
 
1070
                    nonmethod_func = (dict(
 
1071
                            zip(attribute.func_code.co_freevars,
 
1072
                                attribute.__closure__))["func"]
 
1073
                                      .cell_contents)
 
1074
                    # Create a new, but exactly alike, function
 
1075
                    # object, and decorate it to be a new D-Bus signal
 
1076
                    # with the alternate D-Bus interface name
 
1077
                    new_function = (dbus.service.signal
 
1078
                                    (alt_interface,
 
1079
                                     attribute._dbus_signature)
 
1080
                                    (types.FunctionType(
 
1081
                                nonmethod_func.func_code,
 
1082
                                nonmethod_func.func_globals,
 
1083
                                nonmethod_func.func_name,
 
1084
                                nonmethod_func.func_defaults,
 
1085
                                nonmethod_func.func_closure)))
 
1086
                    # Copy annotations, if any
 
1087
                    try:
 
1088
                        new_function._dbus_annotations = (
 
1089
                            dict(attribute._dbus_annotations))
 
1090
                    except AttributeError:
 
1091
                        pass
 
1092
                    # Define a creator of a function to call both the
 
1093
                    # original and alternate functions, so both the
 
1094
                    # original and alternate signals gets sent when
 
1095
                    # the function is called
 
1096
                    def fixscope(func1, func2):
 
1097
                        """This function is a scope container to pass
 
1098
                        func1 and func2 to the "call_both" function
 
1099
                        outside of its arguments"""
 
1100
                        def call_both(*args, **kwargs):
 
1101
                            """This function will emit two D-Bus
 
1102
                            signals by calling func1 and func2"""
 
1103
                            func1(*args, **kwargs)
 
1104
                            func2(*args, **kwargs)
 
1105
                        return call_both
 
1106
                    # Create the "call_both" function and add it to
 
1107
                    # the class
 
1108
                    attr[attrname] = fixscope(attribute, new_function)
 
1109
                # Is this a D-Bus method?
 
1110
                elif getattr(attribute, "_dbus_is_method", False):
 
1111
                    # Create a new, but exactly alike, function
 
1112
                    # object.  Decorate it to be a new D-Bus method
 
1113
                    # with the alternate D-Bus interface name.  Add it
 
1114
                    # to the class.
 
1115
                    attr[attrname] = (dbus.service.method
 
1116
                                      (alt_interface,
 
1117
                                       attribute._dbus_in_signature,
 
1118
                                       attribute._dbus_out_signature)
 
1119
                                      (types.FunctionType
 
1120
                                       (attribute.func_code,
 
1121
                                        attribute.func_globals,
 
1122
                                        attribute.func_name,
 
1123
                                        attribute.func_defaults,
 
1124
                                        attribute.func_closure)))
 
1125
                    # Copy annotations, if any
 
1126
                    try:
 
1127
                        attr[attrname]._dbus_annotations = (
 
1128
                            dict(attribute._dbus_annotations))
 
1129
                    except AttributeError:
 
1130
                        pass
 
1131
                # Is this a D-Bus property?
 
1132
                elif getattr(attribute, "_dbus_is_property", False):
 
1133
                    # Create a new, but exactly alike, function
 
1134
                    # object, and decorate it to be a new D-Bus
 
1135
                    # property with the alternate D-Bus interface
 
1136
                    # name.  Add it to the class.
 
1137
                    attr[attrname] = (dbus_service_property
 
1138
                                      (alt_interface,
 
1139
                                       attribute._dbus_signature,
 
1140
                                       attribute._dbus_access,
 
1141
                                       attribute
 
1142
                                       ._dbus_get_args_options
 
1143
                                       ["byte_arrays"])
 
1144
                                      (types.FunctionType
 
1145
                                       (attribute.func_code,
 
1146
                                        attribute.func_globals,
 
1147
                                        attribute.func_name,
 
1148
                                        attribute.func_defaults,
 
1149
                                        attribute.func_closure)))
 
1150
                    # Copy annotations, if any
 
1151
                    try:
 
1152
                        attr[attrname]._dbus_annotations = (
 
1153
                            dict(attribute._dbus_annotations))
 
1154
                    except AttributeError:
 
1155
                        pass
 
1156
                # Is this a D-Bus interface?
 
1157
                elif getattr(attribute, "_dbus_is_interface", False):
 
1158
                    # Create a new, but exactly alike, function
 
1159
                    # object.  Decorate it to be a new D-Bus interface
 
1160
                    # with the alternate D-Bus interface name.  Add it
 
1161
                    # to the class.
 
1162
                    attr[attrname] = (dbus_interface_annotations
 
1163
                                      (alt_interface)
 
1164
                                      (types.FunctionType
 
1165
                                       (attribute.func_code,
 
1166
                                        attribute.func_globals,
 
1167
                                        attribute.func_name,
 
1168
                                        attribute.func_defaults,
 
1169
                                        attribute.func_closure)))
 
1170
            if deprecate:
 
1171
                # Deprecate all alternate interfaces
 
1172
                iname="_AlternateDBusNames_interface_annotation{0}"
 
1173
                for interface_name in interface_names:
 
1174
                    @dbus_interface_annotations(interface_name)
 
1175
                    def func(self):
 
1176
                        return { "org.freedesktop.DBus.Deprecated":
 
1177
                                     "true" }
 
1178
                    # Find an unused name
 
1179
                    for aname in (iname.format(i)
 
1180
                                  for i in itertools.count()):
 
1181
                        if aname not in attr:
 
1182
                            attr[aname] = func
 
1183
                            break
 
1184
            if interface_names:
 
1185
                # Replace the class with a new subclass of it with
 
1186
                # methods, signals, etc. as created above.
 
1187
                cls = type(b"{0}Alternate".format(cls.__name__),
 
1188
                           (cls,), attr)
 
1189
        return cls
 
1190
    return wrapper
 
1191
 
 
1192
 
 
1193
@alternate_dbus_interfaces({"se.recompile.Mandos":
 
1194
                                "se.bsnet.fukt.Mandos"})
 
1195
class ClientDBus(Client, DBusObjectWithProperties):
481
1196
    """A Client class using D-Bus
482
1197
    
483
1198
    Attributes:
484
1199
    dbus_object_path: dbus.ObjectPath
485
1200
    bus: dbus.SystemBus()
486
1201
    """
 
1202
    
 
1203
    runtime_expansions = (Client.runtime_expansions
 
1204
                          + ("dbus_object_path",))
 
1205
    
487
1206
    # dbus.service.Object doesn't use super(), so we can't either.
488
1207
    
489
1208
    def __init__(self, bus = None, *args, **kwargs):
491
1210
        Client.__init__(self, *args, **kwargs)
492
1211
        # Only now, when this client is initialized, can it show up on
493
1212
        # the D-Bus
 
1213
        client_object_name = unicode(self.name).translate(
 
1214
            {ord("."): ord("_"),
 
1215
             ord("-"): ord("_")})
494
1216
        self.dbus_object_path = (dbus.ObjectPath
495
 
                                 (u"/clients/"
496
 
                                  + self.name.replace(u".", u"_")))
497
 
        dbus.service.Object.__init__(self, self.bus,
498
 
                                     self.dbus_object_path)
499
 
    
500
 
    @staticmethod
501
 
    def _datetime_to_dbus(dt, variant_level=0):
502
 
        """Convert a UTC datetime.datetime() to a D-Bus type."""
503
 
        return dbus.String(dt.isoformat(),
504
 
                           variant_level=variant_level)
505
 
    
506
 
    def enable(self):
507
 
        oldstate = getattr(self, u"enabled", False)
508
 
        r = Client.enable(self)
509
 
        if oldstate != self.enabled:
510
 
            # Emit D-Bus signals
511
 
            self.PropertyChanged(dbus.String(u"enabled"),
512
 
                                 dbus.Boolean(True, variant_level=1))
513
 
            self.PropertyChanged(
514
 
                dbus.String(u"last_enabled"),
515
 
                self._datetime_to_dbus(self.last_enabled,
516
 
                                       variant_level=1))
517
 
        return r
518
 
    
519
 
    def disable(self, signal = True):
520
 
        oldstate = getattr(self, u"enabled", False)
521
 
        r = Client.disable(self)
522
 
        if signal and oldstate != self.enabled:
523
 
            # Emit D-Bus signal
524
 
            self.PropertyChanged(dbus.String(u"enabled"),
525
 
                                 dbus.Boolean(False, variant_level=1))
526
 
        return r
 
1217
                                 ("/clients/" + client_object_name))
 
1218
        DBusObjectWithProperties.__init__(self, self.bus,
 
1219
                                          self.dbus_object_path)
 
1220
    
 
1221
    def notifychangeproperty(transform_func,
 
1222
                             dbus_name, type_func=lambda x: x,
 
1223
                             variant_level=1):
 
1224
        """ Modify a variable so that it's a property which announces
 
1225
        its changes to DBus.
 
1226
        
 
1227
        transform_fun: Function that takes a value and a variant_level
 
1228
                       and transforms it to a D-Bus type.
 
1229
        dbus_name: D-Bus name of the variable
 
1230
        type_func: Function that transform the value before sending it
 
1231
                   to the D-Bus.  Default: no transform
 
1232
        variant_level: D-Bus variant level.  Default: 1
 
1233
        """
 
1234
        attrname = "_{0}".format(dbus_name)
 
1235
        def setter(self, value):
 
1236
            if hasattr(self, "dbus_object_path"):
 
1237
                if (not hasattr(self, attrname) or
 
1238
                    type_func(getattr(self, attrname, None))
 
1239
                    != type_func(value)):
 
1240
                    dbus_value = transform_func(type_func(value),
 
1241
                                                variant_level
 
1242
                                                =variant_level)
 
1243
                    self.PropertyChanged(dbus.String(dbus_name),
 
1244
                                         dbus_value)
 
1245
            setattr(self, attrname, value)
 
1246
        
 
1247
        return property(lambda self: getattr(self, attrname), setter)
 
1248
    
 
1249
    expires = notifychangeproperty(datetime_to_dbus, "Expires")
 
1250
    approvals_pending = notifychangeproperty(dbus.Boolean,
 
1251
                                             "ApprovalPending",
 
1252
                                             type_func = bool)
 
1253
    enabled = notifychangeproperty(dbus.Boolean, "Enabled")
 
1254
    last_enabled = notifychangeproperty(datetime_to_dbus,
 
1255
                                        "LastEnabled")
 
1256
    checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",
 
1257
                                   type_func = lambda checker:
 
1258
                                       checker is not None)
 
1259
    last_checked_ok = notifychangeproperty(datetime_to_dbus,
 
1260
                                           "LastCheckedOK")
 
1261
    last_checker_status = notifychangeproperty(dbus.Int16,
 
1262
                                               "LastCheckerStatus")
 
1263
    last_approval_request = notifychangeproperty(
 
1264
        datetime_to_dbus, "LastApprovalRequest")
 
1265
    approved_by_default = notifychangeproperty(dbus.Boolean,
 
1266
                                               "ApprovedByDefault")
 
1267
    approval_delay = notifychangeproperty(dbus.UInt64,
 
1268
                                          "ApprovalDelay",
 
1269
                                          type_func =
 
1270
                                          timedelta_to_milliseconds)
 
1271
    approval_duration = notifychangeproperty(
 
1272
        dbus.UInt64, "ApprovalDuration",
 
1273
        type_func = timedelta_to_milliseconds)
 
1274
    host = notifychangeproperty(dbus.String, "Host")
 
1275
    timeout = notifychangeproperty(dbus.UInt64, "Timeout",
 
1276
                                   type_func =
 
1277
                                   timedelta_to_milliseconds)
 
1278
    extended_timeout = notifychangeproperty(
 
1279
        dbus.UInt64, "ExtendedTimeout",
 
1280
        type_func = timedelta_to_milliseconds)
 
1281
    interval = notifychangeproperty(dbus.UInt64,
 
1282
                                    "Interval",
 
1283
                                    type_func =
 
1284
                                    timedelta_to_milliseconds)
 
1285
    checker_command = notifychangeproperty(dbus.String, "Checker")
 
1286
    
 
1287
    del notifychangeproperty
527
1288
    
528
1289
    def __del__(self, *args, **kwargs):
529
1290
        try:
530
1291
            self.remove_from_connection()
531
1292
        except LookupError:
532
1293
            pass
533
 
        if hasattr(dbus.service.Object, u"__del__"):
534
 
            dbus.service.Object.__del__(self, *args, **kwargs)
 
1294
        if hasattr(DBusObjectWithProperties, "__del__"):
 
1295
            DBusObjectWithProperties.__del__(self, *args, **kwargs)
535
1296
        Client.__del__(self, *args, **kwargs)
536
1297
    
537
1298
    def checker_callback(self, pid, condition, command,
538
1299
                         *args, **kwargs):
539
1300
        self.checker_callback_tag = None
540
1301
        self.checker = None
541
 
        # Emit D-Bus signal
542
 
        self.PropertyChanged(dbus.String(u"checker_running"),
543
 
                             dbus.Boolean(False, variant_level=1))
544
1302
        if os.WIFEXITED(condition):
545
1303
            exitstatus = os.WEXITSTATUS(condition)
546
1304
            # Emit D-Bus signal
556
1314
        return Client.checker_callback(self, pid, condition, command,
557
1315
                                       *args, **kwargs)
558
1316
    
559
 
    def checked_ok(self, *args, **kwargs):
560
 
        r = Client.checked_ok(self, *args, **kwargs)
561
 
        # Emit D-Bus signal
562
 
        self.PropertyChanged(
563
 
            dbus.String(u"last_checked_ok"),
564
 
            (self._datetime_to_dbus(self.last_checked_ok,
565
 
                                    variant_level=1)))
566
 
        return r
567
 
    
568
1317
    def start_checker(self, *args, **kwargs):
569
1318
        old_checker = self.checker
570
1319
        if self.checker is not None:
577
1326
            and old_checker_pid != self.checker.pid):
578
1327
            # Emit D-Bus signal
579
1328
            self.CheckerStarted(self.current_checker_command)
580
 
            self.PropertyChanged(
581
 
                dbus.String(u"checker_running"),
582
 
                dbus.Boolean(True, variant_level=1))
583
 
        return r
584
 
    
585
 
    def stop_checker(self, *args, **kwargs):
586
 
        old_checker = getattr(self, u"checker", None)
587
 
        r = Client.stop_checker(self, *args, **kwargs)
588
 
        if (old_checker is not None
589
 
            and getattr(self, u"checker", None) is None):
590
 
            self.PropertyChanged(dbus.String(u"checker_running"),
591
 
                                 dbus.Boolean(False, variant_level=1))
592
 
        return r
593
 
    
594
 
    ## D-Bus methods & signals
595
 
    _interface = u"se.bsnet.fukt.Mandos.Client"
596
 
    
597
 
    # CheckedOK - method
598
 
    @dbus.service.method(_interface)
599
 
    def CheckedOK(self):
600
 
        return self.checked_ok()
 
1329
        return r
 
1330
    
 
1331
    def _reset_approved(self):
 
1332
        self.approved = None
 
1333
        return False
 
1334
    
 
1335
    def approve(self, value=True):
 
1336
        self.send_changedstate()
 
1337
        self.approved = value
 
1338
        gobject.timeout_add(timedelta_to_milliseconds
 
1339
                            (self.approval_duration),
 
1340
                            self._reset_approved)
 
1341
    
 
1342
    ## D-Bus methods, signals & properties
 
1343
    _interface = "se.recompile.Mandos.Client"
 
1344
    
 
1345
    ## Interfaces
 
1346
    
 
1347
    @dbus_interface_annotations(_interface)
 
1348
    def _foo(self):
 
1349
        return { "org.freedesktop.DBus.Property.EmitsChangedSignal":
 
1350
                     "false"}
 
1351
    
 
1352
    ## Signals
601
1353
    
602
1354
    # CheckerCompleted - signal
603
 
    @dbus.service.signal(_interface, signature=u"nxs")
 
1355
    @dbus.service.signal(_interface, signature="nxs")
604
1356
    def CheckerCompleted(self, exitcode, waitstatus, command):
605
1357
        "D-Bus signal"
606
1358
        pass
607
1359
    
608
1360
    # CheckerStarted - signal
609
 
    @dbus.service.signal(_interface, signature=u"s")
 
1361
    @dbus.service.signal(_interface, signature="s")
610
1362
    def CheckerStarted(self, command):
611
1363
        "D-Bus signal"
612
1364
        pass
613
1365
    
614
 
    # GetAllProperties - method
615
 
    @dbus.service.method(_interface, out_signature=u"a{sv}")
616
 
    def GetAllProperties(self):
617
 
        "D-Bus method"
618
 
        return dbus.Dictionary({
619
 
                dbus.String(u"name"):
620
 
                    dbus.String(self.name, variant_level=1),
621
 
                dbus.String(u"fingerprint"):
622
 
                    dbus.String(self.fingerprint, variant_level=1),
623
 
                dbus.String(u"host"):
624
 
                    dbus.String(self.host, variant_level=1),
625
 
                dbus.String(u"created"):
626
 
                    self._datetime_to_dbus(self.created,
627
 
                                           variant_level=1),
628
 
                dbus.String(u"last_enabled"):
629
 
                    (self._datetime_to_dbus(self.last_enabled,
630
 
                                            variant_level=1)
631
 
                     if self.last_enabled is not None
632
 
                     else dbus.Boolean(False, variant_level=1)),
633
 
                dbus.String(u"enabled"):
634
 
                    dbus.Boolean(self.enabled, variant_level=1),
635
 
                dbus.String(u"last_checked_ok"):
636
 
                    (self._datetime_to_dbus(self.last_checked_ok,
637
 
                                            variant_level=1)
638
 
                     if self.last_checked_ok is not None
639
 
                     else dbus.Boolean (False, variant_level=1)),
640
 
                dbus.String(u"timeout"):
641
 
                    dbus.UInt64(self.timeout_milliseconds(),
642
 
                                variant_level=1),
643
 
                dbus.String(u"interval"):
644
 
                    dbus.UInt64(self.interval_milliseconds(),
645
 
                                variant_level=1),
646
 
                dbus.String(u"checker"):
647
 
                    dbus.String(self.checker_command,
648
 
                                variant_level=1),
649
 
                dbus.String(u"checker_running"):
650
 
                    dbus.Boolean(self.checker is not None,
651
 
                                 variant_level=1),
652
 
                dbus.String(u"object_path"):
653
 
                    dbus.ObjectPath(self.dbus_object_path,
654
 
                                    variant_level=1)
655
 
                }, signature=u"sv")
656
 
    
657
 
    # IsStillValid - method
658
 
    @dbus.service.method(_interface, out_signature=u"b")
659
 
    def IsStillValid(self):
660
 
        return self.still_valid()
661
 
    
662
1366
    # PropertyChanged - signal
663
 
    @dbus.service.signal(_interface, signature=u"sv")
 
1367
    @dbus.service.signal(_interface, signature="sv")
664
1368
    def PropertyChanged(self, property, value):
665
1369
        "D-Bus signal"
666
1370
        pass
667
1371
    
668
 
    # ReceivedSecret - signal
 
1372
    # GotSecret - signal
669
1373
    @dbus.service.signal(_interface)
670
 
    def ReceivedSecret(self):
671
 
        "D-Bus signal"
 
1374
    def GotSecret(self):
 
1375
        """D-Bus signal
 
1376
        Is sent after a successful transfer of secret from the Mandos
 
1377
        server to mandos-client
 
1378
        """
672
1379
        pass
673
1380
    
674
1381
    # Rejected - signal
675
 
    @dbus.service.signal(_interface)
676
 
    def Rejected(self):
 
1382
    @dbus.service.signal(_interface, signature="s")
 
1383
    def Rejected(self, reason):
677
1384
        "D-Bus signal"
678
1385
        pass
679
1386
    
680
 
    # SetChecker - method
681
 
    @dbus.service.method(_interface, in_signature=u"s")
682
 
    def SetChecker(self, checker):
683
 
        "D-Bus setter method"
684
 
        self.checker_command = checker
685
 
        # Emit D-Bus signal
686
 
        self.PropertyChanged(dbus.String(u"checker"),
687
 
                             dbus.String(self.checker_command,
688
 
                                         variant_level=1))
689
 
    
690
 
    # SetHost - method
691
 
    @dbus.service.method(_interface, in_signature=u"s")
692
 
    def SetHost(self, host):
693
 
        "D-Bus setter method"
694
 
        self.host = host
695
 
        # Emit D-Bus signal
696
 
        self.PropertyChanged(dbus.String(u"host"),
697
 
                             dbus.String(self.host, variant_level=1))
698
 
    
699
 
    # SetInterval - method
700
 
    @dbus.service.method(_interface, in_signature=u"t")
701
 
    def SetInterval(self, milliseconds):
702
 
        self.interval = datetime.timedelta(0, 0, 0, milliseconds)
703
 
        # Emit D-Bus signal
704
 
        self.PropertyChanged(dbus.String(u"interval"),
705
 
                             (dbus.UInt64(self.interval_milliseconds(),
706
 
                                          variant_level=1)))
707
 
    
708
 
    # SetSecret - method
709
 
    @dbus.service.method(_interface, in_signature=u"ay",
710
 
                         byte_arrays=True)
711
 
    def SetSecret(self, secret):
712
 
        "D-Bus setter method"
713
 
        self.secret = str(secret)
714
 
    
715
 
    # SetTimeout - method
716
 
    @dbus.service.method(_interface, in_signature=u"t")
717
 
    def SetTimeout(self, milliseconds):
718
 
        self.timeout = datetime.timedelta(0, 0, 0, milliseconds)
719
 
        # Emit D-Bus signal
720
 
        self.PropertyChanged(dbus.String(u"timeout"),
721
 
                             (dbus.UInt64(self.timeout_milliseconds(),
722
 
                                          variant_level=1)))
 
1387
    # NeedApproval - signal
 
1388
    @dbus.service.signal(_interface, signature="tb")
 
1389
    def NeedApproval(self, timeout, default):
 
1390
        "D-Bus signal"
 
1391
        return self.need_approval()
 
1392
    
 
1393
    ## Methods
 
1394
    
 
1395
    # Approve - method
 
1396
    @dbus.service.method(_interface, in_signature="b")
 
1397
    def Approve(self, value):
 
1398
        self.approve(value)
 
1399
    
 
1400
    # CheckedOK - method
 
1401
    @dbus.service.method(_interface)
 
1402
    def CheckedOK(self):
 
1403
        self.checked_ok()
723
1404
    
724
1405
    # Enable - method
725
1406
    @dbus.service.method(_interface)
744
1425
    def StopChecker(self):
745
1426
        self.stop_checker()
746
1427
    
 
1428
    ## Properties
 
1429
    
 
1430
    # ApprovalPending - property
 
1431
    @dbus_service_property(_interface, signature="b", access="read")
 
1432
    def ApprovalPending_dbus_property(self):
 
1433
        return dbus.Boolean(bool(self.approvals_pending))
 
1434
    
 
1435
    # ApprovedByDefault - property
 
1436
    @dbus_service_property(_interface, signature="b",
 
1437
                           access="readwrite")
 
1438
    def ApprovedByDefault_dbus_property(self, value=None):
 
1439
        if value is None:       # get
 
1440
            return dbus.Boolean(self.approved_by_default)
 
1441
        self.approved_by_default = bool(value)
 
1442
    
 
1443
    # ApprovalDelay - property
 
1444
    @dbus_service_property(_interface, signature="t",
 
1445
                           access="readwrite")
 
1446
    def ApprovalDelay_dbus_property(self, value=None):
 
1447
        if value is None:       # get
 
1448
            return dbus.UInt64(self.approval_delay_milliseconds())
 
1449
        self.approval_delay = datetime.timedelta(0, 0, 0, value)
 
1450
    
 
1451
    # ApprovalDuration - property
 
1452
    @dbus_service_property(_interface, signature="t",
 
1453
                           access="readwrite")
 
1454
    def ApprovalDuration_dbus_property(self, value=None):
 
1455
        if value is None:       # get
 
1456
            return dbus.UInt64(timedelta_to_milliseconds(
 
1457
                    self.approval_duration))
 
1458
        self.approval_duration = datetime.timedelta(0, 0, 0, value)
 
1459
    
 
1460
    # Name - property
 
1461
    @dbus_service_property(_interface, signature="s", access="read")
 
1462
    def Name_dbus_property(self):
 
1463
        return dbus.String(self.name)
 
1464
    
 
1465
    # Fingerprint - property
 
1466
    @dbus_service_property(_interface, signature="s", access="read")
 
1467
    def Fingerprint_dbus_property(self):
 
1468
        return dbus.String(self.fingerprint)
 
1469
    
 
1470
    # Host - property
 
1471
    @dbus_service_property(_interface, signature="s",
 
1472
                           access="readwrite")
 
1473
    def Host_dbus_property(self, value=None):
 
1474
        if value is None:       # get
 
1475
            return dbus.String(self.host)
 
1476
        self.host = unicode(value)
 
1477
    
 
1478
    # Created - property
 
1479
    @dbus_service_property(_interface, signature="s", access="read")
 
1480
    def Created_dbus_property(self):
 
1481
        return datetime_to_dbus(self.created)
 
1482
    
 
1483
    # LastEnabled - property
 
1484
    @dbus_service_property(_interface, signature="s", access="read")
 
1485
    def LastEnabled_dbus_property(self):
 
1486
        return datetime_to_dbus(self.last_enabled)
 
1487
    
 
1488
    # Enabled - property
 
1489
    @dbus_service_property(_interface, signature="b",
 
1490
                           access="readwrite")
 
1491
    def Enabled_dbus_property(self, value=None):
 
1492
        if value is None:       # get
 
1493
            return dbus.Boolean(self.enabled)
 
1494
        if value:
 
1495
            self.enable()
 
1496
        else:
 
1497
            self.disable()
 
1498
    
 
1499
    # LastCheckedOK - property
 
1500
    @dbus_service_property(_interface, signature="s",
 
1501
                           access="readwrite")
 
1502
    def LastCheckedOK_dbus_property(self, value=None):
 
1503
        if value is not None:
 
1504
            self.checked_ok()
 
1505
            return
 
1506
        return datetime_to_dbus(self.last_checked_ok)
 
1507
    
 
1508
    # LastCheckerStatus - property
 
1509
    @dbus_service_property(_interface, signature="n",
 
1510
                           access="read")
 
1511
    def LastCheckerStatus_dbus_property(self):
 
1512
        return dbus.Int16(self.last_checker_status)
 
1513
    
 
1514
    # Expires - property
 
1515
    @dbus_service_property(_interface, signature="s", access="read")
 
1516
    def Expires_dbus_property(self):
 
1517
        return datetime_to_dbus(self.expires)
 
1518
    
 
1519
    # LastApprovalRequest - property
 
1520
    @dbus_service_property(_interface, signature="s", access="read")
 
1521
    def LastApprovalRequest_dbus_property(self):
 
1522
        return datetime_to_dbus(self.last_approval_request)
 
1523
    
 
1524
    # Timeout - property
 
1525
    @dbus_service_property(_interface, signature="t",
 
1526
                           access="readwrite")
 
1527
    def Timeout_dbus_property(self, value=None):
 
1528
        if value is None:       # get
 
1529
            return dbus.UInt64(self.timeout_milliseconds())
 
1530
        self.timeout = datetime.timedelta(0, 0, 0, value)
 
1531
        # Reschedule timeout
 
1532
        if self.enabled:
 
1533
            now = datetime.datetime.utcnow()
 
1534
            time_to_die = timedelta_to_milliseconds(
 
1535
                (self.last_checked_ok + self.timeout) - now)
 
1536
            if time_to_die <= 0:
 
1537
                # The timeout has passed
 
1538
                self.disable()
 
1539
            else:
 
1540
                self.expires = (now +
 
1541
                                datetime.timedelta(milliseconds =
 
1542
                                                   time_to_die))
 
1543
                if (getattr(self, "disable_initiator_tag", None)
 
1544
                    is None):
 
1545
                    return
 
1546
                gobject.source_remove(self.disable_initiator_tag)
 
1547
                self.disable_initiator_tag = (gobject.timeout_add
 
1548
                                              (time_to_die,
 
1549
                                               self.disable))
 
1550
    
 
1551
    # ExtendedTimeout - property
 
1552
    @dbus_service_property(_interface, signature="t",
 
1553
                           access="readwrite")
 
1554
    def ExtendedTimeout_dbus_property(self, value=None):
 
1555
        if value is None:       # get
 
1556
            return dbus.UInt64(self.extended_timeout_milliseconds())
 
1557
        self.extended_timeout = datetime.timedelta(0, 0, 0, value)
 
1558
    
 
1559
    # Interval - property
 
1560
    @dbus_service_property(_interface, signature="t",
 
1561
                           access="readwrite")
 
1562
    def Interval_dbus_property(self, value=None):
 
1563
        if value is None:       # get
 
1564
            return dbus.UInt64(self.interval_milliseconds())
 
1565
        self.interval = datetime.timedelta(0, 0, 0, value)
 
1566
        if getattr(self, "checker_initiator_tag", None) is None:
 
1567
            return
 
1568
        if self.enabled:
 
1569
            # Reschedule checker run
 
1570
            gobject.source_remove(self.checker_initiator_tag)
 
1571
            self.checker_initiator_tag = (gobject.timeout_add
 
1572
                                          (value, self.start_checker))
 
1573
            self.start_checker()    # Start one now, too
 
1574
    
 
1575
    # Checker - property
 
1576
    @dbus_service_property(_interface, signature="s",
 
1577
                           access="readwrite")
 
1578
    def Checker_dbus_property(self, value=None):
 
1579
        if value is None:       # get
 
1580
            return dbus.String(self.checker_command)
 
1581
        self.checker_command = unicode(value)
 
1582
    
 
1583
    # CheckerRunning - property
 
1584
    @dbus_service_property(_interface, signature="b",
 
1585
                           access="readwrite")
 
1586
    def CheckerRunning_dbus_property(self, value=None):
 
1587
        if value is None:       # get
 
1588
            return dbus.Boolean(self.checker is not None)
 
1589
        if value:
 
1590
            self.start_checker()
 
1591
        else:
 
1592
            self.stop_checker()
 
1593
    
 
1594
    # ObjectPath - property
 
1595
    @dbus_service_property(_interface, signature="o", access="read")
 
1596
    def ObjectPath_dbus_property(self):
 
1597
        return self.dbus_object_path # is already a dbus.ObjectPath
 
1598
    
 
1599
    # Secret = property
 
1600
    @dbus_service_property(_interface, signature="ay",
 
1601
                           access="write", byte_arrays=True)
 
1602
    def Secret_dbus_property(self, value):
 
1603
        self.secret = str(value)
 
1604
    
747
1605
    del _interface
748
1606
 
749
1607
 
 
1608
class ProxyClient(object):
 
1609
    def __init__(self, child_pipe, fpr, address):
 
1610
        self._pipe = child_pipe
 
1611
        self._pipe.send(('init', fpr, address))
 
1612
        if not self._pipe.recv():
 
1613
            raise KeyError()
 
1614
    
 
1615
    def __getattribute__(self, name):
 
1616
        if name == '_pipe':
 
1617
            return super(ProxyClient, self).__getattribute__(name)
 
1618
        self._pipe.send(('getattr', name))
 
1619
        data = self._pipe.recv()
 
1620
        if data[0] == 'data':
 
1621
            return data[1]
 
1622
        if data[0] == 'function':
 
1623
            def func(*args, **kwargs):
 
1624
                self._pipe.send(('funcall', name, args, kwargs))
 
1625
                return self._pipe.recv()[1]
 
1626
            return func
 
1627
    
 
1628
    def __setattr__(self, name, value):
 
1629
        if name == '_pipe':
 
1630
            return super(ProxyClient, self).__setattr__(name, value)
 
1631
        self._pipe.send(('setattr', name, value))
 
1632
 
 
1633
 
750
1634
class ClientHandler(socketserver.BaseRequestHandler, object):
751
1635
    """A class to handle client connections.
752
1636
    
754
1638
    Note: This will run in its own forked process."""
755
1639
    
756
1640
    def handle(self):
757
 
        logger.info(u"TCP connection from: %s",
758
 
                    unicode(self.client_address))
759
 
        logger.debug(u"IPC Pipe FD: %d", self.server.pipe[1])
760
 
        # Open IPC pipe to parent process
761
 
        with closing(os.fdopen(self.server.pipe[1], u"w", 1)) as ipc:
 
1641
        with contextlib.closing(self.server.child_pipe) as child_pipe:
 
1642
            logger.info("TCP connection from: %s",
 
1643
                        unicode(self.client_address))
 
1644
            logger.debug("Pipe FD: %d",
 
1645
                         self.server.child_pipe.fileno())
 
1646
            
762
1647
            session = (gnutls.connection
763
1648
                       .ClientSession(self.request,
764
1649
                                      gnutls.connection
765
1650
                                      .X509Credentials()))
766
1651
            
767
 
            line = self.request.makefile().readline()
768
 
            logger.debug(u"Protocol version: %r", line)
769
 
            try:
770
 
                if int(line.strip().split()[0]) > 1:
771
 
                    raise RuntimeError
772
 
            except (ValueError, IndexError, RuntimeError), error:
773
 
                logger.error(u"Unknown protocol version: %s", error)
774
 
                return
775
 
            
776
1652
            # Note: gnutls.connection.X509Credentials is really a
777
1653
            # generic GnuTLS certificate credentials object so long as
778
1654
            # no X.509 keys are added to it.  Therefore, we can use it
779
1655
            # here despite using OpenPGP certificates.
780
1656
            
781
 
            #priority = u':'.join((u"NONE", u"+VERS-TLS1.1",
782
 
            #                      u"+AES-256-CBC", u"+SHA1",
783
 
            #                      u"+COMP-NULL", u"+CTYPE-OPENPGP",
784
 
            #                      u"+DHE-DSS"))
 
1657
            #priority = ':'.join(("NONE", "+VERS-TLS1.1",
 
1658
            #                      "+AES-256-CBC", "+SHA1",
 
1659
            #                      "+COMP-NULL", "+CTYPE-OPENPGP",
 
1660
            #                      "+DHE-DSS"))
785
1661
            # Use a fallback default, since this MUST be set.
786
1662
            priority = self.server.gnutls_priority
787
1663
            if priority is None:
788
 
                priority = u"NORMAL"
 
1664
                priority = "NORMAL"
789
1665
            (gnutls.library.functions
790
1666
             .gnutls_priority_set_direct(session._c_object,
791
1667
                                         priority, None))
792
1668
            
 
1669
            # Start communication using the Mandos protocol
 
1670
            # Get protocol number
 
1671
            line = self.request.makefile().readline()
 
1672
            logger.debug("Protocol version: %r", line)
 
1673
            try:
 
1674
                if int(line.strip().split()[0]) > 1:
 
1675
                    raise RuntimeError
 
1676
            except (ValueError, IndexError, RuntimeError) as error:
 
1677
                logger.error("Unknown protocol version: %s", error)
 
1678
                return
 
1679
            
 
1680
            # Start GnuTLS connection
793
1681
            try:
794
1682
                session.handshake()
795
 
            except gnutls.errors.GNUTLSError, error:
796
 
                logger.warning(u"Handshake failed: %s", error)
 
1683
            except gnutls.errors.GNUTLSError as error:
 
1684
                logger.warning("Handshake failed: %s", error)
797
1685
                # Do not run session.bye() here: the session is not
798
1686
                # established.  Just abandon the request.
799
1687
                return
800
 
            logger.debug(u"Handshake succeeded")
 
1688
            logger.debug("Handshake succeeded")
 
1689
            
 
1690
            approval_required = False
801
1691
            try:
802
 
                fpr = self.fingerprint(self.peer_certificate(session))
803
 
            except (TypeError, gnutls.errors.GNUTLSError), error:
804
 
                logger.warning(u"Bad certificate: %s", error)
805
 
                session.bye()
806
 
                return
807
 
            logger.debug(u"Fingerprint: %s", fpr)
 
1692
                try:
 
1693
                    fpr = self.fingerprint(self.peer_certificate
 
1694
                                           (session))
 
1695
                except (TypeError,
 
1696
                        gnutls.errors.GNUTLSError) as error:
 
1697
                    logger.warning("Bad certificate: %s", error)
 
1698
                    return
 
1699
                logger.debug("Fingerprint: %s", fpr)
 
1700
                
 
1701
                try:
 
1702
                    client = ProxyClient(child_pipe, fpr,
 
1703
                                         self.client_address)
 
1704
                except KeyError:
 
1705
                    return
 
1706
                
 
1707
                if client.approval_delay:
 
1708
                    delay = client.approval_delay
 
1709
                    client.approvals_pending += 1
 
1710
                    approval_required = True
 
1711
                
 
1712
                while True:
 
1713
                    if not client.enabled:
 
1714
                        logger.info("Client %s is disabled",
 
1715
                                       client.name)
 
1716
                        if self.server.use_dbus:
 
1717
                            # Emit D-Bus signal
 
1718
                            client.Rejected("Disabled")
 
1719
                        return
 
1720
                    
 
1721
                    if client.approved or not client.approval_delay:
 
1722
                        #We are approved or approval is disabled
 
1723
                        break
 
1724
                    elif client.approved is None:
 
1725
                        logger.info("Client %s needs approval",
 
1726
                                    client.name)
 
1727
                        if self.server.use_dbus:
 
1728
                            # Emit D-Bus signal
 
1729
                            client.NeedApproval(
 
1730
                                client.approval_delay_milliseconds(),
 
1731
                                client.approved_by_default)
 
1732
                    else:
 
1733
                        logger.warning("Client %s was not approved",
 
1734
                                       client.name)
 
1735
                        if self.server.use_dbus:
 
1736
                            # Emit D-Bus signal
 
1737
                            client.Rejected("Denied")
 
1738
                        return
 
1739
                    
 
1740
                    #wait until timeout or approved
 
1741
                    time = datetime.datetime.now()
 
1742
                    client.changedstate.acquire()
 
1743
                    (client.changedstate.wait
 
1744
                     (float(client.timedelta_to_milliseconds(delay)
 
1745
                            / 1000)))
 
1746
                    client.changedstate.release()
 
1747
                    time2 = datetime.datetime.now()
 
1748
                    if (time2 - time) >= delay:
 
1749
                        if not client.approved_by_default:
 
1750
                            logger.warning("Client %s timed out while"
 
1751
                                           " waiting for approval",
 
1752
                                           client.name)
 
1753
                            if self.server.use_dbus:
 
1754
                                # Emit D-Bus signal
 
1755
                                client.Rejected("Approval timed out")
 
1756
                            return
 
1757
                        else:
 
1758
                            break
 
1759
                    else:
 
1760
                        delay -= time2 - time
 
1761
                
 
1762
                sent_size = 0
 
1763
                while sent_size < len(client.secret):
 
1764
                    try:
 
1765
                        sent = session.send(client.secret[sent_size:])
 
1766
                    except gnutls.errors.GNUTLSError as error:
 
1767
                        logger.warning("gnutls send failed",
 
1768
                                       exc_info=error)
 
1769
                        return
 
1770
                    logger.debug("Sent: %d, remaining: %d",
 
1771
                                 sent, len(client.secret)
 
1772
                                 - (sent_size + sent))
 
1773
                    sent_size += sent
 
1774
                
 
1775
                logger.info("Sending secret to %s", client.name)
 
1776
                # bump the timeout using extended_timeout
 
1777
                client.bump_timeout(client.extended_timeout)
 
1778
                if self.server.use_dbus:
 
1779
                    # Emit D-Bus signal
 
1780
                    client.GotSecret()
808
1781
            
809
 
            for c in self.server.clients:
810
 
                if c.fingerprint == fpr:
811
 
                    client = c
812
 
                    break
813
 
            else:
814
 
                ipc.write(u"NOTFOUND %s\n" % fpr)
815
 
                session.bye()
816
 
                return
817
 
            # Have to check if client.still_valid(), since it is
818
 
            # possible that the client timed out while establishing
819
 
            # the GnuTLS session.
820
 
            if not client.still_valid():
821
 
                ipc.write(u"INVALID %s\n" % client.name)
822
 
                session.bye()
823
 
                return
824
 
            ipc.write(u"SENDING %s\n" % client.name)
825
 
            sent_size = 0
826
 
            while sent_size < len(client.secret):
827
 
                sent = session.send(client.secret[sent_size:])
828
 
                logger.debug(u"Sent: %d, remaining: %d",
829
 
                             sent, len(client.secret)
830
 
                             - (sent_size + sent))
831
 
                sent_size += sent
832
 
            session.bye()
 
1782
            finally:
 
1783
                if approval_required:
 
1784
                    client.approvals_pending -= 1
 
1785
                try:
 
1786
                    session.bye()
 
1787
                except gnutls.errors.GNUTLSError as error:
 
1788
                    logger.warning("GnuTLS bye failed",
 
1789
                                   exc_info=error)
833
1790
    
834
1791
    @staticmethod
835
1792
    def peer_certificate(session):
845
1802
                     .gnutls_certificate_get_peers
846
1803
                     (session._c_object, ctypes.byref(list_size)))
847
1804
        if not bool(cert_list) and list_size.value != 0:
848
 
            raise gnutls.errors.GNUTLSError(u"error getting peer"
849
 
                                            u" certificate")
 
1805
            raise gnutls.errors.GNUTLSError("error getting peer"
 
1806
                                            " certificate")
850
1807
        if list_size.value == 0:
851
1808
            return None
852
1809
        cert = cert_list[0]
878
1835
        if crtverify.value != 0:
879
1836
            gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
880
1837
            raise (gnutls.errors.CertificateSecurityError
881
 
                   (u"Verify failed"))
 
1838
                   ("Verify failed"))
882
1839
        # New buffer for the fingerprint
883
1840
        buf = ctypes.create_string_buffer(20)
884
1841
        buf_len = ctypes.c_size_t()
891
1848
        # Convert the buffer to a Python bytestring
892
1849
        fpr = ctypes.string_at(buf, buf_len.value)
893
1850
        # Convert the bytestring to hexadecimal notation
894
 
        hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
 
1851
        hex_fpr = binascii.hexlify(fpr).upper()
895
1852
        return hex_fpr
896
1853
 
897
1854
 
898
 
class ForkingMixInWithPipe(socketserver.ForkingMixIn, object):
899
 
    """Like socketserver.ForkingMixIn, but also pass a pipe."""
 
1855
class MultiprocessingMixIn(object):
 
1856
    """Like socketserver.ThreadingMixIn, but with multiprocessing"""
 
1857
    def sub_process_main(self, request, address):
 
1858
        try:
 
1859
            self.finish_request(request, address)
 
1860
        except Exception:
 
1861
            self.handle_error(request, address)
 
1862
        self.close_request(request)
 
1863
    
 
1864
    def process_request(self, request, address):
 
1865
        """Start a new process to process the request."""
 
1866
        proc = multiprocessing.Process(target = self.sub_process_main,
 
1867
                                       args = (request,
 
1868
                                               address))
 
1869
        proc.start()
 
1870
        return proc
 
1871
 
 
1872
 
 
1873
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
 
1874
    """ adds a pipe to the MixIn """
900
1875
    def process_request(self, request, client_address):
901
1876
        """Overrides and wraps the original process_request().
902
1877
        
903
 
        This function creates a new pipe in self.pipe 
 
1878
        This function creates a new pipe in self.pipe
904
1879
        """
905
 
        self.pipe = os.pipe()
906
 
        super(ForkingMixInWithPipe,
907
 
              self).process_request(request, client_address)
908
 
        os.close(self.pipe[1])  # close write end
909
 
        self.add_pipe(self.pipe[0])
910
 
    def add_pipe(self, pipe):
 
1880
        parent_pipe, self.child_pipe = multiprocessing.Pipe()
 
1881
        
 
1882
        proc = MultiprocessingMixIn.process_request(self, request,
 
1883
                                                    client_address)
 
1884
        self.child_pipe.close()
 
1885
        self.add_pipe(parent_pipe, proc)
 
1886
    
 
1887
    def add_pipe(self, parent_pipe, proc):
911
1888
        """Dummy function; override as necessary"""
912
 
        os.close(pipe)
913
 
 
914
 
 
915
 
class IPv6_TCPServer(ForkingMixInWithPipe,
 
1889
        raise NotImplementedError
 
1890
 
 
1891
 
 
1892
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
916
1893
                     socketserver.TCPServer, object):
917
1894
    """IPv6-capable TCP server.  Accepts 'None' as address and/or port
918
1895
    
934
1911
        bind to an address or port if they were not specified."""
935
1912
        if self.interface is not None:
936
1913
            if SO_BINDTODEVICE is None:
937
 
                logger.error(u"SO_BINDTODEVICE does not exist;"
938
 
                             u" cannot bind to interface %s",
 
1914
                logger.error("SO_BINDTODEVICE does not exist;"
 
1915
                             " cannot bind to interface %s",
939
1916
                             self.interface)
940
1917
            else:
941
1918
                try:
942
1919
                    self.socket.setsockopt(socket.SOL_SOCKET,
943
1920
                                           SO_BINDTODEVICE,
944
1921
                                           str(self.interface
945
 
                                               + u'\0'))
946
 
                except socket.error, error:
 
1922
                                               + '\0'))
 
1923
                except socket.error as error:
947
1924
                    if error[0] == errno.EPERM:
948
 
                        logger.error(u"No permission to"
949
 
                                     u" bind to interface %s",
 
1925
                        logger.error("No permission to"
 
1926
                                     " bind to interface %s",
950
1927
                                     self.interface)
951
1928
                    elif error[0] == errno.ENOPROTOOPT:
952
 
                        logger.error(u"SO_BINDTODEVICE not available;"
953
 
                                     u" cannot bind to interface %s",
 
1929
                        logger.error("SO_BINDTODEVICE not available;"
 
1930
                                     " cannot bind to interface %s",
954
1931
                                     self.interface)
955
1932
                    else:
956
1933
                        raise
958
1935
        if self.server_address[0] or self.server_address[1]:
959
1936
            if not self.server_address[0]:
960
1937
                if self.address_family == socket.AF_INET6:
961
 
                    any_address = u"::" # in6addr_any
 
1938
                    any_address = "::" # in6addr_any
962
1939
                else:
963
1940
                    any_address = socket.INADDR_ANY
964
1941
                self.server_address = (any_address,
982
1959
        clients:        set of Client objects
983
1960
        gnutls_priority GnuTLS priority string
984
1961
        use_dbus:       Boolean; to emit D-Bus signals or not
985
 
        clients:        set of Client objects
986
 
        gnutls_priority GnuTLS priority string
987
 
        use_dbus:       Boolean; to emit D-Bus signals or not
988
1962
    
989
1963
    Assumes a gobject.MainLoop event loop.
990
1964
    """
994
1968
        self.enabled = False
995
1969
        self.clients = clients
996
1970
        if self.clients is None:
997
 
            self.clients = set()
 
1971
            self.clients = {}
998
1972
        self.use_dbus = use_dbus
999
1973
        self.gnutls_priority = gnutls_priority
1000
1974
        IPv6_TCPServer.__init__(self, server_address,
1004
1978
    def server_activate(self):
1005
1979
        if self.enabled:
1006
1980
            return socketserver.TCPServer.server_activate(self)
 
1981
    
1007
1982
    def enable(self):
1008
1983
        self.enabled = True
1009
 
    def add_pipe(self, pipe):
 
1984
    
 
1985
    def add_pipe(self, parent_pipe, proc):
1010
1986
        # Call "handle_ipc" for both data and EOF events
1011
 
        gobject.io_add_watch(pipe, gobject.IO_IN | gobject.IO_HUP,
1012
 
                             self.handle_ipc)
1013
 
    def handle_ipc(self, source, condition, file_objects={}):
 
1987
        gobject.io_add_watch(parent_pipe.fileno(),
 
1988
                             gobject.IO_IN | gobject.IO_HUP,
 
1989
                             functools.partial(self.handle_ipc,
 
1990
                                               parent_pipe =
 
1991
                                               parent_pipe,
 
1992
                                               proc = proc))
 
1993
    
 
1994
    def handle_ipc(self, source, condition, parent_pipe=None,
 
1995
                   proc = None, client_object=None):
1014
1996
        condition_names = {
1015
 
            gobject.IO_IN: u"IN",   # There is data to read.
1016
 
            gobject.IO_OUT: u"OUT", # Data can be written (without
 
1997
            gobject.IO_IN: "IN",   # There is data to read.
 
1998
            gobject.IO_OUT: "OUT", # Data can be written (without
1017
1999
                                    # blocking).
1018
 
            gobject.IO_PRI: u"PRI", # There is urgent data to read.
1019
 
            gobject.IO_ERR: u"ERR", # Error condition.
1020
 
            gobject.IO_HUP: u"HUP"  # Hung up (the connection has been
 
2000
            gobject.IO_PRI: "PRI", # There is urgent data to read.
 
2001
            gobject.IO_ERR: "ERR", # Error condition.
 
2002
            gobject.IO_HUP: "HUP"  # Hung up (the connection has been
1021
2003
                                    # broken, usually for pipes and
1022
2004
                                    # sockets).
1023
2005
            }
1025
2007
                                       for cond, name in
1026
2008
                                       condition_names.iteritems()
1027
2009
                                       if cond & condition)
1028
 
        logger.debug(u"Handling IPC: FD = %d, condition = %s", source,
1029
 
                     conditions_string)
1030
 
        
1031
 
        # Turn the pipe file descriptor into a Python file object
1032
 
        if source not in file_objects:
1033
 
            file_objects[source] = os.fdopen(source, u"r", 1)
1034
 
        
1035
 
        # Read a line from the file object
1036
 
        cmdline = file_objects[source].readline()
1037
 
        if not cmdline:             # Empty line means end of file
1038
 
            # close the IPC pipe
1039
 
            file_objects[source].close()
1040
 
            del file_objects[source]
1041
 
            
1042
 
            # Stop calling this function
1043
 
            return False
1044
 
        
1045
 
        logger.debug(u"IPC command: %r", cmdline)
1046
 
        
1047
 
        # Parse and act on command
1048
 
        cmd, args = cmdline.rstrip(u"\r\n").split(None, 1)
1049
 
        
1050
 
        if cmd == u"NOTFOUND":
1051
 
            logger.warning(u"Client not found for fingerprint: %s",
1052
 
                           args)
1053
 
            if self.use_dbus:
1054
 
                # Emit D-Bus signal
1055
 
                mandos_dbus_service.ClientNotFound(args)
1056
 
        elif cmd == u"INVALID":
1057
 
            for client in self.clients:
1058
 
                if client.name == args:
1059
 
                    logger.warning(u"Client %s is invalid", args)
1060
 
                    if self.use_dbus:
1061
 
                        # Emit D-Bus signal
1062
 
                        client.Rejected()
1063
 
                    break
1064
 
            else:
1065
 
                logger.error(u"Unknown client %s is invalid", args)
1066
 
        elif cmd == u"SENDING":
1067
 
            for client in self.clients:
1068
 
                if client.name == args:
1069
 
                    logger.info(u"Sending secret to %s", client.name)
1070
 
                    client.checked_ok()
1071
 
                    if self.use_dbus:
1072
 
                        # Emit D-Bus signal
1073
 
                        client.ReceivedSecret()
1074
 
                    break
1075
 
            else:
1076
 
                logger.error(u"Sending secret to unknown client %s",
1077
 
                             args)
1078
 
        else:
1079
 
            logger.error(u"Unknown IPC command: %r", cmdline)
1080
 
        
1081
 
        # Keep calling this function
 
2010
        # error, or the other end of multiprocessing.Pipe has closed
 
2011
        if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):
 
2012
            # Wait for other process to exit
 
2013
            proc.join()
 
2014
            return False
 
2015
        
 
2016
        # Read a request from the child
 
2017
        request = parent_pipe.recv()
 
2018
        command = request[0]
 
2019
        
 
2020
        if command == 'init':
 
2021
            fpr = request[1]
 
2022
            address = request[2]
 
2023
            
 
2024
            for c in self.clients.itervalues():
 
2025
                if c.fingerprint == fpr:
 
2026
                    client = c
 
2027
                    break
 
2028
            else:
 
2029
                logger.info("Client not found for fingerprint: %s, ad"
 
2030
                            "dress: %s", fpr, address)
 
2031
                if self.use_dbus:
 
2032
                    # Emit D-Bus signal
 
2033
                    mandos_dbus_service.ClientNotFound(fpr,
 
2034
                                                       address[0])
 
2035
                parent_pipe.send(False)
 
2036
                return False
 
2037
            
 
2038
            gobject.io_add_watch(parent_pipe.fileno(),
 
2039
                                 gobject.IO_IN | gobject.IO_HUP,
 
2040
                                 functools.partial(self.handle_ipc,
 
2041
                                                   parent_pipe =
 
2042
                                                   parent_pipe,
 
2043
                                                   proc = proc,
 
2044
                                                   client_object =
 
2045
                                                   client))
 
2046
            parent_pipe.send(True)
 
2047
            # remove the old hook in favor of the new above hook on
 
2048
            # same fileno
 
2049
            return False
 
2050
        if command == 'funcall':
 
2051
            funcname = request[1]
 
2052
            args = request[2]
 
2053
            kwargs = request[3]
 
2054
            
 
2055
            parent_pipe.send(('data', getattr(client_object,
 
2056
                                              funcname)(*args,
 
2057
                                                         **kwargs)))
 
2058
        
 
2059
        if command == 'getattr':
 
2060
            attrname = request[1]
 
2061
            if callable(client_object.__getattribute__(attrname)):
 
2062
                parent_pipe.send(('function',))
 
2063
            else:
 
2064
                parent_pipe.send(('data', client_object
 
2065
                                  .__getattribute__(attrname)))
 
2066
        
 
2067
        if command == 'setattr':
 
2068
            attrname = request[1]
 
2069
            value = request[2]
 
2070
            setattr(client_object, attrname, value)
 
2071
        
1082
2072
        return True
1083
2073
 
1084
2074
 
1085
2075
def string_to_delta(interval):
1086
2076
    """Parse a string and return a datetime.timedelta
1087
2077
    
1088
 
    >>> string_to_delta(u'7d')
 
2078
    >>> string_to_delta('7d')
1089
2079
    datetime.timedelta(7)
1090
 
    >>> string_to_delta(u'60s')
 
2080
    >>> string_to_delta('60s')
1091
2081
    datetime.timedelta(0, 60)
1092
 
    >>> string_to_delta(u'60m')
 
2082
    >>> string_to_delta('60m')
1093
2083
    datetime.timedelta(0, 3600)
1094
 
    >>> string_to_delta(u'24h')
 
2084
    >>> string_to_delta('24h')
1095
2085
    datetime.timedelta(1)
1096
 
    >>> string_to_delta(u'1w')
 
2086
    >>> string_to_delta('1w')
1097
2087
    datetime.timedelta(7)
1098
 
    >>> string_to_delta(u'5m 30s')
 
2088
    >>> string_to_delta('5m 30s')
1099
2089
    datetime.timedelta(0, 330)
1100
2090
    """
1101
2091
    timevalue = datetime.timedelta(0)
1103
2093
        try:
1104
2094
            suffix = unicode(s[-1])
1105
2095
            value = int(s[:-1])
1106
 
            if suffix == u"d":
 
2096
            if suffix == "d":
1107
2097
                delta = datetime.timedelta(value)
1108
 
            elif suffix == u"s":
 
2098
            elif suffix == "s":
1109
2099
                delta = datetime.timedelta(0, value)
1110
 
            elif suffix == u"m":
 
2100
            elif suffix == "m":
1111
2101
                delta = datetime.timedelta(0, 0, 0, 0, value)
1112
 
            elif suffix == u"h":
 
2102
            elif suffix == "h":
1113
2103
                delta = datetime.timedelta(0, 0, 0, 0, 0, value)
1114
 
            elif suffix == u"w":
 
2104
            elif suffix == "w":
1115
2105
                delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
1116
2106
            else:
1117
 
                raise ValueError
1118
 
        except (ValueError, IndexError):
1119
 
            raise ValueError
 
2107
                raise ValueError("Unknown suffix {0!r}"
 
2108
                                 .format(suffix))
 
2109
        except (ValueError, IndexError) as e:
 
2110
            raise ValueError(*(e.args))
1120
2111
        timevalue += delta
1121
2112
    return timevalue
1122
2113
 
1123
2114
 
1124
 
def if_nametoindex(interface):
1125
 
    """Call the C function if_nametoindex(), or equivalent
1126
 
    
1127
 
    Note: This function cannot accept a unicode string."""
1128
 
    global if_nametoindex
1129
 
    try:
1130
 
        if_nametoindex = (ctypes.cdll.LoadLibrary
1131
 
                          (ctypes.util.find_library(u"c"))
1132
 
                          .if_nametoindex)
1133
 
    except (OSError, AttributeError):
1134
 
        logger.warning(u"Doing if_nametoindex the hard way")
1135
 
        def if_nametoindex(interface):
1136
 
            "Get an interface index the hard way, i.e. using fcntl()"
1137
 
            SIOCGIFINDEX = 0x8933  # From /usr/include/linux/sockios.h
1138
 
            with closing(socket.socket()) as s:
1139
 
                ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
1140
 
                                    struct.pack(str(u"16s16x"),
1141
 
                                                interface))
1142
 
            interface_index = struct.unpack(str(u"I"),
1143
 
                                            ifreq[16:20])[0]
1144
 
            return interface_index
1145
 
    return if_nametoindex(interface)
1146
 
 
1147
 
 
1148
2115
def daemon(nochdir = False, noclose = False):
1149
2116
    """See daemon(3).  Standard BSD Unix function.
1150
2117
    
1153
2120
        sys.exit()
1154
2121
    os.setsid()
1155
2122
    if not nochdir:
1156
 
        os.chdir(u"/")
 
2123
        os.chdir("/")
1157
2124
    if os.fork():
1158
2125
        sys.exit()
1159
2126
    if not noclose:
1160
2127
        # Close all standard open file descriptors
1161
 
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
 
2128
        null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
1162
2129
        if not stat.S_ISCHR(os.fstat(null).st_mode):
1163
2130
            raise OSError(errno.ENODEV,
1164
 
                          u"/dev/null not a character device")
 
2131
                          "{0} not a character device"
 
2132
                          .format(os.devnull))
1165
2133
        os.dup2(null, sys.stdin.fileno())
1166
2134
        os.dup2(null, sys.stdout.fileno())
1167
2135
        os.dup2(null, sys.stderr.fileno())
1171
2139
 
1172
2140
def main():
1173
2141
    
1174
 
    ######################################################################
 
2142
    ##################################################################
1175
2143
    # Parsing of options, both command line and config file
1176
2144
    
1177
 
    parser = optparse.OptionParser(version = "%%prog %s" % version)
1178
 
    parser.add_option("-i", u"--interface", type=u"string",
1179
 
                      metavar="IF", help=u"Bind to interface IF")
1180
 
    parser.add_option("-a", u"--address", type=u"string",
1181
 
                      help=u"Address to listen for requests on")
1182
 
    parser.add_option("-p", u"--port", type=u"int",
1183
 
                      help=u"Port number to receive requests on")
1184
 
    parser.add_option("--check", action=u"store_true",
1185
 
                      help=u"Run self-test")
1186
 
    parser.add_option("--debug", action=u"store_true",
1187
 
                      help=u"Debug mode; run in foreground and log to"
1188
 
                      u" terminal")
1189
 
    parser.add_option("--priority", type=u"string", help=u"GnuTLS"
1190
 
                      u" priority string (see GnuTLS documentation)")
1191
 
    parser.add_option("--servicename", type=u"string",
1192
 
                      metavar=u"NAME", help=u"Zeroconf service name")
1193
 
    parser.add_option("--configdir", type=u"string",
1194
 
                      default=u"/etc/mandos", metavar=u"DIR",
1195
 
                      help=u"Directory to search for configuration"
1196
 
                      u" files")
1197
 
    parser.add_option("--no-dbus", action=u"store_false",
1198
 
                      dest=u"use_dbus", help=u"Do not provide D-Bus"
1199
 
                      u" system bus interface")
1200
 
    parser.add_option("--no-ipv6", action=u"store_false",
1201
 
                      dest=u"use_ipv6", help=u"Do not use IPv6")
1202
 
    options = parser.parse_args()[0]
 
2145
    parser = argparse.ArgumentParser()
 
2146
    parser.add_argument("-v", "--version", action="version",
 
2147
                        version = "%(prog)s {0}".format(version),
 
2148
                        help="show version number and exit")
 
2149
    parser.add_argument("-i", "--interface", metavar="IF",
 
2150
                        help="Bind to interface IF")
 
2151
    parser.add_argument("-a", "--address",
 
2152
                        help="Address to listen for requests on")
 
2153
    parser.add_argument("-p", "--port", type=int,
 
2154
                        help="Port number to receive requests on")
 
2155
    parser.add_argument("--check", action="store_true",
 
2156
                        help="Run self-test")
 
2157
    parser.add_argument("--debug", action="store_true",
 
2158
                        help="Debug mode; run in foreground and log"
 
2159
                        " to terminal")
 
2160
    parser.add_argument("--debuglevel", metavar="LEVEL",
 
2161
                        help="Debug level for stdout output")
 
2162
    parser.add_argument("--priority", help="GnuTLS"
 
2163
                        " priority string (see GnuTLS documentation)")
 
2164
    parser.add_argument("--servicename",
 
2165
                        metavar="NAME", help="Zeroconf service name")
 
2166
    parser.add_argument("--configdir",
 
2167
                        default="/etc/mandos", metavar="DIR",
 
2168
                        help="Directory to search for configuration"
 
2169
                        " files")
 
2170
    parser.add_argument("--no-dbus", action="store_false",
 
2171
                        dest="use_dbus", help="Do not provide D-Bus"
 
2172
                        " system bus interface")
 
2173
    parser.add_argument("--no-ipv6", action="store_false",
 
2174
                        dest="use_ipv6", help="Do not use IPv6")
 
2175
    parser.add_argument("--no-restore", action="store_false",
 
2176
                        dest="restore", help="Do not restore stored"
 
2177
                        " state")
 
2178
    parser.add_argument("--statedir", metavar="DIR",
 
2179
                        help="Directory to save/restore state in")
 
2180
    
 
2181
    options = parser.parse_args()
1203
2182
    
1204
2183
    if options.check:
1205
2184
        import doctest
1207
2186
        sys.exit()
1208
2187
    
1209
2188
    # Default values for config file for server-global settings
1210
 
    server_defaults = { u"interface": u"",
1211
 
                        u"address": u"",
1212
 
                        u"port": u"",
1213
 
                        u"debug": u"False",
1214
 
                        u"priority":
1215
 
                        u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
1216
 
                        u"servicename": u"Mandos",
1217
 
                        u"use_dbus": u"True",
1218
 
                        u"use_ipv6": u"True",
 
2189
    server_defaults = { "interface": "",
 
2190
                        "address": "",
 
2191
                        "port": "",
 
2192
                        "debug": "False",
 
2193
                        "priority":
 
2194
                        "SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
 
2195
                        "servicename": "Mandos",
 
2196
                        "use_dbus": "True",
 
2197
                        "use_ipv6": "True",
 
2198
                        "debuglevel": "",
 
2199
                        "restore": "True",
 
2200
                        "statedir": "/var/lib/mandos"
1219
2201
                        }
1220
2202
    
1221
2203
    # Parse config file for server-global settings
1222
2204
    server_config = configparser.SafeConfigParser(server_defaults)
1223
2205
    del server_defaults
1224
2206
    server_config.read(os.path.join(options.configdir,
1225
 
                                    u"mandos.conf"))
 
2207
                                    "mandos.conf"))
1226
2208
    # Convert the SafeConfigParser object to a dict
1227
2209
    server_settings = server_config.defaults()
1228
2210
    # Use the appropriate methods on the non-string config options
1229
 
    for option in (u"debug", u"use_dbus", u"use_ipv6"):
1230
 
        server_settings[option] = server_config.getboolean(u"DEFAULT",
 
2211
    for option in ("debug", "use_dbus", "use_ipv6"):
 
2212
        server_settings[option] = server_config.getboolean("DEFAULT",
1231
2213
                                                           option)
1232
2214
    if server_settings["port"]:
1233
 
        server_settings["port"] = server_config.getint(u"DEFAULT",
1234
 
                                                       u"port")
 
2215
        server_settings["port"] = server_config.getint("DEFAULT",
 
2216
                                                       "port")
1235
2217
    del server_config
1236
2218
    
1237
2219
    # Override the settings from the config file with command line
1238
2220
    # options, if set.
1239
 
    for option in (u"interface", u"address", u"port", u"debug",
1240
 
                   u"priority", u"servicename", u"configdir",
1241
 
                   u"use_dbus", u"use_ipv6"):
 
2221
    for option in ("interface", "address", "port", "debug",
 
2222
                   "priority", "servicename", "configdir",
 
2223
                   "use_dbus", "use_ipv6", "debuglevel", "restore",
 
2224
                   "statedir"):
1242
2225
        value = getattr(options, option)
1243
2226
        if value is not None:
1244
2227
            server_settings[option] = value
1252
2235
    ##################################################################
1253
2236
    
1254
2237
    # For convenience
1255
 
    debug = server_settings[u"debug"]
1256
 
    use_dbus = server_settings[u"use_dbus"]
1257
 
    use_ipv6 = server_settings[u"use_ipv6"]
1258
 
    
1259
 
    if not debug:
1260
 
        syslogger.setLevel(logging.WARNING)
1261
 
        console.setLevel(logging.WARNING)
1262
 
    
1263
 
    if server_settings[u"servicename"] != u"Mandos":
 
2238
    debug = server_settings["debug"]
 
2239
    debuglevel = server_settings["debuglevel"]
 
2240
    use_dbus = server_settings["use_dbus"]
 
2241
    use_ipv6 = server_settings["use_ipv6"]
 
2242
    stored_state_path = os.path.join(server_settings["statedir"],
 
2243
                                     stored_state_file)
 
2244
    
 
2245
    if debug:
 
2246
        initlogger(debug, logging.DEBUG)
 
2247
    else:
 
2248
        if not debuglevel:
 
2249
            initlogger(debug)
 
2250
        else:
 
2251
            level = getattr(logging, debuglevel.upper())
 
2252
            initlogger(debug, level)
 
2253
    
 
2254
    if server_settings["servicename"] != "Mandos":
1264
2255
        syslogger.setFormatter(logging.Formatter
1265
 
                               (u'Mandos (%s) [%%(process)d]:'
1266
 
                                u' %%(levelname)s: %%(message)s'
1267
 
                                % server_settings[u"servicename"]))
 
2256
                               ('Mandos ({0}) [%(process)d]:'
 
2257
                                ' %(levelname)s: %(message)s'
 
2258
                                .format(server_settings
 
2259
                                        ["servicename"])))
1268
2260
    
1269
2261
    # Parse config file with clients
1270
 
    client_defaults = { u"timeout": u"1h",
1271
 
                        u"interval": u"5m",
1272
 
                        u"checker": u"fping -q -- %%(host)s",
1273
 
                        u"host": u"",
1274
 
                        }
1275
 
    client_config = configparser.SafeConfigParser(client_defaults)
1276
 
    client_config.read(os.path.join(server_settings[u"configdir"],
1277
 
                                    u"clients.conf"))
 
2262
    client_config = configparser.SafeConfigParser(Client
 
2263
                                                  .client_defaults)
 
2264
    client_config.read(os.path.join(server_settings["configdir"],
 
2265
                                    "clients.conf"))
1278
2266
    
1279
2267
    global mandos_dbus_service
1280
2268
    mandos_dbus_service = None
1281
2269
    
1282
 
    tcp_server = MandosServer((server_settings[u"address"],
1283
 
                               server_settings[u"port"]),
 
2270
    tcp_server = MandosServer((server_settings["address"],
 
2271
                               server_settings["port"]),
1284
2272
                              ClientHandler,
1285
 
                              interface=server_settings[u"interface"],
 
2273
                              interface=(server_settings["interface"]
 
2274
                                         or None),
1286
2275
                              use_ipv6=use_ipv6,
1287
2276
                              gnutls_priority=
1288
 
                              server_settings[u"priority"],
 
2277
                              server_settings["priority"],
1289
2278
                              use_dbus=use_dbus)
1290
 
    pidfilename = u"/var/run/mandos.pid"
1291
 
    try:
1292
 
        pidfile = open(pidfilename, u"w")
1293
 
    except IOError:
1294
 
        logger.error(u"Could not open file %r", pidfilename)
 
2279
    if not debug:
 
2280
        pidfilename = "/var/run/mandos.pid"
 
2281
        try:
 
2282
            pidfile = open(pidfilename, "w")
 
2283
        except IOError as e:
 
2284
            logger.error("Could not open file %r", pidfilename,
 
2285
                         exc_info=e)
1295
2286
    
1296
 
    try:
1297
 
        uid = pwd.getpwnam(u"_mandos").pw_uid
1298
 
        gid = pwd.getpwnam(u"_mandos").pw_gid
1299
 
    except KeyError:
 
2287
    for name in ("_mandos", "mandos", "nobody"):
1300
2288
        try:
1301
 
            uid = pwd.getpwnam(u"mandos").pw_uid
1302
 
            gid = pwd.getpwnam(u"mandos").pw_gid
 
2289
            uid = pwd.getpwnam(name).pw_uid
 
2290
            gid = pwd.getpwnam(name).pw_gid
 
2291
            break
1303
2292
        except KeyError:
1304
 
            try:
1305
 
                uid = pwd.getpwnam(u"nobody").pw_uid
1306
 
                gid = pwd.getpwnam(u"nobody").pw_gid
1307
 
            except KeyError:
1308
 
                uid = 65534
1309
 
                gid = 65534
 
2293
            continue
 
2294
    else:
 
2295
        uid = 65534
 
2296
        gid = 65534
1310
2297
    try:
1311
2298
        os.setgid(gid)
1312
2299
        os.setuid(uid)
1313
 
    except OSError, error:
 
2300
    except OSError as error:
1314
2301
        if error[0] != errno.EPERM:
1315
2302
            raise error
1316
2303
    
1317
 
    # Enable all possible GnuTLS debugging
1318
2304
    if debug:
 
2305
        # Enable all possible GnuTLS debugging
 
2306
        
1319
2307
        # "Use a log level over 10 to enable all debugging options."
1320
2308
        # - GnuTLS manual
1321
2309
        gnutls.library.functions.gnutls_global_set_log_level(11)
1322
2310
        
1323
2311
        @gnutls.library.types.gnutls_log_func
1324
2312
        def debug_gnutls(level, string):
1325
 
            logger.debug(u"GnuTLS: %s", string[:-1])
 
2313
            logger.debug("GnuTLS: %s", string[:-1])
1326
2314
        
1327
2315
        (gnutls.library.functions
1328
2316
         .gnutls_global_set_log_function(debug_gnutls))
 
2317
        
 
2318
        # Redirect stdin so all checkers get /dev/null
 
2319
        null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
 
2320
        os.dup2(null, sys.stdin.fileno())
 
2321
        if null > 2:
 
2322
            os.close(null)
 
2323
    
 
2324
    # Need to fork before connecting to D-Bus
 
2325
    if not debug:
 
2326
        # Close all input and output, do double fork, etc.
 
2327
        daemon()
 
2328
    
 
2329
    gobject.threads_init()
1329
2330
    
1330
2331
    global main_loop
1331
2332
    # From the Avahi example code
1332
 
    DBusGMainLoop(set_as_default=True )
 
2333
    DBusGMainLoop(set_as_default=True)
1333
2334
    main_loop = gobject.MainLoop()
1334
2335
    bus = dbus.SystemBus()
1335
2336
    # End of Avahi example code
1336
2337
    if use_dbus:
1337
 
        bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos", bus)
 
2338
        try:
 
2339
            bus_name = dbus.service.BusName("se.recompile.Mandos",
 
2340
                                            bus, do_not_queue=True)
 
2341
            old_bus_name = (dbus.service.BusName
 
2342
                            ("se.bsnet.fukt.Mandos", bus,
 
2343
                             do_not_queue=True))
 
2344
        except dbus.exceptions.NameExistsException as e:
 
2345
            logger.error("Disabling D-Bus:", exc_info=e)
 
2346
            use_dbus = False
 
2347
            server_settings["use_dbus"] = False
 
2348
            tcp_server.use_dbus = False
1338
2349
    protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
1339
 
    service = AvahiService(name = server_settings[u"servicename"],
1340
 
                           servicetype = u"_mandos._tcp",
1341
 
                           protocol = protocol, bus = bus)
 
2350
    service = AvahiServiceToSyslog(name =
 
2351
                                   server_settings["servicename"],
 
2352
                                   servicetype = "_mandos._tcp",
 
2353
                                   protocol = protocol, bus = bus)
1342
2354
    if server_settings["interface"]:
1343
2355
        service.interface = (if_nametoindex
1344
 
                             (str(server_settings[u"interface"])))
 
2356
                             (str(server_settings["interface"])))
 
2357
    
 
2358
    global multiprocessing_manager
 
2359
    multiprocessing_manager = multiprocessing.Manager()
1345
2360
    
1346
2361
    client_class = Client
1347
2362
    if use_dbus:
1348
2363
        client_class = functools.partial(ClientDBus, bus = bus)
1349
 
    tcp_server.clients.update(set(
1350
 
            client_class(name = section,
1351
 
                         config= dict(client_config.items(section)))
1352
 
            for section in client_config.sections()))
 
2364
    
 
2365
    client_settings = Client.config_parser(client_config)
 
2366
    old_client_settings = {}
 
2367
    clients_data = {}
 
2368
    
 
2369
    # Get client data and settings from last running state.
 
2370
    if server_settings["restore"]:
 
2371
        try:
 
2372
            with open(stored_state_path, "rb") as stored_state:
 
2373
                clients_data, old_client_settings = (pickle.load
 
2374
                                                     (stored_state))
 
2375
            os.remove(stored_state_path)
 
2376
        except IOError as e:
 
2377
            if e.errno == errno.ENOENT:
 
2378
                logger.warning("Could not load persistent state: {0}"
 
2379
                                .format(os.strerror(e.errno)))
 
2380
            else:
 
2381
                logger.critical("Could not load persistent state:",
 
2382
                                exc_info=e)
 
2383
                raise
 
2384
        except EOFError as e:
 
2385
            logger.warning("Could not load persistent state: "
 
2386
                           "EOFError:", exc_info=e)
 
2387
    
 
2388
    with PGPEngine() as pgp:
 
2389
        for client_name, client in clients_data.iteritems():
 
2390
            # Decide which value to use after restoring saved state.
 
2391
            # We have three different values: Old config file,
 
2392
            # new config file, and saved state.
 
2393
            # New config value takes precedence if it differs from old
 
2394
            # config value, otherwise use saved state.
 
2395
            for name, value in client_settings[client_name].items():
 
2396
                try:
 
2397
                    # For each value in new config, check if it
 
2398
                    # differs from the old config value (Except for
 
2399
                    # the "secret" attribute)
 
2400
                    if (name != "secret" and
 
2401
                        value != old_client_settings[client_name]
 
2402
                        [name]):
 
2403
                        client[name] = value
 
2404
                except KeyError:
 
2405
                    pass
 
2406
            
 
2407
            # Clients who has passed its expire date can still be
 
2408
            # enabled if its last checker was successful.  Clients
 
2409
            # whose checker succeeded before we stored its state is
 
2410
            # assumed to have successfully run all checkers during
 
2411
            # downtime.
 
2412
            if client["enabled"]:
 
2413
                if datetime.datetime.utcnow() >= client["expires"]:
 
2414
                    if not client["last_checked_ok"]:
 
2415
                        logger.warning(
 
2416
                            "disabling client {0} - Client never "
 
2417
                            "performed a successful checker"
 
2418
                            .format(client_name))
 
2419
                        client["enabled"] = False
 
2420
                    elif client["last_checker_status"] != 0:
 
2421
                        logger.warning(
 
2422
                            "disabling client {0} - Client "
 
2423
                            "last checker failed with error code {1}"
 
2424
                            .format(client_name,
 
2425
                                    client["last_checker_status"]))
 
2426
                        client["enabled"] = False
 
2427
                    else:
 
2428
                        client["expires"] = (datetime.datetime
 
2429
                                             .utcnow()
 
2430
                                             + client["timeout"])
 
2431
                        logger.debug("Last checker succeeded,"
 
2432
                                     " keeping {0} enabled"
 
2433
                                     .format(client_name))
 
2434
            try:
 
2435
                client["secret"] = (
 
2436
                    pgp.decrypt(client["encrypted_secret"],
 
2437
                                client_settings[client_name]
 
2438
                                ["secret"]))
 
2439
            except PGPError:
 
2440
                # If decryption fails, we use secret from new settings
 
2441
                logger.debug("Failed to decrypt {0} old secret"
 
2442
                             .format(client_name))
 
2443
                client["secret"] = (
 
2444
                    client_settings[client_name]["secret"])
 
2445
    
 
2446
    # Add/remove clients based on new changes made to config
 
2447
    for client_name in (set(old_client_settings)
 
2448
                        - set(client_settings)):
 
2449
        del clients_data[client_name]
 
2450
    for client_name in (set(client_settings)
 
2451
                        - set(old_client_settings)):
 
2452
        clients_data[client_name] = client_settings[client_name]
 
2453
    
 
2454
    # Create all client objects
 
2455
    for client_name, client in clients_data.iteritems():
 
2456
        tcp_server.clients[client_name] = client_class(
 
2457
            name = client_name, settings = client)
 
2458
    
1353
2459
    if not tcp_server.clients:
1354
 
        logger.warning(u"No clients defined")
1355
 
    
1356
 
    if debug:
1357
 
        # Redirect stdin so all checkers get /dev/null
1358
 
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1359
 
        os.dup2(null, sys.stdin.fileno())
1360
 
        if null > 2:
1361
 
            os.close(null)
1362
 
    else:
1363
 
        # No console logging
1364
 
        logger.removeHandler(console)
1365
 
        # Close all input and output, do double fork, etc.
1366
 
        daemon()
1367
 
    
1368
 
    try:
1369
 
        with closing(pidfile):
1370
 
            pid = os.getpid()
1371
 
            pidfile.write(str(pid) + "\n")
1372
 
        del pidfile
1373
 
    except IOError:
1374
 
        logger.error(u"Could not write to file %r with PID %d",
1375
 
                     pidfilename, pid)
1376
 
    except NameError:
1377
 
        # "pidfile" was never created
1378
 
        pass
1379
 
    del pidfilename
1380
 
    
1381
 
    def cleanup():
1382
 
        "Cleanup function; run on exit"
1383
 
        service.cleanup()
1384
 
        
1385
 
        while tcp_server.clients:
1386
 
            client = tcp_server.clients.pop()
1387
 
            client.disable_hook = None
1388
 
            client.disable()
1389
 
    
1390
 
    atexit.register(cleanup)
 
2460
        logger.warning("No clients defined")
1391
2461
    
1392
2462
    if not debug:
 
2463
        try:
 
2464
            with pidfile:
 
2465
                pid = os.getpid()
 
2466
                pidfile.write(str(pid) + "\n".encode("utf-8"))
 
2467
            del pidfile
 
2468
        except IOError:
 
2469
            logger.error("Could not write to file %r with PID %d",
 
2470
                         pidfilename, pid)
 
2471
        except NameError:
 
2472
            # "pidfile" was never created
 
2473
            pass
 
2474
        del pidfilename
1393
2475
        signal.signal(signal.SIGINT, signal.SIG_IGN)
 
2476
    
1394
2477
    signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
1395
2478
    signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
1396
2479
    
1397
2480
    if use_dbus:
1398
 
        class MandosDBusService(dbus.service.Object):
 
2481
        @alternate_dbus_interfaces({"se.recompile.Mandos":
 
2482
                                        "se.bsnet.fukt.Mandos"})
 
2483
        class MandosDBusService(DBusObjectWithProperties):
1399
2484
            """A D-Bus proxy object"""
1400
2485
            def __init__(self):
1401
 
                dbus.service.Object.__init__(self, bus, u"/")
1402
 
            _interface = u"se.bsnet.fukt.Mandos"
1403
 
            
1404
 
            @dbus.service.signal(_interface, signature=u"oa{sv}")
1405
 
            def ClientAdded(self, objpath, properties):
1406
 
                "D-Bus signal"
1407
 
                pass
1408
 
            
1409
 
            @dbus.service.signal(_interface, signature=u"s")
1410
 
            def ClientNotFound(self, fingerprint):
1411
 
                "D-Bus signal"
1412
 
                pass
1413
 
            
1414
 
            @dbus.service.signal(_interface, signature=u"os")
 
2486
                dbus.service.Object.__init__(self, bus, "/")
 
2487
            _interface = "se.recompile.Mandos"
 
2488
            
 
2489
            @dbus_interface_annotations(_interface)
 
2490
            def _foo(self):
 
2491
                return { "org.freedesktop.DBus.Property"
 
2492
                         ".EmitsChangedSignal":
 
2493
                             "false"}
 
2494
            
 
2495
            @dbus.service.signal(_interface, signature="o")
 
2496
            def ClientAdded(self, objpath):
 
2497
                "D-Bus signal"
 
2498
                pass
 
2499
            
 
2500
            @dbus.service.signal(_interface, signature="ss")
 
2501
            def ClientNotFound(self, fingerprint, address):
 
2502
                "D-Bus signal"
 
2503
                pass
 
2504
            
 
2505
            @dbus.service.signal(_interface, signature="os")
1415
2506
            def ClientRemoved(self, objpath, name):
1416
2507
                "D-Bus signal"
1417
2508
                pass
1418
2509
            
1419
 
            @dbus.service.method(_interface, out_signature=u"ao")
 
2510
            @dbus.service.method(_interface, out_signature="ao")
1420
2511
            def GetAllClients(self):
1421
2512
                "D-Bus method"
1422
2513
                return dbus.Array(c.dbus_object_path
1423
 
                                  for c in tcp_server.clients)
 
2514
                                  for c in
 
2515
                                  tcp_server.clients.itervalues())
1424
2516
            
1425
2517
            @dbus.service.method(_interface,
1426
 
                                 out_signature=u"a{oa{sv}}")
 
2518
                                 out_signature="a{oa{sv}}")
1427
2519
            def GetAllClientsWithProperties(self):
1428
2520
                "D-Bus method"
1429
2521
                return dbus.Dictionary(
1430
 
                    ((c.dbus_object_path, c.GetAllProperties())
1431
 
                     for c in tcp_server.clients),
1432
 
                    signature=u"oa{sv}")
 
2522
                    ((c.dbus_object_path, c.GetAll(""))
 
2523
                     for c in tcp_server.clients.itervalues()),
 
2524
                    signature="oa{sv}")
1433
2525
            
1434
 
            @dbus.service.method(_interface, in_signature=u"o")
 
2526
            @dbus.service.method(_interface, in_signature="o")
1435
2527
            def RemoveClient(self, object_path):
1436
2528
                "D-Bus method"
1437
 
                for c in tcp_server.clients:
 
2529
                for c in tcp_server.clients.itervalues():
1438
2530
                    if c.dbus_object_path == object_path:
1439
 
                        tcp_server.clients.remove(c)
 
2531
                        del tcp_server.clients[c.name]
1440
2532
                        c.remove_from_connection()
1441
2533
                        # Don't signal anything except ClientRemoved
1442
 
                        c.disable(signal=False)
 
2534
                        c.disable(quiet=True)
1443
2535
                        # Emit D-Bus signal
1444
2536
                        self.ClientRemoved(object_path, c.name)
1445
2537
                        return
1446
 
                raise KeyError
 
2538
                raise KeyError(object_path)
1447
2539
            
1448
2540
            del _interface
1449
2541
        
1450
2542
        mandos_dbus_service = MandosDBusService()
1451
2543
    
1452
 
    for client in tcp_server.clients:
 
2544
    def cleanup():
 
2545
        "Cleanup function; run on exit"
 
2546
        service.cleanup()
 
2547
        
 
2548
        multiprocessing.active_children()
 
2549
        if not (tcp_server.clients or client_settings):
 
2550
            return
 
2551
        
 
2552
        # Store client before exiting. Secrets are encrypted with key
 
2553
        # based on what config file has. If config file is
 
2554
        # removed/edited, old secret will thus be unrecovable.
 
2555
        clients = {}
 
2556
        with PGPEngine() as pgp:
 
2557
            for client in tcp_server.clients.itervalues():
 
2558
                key = client_settings[client.name]["secret"]
 
2559
                client.encrypted_secret = pgp.encrypt(client.secret,
 
2560
                                                      key)
 
2561
                client_dict = {}
 
2562
                
 
2563
                # A list of attributes that can not be pickled
 
2564
                # + secret.
 
2565
                exclude = set(("bus", "changedstate", "secret",
 
2566
                               "checker"))
 
2567
                for name, typ in (inspect.getmembers
 
2568
                                  (dbus.service.Object)):
 
2569
                    exclude.add(name)
 
2570
                
 
2571
                client_dict["encrypted_secret"] = (client
 
2572
                                                   .encrypted_secret)
 
2573
                for attr in client.client_structure:
 
2574
                    if attr not in exclude:
 
2575
                        client_dict[attr] = getattr(client, attr)
 
2576
                
 
2577
                clients[client.name] = client_dict
 
2578
                del client_settings[client.name]["secret"]
 
2579
        
 
2580
        try:
 
2581
            tempfd, tempname = tempfile.mkstemp(suffix=".pickle",
 
2582
                                                prefix="clients-",
 
2583
                                                dir=os.path.dirname
 
2584
                                                (stored_state_path))
 
2585
            with os.fdopen(tempfd, "wb") as stored_state:
 
2586
                pickle.dump((clients, client_settings), stored_state)
 
2587
            os.rename(tempname, stored_state_path)
 
2588
        except (IOError, OSError) as e:
 
2589
            if not debug:
 
2590
                try:
 
2591
                    os.remove(tempname)
 
2592
                except NameError:
 
2593
                    pass
 
2594
            if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
 
2595
                logger.warning("Could not save persistent state: {0}"
 
2596
                               .format(os.strerror(e.errno)))
 
2597
            else:
 
2598
                logger.warning("Could not save persistent state:",
 
2599
                               exc_info=e)
 
2600
                raise e
 
2601
        
 
2602
        # Delete all clients, and settings from config
 
2603
        while tcp_server.clients:
 
2604
            name, client = tcp_server.clients.popitem()
 
2605
            if use_dbus:
 
2606
                client.remove_from_connection()
 
2607
            # Don't signal anything except ClientRemoved
 
2608
            client.disable(quiet=True)
 
2609
            if use_dbus:
 
2610
                # Emit D-Bus signal
 
2611
                mandos_dbus_service.ClientRemoved(client
 
2612
                                                  .dbus_object_path,
 
2613
                                                  client.name)
 
2614
        client_settings.clear()
 
2615
    
 
2616
    atexit.register(cleanup)
 
2617
    
 
2618
    for client in tcp_server.clients.itervalues():
1453
2619
        if use_dbus:
1454
2620
            # Emit D-Bus signal
1455
 
            mandos_dbus_service.ClientAdded(client.dbus_object_path,
1456
 
                                            client.GetAllProperties())
1457
 
        client.enable()
 
2621
            mandos_dbus_service.ClientAdded(client.dbus_object_path)
 
2622
        # Need to initiate checking of clients
 
2623
        if client.enabled:
 
2624
            client.init_checker()
1458
2625
    
1459
2626
    tcp_server.enable()
1460
2627
    tcp_server.server_activate()
1462
2629
    # Find out what port we got
1463
2630
    service.port = tcp_server.socket.getsockname()[1]
1464
2631
    if use_ipv6:
1465
 
        logger.info(u"Now listening on address %r, port %d,"
1466
 
                    " flowinfo %d, scope_id %d"
1467
 
                    % tcp_server.socket.getsockname())
 
2632
        logger.info("Now listening on address %r, port %d,"
 
2633
                    " flowinfo %d, scope_id %d",
 
2634
                    *tcp_server.socket.getsockname())
1468
2635
    else:                       # IPv4
1469
 
        logger.info(u"Now listening on address %r, port %d"
1470
 
                    % tcp_server.socket.getsockname())
 
2636
        logger.info("Now listening on address %r, port %d",
 
2637
                    *tcp_server.socket.getsockname())
1471
2638
    
1472
2639
    #service.interface = tcp_server.socket.getsockname()[3]
1473
2640
    
1475
2642
        # From the Avahi example code
1476
2643
        try:
1477
2644
            service.activate()
1478
 
        except dbus.exceptions.DBusException, error:
1479
 
            logger.critical(u"DBusException: %s", error)
 
2645
        except dbus.exceptions.DBusException as error:
 
2646
            logger.critical("D-Bus Exception", exc_info=error)
 
2647
            cleanup()
1480
2648
            sys.exit(1)
1481
2649
        # End of Avahi example code
1482
2650
        
1485
2653
                             (tcp_server.handle_request
1486
2654
                              (*args[2:], **kwargs) or True))
1487
2655
        
1488
 
        logger.debug(u"Starting main loop")
 
2656
        logger.debug("Starting main loop")
1489
2657
        main_loop.run()
1490
 
    except AvahiError, error:
1491
 
        logger.critical(u"AvahiError: %s", error)
 
2658
    except AvahiError as error:
 
2659
        logger.critical("Avahi Error", exc_info=error)
 
2660
        cleanup()
1492
2661
        sys.exit(1)
1493
2662
    except KeyboardInterrupt:
1494
2663
        if debug:
1495
 
            print >> sys.stderr
1496
 
        logger.debug(u"Server received KeyboardInterrupt")
1497
 
    logger.debug(u"Server exiting")
 
2664
            print("", file=sys.stderr)
 
2665
        logger.debug("Server received KeyboardInterrupt")
 
2666
    logger.debug("Server exiting")
 
2667
    # Must run before the D-Bus bus name gets deregistered
 
2668
    cleanup()
1498
2669
 
1499
2670
if __name__ == '__main__':
1500
2671
    main()