/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos

  • Committer: Teddy Hogeborn
  • Date: 2012-05-20 14:37:17 UTC
  • mfrom: (237.4.31 release)
  • Revision ID: teddy@recompile.se-20120520143717-48406ypmuwgwl32f
Merge from release branch.

Show diffs side-by-side

added added

removed removed

Lines of Context:
11
11
# "AvahiService" class, and some lines in "main".
12
12
13
13
# Everything else is
14
 
# Copyright © 2008-2011 Teddy Hogeborn
15
 
# Copyright © 2008-2011 Björn Påhlsson
 
14
# Copyright © 2008-2012 Teddy Hogeborn
 
15
# Copyright © 2008-2012 Björn Påhlsson
16
16
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
28
28
# along with this program.  If not, see
29
29
# <http://www.gnu.org/licenses/>.
30
30
31
 
# Contact the authors at <mandos@fukt.bsnet.se>.
 
31
# Contact the authors at <mandos@recompile.se>.
32
32
33
33
 
34
34
from __future__ import (division, absolute_import, print_function,
35
35
                        unicode_literals)
36
36
 
 
37
from future_builtins import *
 
38
 
37
39
import SocketServer as socketserver
38
40
import socket
39
41
import argparse
62
64
import functools
63
65
import cPickle as pickle
64
66
import multiprocessing
 
67
import types
 
68
import binascii
 
69
import tempfile
 
70
import itertools
65
71
 
66
72
import dbus
67
73
import dbus.service
72
78
import ctypes.util
73
79
import xml.dom.minidom
74
80
import inspect
 
81
import GnuPGInterface
75
82
 
76
83
try:
77
84
    SO_BINDTODEVICE = socket.SO_BINDTODEVICE
81
88
    except ImportError:
82
89
        SO_BINDTODEVICE = None
83
90
 
84
 
 
85
 
version = "1.3.0"
86
 
 
87
 
#logger = logging.getLogger('mandos')
88
 
logger = logging.Logger('mandos')
 
91
version = "1.5.4"
 
92
stored_state_file = "clients.pickle"
 
93
 
 
94
logger = logging.getLogger()
89
95
syslogger = (logging.handlers.SysLogHandler
90
96
             (facility = logging.handlers.SysLogHandler.LOG_DAEMON,
91
97
              address = str("/dev/log")))
92
 
syslogger.setFormatter(logging.Formatter
93
 
                       ('Mandos [%(process)d]: %(levelname)s:'
94
 
                        ' %(message)s'))
95
 
logger.addHandler(syslogger)
96
 
 
97
 
console = logging.StreamHandler()
98
 
console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'
99
 
                                       ' %(levelname)s:'
100
 
                                       ' %(message)s'))
101
 
logger.addHandler(console)
 
98
 
 
99
try:
 
100
    if_nametoindex = (ctypes.cdll.LoadLibrary
 
101
                      (ctypes.util.find_library("c"))
 
102
                      .if_nametoindex)
 
103
except (OSError, AttributeError):
 
104
    def if_nametoindex(interface):
 
105
        "Get an interface index the hard way, i.e. using fcntl()"
 
106
        SIOCGIFINDEX = 0x8933  # From /usr/include/linux/sockios.h
 
107
        with contextlib.closing(socket.socket()) as s:
 
108
            ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
 
109
                                struct.pack(str("16s16x"),
 
110
                                            interface))
 
111
        interface_index = struct.unpack(str("I"),
 
112
                                        ifreq[16:20])[0]
 
113
        return interface_index
 
114
 
 
115
 
 
116
def initlogger(debug, level=logging.WARNING):
 
117
    """init logger and add loglevel"""
 
118
    
 
119
    syslogger.setFormatter(logging.Formatter
 
120
                           ('Mandos [%(process)d]: %(levelname)s:'
 
121
                            ' %(message)s'))
 
122
    logger.addHandler(syslogger)
 
123
    
 
124
    if debug:
 
125
        console = logging.StreamHandler()
 
126
        console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
 
127
                                               ' [%(process)d]:'
 
128
                                               ' %(levelname)s:'
 
129
                                               ' %(message)s'))
 
130
        logger.addHandler(console)
 
131
    logger.setLevel(level)
 
132
 
 
133
 
 
134
class PGPError(Exception):
 
135
    """Exception if encryption/decryption fails"""
 
136
    pass
 
137
 
 
138
 
 
139
class PGPEngine(object):
 
140
    """A simple class for OpenPGP symmetric encryption & decryption"""
 
141
    def __init__(self):
 
142
        self.gnupg = GnuPGInterface.GnuPG()
 
143
        self.tempdir = tempfile.mkdtemp(prefix="mandos-")
 
144
        self.gnupg = GnuPGInterface.GnuPG()
 
145
        self.gnupg.options.meta_interactive = False
 
146
        self.gnupg.options.homedir = self.tempdir
 
147
        self.gnupg.options.extra_args.extend(['--force-mdc',
 
148
                                              '--quiet',
 
149
                                              '--no-use-agent'])
 
150
    
 
151
    def __enter__(self):
 
152
        return self
 
153
    
 
154
    def __exit__ (self, exc_type, exc_value, traceback):
 
155
        self._cleanup()
 
156
        return False
 
157
    
 
158
    def __del__(self):
 
159
        self._cleanup()
 
160
    
 
161
    def _cleanup(self):
 
162
        if self.tempdir is not None:
 
163
            # Delete contents of tempdir
 
164
            for root, dirs, files in os.walk(self.tempdir,
 
165
                                             topdown = False):
 
166
                for filename in files:
 
167
                    os.remove(os.path.join(root, filename))
 
168
                for dirname in dirs:
 
169
                    os.rmdir(os.path.join(root, dirname))
 
170
            # Remove tempdir
 
171
            os.rmdir(self.tempdir)
 
172
            self.tempdir = None
 
173
    
 
174
    def password_encode(self, password):
 
175
        # Passphrase can not be empty and can not contain newlines or
 
176
        # NUL bytes.  So we prefix it and hex encode it.
 
177
        return b"mandos" + binascii.hexlify(password)
 
178
    
 
179
    def encrypt(self, data, password):
 
180
        self.gnupg.passphrase = self.password_encode(password)
 
181
        with open(os.devnull, "w") as devnull:
 
182
            try:
 
183
                proc = self.gnupg.run(['--symmetric'],
 
184
                                      create_fhs=['stdin', 'stdout'],
 
185
                                      attach_fhs={'stderr': devnull})
 
186
                with contextlib.closing(proc.handles['stdin']) as f:
 
187
                    f.write(data)
 
188
                with contextlib.closing(proc.handles['stdout']) as f:
 
189
                    ciphertext = f.read()
 
190
                proc.wait()
 
191
            except IOError as e:
 
192
                raise PGPError(e)
 
193
        self.gnupg.passphrase = None
 
194
        return ciphertext
 
195
    
 
196
    def decrypt(self, data, password):
 
197
        self.gnupg.passphrase = self.password_encode(password)
 
198
        with open(os.devnull, "w") as devnull:
 
199
            try:
 
200
                proc = self.gnupg.run(['--decrypt'],
 
201
                                      create_fhs=['stdin', 'stdout'],
 
202
                                      attach_fhs={'stderr': devnull})
 
203
                with contextlib.closing(proc.handles['stdin']) as f:
 
204
                    f.write(data)
 
205
                with contextlib.closing(proc.handles['stdout']) as f:
 
206
                    decrypted_plaintext = f.read()
 
207
                proc.wait()
 
208
            except IOError as e:
 
209
                raise PGPError(e)
 
210
        self.gnupg.passphrase = None
 
211
        return decrypted_plaintext
 
212
 
102
213
 
103
214
class AvahiError(Exception):
104
215
    def __init__(self, value, *args, **kwargs):
134
245
    server: D-Bus Server
135
246
    bus: dbus.SystemBus()
136
247
    """
 
248
    
137
249
    def __init__(self, interface = avahi.IF_UNSPEC, name = None,
138
250
                 servicetype = None, port = None, TXT = None,
139
251
                 domain = "", host = "", max_renames = 32768,
151
263
        self.group = None       # our entry group
152
264
        self.server = None
153
265
        self.bus = bus
 
266
        self.entry_group_state_changed_match = None
 
267
    
154
268
    def rename(self):
155
269
        """Derived from the Avahi example code"""
156
270
        if self.rename_count >= self.max_renames:
158
272
                            " after %i retries, exiting.",
159
273
                            self.rename_count)
160
274
            raise AvahiServiceError("Too many renames")
161
 
        self.name = unicode(self.server.GetAlternativeServiceName(self.name))
 
275
        self.name = unicode(self.server
 
276
                            .GetAlternativeServiceName(self.name))
162
277
        logger.info("Changing Zeroconf service name to %r ...",
163
278
                    self.name)
164
 
        syslogger.setFormatter(logging.Formatter
165
 
                               ('Mandos (%s) [%%(process)d]:'
166
 
                                ' %%(levelname)s: %%(message)s'
167
 
                                % self.name))
168
279
        self.remove()
169
280
        try:
170
281
            self.add()
171
 
        except dbus.exceptions.DBusException, error:
172
 
            logger.critical("DBusException: %s", error)
 
282
        except dbus.exceptions.DBusException as error:
 
283
            logger.critical("D-Bus Exception", exc_info=error)
173
284
            self.cleanup()
174
285
            os._exit(1)
175
286
        self.rename_count += 1
 
287
    
176
288
    def remove(self):
177
289
        """Derived from the Avahi example code"""
 
290
        if self.entry_group_state_changed_match is not None:
 
291
            self.entry_group_state_changed_match.remove()
 
292
            self.entry_group_state_changed_match = None
178
293
        if self.group is not None:
179
294
            self.group.Reset()
 
295
    
180
296
    def add(self):
181
297
        """Derived from the Avahi example code"""
 
298
        self.remove()
182
299
        if self.group is None:
183
300
            self.group = dbus.Interface(
184
301
                self.bus.get_object(avahi.DBUS_NAME,
185
302
                                    self.server.EntryGroupNew()),
186
303
                avahi.DBUS_INTERFACE_ENTRY_GROUP)
187
 
            self.group.connect_to_signal('StateChanged',
188
 
                                         self
189
 
                                         .entry_group_state_changed)
 
304
        self.entry_group_state_changed_match = (
 
305
            self.group.connect_to_signal(
 
306
                'StateChanged', self.entry_group_state_changed))
190
307
        logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
191
308
                     self.name, self.type)
192
309
        self.group.AddService(
198
315
            dbus.UInt16(self.port),
199
316
            avahi.string_array_to_txt_array(self.TXT))
200
317
        self.group.Commit()
 
318
    
201
319
    def entry_group_state_changed(self, state, error):
202
320
        """Derived from the Avahi example code"""
203
321
        logger.debug("Avahi entry group state change: %i", state)
210
328
        elif state == avahi.ENTRY_GROUP_FAILURE:
211
329
            logger.critical("Avahi: Error in group state changed %s",
212
330
                            unicode(error))
213
 
            raise AvahiGroupError("State changed: %s"
214
 
                                  % unicode(error))
 
331
            raise AvahiGroupError("State changed: {0!s}"
 
332
                                  .format(error))
 
333
    
215
334
    def cleanup(self):
216
335
        """Derived from the Avahi example code"""
217
336
        if self.group is not None:
218
 
            self.group.Free()
 
337
            try:
 
338
                self.group.Free()
 
339
            except (dbus.exceptions.UnknownMethodException,
 
340
                    dbus.exceptions.DBusException):
 
341
                pass
219
342
            self.group = None
220
 
    def server_state_changed(self, state):
 
343
        self.remove()
 
344
    
 
345
    def server_state_changed(self, state, error=None):
221
346
        """Derived from the Avahi example code"""
222
347
        logger.debug("Avahi server state change: %i", state)
223
 
        if state == avahi.SERVER_COLLISION:
224
 
            logger.error("Zeroconf server name collision")
225
 
            self.remove()
 
348
        bad_states = { avahi.SERVER_INVALID:
 
349
                           "Zeroconf server invalid",
 
350
                       avahi.SERVER_REGISTERING: None,
 
351
                       avahi.SERVER_COLLISION:
 
352
                           "Zeroconf server name collision",
 
353
                       avahi.SERVER_FAILURE:
 
354
                           "Zeroconf server failure" }
 
355
        if state in bad_states:
 
356
            if bad_states[state] is not None:
 
357
                if error is None:
 
358
                    logger.error(bad_states[state])
 
359
                else:
 
360
                    logger.error(bad_states[state] + ": %r", error)
 
361
            self.cleanup()
226
362
        elif state == avahi.SERVER_RUNNING:
227
363
            self.add()
 
364
        else:
 
365
            if error is None:
 
366
                logger.debug("Unknown state: %r", state)
 
367
            else:
 
368
                logger.debug("Unknown state: %r: %r", state, error)
 
369
    
228
370
    def activate(self):
229
371
        """Derived from the Avahi example code"""
230
372
        if self.server is None:
231
373
            self.server = dbus.Interface(
232
374
                self.bus.get_object(avahi.DBUS_NAME,
233
 
                                    avahi.DBUS_PATH_SERVER),
 
375
                                    avahi.DBUS_PATH_SERVER,
 
376
                                    follow_name_owner_changes=True),
234
377
                avahi.DBUS_INTERFACE_SERVER)
235
378
        self.server.connect_to_signal("StateChanged",
236
379
                                 self.server_state_changed)
237
380
        self.server_state_changed(self.server.GetState())
238
381
 
239
382
 
 
383
class AvahiServiceToSyslog(AvahiService):
 
384
    def rename(self):
 
385
        """Add the new name to the syslog messages"""
 
386
        ret = AvahiService.rename(self)
 
387
        syslogger.setFormatter(logging.Formatter
 
388
                               ('Mandos ({0}) [%(process)d]:'
 
389
                                ' %(levelname)s: %(message)s'
 
390
                                .format(self.name)))
 
391
        return ret
 
392
 
 
393
 
 
394
def timedelta_to_milliseconds(td):
 
395
    "Convert a datetime.timedelta() to milliseconds"
 
396
    return ((td.days * 24 * 60 * 60 * 1000)
 
397
            + (td.seconds * 1000)
 
398
            + (td.microseconds // 1000))
 
399
 
 
400
 
240
401
class Client(object):
241
402
    """A representation of a client host served by this server.
242
403
    
243
404
    Attributes:
244
 
    _approved:   bool(); 'None' if not yet approved/disapproved
 
405
    approved:   bool(); 'None' if not yet approved/disapproved
245
406
    approval_delay: datetime.timedelta(); Time to wait for approval
246
407
    approval_duration: datetime.timedelta(); Duration of one approval
247
408
    checker:    subprocess.Popen(); a running checker process used
254
415
                     instance %(name)s can be used in the command.
255
416
    checker_initiator_tag: a gobject event source tag, or None
256
417
    created:    datetime.datetime(); (UTC) object creation
 
418
    client_structure: Object describing what attributes a client has
 
419
                      and is used for storing the client at exit
257
420
    current_checker_command: string; current running checker_command
258
 
    disable_hook:  If set, called by disable() as disable_hook(self)
259
421
    disable_initiator_tag: a gobject event source tag, or None
260
422
    enabled:    bool()
261
423
    fingerprint: string (40 or 32 hexadecimal digits); used to
264
426
    interval:   datetime.timedelta(); How often to start a new checker
265
427
    last_approval_request: datetime.datetime(); (UTC) or None
266
428
    last_checked_ok: datetime.datetime(); (UTC) or None
267
 
    last_enabled: datetime.datetime(); (UTC)
 
429
    last_checker_status: integer between 0 and 255 reflecting exit
 
430
                         status of last checker. -1 reflects crashed
 
431
                         checker, -2 means no checker completed yet.
 
432
    last_enabled: datetime.datetime(); (UTC) or None
268
433
    name:       string; from the config file, used in log messages and
269
434
                        D-Bus identifiers
270
435
    secret:     bytestring; sent verbatim (over TLS) to client
271
436
    timeout:    datetime.timedelta(); How long from last_checked_ok
272
437
                                      until this client is disabled
 
438
    extended_timeout:   extra long timeout when secret has been sent
273
439
    runtime_expansions: Allowed attributes for runtime expansion.
 
440
    expires:    datetime.datetime(); time (UTC) when a client will be
 
441
                disabled, or None
274
442
    """
275
443
    
276
444
    runtime_expansions = ("approval_delay", "approval_duration",
277
 
                          "created", "enabled", "fingerprint",
278
 
                          "host", "interval", "last_checked_ok",
 
445
                          "created", "enabled", "expires",
 
446
                          "fingerprint", "host", "interval",
 
447
                          "last_approval_request", "last_checked_ok",
279
448
                          "last_enabled", "name", "timeout")
280
 
    
281
 
    @staticmethod
282
 
    def _timedelta_to_milliseconds(td):
283
 
        "Convert a datetime.timedelta() to milliseconds"
284
 
        return ((td.days * 24 * 60 * 60 * 1000)
285
 
                + (td.seconds * 1000)
286
 
                + (td.microseconds // 1000))
 
449
    client_defaults = { "timeout": "5m",
 
450
                        "extended_timeout": "15m",
 
451
                        "interval": "2m",
 
452
                        "checker": "fping -q -- %%(host)s",
 
453
                        "host": "",
 
454
                        "approval_delay": "0s",
 
455
                        "approval_duration": "1s",
 
456
                        "approved_by_default": "True",
 
457
                        "enabled": "True",
 
458
                        }
287
459
    
288
460
    def timeout_milliseconds(self):
289
461
        "Return the 'timeout' attribute in milliseconds"
290
 
        return self._timedelta_to_milliseconds(self.timeout)
 
462
        return timedelta_to_milliseconds(self.timeout)
 
463
    
 
464
    def extended_timeout_milliseconds(self):
 
465
        "Return the 'extended_timeout' attribute in milliseconds"
 
466
        return timedelta_to_milliseconds(self.extended_timeout)
291
467
    
292
468
    def interval_milliseconds(self):
293
469
        "Return the 'interval' attribute in milliseconds"
294
 
        return self._timedelta_to_milliseconds(self.interval)
295
 
 
 
470
        return timedelta_to_milliseconds(self.interval)
 
471
    
296
472
    def approval_delay_milliseconds(self):
297
 
        return self._timedelta_to_milliseconds(self.approval_delay)
298
 
    
299
 
    def __init__(self, name = None, disable_hook=None, config=None):
300
 
        """Note: the 'checker' key in 'config' sets the
301
 
        'checker_command' attribute and *not* the 'checker'
302
 
        attribute."""
 
473
        return timedelta_to_milliseconds(self.approval_delay)
 
474
    
 
475
    @staticmethod
 
476
    def config_parser(config):
 
477
        """Construct a new dict of client settings of this form:
 
478
        { client_name: {setting_name: value, ...}, ...}
 
479
        with exceptions for any special settings as defined above.
 
480
        NOTE: Must be a pure function. Must return the same result
 
481
        value given the same arguments.
 
482
        """
 
483
        settings = {}
 
484
        for client_name in config.sections():
 
485
            section = dict(config.items(client_name))
 
486
            client = settings[client_name] = {}
 
487
            
 
488
            client["host"] = section["host"]
 
489
            # Reformat values from string types to Python types
 
490
            client["approved_by_default"] = config.getboolean(
 
491
                client_name, "approved_by_default")
 
492
            client["enabled"] = config.getboolean(client_name,
 
493
                                                  "enabled")
 
494
            
 
495
            client["fingerprint"] = (section["fingerprint"].upper()
 
496
                                     .replace(" ", ""))
 
497
            if "secret" in section:
 
498
                client["secret"] = section["secret"].decode("base64")
 
499
            elif "secfile" in section:
 
500
                with open(os.path.expanduser(os.path.expandvars
 
501
                                             (section["secfile"])),
 
502
                          "rb") as secfile:
 
503
                    client["secret"] = secfile.read()
 
504
            else:
 
505
                raise TypeError("No secret or secfile for section {0}"
 
506
                                .format(section))
 
507
            client["timeout"] = string_to_delta(section["timeout"])
 
508
            client["extended_timeout"] = string_to_delta(
 
509
                section["extended_timeout"])
 
510
            client["interval"] = string_to_delta(section["interval"])
 
511
            client["approval_delay"] = string_to_delta(
 
512
                section["approval_delay"])
 
513
            client["approval_duration"] = string_to_delta(
 
514
                section["approval_duration"])
 
515
            client["checker_command"] = section["checker"]
 
516
            client["last_approval_request"] = None
 
517
            client["last_checked_ok"] = None
 
518
            client["last_checker_status"] = -2
 
519
        
 
520
        return settings
 
521
    
 
522
    def __init__(self, settings, name = None):
303
523
        self.name = name
304
 
        if config is None:
305
 
            config = {}
 
524
        # adding all client settings
 
525
        for setting, value in settings.iteritems():
 
526
            setattr(self, setting, value)
 
527
        
 
528
        if self.enabled:
 
529
            if not hasattr(self, "last_enabled"):
 
530
                self.last_enabled = datetime.datetime.utcnow()
 
531
            if not hasattr(self, "expires"):
 
532
                self.expires = (datetime.datetime.utcnow()
 
533
                                + self.timeout)
 
534
        else:
 
535
            self.last_enabled = None
 
536
            self.expires = None
 
537
        
306
538
        logger.debug("Creating client %r", self.name)
307
539
        # Uppercase and remove spaces from fingerprint for later
308
540
        # comparison purposes with return value from the fingerprint()
309
541
        # function
310
 
        self.fingerprint = (config["fingerprint"].upper()
311
 
                            .replace(" ", ""))
312
542
        logger.debug("  Fingerprint: %s", self.fingerprint)
313
 
        if "secret" in config:
314
 
            self.secret = config["secret"].decode("base64")
315
 
        elif "secfile" in config:
316
 
            with open(os.path.expanduser(os.path.expandvars
317
 
                                         (config["secfile"])),
318
 
                      "rb") as secfile:
319
 
                self.secret = secfile.read()
320
 
        else:
321
 
            raise TypeError("No secret or secfile for client %s"
322
 
                            % self.name)
323
 
        self.host = config.get("host", "")
324
 
        self.created = datetime.datetime.utcnow()
325
 
        self.enabled = False
326
 
        self.last_approval_request = None
327
 
        self.last_enabled = None
328
 
        self.last_checked_ok = None
329
 
        self.timeout = string_to_delta(config["timeout"])
330
 
        self.interval = string_to_delta(config["interval"])
331
 
        self.disable_hook = disable_hook
 
543
        self.created = settings.get("created",
 
544
                                    datetime.datetime.utcnow())
 
545
        
 
546
        # attributes specific for this server instance
332
547
        self.checker = None
333
548
        self.checker_initiator_tag = None
334
549
        self.disable_initiator_tag = None
335
550
        self.checker_callback_tag = None
336
 
        self.checker_command = config["checker"]
337
551
        self.current_checker_command = None
338
 
        self.last_connect = None
339
 
        self._approved = None
340
 
        self.approved_by_default = config.get("approved_by_default",
341
 
                                              True)
 
552
        self.approved = None
342
553
        self.approvals_pending = 0
343
 
        self.approval_delay = string_to_delta(
344
 
            config["approval_delay"])
345
 
        self.approval_duration = string_to_delta(
346
 
            config["approval_duration"])
347
 
        self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())
 
554
        self.changedstate = (multiprocessing_manager
 
555
                             .Condition(multiprocessing_manager
 
556
                                        .Lock()))
 
557
        self.client_structure = [attr for attr in
 
558
                                 self.__dict__.iterkeys()
 
559
                                 if not attr.startswith("_")]
 
560
        self.client_structure.append("client_structure")
 
561
        
 
562
        for name, t in inspect.getmembers(type(self),
 
563
                                          lambda obj:
 
564
                                              isinstance(obj,
 
565
                                                         property)):
 
566
            if not name.startswith("_"):
 
567
                self.client_structure.append(name)
348
568
    
 
569
    # Send notice to process children that client state has changed
349
570
    def send_changedstate(self):
350
 
        self.changedstate.acquire()
351
 
        self.changedstate.notify_all()
352
 
        self.changedstate.release()
353
 
        
 
571
        with self.changedstate:
 
572
            self.changedstate.notify_all()
 
573
    
354
574
    def enable(self):
355
575
        """Start this client's checker and timeout hooks"""
356
576
        if getattr(self, "enabled", False):
357
577
            # Already enabled
358
578
            return
359
 
        self.send_changedstate()
 
579
        self.expires = datetime.datetime.utcnow() + self.timeout
 
580
        self.enabled = True
360
581
        self.last_enabled = datetime.datetime.utcnow()
 
582
        self.init_checker()
 
583
        self.send_changedstate()
 
584
    
 
585
    def disable(self, quiet=True):
 
586
        """Disable this client."""
 
587
        if not getattr(self, "enabled", False):
 
588
            return False
 
589
        if not quiet:
 
590
            logger.info("Disabling client %s", self.name)
 
591
        if getattr(self, "disable_initiator_tag", None) is not None:
 
592
            gobject.source_remove(self.disable_initiator_tag)
 
593
            self.disable_initiator_tag = None
 
594
        self.expires = None
 
595
        if getattr(self, "checker_initiator_tag", None) is not None:
 
596
            gobject.source_remove(self.checker_initiator_tag)
 
597
            self.checker_initiator_tag = None
 
598
        self.stop_checker()
 
599
        self.enabled = False
 
600
        if not quiet:
 
601
            self.send_changedstate()
 
602
        # Do not run this again if called by a gobject.timeout_add
 
603
        return False
 
604
    
 
605
    def __del__(self):
 
606
        self.disable()
 
607
    
 
608
    def init_checker(self):
361
609
        # Schedule a new checker to be started an 'interval' from now,
362
610
        # and every interval from then on.
 
611
        if self.checker_initiator_tag is not None:
 
612
            gobject.source_remove(self.checker_initiator_tag)
363
613
        self.checker_initiator_tag = (gobject.timeout_add
364
614
                                      (self.interval_milliseconds(),
365
615
                                       self.start_checker))
366
616
        # Schedule a disable() when 'timeout' has passed
 
617
        if self.disable_initiator_tag is not None:
 
618
            gobject.source_remove(self.disable_initiator_tag)
367
619
        self.disable_initiator_tag = (gobject.timeout_add
368
620
                                   (self.timeout_milliseconds(),
369
621
                                    self.disable))
370
 
        self.enabled = True
371
622
        # Also start a new checker *right now*.
372
623
        self.start_checker()
373
624
    
374
 
    def disable(self, quiet=True):
375
 
        """Disable this client."""
376
 
        if not getattr(self, "enabled", False):
377
 
            return False
378
 
        if not quiet:
379
 
            self.send_changedstate()
380
 
        if not quiet:
381
 
            logger.info("Disabling client %s", self.name)
382
 
        if getattr(self, "disable_initiator_tag", False):
383
 
            gobject.source_remove(self.disable_initiator_tag)
384
 
            self.disable_initiator_tag = None
385
 
        if getattr(self, "checker_initiator_tag", False):
386
 
            gobject.source_remove(self.checker_initiator_tag)
387
 
            self.checker_initiator_tag = None
388
 
        self.stop_checker()
389
 
        if self.disable_hook:
390
 
            self.disable_hook(self)
391
 
        self.enabled = False
392
 
        # Do not run this again if called by a gobject.timeout_add
393
 
        return False
394
 
    
395
 
    def __del__(self):
396
 
        self.disable_hook = None
397
 
        self.disable()
398
 
    
399
625
    def checker_callback(self, pid, condition, command):
400
626
        """The checker has completed, so take appropriate actions."""
401
627
        self.checker_callback_tag = None
402
628
        self.checker = None
403
629
        if os.WIFEXITED(condition):
404
 
            exitstatus = os.WEXITSTATUS(condition)
405
 
            if exitstatus == 0:
 
630
            self.last_checker_status = os.WEXITSTATUS(condition)
 
631
            if self.last_checker_status == 0:
406
632
                logger.info("Checker for %(name)s succeeded",
407
633
                            vars(self))
408
634
                self.checked_ok()
410
636
                logger.info("Checker for %(name)s failed",
411
637
                            vars(self))
412
638
        else:
 
639
            self.last_checker_status = -1
413
640
            logger.warning("Checker for %(name)s crashed?",
414
641
                           vars(self))
415
642
    
416
643
    def checked_ok(self):
417
 
        """Bump up the timeout for this client.
418
 
        
419
 
        This should only be called when the client has been seen,
420
 
        alive and well.
421
 
        """
 
644
        """Assert that the client has been seen, alive and well."""
422
645
        self.last_checked_ok = datetime.datetime.utcnow()
423
 
        gobject.source_remove(self.disable_initiator_tag)
424
 
        self.disable_initiator_tag = (gobject.timeout_add
425
 
                                      (self.timeout_milliseconds(),
426
 
                                       self.disable))
 
646
        self.last_checker_status = 0
 
647
        self.bump_timeout()
 
648
    
 
649
    def bump_timeout(self, timeout=None):
 
650
        """Bump up the timeout for this client."""
 
651
        if timeout is None:
 
652
            timeout = self.timeout
 
653
        if self.disable_initiator_tag is not None:
 
654
            gobject.source_remove(self.disable_initiator_tag)
 
655
            self.disable_initiator_tag = None
 
656
        if getattr(self, "enabled", False):
 
657
            self.disable_initiator_tag = (gobject.timeout_add
 
658
                                          (timedelta_to_milliseconds
 
659
                                           (timeout), self.disable))
 
660
            self.expires = datetime.datetime.utcnow() + timeout
427
661
    
428
662
    def need_approval(self):
429
663
        self.last_approval_request = datetime.datetime.utcnow()
434
668
        If a checker already exists, leave it running and do
435
669
        nothing."""
436
670
        # The reason for not killing a running checker is that if we
437
 
        # did that, then if a checker (for some reason) started
438
 
        # running slowly and taking more than 'interval' time, the
439
 
        # client would inevitably timeout, since no checker would get
440
 
        # a chance to run to completion.  If we instead leave running
 
671
        # did that, and if a checker (for some reason) started running
 
672
        # slowly and taking more than 'interval' time, then the client
 
673
        # would inevitably timeout, since no checker would get a
 
674
        # chance to run to completion.  If we instead leave running
441
675
        # checkers alone, the checker would have to take more time
442
676
        # than 'timeout' for the client to be disabled, which is as it
443
677
        # should be.
445
679
        # If a checker exists, make sure it is not a zombie
446
680
        try:
447
681
            pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
448
 
        except (AttributeError, OSError), error:
 
682
        except (AttributeError, OSError) as error:
449
683
            if (isinstance(error, OSError)
450
684
                and error.errno != errno.ECHILD):
451
685
                raise error
457
691
                                      self.current_checker_command)
458
692
        # Start a new checker if needed
459
693
        if self.checker is None:
 
694
            # Escape attributes for the shell
 
695
            escaped_attrs = dict(
 
696
                (attr, re.escape(unicode(getattr(self, attr))))
 
697
                for attr in
 
698
                self.runtime_expansions)
460
699
            try:
461
 
                # In case checker_command has exactly one % operator
462
 
                command = self.checker_command % self.host
463
 
            except TypeError:
464
 
                # Escape attributes for the shell
465
 
                escaped_attrs = dict(
466
 
                    (attr,
467
 
                     re.escape(unicode(str(getattr(self, attr, "")),
468
 
                                       errors=
469
 
                                       'replace')))
470
 
                    for attr in
471
 
                    self.runtime_expansions)
472
 
 
473
 
                try:
474
 
                    command = self.checker_command % escaped_attrs
475
 
                except TypeError, error:
476
 
                    logger.error('Could not format string "%s":'
477
 
                                 ' %s', self.checker_command, error)
478
 
                    return True # Try again later
 
700
                command = self.checker_command % escaped_attrs
 
701
            except TypeError as error:
 
702
                logger.error('Could not format string "%s"',
 
703
                             self.checker_command, exc_info=error)
 
704
                return True # Try again later
479
705
            self.current_checker_command = command
480
706
            try:
481
707
                logger.info("Starting checker %r for %s",
487
713
                self.checker = subprocess.Popen(command,
488
714
                                                close_fds=True,
489
715
                                                shell=True, cwd="/")
490
 
                self.checker_callback_tag = (gobject.child_watch_add
491
 
                                             (self.checker.pid,
492
 
                                              self.checker_callback,
493
 
                                              data=command))
494
 
                # The checker may have completed before the gobject
495
 
                # watch was added.  Check for this.
496
 
                pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
497
 
                if pid:
498
 
                    gobject.source_remove(self.checker_callback_tag)
499
 
                    self.checker_callback(pid, status, command)
500
 
            except OSError, error:
501
 
                logger.error("Failed to start subprocess: %s",
502
 
                             error)
 
716
            except OSError as error:
 
717
                logger.error("Failed to start subprocess",
 
718
                             exc_info=error)
 
719
            self.checker_callback_tag = (gobject.child_watch_add
 
720
                                         (self.checker.pid,
 
721
                                          self.checker_callback,
 
722
                                          data=command))
 
723
            # The checker may have completed before the gobject
 
724
            # watch was added.  Check for this.
 
725
            pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
 
726
            if pid:
 
727
                gobject.source_remove(self.checker_callback_tag)
 
728
                self.checker_callback(pid, status, command)
503
729
        # Re-run this periodically if run by gobject.timeout_add
504
730
        return True
505
731
    
512
738
            return
513
739
        logger.debug("Stopping checker for %(name)s", vars(self))
514
740
        try:
515
 
            os.kill(self.checker.pid, signal.SIGTERM)
 
741
            self.checker.terminate()
516
742
            #time.sleep(0.5)
517
743
            #if self.checker.poll() is None:
518
 
            #    os.kill(self.checker.pid, signal.SIGKILL)
519
 
        except OSError, error:
 
744
            #    self.checker.kill()
 
745
        except OSError as error:
520
746
            if error.errno != errno.ESRCH: # No such process
521
747
                raise
522
748
        self.checker = None
523
749
 
 
750
 
524
751
def dbus_service_property(dbus_interface, signature="v",
525
752
                          access="readwrite", byte_arrays=False):
526
753
    """Decorators for marking methods of a DBusObjectWithProperties to
537
764
    # "Set" method, so we fail early here:
538
765
    if byte_arrays and signature != "ay":
539
766
        raise ValueError("Byte arrays not supported for non-'ay'"
540
 
                         " signature %r" % signature)
 
767
                         " signature {0!r}".format(signature))
541
768
    def decorator(func):
542
769
        func._dbus_is_property = True
543
770
        func._dbus_interface = dbus_interface
551
778
    return decorator
552
779
 
553
780
 
 
781
def dbus_interface_annotations(dbus_interface):
 
782
    """Decorator for marking functions returning interface annotations
 
783
    
 
784
    Usage:
 
785
    
 
786
    @dbus_interface_annotations("org.example.Interface")
 
787
    def _foo(self):  # Function name does not matter
 
788
        return {"org.freedesktop.DBus.Deprecated": "true",
 
789
                "org.freedesktop.DBus.Property.EmitsChangedSignal":
 
790
                    "false"}
 
791
    """
 
792
    def decorator(func):
 
793
        func._dbus_is_interface = True
 
794
        func._dbus_interface = dbus_interface
 
795
        func._dbus_name = dbus_interface
 
796
        return func
 
797
    return decorator
 
798
 
 
799
 
 
800
def dbus_annotations(annotations):
 
801
    """Decorator to annotate D-Bus methods, signals or properties
 
802
    Usage:
 
803
    
 
804
    @dbus_service_property("org.example.Interface", signature="b",
 
805
                           access="r")
 
806
    @dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",
 
807
                        "org.freedesktop.DBus.Property."
 
808
                        "EmitsChangedSignal": "false"})
 
809
    def Property_dbus_property(self):
 
810
        return dbus.Boolean(False)
 
811
    """
 
812
    def decorator(func):
 
813
        func._dbus_annotations = annotations
 
814
        return func
 
815
    return decorator
 
816
 
 
817
 
554
818
class DBusPropertyException(dbus.exceptions.DBusException):
555
819
    """A base class for D-Bus property-related exceptions
556
820
    """
572
836
 
573
837
class DBusObjectWithProperties(dbus.service.Object):
574
838
    """A D-Bus object with properties.
575
 
 
 
839
    
576
840
    Classes inheriting from this can use the dbus_service_property
577
841
    decorator to expose methods as D-Bus properties.  It exposes the
578
842
    standard Get(), Set(), and GetAll() methods on the D-Bus.
579
843
    """
580
844
    
581
845
    @staticmethod
582
 
    def _is_dbus_property(obj):
583
 
        return getattr(obj, "_dbus_is_property", False)
 
846
    def _is_dbus_thing(thing):
 
847
        """Returns a function testing if an attribute is a D-Bus thing
 
848
        
 
849
        If called like _is_dbus_thing("method") it returns a function
 
850
        suitable for use as predicate to inspect.getmembers().
 
851
        """
 
852
        return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),
 
853
                                   False)
584
854
    
585
 
    def _get_all_dbus_properties(self):
 
855
    def _get_all_dbus_things(self, thing):
586
856
        """Returns a generator of (name, attribute) pairs
587
857
        """
588
 
        return ((prop._dbus_name, prop)
589
 
                for name, prop in
590
 
                inspect.getmembers(self, self._is_dbus_property))
 
858
        return ((getattr(athing.__get__(self), "_dbus_name",
 
859
                         name),
 
860
                 athing.__get__(self))
 
861
                for cls in self.__class__.__mro__
 
862
                for name, athing in
 
863
                inspect.getmembers(cls,
 
864
                                   self._is_dbus_thing(thing)))
591
865
    
592
866
    def _get_dbus_property(self, interface_name, property_name):
593
867
        """Returns a bound method if one exists which is a D-Bus
594
868
        property with the specified name and interface.
595
869
        """
596
 
        for name in (property_name,
597
 
                     property_name + "_dbus_property"):
598
 
            prop = getattr(self, name, None)
599
 
            if (prop is None
600
 
                or not self._is_dbus_property(prop)
601
 
                or prop._dbus_name != property_name
602
 
                or (interface_name and prop._dbus_interface
603
 
                    and interface_name != prop._dbus_interface)):
604
 
                continue
605
 
            return prop
 
870
        for cls in  self.__class__.__mro__:
 
871
            for name, value in (inspect.getmembers
 
872
                                (cls,
 
873
                                 self._is_dbus_thing("property"))):
 
874
                if (value._dbus_name == property_name
 
875
                    and value._dbus_interface == interface_name):
 
876
                    return value.__get__(self)
 
877
        
606
878
        # No such property
607
879
        raise DBusPropertyNotFound(self.dbus_object_path + ":"
608
880
                                   + interface_name + "."
633
905
            # signatures other than "ay".
634
906
            if prop._dbus_signature != "ay":
635
907
                raise ValueError
636
 
            value = dbus.ByteArray(''.join(unichr(byte)
637
 
                                           for byte in value))
 
908
            value = dbus.ByteArray(b''.join(chr(byte)
 
909
                                            for byte in value))
638
910
        prop(value)
639
911
    
640
912
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
642
914
    def GetAll(self, interface_name):
643
915
        """Standard D-Bus property GetAll() method, see D-Bus
644
916
        standard.
645
 
 
 
917
        
646
918
        Note: Will not include properties with access="write".
647
919
        """
648
 
        all = {}
649
 
        for name, prop in self._get_all_dbus_properties():
 
920
        properties = {}
 
921
        for name, prop in self._get_all_dbus_things("property"):
650
922
            if (interface_name
651
923
                and interface_name != prop._dbus_interface):
652
924
                # Interface non-empty but did not match
656
928
                continue
657
929
            value = prop()
658
930
            if not hasattr(value, "variant_level"):
659
 
                all[name] = value
 
931
                properties[name] = value
660
932
                continue
661
 
            all[name] = type(value)(value, variant_level=
662
 
                                    value.variant_level+1)
663
 
        return dbus.Dictionary(all, signature="sv")
 
933
            properties[name] = type(value)(value, variant_level=
 
934
                                           value.variant_level+1)
 
935
        return dbus.Dictionary(properties, signature="sv")
664
936
    
665
937
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
666
938
                         out_signature="s",
667
939
                         path_keyword='object_path',
668
940
                         connection_keyword='connection')
669
941
    def Introspect(self, object_path, connection):
670
 
        """Standard D-Bus method, overloaded to insert property tags.
 
942
        """Overloading of standard D-Bus method.
 
943
        
 
944
        Inserts property tags and interface annotation tags.
671
945
        """
672
946
        xmlstring = dbus.service.Object.Introspect(self, object_path,
673
947
                                                   connection)
680
954
                e.setAttribute("access", prop._dbus_access)
681
955
                return e
682
956
            for if_tag in document.getElementsByTagName("interface"):
 
957
                # Add property tags
683
958
                for tag in (make_tag(document, name, prop)
684
959
                            for name, prop
685
 
                            in self._get_all_dbus_properties()
 
960
                            in self._get_all_dbus_things("property")
686
961
                            if prop._dbus_interface
687
962
                            == if_tag.getAttribute("name")):
688
963
                    if_tag.appendChild(tag)
 
964
                # Add annotation tags
 
965
                for typ in ("method", "signal", "property"):
 
966
                    for tag in if_tag.getElementsByTagName(typ):
 
967
                        annots = dict()
 
968
                        for name, prop in (self.
 
969
                                           _get_all_dbus_things(typ)):
 
970
                            if (name == tag.getAttribute("name")
 
971
                                and prop._dbus_interface
 
972
                                == if_tag.getAttribute("name")):
 
973
                                annots.update(getattr
 
974
                                              (prop,
 
975
                                               "_dbus_annotations",
 
976
                                               {}))
 
977
                        for name, value in annots.iteritems():
 
978
                            ann_tag = document.createElement(
 
979
                                "annotation")
 
980
                            ann_tag.setAttribute("name", name)
 
981
                            ann_tag.setAttribute("value", value)
 
982
                            tag.appendChild(ann_tag)
 
983
                # Add interface annotation tags
 
984
                for annotation, value in dict(
 
985
                    itertools.chain.from_iterable(
 
986
                        annotations().iteritems()
 
987
                        for name, annotations in
 
988
                        self._get_all_dbus_things("interface")
 
989
                        if name == if_tag.getAttribute("name")
 
990
                        )).iteritems():
 
991
                    ann_tag = document.createElement("annotation")
 
992
                    ann_tag.setAttribute("name", annotation)
 
993
                    ann_tag.setAttribute("value", value)
 
994
                    if_tag.appendChild(ann_tag)
689
995
                # Add the names to the return values for the
690
996
                # "org.freedesktop.DBus.Properties" methods
691
997
                if (if_tag.getAttribute("name")
704
1010
            xmlstring = document.toxml("utf-8")
705
1011
            document.unlink()
706
1012
        except (AttributeError, xml.dom.DOMException,
707
 
                xml.parsers.expat.ExpatError), error:
 
1013
                xml.parsers.expat.ExpatError) as error:
708
1014
            logger.error("Failed to override Introspection method",
709
 
                         error)
 
1015
                         exc_info=error)
710
1016
        return xmlstring
711
1017
 
712
1018
 
 
1019
def datetime_to_dbus (dt, variant_level=0):
 
1020
    """Convert a UTC datetime.datetime() to a D-Bus type."""
 
1021
    if dt is None:
 
1022
        return dbus.String("", variant_level = variant_level)
 
1023
    return dbus.String(dt.isoformat(),
 
1024
                       variant_level=variant_level)
 
1025
 
 
1026
 
 
1027
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
 
1028
    """A class decorator; applied to a subclass of
 
1029
    dbus.service.Object, it will add alternate D-Bus attributes with
 
1030
    interface names according to the "alt_interface_names" mapping.
 
1031
    Usage:
 
1032
    
 
1033
    @alternate_dbus_names({"org.example.Interface":
 
1034
                               "net.example.AlternateInterface"})
 
1035
    class SampleDBusObject(dbus.service.Object):
 
1036
        @dbus.service.method("org.example.Interface")
 
1037
        def SampleDBusMethod():
 
1038
            pass
 
1039
    
 
1040
    The above "SampleDBusMethod" on "SampleDBusObject" will be
 
1041
    reachable via two interfaces: "org.example.Interface" and
 
1042
    "net.example.AlternateInterface", the latter of which will have
 
1043
    its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
 
1044
    "true", unless "deprecate" is passed with a False value.
 
1045
    
 
1046
    This works for methods and signals, and also for D-Bus properties
 
1047
    (from DBusObjectWithProperties) and interfaces (from the
 
1048
    dbus_interface_annotations decorator).
 
1049
    """
 
1050
    def wrapper(cls):
 
1051
        for orig_interface_name, alt_interface_name in (
 
1052
            alt_interface_names.iteritems()):
 
1053
            attr = {}
 
1054
            interface_names = set()
 
1055
            # Go though all attributes of the class
 
1056
            for attrname, attribute in inspect.getmembers(cls):
 
1057
                # Ignore non-D-Bus attributes, and D-Bus attributes
 
1058
                # with the wrong interface name
 
1059
                if (not hasattr(attribute, "_dbus_interface")
 
1060
                    or not attribute._dbus_interface
 
1061
                    .startswith(orig_interface_name)):
 
1062
                    continue
 
1063
                # Create an alternate D-Bus interface name based on
 
1064
                # the current name
 
1065
                alt_interface = (attribute._dbus_interface
 
1066
                                 .replace(orig_interface_name,
 
1067
                                          alt_interface_name))
 
1068
                interface_names.add(alt_interface)
 
1069
                # Is this a D-Bus signal?
 
1070
                if getattr(attribute, "_dbus_is_signal", False):
 
1071
                    # Extract the original non-method function by
 
1072
                    # black magic
 
1073
                    nonmethod_func = (dict(
 
1074
                            zip(attribute.func_code.co_freevars,
 
1075
                                attribute.__closure__))["func"]
 
1076
                                      .cell_contents)
 
1077
                    # Create a new, but exactly alike, function
 
1078
                    # object, and decorate it to be a new D-Bus signal
 
1079
                    # with the alternate D-Bus interface name
 
1080
                    new_function = (dbus.service.signal
 
1081
                                    (alt_interface,
 
1082
                                     attribute._dbus_signature)
 
1083
                                    (types.FunctionType(
 
1084
                                nonmethod_func.func_code,
 
1085
                                nonmethod_func.func_globals,
 
1086
                                nonmethod_func.func_name,
 
1087
                                nonmethod_func.func_defaults,
 
1088
                                nonmethod_func.func_closure)))
 
1089
                    # Copy annotations, if any
 
1090
                    try:
 
1091
                        new_function._dbus_annotations = (
 
1092
                            dict(attribute._dbus_annotations))
 
1093
                    except AttributeError:
 
1094
                        pass
 
1095
                    # Define a creator of a function to call both the
 
1096
                    # original and alternate functions, so both the
 
1097
                    # original and alternate signals gets sent when
 
1098
                    # the function is called
 
1099
                    def fixscope(func1, func2):
 
1100
                        """This function is a scope container to pass
 
1101
                        func1 and func2 to the "call_both" function
 
1102
                        outside of its arguments"""
 
1103
                        def call_both(*args, **kwargs):
 
1104
                            """This function will emit two D-Bus
 
1105
                            signals by calling func1 and func2"""
 
1106
                            func1(*args, **kwargs)
 
1107
                            func2(*args, **kwargs)
 
1108
                        return call_both
 
1109
                    # Create the "call_both" function and add it to
 
1110
                    # the class
 
1111
                    attr[attrname] = fixscope(attribute, new_function)
 
1112
                # Is this a D-Bus method?
 
1113
                elif getattr(attribute, "_dbus_is_method", False):
 
1114
                    # Create a new, but exactly alike, function
 
1115
                    # object.  Decorate it to be a new D-Bus method
 
1116
                    # with the alternate D-Bus interface name.  Add it
 
1117
                    # to the class.
 
1118
                    attr[attrname] = (dbus.service.method
 
1119
                                      (alt_interface,
 
1120
                                       attribute._dbus_in_signature,
 
1121
                                       attribute._dbus_out_signature)
 
1122
                                      (types.FunctionType
 
1123
                                       (attribute.func_code,
 
1124
                                        attribute.func_globals,
 
1125
                                        attribute.func_name,
 
1126
                                        attribute.func_defaults,
 
1127
                                        attribute.func_closure)))
 
1128
                    # Copy annotations, if any
 
1129
                    try:
 
1130
                        attr[attrname]._dbus_annotations = (
 
1131
                            dict(attribute._dbus_annotations))
 
1132
                    except AttributeError:
 
1133
                        pass
 
1134
                # Is this a D-Bus property?
 
1135
                elif getattr(attribute, "_dbus_is_property", False):
 
1136
                    # Create a new, but exactly alike, function
 
1137
                    # object, and decorate it to be a new D-Bus
 
1138
                    # property with the alternate D-Bus interface
 
1139
                    # name.  Add it to the class.
 
1140
                    attr[attrname] = (dbus_service_property
 
1141
                                      (alt_interface,
 
1142
                                       attribute._dbus_signature,
 
1143
                                       attribute._dbus_access,
 
1144
                                       attribute
 
1145
                                       ._dbus_get_args_options
 
1146
                                       ["byte_arrays"])
 
1147
                                      (types.FunctionType
 
1148
                                       (attribute.func_code,
 
1149
                                        attribute.func_globals,
 
1150
                                        attribute.func_name,
 
1151
                                        attribute.func_defaults,
 
1152
                                        attribute.func_closure)))
 
1153
                    # Copy annotations, if any
 
1154
                    try:
 
1155
                        attr[attrname]._dbus_annotations = (
 
1156
                            dict(attribute._dbus_annotations))
 
1157
                    except AttributeError:
 
1158
                        pass
 
1159
                # Is this a D-Bus interface?
 
1160
                elif getattr(attribute, "_dbus_is_interface", False):
 
1161
                    # Create a new, but exactly alike, function
 
1162
                    # object.  Decorate it to be a new D-Bus interface
 
1163
                    # with the alternate D-Bus interface name.  Add it
 
1164
                    # to the class.
 
1165
                    attr[attrname] = (dbus_interface_annotations
 
1166
                                      (alt_interface)
 
1167
                                      (types.FunctionType
 
1168
                                       (attribute.func_code,
 
1169
                                        attribute.func_globals,
 
1170
                                        attribute.func_name,
 
1171
                                        attribute.func_defaults,
 
1172
                                        attribute.func_closure)))
 
1173
            if deprecate:
 
1174
                # Deprecate all alternate interfaces
 
1175
                iname="_AlternateDBusNames_interface_annotation{0}"
 
1176
                for interface_name in interface_names:
 
1177
                    @dbus_interface_annotations(interface_name)
 
1178
                    def func(self):
 
1179
                        return { "org.freedesktop.DBus.Deprecated":
 
1180
                                     "true" }
 
1181
                    # Find an unused name
 
1182
                    for aname in (iname.format(i)
 
1183
                                  for i in itertools.count()):
 
1184
                        if aname not in attr:
 
1185
                            attr[aname] = func
 
1186
                            break
 
1187
            if interface_names:
 
1188
                # Replace the class with a new subclass of it with
 
1189
                # methods, signals, etc. as created above.
 
1190
                cls = type(b"{0}Alternate".format(cls.__name__),
 
1191
                           (cls,), attr)
 
1192
        return cls
 
1193
    return wrapper
 
1194
 
 
1195
 
 
1196
@alternate_dbus_interfaces({"se.recompile.Mandos":
 
1197
                                "se.bsnet.fukt.Mandos"})
713
1198
class ClientDBus(Client, DBusObjectWithProperties):
714
1199
    """A Client class using D-Bus
715
1200
    
724
1209
    # dbus.service.Object doesn't use super(), so we can't either.
725
1210
    
726
1211
    def __init__(self, bus = None, *args, **kwargs):
727
 
        self._approvals_pending = 0
728
1212
        self.bus = bus
729
1213
        Client.__init__(self, *args, **kwargs)
730
1214
        # Only now, when this client is initialized, can it show up on
736
1220
                                 ("/clients/" + client_object_name))
737
1221
        DBusObjectWithProperties.__init__(self, self.bus,
738
1222
                                          self.dbus_object_path)
739
 
        
740
 
    def _get_approvals_pending(self):
741
 
        return self._approvals_pending
742
 
    def _set_approvals_pending(self, value):
743
 
        old_value = self._approvals_pending
744
 
        self._approvals_pending = value
745
 
        bval = bool(value)
746
 
        if (hasattr(self, "dbus_object_path")
747
 
            and bval is not bool(old_value)):
748
 
            dbus_bool = dbus.Boolean(bval, variant_level=1)
749
 
            self.PropertyChanged(dbus.String("ApprovalPending"),
750
 
                                 dbus_bool)
751
 
 
752
 
    approvals_pending = property(_get_approvals_pending,
753
 
                                 _set_approvals_pending)
754
 
    del _get_approvals_pending, _set_approvals_pending
755
 
    
756
 
    @staticmethod
757
 
    def _datetime_to_dbus(dt, variant_level=0):
758
 
        """Convert a UTC datetime.datetime() to a D-Bus type."""
759
 
        return dbus.String(dt.isoformat(),
760
 
                           variant_level=variant_level)
761
 
    
762
 
    def enable(self):
763
 
        oldstate = getattr(self, "enabled", False)
764
 
        r = Client.enable(self)
765
 
        if oldstate != self.enabled:
766
 
            # Emit D-Bus signals
767
 
            self.PropertyChanged(dbus.String("Enabled"),
768
 
                                 dbus.Boolean(True, variant_level=1))
769
 
            self.PropertyChanged(
770
 
                dbus.String("LastEnabled"),
771
 
                self._datetime_to_dbus(self.last_enabled,
772
 
                                       variant_level=1))
773
 
        return r
774
 
    
775
 
    def disable(self, quiet = False):
776
 
        oldstate = getattr(self, "enabled", False)
777
 
        r = Client.disable(self, quiet=quiet)
778
 
        if not quiet and oldstate != self.enabled:
779
 
            # Emit D-Bus signal
780
 
            self.PropertyChanged(dbus.String("Enabled"),
781
 
                                 dbus.Boolean(False, variant_level=1))
782
 
        return r
 
1223
    
 
1224
    def notifychangeproperty(transform_func,
 
1225
                             dbus_name, type_func=lambda x: x,
 
1226
                             variant_level=1):
 
1227
        """ Modify a variable so that it's a property which announces
 
1228
        its changes to DBus.
 
1229
        
 
1230
        transform_fun: Function that takes a value and a variant_level
 
1231
                       and transforms it to a D-Bus type.
 
1232
        dbus_name: D-Bus name of the variable
 
1233
        type_func: Function that transform the value before sending it
 
1234
                   to the D-Bus.  Default: no transform
 
1235
        variant_level: D-Bus variant level.  Default: 1
 
1236
        """
 
1237
        attrname = "_{0}".format(dbus_name)
 
1238
        def setter(self, value):
 
1239
            if hasattr(self, "dbus_object_path"):
 
1240
                if (not hasattr(self, attrname) or
 
1241
                    type_func(getattr(self, attrname, None))
 
1242
                    != type_func(value)):
 
1243
                    dbus_value = transform_func(type_func(value),
 
1244
                                                variant_level
 
1245
                                                =variant_level)
 
1246
                    self.PropertyChanged(dbus.String(dbus_name),
 
1247
                                         dbus_value)
 
1248
            setattr(self, attrname, value)
 
1249
        
 
1250
        return property(lambda self: getattr(self, attrname), setter)
 
1251
    
 
1252
    expires = notifychangeproperty(datetime_to_dbus, "Expires")
 
1253
    approvals_pending = notifychangeproperty(dbus.Boolean,
 
1254
                                             "ApprovalPending",
 
1255
                                             type_func = bool)
 
1256
    enabled = notifychangeproperty(dbus.Boolean, "Enabled")
 
1257
    last_enabled = notifychangeproperty(datetime_to_dbus,
 
1258
                                        "LastEnabled")
 
1259
    checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",
 
1260
                                   type_func = lambda checker:
 
1261
                                       checker is not None)
 
1262
    last_checked_ok = notifychangeproperty(datetime_to_dbus,
 
1263
                                           "LastCheckedOK")
 
1264
    last_checker_status = notifychangeproperty(dbus.Int16,
 
1265
                                               "LastCheckerStatus")
 
1266
    last_approval_request = notifychangeproperty(
 
1267
        datetime_to_dbus, "LastApprovalRequest")
 
1268
    approved_by_default = notifychangeproperty(dbus.Boolean,
 
1269
                                               "ApprovedByDefault")
 
1270
    approval_delay = notifychangeproperty(dbus.UInt64,
 
1271
                                          "ApprovalDelay",
 
1272
                                          type_func =
 
1273
                                          timedelta_to_milliseconds)
 
1274
    approval_duration = notifychangeproperty(
 
1275
        dbus.UInt64, "ApprovalDuration",
 
1276
        type_func = timedelta_to_milliseconds)
 
1277
    host = notifychangeproperty(dbus.String, "Host")
 
1278
    timeout = notifychangeproperty(dbus.UInt64, "Timeout",
 
1279
                                   type_func =
 
1280
                                   timedelta_to_milliseconds)
 
1281
    extended_timeout = notifychangeproperty(
 
1282
        dbus.UInt64, "ExtendedTimeout",
 
1283
        type_func = timedelta_to_milliseconds)
 
1284
    interval = notifychangeproperty(dbus.UInt64,
 
1285
                                    "Interval",
 
1286
                                    type_func =
 
1287
                                    timedelta_to_milliseconds)
 
1288
    checker_command = notifychangeproperty(dbus.String, "Checker")
 
1289
    
 
1290
    del notifychangeproperty
783
1291
    
784
1292
    def __del__(self, *args, **kwargs):
785
1293
        try:
794
1302
                         *args, **kwargs):
795
1303
        self.checker_callback_tag = None
796
1304
        self.checker = None
797
 
        # Emit D-Bus signal
798
 
        self.PropertyChanged(dbus.String("CheckerRunning"),
799
 
                             dbus.Boolean(False, variant_level=1))
800
1305
        if os.WIFEXITED(condition):
801
1306
            exitstatus = os.WEXITSTATUS(condition)
802
1307
            # Emit D-Bus signal
812
1317
        return Client.checker_callback(self, pid, condition, command,
813
1318
                                       *args, **kwargs)
814
1319
    
815
 
    def checked_ok(self, *args, **kwargs):
816
 
        r = Client.checked_ok(self, *args, **kwargs)
817
 
        # Emit D-Bus signal
818
 
        self.PropertyChanged(
819
 
            dbus.String("LastCheckedOK"),
820
 
            (self._datetime_to_dbus(self.last_checked_ok,
821
 
                                    variant_level=1)))
822
 
        return r
823
 
    
824
 
    def need_approval(self, *args, **kwargs):
825
 
        r = Client.need_approval(self, *args, **kwargs)
826
 
        # Emit D-Bus signal
827
 
        self.PropertyChanged(
828
 
            dbus.String("LastApprovalRequest"),
829
 
            (self._datetime_to_dbus(self.last_approval_request,
830
 
                                    variant_level=1)))
831
 
        return r
832
 
    
833
1320
    def start_checker(self, *args, **kwargs):
834
1321
        old_checker = self.checker
835
1322
        if self.checker is not None:
842
1329
            and old_checker_pid != self.checker.pid):
843
1330
            # Emit D-Bus signal
844
1331
            self.CheckerStarted(self.current_checker_command)
845
 
            self.PropertyChanged(
846
 
                dbus.String("CheckerRunning"),
847
 
                dbus.Boolean(True, variant_level=1))
848
1332
        return r
849
1333
    
850
 
    def stop_checker(self, *args, **kwargs):
851
 
        old_checker = getattr(self, "checker", None)
852
 
        r = Client.stop_checker(self, *args, **kwargs)
853
 
        if (old_checker is not None
854
 
            and getattr(self, "checker", None) is None):
855
 
            self.PropertyChanged(dbus.String("CheckerRunning"),
856
 
                                 dbus.Boolean(False, variant_level=1))
857
 
        return r
858
 
 
859
1334
    def _reset_approved(self):
860
 
        self._approved = None
 
1335
        self.approved = None
861
1336
        return False
862
1337
    
863
1338
    def approve(self, value=True):
864
 
        self.send_changedstate()
865
 
        self._approved = value
866
 
        gobject.timeout_add(self._timedelta_to_milliseconds
 
1339
        self.approved = value
 
1340
        gobject.timeout_add(timedelta_to_milliseconds
867
1341
                            (self.approval_duration),
868
1342
                            self._reset_approved)
869
 
    
 
1343
        self.send_changedstate()
870
1344
    
871
1345
    ## D-Bus methods, signals & properties
872
 
    _interface = "se.bsnet.fukt.Mandos.Client"
 
1346
    _interface = "se.recompile.Mandos.Client"
 
1347
    
 
1348
    ## Interfaces
 
1349
    
 
1350
    @dbus_interface_annotations(_interface)
 
1351
    def _foo(self):
 
1352
        return { "org.freedesktop.DBus.Property.EmitsChangedSignal":
 
1353
                     "false"}
873
1354
    
874
1355
    ## Signals
875
1356
    
922
1403
    # CheckedOK - method
923
1404
    @dbus.service.method(_interface)
924
1405
    def CheckedOK(self):
925
 
        return self.checked_ok()
 
1406
        self.checked_ok()
926
1407
    
927
1408
    # Enable - method
928
1409
    @dbus.service.method(_interface)
961
1442
        if value is None:       # get
962
1443
            return dbus.Boolean(self.approved_by_default)
963
1444
        self.approved_by_default = bool(value)
964
 
        # Emit D-Bus signal
965
 
        self.PropertyChanged(dbus.String("ApprovedByDefault"),
966
 
                             dbus.Boolean(value, variant_level=1))
967
1445
    
968
1446
    # ApprovalDelay - property
969
1447
    @dbus_service_property(_interface, signature="t",
972
1450
        if value is None:       # get
973
1451
            return dbus.UInt64(self.approval_delay_milliseconds())
974
1452
        self.approval_delay = datetime.timedelta(0, 0, 0, value)
975
 
        # Emit D-Bus signal
976
 
        self.PropertyChanged(dbus.String("ApprovalDelay"),
977
 
                             dbus.UInt64(value, variant_level=1))
978
1453
    
979
1454
    # ApprovalDuration - property
980
1455
    @dbus_service_property(_interface, signature="t",
981
1456
                           access="readwrite")
982
1457
    def ApprovalDuration_dbus_property(self, value=None):
983
1458
        if value is None:       # get
984
 
            return dbus.UInt64(self._timedelta_to_milliseconds(
 
1459
            return dbus.UInt64(timedelta_to_milliseconds(
985
1460
                    self.approval_duration))
986
1461
        self.approval_duration = datetime.timedelta(0, 0, 0, value)
987
 
        # Emit D-Bus signal
988
 
        self.PropertyChanged(dbus.String("ApprovalDuration"),
989
 
                             dbus.UInt64(value, variant_level=1))
990
1462
    
991
1463
    # Name - property
992
1464
    @dbus_service_property(_interface, signature="s", access="read")
1004
1476
    def Host_dbus_property(self, value=None):
1005
1477
        if value is None:       # get
1006
1478
            return dbus.String(self.host)
1007
 
        self.host = value
1008
 
        # Emit D-Bus signal
1009
 
        self.PropertyChanged(dbus.String("Host"),
1010
 
                             dbus.String(value, variant_level=1))
 
1479
        self.host = unicode(value)
1011
1480
    
1012
1481
    # Created - property
1013
1482
    @dbus_service_property(_interface, signature="s", access="read")
1014
1483
    def Created_dbus_property(self):
1015
 
        return dbus.String(self._datetime_to_dbus(self.created))
 
1484
        return datetime_to_dbus(self.created)
1016
1485
    
1017
1486
    # LastEnabled - property
1018
1487
    @dbus_service_property(_interface, signature="s", access="read")
1019
1488
    def LastEnabled_dbus_property(self):
1020
 
        if self.last_enabled is None:
1021
 
            return dbus.String("")
1022
 
        return dbus.String(self._datetime_to_dbus(self.last_enabled))
 
1489
        return datetime_to_dbus(self.last_enabled)
1023
1490
    
1024
1491
    # Enabled - property
1025
1492
    @dbus_service_property(_interface, signature="b",
1039
1506
        if value is not None:
1040
1507
            self.checked_ok()
1041
1508
            return
1042
 
        if self.last_checked_ok is None:
1043
 
            return dbus.String("")
1044
 
        return dbus.String(self._datetime_to_dbus(self
1045
 
                                                  .last_checked_ok))
 
1509
        return datetime_to_dbus(self.last_checked_ok)
 
1510
    
 
1511
    # LastCheckerStatus - property
 
1512
    @dbus_service_property(_interface, signature="n",
 
1513
                           access="read")
 
1514
    def LastCheckerStatus_dbus_property(self):
 
1515
        return dbus.Int16(self.last_checker_status)
 
1516
    
 
1517
    # Expires - property
 
1518
    @dbus_service_property(_interface, signature="s", access="read")
 
1519
    def Expires_dbus_property(self):
 
1520
        return datetime_to_dbus(self.expires)
1046
1521
    
1047
1522
    # LastApprovalRequest - property
1048
1523
    @dbus_service_property(_interface, signature="s", access="read")
1049
1524
    def LastApprovalRequest_dbus_property(self):
1050
 
        if self.last_approval_request is None:
1051
 
            return dbus.String("")
1052
 
        return dbus.String(self.
1053
 
                           _datetime_to_dbus(self
1054
 
                                             .last_approval_request))
 
1525
        return datetime_to_dbus(self.last_approval_request)
1055
1526
    
1056
1527
    # Timeout - property
1057
1528
    @dbus_service_property(_interface, signature="t",
1059
1530
    def Timeout_dbus_property(self, value=None):
1060
1531
        if value is None:       # get
1061
1532
            return dbus.UInt64(self.timeout_milliseconds())
 
1533
        old_timeout = self.timeout
1062
1534
        self.timeout = datetime.timedelta(0, 0, 0, value)
1063
 
        # Emit D-Bus signal
1064
 
        self.PropertyChanged(dbus.String("Timeout"),
1065
 
                             dbus.UInt64(value, variant_level=1))
1066
 
        if getattr(self, "disable_initiator_tag", None) is None:
1067
 
            return
1068
 
        # Reschedule timeout
1069
 
        gobject.source_remove(self.disable_initiator_tag)
1070
 
        self.disable_initiator_tag = None
1071
 
        time_to_die = (self.
1072
 
                       _timedelta_to_milliseconds((self
1073
 
                                                   .last_checked_ok
1074
 
                                                   + self.timeout)
1075
 
                                                  - datetime.datetime
1076
 
                                                  .utcnow()))
1077
 
        if time_to_die <= 0:
1078
 
            # The timeout has passed
1079
 
            self.disable()
1080
 
        else:
1081
 
            self.disable_initiator_tag = (gobject.timeout_add
1082
 
                                          (time_to_die, self.disable))
 
1535
        # Reschedule disabling
 
1536
        if self.enabled:
 
1537
            now = datetime.datetime.utcnow()
 
1538
            self.expires += self.timeout - old_timeout
 
1539
            if self.expires <= now:
 
1540
                # The timeout has passed
 
1541
                self.disable()
 
1542
            else:
 
1543
                if (getattr(self, "disable_initiator_tag", None)
 
1544
                    is None):
 
1545
                    return
 
1546
                gobject.source_remove(self.disable_initiator_tag)
 
1547
                self.disable_initiator_tag = (
 
1548
                    gobject.timeout_add(
 
1549
                        timedelta_to_milliseconds(self.expires - now),
 
1550
                        self.disable))
 
1551
    
 
1552
    # ExtendedTimeout - property
 
1553
    @dbus_service_property(_interface, signature="t",
 
1554
                           access="readwrite")
 
1555
    def ExtendedTimeout_dbus_property(self, value=None):
 
1556
        if value is None:       # get
 
1557
            return dbus.UInt64(self.extended_timeout_milliseconds())
 
1558
        self.extended_timeout = datetime.timedelta(0, 0, 0, value)
1083
1559
    
1084
1560
    # Interval - property
1085
1561
    @dbus_service_property(_interface, signature="t",
1088
1564
        if value is None:       # get
1089
1565
            return dbus.UInt64(self.interval_milliseconds())
1090
1566
        self.interval = datetime.timedelta(0, 0, 0, value)
1091
 
        # Emit D-Bus signal
1092
 
        self.PropertyChanged(dbus.String("Interval"),
1093
 
                             dbus.UInt64(value, variant_level=1))
1094
1567
        if getattr(self, "checker_initiator_tag", None) is None:
1095
1568
            return
1096
 
        # Reschedule checker run
1097
 
        gobject.source_remove(self.checker_initiator_tag)
1098
 
        self.checker_initiator_tag = (gobject.timeout_add
1099
 
                                      (value, self.start_checker))
1100
 
        self.start_checker()    # Start one now, too
1101
 
 
 
1569
        if self.enabled:
 
1570
            # Reschedule checker run
 
1571
            gobject.source_remove(self.checker_initiator_tag)
 
1572
            self.checker_initiator_tag = (gobject.timeout_add
 
1573
                                          (value, self.start_checker))
 
1574
            self.start_checker()    # Start one now, too
 
1575
    
1102
1576
    # Checker - property
1103
1577
    @dbus_service_property(_interface, signature="s",
1104
1578
                           access="readwrite")
1105
1579
    def Checker_dbus_property(self, value=None):
1106
1580
        if value is None:       # get
1107
1581
            return dbus.String(self.checker_command)
1108
 
        self.checker_command = value
1109
 
        # Emit D-Bus signal
1110
 
        self.PropertyChanged(dbus.String("Checker"),
1111
 
                             dbus.String(self.checker_command,
1112
 
                                         variant_level=1))
 
1582
        self.checker_command = unicode(value)
1113
1583
    
1114
1584
    # CheckerRunning - property
1115
1585
    @dbus_service_property(_interface, signature="b",
1142
1612
        self._pipe.send(('init', fpr, address))
1143
1613
        if not self._pipe.recv():
1144
1614
            raise KeyError()
1145
 
 
 
1615
    
1146
1616
    def __getattribute__(self, name):
1147
 
        if(name == '_pipe'):
 
1617
        if name == '_pipe':
1148
1618
            return super(ProxyClient, self).__getattribute__(name)
1149
1619
        self._pipe.send(('getattr', name))
1150
1620
        data = self._pipe.recv()
1155
1625
                self._pipe.send(('funcall', name, args, kwargs))
1156
1626
                return self._pipe.recv()[1]
1157
1627
            return func
1158
 
 
 
1628
    
1159
1629
    def __setattr__(self, name, value):
1160
 
        if(name == '_pipe'):
 
1630
        if name == '_pipe':
1161
1631
            return super(ProxyClient, self).__setattr__(name, value)
1162
1632
        self._pipe.send(('setattr', name, value))
1163
1633
 
1174
1644
                        unicode(self.client_address))
1175
1645
            logger.debug("Pipe FD: %d",
1176
1646
                         self.server.child_pipe.fileno())
1177
 
 
 
1647
            
1178
1648
            session = (gnutls.connection
1179
1649
                       .ClientSession(self.request,
1180
1650
                                      gnutls.connection
1181
1651
                                      .X509Credentials()))
1182
 
 
 
1652
            
1183
1653
            # Note: gnutls.connection.X509Credentials is really a
1184
1654
            # generic GnuTLS certificate credentials object so long as
1185
1655
            # no X.509 keys are added to it.  Therefore, we can use it
1186
1656
            # here despite using OpenPGP certificates.
1187
 
 
 
1657
            
1188
1658
            #priority = ':'.join(("NONE", "+VERS-TLS1.1",
1189
1659
            #                      "+AES-256-CBC", "+SHA1",
1190
1660
            #                      "+COMP-NULL", "+CTYPE-OPENPGP",
1196
1666
            (gnutls.library.functions
1197
1667
             .gnutls_priority_set_direct(session._c_object,
1198
1668
                                         priority, None))
1199
 
 
 
1669
            
1200
1670
            # Start communication using the Mandos protocol
1201
1671
            # Get protocol number
1202
1672
            line = self.request.makefile().readline()
1204
1674
            try:
1205
1675
                if int(line.strip().split()[0]) > 1:
1206
1676
                    raise RuntimeError
1207
 
            except (ValueError, IndexError, RuntimeError), error:
 
1677
            except (ValueError, IndexError, RuntimeError) as error:
1208
1678
                logger.error("Unknown protocol version: %s", error)
1209
1679
                return
1210
 
 
 
1680
            
1211
1681
            # Start GnuTLS connection
1212
1682
            try:
1213
1683
                session.handshake()
1214
 
            except gnutls.errors.GNUTLSError, error:
 
1684
            except gnutls.errors.GNUTLSError as error:
1215
1685
                logger.warning("Handshake failed: %s", error)
1216
1686
                # Do not run session.bye() here: the session is not
1217
1687
                # established.  Just abandon the request.
1218
1688
                return
1219
1689
            logger.debug("Handshake succeeded")
1220
 
 
 
1690
            
1221
1691
            approval_required = False
1222
1692
            try:
1223
1693
                try:
1224
1694
                    fpr = self.fingerprint(self.peer_certificate
1225
1695
                                           (session))
1226
 
                except (TypeError, gnutls.errors.GNUTLSError), error:
 
1696
                except (TypeError,
 
1697
                        gnutls.errors.GNUTLSError) as error:
1227
1698
                    logger.warning("Bad certificate: %s", error)
1228
1699
                    return
1229
1700
                logger.debug("Fingerprint: %s", fpr)
1230
 
 
 
1701
                
1231
1702
                try:
1232
1703
                    client = ProxyClient(child_pipe, fpr,
1233
1704
                                         self.client_address)
1241
1712
                
1242
1713
                while True:
1243
1714
                    if not client.enabled:
1244
 
                        logger.warning("Client %s is disabled",
 
1715
                        logger.info("Client %s is disabled",
1245
1716
                                       client.name)
1246
1717
                        if self.server.use_dbus:
1247
1718
                            # Emit D-Bus signal
1248
 
                            client.Rejected("Disabled")                    
 
1719
                            client.Rejected("Disabled")
1249
1720
                        return
1250
1721
                    
1251
 
                    if client._approved or not client.approval_delay:
 
1722
                    if client.approved or not client.approval_delay:
1252
1723
                        #We are approved or approval is disabled
1253
1724
                        break
1254
 
                    elif client._approved is None:
 
1725
                    elif client.approved is None:
1255
1726
                        logger.info("Client %s needs approval",
1256
1727
                                    client.name)
1257
1728
                        if self.server.use_dbus:
1268
1739
                        return
1269
1740
                    
1270
1741
                    #wait until timeout or approved
1271
 
                    #x = float(client._timedelta_to_milliseconds(delay))
1272
1742
                    time = datetime.datetime.now()
1273
1743
                    client.changedstate.acquire()
1274
 
                    client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))
 
1744
                    client.changedstate.wait(
 
1745
                        float(timedelta_to_milliseconds(delay)
 
1746
                              / 1000))
1275
1747
                    client.changedstate.release()
1276
1748
                    time2 = datetime.datetime.now()
1277
1749
                    if (time2 - time) >= delay:
1292
1764
                while sent_size < len(client.secret):
1293
1765
                    try:
1294
1766
                        sent = session.send(client.secret[sent_size:])
1295
 
                    except (gnutls.errors.GNUTLSError), error:
1296
 
                        logger.warning("gnutls send failed")
 
1767
                    except gnutls.errors.GNUTLSError as error:
 
1768
                        logger.warning("gnutls send failed",
 
1769
                                       exc_info=error)
1297
1770
                        return
1298
1771
                    logger.debug("Sent: %d, remaining: %d",
1299
1772
                                 sent, len(client.secret)
1300
1773
                                 - (sent_size + sent))
1301
1774
                    sent_size += sent
1302
 
 
 
1775
                
1303
1776
                logger.info("Sending secret to %s", client.name)
1304
 
                # bump the timeout as if seen
1305
 
                client.checked_ok()
 
1777
                # bump the timeout using extended_timeout
 
1778
                client.bump_timeout(client.extended_timeout)
1306
1779
                if self.server.use_dbus:
1307
1780
                    # Emit D-Bus signal
1308
1781
                    client.GotSecret()
1312
1785
                    client.approvals_pending -= 1
1313
1786
                try:
1314
1787
                    session.bye()
1315
 
                except (gnutls.errors.GNUTLSError), error:
1316
 
                    logger.warning("GnuTLS bye failed")
 
1788
                except gnutls.errors.GNUTLSError as error:
 
1789
                    logger.warning("GnuTLS bye failed",
 
1790
                                   exc_info=error)
1317
1791
    
1318
1792
    @staticmethod
1319
1793
    def peer_certificate(session):
1375
1849
        # Convert the buffer to a Python bytestring
1376
1850
        fpr = ctypes.string_at(buf, buf_len.value)
1377
1851
        # Convert the bytestring to hexadecimal notation
1378
 
        hex_fpr = ''.join("%02X" % ord(char) for char in fpr)
 
1852
        hex_fpr = binascii.hexlify(fpr).upper()
1379
1853
        return hex_fpr
1380
1854
 
1381
1855
 
1384
1858
    def sub_process_main(self, request, address):
1385
1859
        try:
1386
1860
            self.finish_request(request, address)
1387
 
        except:
 
1861
        except Exception:
1388
1862
            self.handle_error(request, address)
1389
1863
        self.close_request(request)
1390
 
            
 
1864
    
1391
1865
    def process_request(self, request, address):
1392
1866
        """Start a new process to process the request."""
1393
 
        multiprocessing.Process(target = self.sub_process_main,
1394
 
                                args = (request, address)).start()
 
1867
        proc = multiprocessing.Process(target = self.sub_process_main,
 
1868
                                       args = (request, address))
 
1869
        proc.start()
 
1870
        return proc
 
1871
 
1395
1872
 
1396
1873
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
1397
1874
    """ adds a pipe to the MixIn """
1401
1878
        This function creates a new pipe in self.pipe
1402
1879
        """
1403
1880
        parent_pipe, self.child_pipe = multiprocessing.Pipe()
1404
 
 
1405
 
        super(MultiprocessingMixInWithPipe,
1406
 
              self).process_request(request, client_address)
 
1881
        
 
1882
        proc = MultiprocessingMixIn.process_request(self, request,
 
1883
                                                    client_address)
1407
1884
        self.child_pipe.close()
1408
 
        self.add_pipe(parent_pipe)
1409
 
 
1410
 
    def add_pipe(self, parent_pipe):
 
1885
        self.add_pipe(parent_pipe, proc)
 
1886
    
 
1887
    def add_pipe(self, parent_pipe, proc):
1411
1888
        """Dummy function; override as necessary"""
1412
1889
        raise NotImplementedError
1413
1890
 
 
1891
 
1414
1892
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
1415
1893
                     socketserver.TCPServer, object):
1416
1894
    """IPv6-capable TCP server.  Accepts 'None' as address and/or port
1442
1920
                                           SO_BINDTODEVICE,
1443
1921
                                           str(self.interface
1444
1922
                                               + '\0'))
1445
 
                except socket.error, error:
1446
 
                    if error[0] == errno.EPERM:
 
1923
                except socket.error as error:
 
1924
                    if error.errno == errno.EPERM:
1447
1925
                        logger.error("No permission to"
1448
1926
                                     " bind to interface %s",
1449
1927
                                     self.interface)
1450
 
                    elif error[0] == errno.ENOPROTOOPT:
 
1928
                    elif error.errno == errno.ENOPROTOOPT:
1451
1929
                        logger.error("SO_BINDTODEVICE not available;"
1452
1930
                                     " cannot bind to interface %s",
1453
1931
                                     self.interface)
 
1932
                    elif error.errno == errno.ENODEV:
 
1933
                        logger.error("Interface %s does not"
 
1934
                                     " exist, cannot bind",
 
1935
                                     self.interface)
1454
1936
                    else:
1455
1937
                        raise
1456
1938
        # Only bind(2) the socket if we really need to.
1490
1972
        self.enabled = False
1491
1973
        self.clients = clients
1492
1974
        if self.clients is None:
1493
 
            self.clients = set()
 
1975
            self.clients = {}
1494
1976
        self.use_dbus = use_dbus
1495
1977
        self.gnutls_priority = gnutls_priority
1496
1978
        IPv6_TCPServer.__init__(self, server_address,
1500
1982
    def server_activate(self):
1501
1983
        if self.enabled:
1502
1984
            return socketserver.TCPServer.server_activate(self)
 
1985
    
1503
1986
    def enable(self):
1504
1987
        self.enabled = True
1505
 
    def add_pipe(self, parent_pipe):
 
1988
    
 
1989
    def add_pipe(self, parent_pipe, proc):
1506
1990
        # Call "handle_ipc" for both data and EOF events
1507
1991
        gobject.io_add_watch(parent_pipe.fileno(),
1508
1992
                             gobject.IO_IN | gobject.IO_HUP,
1509
1993
                             functools.partial(self.handle_ipc,
1510
 
                                               parent_pipe = parent_pipe))
1511
 
        
 
1994
                                               parent_pipe =
 
1995
                                               parent_pipe,
 
1996
                                               proc = proc))
 
1997
    
1512
1998
    def handle_ipc(self, source, condition, parent_pipe=None,
1513
 
                   client_object=None):
1514
 
        condition_names = {
1515
 
            gobject.IO_IN: "IN",   # There is data to read.
1516
 
            gobject.IO_OUT: "OUT", # Data can be written (without
1517
 
                                    # blocking).
1518
 
            gobject.IO_PRI: "PRI", # There is urgent data to read.
1519
 
            gobject.IO_ERR: "ERR", # Error condition.
1520
 
            gobject.IO_HUP: "HUP"  # Hung up (the connection has been
1521
 
                                    # broken, usually for pipes and
1522
 
                                    # sockets).
1523
 
            }
1524
 
        conditions_string = ' | '.join(name
1525
 
                                       for cond, name in
1526
 
                                       condition_names.iteritems()
1527
 
                                       if cond & condition)
1528
 
        # error or the other end of multiprocessing.Pipe has closed
1529
 
        if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):
 
1999
                   proc = None, client_object=None):
 
2000
        # error, or the other end of multiprocessing.Pipe has closed
 
2001
        if condition & (gobject.IO_ERR | gobject.IO_HUP):
 
2002
            # Wait for other process to exit
 
2003
            proc.join()
1530
2004
            return False
1531
2005
        
1532
2006
        # Read a request from the child
1537
2011
            fpr = request[1]
1538
2012
            address = request[2]
1539
2013
            
1540
 
            for c in self.clients:
 
2014
            for c in self.clients.itervalues():
1541
2015
                if c.fingerprint == fpr:
1542
2016
                    client = c
1543
2017
                    break
1544
2018
            else:
1545
 
                logger.warning("Client not found for fingerprint: %s, ad"
1546
 
                               "dress: %s", fpr, address)
 
2019
                logger.info("Client not found for fingerprint: %s, ad"
 
2020
                            "dress: %s", fpr, address)
1547
2021
                if self.use_dbus:
1548
2022
                    # Emit D-Bus signal
1549
 
                    mandos_dbus_service.ClientNotFound(fpr, address[0])
 
2023
                    mandos_dbus_service.ClientNotFound(fpr,
 
2024
                                                       address[0])
1550
2025
                parent_pipe.send(False)
1551
2026
                return False
1552
2027
            
1553
2028
            gobject.io_add_watch(parent_pipe.fileno(),
1554
2029
                                 gobject.IO_IN | gobject.IO_HUP,
1555
2030
                                 functools.partial(self.handle_ipc,
1556
 
                                                   parent_pipe = parent_pipe,
1557
 
                                                   client_object = client))
 
2031
                                                   parent_pipe =
 
2032
                                                   parent_pipe,
 
2033
                                                   proc = proc,
 
2034
                                                   client_object =
 
2035
                                                   client))
1558
2036
            parent_pipe.send(True)
1559
 
            # remove the old hook in favor of the new above hook on same fileno
 
2037
            # remove the old hook in favor of the new above hook on
 
2038
            # same fileno
1560
2039
            return False
1561
2040
        if command == 'funcall':
1562
2041
            funcname = request[1]
1563
2042
            args = request[2]
1564
2043
            kwargs = request[3]
1565
2044
            
1566
 
            parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))
1567
 
 
 
2045
            parent_pipe.send(('data', getattr(client_object,
 
2046
                                              funcname)(*args,
 
2047
                                                         **kwargs)))
 
2048
        
1568
2049
        if command == 'getattr':
1569
2050
            attrname = request[1]
1570
2051
            if callable(client_object.__getattribute__(attrname)):
1571
2052
                parent_pipe.send(('function',))
1572
2053
            else:
1573
 
                parent_pipe.send(('data', client_object.__getattribute__(attrname)))
 
2054
                parent_pipe.send(('data', client_object
 
2055
                                  .__getattribute__(attrname)))
1574
2056
        
1575
2057
        if command == 'setattr':
1576
2058
            attrname = request[1]
1577
2059
            value = request[2]
1578
2060
            setattr(client_object, attrname, value)
1579
 
 
 
2061
        
1580
2062
        return True
1581
2063
 
1582
2064
 
1612
2094
            elif suffix == "w":
1613
2095
                delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
1614
2096
            else:
1615
 
                raise ValueError("Unknown suffix %r" % suffix)
1616
 
        except (ValueError, IndexError), e:
 
2097
                raise ValueError("Unknown suffix {0!r}"
 
2098
                                 .format(suffix))
 
2099
        except (ValueError, IndexError) as e:
1617
2100
            raise ValueError(*(e.args))
1618
2101
        timevalue += delta
1619
2102
    return timevalue
1620
2103
 
1621
2104
 
1622
 
def if_nametoindex(interface):
1623
 
    """Call the C function if_nametoindex(), or equivalent
1624
 
    
1625
 
    Note: This function cannot accept a unicode string."""
1626
 
    global if_nametoindex
1627
 
    try:
1628
 
        if_nametoindex = (ctypes.cdll.LoadLibrary
1629
 
                          (ctypes.util.find_library("c"))
1630
 
                          .if_nametoindex)
1631
 
    except (OSError, AttributeError):
1632
 
        logger.warning("Doing if_nametoindex the hard way")
1633
 
        def if_nametoindex(interface):
1634
 
            "Get an interface index the hard way, i.e. using fcntl()"
1635
 
            SIOCGIFINDEX = 0x8933  # From /usr/include/linux/sockios.h
1636
 
            with contextlib.closing(socket.socket()) as s:
1637
 
                ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
1638
 
                                    struct.pack(str("16s16x"),
1639
 
                                                interface))
1640
 
            interface_index = struct.unpack(str("I"),
1641
 
                                            ifreq[16:20])[0]
1642
 
            return interface_index
1643
 
    return if_nametoindex(interface)
1644
 
 
1645
 
 
1646
2105
def daemon(nochdir = False, noclose = False):
1647
2106
    """See daemon(3).  Standard BSD Unix function.
1648
2107
    
1656
2115
        sys.exit()
1657
2116
    if not noclose:
1658
2117
        # Close all standard open file descriptors
1659
 
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
 
2118
        null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
1660
2119
        if not stat.S_ISCHR(os.fstat(null).st_mode):
1661
2120
            raise OSError(errno.ENODEV,
1662
 
                          "%s not a character device"
1663
 
                          % os.path.devnull)
 
2121
                          "{0} not a character device"
 
2122
                          .format(os.devnull))
1664
2123
        os.dup2(null, sys.stdin.fileno())
1665
2124
        os.dup2(null, sys.stdout.fileno())
1666
2125
        os.dup2(null, sys.stderr.fileno())
1675
2134
    
1676
2135
    parser = argparse.ArgumentParser()
1677
2136
    parser.add_argument("-v", "--version", action="version",
1678
 
                        version = "%%(prog)s %s" % version,
 
2137
                        version = "%(prog)s {0}".format(version),
1679
2138
                        help="show version number and exit")
1680
2139
    parser.add_argument("-i", "--interface", metavar="IF",
1681
2140
                        help="Bind to interface IF")
1703
2162
                        " system bus interface")
1704
2163
    parser.add_argument("--no-ipv6", action="store_false",
1705
2164
                        dest="use_ipv6", help="Do not use IPv6")
 
2165
    parser.add_argument("--no-restore", action="store_false",
 
2166
                        dest="restore", help="Do not restore stored"
 
2167
                        " state")
 
2168
    parser.add_argument("--statedir", metavar="DIR",
 
2169
                        help="Directory to save/restore state in")
 
2170
    
1706
2171
    options = parser.parse_args()
1707
2172
    
1708
2173
    if options.check:
1721
2186
                        "use_dbus": "True",
1722
2187
                        "use_ipv6": "True",
1723
2188
                        "debuglevel": "",
 
2189
                        "restore": "True",
 
2190
                        "statedir": "/var/lib/mandos"
1724
2191
                        }
1725
2192
    
1726
2193
    # Parse config file for server-global settings
1743
2210
    # options, if set.
1744
2211
    for option in ("interface", "address", "port", "debug",
1745
2212
                   "priority", "servicename", "configdir",
1746
 
                   "use_dbus", "use_ipv6", "debuglevel"):
 
2213
                   "use_dbus", "use_ipv6", "debuglevel", "restore",
 
2214
                   "statedir"):
1747
2215
        value = getattr(options, option)
1748
2216
        if value is not None:
1749
2217
            server_settings[option] = value
1761
2229
    debuglevel = server_settings["debuglevel"]
1762
2230
    use_dbus = server_settings["use_dbus"]
1763
2231
    use_ipv6 = server_settings["use_ipv6"]
1764
 
 
 
2232
    stored_state_path = os.path.join(server_settings["statedir"],
 
2233
                                     stored_state_file)
 
2234
    
 
2235
    if debug:
 
2236
        initlogger(debug, logging.DEBUG)
 
2237
    else:
 
2238
        if not debuglevel:
 
2239
            initlogger(debug)
 
2240
        else:
 
2241
            level = getattr(logging, debuglevel.upper())
 
2242
            initlogger(debug, level)
 
2243
    
1765
2244
    if server_settings["servicename"] != "Mandos":
1766
2245
        syslogger.setFormatter(logging.Formatter
1767
 
                               ('Mandos (%s) [%%(process)d]:'
1768
 
                                ' %%(levelname)s: %%(message)s'
1769
 
                                % server_settings["servicename"]))
 
2246
                               ('Mandos ({0}) [%(process)d]:'
 
2247
                                ' %(levelname)s: %(message)s'
 
2248
                                .format(server_settings
 
2249
                                        ["servicename"])))
1770
2250
    
1771
2251
    # Parse config file with clients
1772
 
    client_defaults = { "timeout": "1h",
1773
 
                        "interval": "5m",
1774
 
                        "checker": "fping -q -- %%(host)s",
1775
 
                        "host": "",
1776
 
                        "approval_delay": "0s",
1777
 
                        "approval_duration": "1s",
1778
 
                        }
1779
 
    client_config = configparser.SafeConfigParser(client_defaults)
 
2252
    client_config = configparser.SafeConfigParser(Client
 
2253
                                                  .client_defaults)
1780
2254
    client_config.read(os.path.join(server_settings["configdir"],
1781
2255
                                    "clients.conf"))
1782
2256
    
1796
2270
        pidfilename = "/var/run/mandos.pid"
1797
2271
        try:
1798
2272
            pidfile = open(pidfilename, "w")
1799
 
        except IOError:
1800
 
            logger.error("Could not open file %r", pidfilename)
 
2273
        except IOError as e:
 
2274
            logger.error("Could not open file %r", pidfilename,
 
2275
                         exc_info=e)
1801
2276
    
1802
 
    try:
1803
 
        uid = pwd.getpwnam("_mandos").pw_uid
1804
 
        gid = pwd.getpwnam("_mandos").pw_gid
1805
 
    except KeyError:
 
2277
    for name in ("_mandos", "mandos", "nobody"):
1806
2278
        try:
1807
 
            uid = pwd.getpwnam("mandos").pw_uid
1808
 
            gid = pwd.getpwnam("mandos").pw_gid
 
2279
            uid = pwd.getpwnam(name).pw_uid
 
2280
            gid = pwd.getpwnam(name).pw_gid
 
2281
            break
1809
2282
        except KeyError:
1810
 
            try:
1811
 
                uid = pwd.getpwnam("nobody").pw_uid
1812
 
                gid = pwd.getpwnam("nobody").pw_gid
1813
 
            except KeyError:
1814
 
                uid = 65534
1815
 
                gid = 65534
 
2283
            continue
 
2284
    else:
 
2285
        uid = 65534
 
2286
        gid = 65534
1816
2287
    try:
1817
2288
        os.setgid(gid)
1818
2289
        os.setuid(uid)
1819
 
    except OSError, error:
1820
 
        if error[0] != errno.EPERM:
 
2290
    except OSError as error:
 
2291
        if error.errno != errno.EPERM:
1821
2292
            raise error
1822
2293
    
1823
 
    if not debug and not debuglevel:
1824
 
        syslogger.setLevel(logging.WARNING)
1825
 
        console.setLevel(logging.WARNING)
1826
 
    if debuglevel:
1827
 
        level = getattr(logging, debuglevel.upper())
1828
 
        syslogger.setLevel(level)
1829
 
        console.setLevel(level)
1830
 
 
1831
2294
    if debug:
1832
2295
        # Enable all possible GnuTLS debugging
1833
2296
        
1843
2306
         .gnutls_global_set_log_function(debug_gnutls))
1844
2307
        
1845
2308
        # Redirect stdin so all checkers get /dev/null
1846
 
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
 
2309
        null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
1847
2310
        os.dup2(null, sys.stdin.fileno())
1848
2311
        if null > 2:
1849
2312
            os.close(null)
1850
 
    else:
1851
 
        # No console logging
1852
 
        logger.removeHandler(console)
1853
2313
    
1854
2314
    # Need to fork before connecting to D-Bus
1855
2315
    if not debug:
1856
2316
        # Close all input and output, do double fork, etc.
1857
2317
        daemon()
1858
2318
    
 
2319
    gobject.threads_init()
 
2320
    
1859
2321
    global main_loop
1860
2322
    # From the Avahi example code
1861
 
    DBusGMainLoop(set_as_default=True )
 
2323
    DBusGMainLoop(set_as_default=True)
1862
2324
    main_loop = gobject.MainLoop()
1863
2325
    bus = dbus.SystemBus()
1864
2326
    # End of Avahi example code
1865
2327
    if use_dbus:
1866
2328
        try:
1867
 
            bus_name = dbus.service.BusName("se.bsnet.fukt.Mandos",
 
2329
            bus_name = dbus.service.BusName("se.recompile.Mandos",
1868
2330
                                            bus, do_not_queue=True)
1869
 
        except dbus.exceptions.NameExistsException, e:
1870
 
            logger.error(unicode(e) + ", disabling D-Bus")
 
2331
            old_bus_name = (dbus.service.BusName
 
2332
                            ("se.bsnet.fukt.Mandos", bus,
 
2333
                             do_not_queue=True))
 
2334
        except dbus.exceptions.NameExistsException as e:
 
2335
            logger.error("Disabling D-Bus:", exc_info=e)
1871
2336
            use_dbus = False
1872
2337
            server_settings["use_dbus"] = False
1873
2338
            tcp_server.use_dbus = False
1874
2339
    protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
1875
 
    service = AvahiService(name = server_settings["servicename"],
1876
 
                           servicetype = "_mandos._tcp",
1877
 
                           protocol = protocol, bus = bus)
 
2340
    service = AvahiServiceToSyslog(name =
 
2341
                                   server_settings["servicename"],
 
2342
                                   servicetype = "_mandos._tcp",
 
2343
                                   protocol = protocol, bus = bus)
1878
2344
    if server_settings["interface"]:
1879
2345
        service.interface = (if_nametoindex
1880
2346
                             (str(server_settings["interface"])))
1885
2351
    client_class = Client
1886
2352
    if use_dbus:
1887
2353
        client_class = functools.partial(ClientDBus, bus = bus)
1888
 
    def client_config_items(config, section):
1889
 
        special_settings = {
1890
 
            "approved_by_default":
1891
 
                lambda: config.getboolean(section,
1892
 
                                          "approved_by_default"),
1893
 
            }
1894
 
        for name, value in config.items(section):
 
2354
    
 
2355
    client_settings = Client.config_parser(client_config)
 
2356
    old_client_settings = {}
 
2357
    clients_data = {}
 
2358
    
 
2359
    # Get client data and settings from last running state.
 
2360
    if server_settings["restore"]:
 
2361
        try:
 
2362
            with open(stored_state_path, "rb") as stored_state:
 
2363
                clients_data, old_client_settings = (pickle.load
 
2364
                                                     (stored_state))
 
2365
            os.remove(stored_state_path)
 
2366
        except IOError as e:
 
2367
            if e.errno == errno.ENOENT:
 
2368
                logger.warning("Could not load persistent state: {0}"
 
2369
                                .format(os.strerror(e.errno)))
 
2370
            else:
 
2371
                logger.critical("Could not load persistent state:",
 
2372
                                exc_info=e)
 
2373
                raise
 
2374
        except EOFError as e:
 
2375
            logger.warning("Could not load persistent state: "
 
2376
                           "EOFError:", exc_info=e)
 
2377
    
 
2378
    with PGPEngine() as pgp:
 
2379
        for client_name, client in clients_data.iteritems():
 
2380
            # Decide which value to use after restoring saved state.
 
2381
            # We have three different values: Old config file,
 
2382
            # new config file, and saved state.
 
2383
            # New config value takes precedence if it differs from old
 
2384
            # config value, otherwise use saved state.
 
2385
            for name, value in client_settings[client_name].items():
 
2386
                try:
 
2387
                    # For each value in new config, check if it
 
2388
                    # differs from the old config value (Except for
 
2389
                    # the "secret" attribute)
 
2390
                    if (name != "secret" and
 
2391
                        value != old_client_settings[client_name]
 
2392
                        [name]):
 
2393
                        client[name] = value
 
2394
                except KeyError:
 
2395
                    pass
 
2396
            
 
2397
            # Clients who has passed its expire date can still be
 
2398
            # enabled if its last checker was successful.  Clients
 
2399
            # whose checker succeeded before we stored its state is
 
2400
            # assumed to have successfully run all checkers during
 
2401
            # downtime.
 
2402
            if client["enabled"]:
 
2403
                if datetime.datetime.utcnow() >= client["expires"]:
 
2404
                    if not client["last_checked_ok"]:
 
2405
                        logger.warning(
 
2406
                            "disabling client {0} - Client never "
 
2407
                            "performed a successful checker"
 
2408
                            .format(client_name))
 
2409
                        client["enabled"] = False
 
2410
                    elif client["last_checker_status"] != 0:
 
2411
                        logger.warning(
 
2412
                            "disabling client {0} - Client "
 
2413
                            "last checker failed with error code {1}"
 
2414
                            .format(client_name,
 
2415
                                    client["last_checker_status"]))
 
2416
                        client["enabled"] = False
 
2417
                    else:
 
2418
                        client["expires"] = (datetime.datetime
 
2419
                                             .utcnow()
 
2420
                                             + client["timeout"])
 
2421
                        logger.debug("Last checker succeeded,"
 
2422
                                     " keeping {0} enabled"
 
2423
                                     .format(client_name))
1895
2424
            try:
1896
 
                yield (name, special_settings[name]())
1897
 
            except KeyError:
1898
 
                yield (name, value)
1899
 
    
1900
 
    tcp_server.clients.update(set(
1901
 
            client_class(name = section,
1902
 
                         config= dict(client_config_items(
1903
 
                        client_config, section)))
1904
 
            for section in client_config.sections()))
 
2425
                client["secret"] = (
 
2426
                    pgp.decrypt(client["encrypted_secret"],
 
2427
                                client_settings[client_name]
 
2428
                                ["secret"]))
 
2429
            except PGPError:
 
2430
                # If decryption fails, we use secret from new settings
 
2431
                logger.debug("Failed to decrypt {0} old secret"
 
2432
                             .format(client_name))
 
2433
                client["secret"] = (
 
2434
                    client_settings[client_name]["secret"])
 
2435
    
 
2436
    # Add/remove clients based on new changes made to config
 
2437
    for client_name in (set(old_client_settings)
 
2438
                        - set(client_settings)):
 
2439
        del clients_data[client_name]
 
2440
    for client_name in (set(client_settings)
 
2441
                        - set(old_client_settings)):
 
2442
        clients_data[client_name] = client_settings[client_name]
 
2443
    
 
2444
    # Create all client objects
 
2445
    for client_name, client in clients_data.iteritems():
 
2446
        tcp_server.clients[client_name] = client_class(
 
2447
            name = client_name, settings = client)
 
2448
    
1905
2449
    if not tcp_server.clients:
1906
2450
        logger.warning("No clients defined")
1907
 
        
 
2451
    
1908
2452
    if not debug:
1909
2453
        try:
1910
2454
            with pidfile:
1918
2462
            # "pidfile" was never created
1919
2463
            pass
1920
2464
        del pidfilename
1921
 
        
1922
 
        signal.signal(signal.SIGINT, signal.SIG_IGN)
1923
 
 
 
2465
    
1924
2466
    signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
1925
2467
    signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
1926
2468
    
1927
2469
    if use_dbus:
1928
 
        class MandosDBusService(dbus.service.Object):
 
2470
        @alternate_dbus_interfaces({"se.recompile.Mandos":
 
2471
                                        "se.bsnet.fukt.Mandos"})
 
2472
        class MandosDBusService(DBusObjectWithProperties):
1929
2473
            """A D-Bus proxy object"""
1930
2474
            def __init__(self):
1931
2475
                dbus.service.Object.__init__(self, bus, "/")
1932
 
            _interface = "se.bsnet.fukt.Mandos"
 
2476
            _interface = "se.recompile.Mandos"
 
2477
            
 
2478
            @dbus_interface_annotations(_interface)
 
2479
            def _foo(self):
 
2480
                return { "org.freedesktop.DBus.Property"
 
2481
                         ".EmitsChangedSignal":
 
2482
                             "false"}
1933
2483
            
1934
2484
            @dbus.service.signal(_interface, signature="o")
1935
2485
            def ClientAdded(self, objpath):
1950
2500
            def GetAllClients(self):
1951
2501
                "D-Bus method"
1952
2502
                return dbus.Array(c.dbus_object_path
1953
 
                                  for c in tcp_server.clients)
 
2503
                                  for c in
 
2504
                                  tcp_server.clients.itervalues())
1954
2505
            
1955
2506
            @dbus.service.method(_interface,
1956
2507
                                 out_signature="a{oa{sv}}")
1958
2509
                "D-Bus method"
1959
2510
                return dbus.Dictionary(
1960
2511
                    ((c.dbus_object_path, c.GetAll(""))
1961
 
                     for c in tcp_server.clients),
 
2512
                     for c in tcp_server.clients.itervalues()),
1962
2513
                    signature="oa{sv}")
1963
2514
            
1964
2515
            @dbus.service.method(_interface, in_signature="o")
1965
2516
            def RemoveClient(self, object_path):
1966
2517
                "D-Bus method"
1967
 
                for c in tcp_server.clients:
 
2518
                for c in tcp_server.clients.itervalues():
1968
2519
                    if c.dbus_object_path == object_path:
1969
 
                        tcp_server.clients.remove(c)
 
2520
                        del tcp_server.clients[c.name]
1970
2521
                        c.remove_from_connection()
1971
2522
                        # Don't signal anything except ClientRemoved
1972
2523
                        c.disable(quiet=True)
1983
2534
        "Cleanup function; run on exit"
1984
2535
        service.cleanup()
1985
2536
        
 
2537
        multiprocessing.active_children()
 
2538
        if not (tcp_server.clients or client_settings):
 
2539
            return
 
2540
        
 
2541
        # Store client before exiting. Secrets are encrypted with key
 
2542
        # based on what config file has. If config file is
 
2543
        # removed/edited, old secret will thus be unrecovable.
 
2544
        clients = {}
 
2545
        with PGPEngine() as pgp:
 
2546
            for client in tcp_server.clients.itervalues():
 
2547
                key = client_settings[client.name]["secret"]
 
2548
                client.encrypted_secret = pgp.encrypt(client.secret,
 
2549
                                                      key)
 
2550
                client_dict = {}
 
2551
                
 
2552
                # A list of attributes that can not be pickled
 
2553
                # + secret.
 
2554
                exclude = set(("bus", "changedstate", "secret",
 
2555
                               "checker"))
 
2556
                for name, typ in (inspect.getmembers
 
2557
                                  (dbus.service.Object)):
 
2558
                    exclude.add(name)
 
2559
                
 
2560
                client_dict["encrypted_secret"] = (client
 
2561
                                                   .encrypted_secret)
 
2562
                for attr in client.client_structure:
 
2563
                    if attr not in exclude:
 
2564
                        client_dict[attr] = getattr(client, attr)
 
2565
                
 
2566
                clients[client.name] = client_dict
 
2567
                del client_settings[client.name]["secret"]
 
2568
        
 
2569
        try:
 
2570
            with (tempfile.NamedTemporaryFile
 
2571
                  (mode='wb', suffix=".pickle", prefix='clients-',
 
2572
                   dir=os.path.dirname(stored_state_path),
 
2573
                   delete=False)) as stored_state:
 
2574
                pickle.dump((clients, client_settings), stored_state)
 
2575
                tempname=stored_state.name
 
2576
            os.rename(tempname, stored_state_path)
 
2577
        except (IOError, OSError) as e:
 
2578
            if not debug:
 
2579
                try:
 
2580
                    os.remove(tempname)
 
2581
                except NameError:
 
2582
                    pass
 
2583
            if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
 
2584
                logger.warning("Could not save persistent state: {0}"
 
2585
                               .format(os.strerror(e.errno)))
 
2586
            else:
 
2587
                logger.warning("Could not save persistent state:",
 
2588
                               exc_info=e)
 
2589
                raise e
 
2590
        
 
2591
        # Delete all clients, and settings from config
1986
2592
        while tcp_server.clients:
1987
 
            client = tcp_server.clients.pop()
 
2593
            name, client = tcp_server.clients.popitem()
1988
2594
            if use_dbus:
1989
2595
                client.remove_from_connection()
1990
 
            client.disable_hook = None
1991
2596
            # Don't signal anything except ClientRemoved
1992
2597
            client.disable(quiet=True)
1993
2598
            if use_dbus:
1994
2599
                # Emit D-Bus signal
1995
 
                mandos_dbus_service.ClientRemoved(client.dbus_object_path,
 
2600
                mandos_dbus_service.ClientRemoved(client
 
2601
                                                  .dbus_object_path,
1996
2602
                                                  client.name)
 
2603
        client_settings.clear()
1997
2604
    
1998
2605
    atexit.register(cleanup)
1999
2606
    
2000
 
    for client in tcp_server.clients:
 
2607
    for client in tcp_server.clients.itervalues():
2001
2608
        if use_dbus:
2002
2609
            # Emit D-Bus signal
2003
2610
            mandos_dbus_service.ClientAdded(client.dbus_object_path)
2004
 
        client.enable()
 
2611
        # Need to initiate checking of clients
 
2612
        if client.enabled:
 
2613
            client.init_checker()
2005
2614
    
2006
2615
    tcp_server.enable()
2007
2616
    tcp_server.server_activate()
2010
2619
    service.port = tcp_server.socket.getsockname()[1]
2011
2620
    if use_ipv6:
2012
2621
        logger.info("Now listening on address %r, port %d,"
2013
 
                    " flowinfo %d, scope_id %d"
2014
 
                    % tcp_server.socket.getsockname())
 
2622
                    " flowinfo %d, scope_id %d",
 
2623
                    *tcp_server.socket.getsockname())
2015
2624
    else:                       # IPv4
2016
 
        logger.info("Now listening on address %r, port %d"
2017
 
                    % tcp_server.socket.getsockname())
 
2625
        logger.info("Now listening on address %r, port %d",
 
2626
                    *tcp_server.socket.getsockname())
2018
2627
    
2019
2628
    #service.interface = tcp_server.socket.getsockname()[3]
2020
2629
    
2022
2631
        # From the Avahi example code
2023
2632
        try:
2024
2633
            service.activate()
2025
 
        except dbus.exceptions.DBusException, error:
2026
 
            logger.critical("DBusException: %s", error)
 
2634
        except dbus.exceptions.DBusException as error:
 
2635
            logger.critical("D-Bus Exception", exc_info=error)
2027
2636
            cleanup()
2028
2637
            sys.exit(1)
2029
2638
        # End of Avahi example code
2035
2644
        
2036
2645
        logger.debug("Starting main loop")
2037
2646
        main_loop.run()
2038
 
    except AvahiError, error:
2039
 
        logger.critical("AvahiError: %s", error)
 
2647
    except AvahiError as error:
 
2648
        logger.critical("Avahi Error", exc_info=error)
2040
2649
        cleanup()
2041
2650
        sys.exit(1)
2042
2651
    except KeyboardInterrupt: