/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos

  • Committer: Teddy Hogeborn
  • Date: 2012-05-26 22:56:38 UTC
  • mfrom: (589.1.1 socket-option)
  • Revision ID: teddy@recompile.se-20120526225638-4hvqyrvmj0036lfn
Merge "--socket" option for server.

This is suggested by the GNU Coding Standards' Table of Long Options,
and will probably also allow socket activation (e.g. by systemd(8)).

Show diffs side-by-side

added added

removed removed

Lines of Context:
11
11
# "AvahiService" class, and some lines in "main".
12
12
13
13
# Everything else is
14
 
# Copyright © 2008-2011 Teddy Hogeborn
15
 
# Copyright © 2008-2011 Björn Påhlsson
 
14
# Copyright © 2008-2012 Teddy Hogeborn
 
15
# Copyright © 2008-2012 Björn Påhlsson
16
16
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
34
34
from __future__ import (division, absolute_import, print_function,
35
35
                        unicode_literals)
36
36
 
 
37
from future_builtins import *
 
38
 
37
39
import SocketServer as socketserver
38
40
import socket
39
41
import argparse
65
67
import types
66
68
import binascii
67
69
import tempfile
 
70
import itertools
68
71
 
69
72
import dbus
70
73
import dbus.service
85
88
    except ImportError:
86
89
        SO_BINDTODEVICE = None
87
90
 
88
 
version = "1.4.1"
 
91
version = "1.5.4"
89
92
stored_state_file = "clients.pickle"
90
93
 
91
94
logger = logging.getLogger()
148
151
    def __enter__(self):
149
152
        return self
150
153
    
151
 
    def __exit__ (self, exc_type, exc_value, traceback):
 
154
    def __exit__(self, exc_type, exc_value, traceback):
152
155
        self._cleanup()
153
156
        return False
154
157
    
175
178
    
176
179
    def encrypt(self, data, password):
177
180
        self.gnupg.passphrase = self.password_encode(password)
178
 
        with open(os.devnull) as devnull:
 
181
        with open(os.devnull, "w") as devnull:
179
182
            try:
180
183
                proc = self.gnupg.run(['--symmetric'],
181
184
                                      create_fhs=['stdin', 'stdout'],
192
195
    
193
196
    def decrypt(self, data, password):
194
197
        self.gnupg.passphrase = self.password_encode(password)
195
 
        with open(os.devnull) as devnull:
 
198
        with open(os.devnull, "w") as devnull:
196
199
            try:
197
200
                proc = self.gnupg.run(['--decrypt'],
198
201
                                      create_fhs=['stdin', 'stdout'],
199
202
                                      attach_fhs={'stderr': devnull})
200
 
                with contextlib.closing(proc.handles['stdin'] ) as f:
 
203
                with contextlib.closing(proc.handles['stdin']) as f:
201
204
                    f.write(data)
202
205
                with contextlib.closing(proc.handles['stdout']) as f:
203
206
                    decrypted_plaintext = f.read()
208
211
        return decrypted_plaintext
209
212
 
210
213
 
211
 
 
212
214
class AvahiError(Exception):
213
215
    def __init__(self, value, *args, **kwargs):
214
216
        self.value = value
243
245
    server: D-Bus Server
244
246
    bus: dbus.SystemBus()
245
247
    """
 
248
    
246
249
    def __init__(self, interface = avahi.IF_UNSPEC, name = None,
247
250
                 servicetype = None, port = None, TXT = None,
248
251
                 domain = "", host = "", max_renames = 32768,
261
264
        self.server = None
262
265
        self.bus = bus
263
266
        self.entry_group_state_changed_match = None
 
267
    
264
268
    def rename(self):
265
269
        """Derived from the Avahi example code"""
266
270
        if self.rename_count >= self.max_renames:
276
280
        try:
277
281
            self.add()
278
282
        except dbus.exceptions.DBusException as error:
279
 
            logger.critical("DBusException: %s", error)
 
283
            logger.critical("D-Bus Exception", exc_info=error)
280
284
            self.cleanup()
281
285
            os._exit(1)
282
286
        self.rename_count += 1
 
287
    
283
288
    def remove(self):
284
289
        """Derived from the Avahi example code"""
285
290
        if self.entry_group_state_changed_match is not None:
287
292
            self.entry_group_state_changed_match = None
288
293
        if self.group is not None:
289
294
            self.group.Reset()
 
295
    
290
296
    def add(self):
291
297
        """Derived from the Avahi example code"""
292
298
        self.remove()
309
315
            dbus.UInt16(self.port),
310
316
            avahi.string_array_to_txt_array(self.TXT))
311
317
        self.group.Commit()
 
318
    
312
319
    def entry_group_state_changed(self, state, error):
313
320
        """Derived from the Avahi example code"""
314
321
        logger.debug("Avahi entry group state change: %i", state)
321
328
        elif state == avahi.ENTRY_GROUP_FAILURE:
322
329
            logger.critical("Avahi: Error in group state changed %s",
323
330
                            unicode(error))
324
 
            raise AvahiGroupError("State changed: %s"
325
 
                                  % unicode(error))
 
331
            raise AvahiGroupError("State changed: {0!s}"
 
332
                                  .format(error))
 
333
    
326
334
    def cleanup(self):
327
335
        """Derived from the Avahi example code"""
328
336
        if self.group is not None:
333
341
                pass
334
342
            self.group = None
335
343
        self.remove()
 
344
    
336
345
    def server_state_changed(self, state, error=None):
337
346
        """Derived from the Avahi example code"""
338
347
        logger.debug("Avahi server state change: %i", state)
357
366
                logger.debug("Unknown state: %r", state)
358
367
            else:
359
368
                logger.debug("Unknown state: %r: %r", state, error)
 
369
    
360
370
    def activate(self):
361
371
        """Derived from the Avahi example code"""
362
372
        if self.server is None:
369
379
                                 self.server_state_changed)
370
380
        self.server_state_changed(self.server.GetState())
371
381
 
 
382
 
372
383
class AvahiServiceToSyslog(AvahiService):
373
384
    def rename(self):
374
385
        """Add the new name to the syslog messages"""
375
386
        ret = AvahiService.rename(self)
376
387
        syslogger.setFormatter(logging.Formatter
377
 
                               ('Mandos (%s) [%%(process)d]:'
378
 
                                ' %%(levelname)s: %%(message)s'
379
 
                                % self.name))
 
388
                               ('Mandos ({0}) [%(process)d]:'
 
389
                                ' %(levelname)s: %(message)s'
 
390
                                .format(self.name)))
380
391
        return ret
381
392
 
 
393
 
382
394
def timedelta_to_milliseconds(td):
383
395
    "Convert a datetime.timedelta() to milliseconds"
384
396
    return ((td.days * 24 * 60 * 60 * 1000)
385
397
            + (td.seconds * 1000)
386
398
            + (td.microseconds // 1000))
387
 
        
 
399
 
 
400
 
388
401
class Client(object):
389
402
    """A representation of a client host served by this server.
390
403
    
415
428
    last_checked_ok: datetime.datetime(); (UTC) or None
416
429
    last_checker_status: integer between 0 and 255 reflecting exit
417
430
                         status of last checker. -1 reflects crashed
418
 
                         checker, or None.
 
431
                         checker, -2 means no checker completed yet.
419
432
    last_enabled: datetime.datetime(); (UTC) or None
420
433
    name:       string; from the config file, used in log messages and
421
434
                        D-Bus identifiers
422
435
    secret:     bytestring; sent verbatim (over TLS) to client
423
436
    timeout:    datetime.timedelta(); How long from last_checked_ok
424
437
                                      until this client is disabled
425
 
    extended_timeout:   extra long timeout when password has been sent
 
438
    extended_timeout:   extra long timeout when secret has been sent
426
439
    runtime_expansions: Allowed attributes for runtime expansion.
427
440
    expires:    datetime.datetime(); time (UTC) when a client will be
428
441
                disabled, or None
429
442
    """
430
443
    
431
444
    runtime_expansions = ("approval_delay", "approval_duration",
432
 
                          "created", "enabled", "fingerprint",
433
 
                          "host", "interval", "last_checked_ok",
 
445
                          "created", "enabled", "expires",
 
446
                          "fingerprint", "host", "interval",
 
447
                          "last_approval_request", "last_checked_ok",
434
448
                          "last_enabled", "name", "timeout")
435
449
    client_defaults = { "timeout": "5m",
436
450
                        "extended_timeout": "15m",
457
471
    
458
472
    def approval_delay_milliseconds(self):
459
473
        return timedelta_to_milliseconds(self.approval_delay)
460
 
 
 
474
    
461
475
    @staticmethod
462
476
    def config_parser(config):
463
 
        """ Construct a new dict of client settings of this form:
 
477
        """Construct a new dict of client settings of this form:
464
478
        { client_name: {setting_name: value, ...}, ...}
465
 
        with exceptions for any special settings as defined above"""
 
479
        with exceptions for any special settings as defined above.
 
480
        NOTE: Must be a pure function. Must return the same result
 
481
        value given the same arguments.
 
482
        """
466
483
        settings = {}
467
484
        for client_name in config.sections():
468
485
            section = dict(config.items(client_name))
472
489
            # Reformat values from string types to Python types
473
490
            client["approved_by_default"] = config.getboolean(
474
491
                client_name, "approved_by_default")
475
 
            client["enabled"] = config.getboolean(client_name, "enabled")
 
492
            client["enabled"] = config.getboolean(client_name,
 
493
                                                  "enabled")
476
494
            
477
495
            client["fingerprint"] = (section["fingerprint"].upper()
478
496
                                     .replace(" ", ""))
484
502
                          "rb") as secfile:
485
503
                    client["secret"] = secfile.read()
486
504
            else:
487
 
                raise TypeError("No secret or secfile for section %s"
488
 
                                % section)
 
505
                raise TypeError("No secret or secfile for section {0}"
 
506
                                .format(section))
489
507
            client["timeout"] = string_to_delta(section["timeout"])
490
508
            client["extended_timeout"] = string_to_delta(
491
509
                section["extended_timeout"])
497
515
            client["checker_command"] = section["checker"]
498
516
            client["last_approval_request"] = None
499
517
            client["last_checked_ok"] = None
500
 
            client["last_checker_status"] = None
501
 
            if client["enabled"]:
502
 
                client["last_enabled"] = datetime.datetime.utcnow()
503
 
                client["expires"] = (datetime.datetime.utcnow()
504
 
                                     + client["timeout"])
505
 
            else:
506
 
                client["last_enabled"] = None
507
 
                client["expires"] = None
508
 
 
 
518
            client["last_checker_status"] = -2
 
519
        
509
520
        return settings
510
 
        
511
 
        
 
521
    
512
522
    def __init__(self, settings, name = None):
513
 
        """Note: the 'checker' key in 'config' sets the
514
 
        'checker_command' attribute and *not* the 'checker'
515
 
        attribute."""
516
523
        self.name = name
517
524
        # adding all client settings
518
525
        for setting, value in settings.iteritems():
519
526
            setattr(self, setting, value)
520
527
        
 
528
        if self.enabled:
 
529
            if not hasattr(self, "last_enabled"):
 
530
                self.last_enabled = datetime.datetime.utcnow()
 
531
            if not hasattr(self, "expires"):
 
532
                self.expires = (datetime.datetime.utcnow()
 
533
                                + self.timeout)
 
534
        else:
 
535
            self.last_enabled = None
 
536
            self.expires = None
 
537
        
521
538
        logger.debug("Creating client %r", self.name)
522
539
        # Uppercase and remove spaces from fingerprint for later
523
540
        # comparison purposes with return value from the fingerprint()
524
541
        # function
525
542
        logger.debug("  Fingerprint: %s", self.fingerprint)
526
 
        self.created = settings.get("created", datetime.datetime.utcnow())
527
 
 
 
543
        self.created = settings.get("created",
 
544
                                    datetime.datetime.utcnow())
 
545
        
528
546
        # attributes specific for this server instance
529
547
        self.checker = None
530
548
        self.checker_initiator_tag = None
558
576
        if getattr(self, "enabled", False):
559
577
            # Already enabled
560
578
            return
561
 
        self.send_changedstate()
562
579
        self.expires = datetime.datetime.utcnow() + self.timeout
563
580
        self.enabled = True
564
581
        self.last_enabled = datetime.datetime.utcnow()
565
582
        self.init_checker()
 
583
        self.send_changedstate()
566
584
    
567
585
    def disable(self, quiet=True):
568
586
        """Disable this client."""
569
587
        if not getattr(self, "enabled", False):
570
588
            return False
571
589
        if not quiet:
572
 
            self.send_changedstate()
573
 
        if not quiet:
574
590
            logger.info("Disabling client %s", self.name)
575
 
        if getattr(self, "disable_initiator_tag", False):
 
591
        if getattr(self, "disable_initiator_tag", None) is not None:
576
592
            gobject.source_remove(self.disable_initiator_tag)
577
593
            self.disable_initiator_tag = None
578
594
        self.expires = None
579
 
        if getattr(self, "checker_initiator_tag", False):
 
595
        if getattr(self, "checker_initiator_tag", None) is not None:
580
596
            gobject.source_remove(self.checker_initiator_tag)
581
597
            self.checker_initiator_tag = None
582
598
        self.stop_checker()
583
599
        self.enabled = False
 
600
        if not quiet:
 
601
            self.send_changedstate()
584
602
        # Do not run this again if called by a gobject.timeout_add
585
603
        return False
586
604
    
590
608
    def init_checker(self):
591
609
        # Schedule a new checker to be started an 'interval' from now,
592
610
        # and every interval from then on.
 
611
        if self.checker_initiator_tag is not None:
 
612
            gobject.source_remove(self.checker_initiator_tag)
593
613
        self.checker_initiator_tag = (gobject.timeout_add
594
614
                                      (self.interval_milliseconds(),
595
615
                                       self.start_checker))
596
616
        # Schedule a disable() when 'timeout' has passed
 
617
        if self.disable_initiator_tag is not None:
 
618
            gobject.source_remove(self.disable_initiator_tag)
597
619
        self.disable_initiator_tag = (gobject.timeout_add
598
620
                                   (self.timeout_milliseconds(),
599
621
                                    self.disable))
618
640
            logger.warning("Checker for %(name)s crashed?",
619
641
                           vars(self))
620
642
    
621
 
    def checked_ok(self, timeout=None):
622
 
        """Bump up the timeout for this client.
623
 
        
624
 
        This should only be called when the client has been seen,
625
 
        alive and well.
626
 
        """
 
643
    def checked_ok(self):
 
644
        """Assert that the client has been seen, alive and well."""
 
645
        self.last_checked_ok = datetime.datetime.utcnow()
 
646
        self.last_checker_status = 0
 
647
        self.bump_timeout()
 
648
    
 
649
    def bump_timeout(self, timeout=None):
 
650
        """Bump up the timeout for this client."""
627
651
        if timeout is None:
628
652
            timeout = self.timeout
629
 
        self.last_checked_ok = datetime.datetime.utcnow()
630
653
        if self.disable_initiator_tag is not None:
631
654
            gobject.source_remove(self.disable_initiator_tag)
 
655
            self.disable_initiator_tag = None
632
656
        if getattr(self, "enabled", False):
633
657
            self.disable_initiator_tag = (gobject.timeout_add
634
658
                                          (timedelta_to_milliseconds
644
668
        If a checker already exists, leave it running and do
645
669
        nothing."""
646
670
        # The reason for not killing a running checker is that if we
647
 
        # did that, then if a checker (for some reason) started
648
 
        # running slowly and taking more than 'interval' time, the
649
 
        # client would inevitably timeout, since no checker would get
650
 
        # a chance to run to completion.  If we instead leave running
 
671
        # did that, and if a checker (for some reason) started running
 
672
        # slowly and taking more than 'interval' time, then the client
 
673
        # would inevitably timeout, since no checker would get a
 
674
        # chance to run to completion.  If we instead leave running
651
675
        # checkers alone, the checker would have to take more time
652
676
        # than 'timeout' for the client to be disabled, which is as it
653
677
        # should be.
667
691
                                      self.current_checker_command)
668
692
        # Start a new checker if needed
669
693
        if self.checker is None:
 
694
            # Escape attributes for the shell
 
695
            escaped_attrs = dict(
 
696
                (attr, re.escape(unicode(getattr(self, attr))))
 
697
                for attr in
 
698
                self.runtime_expansions)
670
699
            try:
671
 
                # In case checker_command has exactly one % operator
672
 
                command = self.checker_command % self.host
673
 
            except TypeError:
674
 
                # Escape attributes for the shell
675
 
                escaped_attrs = dict(
676
 
                    (attr,
677
 
                     re.escape(unicode(str(getattr(self, attr, "")),
678
 
                                       errors=
679
 
                                       'replace')))
680
 
                    for attr in
681
 
                    self.runtime_expansions)
682
 
                
683
 
                try:
684
 
                    command = self.checker_command % escaped_attrs
685
 
                except TypeError as error:
686
 
                    logger.error('Could not format string "%s":'
687
 
                                 ' %s', self.checker_command, error)
688
 
                    return True # Try again later
 
700
                command = self.checker_command % escaped_attrs
 
701
            except TypeError as error:
 
702
                logger.error('Could not format string "%s"',
 
703
                             self.checker_command, exc_info=error)
 
704
                return True # Try again later
689
705
            self.current_checker_command = command
690
706
            try:
691
707
                logger.info("Starting checker %r for %s",
697
713
                self.checker = subprocess.Popen(command,
698
714
                                                close_fds=True,
699
715
                                                shell=True, cwd="/")
700
 
                self.checker_callback_tag = (gobject.child_watch_add
701
 
                                             (self.checker.pid,
702
 
                                              self.checker_callback,
703
 
                                              data=command))
704
 
                # The checker may have completed before the gobject
705
 
                # watch was added.  Check for this.
706
 
                pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
707
 
                if pid:
708
 
                    gobject.source_remove(self.checker_callback_tag)
709
 
                    self.checker_callback(pid, status, command)
710
716
            except OSError as error:
711
 
                logger.error("Failed to start subprocess: %s",
712
 
                             error)
 
717
                logger.error("Failed to start subprocess",
 
718
                             exc_info=error)
 
719
            self.checker_callback_tag = (gobject.child_watch_add
 
720
                                         (self.checker.pid,
 
721
                                          self.checker_callback,
 
722
                                          data=command))
 
723
            # The checker may have completed before the gobject
 
724
            # watch was added.  Check for this.
 
725
            pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
 
726
            if pid:
 
727
                gobject.source_remove(self.checker_callback_tag)
 
728
                self.checker_callback(pid, status, command)
713
729
        # Re-run this periodically if run by gobject.timeout_add
714
730
        return True
715
731
    
722
738
            return
723
739
        logger.debug("Stopping checker for %(name)s", vars(self))
724
740
        try:
725
 
            os.kill(self.checker.pid, signal.SIGTERM)
 
741
            self.checker.terminate()
726
742
            #time.sleep(0.5)
727
743
            #if self.checker.poll() is None:
728
 
            #    os.kill(self.checker.pid, signal.SIGKILL)
 
744
            #    self.checker.kill()
729
745
        except OSError as error:
730
746
            if error.errno != errno.ESRCH: # No such process
731
747
                raise
748
764
    # "Set" method, so we fail early here:
749
765
    if byte_arrays and signature != "ay":
750
766
        raise ValueError("Byte arrays not supported for non-'ay'"
751
 
                         " signature %r" % signature)
 
767
                         " signature {0!r}".format(signature))
752
768
    def decorator(func):
753
769
        func._dbus_is_property = True
754
770
        func._dbus_interface = dbus_interface
762
778
    return decorator
763
779
 
764
780
 
 
781
def dbus_interface_annotations(dbus_interface):
 
782
    """Decorator for marking functions returning interface annotations
 
783
    
 
784
    Usage:
 
785
    
 
786
    @dbus_interface_annotations("org.example.Interface")
 
787
    def _foo(self):  # Function name does not matter
 
788
        return {"org.freedesktop.DBus.Deprecated": "true",
 
789
                "org.freedesktop.DBus.Property.EmitsChangedSignal":
 
790
                    "false"}
 
791
    """
 
792
    def decorator(func):
 
793
        func._dbus_is_interface = True
 
794
        func._dbus_interface = dbus_interface
 
795
        func._dbus_name = dbus_interface
 
796
        return func
 
797
    return decorator
 
798
 
 
799
 
 
800
def dbus_annotations(annotations):
 
801
    """Decorator to annotate D-Bus methods, signals or properties
 
802
    Usage:
 
803
    
 
804
    @dbus_service_property("org.example.Interface", signature="b",
 
805
                           access="r")
 
806
    @dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",
 
807
                        "org.freedesktop.DBus.Property."
 
808
                        "EmitsChangedSignal": "false"})
 
809
    def Property_dbus_property(self):
 
810
        return dbus.Boolean(False)
 
811
    """
 
812
    def decorator(func):
 
813
        func._dbus_annotations = annotations
 
814
        return func
 
815
    return decorator
 
816
 
 
817
 
765
818
class DBusPropertyException(dbus.exceptions.DBusException):
766
819
    """A base class for D-Bus property-related exceptions
767
820
    """
790
843
    """
791
844
    
792
845
    @staticmethod
793
 
    def _is_dbus_property(obj):
794
 
        return getattr(obj, "_dbus_is_property", False)
 
846
    def _is_dbus_thing(thing):
 
847
        """Returns a function testing if an attribute is a D-Bus thing
 
848
        
 
849
        If called like _is_dbus_thing("method") it returns a function
 
850
        suitable for use as predicate to inspect.getmembers().
 
851
        """
 
852
        return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),
 
853
                                   False)
795
854
    
796
 
    def _get_all_dbus_properties(self):
 
855
    def _get_all_dbus_things(self, thing):
797
856
        """Returns a generator of (name, attribute) pairs
798
857
        """
799
 
        return ((prop.__get__(self)._dbus_name, prop.__get__(self))
 
858
        return ((getattr(athing.__get__(self), "_dbus_name",
 
859
                         name),
 
860
                 athing.__get__(self))
800
861
                for cls in self.__class__.__mro__
801
 
                for name, prop in
802
 
                inspect.getmembers(cls, self._is_dbus_property))
 
862
                for name, athing in
 
863
                inspect.getmembers(cls,
 
864
                                   self._is_dbus_thing(thing)))
803
865
    
804
866
    def _get_dbus_property(self, interface_name, property_name):
805
867
        """Returns a bound method if one exists which is a D-Bus
807
869
        """
808
870
        for cls in  self.__class__.__mro__:
809
871
            for name, value in (inspect.getmembers
810
 
                                (cls, self._is_dbus_property)):
 
872
                                (cls,
 
873
                                 self._is_dbus_thing("property"))):
811
874
                if (value._dbus_name == property_name
812
875
                    and value._dbus_interface == interface_name):
813
876
                    return value.__get__(self)
842
905
            # signatures other than "ay".
843
906
            if prop._dbus_signature != "ay":
844
907
                raise ValueError
845
 
            value = dbus.ByteArray(''.join(unichr(byte)
846
 
                                           for byte in value))
 
908
            value = dbus.ByteArray(b''.join(chr(byte)
 
909
                                            for byte in value))
847
910
        prop(value)
848
911
    
849
912
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
855
918
        Note: Will not include properties with access="write".
856
919
        """
857
920
        properties = {}
858
 
        for name, prop in self._get_all_dbus_properties():
 
921
        for name, prop in self._get_all_dbus_things("property"):
859
922
            if (interface_name
860
923
                and interface_name != prop._dbus_interface):
861
924
                # Interface non-empty but did not match
876
939
                         path_keyword='object_path',
877
940
                         connection_keyword='connection')
878
941
    def Introspect(self, object_path, connection):
879
 
        """Standard D-Bus method, overloaded to insert property tags.
 
942
        """Overloading of standard D-Bus method.
 
943
        
 
944
        Inserts property tags and interface annotation tags.
880
945
        """
881
946
        xmlstring = dbus.service.Object.Introspect(self, object_path,
882
947
                                                   connection)
889
954
                e.setAttribute("access", prop._dbus_access)
890
955
                return e
891
956
            for if_tag in document.getElementsByTagName("interface"):
 
957
                # Add property tags
892
958
                for tag in (make_tag(document, name, prop)
893
959
                            for name, prop
894
 
                            in self._get_all_dbus_properties()
 
960
                            in self._get_all_dbus_things("property")
895
961
                            if prop._dbus_interface
896
962
                            == if_tag.getAttribute("name")):
897
963
                    if_tag.appendChild(tag)
 
964
                # Add annotation tags
 
965
                for typ in ("method", "signal", "property"):
 
966
                    for tag in if_tag.getElementsByTagName(typ):
 
967
                        annots = dict()
 
968
                        for name, prop in (self.
 
969
                                           _get_all_dbus_things(typ)):
 
970
                            if (name == tag.getAttribute("name")
 
971
                                and prop._dbus_interface
 
972
                                == if_tag.getAttribute("name")):
 
973
                                annots.update(getattr
 
974
                                              (prop,
 
975
                                               "_dbus_annotations",
 
976
                                               {}))
 
977
                        for name, value in annots.iteritems():
 
978
                            ann_tag = document.createElement(
 
979
                                "annotation")
 
980
                            ann_tag.setAttribute("name", name)
 
981
                            ann_tag.setAttribute("value", value)
 
982
                            tag.appendChild(ann_tag)
 
983
                # Add interface annotation tags
 
984
                for annotation, value in dict(
 
985
                    itertools.chain.from_iterable(
 
986
                        annotations().iteritems()
 
987
                        for name, annotations in
 
988
                        self._get_all_dbus_things("interface")
 
989
                        if name == if_tag.getAttribute("name")
 
990
                        )).iteritems():
 
991
                    ann_tag = document.createElement("annotation")
 
992
                    ann_tag.setAttribute("name", annotation)
 
993
                    ann_tag.setAttribute("value", value)
 
994
                    if_tag.appendChild(ann_tag)
898
995
                # Add the names to the return values for the
899
996
                # "org.freedesktop.DBus.Properties" methods
900
997
                if (if_tag.getAttribute("name")
915
1012
        except (AttributeError, xml.dom.DOMException,
916
1013
                xml.parsers.expat.ExpatError) as error:
917
1014
            logger.error("Failed to override Introspection method",
918
 
                         error)
 
1015
                         exc_info=error)
919
1016
        return xmlstring
920
1017
 
921
1018
 
922
 
def datetime_to_dbus (dt, variant_level=0):
 
1019
def datetime_to_dbus(dt, variant_level=0):
923
1020
    """Convert a UTC datetime.datetime() to a D-Bus type."""
924
1021
    if dt is None:
925
1022
        return dbus.String("", variant_level = variant_level)
927
1024
                       variant_level=variant_level)
928
1025
 
929
1026
 
930
 
class AlternateDBusNamesMetaclass(DBusObjectWithProperties
931
 
                                  .__metaclass__):
932
 
    """Applied to an empty subclass of a D-Bus object, this metaclass
933
 
    will add additional D-Bus attributes matching a certain pattern.
 
1027
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
 
1028
    """A class decorator; applied to a subclass of
 
1029
    dbus.service.Object, it will add alternate D-Bus attributes with
 
1030
    interface names according to the "alt_interface_names" mapping.
 
1031
    Usage:
 
1032
    
 
1033
    @alternate_dbus_interfaces({"org.example.Interface":
 
1034
                                    "net.example.AlternateInterface"})
 
1035
    class SampleDBusObject(dbus.service.Object):
 
1036
        @dbus.service.method("org.example.Interface")
 
1037
        def SampleDBusMethod():
 
1038
            pass
 
1039
    
 
1040
    The above "SampleDBusMethod" on "SampleDBusObject" will be
 
1041
    reachable via two interfaces: "org.example.Interface" and
 
1042
    "net.example.AlternateInterface", the latter of which will have
 
1043
    its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
 
1044
    "true", unless "deprecate" is passed with a False value.
 
1045
    
 
1046
    This works for methods and signals, and also for D-Bus properties
 
1047
    (from DBusObjectWithProperties) and interfaces (from the
 
1048
    dbus_interface_annotations decorator).
934
1049
    """
935
 
    def __new__(mcs, name, bases, attr):
936
 
        # Go through all the base classes which could have D-Bus
937
 
        # methods, signals, or properties in them
938
 
        for base in (b for b in bases
939
 
                     if issubclass(b, dbus.service.Object)):
940
 
            # Go though all attributes of the base class
941
 
            for attrname, attribute in inspect.getmembers(base):
 
1050
    def wrapper(cls):
 
1051
        for orig_interface_name, alt_interface_name in (
 
1052
            alt_interface_names.iteritems()):
 
1053
            attr = {}
 
1054
            interface_names = set()
 
1055
            # Go though all attributes of the class
 
1056
            for attrname, attribute in inspect.getmembers(cls):
942
1057
                # Ignore non-D-Bus attributes, and D-Bus attributes
943
1058
                # with the wrong interface name
944
1059
                if (not hasattr(attribute, "_dbus_interface")
945
1060
                    or not attribute._dbus_interface
946
 
                    .startswith("se.recompile.Mandos")):
 
1061
                    .startswith(orig_interface_name)):
947
1062
                    continue
948
1063
                # Create an alternate D-Bus interface name based on
949
1064
                # the current name
950
1065
                alt_interface = (attribute._dbus_interface
951
 
                                 .replace("se.recompile.Mandos",
952
 
                                          "se.bsnet.fukt.Mandos"))
 
1066
                                 .replace(orig_interface_name,
 
1067
                                          alt_interface_name))
 
1068
                interface_names.add(alt_interface)
953
1069
                # Is this a D-Bus signal?
954
1070
                if getattr(attribute, "_dbus_is_signal", False):
955
1071
                    # Extract the original non-method function by
970
1086
                                nonmethod_func.func_name,
971
1087
                                nonmethod_func.func_defaults,
972
1088
                                nonmethod_func.func_closure)))
 
1089
                    # Copy annotations, if any
 
1090
                    try:
 
1091
                        new_function._dbus_annotations = (
 
1092
                            dict(attribute._dbus_annotations))
 
1093
                    except AttributeError:
 
1094
                        pass
973
1095
                    # Define a creator of a function to call both the
974
 
                    # old and new functions, so both the old and new
975
 
                    # signals gets sent when the function is called
 
1096
                    # original and alternate functions, so both the
 
1097
                    # original and alternate signals gets sent when
 
1098
                    # the function is called
976
1099
                    def fixscope(func1, func2):
977
1100
                        """This function is a scope container to pass
978
1101
                        func1 and func2 to the "call_both" function
985
1108
                        return call_both
986
1109
                    # Create the "call_both" function and add it to
987
1110
                    # the class
988
 
                    attr[attrname] = fixscope(attribute,
989
 
                                              new_function)
 
1111
                    attr[attrname] = fixscope(attribute, new_function)
990
1112
                # Is this a D-Bus method?
991
1113
                elif getattr(attribute, "_dbus_is_method", False):
992
1114
                    # Create a new, but exactly alike, function
1003
1125
                                        attribute.func_name,
1004
1126
                                        attribute.func_defaults,
1005
1127
                                        attribute.func_closure)))
 
1128
                    # Copy annotations, if any
 
1129
                    try:
 
1130
                        attr[attrname]._dbus_annotations = (
 
1131
                            dict(attribute._dbus_annotations))
 
1132
                    except AttributeError:
 
1133
                        pass
1006
1134
                # Is this a D-Bus property?
1007
1135
                elif getattr(attribute, "_dbus_is_property", False):
1008
1136
                    # Create a new, but exactly alike, function
1022
1150
                                        attribute.func_name,
1023
1151
                                        attribute.func_defaults,
1024
1152
                                        attribute.func_closure)))
1025
 
        return type.__new__(mcs, name, bases, attr)
1026
 
 
1027
 
 
 
1153
                    # Copy annotations, if any
 
1154
                    try:
 
1155
                        attr[attrname]._dbus_annotations = (
 
1156
                            dict(attribute._dbus_annotations))
 
1157
                    except AttributeError:
 
1158
                        pass
 
1159
                # Is this a D-Bus interface?
 
1160
                elif getattr(attribute, "_dbus_is_interface", False):
 
1161
                    # Create a new, but exactly alike, function
 
1162
                    # object.  Decorate it to be a new D-Bus interface
 
1163
                    # with the alternate D-Bus interface name.  Add it
 
1164
                    # to the class.
 
1165
                    attr[attrname] = (dbus_interface_annotations
 
1166
                                      (alt_interface)
 
1167
                                      (types.FunctionType
 
1168
                                       (attribute.func_code,
 
1169
                                        attribute.func_globals,
 
1170
                                        attribute.func_name,
 
1171
                                        attribute.func_defaults,
 
1172
                                        attribute.func_closure)))
 
1173
            if deprecate:
 
1174
                # Deprecate all alternate interfaces
 
1175
                iname="_AlternateDBusNames_interface_annotation{0}"
 
1176
                for interface_name in interface_names:
 
1177
                    @dbus_interface_annotations(interface_name)
 
1178
                    def func(self):
 
1179
                        return { "org.freedesktop.DBus.Deprecated":
 
1180
                                     "true" }
 
1181
                    # Find an unused name
 
1182
                    for aname in (iname.format(i)
 
1183
                                  for i in itertools.count()):
 
1184
                        if aname not in attr:
 
1185
                            attr[aname] = func
 
1186
                            break
 
1187
            if interface_names:
 
1188
                # Replace the class with a new subclass of it with
 
1189
                # methods, signals, etc. as created above.
 
1190
                cls = type(b"{0}Alternate".format(cls.__name__),
 
1191
                           (cls,), attr)
 
1192
        return cls
 
1193
    return wrapper
 
1194
 
 
1195
 
 
1196
@alternate_dbus_interfaces({"se.recompile.Mandos":
 
1197
                                "se.bsnet.fukt.Mandos"})
1028
1198
class ClientDBus(Client, DBusObjectWithProperties):
1029
1199
    """A Client class using D-Bus
1030
1200
    
1041
1211
    def __init__(self, bus = None, *args, **kwargs):
1042
1212
        self.bus = bus
1043
1213
        Client.__init__(self, *args, **kwargs)
1044
 
        self._approvals_pending = 0
1045
 
        
1046
 
        self._approvals_pending = 0
1047
1214
        # Only now, when this client is initialized, can it show up on
1048
1215
        # the D-Bus
1049
1216
        client_object_name = unicode(self.name).translate(
1053
1220
                                 ("/clients/" + client_object_name))
1054
1221
        DBusObjectWithProperties.__init__(self, self.bus,
1055
1222
                                          self.dbus_object_path)
1056
 
        
 
1223
    
1057
1224
    def notifychangeproperty(transform_func,
1058
1225
                             dbus_name, type_func=lambda x: x,
1059
1226
                             variant_level=1):
1082
1249
        
1083
1250
        return property(lambda self: getattr(self, attrname), setter)
1084
1251
    
1085
 
    
1086
1252
    expires = notifychangeproperty(datetime_to_dbus, "Expires")
1087
1253
    approvals_pending = notifychangeproperty(dbus.Boolean,
1088
1254
                                             "ApprovalPending",
1095
1261
                                       checker is not None)
1096
1262
    last_checked_ok = notifychangeproperty(datetime_to_dbus,
1097
1263
                                           "LastCheckedOK")
 
1264
    last_checker_status = notifychangeproperty(dbus.Int16,
 
1265
                                               "LastCheckerStatus")
1098
1266
    last_approval_request = notifychangeproperty(
1099
1267
        datetime_to_dbus, "LastApprovalRequest")
1100
1268
    approved_by_default = notifychangeproperty(dbus.Boolean,
1168
1336
        return False
1169
1337
    
1170
1338
    def approve(self, value=True):
1171
 
        self.send_changedstate()
1172
1339
        self.approved = value
1173
1340
        gobject.timeout_add(timedelta_to_milliseconds
1174
1341
                            (self.approval_duration),
1175
1342
                            self._reset_approved)
1176
 
    
 
1343
        self.send_changedstate()
1177
1344
    
1178
1345
    ## D-Bus methods, signals & properties
1179
1346
    _interface = "se.recompile.Mandos.Client"
1180
1347
    
 
1348
    ## Interfaces
 
1349
    
 
1350
    @dbus_interface_annotations(_interface)
 
1351
    def _foo(self):
 
1352
        return { "org.freedesktop.DBus.Property.EmitsChangedSignal":
 
1353
                     "false"}
 
1354
    
1181
1355
    ## Signals
1182
1356
    
1183
1357
    # CheckerCompleted - signal
1219
1393
        "D-Bus signal"
1220
1394
        return self.need_approval()
1221
1395
    
1222
 
    # NeRwequest - signal
1223
 
    @dbus.service.signal(_interface, signature="s")
1224
 
    def NewRequest(self, ip):
1225
 
        """D-Bus signal
1226
 
        Is sent after a client request a password.
1227
 
        """
1228
 
        pass
1229
 
    
1230
1396
    ## Methods
1231
1397
    
1232
1398
    # Approve - method
1342
1508
            return
1343
1509
        return datetime_to_dbus(self.last_checked_ok)
1344
1510
    
 
1511
    # LastCheckerStatus - property
 
1512
    @dbus_service_property(_interface, signature="n",
 
1513
                           access="read")
 
1514
    def LastCheckerStatus_dbus_property(self):
 
1515
        return dbus.Int16(self.last_checker_status)
 
1516
    
1345
1517
    # Expires - property
1346
1518
    @dbus_service_property(_interface, signature="s", access="read")
1347
1519
    def Expires_dbus_property(self):
1358
1530
    def Timeout_dbus_property(self, value=None):
1359
1531
        if value is None:       # get
1360
1532
            return dbus.UInt64(self.timeout_milliseconds())
 
1533
        old_timeout = self.timeout
1361
1534
        self.timeout = datetime.timedelta(0, 0, 0, value)
1362
 
        if getattr(self, "disable_initiator_tag", None) is None:
1363
 
            return
1364
 
        # Reschedule timeout
1365
 
        gobject.source_remove(self.disable_initiator_tag)
1366
 
        self.disable_initiator_tag = None
1367
 
        self.expires = None
1368
 
        time_to_die = timedelta_to_milliseconds((self
1369
 
                                                 .last_checked_ok
1370
 
                                                 + self.timeout)
1371
 
                                                - datetime.datetime
1372
 
                                                .utcnow())
1373
 
        if time_to_die <= 0:
1374
 
            # The timeout has passed
1375
 
            self.disable()
1376
 
        else:
1377
 
            self.expires = (datetime.datetime.utcnow()
1378
 
                            + datetime.timedelta(milliseconds =
1379
 
                                                 time_to_die))
1380
 
            self.disable_initiator_tag = (gobject.timeout_add
1381
 
                                          (time_to_die, self.disable))
 
1535
        # Reschedule disabling
 
1536
        if self.enabled:
 
1537
            now = datetime.datetime.utcnow()
 
1538
            self.expires += self.timeout - old_timeout
 
1539
            if self.expires <= now:
 
1540
                # The timeout has passed
 
1541
                self.disable()
 
1542
            else:
 
1543
                if (getattr(self, "disable_initiator_tag", None)
 
1544
                    is None):
 
1545
                    return
 
1546
                gobject.source_remove(self.disable_initiator_tag)
 
1547
                self.disable_initiator_tag = (
 
1548
                    gobject.timeout_add(
 
1549
                        timedelta_to_milliseconds(self.expires - now),
 
1550
                        self.disable))
1382
1551
    
1383
1552
    # ExtendedTimeout - property
1384
1553
    @dbus_service_property(_interface, signature="t",
1463
1632
        self._pipe.send(('setattr', name, value))
1464
1633
 
1465
1634
 
1466
 
class ClientDBusTransitional(ClientDBus):
1467
 
    __metaclass__ = AlternateDBusNamesMetaclass
1468
 
 
1469
 
 
1470
1635
class ClientHandler(socketserver.BaseRequestHandler, object):
1471
1636
    """A class to handle client connections.
1472
1637
    
1540
1705
                except KeyError:
1541
1706
                    return
1542
1707
                
1543
 
                if self.server.use_dbus:
1544
 
                    # Emit D-Bus signal
1545
 
                    client.NewRequest(str(self.client_address))
1546
 
                
1547
1708
                if client.approval_delay:
1548
1709
                    delay = client.approval_delay
1549
1710
                    client.approvals_pending += 1
1580
1741
                    #wait until timeout or approved
1581
1742
                    time = datetime.datetime.now()
1582
1743
                    client.changedstate.acquire()
1583
 
                    (client.changedstate.wait
1584
 
                     (float(client.timedelta_to_milliseconds(delay)
1585
 
                            / 1000)))
 
1744
                    client.changedstate.wait(
 
1745
                        float(timedelta_to_milliseconds(delay)
 
1746
                              / 1000))
1586
1747
                    client.changedstate.release()
1587
1748
                    time2 = datetime.datetime.now()
1588
1749
                    if (time2 - time) >= delay:
1604
1765
                    try:
1605
1766
                        sent = session.send(client.secret[sent_size:])
1606
1767
                    except gnutls.errors.GNUTLSError as error:
1607
 
                        logger.warning("gnutls send failed")
 
1768
                        logger.warning("gnutls send failed",
 
1769
                                       exc_info=error)
1608
1770
                        return
1609
1771
                    logger.debug("Sent: %d, remaining: %d",
1610
1772
                                 sent, len(client.secret)
1613
1775
                
1614
1776
                logger.info("Sending secret to %s", client.name)
1615
1777
                # bump the timeout using extended_timeout
1616
 
                client.checked_ok(client.extended_timeout)
 
1778
                client.bump_timeout(client.extended_timeout)
1617
1779
                if self.server.use_dbus:
1618
1780
                    # Emit D-Bus signal
1619
1781
                    client.GotSecret()
1624
1786
                try:
1625
1787
                    session.bye()
1626
1788
                except gnutls.errors.GNUTLSError as error:
1627
 
                    logger.warning("GnuTLS bye failed")
 
1789
                    logger.warning("GnuTLS bye failed",
 
1790
                                   exc_info=error)
1628
1791
    
1629
1792
    @staticmethod
1630
1793
    def peer_certificate(session):
1702
1865
    def process_request(self, request, address):
1703
1866
        """Start a new process to process the request."""
1704
1867
        proc = multiprocessing.Process(target = self.sub_process_main,
1705
 
                                       args = (request,
1706
 
                                               address))
 
1868
                                       args = (request, address))
1707
1869
        proc.start()
1708
1870
        return proc
1709
1871
 
1737
1899
        use_ipv6:       Boolean; to use IPv6 or not
1738
1900
    """
1739
1901
    def __init__(self, server_address, RequestHandlerClass,
1740
 
                 interface=None, use_ipv6=True):
 
1902
                 interface=None, use_ipv6=True, socketfd=None):
 
1903
        """If socketfd is set, use that file descriptor instead of
 
1904
        creating a new one with socket.socket().
 
1905
        """
1741
1906
        self.interface = interface
1742
1907
        if use_ipv6:
1743
1908
            self.address_family = socket.AF_INET6
 
1909
        if socketfd is not None:
 
1910
            # Save the file descriptor
 
1911
            self.socketfd = socketfd
 
1912
            # Save the original socket.socket() function
 
1913
            self.socket_socket = socket.socket
 
1914
            # To implement --socket, we monkey patch socket.socket.
 
1915
            # 
 
1916
            # (When socketserver.TCPServer is a new-style class, we
 
1917
            # could make self.socket into a property instead of monkey
 
1918
            # patching socket.socket.)
 
1919
            # 
 
1920
            # Create a one-time-only replacement for socket.socket()
 
1921
            @functools.wraps(socket.socket)
 
1922
            def socket_wrapper(*args, **kwargs):
 
1923
                # Restore original function so subsequent calls are
 
1924
                # not affected.
 
1925
                socket.socket = self.socket_socket
 
1926
                del self.socket_socket
 
1927
                # This time only, return a new socket object from the
 
1928
                # saved file descriptor.
 
1929
                return socket.fromfd(self.socketfd, *args, **kwargs)
 
1930
            # Replace socket.socket() function with wrapper
 
1931
            socket.socket = socket_wrapper
 
1932
        # The socketserver.TCPServer.__init__ will call
 
1933
        # socket.socket(), which might be our replacement,
 
1934
        # socket_wrapper(), if socketfd was set.
1744
1935
        socketserver.TCPServer.__init__(self, server_address,
1745
1936
                                        RequestHandlerClass)
 
1937
    
1746
1938
    def server_bind(self):
1747
1939
        """This overrides the normal server_bind() function
1748
1940
        to bind to an interface if one was specified, and also NOT to
1759
1951
                                           str(self.interface
1760
1952
                                               + '\0'))
1761
1953
                except socket.error as error:
1762
 
                    if error[0] == errno.EPERM:
 
1954
                    if error.errno == errno.EPERM:
1763
1955
                        logger.error("No permission to"
1764
1956
                                     " bind to interface %s",
1765
1957
                                     self.interface)
1766
 
                    elif error[0] == errno.ENOPROTOOPT:
 
1958
                    elif error.errno == errno.ENOPROTOOPT:
1767
1959
                        logger.error("SO_BINDTODEVICE not available;"
1768
1960
                                     " cannot bind to interface %s",
1769
1961
                                     self.interface)
 
1962
                    elif error.errno == errno.ENODEV:
 
1963
                        logger.error("Interface %s does not"
 
1964
                                     " exist, cannot bind",
 
1965
                                     self.interface)
1770
1966
                    else:
1771
1967
                        raise
1772
1968
        # Only bind(2) the socket if we really need to.
1802
1998
    """
1803
1999
    def __init__(self, server_address, RequestHandlerClass,
1804
2000
                 interface=None, use_ipv6=True, clients=None,
1805
 
                 gnutls_priority=None, use_dbus=True):
 
2001
                 gnutls_priority=None, use_dbus=True, socketfd=None):
1806
2002
        self.enabled = False
1807
2003
        self.clients = clients
1808
2004
        if self.clients is None:
1812
2008
        IPv6_TCPServer.__init__(self, server_address,
1813
2009
                                RequestHandlerClass,
1814
2010
                                interface = interface,
1815
 
                                use_ipv6 = use_ipv6)
 
2011
                                use_ipv6 = use_ipv6,
 
2012
                                socketfd = socketfd)
1816
2013
    def server_activate(self):
1817
2014
        if self.enabled:
1818
2015
            return socketserver.TCPServer.server_activate(self)
1831
2028
    
1832
2029
    def handle_ipc(self, source, condition, parent_pipe=None,
1833
2030
                   proc = None, client_object=None):
1834
 
        condition_names = {
1835
 
            gobject.IO_IN: "IN",   # There is data to read.
1836
 
            gobject.IO_OUT: "OUT", # Data can be written (without
1837
 
                                    # blocking).
1838
 
            gobject.IO_PRI: "PRI", # There is urgent data to read.
1839
 
            gobject.IO_ERR: "ERR", # Error condition.
1840
 
            gobject.IO_HUP: "HUP"  # Hung up (the connection has been
1841
 
                                    # broken, usually for pipes and
1842
 
                                    # sockets).
1843
 
            }
1844
 
        conditions_string = ' | '.join(name
1845
 
                                       for cond, name in
1846
 
                                       condition_names.iteritems()
1847
 
                                       if cond & condition)
1848
2031
        # error, or the other end of multiprocessing.Pipe has closed
1849
 
        if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):
 
2032
        if condition & (gobject.IO_ERR | gobject.IO_HUP):
1850
2033
            # Wait for other process to exit
1851
2034
            proc.join()
1852
2035
            return False
1942
2125
            elif suffix == "w":
1943
2126
                delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
1944
2127
            else:
1945
 
                raise ValueError("Unknown suffix %r" % suffix)
 
2128
                raise ValueError("Unknown suffix {0!r}"
 
2129
                                 .format(suffix))
1946
2130
        except (ValueError, IndexError) as e:
1947
2131
            raise ValueError(*(e.args))
1948
2132
        timevalue += delta
1962
2146
        sys.exit()
1963
2147
    if not noclose:
1964
2148
        # Close all standard open file descriptors
1965
 
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
 
2149
        null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
1966
2150
        if not stat.S_ISCHR(os.fstat(null).st_mode):
1967
2151
            raise OSError(errno.ENODEV,
1968
 
                          "%s not a character device"
1969
 
                          % os.path.devnull)
 
2152
                          "{0} not a character device"
 
2153
                          .format(os.devnull))
1970
2154
        os.dup2(null, sys.stdin.fileno())
1971
2155
        os.dup2(null, sys.stdout.fileno())
1972
2156
        os.dup2(null, sys.stderr.fileno())
1981
2165
    
1982
2166
    parser = argparse.ArgumentParser()
1983
2167
    parser.add_argument("-v", "--version", action="version",
1984
 
                        version = "%%(prog)s %s" % version,
 
2168
                        version = "%(prog)s {0}".format(version),
1985
2169
                        help="show version number and exit")
1986
2170
    parser.add_argument("-i", "--interface", metavar="IF",
1987
2171
                        help="Bind to interface IF")
2012
2196
    parser.add_argument("--no-restore", action="store_false",
2013
2197
                        dest="restore", help="Do not restore stored"
2014
2198
                        " state")
 
2199
    parser.add_argument("--socket", type=int,
 
2200
                        help="Specify a file descriptor to a network"
 
2201
                        " socket to use instead of creating one")
2015
2202
    parser.add_argument("--statedir", metavar="DIR",
2016
2203
                        help="Directory to save/restore state in")
2017
2204
    
2034
2221
                        "use_ipv6": "True",
2035
2222
                        "debuglevel": "",
2036
2223
                        "restore": "True",
 
2224
                        "socket": "",
2037
2225
                        "statedir": "/var/lib/mandos"
2038
2226
                        }
2039
2227
    
2051
2239
    if server_settings["port"]:
2052
2240
        server_settings["port"] = server_config.getint("DEFAULT",
2053
2241
                                                       "port")
 
2242
    if server_settings["socket"]:
 
2243
        server_settings["socket"] = server_config.getint("DEFAULT",
 
2244
                                                         "socket")
 
2245
        # Later, stdin will, and stdout and stderr might, be dup'ed
 
2246
        # over with an opened os.devnull.  But we don't want this to
 
2247
        # happen with a supplied network socket.
 
2248
        if 0 <= server_settings["socket"] <= 2:
 
2249
            server_settings["socket"] = os.dup(server_settings
 
2250
                                               ["socket"])
2054
2251
    del server_config
2055
2252
    
2056
2253
    # Override the settings from the config file with command line
2058
2255
    for option in ("interface", "address", "port", "debug",
2059
2256
                   "priority", "servicename", "configdir",
2060
2257
                   "use_dbus", "use_ipv6", "debuglevel", "restore",
2061
 
                   "statedir"):
 
2258
                   "statedir", "socket"):
2062
2259
        value = getattr(options, option)
2063
2260
        if value is not None:
2064
2261
            server_settings[option] = value
2090
2287
    
2091
2288
    if server_settings["servicename"] != "Mandos":
2092
2289
        syslogger.setFormatter(logging.Formatter
2093
 
                               ('Mandos (%s) [%%(process)d]:'
2094
 
                                ' %%(levelname)s: %%(message)s'
2095
 
                                % server_settings["servicename"]))
 
2290
                               ('Mandos ({0}) [%(process)d]:'
 
2291
                                ' %(levelname)s: %(message)s'
 
2292
                                .format(server_settings
 
2293
                                        ["servicename"])))
2096
2294
    
2097
2295
    # Parse config file with clients
2098
 
    client_config = configparser.SafeConfigParser(Client.client_defaults)
 
2296
    client_config = configparser.SafeConfigParser(Client
 
2297
                                                  .client_defaults)
2099
2298
    client_config.read(os.path.join(server_settings["configdir"],
2100
2299
                                    "clients.conf"))
2101
2300
    
2110
2309
                              use_ipv6=use_ipv6,
2111
2310
                              gnutls_priority=
2112
2311
                              server_settings["priority"],
2113
 
                              use_dbus=use_dbus)
 
2312
                              use_dbus=use_dbus,
 
2313
                              socketfd=(server_settings["socket"]
 
2314
                                        or None))
2114
2315
    if not debug:
2115
2316
        pidfilename = "/var/run/mandos.pid"
2116
2317
        try:
2117
2318
            pidfile = open(pidfilename, "w")
2118
 
        except IOError:
2119
 
            logger.error("Could not open file %r", pidfilename)
 
2319
        except IOError as e:
 
2320
            logger.error("Could not open file %r", pidfilename,
 
2321
                         exc_info=e)
2120
2322
    
2121
 
    try:
2122
 
        uid = pwd.getpwnam("_mandos").pw_uid
2123
 
        gid = pwd.getpwnam("_mandos").pw_gid
2124
 
    except KeyError:
 
2323
    for name in ("_mandos", "mandos", "nobody"):
2125
2324
        try:
2126
 
            uid = pwd.getpwnam("mandos").pw_uid
2127
 
            gid = pwd.getpwnam("mandos").pw_gid
 
2325
            uid = pwd.getpwnam(name).pw_uid
 
2326
            gid = pwd.getpwnam(name).pw_gid
 
2327
            break
2128
2328
        except KeyError:
2129
 
            try:
2130
 
                uid = pwd.getpwnam("nobody").pw_uid
2131
 
                gid = pwd.getpwnam("nobody").pw_gid
2132
 
            except KeyError:
2133
 
                uid = 65534
2134
 
                gid = 65534
 
2329
            continue
 
2330
    else:
 
2331
        uid = 65534
 
2332
        gid = 65534
2135
2333
    try:
2136
2334
        os.setgid(gid)
2137
2335
        os.setuid(uid)
2138
2336
    except OSError as error:
2139
 
        if error[0] != errno.EPERM:
 
2337
        if error.errno != errno.EPERM:
2140
2338
            raise error
2141
2339
    
2142
2340
    if debug:
2154
2352
         .gnutls_global_set_log_function(debug_gnutls))
2155
2353
        
2156
2354
        # Redirect stdin so all checkers get /dev/null
2157
 
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
 
2355
        null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2158
2356
        os.dup2(null, sys.stdin.fileno())
2159
2357
        if null > 2:
2160
2358
            os.close(null)
2164
2362
        # Close all input and output, do double fork, etc.
2165
2363
        daemon()
2166
2364
    
 
2365
    # multiprocessing will use threads, so before we use gobject we
 
2366
    # need to inform gobject that threads will be used.
2167
2367
    gobject.threads_init()
2168
2368
    
2169
2369
    global main_loop
2170
2370
    # From the Avahi example code
2171
 
    DBusGMainLoop(set_as_default=True )
 
2371
    DBusGMainLoop(set_as_default=True)
2172
2372
    main_loop = gobject.MainLoop()
2173
2373
    bus = dbus.SystemBus()
2174
2374
    # End of Avahi example code
2180
2380
                            ("se.bsnet.fukt.Mandos", bus,
2181
2381
                             do_not_queue=True))
2182
2382
        except dbus.exceptions.NameExistsException as e:
2183
 
            logger.error(unicode(e) + ", disabling D-Bus")
 
2383
            logger.error("Disabling D-Bus:", exc_info=e)
2184
2384
            use_dbus = False
2185
2385
            server_settings["use_dbus"] = False
2186
2386
            tcp_server.use_dbus = False
2198
2398
    
2199
2399
    client_class = Client
2200
2400
    if use_dbus:
2201
 
        client_class = functools.partial(ClientDBusTransitional,
2202
 
                                         bus = bus)
 
2401
        client_class = functools.partial(ClientDBus, bus = bus)
2203
2402
    
2204
2403
    client_settings = Client.config_parser(client_config)
2205
2404
    old_client_settings = {}
2213
2412
                                                     (stored_state))
2214
2413
            os.remove(stored_state_path)
2215
2414
        except IOError as e:
2216
 
            logger.warning("Could not load persistent state: {0}"
2217
 
                           .format(e))
2218
 
            if e.errno != errno.ENOENT:
 
2415
            if e.errno == errno.ENOENT:
 
2416
                logger.warning("Could not load persistent state: {0}"
 
2417
                                .format(os.strerror(e.errno)))
 
2418
            else:
 
2419
                logger.critical("Could not load persistent state:",
 
2420
                                exc_info=e)
2219
2421
                raise
2220
2422
        except EOFError as e:
2221
2423
            logger.warning("Could not load persistent state: "
2222
 
                           "EOFError: {0}".format(e))
 
2424
                           "EOFError:", exc_info=e)
2223
2425
    
2224
2426
    with PGPEngine() as pgp:
2225
2427
        for client_name, client in clients_data.iteritems():
2242
2444
            
2243
2445
            # Clients who has passed its expire date can still be
2244
2446
            # enabled if its last checker was successful.  Clients
2245
 
            # whose checker failed before we stored its state is
2246
 
            # assumed to have failed all checkers during downtime.
 
2447
            # whose checker succeeded before we stored its state is
 
2448
            # assumed to have successfully run all checkers during
 
2449
            # downtime.
2247
2450
            if client["enabled"]:
2248
2451
                if datetime.datetime.utcnow() >= client["expires"]:
2249
2452
                    if not client["last_checked_ok"]:
2250
2453
                        logger.warning(
2251
2454
                            "disabling client {0} - Client never "
2252
 
                            "performed a successfull checker"
2253
 
                            .format(client["name"]))
 
2455
                            "performed a successful checker"
 
2456
                            .format(client_name))
2254
2457
                        client["enabled"] = False
2255
2458
                    elif client["last_checker_status"] != 0:
2256
2459
                        logger.warning(
2257
2460
                            "disabling client {0} - Client "
2258
2461
                            "last checker failed with error code {1}"
2259
 
                            .format(client["name"],
 
2462
                            .format(client_name,
2260
2463
                                    client["last_checker_status"]))
2261
2464
                        client["enabled"] = False
2262
2465
                    else:
2263
2466
                        client["expires"] = (datetime.datetime
2264
2467
                                             .utcnow()
2265
2468
                                             + client["timeout"])
2266
 
                    
 
2469
                        logger.debug("Last checker succeeded,"
 
2470
                                     " keeping {0} enabled"
 
2471
                                     .format(client_name))
2267
2472
            try:
2268
2473
                client["secret"] = (
2269
2474
                    pgp.decrypt(client["encrypted_secret"],
2275
2480
                             .format(client_name))
2276
2481
                client["secret"] = (
2277
2482
                    client_settings[client_name]["secret"])
2278
 
 
2279
2483
    
2280
2484
    # Add/remove clients based on new changes made to config
2281
 
    for client_name in set(old_client_settings) - set(client_settings):
 
2485
    for client_name in (set(old_client_settings)
 
2486
                        - set(client_settings)):
2282
2487
        del clients_data[client_name]
2283
 
    for client_name in set(client_settings) - set(old_client_settings):
 
2488
    for client_name in (set(client_settings)
 
2489
                        - set(old_client_settings)):
2284
2490
        clients_data[client_name] = client_settings[client_name]
2285
 
 
2286
 
    # Create clients all clients
 
2491
    
 
2492
    # Create all client objects
2287
2493
    for client_name, client in clients_data.iteritems():
2288
2494
        tcp_server.clients[client_name] = client_class(
2289
2495
            name = client_name, settings = client)
2290
2496
    
2291
2497
    if not tcp_server.clients:
2292
2498
        logger.warning("No clients defined")
2293
 
        
 
2499
    
2294
2500
    if not debug:
2295
2501
        try:
2296
2502
            with pidfile:
2304
2510
            # "pidfile" was never created
2305
2511
            pass
2306
2512
        del pidfilename
2307
 
        signal.signal(signal.SIGINT, signal.SIG_IGN)
2308
2513
    
2309
2514
    signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2310
2515
    signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
2311
2516
    
2312
2517
    if use_dbus:
2313
 
        class MandosDBusService(dbus.service.Object):
 
2518
        @alternate_dbus_interfaces({"se.recompile.Mandos":
 
2519
                                        "se.bsnet.fukt.Mandos"})
 
2520
        class MandosDBusService(DBusObjectWithProperties):
2314
2521
            """A D-Bus proxy object"""
2315
2522
            def __init__(self):
2316
2523
                dbus.service.Object.__init__(self, bus, "/")
2317
2524
            _interface = "se.recompile.Mandos"
2318
2525
            
 
2526
            @dbus_interface_annotations(_interface)
 
2527
            def _foo(self):
 
2528
                return { "org.freedesktop.DBus.Property"
 
2529
                         ".EmitsChangedSignal":
 
2530
                             "false"}
 
2531
            
2319
2532
            @dbus.service.signal(_interface, signature="o")
2320
2533
            def ClientAdded(self, objpath):
2321
2534
                "D-Bus signal"
2363
2576
            
2364
2577
            del _interface
2365
2578
        
2366
 
        class MandosDBusServiceTransitional(MandosDBusService):
2367
 
            __metaclass__ = AlternateDBusNamesMetaclass
2368
 
        mandos_dbus_service = MandosDBusServiceTransitional()
 
2579
        mandos_dbus_service = MandosDBusService()
2369
2580
    
2370
2581
    def cleanup():
2371
2582
        "Cleanup function; run on exit"
2404
2615
                del client_settings[client.name]["secret"]
2405
2616
        
2406
2617
        try:
2407
 
            tempfd, tempname = tempfile.mkstemp(suffix=".pickle",
2408
 
                                                prefix="clients-",
2409
 
                                                dir=os.path.dirname
2410
 
                                                (stored_state_path))
2411
 
            with os.fdopen(tempfd, "wb") as stored_state:
 
2618
            with (tempfile.NamedTemporaryFile
 
2619
                  (mode='wb', suffix=".pickle", prefix='clients-',
 
2620
                   dir=os.path.dirname(stored_state_path),
 
2621
                   delete=False)) as stored_state:
2412
2622
                pickle.dump((clients, client_settings), stored_state)
 
2623
                tempname=stored_state.name
2413
2624
            os.rename(tempname, stored_state_path)
2414
2625
        except (IOError, OSError) as e:
2415
 
            logger.warning("Could not save persistent state: {0}"
2416
 
                           .format(e))
2417
2626
            if not debug:
2418
2627
                try:
2419
2628
                    os.remove(tempname)
2420
2629
                except NameError:
2421
2630
                    pass
2422
 
            if e.errno not in set((errno.ENOENT, errno.EACCES,
2423
 
                                   errno.EEXIST)):
 
2631
            if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
 
2632
                logger.warning("Could not save persistent state: {0}"
 
2633
                               .format(os.strerror(e.errno)))
 
2634
            else:
 
2635
                logger.warning("Could not save persistent state:",
 
2636
                               exc_info=e)
2424
2637
                raise e
2425
2638
        
2426
2639
        # Delete all clients, and settings from config
2454
2667
    service.port = tcp_server.socket.getsockname()[1]
2455
2668
    if use_ipv6:
2456
2669
        logger.info("Now listening on address %r, port %d,"
2457
 
                    " flowinfo %d, scope_id %d"
2458
 
                    % tcp_server.socket.getsockname())
 
2670
                    " flowinfo %d, scope_id %d",
 
2671
                    *tcp_server.socket.getsockname())
2459
2672
    else:                       # IPv4
2460
 
        logger.info("Now listening on address %r, port %d"
2461
 
                    % tcp_server.socket.getsockname())
 
2673
        logger.info("Now listening on address %r, port %d",
 
2674
                    *tcp_server.socket.getsockname())
2462
2675
    
2463
2676
    #service.interface = tcp_server.socket.getsockname()[3]
2464
2677
    
2467
2680
        try:
2468
2681
            service.activate()
2469
2682
        except dbus.exceptions.DBusException as error:
2470
 
            logger.critical("DBusException: %s", error)
 
2683
            logger.critical("D-Bus Exception", exc_info=error)
2471
2684
            cleanup()
2472
2685
            sys.exit(1)
2473
2686
        # End of Avahi example code
2480
2693
        logger.debug("Starting main loop")
2481
2694
        main_loop.run()
2482
2695
    except AvahiError as error:
2483
 
        logger.critical("AvahiError: %s", error)
 
2696
        logger.critical("Avahi Error", exc_info=error)
2484
2697
        cleanup()
2485
2698
        sys.exit(1)
2486
2699
    except KeyboardInterrupt: