/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos

  • Committer: Teddy Hogeborn
  • Date: 2013-10-22 19:46:35 UTC
  • Revision ID: teddy@recompile.se-20131022194635-ll6jyg1snrxwe94o
* TODO

Show diffs side-by-side

added added

removed removed

Lines of Context:
mandos
11
11
# "AvahiService" class, and some lines in "main".
12
12
# 
13
13
# Everything else is
14
 
# Copyright © 2008,2009 Teddy Hogeborn
15
 
# Copyright © 2008,2009 Björn Påhlsson
 
14
# Copyright © 2008-2013 Teddy Hogeborn
 
15
# Copyright © 2008-2013 Björn Påhlsson
16
16
# 
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
28
28
# along with this program.  If not, see
29
29
# <http://www.gnu.org/licenses/>.
30
30
# 
31
 
# Contact the authors at <mandos@fukt.bsnet.se>.
 
31
# Contact the authors at <mandos@recompile.se>.
32
32
# 
33
33
 
34
 
from __future__ import division, with_statement, absolute_import
 
34
from __future__ import (division, absolute_import, print_function,
 
35
                        unicode_literals)
 
36
 
 
37
from future_builtins import *
35
38
 
36
39
import SocketServer as socketserver
37
40
import socket
38
 
import optparse
 
41
import argparse
39
42
import datetime
40
43
import errno
41
44
import gnutls.crypto
61
64
import functools
62
65
import cPickle as pickle
63
66
import multiprocessing
 
67
import types
 
68
import binascii
 
69
import tempfile
 
70
import itertools
 
71
import collections
64
72
 
65
73
import dbus
66
74
import dbus.service
80
88
    except ImportError:
81
89
        SO_BINDTODEVICE = None
82
90
 
83
 
 
84
 
version = "1.0.14"
85
 
 
86
 
#logger = logging.getLogger(u'mandos')
87
 
logger = logging.Logger(u'mandos')
 
91
version = "1.6.1"
 
92
stored_state_file = "clients.pickle"
 
93
 
 
94
logger = logging.getLogger()
88
95
syslogger = (logging.handlers.SysLogHandler
89
96
             (facility = logging.handlers.SysLogHandler.LOG_DAEMON,
90
 
              address = "/dev/log"))
91
 
syslogger.setFormatter(logging.Formatter
92
 
                       (u'Mandos [%(process)d]: %(levelname)s:'
93
 
                        u' %(message)s'))
94
 
logger.addHandler(syslogger)
95
 
 
96
 
console = logging.StreamHandler()
97
 
console.setFormatter(logging.Formatter(u'%(name)s [%(process)d]:'
98
 
                                       u' %(levelname)s:'
99
 
                                       u' %(message)s'))
100
 
logger.addHandler(console)
 
97
              address = str("/dev/log")))
 
98
 
 
99
try:
 
100
    if_nametoindex = (ctypes.cdll.LoadLibrary
 
101
                      (ctypes.util.find_library("c"))
 
102
                      .if_nametoindex)
 
103
except (OSError, AttributeError):
 
104
    def if_nametoindex(interface):
 
105
        "Get an interface index the hard way, i.e. using fcntl()"
 
106
        SIOCGIFINDEX = 0x8933  # From /usr/include/linux/sockios.h
 
107
        with contextlib.closing(socket.socket()) as s:
 
108
            ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
 
109
                                struct.pack(str("16s16x"),
 
110
                                            interface))
 
111
        interface_index = struct.unpack(str("I"),
 
112
                                        ifreq[16:20])[0]
 
113
        return interface_index
 
114
 
 
115
 
 
116
def initlogger(debug, level=logging.WARNING):
 
117
    """init logger and add loglevel"""
 
118
    
 
119
    syslogger.setFormatter(logging.Formatter
 
120
                           ('Mandos [%(process)d]: %(levelname)s:'
 
121
                            ' %(message)s'))
 
122
    logger.addHandler(syslogger)
 
123
    
 
124
    if debug:
 
125
        console = logging.StreamHandler()
 
126
        console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
 
127
                                               ' [%(process)d]:'
 
128
                                               ' %(levelname)s:'
 
129
                                               ' %(message)s'))
 
130
        logger.addHandler(console)
 
131
    logger.setLevel(level)
 
132
 
 
133
 
 
134
class PGPError(Exception):
 
135
    """Exception if encryption/decryption fails"""
 
136
    pass
 
137
 
 
138
 
 
139
class PGPEngine(object):
 
140
    """A simple class for OpenPGP symmetric encryption & decryption"""
 
141
    def __init__(self):
 
142
        self.tempdir = tempfile.mkdtemp(prefix="mandos-")
 
143
        self.gnupgargs = ['--batch',
 
144
                          '--home', self.tempdir,
 
145
                          '--force-mdc',
 
146
                          '--quiet',
 
147
                          '--no-use-agent']
 
148
    
 
149
    def __enter__(self):
 
150
        return self
 
151
    
 
152
    def __exit__(self, exc_type, exc_value, traceback):
 
153
        self._cleanup()
 
154
        return False
 
155
    
 
156
    def __del__(self):
 
157
        self._cleanup()
 
158
    
 
159
    def _cleanup(self):
 
160
        if self.tempdir is not None:
 
161
            # Delete contents of tempdir
 
162
            for root, dirs, files in os.walk(self.tempdir,
 
163
                                             topdown = False):
 
164
                for filename in files:
 
165
                    os.remove(os.path.join(root, filename))
 
166
                for dirname in dirs:
 
167
                    os.rmdir(os.path.join(root, dirname))
 
168
            # Remove tempdir
 
169
            os.rmdir(self.tempdir)
 
170
            self.tempdir = None
 
171
    
 
172
    def password_encode(self, password):
 
173
        # Passphrase can not be empty and can not contain newlines or
 
174
        # NUL bytes.  So we prefix it and hex encode it.
 
175
        encoded = b"mandos" + binascii.hexlify(password)
 
176
        if len(encoded) > 2048:
 
177
            # GnuPG can't handle long passwords, so encode differently
 
178
            encoded = (b"mandos" + password.replace(b"\\", b"\\\\")
 
179
                       .replace(b"\n", b"\\n")
 
180
                       .replace(b"\0", b"\\x00"))
 
181
        return encoded
 
182
    
 
183
    def encrypt(self, data, password):
 
184
        passphrase = self.password_encode(password)
 
185
        with tempfile.NamedTemporaryFile(dir=self.tempdir
 
186
                                         ) as passfile:
 
187
            passfile.write(passphrase)
 
188
            passfile.flush()
 
189
            proc = subprocess.Popen(['gpg', '--symmetric',
 
190
                                     '--passphrase-file',
 
191
                                     passfile.name]
 
192
                                    + self.gnupgargs,
 
193
                                    stdin = subprocess.PIPE,
 
194
                                    stdout = subprocess.PIPE,
 
195
                                    stderr = subprocess.PIPE)
 
196
            ciphertext, err = proc.communicate(input = data)
 
197
        if proc.returncode != 0:
 
198
            raise PGPError(err)
 
199
        return ciphertext
 
200
    
 
201
    def decrypt(self, data, password):
 
202
        passphrase = self.password_encode(password)
 
203
        with tempfile.NamedTemporaryFile(dir = self.tempdir
 
204
                                         ) as passfile:
 
205
            passfile.write(passphrase)
 
206
            passfile.flush()
 
207
            proc = subprocess.Popen(['gpg', '--decrypt',
 
208
                                     '--passphrase-file',
 
209
                                     passfile.name]
 
210
                                    + self.gnupgargs,
 
211
                                    stdin = subprocess.PIPE,
 
212
                                    stdout = subprocess.PIPE,
 
213
                                    stderr = subprocess.PIPE)
 
214
            decrypted_plaintext, err = proc.communicate(input
 
215
                                                        = data)
 
216
        if proc.returncode != 0:
 
217
            raise PGPError(err)
 
218
        return decrypted_plaintext
 
219
 
101
220
 
102
221
class AvahiError(Exception):
103
222
    def __init__(self, value, *args, **kwargs):
119
238
    Attributes:
120
239
    interface: integer; avahi.IF_UNSPEC or an interface index.
121
240
               Used to optionally bind to the specified interface.
122
 
    name: string; Example: u'Mandos'
123
 
    type: string; Example: u'_mandos._tcp'.
124
 
                  See <http://www.dns-sd.org/ServiceTypes.html>
 
241
    name: string; Example: 'Mandos'
 
242
    type: string; Example: '_mandos._tcp'.
 
243
     See <https://www.iana.org/assignments/service-names-port-numbers>
125
244
    port: integer; what port to announce
126
245
    TXT: list of strings; TXT record for the service
127
246
    domain: string; Domain to publish on, default to .local if empty.
133
252
    server: D-Bus Server
134
253
    bus: dbus.SystemBus()
135
254
    """
 
255
    
136
256
    def __init__(self, interface = avahi.IF_UNSPEC, name = None,
137
257
                 servicetype = None, port = None, TXT = None,
138
 
                 domain = u"", host = u"", max_renames = 32768,
 
258
                 domain = "", host = "", max_renames = 32768,
139
259
                 protocol = avahi.PROTO_UNSPEC, bus = None):
140
260
        self.interface = interface
141
261
        self.name = name
150
270
        self.group = None       # our entry group
151
271
        self.server = None
152
272
        self.bus = bus
 
273
        self.entry_group_state_changed_match = None
 
274
    
153
275
    def rename(self):
154
276
        """Derived from the Avahi example code"""
155
277
        if self.rename_count >= self.max_renames:
156
 
            logger.critical(u"No suitable Zeroconf service name found"
157
 
                            u" after %i retries, exiting.",
 
278
            logger.critical("No suitable Zeroconf service name found"
 
279
                            " after %i retries, exiting.",
158
280
                            self.rename_count)
159
 
            raise AvahiServiceError(u"Too many renames")
160
 
        self.name = unicode(self.server.GetAlternativeServiceName(self.name))
161
 
        logger.info(u"Changing Zeroconf service name to %r ...",
 
281
            raise AvahiServiceError("Too many renames")
 
282
        self.name = unicode(self.server
 
283
                            .GetAlternativeServiceName(self.name))
 
284
        logger.info("Changing Zeroconf service name to %r ...",
162
285
                    self.name)
163
 
        syslogger.setFormatter(logging.Formatter
164
 
                               (u'Mandos (%s) [%%(process)d]:'
165
 
                                u' %%(levelname)s: %%(message)s'
166
 
                                % self.name))
167
286
        self.remove()
168
 
        self.add()
 
287
        try:
 
288
            self.add()
 
289
        except dbus.exceptions.DBusException as error:
 
290
            logger.critical("D-Bus Exception", exc_info=error)
 
291
            self.cleanup()
 
292
            os._exit(1)
169
293
        self.rename_count += 1
 
294
    
170
295
    def remove(self):
171
296
        """Derived from the Avahi example code"""
 
297
        if self.entry_group_state_changed_match is not None:
 
298
            self.entry_group_state_changed_match.remove()
 
299
            self.entry_group_state_changed_match = None
172
300
        if self.group is not None:
173
301
            self.group.Reset()
 
302
    
174
303
    def add(self):
175
304
        """Derived from the Avahi example code"""
 
305
        self.remove()
176
306
        if self.group is None:
177
307
            self.group = dbus.Interface(
178
308
                self.bus.get_object(avahi.DBUS_NAME,
179
309
                                    self.server.EntryGroupNew()),
180
310
                avahi.DBUS_INTERFACE_ENTRY_GROUP)
181
 
            self.group.connect_to_signal('StateChanged',
182
 
                                         self
183
 
                                         .entry_group_state_changed)
184
 
        logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
 
311
        self.entry_group_state_changed_match = (
 
312
            self.group.connect_to_signal(
 
313
                'StateChanged', self.entry_group_state_changed))
 
314
        logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
185
315
                     self.name, self.type)
186
316
        self.group.AddService(
187
317
            self.interface,
192
322
            dbus.UInt16(self.port),
193
323
            avahi.string_array_to_txt_array(self.TXT))
194
324
        self.group.Commit()
 
325
    
195
326
    def entry_group_state_changed(self, state, error):
196
327
        """Derived from the Avahi example code"""
197
 
        logger.debug(u"Avahi entry group state change: %i", state)
 
328
        logger.debug("Avahi entry group state change: %i", state)
198
329
        
199
330
        if state == avahi.ENTRY_GROUP_ESTABLISHED:
200
 
            logger.debug(u"Zeroconf service established.")
 
331
            logger.debug("Zeroconf service established.")
201
332
        elif state == avahi.ENTRY_GROUP_COLLISION:
202
 
            logger.warning(u"Zeroconf service name collision.")
 
333
            logger.info("Zeroconf service name collision.")
203
334
            self.rename()
204
335
        elif state == avahi.ENTRY_GROUP_FAILURE:
205
 
            logger.critical(u"Avahi: Error in group state changed %s",
 
336
            logger.critical("Avahi: Error in group state changed %s",
206
337
                            unicode(error))
207
 
            raise AvahiGroupError(u"State changed: %s"
208
 
                                  % unicode(error))
 
338
            raise AvahiGroupError("State changed: {0!s}"
 
339
                                  .format(error))
 
340
    
209
341
    def cleanup(self):
210
342
        """Derived from the Avahi example code"""
211
343
        if self.group is not None:
212
 
            self.group.Free()
 
344
            try:
 
345
                self.group.Free()
 
346
            except (dbus.exceptions.UnknownMethodException,
 
347
                    dbus.exceptions.DBusException):
 
348
                pass
213
349
            self.group = None
214
 
    def server_state_changed(self, state):
 
350
        self.remove()
 
351
    
 
352
    def server_state_changed(self, state, error=None):
215
353
        """Derived from the Avahi example code"""
216
 
        logger.debug(u"Avahi server state change: %i", state)
217
 
        if state == avahi.SERVER_COLLISION:
218
 
            logger.error(u"Zeroconf server name collision")
219
 
            self.remove()
 
354
        logger.debug("Avahi server state change: %i", state)
 
355
        bad_states = { avahi.SERVER_INVALID:
 
356
                           "Zeroconf server invalid",
 
357
                       avahi.SERVER_REGISTERING: None,
 
358
                       avahi.SERVER_COLLISION:
 
359
                           "Zeroconf server name collision",
 
360
                       avahi.SERVER_FAILURE:
 
361
                           "Zeroconf server failure" }
 
362
        if state in bad_states:
 
363
            if bad_states[state] is not None:
 
364
                if error is None:
 
365
                    logger.error(bad_states[state])
 
366
                else:
 
367
                    logger.error(bad_states[state] + ": %r", error)
 
368
            self.cleanup()
220
369
        elif state == avahi.SERVER_RUNNING:
221
370
            self.add()
 
371
        else:
 
372
            if error is None:
 
373
                logger.debug("Unknown state: %r", state)
 
374
            else:
 
375
                logger.debug("Unknown state: %r: %r", state, error)
 
376
    
222
377
    def activate(self):
223
378
        """Derived from the Avahi example code"""
224
379
        if self.server is None:
225
380
            self.server = dbus.Interface(
226
381
                self.bus.get_object(avahi.DBUS_NAME,
227
 
                                    avahi.DBUS_PATH_SERVER),
 
382
                                    avahi.DBUS_PATH_SERVER,
 
383
                                    follow_name_owner_changes=True),
228
384
                avahi.DBUS_INTERFACE_SERVER)
229
 
        self.server.connect_to_signal(u"StateChanged",
 
385
        self.server.connect_to_signal("StateChanged",
230
386
                                 self.server_state_changed)
231
387
        self.server_state_changed(self.server.GetState())
232
388
 
233
389
 
 
390
class AvahiServiceToSyslog(AvahiService):
 
391
    def rename(self):
 
392
        """Add the new name to the syslog messages"""
 
393
        ret = AvahiService.rename(self)
 
394
        syslogger.setFormatter(logging.Formatter
 
395
                               ('Mandos ({0}) [%(process)d]:'
 
396
                                ' %(levelname)s: %(message)s'
 
397
                                .format(self.name)))
 
398
        return ret
 
399
 
 
400
 
 
401
def timedelta_to_milliseconds(td):
 
402
    "Convert a datetime.timedelta() to milliseconds"
 
403
    return ((td.days * 24 * 60 * 60 * 1000)
 
404
            + (td.seconds * 1000)
 
405
            + (td.microseconds // 1000))
 
406
 
 
407
 
234
408
class Client(object):
235
409
    """A representation of a client host served by this server.
236
410
    
237
411
    Attributes:
238
 
    name:       string; from the config file, used in log messages and
239
 
                        D-Bus identifiers
 
412
    approved:   bool(); 'None' if not yet approved/disapproved
 
413
    approval_delay: datetime.timedelta(); Time to wait for approval
 
414
    approval_duration: datetime.timedelta(); Duration of one approval
 
415
    checker:    subprocess.Popen(); a running checker process used
 
416
                                    to see if the client lives.
 
417
                                    'None' if no process is running.
 
418
    checker_callback_tag: a gobject event source tag, or None
 
419
    checker_command: string; External command which is run to check
 
420
                     if client lives.  %() expansions are done at
 
421
                     runtime with vars(self) as dict, so that for
 
422
                     instance %(name)s can be used in the command.
 
423
    checker_initiator_tag: a gobject event source tag, or None
 
424
    created:    datetime.datetime(); (UTC) object creation
 
425
    client_structure: Object describing what attributes a client has
 
426
                      and is used for storing the client at exit
 
427
    current_checker_command: string; current running checker_command
 
428
    disable_initiator_tag: a gobject event source tag, or None
 
429
    enabled:    bool()
240
430
    fingerprint: string (40 or 32 hexadecimal digits); used to
241
431
                 uniquely identify the client
242
 
    secret:     bytestring; sent verbatim (over TLS) to client
243
432
    host:       string; available for use by the checker command
244
 
    created:    datetime.datetime(); (UTC) object creation
245
 
    last_enabled: datetime.datetime(); (UTC)
246
 
    enabled:    bool()
 
433
    interval:   datetime.timedelta(); How often to start a new checker
 
434
    last_approval_request: datetime.datetime(); (UTC) or None
247
435
    last_checked_ok: datetime.datetime(); (UTC) or None
 
436
    last_checker_status: integer between 0 and 255 reflecting exit
 
437
                         status of last checker. -1 reflects crashed
 
438
                         checker, -2 means no checker completed yet.
 
439
    last_enabled: datetime.datetime(); (UTC) or None
 
440
    name:       string; from the config file, used in log messages and
 
441
                        D-Bus identifiers
 
442
    secret:     bytestring; sent verbatim (over TLS) to client
248
443
    timeout:    datetime.timedelta(); How long from last_checked_ok
249
444
                                      until this client is disabled
250
 
    interval:   datetime.timedelta(); How often to start a new checker
251
 
    disable_hook:  If set, called by disable() as disable_hook(self)
252
 
    checker:    subprocess.Popen(); a running checker process used
253
 
                                    to see if the client lives.
254
 
                                    'None' if no process is running.
255
 
    checker_initiator_tag: a gobject event source tag, or None
256
 
    disable_initiator_tag: - '' -
257
 
    checker_callback_tag:  - '' -
258
 
    checker_command: string; External command which is run to check if
259
 
                     client lives.  %() expansions are done at
260
 
                     runtime with vars(self) as dict, so that for
261
 
                     instance %(name)s can be used in the command.
262
 
    current_checker_command: string; current running checker_command
263
 
    approved_delay: datetime.timedelta(); Time to wait for approval
264
 
    _approved:   bool(); 'None' if not yet approved/disapproved
265
 
    approved_duration: datetime.timedelta(); Duration of one approval
 
445
    extended_timeout:   extra long timeout when secret has been sent
 
446
    runtime_expansions: Allowed attributes for runtime expansion.
 
447
    expires:    datetime.datetime(); time (UTC) when a client will be
 
448
                disabled, or None
 
449
    server_settings: The server_settings dict from main()
266
450
    """
267
451
    
268
 
    @staticmethod
269
 
    def _timedelta_to_milliseconds(td):
270
 
        "Convert a datetime.timedelta() to milliseconds"
271
 
        return ((td.days * 24 * 60 * 60 * 1000)
272
 
                + (td.seconds * 1000)
273
 
                + (td.microseconds // 1000))
 
452
    runtime_expansions = ("approval_delay", "approval_duration",
 
453
                          "created", "enabled", "expires",
 
454
                          "fingerprint", "host", "interval",
 
455
                          "last_approval_request", "last_checked_ok",
 
456
                          "last_enabled", "name", "timeout")
 
457
    client_defaults = { "timeout": "PT5M",
 
458
                        "extended_timeout": "PT15M",
 
459
                        "interval": "PT2M",
 
460
                        "checker": "fping -q -- %%(host)s",
 
461
                        "host": "",
 
462
                        "approval_delay": "PT0S",
 
463
                        "approval_duration": "PT1S",
 
464
                        "approved_by_default": "True",
 
465
                        "enabled": "True",
 
466
                        }
274
467
    
275
468
    def timeout_milliseconds(self):
276
469
        "Return the 'timeout' attribute in milliseconds"
277
 
        return self._timedelta_to_milliseconds(self.timeout)
 
470
        return timedelta_to_milliseconds(self.timeout)
 
471
    
 
472
    def extended_timeout_milliseconds(self):
 
473
        "Return the 'extended_timeout' attribute in milliseconds"
 
474
        return timedelta_to_milliseconds(self.extended_timeout)
278
475
    
279
476
    def interval_milliseconds(self):
280
477
        "Return the 'interval' attribute in milliseconds"
281
 
        return self._timedelta_to_milliseconds(self.interval)
282
 
 
283
 
    def approved_delay_milliseconds(self):
284
 
        return self._timedelta_to_milliseconds(self.approved_delay)
285
 
    
286
 
    def __init__(self, name = None, disable_hook=None, config=None):
287
 
        """Note: the 'checker' key in 'config' sets the
288
 
        'checker_command' attribute and *not* the 'checker'
289
 
        attribute."""
 
478
        return timedelta_to_milliseconds(self.interval)
 
479
    
 
480
    def approval_delay_milliseconds(self):
 
481
        return timedelta_to_milliseconds(self.approval_delay)
 
482
    
 
483
    @staticmethod
 
484
    def config_parser(config):
 
485
        """Construct a new dict of client settings of this form:
 
486
        { client_name: {setting_name: value, ...}, ...}
 
487
        with exceptions for any special settings as defined above.
 
488
        NOTE: Must be a pure function. Must return the same result
 
489
        value given the same arguments.
 
490
        """
 
491
        settings = {}
 
492
        for client_name in config.sections():
 
493
            section = dict(config.items(client_name))
 
494
            client = settings[client_name] = {}
 
495
            
 
496
            client["host"] = section["host"]
 
497
            # Reformat values from string types to Python types
 
498
            client["approved_by_default"] = config.getboolean(
 
499
                client_name, "approved_by_default")
 
500
            client["enabled"] = config.getboolean(client_name,
 
501
                                                  "enabled")
 
502
            
 
503
            client["fingerprint"] = (section["fingerprint"].upper()
 
504
                                     .replace(" ", ""))
 
505
            if "secret" in section:
 
506
                client["secret"] = section["secret"].decode("base64")
 
507
            elif "secfile" in section:
 
508
                with open(os.path.expanduser(os.path.expandvars
 
509
                                             (section["secfile"])),
 
510
                          "rb") as secfile:
 
511
                    client["secret"] = secfile.read()
 
512
            else:
 
513
                raise TypeError("No secret or secfile for section {0}"
 
514
                                .format(section))
 
515
            client["timeout"] = string_to_delta(section["timeout"])
 
516
            client["extended_timeout"] = string_to_delta(
 
517
                section["extended_timeout"])
 
518
            client["interval"] = string_to_delta(section["interval"])
 
519
            client["approval_delay"] = string_to_delta(
 
520
                section["approval_delay"])
 
521
            client["approval_duration"] = string_to_delta(
 
522
                section["approval_duration"])
 
523
            client["checker_command"] = section["checker"]
 
524
            client["last_approval_request"] = None
 
525
            client["last_checked_ok"] = None
 
526
            client["last_checker_status"] = -2
 
527
        
 
528
        return settings
 
529
    
 
530
    def __init__(self, settings, name = None, server_settings=None):
290
531
        self.name = name
291
 
        if config is None:
292
 
            config = {}
293
 
        logger.debug(u"Creating client %r", self.name)
 
532
        if server_settings is None:
 
533
            server_settings = {}
 
534
        self.server_settings = server_settings
 
535
        # adding all client settings
 
536
        for setting, value in settings.iteritems():
 
537
            setattr(self, setting, value)
 
538
        
 
539
        if self.enabled:
 
540
            if not hasattr(self, "last_enabled"):
 
541
                self.last_enabled = datetime.datetime.utcnow()
 
542
            if not hasattr(self, "expires"):
 
543
                self.expires = (datetime.datetime.utcnow()
 
544
                                + self.timeout)
 
545
        else:
 
546
            self.last_enabled = None
 
547
            self.expires = None
 
548
        
 
549
        logger.debug("Creating client %r", self.name)
294
550
        # Uppercase and remove spaces from fingerprint for later
295
551
        # comparison purposes with return value from the fingerprint()
296
552
        # function
297
 
        self.fingerprint = (config[u"fingerprint"].upper()
298
 
                            .replace(u" ", u""))
299
 
        logger.debug(u"  Fingerprint: %s", self.fingerprint)
300
 
        if u"secret" in config:
301
 
            self.secret = config[u"secret"].decode(u"base64")
302
 
        elif u"secfile" in config:
303
 
            with open(os.path.expanduser(os.path.expandvars
304
 
                                         (config[u"secfile"])),
305
 
                      "rb") as secfile:
306
 
                self.secret = secfile.read()
307
 
        else:
308
 
            raise TypeError(u"No secret or secfile for client %s"
309
 
                            % self.name)
310
 
        self.host = config.get(u"host", u"")
311
 
        self.created = datetime.datetime.utcnow()
312
 
        self.enabled = False
313
 
        self.last_enabled = None
314
 
        self.last_checked_ok = None
315
 
        self.timeout = string_to_delta(config[u"timeout"])
316
 
        self.interval = string_to_delta(config[u"interval"])
317
 
        self.disable_hook = disable_hook
 
553
        logger.debug("  Fingerprint: %s", self.fingerprint)
 
554
        self.created = settings.get("created",
 
555
                                    datetime.datetime.utcnow())
 
556
        
 
557
        # attributes specific for this server instance
318
558
        self.checker = None
319
559
        self.checker_initiator_tag = None
320
560
        self.disable_initiator_tag = None
321
561
        self.checker_callback_tag = None
322
 
        self.checker_command = config[u"checker"]
323
562
        self.current_checker_command = None
324
 
        self.last_connect = None
325
 
        self._approved = None
326
 
        self.approved_by_default = config.get(u"approved_by_default",
327
 
                                              True)
 
563
        self.approved = None
328
564
        self.approvals_pending = 0
329
 
        self.approved_delay = string_to_delta(
330
 
            config[u"approved_delay"])
331
 
        self.approved_duration = string_to_delta(
332
 
            config[u"approved_duration"])
333
 
        self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())
 
565
        self.changedstate = (multiprocessing_manager
 
566
                             .Condition(multiprocessing_manager
 
567
                                        .Lock()))
 
568
        self.client_structure = [attr for attr in
 
569
                                 self.__dict__.iterkeys()
 
570
                                 if not attr.startswith("_")]
 
571
        self.client_structure.append("client_structure")
 
572
        
 
573
        for name, t in inspect.getmembers(type(self),
 
574
                                          lambda obj:
 
575
                                              isinstance(obj,
 
576
                                                         property)):
 
577
            if not name.startswith("_"):
 
578
                self.client_structure.append(name)
334
579
    
 
580
    # Send notice to process children that client state has changed
335
581
    def send_changedstate(self):
336
 
        self.changedstate.acquire()
337
 
        self.changedstate.notify_all()
338
 
        self.changedstate.release()
339
 
        
 
582
        with self.changedstate:
 
583
            self.changedstate.notify_all()
 
584
    
340
585
    def enable(self):
341
586
        """Start this client's checker and timeout hooks"""
342
 
        if getattr(self, u"enabled", False):
 
587
        if getattr(self, "enabled", False):
343
588
            # Already enabled
344
589
            return
345
 
        self.send_changedstate()
 
590
        self.expires = datetime.datetime.utcnow() + self.timeout
 
591
        self.enabled = True
346
592
        self.last_enabled = datetime.datetime.utcnow()
 
593
        self.init_checker()
 
594
        self.send_changedstate()
 
595
    
 
596
    def disable(self, quiet=True):
 
597
        """Disable this client."""
 
598
        if not getattr(self, "enabled", False):
 
599
            return False
 
600
        if not quiet:
 
601
            logger.info("Disabling client %s", self.name)
 
602
        if getattr(self, "disable_initiator_tag", None) is not None:
 
603
            gobject.source_remove(self.disable_initiator_tag)
 
604
            self.disable_initiator_tag = None
 
605
        self.expires = None
 
606
        if getattr(self, "checker_initiator_tag", None) is not None:
 
607
            gobject.source_remove(self.checker_initiator_tag)
 
608
            self.checker_initiator_tag = None
 
609
        self.stop_checker()
 
610
        self.enabled = False
 
611
        if not quiet:
 
612
            self.send_changedstate()
 
613
        # Do not run this again if called by a gobject.timeout_add
 
614
        return False
 
615
    
 
616
    def __del__(self):
 
617
        self.disable()
 
618
    
 
619
    def init_checker(self):
347
620
        # Schedule a new checker to be started an 'interval' from now,
348
621
        # and every interval from then on.
 
622
        if self.checker_initiator_tag is not None:
 
623
            gobject.source_remove(self.checker_initiator_tag)
349
624
        self.checker_initiator_tag = (gobject.timeout_add
350
625
                                      (self.interval_milliseconds(),
351
626
                                       self.start_checker))
352
627
        # Schedule a disable() when 'timeout' has passed
 
628
        if self.disable_initiator_tag is not None:
 
629
            gobject.source_remove(self.disable_initiator_tag)
353
630
        self.disable_initiator_tag = (gobject.timeout_add
354
631
                                   (self.timeout_milliseconds(),
355
632
                                    self.disable))
356
 
        self.enabled = True
357
633
        # Also start a new checker *right now*.
358
634
        self.start_checker()
359
635
    
360
 
    def disable(self, quiet=True):
361
 
        """Disable this client."""
362
 
        if not getattr(self, "enabled", False):
363
 
            return False
364
 
        if not quiet:
365
 
            self.send_changedstate()
366
 
        if not quiet:
367
 
            logger.info(u"Disabling client %s", self.name)
368
 
        if getattr(self, u"disable_initiator_tag", False):
369
 
            gobject.source_remove(self.disable_initiator_tag)
370
 
            self.disable_initiator_tag = None
371
 
        if getattr(self, u"checker_initiator_tag", False):
372
 
            gobject.source_remove(self.checker_initiator_tag)
373
 
            self.checker_initiator_tag = None
374
 
        self.stop_checker()
375
 
        if self.disable_hook:
376
 
            self.disable_hook(self)
377
 
        self.enabled = False
378
 
        # Do not run this again if called by a gobject.timeout_add
379
 
        return False
380
 
    
381
 
    def __del__(self):
382
 
        self.disable_hook = None
383
 
        self.disable()
384
 
    
385
636
    def checker_callback(self, pid, condition, command):
386
637
        """The checker has completed, so take appropriate actions."""
387
638
        self.checker_callback_tag = None
388
639
        self.checker = None
389
640
        if os.WIFEXITED(condition):
390
 
            exitstatus = os.WEXITSTATUS(condition)
391
 
            if exitstatus == 0:
392
 
                logger.info(u"Checker for %(name)s succeeded",
 
641
            self.last_checker_status = os.WEXITSTATUS(condition)
 
642
            if self.last_checker_status == 0:
 
643
                logger.info("Checker for %(name)s succeeded",
393
644
                            vars(self))
394
645
                self.checked_ok()
395
646
            else:
396
 
                logger.info(u"Checker for %(name)s failed",
 
647
                logger.info("Checker for %(name)s failed",
397
648
                            vars(self))
398
649
        else:
399
 
            logger.warning(u"Checker for %(name)s crashed?",
 
650
            self.last_checker_status = -1
 
651
            logger.warning("Checker for %(name)s crashed?",
400
652
                           vars(self))
401
653
    
402
654
    def checked_ok(self):
403
 
        """Bump up the timeout for this client.
404
 
        
405
 
        This should only be called when the client has been seen,
406
 
        alive and well.
407
 
        """
 
655
        """Assert that the client has been seen, alive and well."""
408
656
        self.last_checked_ok = datetime.datetime.utcnow()
409
 
        gobject.source_remove(self.disable_initiator_tag)
410
 
        self.disable_initiator_tag = (gobject.timeout_add
411
 
                                      (self.timeout_milliseconds(),
412
 
                                       self.disable))
 
657
        self.last_checker_status = 0
 
658
        self.bump_timeout()
 
659
    
 
660
    def bump_timeout(self, timeout=None):
 
661
        """Bump up the timeout for this client."""
 
662
        if timeout is None:
 
663
            timeout = self.timeout
 
664
        if self.disable_initiator_tag is not None:
 
665
            gobject.source_remove(self.disable_initiator_tag)
 
666
            self.disable_initiator_tag = None
 
667
        if getattr(self, "enabled", False):
 
668
            self.disable_initiator_tag = (gobject.timeout_add
 
669
                                          (timedelta_to_milliseconds
 
670
                                           (timeout), self.disable))
 
671
            self.expires = datetime.datetime.utcnow() + timeout
 
672
    
 
673
    def need_approval(self):
 
674
        self.last_approval_request = datetime.datetime.utcnow()
413
675
    
414
676
    def start_checker(self):
415
677
        """Start a new checker subprocess if one is not running.
417
679
        If a checker already exists, leave it running and do
418
680
        nothing."""
419
681
        # The reason for not killing a running checker is that if we
420
 
        # did that, then if a checker (for some reason) started
421
 
        # running slowly and taking more than 'interval' time, the
422
 
        # client would inevitably timeout, since no checker would get
423
 
        # a chance to run to completion.  If we instead leave running
 
682
        # did that, and if a checker (for some reason) started running
 
683
        # slowly and taking more than 'interval' time, then the client
 
684
        # would inevitably timeout, since no checker would get a
 
685
        # chance to run to completion.  If we instead leave running
424
686
        # checkers alone, the checker would have to take more time
425
687
        # than 'timeout' for the client to be disabled, which is as it
426
688
        # should be.
428
690
        # If a checker exists, make sure it is not a zombie
429
691
        try:
430
692
            pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
431
 
        except (AttributeError, OSError), error:
 
693
        except (AttributeError, OSError) as error:
432
694
            if (isinstance(error, OSError)
433
695
                and error.errno != errno.ECHILD):
434
696
                raise error
435
697
        else:
436
698
            if pid:
437
 
                logger.warning(u"Checker was a zombie")
 
699
                logger.warning("Checker was a zombie")
438
700
                gobject.source_remove(self.checker_callback_tag)
439
701
                self.checker_callback(pid, status,
440
702
                                      self.current_checker_command)
441
703
        # Start a new checker if needed
442
704
        if self.checker is None:
 
705
            # Escape attributes for the shell
 
706
            escaped_attrs = dict(
 
707
                (attr, re.escape(unicode(getattr(self, attr))))
 
708
                for attr in
 
709
                self.runtime_expansions)
443
710
            try:
444
 
                # In case checker_command has exactly one % operator
445
 
                command = self.checker_command % self.host
446
 
            except TypeError:
447
 
                # Escape attributes for the shell
448
 
                escaped_attrs = dict((key,
449
 
                                      re.escape(unicode(str(val),
450
 
                                                        errors=
451
 
                                                        u'replace')))
452
 
                                     for key, val in
453
 
                                     vars(self).iteritems())
454
 
                try:
455
 
                    command = self.checker_command % escaped_attrs
456
 
                except TypeError, error:
457
 
                    logger.error(u'Could not format string "%s":'
458
 
                                 u' %s', self.checker_command, error)
459
 
                    return True # Try again later
 
711
                command = self.checker_command % escaped_attrs
 
712
            except TypeError as error:
 
713
                logger.error('Could not format string "%s"',
 
714
                             self.checker_command, exc_info=error)
 
715
                return True # Try again later
460
716
            self.current_checker_command = command
461
717
            try:
462
 
                logger.info(u"Starting checker %r for %s",
 
718
                logger.info("Starting checker %r for %s",
463
719
                            command, self.name)
464
720
                # We don't need to redirect stdout and stderr, since
465
721
                # in normal mode, that is already done by daemon(),
466
722
                # and in debug mode we don't want to.  (Stdin is
467
723
                # always replaced by /dev/null.)
 
724
                # The exception is when not debugging but nevertheless
 
725
                # running in the foreground; use the previously
 
726
                # created wnull.
 
727
                popen_args = {}
 
728
                if (not self.server_settings["debug"]
 
729
                    and self.server_settings["foreground"]):
 
730
                    popen_args.update({"stdout": wnull,
 
731
                                       "stderr": wnull })
468
732
                self.checker = subprocess.Popen(command,
469
733
                                                close_fds=True,
470
 
                                                shell=True, cwd=u"/")
471
 
                self.checker_callback_tag = (gobject.child_watch_add
472
 
                                             (self.checker.pid,
473
 
                                              self.checker_callback,
474
 
                                              data=command))
475
 
                # The checker may have completed before the gobject
476
 
                # watch was added.  Check for this.
 
734
                                                shell=True, cwd="/",
 
735
                                                **popen_args)
 
736
            except OSError as error:
 
737
                logger.error("Failed to start subprocess",
 
738
                             exc_info=error)
 
739
                return True
 
740
            self.checker_callback_tag = (gobject.child_watch_add
 
741
                                         (self.checker.pid,
 
742
                                          self.checker_callback,
 
743
                                          data=command))
 
744
            # The checker may have completed before the gobject
 
745
            # watch was added.  Check for this.
 
746
            try:
477
747
                pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
478
 
                if pid:
479
 
                    gobject.source_remove(self.checker_callback_tag)
480
 
                    self.checker_callback(pid, status, command)
481
 
            except OSError, error:
482
 
                logger.error(u"Failed to start subprocess: %s",
483
 
                             error)
 
748
            except OSError as error:
 
749
                if error.errno == errno.ECHILD:
 
750
                    # This should never happen
 
751
                    logger.error("Child process vanished",
 
752
                                 exc_info=error)
 
753
                    return True
 
754
                raise
 
755
            if pid:
 
756
                gobject.source_remove(self.checker_callback_tag)
 
757
                self.checker_callback(pid, status, command)
484
758
        # Re-run this periodically if run by gobject.timeout_add
485
759
        return True
486
760
    
489
763
        if self.checker_callback_tag:
490
764
            gobject.source_remove(self.checker_callback_tag)
491
765
            self.checker_callback_tag = None
492
 
        if getattr(self, u"checker", None) is None:
 
766
        if getattr(self, "checker", None) is None:
493
767
            return
494
 
        logger.debug(u"Stopping checker for %(name)s", vars(self))
 
768
        logger.debug("Stopping checker for %(name)s", vars(self))
495
769
        try:
496
 
            os.kill(self.checker.pid, signal.SIGTERM)
 
770
            self.checker.terminate()
497
771
            #time.sleep(0.5)
498
772
            #if self.checker.poll() is None:
499
 
            #    os.kill(self.checker.pid, signal.SIGKILL)
500
 
        except OSError, error:
 
773
            #    self.checker.kill()
 
774
        except OSError as error:
501
775
            if error.errno != errno.ESRCH: # No such process
502
776
                raise
503
777
        self.checker = None
504
778
 
505
 
def dbus_service_property(dbus_interface, signature=u"v",
506
 
                          access=u"readwrite", byte_arrays=False):
 
779
 
 
780
def dbus_service_property(dbus_interface, signature="v",
 
781
                          access="readwrite", byte_arrays=False):
507
782
    """Decorators for marking methods of a DBusObjectWithProperties to
508
783
    become properties on the D-Bus.
509
784
    
516
791
    """
517
792
    # Encoding deeply encoded byte arrays is not supported yet by the
518
793
    # "Set" method, so we fail early here:
519
 
    if byte_arrays and signature != u"ay":
520
 
        raise ValueError(u"Byte arrays not supported for non-'ay'"
521
 
                         u" signature %r" % signature)
 
794
    if byte_arrays and signature != "ay":
 
795
        raise ValueError("Byte arrays not supported for non-'ay'"
 
796
                         " signature {0!r}".format(signature))
522
797
    def decorator(func):
523
798
        func._dbus_is_property = True
524
799
        func._dbus_interface = dbus_interface
525
800
        func._dbus_signature = signature
526
801
        func._dbus_access = access
527
802
        func._dbus_name = func.__name__
528
 
        if func._dbus_name.endswith(u"_dbus_property"):
 
803
        if func._dbus_name.endswith("_dbus_property"):
529
804
            func._dbus_name = func._dbus_name[:-14]
530
 
        func._dbus_get_args_options = {u'byte_arrays': byte_arrays }
 
805
        func._dbus_get_args_options = {'byte_arrays': byte_arrays }
 
806
        return func
 
807
    return decorator
 
808
 
 
809
 
 
810
def dbus_interface_annotations(dbus_interface):
 
811
    """Decorator for marking functions returning interface annotations
 
812
    
 
813
    Usage:
 
814
    
 
815
    @dbus_interface_annotations("org.example.Interface")
 
816
    def _foo(self):  # Function name does not matter
 
817
        return {"org.freedesktop.DBus.Deprecated": "true",
 
818
                "org.freedesktop.DBus.Property.EmitsChangedSignal":
 
819
                    "false"}
 
820
    """
 
821
    def decorator(func):
 
822
        func._dbus_is_interface = True
 
823
        func._dbus_interface = dbus_interface
 
824
        func._dbus_name = dbus_interface
 
825
        return func
 
826
    return decorator
 
827
 
 
828
 
 
829
def dbus_annotations(annotations):
 
830
    """Decorator to annotate D-Bus methods, signals or properties
 
831
    Usage:
 
832
    
 
833
    @dbus_service_property("org.example.Interface", signature="b",
 
834
                           access="r")
 
835
    @dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",
 
836
                        "org.freedesktop.DBus.Property."
 
837
                        "EmitsChangedSignal": "false"})
 
838
    def Property_dbus_property(self):
 
839
        return dbus.Boolean(False)
 
840
    """
 
841
    def decorator(func):
 
842
        func._dbus_annotations = annotations
531
843
        return func
532
844
    return decorator
533
845
 
553
865
 
554
866
class DBusObjectWithProperties(dbus.service.Object):
555
867
    """A D-Bus object with properties.
556
 
 
 
868
    
557
869
    Classes inheriting from this can use the dbus_service_property
558
870
    decorator to expose methods as D-Bus properties.  It exposes the
559
871
    standard Get(), Set(), and GetAll() methods on the D-Bus.
560
872
    """
561
873
    
562
874
    @staticmethod
563
 
    def _is_dbus_property(obj):
564
 
        return getattr(obj, u"_dbus_is_property", False)
 
875
    def _is_dbus_thing(thing):
 
876
        """Returns a function testing if an attribute is a D-Bus thing
 
877
        
 
878
        If called like _is_dbus_thing("method") it returns a function
 
879
        suitable for use as predicate to inspect.getmembers().
 
880
        """
 
881
        return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),
 
882
                                   False)
565
883
    
566
 
    def _get_all_dbus_properties(self):
 
884
    def _get_all_dbus_things(self, thing):
567
885
        """Returns a generator of (name, attribute) pairs
568
886
        """
569
 
        return ((prop._dbus_name, prop)
570
 
                for name, prop in
571
 
                inspect.getmembers(self, self._is_dbus_property))
 
887
        return ((getattr(athing.__get__(self), "_dbus_name",
 
888
                         name),
 
889
                 athing.__get__(self))
 
890
                for cls in self.__class__.__mro__
 
891
                for name, athing in
 
892
                inspect.getmembers(cls,
 
893
                                   self._is_dbus_thing(thing)))
572
894
    
573
895
    def _get_dbus_property(self, interface_name, property_name):
574
896
        """Returns a bound method if one exists which is a D-Bus
575
897
        property with the specified name and interface.
576
898
        """
577
 
        for name in (property_name,
578
 
                     property_name + u"_dbus_property"):
579
 
            prop = getattr(self, name, None)
580
 
            if (prop is None
581
 
                or not self._is_dbus_property(prop)
582
 
                or prop._dbus_name != property_name
583
 
                or (interface_name and prop._dbus_interface
584
 
                    and interface_name != prop._dbus_interface)):
585
 
                continue
586
 
            return prop
 
899
        for cls in  self.__class__.__mro__:
 
900
            for name, value in (inspect.getmembers
 
901
                                (cls,
 
902
                                 self._is_dbus_thing("property"))):
 
903
                if (value._dbus_name == property_name
 
904
                    and value._dbus_interface == interface_name):
 
905
                    return value.__get__(self)
 
906
        
587
907
        # No such property
588
 
        raise DBusPropertyNotFound(self.dbus_object_path + u":"
589
 
                                   + interface_name + u"."
 
908
        raise DBusPropertyNotFound(self.dbus_object_path + ":"
 
909
                                   + interface_name + "."
590
910
                                   + property_name)
591
911
    
592
 
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ss",
593
 
                         out_signature=u"v")
 
912
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
 
913
                         out_signature="v")
594
914
    def Get(self, interface_name, property_name):
595
915
        """Standard D-Bus property Get() method, see D-Bus standard.
596
916
        """
597
917
        prop = self._get_dbus_property(interface_name, property_name)
598
 
        if prop._dbus_access == u"write":
 
918
        if prop._dbus_access == "write":
599
919
            raise DBusPropertyAccessException(property_name)
600
920
        value = prop()
601
 
        if not hasattr(value, u"variant_level"):
 
921
        if not hasattr(value, "variant_level"):
602
922
            return value
603
923
        return type(value)(value, variant_level=value.variant_level+1)
604
924
    
605
 
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ssv")
 
925
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
606
926
    def Set(self, interface_name, property_name, value):
607
927
        """Standard D-Bus property Set() method, see D-Bus standard.
608
928
        """
609
929
        prop = self._get_dbus_property(interface_name, property_name)
610
 
        if prop._dbus_access == u"read":
 
930
        if prop._dbus_access == "read":
611
931
            raise DBusPropertyAccessException(property_name)
612
 
        if prop._dbus_get_args_options[u"byte_arrays"]:
 
932
        if prop._dbus_get_args_options["byte_arrays"]:
613
933
            # The byte_arrays option is not supported yet on
614
934
            # signatures other than "ay".
615
 
            if prop._dbus_signature != u"ay":
 
935
            if prop._dbus_signature != "ay":
616
936
                raise ValueError
617
 
            value = dbus.ByteArray(''.join(unichr(byte)
618
 
                                           for byte in value))
 
937
            value = dbus.ByteArray(b''.join(chr(byte)
 
938
                                            for byte in value))
619
939
        prop(value)
620
940
    
621
 
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"s",
622
 
                         out_signature=u"a{sv}")
 
941
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
 
942
                         out_signature="a{sv}")
623
943
    def GetAll(self, interface_name):
624
944
        """Standard D-Bus property GetAll() method, see D-Bus
625
945
        standard.
626
 
 
 
946
        
627
947
        Note: Will not include properties with access="write".
628
948
        """
629
 
        all = {}
630
 
        for name, prop in self._get_all_dbus_properties():
 
949
        properties = {}
 
950
        for name, prop in self._get_all_dbus_things("property"):
631
951
            if (interface_name
632
952
                and interface_name != prop._dbus_interface):
633
953
                # Interface non-empty but did not match
634
954
                continue
635
955
            # Ignore write-only properties
636
 
            if prop._dbus_access == u"write":
 
956
            if prop._dbus_access == "write":
637
957
                continue
638
958
            value = prop()
639
 
            if not hasattr(value, u"variant_level"):
640
 
                all[name] = value
 
959
            if not hasattr(value, "variant_level"):
 
960
                properties[name] = value
641
961
                continue
642
 
            all[name] = type(value)(value, variant_level=
643
 
                                    value.variant_level+1)
644
 
        return dbus.Dictionary(all, signature=u"sv")
 
962
            properties[name] = type(value)(value, variant_level=
 
963
                                           value.variant_level+1)
 
964
        return dbus.Dictionary(properties, signature="sv")
645
965
    
646
966
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
647
 
                         out_signature=u"s",
 
967
                         out_signature="s",
648
968
                         path_keyword='object_path',
649
969
                         connection_keyword='connection')
650
970
    def Introspect(self, object_path, connection):
651
 
        """Standard D-Bus method, overloaded to insert property tags.
 
971
        """Overloading of standard D-Bus method.
 
972
        
 
973
        Inserts property tags and interface annotation tags.
652
974
        """
653
975
        xmlstring = dbus.service.Object.Introspect(self, object_path,
654
976
                                                   connection)
655
977
        try:
656
978
            document = xml.dom.minidom.parseString(xmlstring)
657
979
            def make_tag(document, name, prop):
658
 
                e = document.createElement(u"property")
659
 
                e.setAttribute(u"name", name)
660
 
                e.setAttribute(u"type", prop._dbus_signature)
661
 
                e.setAttribute(u"access", prop._dbus_access)
 
980
                e = document.createElement("property")
 
981
                e.setAttribute("name", name)
 
982
                e.setAttribute("type", prop._dbus_signature)
 
983
                e.setAttribute("access", prop._dbus_access)
662
984
                return e
663
 
            for if_tag in document.getElementsByTagName(u"interface"):
 
985
            for if_tag in document.getElementsByTagName("interface"):
 
986
                # Add property tags
664
987
                for tag in (make_tag(document, name, prop)
665
988
                            for name, prop
666
 
                            in self._get_all_dbus_properties()
 
989
                            in self._get_all_dbus_things("property")
667
990
                            if prop._dbus_interface
668
 
                            == if_tag.getAttribute(u"name")):
 
991
                            == if_tag.getAttribute("name")):
669
992
                    if_tag.appendChild(tag)
 
993
                # Add annotation tags
 
994
                for typ in ("method", "signal", "property"):
 
995
                    for tag in if_tag.getElementsByTagName(typ):
 
996
                        annots = dict()
 
997
                        for name, prop in (self.
 
998
                                           _get_all_dbus_things(typ)):
 
999
                            if (name == tag.getAttribute("name")
 
1000
                                and prop._dbus_interface
 
1001
                                == if_tag.getAttribute("name")):
 
1002
                                annots.update(getattr
 
1003
                                              (prop,
 
1004
                                               "_dbus_annotations",
 
1005
                                               {}))
 
1006
                        for name, value in annots.iteritems():
 
1007
                            ann_tag = document.createElement(
 
1008
                                "annotation")
 
1009
                            ann_tag.setAttribute("name", name)
 
1010
                            ann_tag.setAttribute("value", value)
 
1011
                            tag.appendChild(ann_tag)
 
1012
                # Add interface annotation tags
 
1013
                for annotation, value in dict(
 
1014
                    itertools.chain.from_iterable(
 
1015
                        annotations().iteritems()
 
1016
                        for name, annotations in
 
1017
                        self._get_all_dbus_things("interface")
 
1018
                        if name == if_tag.getAttribute("name")
 
1019
                        )).iteritems():
 
1020
                    ann_tag = document.createElement("annotation")
 
1021
                    ann_tag.setAttribute("name", annotation)
 
1022
                    ann_tag.setAttribute("value", value)
 
1023
                    if_tag.appendChild(ann_tag)
670
1024
                # Add the names to the return values for the
671
1025
                # "org.freedesktop.DBus.Properties" methods
672
 
                if (if_tag.getAttribute(u"name")
673
 
                    == u"org.freedesktop.DBus.Properties"):
674
 
                    for cn in if_tag.getElementsByTagName(u"method"):
675
 
                        if cn.getAttribute(u"name") == u"Get":
676
 
                            for arg in cn.getElementsByTagName(u"arg"):
677
 
                                if (arg.getAttribute(u"direction")
678
 
                                    == u"out"):
679
 
                                    arg.setAttribute(u"name", u"value")
680
 
                        elif cn.getAttribute(u"name") == u"GetAll":
681
 
                            for arg in cn.getElementsByTagName(u"arg"):
682
 
                                if (arg.getAttribute(u"direction")
683
 
                                    == u"out"):
684
 
                                    arg.setAttribute(u"name", u"props")
685
 
            xmlstring = document.toxml(u"utf-8")
 
1026
                if (if_tag.getAttribute("name")
 
1027
                    == "org.freedesktop.DBus.Properties"):
 
1028
                    for cn in if_tag.getElementsByTagName("method"):
 
1029
                        if cn.getAttribute("name") == "Get":
 
1030
                            for arg in cn.getElementsByTagName("arg"):
 
1031
                                if (arg.getAttribute("direction")
 
1032
                                    == "out"):
 
1033
                                    arg.setAttribute("name", "value")
 
1034
                        elif cn.getAttribute("name") == "GetAll":
 
1035
                            for arg in cn.getElementsByTagName("arg"):
 
1036
                                if (arg.getAttribute("direction")
 
1037
                                    == "out"):
 
1038
                                    arg.setAttribute("name", "props")
 
1039
            xmlstring = document.toxml("utf-8")
686
1040
            document.unlink()
687
1041
        except (AttributeError, xml.dom.DOMException,
688
 
                xml.parsers.expat.ExpatError), error:
689
 
            logger.error(u"Failed to override Introspection method",
690
 
                         error)
 
1042
                xml.parsers.expat.ExpatError) as error:
 
1043
            logger.error("Failed to override Introspection method",
 
1044
                         exc_info=error)
691
1045
        return xmlstring
692
1046
 
693
1047
 
 
1048
def datetime_to_dbus(dt, variant_level=0):
 
1049
    """Convert a UTC datetime.datetime() to a D-Bus type."""
 
1050
    if dt is None:
 
1051
        return dbus.String("", variant_level = variant_level)
 
1052
    return dbus.String(dt.isoformat(),
 
1053
                       variant_level=variant_level)
 
1054
 
 
1055
 
 
1056
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
 
1057
    """A class decorator; applied to a subclass of
 
1058
    dbus.service.Object, it will add alternate D-Bus attributes with
 
1059
    interface names according to the "alt_interface_names" mapping.
 
1060
    Usage:
 
1061
    
 
1062
    @alternate_dbus_interfaces({"org.example.Interface":
 
1063
                                    "net.example.AlternateInterface"})
 
1064
    class SampleDBusObject(dbus.service.Object):
 
1065
        @dbus.service.method("org.example.Interface")
 
1066
        def SampleDBusMethod():
 
1067
            pass
 
1068
    
 
1069
    The above "SampleDBusMethod" on "SampleDBusObject" will be
 
1070
    reachable via two interfaces: "org.example.Interface" and
 
1071
    "net.example.AlternateInterface", the latter of which will have
 
1072
    its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
 
1073
    "true", unless "deprecate" is passed with a False value.
 
1074
    
 
1075
    This works for methods and signals, and also for D-Bus properties
 
1076
    (from DBusObjectWithProperties) and interfaces (from the
 
1077
    dbus_interface_annotations decorator).
 
1078
    """
 
1079
    def wrapper(cls):
 
1080
        for orig_interface_name, alt_interface_name in (
 
1081
            alt_interface_names.iteritems()):
 
1082
            attr = {}
 
1083
            interface_names = set()
 
1084
            # Go though all attributes of the class
 
1085
            for attrname, attribute in inspect.getmembers(cls):
 
1086
                # Ignore non-D-Bus attributes, and D-Bus attributes
 
1087
                # with the wrong interface name
 
1088
                if (not hasattr(attribute, "_dbus_interface")
 
1089
                    or not attribute._dbus_interface
 
1090
                    .startswith(orig_interface_name)):
 
1091
                    continue
 
1092
                # Create an alternate D-Bus interface name based on
 
1093
                # the current name
 
1094
                alt_interface = (attribute._dbus_interface
 
1095
                                 .replace(orig_interface_name,
 
1096
                                          alt_interface_name))
 
1097
                interface_names.add(alt_interface)
 
1098
                # Is this a D-Bus signal?
 
1099
                if getattr(attribute, "_dbus_is_signal", False):
 
1100
                    # Extract the original non-method undecorated
 
1101
                    # function by black magic
 
1102
                    nonmethod_func = (dict(
 
1103
                            zip(attribute.func_code.co_freevars,
 
1104
                                attribute.__closure__))["func"]
 
1105
                                      .cell_contents)
 
1106
                    # Create a new, but exactly alike, function
 
1107
                    # object, and decorate it to be a new D-Bus signal
 
1108
                    # with the alternate D-Bus interface name
 
1109
                    new_function = (dbus.service.signal
 
1110
                                    (alt_interface,
 
1111
                                     attribute._dbus_signature)
 
1112
                                    (types.FunctionType(
 
1113
                                nonmethod_func.func_code,
 
1114
                                nonmethod_func.func_globals,
 
1115
                                nonmethod_func.func_name,
 
1116
                                nonmethod_func.func_defaults,
 
1117
                                nonmethod_func.func_closure)))
 
1118
                    # Copy annotations, if any
 
1119
                    try:
 
1120
                        new_function._dbus_annotations = (
 
1121
                            dict(attribute._dbus_annotations))
 
1122
                    except AttributeError:
 
1123
                        pass
 
1124
                    # Define a creator of a function to call both the
 
1125
                    # original and alternate functions, so both the
 
1126
                    # original and alternate signals gets sent when
 
1127
                    # the function is called
 
1128
                    def fixscope(func1, func2):
 
1129
                        """This function is a scope container to pass
 
1130
                        func1 and func2 to the "call_both" function
 
1131
                        outside of its arguments"""
 
1132
                        def call_both(*args, **kwargs):
 
1133
                            """This function will emit two D-Bus
 
1134
                            signals by calling func1 and func2"""
 
1135
                            func1(*args, **kwargs)
 
1136
                            func2(*args, **kwargs)
 
1137
                        return call_both
 
1138
                    # Create the "call_both" function and add it to
 
1139
                    # the class
 
1140
                    attr[attrname] = fixscope(attribute, new_function)
 
1141
                # Is this a D-Bus method?
 
1142
                elif getattr(attribute, "_dbus_is_method", False):
 
1143
                    # Create a new, but exactly alike, function
 
1144
                    # object.  Decorate it to be a new D-Bus method
 
1145
                    # with the alternate D-Bus interface name.  Add it
 
1146
                    # to the class.
 
1147
                    attr[attrname] = (dbus.service.method
 
1148
                                      (alt_interface,
 
1149
                                       attribute._dbus_in_signature,
 
1150
                                       attribute._dbus_out_signature)
 
1151
                                      (types.FunctionType
 
1152
                                       (attribute.func_code,
 
1153
                                        attribute.func_globals,
 
1154
                                        attribute.func_name,
 
1155
                                        attribute.func_defaults,
 
1156
                                        attribute.func_closure)))
 
1157
                    # Copy annotations, if any
 
1158
                    try:
 
1159
                        attr[attrname]._dbus_annotations = (
 
1160
                            dict(attribute._dbus_annotations))
 
1161
                    except AttributeError:
 
1162
                        pass
 
1163
                # Is this a D-Bus property?
 
1164
                elif getattr(attribute, "_dbus_is_property", False):
 
1165
                    # Create a new, but exactly alike, function
 
1166
                    # object, and decorate it to be a new D-Bus
 
1167
                    # property with the alternate D-Bus interface
 
1168
                    # name.  Add it to the class.
 
1169
                    attr[attrname] = (dbus_service_property
 
1170
                                      (alt_interface,
 
1171
                                       attribute._dbus_signature,
 
1172
                                       attribute._dbus_access,
 
1173
                                       attribute
 
1174
                                       ._dbus_get_args_options
 
1175
                                       ["byte_arrays"])
 
1176
                                      (types.FunctionType
 
1177
                                       (attribute.func_code,
 
1178
                                        attribute.func_globals,
 
1179
                                        attribute.func_name,
 
1180
                                        attribute.func_defaults,
 
1181
                                        attribute.func_closure)))
 
1182
                    # Copy annotations, if any
 
1183
                    try:
 
1184
                        attr[attrname]._dbus_annotations = (
 
1185
                            dict(attribute._dbus_annotations))
 
1186
                    except AttributeError:
 
1187
                        pass
 
1188
                # Is this a D-Bus interface?
 
1189
                elif getattr(attribute, "_dbus_is_interface", False):
 
1190
                    # Create a new, but exactly alike, function
 
1191
                    # object.  Decorate it to be a new D-Bus interface
 
1192
                    # with the alternate D-Bus interface name.  Add it
 
1193
                    # to the class.
 
1194
                    attr[attrname] = (dbus_interface_annotations
 
1195
                                      (alt_interface)
 
1196
                                      (types.FunctionType
 
1197
                                       (attribute.func_code,
 
1198
                                        attribute.func_globals,
 
1199
                                        attribute.func_name,
 
1200
                                        attribute.func_defaults,
 
1201
                                        attribute.func_closure)))
 
1202
            if deprecate:
 
1203
                # Deprecate all alternate interfaces
 
1204
                iname="_AlternateDBusNames_interface_annotation{0}"
 
1205
                for interface_name in interface_names:
 
1206
                    @dbus_interface_annotations(interface_name)
 
1207
                    def func(self):
 
1208
                        return { "org.freedesktop.DBus.Deprecated":
 
1209
                                     "true" }
 
1210
                    # Find an unused name
 
1211
                    for aname in (iname.format(i)
 
1212
                                  for i in itertools.count()):
 
1213
                        if aname not in attr:
 
1214
                            attr[aname] = func
 
1215
                            break
 
1216
            if interface_names:
 
1217
                # Replace the class with a new subclass of it with
 
1218
                # methods, signals, etc. as created above.
 
1219
                cls = type(b"{0}Alternate".format(cls.__name__),
 
1220
                           (cls,), attr)
 
1221
        return cls
 
1222
    return wrapper
 
1223
 
 
1224
 
 
1225
@alternate_dbus_interfaces({"se.recompile.Mandos":
 
1226
                                "se.bsnet.fukt.Mandos"})
694
1227
class ClientDBus(Client, DBusObjectWithProperties):
695
1228
    """A Client class using D-Bus
696
1229
    
698
1231
    dbus_object_path: dbus.ObjectPath
699
1232
    bus: dbus.SystemBus()
700
1233
    """
 
1234
    
 
1235
    runtime_expansions = (Client.runtime_expansions
 
1236
                          + ("dbus_object_path",))
 
1237
    
701
1238
    # dbus.service.Object doesn't use super(), so we can't either.
702
1239
    
703
1240
    def __init__(self, bus = None, *args, **kwargs):
704
 
        self._approvals_pending = 0
705
1241
        self.bus = bus
706
1242
        Client.__init__(self, *args, **kwargs)
707
1243
        # Only now, when this client is initialized, can it show up on
708
1244
        # the D-Bus
 
1245
        client_object_name = unicode(self.name).translate(
 
1246
            {ord("."): ord("_"),
 
1247
             ord("-"): ord("_")})
709
1248
        self.dbus_object_path = (dbus.ObjectPath
710
 
                                 (u"/clients/"
711
 
                                  + self.name.replace(u".", u"_")))
 
1249
                                 ("/clients/" + client_object_name))
712
1250
        DBusObjectWithProperties.__init__(self, self.bus,
713
1251
                                          self.dbus_object_path)
714
 
 
715
 
    def _get_approvals_pending(self):
716
 
        return self._approvals_pending
717
 
    def _set_approvals_pending(self, value):
718
 
        old_value = self._approvals_pending
719
 
        self._approvals_pending = value
720
 
        bval = bool(value)
721
 
        if (hasattr(self, "dbus_object_path")
722
 
            and bval is not bool(old_value)):
723
 
            dbus_bool = dbus.Boolean(bval, variant_level=1)
724
 
            self.PropertyChanged(dbus.String(u"approved_pending"),
725
 
                                 dbus_bool)
726
 
 
727
 
    approvals_pending = property(_get_approvals_pending,
728
 
                                 _set_approvals_pending)
729
 
    del _get_approvals_pending, _set_approvals_pending
730
 
    
731
 
    @staticmethod
732
 
    def _datetime_to_dbus(dt, variant_level=0):
733
 
        """Convert a UTC datetime.datetime() to a D-Bus type."""
734
 
        return dbus.String(dt.isoformat(),
735
 
                           variant_level=variant_level)
736
 
    
737
 
    def enable(self):
738
 
        oldstate = getattr(self, u"enabled", False)
739
 
        r = Client.enable(self)
740
 
        if oldstate != self.enabled:
741
 
            # Emit D-Bus signals
742
 
            self.PropertyChanged(dbus.String(u"enabled"),
743
 
                                 dbus.Boolean(True, variant_level=1))
744
 
            self.PropertyChanged(
745
 
                dbus.String(u"last_enabled"),
746
 
                self._datetime_to_dbus(self.last_enabled,
747
 
                                       variant_level=1))
748
 
        return r
749
 
    
750
 
    def disable(self, quiet = False):
751
 
        oldstate = getattr(self, u"enabled", False)
752
 
        r = Client.disable(self, quiet=quiet)
753
 
        if not quiet and oldstate != self.enabled:
754
 
            # Emit D-Bus signal
755
 
            self.PropertyChanged(dbus.String(u"enabled"),
756
 
                                 dbus.Boolean(False, variant_level=1))
757
 
        return r
 
1252
    
 
1253
    def notifychangeproperty(transform_func,
 
1254
                             dbus_name, type_func=lambda x: x,
 
1255
                             variant_level=1):
 
1256
        """ Modify a variable so that it's a property which announces
 
1257
        its changes to DBus.
 
1258
        
 
1259
        transform_fun: Function that takes a value and a variant_level
 
1260
                       and transforms it to a D-Bus type.
 
1261
        dbus_name: D-Bus name of the variable
 
1262
        type_func: Function that transform the value before sending it
 
1263
                   to the D-Bus.  Default: no transform
 
1264
        variant_level: D-Bus variant level.  Default: 1
 
1265
        """
 
1266
        attrname = "_{0}".format(dbus_name)
 
1267
        def setter(self, value):
 
1268
            if hasattr(self, "dbus_object_path"):
 
1269
                if (not hasattr(self, attrname) or
 
1270
                    type_func(getattr(self, attrname, None))
 
1271
                    != type_func(value)):
 
1272
                    dbus_value = transform_func(type_func(value),
 
1273
                                                variant_level
 
1274
                                                =variant_level)
 
1275
                    self.PropertyChanged(dbus.String(dbus_name),
 
1276
                                         dbus_value)
 
1277
            setattr(self, attrname, value)
 
1278
        
 
1279
        return property(lambda self: getattr(self, attrname), setter)
 
1280
    
 
1281
    expires = notifychangeproperty(datetime_to_dbus, "Expires")
 
1282
    approvals_pending = notifychangeproperty(dbus.Boolean,
 
1283
                                             "ApprovalPending",
 
1284
                                             type_func = bool)
 
1285
    enabled = notifychangeproperty(dbus.Boolean, "Enabled")
 
1286
    last_enabled = notifychangeproperty(datetime_to_dbus,
 
1287
                                        "LastEnabled")
 
1288
    checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",
 
1289
                                   type_func = lambda checker:
 
1290
                                       checker is not None)
 
1291
    last_checked_ok = notifychangeproperty(datetime_to_dbus,
 
1292
                                           "LastCheckedOK")
 
1293
    last_checker_status = notifychangeproperty(dbus.Int16,
 
1294
                                               "LastCheckerStatus")
 
1295
    last_approval_request = notifychangeproperty(
 
1296
        datetime_to_dbus, "LastApprovalRequest")
 
1297
    approved_by_default = notifychangeproperty(dbus.Boolean,
 
1298
                                               "ApprovedByDefault")
 
1299
    approval_delay = notifychangeproperty(dbus.UInt64,
 
1300
                                          "ApprovalDelay",
 
1301
                                          type_func =
 
1302
                                          timedelta_to_milliseconds)
 
1303
    approval_duration = notifychangeproperty(
 
1304
        dbus.UInt64, "ApprovalDuration",
 
1305
        type_func = timedelta_to_milliseconds)
 
1306
    host = notifychangeproperty(dbus.String, "Host")
 
1307
    timeout = notifychangeproperty(dbus.UInt64, "Timeout",
 
1308
                                   type_func =
 
1309
                                   timedelta_to_milliseconds)
 
1310
    extended_timeout = notifychangeproperty(
 
1311
        dbus.UInt64, "ExtendedTimeout",
 
1312
        type_func = timedelta_to_milliseconds)
 
1313
    interval = notifychangeproperty(dbus.UInt64,
 
1314
                                    "Interval",
 
1315
                                    type_func =
 
1316
                                    timedelta_to_milliseconds)
 
1317
    checker_command = notifychangeproperty(dbus.String, "Checker")
 
1318
    
 
1319
    del notifychangeproperty
758
1320
    
759
1321
    def __del__(self, *args, **kwargs):
760
1322
        try:
761
1323
            self.remove_from_connection()
762
1324
        except LookupError:
763
1325
            pass
764
 
        if hasattr(DBusObjectWithProperties, u"__del__"):
 
1326
        if hasattr(DBusObjectWithProperties, "__del__"):
765
1327
            DBusObjectWithProperties.__del__(self, *args, **kwargs)
766
1328
        Client.__del__(self, *args, **kwargs)
767
1329
    
769
1331
                         *args, **kwargs):
770
1332
        self.checker_callback_tag = None
771
1333
        self.checker = None
772
 
        # Emit D-Bus signal
773
 
        self.PropertyChanged(dbus.String(u"checker_running"),
774
 
                             dbus.Boolean(False, variant_level=1))
775
1334
        if os.WIFEXITED(condition):
776
1335
            exitstatus = os.WEXITSTATUS(condition)
777
1336
            # Emit D-Bus signal
787
1346
        return Client.checker_callback(self, pid, condition, command,
788
1347
                                       *args, **kwargs)
789
1348
    
790
 
    def checked_ok(self, *args, **kwargs):
791
 
        r = Client.checked_ok(self, *args, **kwargs)
792
 
        # Emit D-Bus signal
793
 
        self.PropertyChanged(
794
 
            dbus.String(u"last_checked_ok"),
795
 
            (self._datetime_to_dbus(self.last_checked_ok,
796
 
                                    variant_level=1)))
797
 
        return r
798
 
    
799
1349
    def start_checker(self, *args, **kwargs):
800
1350
        old_checker = self.checker
801
1351
        if self.checker is not None:
808
1358
            and old_checker_pid != self.checker.pid):
809
1359
            # Emit D-Bus signal
810
1360
            self.CheckerStarted(self.current_checker_command)
811
 
            self.PropertyChanged(
812
 
                dbus.String(u"checker_running"),
813
 
                dbus.Boolean(True, variant_level=1))
814
1361
        return r
815
1362
    
816
 
    def stop_checker(self, *args, **kwargs):
817
 
        old_checker = getattr(self, u"checker", None)
818
 
        r = Client.stop_checker(self, *args, **kwargs)
819
 
        if (old_checker is not None
820
 
            and getattr(self, u"checker", None) is None):
821
 
            self.PropertyChanged(dbus.String(u"checker_running"),
822
 
                                 dbus.Boolean(False, variant_level=1))
823
 
        return r
824
 
 
825
1363
    def _reset_approved(self):
826
 
        self._approved = None
 
1364
        self.approved = None
827
1365
        return False
828
1366
    
829
1367
    def approve(self, value=True):
830
 
        self.send_changedstate()
831
 
        self._approved = value
832
 
        gobject.timeout_add(self._timedelta_to_milliseconds(self.approved_duration),
 
1368
        self.approved = value
 
1369
        gobject.timeout_add(timedelta_to_milliseconds
 
1370
                            (self.approval_duration),
833
1371
                            self._reset_approved)
834
 
    
 
1372
        self.send_changedstate()
835
1373
    
836
1374
    ## D-Bus methods, signals & properties
837
 
    _interface = u"se.bsnet.fukt.Mandos.Client"
 
1375
    _interface = "se.recompile.Mandos.Client"
 
1376
    
 
1377
    ## Interfaces
 
1378
    
 
1379
    @dbus_interface_annotations(_interface)
 
1380
    def _foo(self):
 
1381
        return { "org.freedesktop.DBus.Property.EmitsChangedSignal":
 
1382
                     "false"}
838
1383
    
839
1384
    ## Signals
840
1385
    
841
1386
    # CheckerCompleted - signal
842
 
    @dbus.service.signal(_interface, signature=u"nxs")
 
1387
    @dbus.service.signal(_interface, signature="nxs")
843
1388
    def CheckerCompleted(self, exitcode, waitstatus, command):
844
1389
        "D-Bus signal"
845
1390
        pass
846
1391
    
847
1392
    # CheckerStarted - signal
848
 
    @dbus.service.signal(_interface, signature=u"s")
 
1393
    @dbus.service.signal(_interface, signature="s")
849
1394
    def CheckerStarted(self, command):
850
1395
        "D-Bus signal"
851
1396
        pass
852
1397
    
853
1398
    # PropertyChanged - signal
854
 
    @dbus.service.signal(_interface, signature=u"sv")
 
1399
    @dbus.service.signal(_interface, signature="sv")
855
1400
    def PropertyChanged(self, property, value):
856
1401
        "D-Bus signal"
857
1402
        pass
866
1411
        pass
867
1412
    
868
1413
    # Rejected - signal
869
 
    @dbus.service.signal(_interface, signature=u"s")
 
1414
    @dbus.service.signal(_interface, signature="s")
870
1415
    def Rejected(self, reason):
871
1416
        "D-Bus signal"
872
1417
        pass
873
1418
    
874
1419
    # NeedApproval - signal
875
 
    @dbus.service.signal(_interface, signature=u"db")
 
1420
    @dbus.service.signal(_interface, signature="tb")
876
1421
    def NeedApproval(self, timeout, default):
877
1422
        "D-Bus signal"
878
 
        pass
 
1423
        return self.need_approval()
879
1424
    
880
1425
    ## Methods
881
 
 
 
1426
    
882
1427
    # Approve - method
883
 
    @dbus.service.method(_interface, in_signature=u"b")
 
1428
    @dbus.service.method(_interface, in_signature="b")
884
1429
    def Approve(self, value):
885
1430
        self.approve(value)
886
 
 
 
1431
    
887
1432
    # CheckedOK - method
888
1433
    @dbus.service.method(_interface)
889
1434
    def CheckedOK(self):
890
 
        return self.checked_ok()
 
1435
        self.checked_ok()
891
1436
    
892
1437
    # Enable - method
893
1438
    @dbus.service.method(_interface)
914
1459
    
915
1460
    ## Properties
916
1461
    
917
 
    # approved_pending - property
918
 
    @dbus_service_property(_interface, signature=u"b", access=u"read")
919
 
    def approved_pending_dbus_property(self):
 
1462
    # ApprovalPending - property
 
1463
    @dbus_service_property(_interface, signature="b", access="read")
 
1464
    def ApprovalPending_dbus_property(self):
920
1465
        return dbus.Boolean(bool(self.approvals_pending))
921
1466
    
922
 
    # approved_by_default - property
923
 
    @dbus_service_property(_interface, signature=u"b",
924
 
                           access=u"readwrite")
925
 
    def approved_by_default_dbus_property(self):
926
 
        return dbus.Boolean(self.approved_by_default)
927
 
    
928
 
    # approved_delay - property
929
 
    @dbus_service_property(_interface, signature=u"t",
930
 
                           access=u"readwrite")
931
 
    def approved_delay_dbus_property(self):
932
 
        return dbus.UInt64(self.approved_delay_milliseconds())
933
 
    
934
 
    # approved_duration - property
935
 
    @dbus_service_property(_interface, signature=u"t",
936
 
                           access=u"readwrite")
937
 
    def approved_duration_dbus_property(self):
938
 
        return dbus.UInt64(self._timedelta_to_milliseconds(
939
 
                self.approved_duration))
940
 
    
941
 
    # name - property
942
 
    @dbus_service_property(_interface, signature=u"s", access=u"read")
943
 
    def name_dbus_property(self):
 
1467
    # ApprovedByDefault - property
 
1468
    @dbus_service_property(_interface, signature="b",
 
1469
                           access="readwrite")
 
1470
    def ApprovedByDefault_dbus_property(self, value=None):
 
1471
        if value is None:       # get
 
1472
            return dbus.Boolean(self.approved_by_default)
 
1473
        self.approved_by_default = bool(value)
 
1474
    
 
1475
    # ApprovalDelay - property
 
1476
    @dbus_service_property(_interface, signature="t",
 
1477
                           access="readwrite")
 
1478
    def ApprovalDelay_dbus_property(self, value=None):
 
1479
        if value is None:       # get
 
1480
            return dbus.UInt64(self.approval_delay_milliseconds())
 
1481
        self.approval_delay = datetime.timedelta(0, 0, 0, value)
 
1482
    
 
1483
    # ApprovalDuration - property
 
1484
    @dbus_service_property(_interface, signature="t",
 
1485
                           access="readwrite")
 
1486
    def ApprovalDuration_dbus_property(self, value=None):
 
1487
        if value is None:       # get
 
1488
            return dbus.UInt64(timedelta_to_milliseconds(
 
1489
                    self.approval_duration))
 
1490
        self.approval_duration = datetime.timedelta(0, 0, 0, value)
 
1491
    
 
1492
    # Name - property
 
1493
    @dbus_service_property(_interface, signature="s", access="read")
 
1494
    def Name_dbus_property(self):
944
1495
        return dbus.String(self.name)
945
1496
    
946
 
    # fingerprint - property
947
 
    @dbus_service_property(_interface, signature=u"s", access=u"read")
948
 
    def fingerprint_dbus_property(self):
 
1497
    # Fingerprint - property
 
1498
    @dbus_service_property(_interface, signature="s", access="read")
 
1499
    def Fingerprint_dbus_property(self):
949
1500
        return dbus.String(self.fingerprint)
950
1501
    
951
 
    # host - property
952
 
    @dbus_service_property(_interface, signature=u"s",
953
 
                           access=u"readwrite")
954
 
    def host_dbus_property(self, value=None):
 
1502
    # Host - property
 
1503
    @dbus_service_property(_interface, signature="s",
 
1504
                           access="readwrite")
 
1505
    def Host_dbus_property(self, value=None):
955
1506
        if value is None:       # get
956
1507
            return dbus.String(self.host)
957
 
        self.host = value
958
 
        # Emit D-Bus signal
959
 
        self.PropertyChanged(dbus.String(u"host"),
960
 
                             dbus.String(value, variant_level=1))
961
 
    
962
 
    # created - property
963
 
    @dbus_service_property(_interface, signature=u"s", access=u"read")
964
 
    def created_dbus_property(self):
965
 
        return dbus.String(self._datetime_to_dbus(self.created))
966
 
    
967
 
    # last_enabled - property
968
 
    @dbus_service_property(_interface, signature=u"s", access=u"read")
969
 
    def last_enabled_dbus_property(self):
970
 
        if self.last_enabled is None:
971
 
            return dbus.String(u"")
972
 
        return dbus.String(self._datetime_to_dbus(self.last_enabled))
973
 
    
974
 
    # enabled - property
975
 
    @dbus_service_property(_interface, signature=u"b",
976
 
                           access=u"readwrite")
977
 
    def enabled_dbus_property(self, value=None):
 
1508
        self.host = unicode(value)
 
1509
    
 
1510
    # Created - property
 
1511
    @dbus_service_property(_interface, signature="s", access="read")
 
1512
    def Created_dbus_property(self):
 
1513
        return datetime_to_dbus(self.created)
 
1514
    
 
1515
    # LastEnabled - property
 
1516
    @dbus_service_property(_interface, signature="s", access="read")
 
1517
    def LastEnabled_dbus_property(self):
 
1518
        return datetime_to_dbus(self.last_enabled)
 
1519
    
 
1520
    # Enabled - property
 
1521
    @dbus_service_property(_interface, signature="b",
 
1522
                           access="readwrite")
 
1523
    def Enabled_dbus_property(self, value=None):
978
1524
        if value is None:       # get
979
1525
            return dbus.Boolean(self.enabled)
980
1526
        if value:
982
1528
        else:
983
1529
            self.disable()
984
1530
    
985
 
    # last_checked_ok - property
986
 
    @dbus_service_property(_interface, signature=u"s",
987
 
                           access=u"readwrite")
988
 
    def last_checked_ok_dbus_property(self, value=None):
 
1531
    # LastCheckedOK - property
 
1532
    @dbus_service_property(_interface, signature="s",
 
1533
                           access="readwrite")
 
1534
    def LastCheckedOK_dbus_property(self, value=None):
989
1535
        if value is not None:
990
1536
            self.checked_ok()
991
1537
            return
992
 
        if self.last_checked_ok is None:
993
 
            return dbus.String(u"")
994
 
        return dbus.String(self._datetime_to_dbus(self
995
 
                                                  .last_checked_ok))
996
 
    
997
 
    # timeout - property
998
 
    @dbus_service_property(_interface, signature=u"t",
999
 
                           access=u"readwrite")
1000
 
    def timeout_dbus_property(self, value=None):
 
1538
        return datetime_to_dbus(self.last_checked_ok)
 
1539
    
 
1540
    # LastCheckerStatus - property
 
1541
    @dbus_service_property(_interface, signature="n",
 
1542
                           access="read")
 
1543
    def LastCheckerStatus_dbus_property(self):
 
1544
        return dbus.Int16(self.last_checker_status)
 
1545
    
 
1546
    # Expires - property
 
1547
    @dbus_service_property(_interface, signature="s", access="read")
 
1548
    def Expires_dbus_property(self):
 
1549
        return datetime_to_dbus(self.expires)
 
1550
    
 
1551
    # LastApprovalRequest - property
 
1552
    @dbus_service_property(_interface, signature="s", access="read")
 
1553
    def LastApprovalRequest_dbus_property(self):
 
1554
        return datetime_to_dbus(self.last_approval_request)
 
1555
    
 
1556
    # Timeout - property
 
1557
    @dbus_service_property(_interface, signature="t",
 
1558
                           access="readwrite")
 
1559
    def Timeout_dbus_property(self, value=None):
1001
1560
        if value is None:       # get
1002
1561
            return dbus.UInt64(self.timeout_milliseconds())
 
1562
        old_timeout = self.timeout
1003
1563
        self.timeout = datetime.timedelta(0, 0, 0, value)
1004
 
        # Emit D-Bus signal
1005
 
        self.PropertyChanged(dbus.String(u"timeout"),
1006
 
                             dbus.UInt64(value, variant_level=1))
1007
 
        if getattr(self, u"disable_initiator_tag", None) is None:
1008
 
            return
1009
 
        # Reschedule timeout
1010
 
        gobject.source_remove(self.disable_initiator_tag)
1011
 
        self.disable_initiator_tag = None
1012
 
        time_to_die = (self.
1013
 
                       _timedelta_to_milliseconds((self
1014
 
                                                   .last_checked_ok
1015
 
                                                   + self.timeout)
1016
 
                                                  - datetime.datetime
1017
 
                                                  .utcnow()))
1018
 
        if time_to_die <= 0:
1019
 
            # The timeout has passed
1020
 
            self.disable()
1021
 
        else:
1022
 
            self.disable_initiator_tag = (gobject.timeout_add
1023
 
                                          (time_to_die, self.disable))
1024
 
    
1025
 
    # interval - property
1026
 
    @dbus_service_property(_interface, signature=u"t",
1027
 
                           access=u"readwrite")
1028
 
    def interval_dbus_property(self, value=None):
 
1564
        # Reschedule disabling
 
1565
        if self.enabled:
 
1566
            now = datetime.datetime.utcnow()
 
1567
            self.expires += self.timeout - old_timeout
 
1568
            if self.expires <= now:
 
1569
                # The timeout has passed
 
1570
                self.disable()
 
1571
            else:
 
1572
                if (getattr(self, "disable_initiator_tag", None)
 
1573
                    is None):
 
1574
                    return
 
1575
                gobject.source_remove(self.disable_initiator_tag)
 
1576
                self.disable_initiator_tag = (
 
1577
                    gobject.timeout_add(
 
1578
                        timedelta_to_milliseconds(self.expires - now),
 
1579
                        self.disable))
 
1580
    
 
1581
    # ExtendedTimeout - property
 
1582
    @dbus_service_property(_interface, signature="t",
 
1583
                           access="readwrite")
 
1584
    def ExtendedTimeout_dbus_property(self, value=None):
 
1585
        if value is None:       # get
 
1586
            return dbus.UInt64(self.extended_timeout_milliseconds())
 
1587
        self.extended_timeout = datetime.timedelta(0, 0, 0, value)
 
1588
    
 
1589
    # Interval - property
 
1590
    @dbus_service_property(_interface, signature="t",
 
1591
                           access="readwrite")
 
1592
    def Interval_dbus_property(self, value=None):
1029
1593
        if value is None:       # get
1030
1594
            return dbus.UInt64(self.interval_milliseconds())
1031
1595
        self.interval = datetime.timedelta(0, 0, 0, value)
1032
 
        # Emit D-Bus signal
1033
 
        self.PropertyChanged(dbus.String(u"interval"),
1034
 
                             dbus.UInt64(value, variant_level=1))
1035
 
        if getattr(self, u"checker_initiator_tag", None) is None:
 
1596
        if getattr(self, "checker_initiator_tag", None) is None:
1036
1597
            return
1037
 
        # Reschedule checker run
1038
 
        gobject.source_remove(self.checker_initiator_tag)
1039
 
        self.checker_initiator_tag = (gobject.timeout_add
1040
 
                                      (value, self.start_checker))
1041
 
        self.start_checker()    # Start one now, too
1042
 
 
1043
 
    # checker - property
1044
 
    @dbus_service_property(_interface, signature=u"s",
1045
 
                           access=u"readwrite")
1046
 
    def checker_dbus_property(self, value=None):
 
1598
        if self.enabled:
 
1599
            # Reschedule checker run
 
1600
            gobject.source_remove(self.checker_initiator_tag)
 
1601
            self.checker_initiator_tag = (gobject.timeout_add
 
1602
                                          (value, self.start_checker))
 
1603
            self.start_checker()    # Start one now, too
 
1604
    
 
1605
    # Checker - property
 
1606
    @dbus_service_property(_interface, signature="s",
 
1607
                           access="readwrite")
 
1608
    def Checker_dbus_property(self, value=None):
1047
1609
        if value is None:       # get
1048
1610
            return dbus.String(self.checker_command)
1049
 
        self.checker_command = value
1050
 
        # Emit D-Bus signal
1051
 
        self.PropertyChanged(dbus.String(u"checker"),
1052
 
                             dbus.String(self.checker_command,
1053
 
                                         variant_level=1))
 
1611
        self.checker_command = unicode(value)
1054
1612
    
1055
 
    # checker_running - property
1056
 
    @dbus_service_property(_interface, signature=u"b",
1057
 
                           access=u"readwrite")
1058
 
    def checker_running_dbus_property(self, value=None):
 
1613
    # CheckerRunning - property
 
1614
    @dbus_service_property(_interface, signature="b",
 
1615
                           access="readwrite")
 
1616
    def CheckerRunning_dbus_property(self, value=None):
1059
1617
        if value is None:       # get
1060
1618
            return dbus.Boolean(self.checker is not None)
1061
1619
        if value:
1063
1621
        else:
1064
1622
            self.stop_checker()
1065
1623
    
1066
 
    # object_path - property
1067
 
    @dbus_service_property(_interface, signature=u"o", access=u"read")
1068
 
    def object_path_dbus_property(self):
 
1624
    # ObjectPath - property
 
1625
    @dbus_service_property(_interface, signature="o", access="read")
 
1626
    def ObjectPath_dbus_property(self):
1069
1627
        return self.dbus_object_path # is already a dbus.ObjectPath
1070
1628
    
1071
 
    # secret = property
1072
 
    @dbus_service_property(_interface, signature=u"ay",
1073
 
                           access=u"write", byte_arrays=True)
1074
 
    def secret_dbus_property(self, value):
 
1629
    # Secret = property
 
1630
    @dbus_service_property(_interface, signature="ay",
 
1631
                           access="write", byte_arrays=True)
 
1632
    def Secret_dbus_property(self, value):
1075
1633
        self.secret = str(value)
1076
1634
    
1077
1635
    del _interface
1083
1641
        self._pipe.send(('init', fpr, address))
1084
1642
        if not self._pipe.recv():
1085
1643
            raise KeyError()
1086
 
 
 
1644
    
1087
1645
    def __getattribute__(self, name):
1088
 
        if(name == '_pipe'):
 
1646
        if name == '_pipe':
1089
1647
            return super(ProxyClient, self).__getattribute__(name)
1090
1648
        self._pipe.send(('getattr', name))
1091
1649
        data = self._pipe.recv()
1096
1654
                self._pipe.send(('funcall', name, args, kwargs))
1097
1655
                return self._pipe.recv()[1]
1098
1656
            return func
1099
 
 
 
1657
    
1100
1658
    def __setattr__(self, name, value):
1101
 
        if(name == '_pipe'):
 
1659
        if name == '_pipe':
1102
1660
            return super(ProxyClient, self).__setattr__(name, value)
1103
1661
        self._pipe.send(('setattr', name, value))
1104
1662
 
1111
1669
    
1112
1670
    def handle(self):
1113
1671
        with contextlib.closing(self.server.child_pipe) as child_pipe:
1114
 
            logger.info(u"TCP connection from: %s",
 
1672
            logger.info("TCP connection from: %s",
1115
1673
                        unicode(self.client_address))
1116
 
            logger.debug(u"Pipe FD: %d",
 
1674
            logger.debug("Pipe FD: %d",
1117
1675
                         self.server.child_pipe.fileno())
1118
 
 
 
1676
            
1119
1677
            session = (gnutls.connection
1120
1678
                       .ClientSession(self.request,
1121
1679
                                      gnutls.connection
1122
1680
                                      .X509Credentials()))
1123
 
 
 
1681
            
1124
1682
            # Note: gnutls.connection.X509Credentials is really a
1125
1683
            # generic GnuTLS certificate credentials object so long as
1126
1684
            # no X.509 keys are added to it.  Therefore, we can use it
1127
1685
            # here despite using OpenPGP certificates.
1128
 
 
1129
 
            #priority = u':'.join((u"NONE", u"+VERS-TLS1.1",
1130
 
            #                      u"+AES-256-CBC", u"+SHA1",
1131
 
            #                      u"+COMP-NULL", u"+CTYPE-OPENPGP",
1132
 
            #                      u"+DHE-DSS"))
 
1686
            
 
1687
            #priority = ':'.join(("NONE", "+VERS-TLS1.1",
 
1688
            #                      "+AES-256-CBC", "+SHA1",
 
1689
            #                      "+COMP-NULL", "+CTYPE-OPENPGP",
 
1690
            #                      "+DHE-DSS"))
1133
1691
            # Use a fallback default, since this MUST be set.
1134
1692
            priority = self.server.gnutls_priority
1135
1693
            if priority is None:
1136
 
                priority = u"NORMAL"
 
1694
                priority = "NORMAL"
1137
1695
            (gnutls.library.functions
1138
1696
             .gnutls_priority_set_direct(session._c_object,
1139
1697
                                         priority, None))
1140
 
 
 
1698
            
1141
1699
            # Start communication using the Mandos protocol
1142
1700
            # Get protocol number
1143
1701
            line = self.request.makefile().readline()
1144
 
            logger.debug(u"Protocol version: %r", line)
 
1702
            logger.debug("Protocol version: %r", line)
1145
1703
            try:
1146
1704
                if int(line.strip().split()[0]) > 1:
1147
1705
                    raise RuntimeError
1148
 
            except (ValueError, IndexError, RuntimeError), error:
1149
 
                logger.error(u"Unknown protocol version: %s", error)
 
1706
            except (ValueError, IndexError, RuntimeError) as error:
 
1707
                logger.error("Unknown protocol version: %s", error)
1150
1708
                return
1151
 
 
 
1709
            
1152
1710
            # Start GnuTLS connection
1153
1711
            try:
1154
1712
                session.handshake()
1155
 
            except gnutls.errors.GNUTLSError, error:
1156
 
                logger.warning(u"Handshake failed: %s", error)
 
1713
            except gnutls.errors.GNUTLSError as error:
 
1714
                logger.warning("Handshake failed: %s", error)
1157
1715
                # Do not run session.bye() here: the session is not
1158
1716
                # established.  Just abandon the request.
1159
1717
                return
1160
 
            logger.debug(u"Handshake succeeded")
1161
 
 
 
1718
            logger.debug("Handshake succeeded")
 
1719
            
1162
1720
            approval_required = False
1163
1721
            try:
1164
1722
                try:
1165
1723
                    fpr = self.fingerprint(self.peer_certificate
1166
1724
                                           (session))
1167
 
                except (TypeError, gnutls.errors.GNUTLSError), error:
1168
 
                    logger.warning(u"Bad certificate: %s", error)
 
1725
                except (TypeError,
 
1726
                        gnutls.errors.GNUTLSError) as error:
 
1727
                    logger.warning("Bad certificate: %s", error)
1169
1728
                    return
1170
 
                logger.debug(u"Fingerprint: %s", fpr)
1171
 
 
 
1729
                logger.debug("Fingerprint: %s", fpr)
 
1730
                
1172
1731
                try:
1173
1732
                    client = ProxyClient(child_pipe, fpr,
1174
1733
                                         self.client_address)
1175
1734
                except KeyError:
1176
1735
                    return
1177
1736
                
1178
 
                if client.approved_delay:
1179
 
                    delay = client.approved_delay
 
1737
                if client.approval_delay:
 
1738
                    delay = client.approval_delay
1180
1739
                    client.approvals_pending += 1
1181
1740
                    approval_required = True
1182
1741
                
1183
1742
                while True:
1184
1743
                    if not client.enabled:
1185
 
                        logger.warning(u"Client %s is disabled",
 
1744
                        logger.info("Client %s is disabled",
1186
1745
                                       client.name)
1187
1746
                        if self.server.use_dbus:
1188
1747
                            # Emit D-Bus signal
1189
 
                            client.Rejected("Disabled")                    
 
1748
                            client.Rejected("Disabled")
1190
1749
                        return
1191
1750
                    
1192
 
                    if client._approved or not client.approved_delay:
 
1751
                    if client.approved or not client.approval_delay:
1193
1752
                        #We are approved or approval is disabled
1194
1753
                        break
1195
 
                    elif client._approved is None:
1196
 
                        logger.info(u"Client %s need approval",
 
1754
                    elif client.approved is None:
 
1755
                        logger.info("Client %s needs approval",
1197
1756
                                    client.name)
1198
1757
                        if self.server.use_dbus:
1199
1758
                            # Emit D-Bus signal
1200
1759
                            client.NeedApproval(
1201
 
                                client.approved_delay_milliseconds(),
 
1760
                                client.approval_delay_milliseconds(),
1202
1761
                                client.approved_by_default)
1203
1762
                    else:
1204
 
                        logger.warning(u"Client %s was not approved",
 
1763
                        logger.warning("Client %s was not approved",
1205
1764
                                       client.name)
1206
1765
                        if self.server.use_dbus:
1207
1766
                            # Emit D-Bus signal
1208
 
                            client.Rejected("Disapproved")
 
1767
                            client.Rejected("Denied")
1209
1768
                        return
1210
1769
                    
1211
1770
                    #wait until timeout or approved
1212
 
                    #x = float(client._timedelta_to_milliseconds(delay))
1213
1771
                    time = datetime.datetime.now()
1214
1772
                    client.changedstate.acquire()
1215
 
                    client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))
 
1773
                    client.changedstate.wait(
 
1774
                        float(timedelta_to_milliseconds(delay)
 
1775
                              / 1000))
1216
1776
                    client.changedstate.release()
1217
1777
                    time2 = datetime.datetime.now()
1218
1778
                    if (time2 - time) >= delay:
1222
1782
                                           client.name)
1223
1783
                            if self.server.use_dbus:
1224
1784
                                # Emit D-Bus signal
1225
 
                                client.Rejected("Time out")
 
1785
                                client.Rejected("Approval timed out")
1226
1786
                            return
1227
1787
                        else:
1228
1788
                            break
1233
1793
                while sent_size < len(client.secret):
1234
1794
                    try:
1235
1795
                        sent = session.send(client.secret[sent_size:])
1236
 
                    except (gnutls.errors.GNUTLSError), error:
1237
 
                        logger.warning("gnutls send failed")
 
1796
                    except gnutls.errors.GNUTLSError as error:
 
1797
                        logger.warning("gnutls send failed",
 
1798
                                       exc_info=error)
1238
1799
                        return
1239
 
                    logger.debug(u"Sent: %d, remaining: %d",
 
1800
                    logger.debug("Sent: %d, remaining: %d",
1240
1801
                                 sent, len(client.secret)
1241
1802
                                 - (sent_size + sent))
1242
1803
                    sent_size += sent
1243
 
 
1244
 
                logger.info(u"Sending secret to %s", client.name)
1245
 
                # bump the timeout as if seen
1246
 
                client.checked_ok()
 
1804
                
 
1805
                logger.info("Sending secret to %s", client.name)
 
1806
                # bump the timeout using extended_timeout
 
1807
                client.bump_timeout(client.extended_timeout)
1247
1808
                if self.server.use_dbus:
1248
1809
                    # Emit D-Bus signal
1249
1810
                    client.GotSecret()
1253
1814
                    client.approvals_pending -= 1
1254
1815
                try:
1255
1816
                    session.bye()
1256
 
                except (gnutls.errors.GNUTLSError), error:
1257
 
                    logger.warning("gnutls bye failed")
 
1817
                except gnutls.errors.GNUTLSError as error:
 
1818
                    logger.warning("GnuTLS bye failed",
 
1819
                                   exc_info=error)
1258
1820
    
1259
1821
    @staticmethod
1260
1822
    def peer_certificate(session):
1270
1832
                     .gnutls_certificate_get_peers
1271
1833
                     (session._c_object, ctypes.byref(list_size)))
1272
1834
        if not bool(cert_list) and list_size.value != 0:
1273
 
            raise gnutls.errors.GNUTLSError(u"error getting peer"
1274
 
                                            u" certificate")
 
1835
            raise gnutls.errors.GNUTLSError("error getting peer"
 
1836
                                            " certificate")
1275
1837
        if list_size.value == 0:
1276
1838
            return None
1277
1839
        cert = cert_list[0]
1303
1865
        if crtverify.value != 0:
1304
1866
            gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1305
1867
            raise (gnutls.errors.CertificateSecurityError
1306
 
                   (u"Verify failed"))
 
1868
                   ("Verify failed"))
1307
1869
        # New buffer for the fingerprint
1308
1870
        buf = ctypes.create_string_buffer(20)
1309
1871
        buf_len = ctypes.c_size_t()
1316
1878
        # Convert the buffer to a Python bytestring
1317
1879
        fpr = ctypes.string_at(buf, buf_len.value)
1318
1880
        # Convert the bytestring to hexadecimal notation
1319
 
        hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
 
1881
        hex_fpr = binascii.hexlify(fpr).upper()
1320
1882
        return hex_fpr
1321
1883
 
1322
1884
 
1325
1887
    def sub_process_main(self, request, address):
1326
1888
        try:
1327
1889
            self.finish_request(request, address)
1328
 
        except:
 
1890
        except Exception:
1329
1891
            self.handle_error(request, address)
1330
1892
        self.close_request(request)
1331
 
            
 
1893
    
1332
1894
    def process_request(self, request, address):
1333
1895
        """Start a new process to process the request."""
1334
 
        multiprocessing.Process(target = self.sub_process_main,
1335
 
                                args = (request, address)).start()
 
1896
        proc = multiprocessing.Process(target = self.sub_process_main,
 
1897
                                       args = (request, address))
 
1898
        proc.start()
 
1899
        return proc
 
1900
 
1336
1901
 
1337
1902
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
1338
1903
    """ adds a pipe to the MixIn """
1342
1907
        This function creates a new pipe in self.pipe
1343
1908
        """
1344
1909
        parent_pipe, self.child_pipe = multiprocessing.Pipe()
1345
 
 
1346
 
        super(MultiprocessingMixInWithPipe,
1347
 
              self).process_request(request, client_address)
 
1910
        
 
1911
        proc = MultiprocessingMixIn.process_request(self, request,
 
1912
                                                    client_address)
1348
1913
        self.child_pipe.close()
1349
 
        self.add_pipe(parent_pipe)
1350
 
 
1351
 
    def add_pipe(self, parent_pipe):
 
1914
        self.add_pipe(parent_pipe, proc)
 
1915
    
 
1916
    def add_pipe(self, parent_pipe, proc):
1352
1917
        """Dummy function; override as necessary"""
1353
 
        pass
 
1918
        raise NotImplementedError
 
1919
 
1354
1920
 
1355
1921
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
1356
1922
                     socketserver.TCPServer, object):
1362
1928
        use_ipv6:       Boolean; to use IPv6 or not
1363
1929
    """
1364
1930
    def __init__(self, server_address, RequestHandlerClass,
1365
 
                 interface=None, use_ipv6=True):
 
1931
                 interface=None, use_ipv6=True, socketfd=None):
 
1932
        """If socketfd is set, use that file descriptor instead of
 
1933
        creating a new one with socket.socket().
 
1934
        """
1366
1935
        self.interface = interface
1367
1936
        if use_ipv6:
1368
1937
            self.address_family = socket.AF_INET6
 
1938
        if socketfd is not None:
 
1939
            # Save the file descriptor
 
1940
            self.socketfd = socketfd
 
1941
            # Save the original socket.socket() function
 
1942
            self.socket_socket = socket.socket
 
1943
            # To implement --socket, we monkey patch socket.socket.
 
1944
            # 
 
1945
            # (When socketserver.TCPServer is a new-style class, we
 
1946
            # could make self.socket into a property instead of monkey
 
1947
            # patching socket.socket.)
 
1948
            # 
 
1949
            # Create a one-time-only replacement for socket.socket()
 
1950
            @functools.wraps(socket.socket)
 
1951
            def socket_wrapper(*args, **kwargs):
 
1952
                # Restore original function so subsequent calls are
 
1953
                # not affected.
 
1954
                socket.socket = self.socket_socket
 
1955
                del self.socket_socket
 
1956
                # This time only, return a new socket object from the
 
1957
                # saved file descriptor.
 
1958
                return socket.fromfd(self.socketfd, *args, **kwargs)
 
1959
            # Replace socket.socket() function with wrapper
 
1960
            socket.socket = socket_wrapper
 
1961
        # The socketserver.TCPServer.__init__ will call
 
1962
        # socket.socket(), which might be our replacement,
 
1963
        # socket_wrapper(), if socketfd was set.
1369
1964
        socketserver.TCPServer.__init__(self, server_address,
1370
1965
                                        RequestHandlerClass)
 
1966
    
1371
1967
    def server_bind(self):
1372
1968
        """This overrides the normal server_bind() function
1373
1969
        to bind to an interface if one was specified, and also NOT to
1374
1970
        bind to an address or port if they were not specified."""
1375
1971
        if self.interface is not None:
1376
1972
            if SO_BINDTODEVICE is None:
1377
 
                logger.error(u"SO_BINDTODEVICE does not exist;"
1378
 
                             u" cannot bind to interface %s",
 
1973
                logger.error("SO_BINDTODEVICE does not exist;"
 
1974
                             " cannot bind to interface %s",
1379
1975
                             self.interface)
1380
1976
            else:
1381
1977
                try:
1382
1978
                    self.socket.setsockopt(socket.SOL_SOCKET,
1383
1979
                                           SO_BINDTODEVICE,
1384
 
                                           str(self.interface
1385
 
                                               + u'\0'))
1386
 
                except socket.error, error:
1387
 
                    if error[0] == errno.EPERM:
1388
 
                        logger.error(u"No permission to"
1389
 
                                     u" bind to interface %s",
1390
 
                                     self.interface)
1391
 
                    elif error[0] == errno.ENOPROTOOPT:
1392
 
                        logger.error(u"SO_BINDTODEVICE not available;"
1393
 
                                     u" cannot bind to interface %s",
1394
 
                                     self.interface)
 
1980
                                           str(self.interface + '\0'))
 
1981
                except socket.error as error:
 
1982
                    if error.errno == errno.EPERM:
 
1983
                        logger.error("No permission to bind to"
 
1984
                                     " interface %s", self.interface)
 
1985
                    elif error.errno == errno.ENOPROTOOPT:
 
1986
                        logger.error("SO_BINDTODEVICE not available;"
 
1987
                                     " cannot bind to interface %s",
 
1988
                                     self.interface)
 
1989
                    elif error.errno == errno.ENODEV:
 
1990
                        logger.error("Interface %s does not exist,"
 
1991
                                     " cannot bind", self.interface)
1395
1992
                    else:
1396
1993
                        raise
1397
1994
        # Only bind(2) the socket if we really need to.
1398
1995
        if self.server_address[0] or self.server_address[1]:
1399
1996
            if not self.server_address[0]:
1400
1997
                if self.address_family == socket.AF_INET6:
1401
 
                    any_address = u"::" # in6addr_any
 
1998
                    any_address = "::" # in6addr_any
1402
1999
                else:
1403
 
                    any_address = socket.INADDR_ANY
 
2000
                    any_address = "0.0.0.0" # INADDR_ANY
1404
2001
                self.server_address = (any_address,
1405
2002
                                       self.server_address[1])
1406
2003
            elif not self.server_address[1]:
1427
2024
    """
1428
2025
    def __init__(self, server_address, RequestHandlerClass,
1429
2026
                 interface=None, use_ipv6=True, clients=None,
1430
 
                 gnutls_priority=None, use_dbus=True):
 
2027
                 gnutls_priority=None, use_dbus=True, socketfd=None):
1431
2028
        self.enabled = False
1432
2029
        self.clients = clients
1433
2030
        if self.clients is None:
1434
 
            self.clients = set()
 
2031
            self.clients = {}
1435
2032
        self.use_dbus = use_dbus
1436
2033
        self.gnutls_priority = gnutls_priority
1437
2034
        IPv6_TCPServer.__init__(self, server_address,
1438
2035
                                RequestHandlerClass,
1439
2036
                                interface = interface,
1440
 
                                use_ipv6 = use_ipv6)
 
2037
                                use_ipv6 = use_ipv6,
 
2038
                                socketfd = socketfd)
1441
2039
    def server_activate(self):
1442
2040
        if self.enabled:
1443
2041
            return socketserver.TCPServer.server_activate(self)
 
2042
    
1444
2043
    def enable(self):
1445
2044
        self.enabled = True
1446
 
    def add_pipe(self, parent_pipe):
 
2045
    
 
2046
    def add_pipe(self, parent_pipe, proc):
1447
2047
        # Call "handle_ipc" for both data and EOF events
1448
2048
        gobject.io_add_watch(parent_pipe.fileno(),
1449
2049
                             gobject.IO_IN | gobject.IO_HUP,
1450
2050
                             functools.partial(self.handle_ipc,
1451
 
                                               parent_pipe = parent_pipe))
1452
 
        
 
2051
                                               parent_pipe =
 
2052
                                               parent_pipe,
 
2053
                                               proc = proc))
 
2054
    
1453
2055
    def handle_ipc(self, source, condition, parent_pipe=None,
1454
 
                   client_object=None):
1455
 
        condition_names = {
1456
 
            gobject.IO_IN: u"IN",   # There is data to read.
1457
 
            gobject.IO_OUT: u"OUT", # Data can be written (without
1458
 
                                    # blocking).
1459
 
            gobject.IO_PRI: u"PRI", # There is urgent data to read.
1460
 
            gobject.IO_ERR: u"ERR", # Error condition.
1461
 
            gobject.IO_HUP: u"HUP"  # Hung up (the connection has been
1462
 
                                    # broken, usually for pipes and
1463
 
                                    # sockets).
1464
 
            }
1465
 
        conditions_string = ' | '.join(name
1466
 
                                       for cond, name in
1467
 
                                       condition_names.iteritems()
1468
 
                                       if cond & condition)
1469
 
        logger.debug(u"Handling IPC: FD = %d, condition = %s", source,
1470
 
                     conditions_string)
1471
 
 
1472
 
        # error or the other end of multiprocessing.Pipe has closed
1473
 
        if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):
 
2056
                   proc = None, client_object=None):
 
2057
        # error, or the other end of multiprocessing.Pipe has closed
 
2058
        if condition & (gobject.IO_ERR | gobject.IO_HUP):
 
2059
            # Wait for other process to exit
 
2060
            proc.join()
1474
2061
            return False
1475
2062
        
1476
2063
        # Read a request from the child
1477
2064
        request = parent_pipe.recv()
1478
 
        logger.debug(u"IPC request: %s", repr(request))
1479
2065
        command = request[0]
1480
2066
        
1481
2067
        if command == 'init':
1482
2068
            fpr = request[1]
1483
2069
            address = request[2]
1484
2070
            
1485
 
            for c in self.clients:
 
2071
            for c in self.clients.itervalues():
1486
2072
                if c.fingerprint == fpr:
1487
2073
                    client = c
1488
2074
                    break
1489
2075
            else:
1490
 
                logger.warning(u"Client not found for fingerprint: %s, ad"
1491
 
                               u"dress: %s", fpr, address)
 
2076
                logger.info("Client not found for fingerprint: %s, ad"
 
2077
                            "dress: %s", fpr, address)
1492
2078
                if self.use_dbus:
1493
2079
                    # Emit D-Bus signal
1494
 
                    mandos_dbus_service.ClientNotFound(fpr, address)
 
2080
                    mandos_dbus_service.ClientNotFound(fpr,
 
2081
                                                       address[0])
1495
2082
                parent_pipe.send(False)
1496
2083
                return False
1497
2084
            
1498
2085
            gobject.io_add_watch(parent_pipe.fileno(),
1499
2086
                                 gobject.IO_IN | gobject.IO_HUP,
1500
2087
                                 functools.partial(self.handle_ipc,
1501
 
                                                   parent_pipe = parent_pipe,
1502
 
                                                   client_object = client))
 
2088
                                                   parent_pipe =
 
2089
                                                   parent_pipe,
 
2090
                                                   proc = proc,
 
2091
                                                   client_object =
 
2092
                                                   client))
1503
2093
            parent_pipe.send(True)
1504
 
            # remove the old hook in favor of the new above hook on same fileno
 
2094
            # remove the old hook in favor of the new above hook on
 
2095
            # same fileno
1505
2096
            return False
1506
2097
        if command == 'funcall':
1507
2098
            funcname = request[1]
1508
2099
            args = request[2]
1509
2100
            kwargs = request[3]
1510
2101
            
1511
 
            parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))
1512
 
 
 
2102
            parent_pipe.send(('data', getattr(client_object,
 
2103
                                              funcname)(*args,
 
2104
                                                         **kwargs)))
 
2105
        
1513
2106
        if command == 'getattr':
1514
2107
            attrname = request[1]
1515
2108
            if callable(client_object.__getattribute__(attrname)):
1516
2109
                parent_pipe.send(('function',))
1517
2110
            else:
1518
 
                parent_pipe.send(('data', client_object.__getattribute__(attrname)))
 
2111
                parent_pipe.send(('data', client_object
 
2112
                                  .__getattribute__(attrname)))
1519
2113
        
1520
2114
        if command == 'setattr':
1521
2115
            attrname = request[1]
1522
2116
            value = request[2]
1523
2117
            setattr(client_object, attrname, value)
1524
 
 
 
2118
        
1525
2119
        return True
1526
2120
 
1527
2121
 
 
2122
def rfc3339_duration_to_delta(duration):
 
2123
    """Parse an RFC 3339 "duration" and return a datetime.timedelta
 
2124
    
 
2125
    >>> rfc3339_duration_to_delta("P7D")
 
2126
    datetime.timedelta(7)
 
2127
    >>> rfc3339_duration_to_delta("PT60S")
 
2128
    datetime.timedelta(0, 60)
 
2129
    >>> rfc3339_duration_to_delta("PT60M")
 
2130
    datetime.timedelta(0, 3600)
 
2131
    >>> rfc3339_duration_to_delta("PT24H")
 
2132
    datetime.timedelta(1)
 
2133
    >>> rfc3339_duration_to_delta("P1W")
 
2134
    datetime.timedelta(7)
 
2135
    >>> rfc3339_duration_to_delta("PT5M30S")
 
2136
    datetime.timedelta(0, 330)
 
2137
    >>> rfc3339_duration_to_delta("P1DT3M20S")
 
2138
    datetime.timedelta(1, 200)
 
2139
    """
 
2140
    
 
2141
    # Parsing an RFC 3339 duration with regular expressions is not
 
2142
    # possible - there would have to be multiple places for the same
 
2143
    # values, like seconds.  The current code, while more esoteric, is
 
2144
    # cleaner without depending on a parsing library.  If Python had a
 
2145
    # built-in library for parsing we would use it, but we'd like to
 
2146
    # avoid excessive use of external libraries.
 
2147
    
 
2148
    # New type for defining tokens, syntax, and semantics all-in-one
 
2149
    Token = collections.namedtuple("Token",
 
2150
                                   ("regexp", # To match token; if
 
2151
                                              # "value" is not None,
 
2152
                                              # must have a "group"
 
2153
                                              # containing digits
 
2154
                                    "value",  # datetime.timedelta or
 
2155
                                              # None
 
2156
                                    "followers")) # Tokens valid after
 
2157
                                                  # this token
 
2158
    # RFC 3339 "duration" tokens, syntax, and semantics; taken from
 
2159
    # the "duration" ABNF definition in RFC 3339, Appendix A.
 
2160
    token_end = Token(re.compile(r"$"), None, frozenset())
 
2161
    token_second = Token(re.compile(r"(\d+)S"),
 
2162
                         datetime.timedelta(seconds=1),
 
2163
                         frozenset((token_end,)))
 
2164
    token_minute = Token(re.compile(r"(\d+)M"),
 
2165
                         datetime.timedelta(minutes=1),
 
2166
                         frozenset((token_second, token_end)))
 
2167
    token_hour = Token(re.compile(r"(\d+)H"),
 
2168
                       datetime.timedelta(hours=1),
 
2169
                       frozenset((token_minute, token_end)))
 
2170
    token_time = Token(re.compile(r"T"),
 
2171
                       None,
 
2172
                       frozenset((token_hour, token_minute,
 
2173
                                  token_second)))
 
2174
    token_day = Token(re.compile(r"(\d+)D"),
 
2175
                      datetime.timedelta(days=1),
 
2176
                      frozenset((token_time, token_end)))
 
2177
    token_month = Token(re.compile(r"(\d+)M"),
 
2178
                        datetime.timedelta(weeks=4),
 
2179
                        frozenset((token_day, token_end)))
 
2180
    token_year = Token(re.compile(r"(\d+)Y"),
 
2181
                       datetime.timedelta(weeks=52),
 
2182
                       frozenset((token_month, token_end)))
 
2183
    token_week = Token(re.compile(r"(\d+)W"),
 
2184
                       datetime.timedelta(weeks=1),
 
2185
                       frozenset((token_end,)))
 
2186
    token_duration = Token(re.compile(r"P"), None,
 
2187
                           frozenset((token_year, token_month,
 
2188
                                      token_day, token_time,
 
2189
                                      token_week))),
 
2190
    # Define starting values
 
2191
    value = datetime.timedelta() # Value so far
 
2192
    found_token = None
 
2193
    followers = frozenset(token_duration,) # Following valid tokens
 
2194
    s = duration                # String left to parse
 
2195
    # Loop until end token is found
 
2196
    while found_token is not token_end:
 
2197
        # Search for any currently valid tokens
 
2198
        for token in followers:
 
2199
            match = token.regexp.match(s)
 
2200
            if match is not None:
 
2201
                # Token found
 
2202
                if token.value is not None:
 
2203
                    # Value found, parse digits
 
2204
                    factor = int(match.group(1), 10)
 
2205
                    # Add to value so far
 
2206
                    value += factor * token.value
 
2207
                # Strip token from string
 
2208
                s = token.regexp.sub("", s, 1)
 
2209
                # Go to found token
 
2210
                found_token = token
 
2211
                # Set valid next tokens
 
2212
                followers = found_token.followers
 
2213
                break
 
2214
        else:
 
2215
            # No currently valid tokens were found
 
2216
            raise ValueError("Invalid RFC 3339 duration")
 
2217
    # End token found
 
2218
    return value
 
2219
 
 
2220
 
1528
2221
def string_to_delta(interval):
1529
2222
    """Parse a string and return a datetime.timedelta
1530
2223
    
1531
 
    >>> string_to_delta(u'7d')
 
2224
    >>> string_to_delta('7d')
1532
2225
    datetime.timedelta(7)
1533
 
    >>> string_to_delta(u'60s')
 
2226
    >>> string_to_delta('60s')
1534
2227
    datetime.timedelta(0, 60)
1535
 
    >>> string_to_delta(u'60m')
 
2228
    >>> string_to_delta('60m')
1536
2229
    datetime.timedelta(0, 3600)
1537
 
    >>> string_to_delta(u'24h')
 
2230
    >>> string_to_delta('24h')
1538
2231
    datetime.timedelta(1)
1539
 
    >>> string_to_delta(u'1w')
 
2232
    >>> string_to_delta('1w')
1540
2233
    datetime.timedelta(7)
1541
 
    >>> string_to_delta(u'5m 30s')
 
2234
    >>> string_to_delta('5m 30s')
1542
2235
    datetime.timedelta(0, 330)
1543
2236
    """
 
2237
    
 
2238
    try:
 
2239
        return rfc3339_duration_to_delta(interval)
 
2240
    except ValueError:
 
2241
        pass
 
2242
    
1544
2243
    timevalue = datetime.timedelta(0)
1545
2244
    for s in interval.split():
1546
2245
        try:
1547
2246
            suffix = unicode(s[-1])
1548
2247
            value = int(s[:-1])
1549
 
            if suffix == u"d":
 
2248
            if suffix == "d":
1550
2249
                delta = datetime.timedelta(value)
1551
 
            elif suffix == u"s":
 
2250
            elif suffix == "s":
1552
2251
                delta = datetime.timedelta(0, value)
1553
 
            elif suffix == u"m":
 
2252
            elif suffix == "m":
1554
2253
                delta = datetime.timedelta(0, 0, 0, 0, value)
1555
 
            elif suffix == u"h":
 
2254
            elif suffix == "h":
1556
2255
                delta = datetime.timedelta(0, 0, 0, 0, 0, value)
1557
 
            elif suffix == u"w":
 
2256
            elif suffix == "w":
1558
2257
                delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
1559
2258
            else:
1560
 
                raise ValueError(u"Unknown suffix %r" % suffix)
1561
 
        except (ValueError, IndexError), e:
1562
 
            raise ValueError(e.message)
 
2259
                raise ValueError("Unknown suffix {0!r}"
 
2260
                                 .format(suffix))
 
2261
        except (ValueError, IndexError) as e:
 
2262
            raise ValueError(*(e.args))
1563
2263
        timevalue += delta
1564
2264
    return timevalue
1565
2265
 
1566
2266
 
1567
 
def if_nametoindex(interface):
1568
 
    """Call the C function if_nametoindex(), or equivalent
1569
 
    
1570
 
    Note: This function cannot accept a unicode string."""
1571
 
    global if_nametoindex
1572
 
    try:
1573
 
        if_nametoindex = (ctypes.cdll.LoadLibrary
1574
 
                          (ctypes.util.find_library(u"c"))
1575
 
                          .if_nametoindex)
1576
 
    except (OSError, AttributeError):
1577
 
        logger.warning(u"Doing if_nametoindex the hard way")
1578
 
        def if_nametoindex(interface):
1579
 
            "Get an interface index the hard way, i.e. using fcntl()"
1580
 
            SIOCGIFINDEX = 0x8933  # From /usr/include/linux/sockios.h
1581
 
            with contextlib.closing(socket.socket()) as s:
1582
 
                ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
1583
 
                                    struct.pack(str(u"16s16x"),
1584
 
                                                interface))
1585
 
            interface_index = struct.unpack(str(u"I"),
1586
 
                                            ifreq[16:20])[0]
1587
 
            return interface_index
1588
 
    return if_nametoindex(interface)
1589
 
 
1590
 
 
1591
2267
def daemon(nochdir = False, noclose = False):
1592
2268
    """See daemon(3).  Standard BSD Unix function.
1593
2269
    
1596
2272
        sys.exit()
1597
2273
    os.setsid()
1598
2274
    if not nochdir:
1599
 
        os.chdir(u"/")
 
2275
        os.chdir("/")
1600
2276
    if os.fork():
1601
2277
        sys.exit()
1602
2278
    if not noclose:
1603
2279
        # Close all standard open file descriptors
1604
 
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
 
2280
        null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
1605
2281
        if not stat.S_ISCHR(os.fstat(null).st_mode):
1606
2282
            raise OSError(errno.ENODEV,
1607
 
                          u"%s not a character device"
1608
 
                          % os.path.devnull)
 
2283
                          "{0} not a character device"
 
2284
                          .format(os.devnull))
1609
2285
        os.dup2(null, sys.stdin.fileno())
1610
2286
        os.dup2(null, sys.stdout.fileno())
1611
2287
        os.dup2(null, sys.stderr.fileno())
1618
2294
    ##################################################################
1619
2295
    # Parsing of options, both command line and config file
1620
2296
    
1621
 
    parser = optparse.OptionParser(version = "%%prog %s" % version)
1622
 
    parser.add_option("-i", u"--interface", type=u"string",
1623
 
                      metavar="IF", help=u"Bind to interface IF")
1624
 
    parser.add_option("-a", u"--address", type=u"string",
1625
 
                      help=u"Address to listen for requests on")
1626
 
    parser.add_option("-p", u"--port", type=u"int",
1627
 
                      help=u"Port number to receive requests on")
1628
 
    parser.add_option("--check", action=u"store_true",
1629
 
                      help=u"Run self-test")
1630
 
    parser.add_option("--debug", action=u"store_true",
1631
 
                      help=u"Debug mode; run in foreground and log to"
1632
 
                      u" terminal")
1633
 
    parser.add_option("--debuglevel", type=u"string", metavar="Level",
1634
 
                      help=u"Debug level for stdout output")
1635
 
    parser.add_option("--priority", type=u"string", help=u"GnuTLS"
1636
 
                      u" priority string (see GnuTLS documentation)")
1637
 
    parser.add_option("--servicename", type=u"string",
1638
 
                      metavar=u"NAME", help=u"Zeroconf service name")
1639
 
    parser.add_option("--configdir", type=u"string",
1640
 
                      default=u"/etc/mandos", metavar=u"DIR",
1641
 
                      help=u"Directory to search for configuration"
1642
 
                      u" files")
1643
 
    parser.add_option("--no-dbus", action=u"store_false",
1644
 
                      dest=u"use_dbus", help=u"Do not provide D-Bus"
1645
 
                      u" system bus interface")
1646
 
    parser.add_option("--no-ipv6", action=u"store_false",
1647
 
                      dest=u"use_ipv6", help=u"Do not use IPv6")
1648
 
    options = parser.parse_args()[0]
 
2297
    parser = argparse.ArgumentParser()
 
2298
    parser.add_argument("-v", "--version", action="version",
 
2299
                        version = "%(prog)s {0}".format(version),
 
2300
                        help="show version number and exit")
 
2301
    parser.add_argument("-i", "--interface", metavar="IF",
 
2302
                        help="Bind to interface IF")
 
2303
    parser.add_argument("-a", "--address",
 
2304
                        help="Address to listen for requests on")
 
2305
    parser.add_argument("-p", "--port", type=int,
 
2306
                        help="Port number to receive requests on")
 
2307
    parser.add_argument("--check", action="store_true",
 
2308
                        help="Run self-test")
 
2309
    parser.add_argument("--debug", action="store_true",
 
2310
                        help="Debug mode; run in foreground and log"
 
2311
                        " to terminal", default=None)
 
2312
    parser.add_argument("--debuglevel", metavar="LEVEL",
 
2313
                        help="Debug level for stdout output")
 
2314
    parser.add_argument("--priority", help="GnuTLS"
 
2315
                        " priority string (see GnuTLS documentation)")
 
2316
    parser.add_argument("--servicename",
 
2317
                        metavar="NAME", help="Zeroconf service name")
 
2318
    parser.add_argument("--configdir",
 
2319
                        default="/etc/mandos", metavar="DIR",
 
2320
                        help="Directory to search for configuration"
 
2321
                        " files")
 
2322
    parser.add_argument("--no-dbus", action="store_false",
 
2323
                        dest="use_dbus", help="Do not provide D-Bus"
 
2324
                        " system bus interface", default=None)
 
2325
    parser.add_argument("--no-ipv6", action="store_false",
 
2326
                        dest="use_ipv6", help="Do not use IPv6",
 
2327
                        default=None)
 
2328
    parser.add_argument("--no-restore", action="store_false",
 
2329
                        dest="restore", help="Do not restore stored"
 
2330
                        " state", default=None)
 
2331
    parser.add_argument("--socket", type=int,
 
2332
                        help="Specify a file descriptor to a network"
 
2333
                        " socket to use instead of creating one")
 
2334
    parser.add_argument("--statedir", metavar="DIR",
 
2335
                        help="Directory to save/restore state in")
 
2336
    parser.add_argument("--foreground", action="store_true",
 
2337
                        help="Run in foreground", default=None)
 
2338
    
 
2339
    options = parser.parse_args()
1649
2340
    
1650
2341
    if options.check:
1651
2342
        import doctest
1653
2344
        sys.exit()
1654
2345
    
1655
2346
    # Default values for config file for server-global settings
1656
 
    server_defaults = { u"interface": u"",
1657
 
                        u"address": u"",
1658
 
                        u"port": u"",
1659
 
                        u"debug": u"False",
1660
 
                        u"priority":
1661
 
                        u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
1662
 
                        u"servicename": u"Mandos",
1663
 
                        u"use_dbus": u"True",
1664
 
                        u"use_ipv6": u"True",
1665
 
                        u"debuglevel": u"",
 
2347
    server_defaults = { "interface": "",
 
2348
                        "address": "",
 
2349
                        "port": "",
 
2350
                        "debug": "False",
 
2351
                        "priority":
 
2352
                        "SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",
 
2353
                        "servicename": "Mandos",
 
2354
                        "use_dbus": "True",
 
2355
                        "use_ipv6": "True",
 
2356
                        "debuglevel": "",
 
2357
                        "restore": "True",
 
2358
                        "socket": "",
 
2359
                        "statedir": "/var/lib/mandos",
 
2360
                        "foreground": "False",
1666
2361
                        }
1667
2362
    
1668
2363
    # Parse config file for server-global settings
1669
2364
    server_config = configparser.SafeConfigParser(server_defaults)
1670
2365
    del server_defaults
1671
2366
    server_config.read(os.path.join(options.configdir,
1672
 
                                    u"mandos.conf"))
 
2367
                                    "mandos.conf"))
1673
2368
    # Convert the SafeConfigParser object to a dict
1674
2369
    server_settings = server_config.defaults()
1675
2370
    # Use the appropriate methods on the non-string config options
1676
 
    for option in (u"debug", u"use_dbus", u"use_ipv6"):
1677
 
        server_settings[option] = server_config.getboolean(u"DEFAULT",
 
2371
    for option in ("debug", "use_dbus", "use_ipv6", "foreground"):
 
2372
        server_settings[option] = server_config.getboolean("DEFAULT",
1678
2373
                                                           option)
1679
2374
    if server_settings["port"]:
1680
 
        server_settings["port"] = server_config.getint(u"DEFAULT",
1681
 
                                                       u"port")
 
2375
        server_settings["port"] = server_config.getint("DEFAULT",
 
2376
                                                       "port")
 
2377
    if server_settings["socket"]:
 
2378
        server_settings["socket"] = server_config.getint("DEFAULT",
 
2379
                                                         "socket")
 
2380
        # Later, stdin will, and stdout and stderr might, be dup'ed
 
2381
        # over with an opened os.devnull.  But we don't want this to
 
2382
        # happen with a supplied network socket.
 
2383
        if 0 <= server_settings["socket"] <= 2:
 
2384
            server_settings["socket"] = os.dup(server_settings
 
2385
                                               ["socket"])
1682
2386
    del server_config
1683
2387
    
1684
2388
    # Override the settings from the config file with command line
1685
2389
    # options, if set.
1686
 
    for option in (u"interface", u"address", u"port", u"debug",
1687
 
                   u"priority", u"servicename", u"configdir",
1688
 
                   u"use_dbus", u"use_ipv6", u"debuglevel"):
 
2390
    for option in ("interface", "address", "port", "debug",
 
2391
                   "priority", "servicename", "configdir",
 
2392
                   "use_dbus", "use_ipv6", "debuglevel", "restore",
 
2393
                   "statedir", "socket", "foreground"):
1689
2394
        value = getattr(options, option)
1690
2395
        if value is not None:
1691
2396
            server_settings[option] = value
1694
2399
    for option in server_settings.keys():
1695
2400
        if type(server_settings[option]) is str:
1696
2401
            server_settings[option] = unicode(server_settings[option])
 
2402
    # Force all boolean options to be boolean
 
2403
    for option in ("debug", "use_dbus", "use_ipv6", "restore",
 
2404
                   "foreground"):
 
2405
        server_settings[option] = bool(server_settings[option])
 
2406
    # Debug implies foreground
 
2407
    if server_settings["debug"]:
 
2408
        server_settings["foreground"] = True
1697
2409
    # Now we have our good server settings in "server_settings"
1698
2410
    
1699
2411
    ##################################################################
1700
2412
    
1701
2413
    # For convenience
1702
 
    debug = server_settings[u"debug"]
1703
 
    debuglevel = server_settings[u"debuglevel"]
1704
 
    use_dbus = server_settings[u"use_dbus"]
1705
 
    use_ipv6 = server_settings[u"use_ipv6"]
1706
 
 
1707
 
    if server_settings[u"servicename"] != u"Mandos":
 
2414
    debug = server_settings["debug"]
 
2415
    debuglevel = server_settings["debuglevel"]
 
2416
    use_dbus = server_settings["use_dbus"]
 
2417
    use_ipv6 = server_settings["use_ipv6"]
 
2418
    stored_state_path = os.path.join(server_settings["statedir"],
 
2419
                                     stored_state_file)
 
2420
    foreground = server_settings["foreground"]
 
2421
    
 
2422
    if debug:
 
2423
        initlogger(debug, logging.DEBUG)
 
2424
    else:
 
2425
        if not debuglevel:
 
2426
            initlogger(debug)
 
2427
        else:
 
2428
            level = getattr(logging, debuglevel.upper())
 
2429
            initlogger(debug, level)
 
2430
    
 
2431
    if server_settings["servicename"] != "Mandos":
1708
2432
        syslogger.setFormatter(logging.Formatter
1709
 
                               (u'Mandos (%s) [%%(process)d]:'
1710
 
                                u' %%(levelname)s: %%(message)s'
1711
 
                                % server_settings[u"servicename"]))
 
2433
                               ('Mandos ({0}) [%(process)d]:'
 
2434
                                ' %(levelname)s: %(message)s'
 
2435
                                .format(server_settings
 
2436
                                        ["servicename"])))
1712
2437
    
1713
2438
    # Parse config file with clients
1714
 
    client_defaults = { u"timeout": u"1h",
1715
 
                        u"interval": u"5m",
1716
 
                        u"checker": u"fping -q -- %%(host)s",
1717
 
                        u"host": u"",
1718
 
                        u"approved_delay": u"0s",
1719
 
                        u"approved_duration": u"1s",
1720
 
                        }
1721
 
    client_config = configparser.SafeConfigParser(client_defaults)
1722
 
    client_config.read(os.path.join(server_settings[u"configdir"],
1723
 
                                    u"clients.conf"))
 
2439
    client_config = configparser.SafeConfigParser(Client
 
2440
                                                  .client_defaults)
 
2441
    client_config.read(os.path.join(server_settings["configdir"],
 
2442
                                    "clients.conf"))
1724
2443
    
1725
2444
    global mandos_dbus_service
1726
2445
    mandos_dbus_service = None
1727
2446
    
1728
 
    tcp_server = MandosServer((server_settings[u"address"],
1729
 
                               server_settings[u"port"]),
 
2447
    tcp_server = MandosServer((server_settings["address"],
 
2448
                               server_settings["port"]),
1730
2449
                              ClientHandler,
1731
 
                              interface=server_settings[u"interface"],
 
2450
                              interface=(server_settings["interface"]
 
2451
                                         or None),
1732
2452
                              use_ipv6=use_ipv6,
1733
2453
                              gnutls_priority=
1734
 
                              server_settings[u"priority"],
1735
 
                              use_dbus=use_dbus)
1736
 
    pidfilename = u"/var/run/mandos.pid"
1737
 
    try:
1738
 
        pidfile = open(pidfilename, u"w")
1739
 
    except IOError:
1740
 
        logger.error(u"Could not open file %r", pidfilename)
 
2454
                              server_settings["priority"],
 
2455
                              use_dbus=use_dbus,
 
2456
                              socketfd=(server_settings["socket"]
 
2457
                                        or None))
 
2458
    if not foreground:
 
2459
        pidfilename = "/run/mandos.pid"
 
2460
        pidfile = None
 
2461
        try:
 
2462
            pidfile = open(pidfilename, "w")
 
2463
        except IOError as e:
 
2464
            logger.error("Could not open file %r", pidfilename,
 
2465
                         exc_info=e)
1741
2466
    
1742
 
    try:
1743
 
        uid = pwd.getpwnam(u"_mandos").pw_uid
1744
 
        gid = pwd.getpwnam(u"_mandos").pw_gid
1745
 
    except KeyError:
 
2467
    for name in ("_mandos", "mandos", "nobody"):
1746
2468
        try:
1747
 
            uid = pwd.getpwnam(u"mandos").pw_uid
1748
 
            gid = pwd.getpwnam(u"mandos").pw_gid
 
2469
            uid = pwd.getpwnam(name).pw_uid
 
2470
            gid = pwd.getpwnam(name).pw_gid
 
2471
            break
1749
2472
        except KeyError:
1750
 
            try:
1751
 
                uid = pwd.getpwnam(u"nobody").pw_uid
1752
 
                gid = pwd.getpwnam(u"nobody").pw_gid
1753
 
            except KeyError:
1754
 
                uid = 65534
1755
 
                gid = 65534
 
2473
            continue
 
2474
    else:
 
2475
        uid = 65534
 
2476
        gid = 65534
1756
2477
    try:
1757
2478
        os.setgid(gid)
1758
2479
        os.setuid(uid)
1759
 
    except OSError, error:
1760
 
        if error[0] != errno.EPERM:
 
2480
    except OSError as error:
 
2481
        if error.errno != errno.EPERM:
1761
2482
            raise error
1762
2483
    
1763
 
    # Enable all possible GnuTLS debugging
1764
 
 
1765
 
 
1766
 
    if not debug and not debuglevel:
1767
 
        syslogger.setLevel(logging.WARNING)
1768
 
        console.setLevel(logging.WARNING)
1769
 
    if debuglevel:
1770
 
        level = getattr(logging, debuglevel.upper())
1771
 
        syslogger.setLevel(level)
1772
 
        console.setLevel(level)
1773
 
 
1774
2484
    if debug:
 
2485
        # Enable all possible GnuTLS debugging
 
2486
        
1775
2487
        # "Use a log level over 10 to enable all debugging options."
1776
2488
        # - GnuTLS manual
1777
2489
        gnutls.library.functions.gnutls_global_set_log_level(11)
1778
2490
        
1779
2491
        @gnutls.library.types.gnutls_log_func
1780
2492
        def debug_gnutls(level, string):
1781
 
            logger.debug(u"GnuTLS: %s", string[:-1])
 
2493
            logger.debug("GnuTLS: %s", string[:-1])
1782
2494
        
1783
2495
        (gnutls.library.functions
1784
2496
         .gnutls_global_set_log_function(debug_gnutls))
1785
 
 
 
2497
        
1786
2498
        # Redirect stdin so all checkers get /dev/null
1787
 
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
 
2499
        null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
1788
2500
        os.dup2(null, sys.stdin.fileno())
1789
2501
        if null > 2:
1790
2502
            os.close(null)
1791
 
    else:
1792
 
        # No console logging
1793
 
        logger.removeHandler(console)
1794
 
 
 
2503
    
 
2504
    # Need to fork before connecting to D-Bus
 
2505
    if not foreground:
 
2506
        # Close all input and output, do double fork, etc.
 
2507
        daemon()
 
2508
    
 
2509
    # multiprocessing will use threads, so before we use gobject we
 
2510
    # need to inform gobject that threads will be used.
 
2511
    gobject.threads_init()
1795
2512
    
1796
2513
    global main_loop
1797
2514
    # From the Avahi example code
1798
 
    DBusGMainLoop(set_as_default=True )
 
2515
    DBusGMainLoop(set_as_default=True)
1799
2516
    main_loop = gobject.MainLoop()
1800
2517
    bus = dbus.SystemBus()
1801
2518
    # End of Avahi example code
1802
2519
    if use_dbus:
1803
2520
        try:
1804
 
            bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos",
 
2521
            bus_name = dbus.service.BusName("se.recompile.Mandos",
1805
2522
                                            bus, do_not_queue=True)
1806
 
        except dbus.exceptions.NameExistsException, e:
1807
 
            logger.error(unicode(e) + u", disabling D-Bus")
 
2523
            old_bus_name = (dbus.service.BusName
 
2524
                            ("se.bsnet.fukt.Mandos", bus,
 
2525
                             do_not_queue=True))
 
2526
        except dbus.exceptions.NameExistsException as e:
 
2527
            logger.error("Disabling D-Bus:", exc_info=e)
1808
2528
            use_dbus = False
1809
 
            server_settings[u"use_dbus"] = False
 
2529
            server_settings["use_dbus"] = False
1810
2530
            tcp_server.use_dbus = False
1811
2531
    protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
1812
 
    service = AvahiService(name = server_settings[u"servicename"],
1813
 
                           servicetype = u"_mandos._tcp",
1814
 
                           protocol = protocol, bus = bus)
 
2532
    service = AvahiServiceToSyslog(name =
 
2533
                                   server_settings["servicename"],
 
2534
                                   servicetype = "_mandos._tcp",
 
2535
                                   protocol = protocol, bus = bus)
1815
2536
    if server_settings["interface"]:
1816
2537
        service.interface = (if_nametoindex
1817
 
                             (str(server_settings[u"interface"])))
1818
 
 
1819
 
    if not debug:
1820
 
        # Close all input and output, do double fork, etc.
1821
 
        daemon()
1822
 
        
 
2538
                             (str(server_settings["interface"])))
 
2539
    
1823
2540
    global multiprocessing_manager
1824
2541
    multiprocessing_manager = multiprocessing.Manager()
1825
2542
    
1826
2543
    client_class = Client
1827
2544
    if use_dbus:
1828
2545
        client_class = functools.partial(ClientDBus, bus = bus)
1829
 
    def client_config_items(config, section):
1830
 
        special_settings = {
1831
 
            "approved_by_default":
1832
 
                lambda: config.getboolean(section,
1833
 
                                          "approved_by_default"),
1834
 
            }
1835
 
        for name, value in config.items(section):
 
2546
    
 
2547
    client_settings = Client.config_parser(client_config)
 
2548
    old_client_settings = {}
 
2549
    clients_data = {}
 
2550
    
 
2551
    # This is used to redirect stdout and stderr for checker processes
 
2552
    global wnull
 
2553
    wnull = open(os.devnull, "w") # A writable /dev/null
 
2554
    # Only used if server is running in foreground but not in debug
 
2555
    # mode
 
2556
    if debug or not foreground:
 
2557
        wnull.close()
 
2558
    
 
2559
    # Get client data and settings from last running state.
 
2560
    if server_settings["restore"]:
 
2561
        try:
 
2562
            with open(stored_state_path, "rb") as stored_state:
 
2563
                clients_data, old_client_settings = (pickle.load
 
2564
                                                     (stored_state))
 
2565
            os.remove(stored_state_path)
 
2566
        except IOError as e:
 
2567
            if e.errno == errno.ENOENT:
 
2568
                logger.warning("Could not load persistent state: {0}"
 
2569
                                .format(os.strerror(e.errno)))
 
2570
            else:
 
2571
                logger.critical("Could not load persistent state:",
 
2572
                                exc_info=e)
 
2573
                raise
 
2574
        except EOFError as e:
 
2575
            logger.warning("Could not load persistent state: "
 
2576
                           "EOFError:", exc_info=e)
 
2577
    
 
2578
    with PGPEngine() as pgp:
 
2579
        for client_name, client in clients_data.iteritems():
 
2580
            # Skip removed clients
 
2581
            if client_name not in client_settings:
 
2582
                continue
 
2583
            
 
2584
            # Decide which value to use after restoring saved state.
 
2585
            # We have three different values: Old config file,
 
2586
            # new config file, and saved state.
 
2587
            # New config value takes precedence if it differs from old
 
2588
            # config value, otherwise use saved state.
 
2589
            for name, value in client_settings[client_name].items():
 
2590
                try:
 
2591
                    # For each value in new config, check if it
 
2592
                    # differs from the old config value (Except for
 
2593
                    # the "secret" attribute)
 
2594
                    if (name != "secret" and
 
2595
                        value != old_client_settings[client_name]
 
2596
                        [name]):
 
2597
                        client[name] = value
 
2598
                except KeyError:
 
2599
                    pass
 
2600
            
 
2601
            # Clients who has passed its expire date can still be
 
2602
            # enabled if its last checker was successful.  Clients
 
2603
            # whose checker succeeded before we stored its state is
 
2604
            # assumed to have successfully run all checkers during
 
2605
            # downtime.
 
2606
            if client["enabled"]:
 
2607
                if datetime.datetime.utcnow() >= client["expires"]:
 
2608
                    if not client["last_checked_ok"]:
 
2609
                        logger.warning(
 
2610
                            "disabling client {0} - Client never "
 
2611
                            "performed a successful checker"
 
2612
                            .format(client_name))
 
2613
                        client["enabled"] = False
 
2614
                    elif client["last_checker_status"] != 0:
 
2615
                        logger.warning(
 
2616
                            "disabling client {0} - Client "
 
2617
                            "last checker failed with error code {1}"
 
2618
                            .format(client_name,
 
2619
                                    client["last_checker_status"]))
 
2620
                        client["enabled"] = False
 
2621
                    else:
 
2622
                        client["expires"] = (datetime.datetime
 
2623
                                             .utcnow()
 
2624
                                             + client["timeout"])
 
2625
                        logger.debug("Last checker succeeded,"
 
2626
                                     " keeping {0} enabled"
 
2627
                                     .format(client_name))
1836
2628
            try:
1837
 
                yield (name, special_settings[name]())
1838
 
            except KeyError:
1839
 
                yield (name, value)
1840
 
    
1841
 
    tcp_server.clients.update(set(
1842
 
            client_class(name = section,
1843
 
                         config= dict(client_config_items(
1844
 
                        client_config, section)))
1845
 
            for section in client_config.sections()))
 
2629
                client["secret"] = (
 
2630
                    pgp.decrypt(client["encrypted_secret"],
 
2631
                                client_settings[client_name]
 
2632
                                ["secret"]))
 
2633
            except PGPError:
 
2634
                # If decryption fails, we use secret from new settings
 
2635
                logger.debug("Failed to decrypt {0} old secret"
 
2636
                             .format(client_name))
 
2637
                client["secret"] = (
 
2638
                    client_settings[client_name]["secret"])
 
2639
    
 
2640
    # Add/remove clients based on new changes made to config
 
2641
    for client_name in (set(old_client_settings)
 
2642
                        - set(client_settings)):
 
2643
        del clients_data[client_name]
 
2644
    for client_name in (set(client_settings)
 
2645
                        - set(old_client_settings)):
 
2646
        clients_data[client_name] = client_settings[client_name]
 
2647
    
 
2648
    # Create all client objects
 
2649
    for client_name, client in clients_data.iteritems():
 
2650
        tcp_server.clients[client_name] = client_class(
 
2651
            name = client_name, settings = client,
 
2652
            server_settings = server_settings)
 
2653
    
1846
2654
    if not tcp_server.clients:
1847
 
        logger.warning(u"No clients defined")
1848
 
        
1849
 
    try:
1850
 
        with pidfile:
1851
 
            pid = os.getpid()
1852
 
            pidfile.write(str(pid) + "\n")
 
2655
        logger.warning("No clients defined")
 
2656
    
 
2657
    if not foreground:
 
2658
        if pidfile is not None:
 
2659
            try:
 
2660
                with pidfile:
 
2661
                    pid = os.getpid()
 
2662
                    pidfile.write(str(pid) + "\n".encode("utf-8"))
 
2663
            except IOError:
 
2664
                logger.error("Could not write to file %r with PID %d",
 
2665
                             pidfilename, pid)
1853
2666
        del pidfile
1854
 
    except IOError:
1855
 
        logger.error(u"Could not write to file %r with PID %d",
1856
 
                     pidfilename, pid)
1857
 
    except NameError:
1858
 
        # "pidfile" was never created
1859
 
        pass
1860
 
    del pidfilename
 
2667
        del pidfilename
1861
2668
    
1862
 
    if not debug:
1863
 
        signal.signal(signal.SIGINT, signal.SIG_IGN)
1864
2669
    signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
1865
2670
    signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
1866
2671
    
1867
2672
    if use_dbus:
1868
 
        class MandosDBusService(dbus.service.Object):
 
2673
        @alternate_dbus_interfaces({"se.recompile.Mandos":
 
2674
                                        "se.bsnet.fukt.Mandos"})
 
2675
        class MandosDBusService(DBusObjectWithProperties):
1869
2676
            """A D-Bus proxy object"""
1870
2677
            def __init__(self):
1871
 
                dbus.service.Object.__init__(self, bus, u"/")
1872
 
            _interface = u"se.bsnet.fukt.Mandos"
1873
 
            
1874
 
            @dbus.service.signal(_interface, signature=u"o")
 
2678
                dbus.service.Object.__init__(self, bus, "/")
 
2679
            _interface = "se.recompile.Mandos"
 
2680
            
 
2681
            @dbus_interface_annotations(_interface)
 
2682
            def _foo(self):
 
2683
                return { "org.freedesktop.DBus.Property"
 
2684
                         ".EmitsChangedSignal":
 
2685
                             "false"}
 
2686
            
 
2687
            @dbus.service.signal(_interface, signature="o")
1875
2688
            def ClientAdded(self, objpath):
1876
2689
                "D-Bus signal"
1877
2690
                pass
1878
2691
            
1879
 
            @dbus.service.signal(_interface, signature=u"ss")
 
2692
            @dbus.service.signal(_interface, signature="ss")
1880
2693
            def ClientNotFound(self, fingerprint, address):
1881
2694
                "D-Bus signal"
1882
2695
                pass
1883
2696
            
1884
 
            @dbus.service.signal(_interface, signature=u"os")
 
2697
            @dbus.service.signal(_interface, signature="os")
1885
2698
            def ClientRemoved(self, objpath, name):
1886
2699
                "D-Bus signal"
1887
2700
                pass
1888
2701
            
1889
 
            @dbus.service.method(_interface, out_signature=u"ao")
 
2702
            @dbus.service.method(_interface, out_signature="ao")
1890
2703
            def GetAllClients(self):
1891
2704
                "D-Bus method"
1892
2705
                return dbus.Array(c.dbus_object_path
1893
 
                                  for c in tcp_server.clients)
 
2706
                                  for c in
 
2707
                                  tcp_server.clients.itervalues())
1894
2708
            
1895
2709
            @dbus.service.method(_interface,
1896
 
                                 out_signature=u"a{oa{sv}}")
 
2710
                                 out_signature="a{oa{sv}}")
1897
2711
            def GetAllClientsWithProperties(self):
1898
2712
                "D-Bus method"
1899
2713
                return dbus.Dictionary(
1900
 
                    ((c.dbus_object_path, c.GetAll(u""))
1901
 
                     for c in tcp_server.clients),
1902
 
                    signature=u"oa{sv}")
 
2714
                    ((c.dbus_object_path, c.GetAll(""))
 
2715
                     for c in tcp_server.clients.itervalues()),
 
2716
                    signature="oa{sv}")
1903
2717
            
1904
 
            @dbus.service.method(_interface, in_signature=u"o")
 
2718
            @dbus.service.method(_interface, in_signature="o")
1905
2719
            def RemoveClient(self, object_path):
1906
2720
                "D-Bus method"
1907
 
                for c in tcp_server.clients:
 
2721
                for c in tcp_server.clients.itervalues():
1908
2722
                    if c.dbus_object_path == object_path:
1909
 
                        tcp_server.clients.remove(c)
 
2723
                        del tcp_server.clients[c.name]
1910
2724
                        c.remove_from_connection()
1911
2725
                        # Don't signal anything except ClientRemoved
1912
2726
                        c.disable(quiet=True)
1923
2737
        "Cleanup function; run on exit"
1924
2738
        service.cleanup()
1925
2739
        
 
2740
        multiprocessing.active_children()
 
2741
        wnull.close()
 
2742
        if not (tcp_server.clients or client_settings):
 
2743
            return
 
2744
        
 
2745
        # Store client before exiting. Secrets are encrypted with key
 
2746
        # based on what config file has. If config file is
 
2747
        # removed/edited, old secret will thus be unrecovable.
 
2748
        clients = {}
 
2749
        with PGPEngine() as pgp:
 
2750
            for client in tcp_server.clients.itervalues():
 
2751
                key = client_settings[client.name]["secret"]
 
2752
                client.encrypted_secret = pgp.encrypt(client.secret,
 
2753
                                                      key)
 
2754
                client_dict = {}
 
2755
                
 
2756
                # A list of attributes that can not be pickled
 
2757
                # + secret.
 
2758
                exclude = set(("bus", "changedstate", "secret",
 
2759
                               "checker", "server_settings"))
 
2760
                for name, typ in (inspect.getmembers
 
2761
                                  (dbus.service.Object)):
 
2762
                    exclude.add(name)
 
2763
                
 
2764
                client_dict["encrypted_secret"] = (client
 
2765
                                                   .encrypted_secret)
 
2766
                for attr in client.client_structure:
 
2767
                    if attr not in exclude:
 
2768
                        client_dict[attr] = getattr(client, attr)
 
2769
                
 
2770
                clients[client.name] = client_dict
 
2771
                del client_settings[client.name]["secret"]
 
2772
        
 
2773
        try:
 
2774
            with (tempfile.NamedTemporaryFile
 
2775
                  (mode='wb', suffix=".pickle", prefix='clients-',
 
2776
                   dir=os.path.dirname(stored_state_path),
 
2777
                   delete=False)) as stored_state:
 
2778
                pickle.dump((clients, client_settings), stored_state)
 
2779
                tempname=stored_state.name
 
2780
            os.rename(tempname, stored_state_path)
 
2781
        except (IOError, OSError) as e:
 
2782
            if not debug:
 
2783
                try:
 
2784
                    os.remove(tempname)
 
2785
                except NameError:
 
2786
                    pass
 
2787
            if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
 
2788
                logger.warning("Could not save persistent state: {0}"
 
2789
                               .format(os.strerror(e.errno)))
 
2790
            else:
 
2791
                logger.warning("Could not save persistent state:",
 
2792
                               exc_info=e)
 
2793
                raise e
 
2794
        
 
2795
        # Delete all clients, and settings from config
1926
2796
        while tcp_server.clients:
1927
 
            client = tcp_server.clients.pop()
 
2797
            name, client = tcp_server.clients.popitem()
1928
2798
            if use_dbus:
1929
2799
                client.remove_from_connection()
1930
 
            client.disable_hook = None
1931
2800
            # Don't signal anything except ClientRemoved
1932
2801
            client.disable(quiet=True)
1933
2802
            if use_dbus:
1934
2803
                # Emit D-Bus signal
1935
 
                mandos_dbus_service.ClientRemoved(client.dbus_object_path,
 
2804
                mandos_dbus_service.ClientRemoved(client
 
2805
                                                  .dbus_object_path,
1936
2806
                                                  client.name)
 
2807
        client_settings.clear()
1937
2808
    
1938
2809
    atexit.register(cleanup)
1939
2810
    
1940
 
    for client in tcp_server.clients:
 
2811
    for client in tcp_server.clients.itervalues():
1941
2812
        if use_dbus:
1942
2813
            # Emit D-Bus signal
1943
2814
            mandos_dbus_service.ClientAdded(client.dbus_object_path)
1944
 
        client.enable()
 
2815
        # Need to initiate checking of clients
 
2816
        if client.enabled:
 
2817
            client.init_checker()
1945
2818
    
1946
2819
    tcp_server.enable()
1947
2820
    tcp_server.server_activate()
1949
2822
    # Find out what port we got
1950
2823
    service.port = tcp_server.socket.getsockname()[1]
1951
2824
    if use_ipv6:
1952
 
        logger.info(u"Now listening on address %r, port %d,"
1953
 
                    " flowinfo %d, scope_id %d"
1954
 
                    % tcp_server.socket.getsockname())
 
2825
        logger.info("Now listening on address %r, port %d,"
 
2826
                    " flowinfo %d, scope_id %d",
 
2827
                    *tcp_server.socket.getsockname())
1955
2828
    else:                       # IPv4
1956
 
        logger.info(u"Now listening on address %r, port %d"
1957
 
                    % tcp_server.socket.getsockname())
 
2829
        logger.info("Now listening on address %r, port %d",
 
2830
                    *tcp_server.socket.getsockname())
1958
2831
    
1959
2832
    #service.interface = tcp_server.socket.getsockname()[3]
1960
2833
    
1962
2835
        # From the Avahi example code
1963
2836
        try:
1964
2837
            service.activate()
1965
 
        except dbus.exceptions.DBusException, error:
1966
 
            logger.critical(u"DBusException: %s", error)
 
2838
        except dbus.exceptions.DBusException as error:
 
2839
            logger.critical("D-Bus Exception", exc_info=error)
1967
2840
            cleanup()
1968
2841
            sys.exit(1)
1969
2842
        # End of Avahi example code
1973
2846
                             (tcp_server.handle_request
1974
2847
                              (*args[2:], **kwargs) or True))
1975
2848
        
1976
 
        logger.debug(u"Starting main loop")
 
2849
        logger.debug("Starting main loop")
1977
2850
        main_loop.run()
1978
 
    except AvahiError, error:
1979
 
        logger.critical(u"AvahiError: %s", error)
 
2851
    except AvahiError as error:
 
2852
        logger.critical("Avahi Error", exc_info=error)
1980
2853
        cleanup()
1981
2854
        sys.exit(1)
1982
2855
    except KeyboardInterrupt:
1983
2856
        if debug:
1984
 
            print >> sys.stderr
1985
 
        logger.debug(u"Server received KeyboardInterrupt")
1986
 
    logger.debug(u"Server exiting")
 
2857
            print("", file=sys.stderr)
 
2858
        logger.debug("Server received KeyboardInterrupt")
 
2859
    logger.debug("Server exiting")
1987
2860
    # Must run before the D-Bus bus name gets deregistered
1988
2861
    cleanup()
1989
2862