/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos

  • Committer: Teddy Hogeborn
  • Date: 2013-10-22 19:46:35 UTC
  • Revision ID: teddy@recompile.se-20131022194635-ll6jyg1snrxwe94o
* TODO

Show diffs side-by-side

added added

removed removed

Lines of Context:
1
 
#!/usr/bin/python2.7
 
1
#!/usr/bin/python
2
2
# -*- mode: python; coding: utf-8 -*-
3
3
4
4
# Mandos server - give out binary blobs to connecting clients.
11
11
# "AvahiService" class, and some lines in "main".
12
12
13
13
# Everything else is
14
 
# Copyright © 2008-2015 Teddy Hogeborn
15
 
# Copyright © 2008-2015 Björn Påhlsson
 
14
# Copyright © 2008-2013 Teddy Hogeborn
 
15
# Copyright © 2008-2013 Björn Påhlsson
16
16
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
36
36
 
37
37
from future_builtins import *
38
38
 
39
 
try:
40
 
    import SocketServer as socketserver
41
 
except ImportError:
42
 
    import socketserver
 
39
import SocketServer as socketserver
43
40
import socket
44
41
import argparse
45
42
import datetime
50
47
import gnutls.library.functions
51
48
import gnutls.library.constants
52
49
import gnutls.library.types
53
 
try:
54
 
    import ConfigParser as configparser
55
 
except ImportError:
56
 
    import configparser
 
50
import ConfigParser as configparser
57
51
import sys
58
52
import re
59
53
import os
68
62
import struct
69
63
import fcntl
70
64
import functools
71
 
try:
72
 
    import cPickle as pickle
73
 
except ImportError:
74
 
    import pickle
 
65
import cPickle as pickle
75
66
import multiprocessing
76
67
import types
77
68
import binascii
78
69
import tempfile
79
70
import itertools
80
71
import collections
81
 
import codecs
82
72
 
83
73
import dbus
84
74
import dbus.service
85
 
try:
86
 
    import gobject
87
 
except ImportError:
88
 
    from gi.repository import GObject as gobject
 
75
import gobject
89
76
import avahi
90
77
from dbus.mainloop.glib import DBusGMainLoop
91
78
import ctypes
101
88
    except ImportError:
102
89
        SO_BINDTODEVICE = None
103
90
 
104
 
if sys.version_info.major == 2:
105
 
    str = unicode
106
 
 
107
 
version = "1.6.9"
 
91
version = "1.6.1"
108
92
stored_state_file = "clients.pickle"
109
93
 
110
94
logger = logging.getLogger()
111
 
syslogger = None
 
95
syslogger = (logging.handlers.SysLogHandler
 
96
             (facility = logging.handlers.SysLogHandler.LOG_DAEMON,
 
97
              address = str("/dev/log")))
112
98
 
113
99
try:
114
 
    if_nametoindex = ctypes.cdll.LoadLibrary(
115
 
        ctypes.util.find_library("c")).if_nametoindex
 
100
    if_nametoindex = (ctypes.cdll.LoadLibrary
 
101
                      (ctypes.util.find_library("c"))
 
102
                      .if_nametoindex)
116
103
except (OSError, AttributeError):
117
 
    
118
104
    def if_nametoindex(interface):
119
105
        "Get an interface index the hard way, i.e. using fcntl()"
120
106
        SIOCGIFINDEX = 0x8933  # From /usr/include/linux/sockios.h
121
107
        with contextlib.closing(socket.socket()) as s:
122
108
            ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
123
 
                                struct.pack(b"16s16x", interface))
124
 
        interface_index = struct.unpack("I", ifreq[16:20])[0]
 
109
                                struct.pack(str("16s16x"),
 
110
                                            interface))
 
111
        interface_index = struct.unpack(str("I"),
 
112
                                        ifreq[16:20])[0]
125
113
        return interface_index
126
114
 
127
115
 
128
116
def initlogger(debug, level=logging.WARNING):
129
117
    """init logger and add loglevel"""
130
118
    
131
 
    global syslogger
132
 
    syslogger = (logging.handlers.SysLogHandler(
133
 
        facility = logging.handlers.SysLogHandler.LOG_DAEMON,
134
 
        address = "/dev/log"))
135
119
    syslogger.setFormatter(logging.Formatter
136
120
                           ('Mandos [%(process)d]: %(levelname)s:'
137
121
                            ' %(message)s'))
154
138
 
155
139
class PGPEngine(object):
156
140
    """A simple class for OpenPGP symmetric encryption & decryption"""
157
 
    
158
141
    def __init__(self):
159
142
        self.tempdir = tempfile.mkdtemp(prefix="mandos-")
160
143
        self.gnupgargs = ['--batch',
199
182
    
200
183
    def encrypt(self, data, password):
201
184
        passphrase = self.password_encode(password)
202
 
        with tempfile.NamedTemporaryFile(
203
 
                dir=self.tempdir) as passfile:
 
185
        with tempfile.NamedTemporaryFile(dir=self.tempdir
 
186
                                         ) as passfile:
204
187
            passfile.write(passphrase)
205
188
            passfile.flush()
206
189
            proc = subprocess.Popen(['gpg', '--symmetric',
217
200
    
218
201
    def decrypt(self, data, password):
219
202
        passphrase = self.password_encode(password)
220
 
        with tempfile.NamedTemporaryFile(
221
 
                dir = self.tempdir) as passfile:
 
203
        with tempfile.NamedTemporaryFile(dir = self.tempdir
 
204
                                         ) as passfile:
222
205
            passfile.write(passphrase)
223
206
            passfile.flush()
224
207
            proc = subprocess.Popen(['gpg', '--decrypt',
228
211
                                    stdin = subprocess.PIPE,
229
212
                                    stdout = subprocess.PIPE,
230
213
                                    stderr = subprocess.PIPE)
231
 
            decrypted_plaintext, err = proc.communicate(input = data)
 
214
            decrypted_plaintext, err = proc.communicate(input
 
215
                                                        = data)
232
216
        if proc.returncode != 0:
233
217
            raise PGPError(err)
234
218
        return decrypted_plaintext
237
221
class AvahiError(Exception):
238
222
    def __init__(self, value, *args, **kwargs):
239
223
        self.value = value
240
 
        return super(AvahiError, self).__init__(value, *args,
241
 
                                                **kwargs)
242
 
 
 
224
        super(AvahiError, self).__init__(value, *args, **kwargs)
 
225
    def __unicode__(self):
 
226
        return unicode(repr(self.value))
243
227
 
244
228
class AvahiServiceError(AvahiError):
245
229
    pass
246
230
 
247
 
 
248
231
class AvahiGroupError(AvahiError):
249
232
    pass
250
233
 
270
253
    bus: dbus.SystemBus()
271
254
    """
272
255
    
273
 
    def __init__(self,
274
 
                 interface = avahi.IF_UNSPEC,
275
 
                 name = None,
276
 
                 servicetype = None,
277
 
                 port = None,
278
 
                 TXT = None,
279
 
                 domain = "",
280
 
                 host = "",
281
 
                 max_renames = 32768,
282
 
                 protocol = avahi.PROTO_UNSPEC,
283
 
                 bus = None):
 
256
    def __init__(self, interface = avahi.IF_UNSPEC, name = None,
 
257
                 servicetype = None, port = None, TXT = None,
 
258
                 domain = "", host = "", max_renames = 32768,
 
259
                 protocol = avahi.PROTO_UNSPEC, bus = None):
284
260
        self.interface = interface
285
261
        self.name = name
286
262
        self.type = servicetype
296
272
        self.bus = bus
297
273
        self.entry_group_state_changed_match = None
298
274
    
299
 
    def rename(self, remove=True):
 
275
    def rename(self):
300
276
        """Derived from the Avahi example code"""
301
277
        if self.rename_count >= self.max_renames:
302
278
            logger.critical("No suitable Zeroconf service name found"
303
279
                            " after %i retries, exiting.",
304
280
                            self.rename_count)
305
281
            raise AvahiServiceError("Too many renames")
306
 
        self.name = str(
307
 
            self.server.GetAlternativeServiceName(self.name))
308
 
        self.rename_count += 1
 
282
        self.name = unicode(self.server
 
283
                            .GetAlternativeServiceName(self.name))
309
284
        logger.info("Changing Zeroconf service name to %r ...",
310
285
                    self.name)
311
 
        if remove:
312
 
            self.remove()
 
286
        self.remove()
313
287
        try:
314
288
            self.add()
315
289
        except dbus.exceptions.DBusException as error:
316
 
            if (error.get_dbus_name()
317
 
                == "org.freedesktop.Avahi.CollisionError"):
318
 
                logger.info("Local Zeroconf service name collision.")
319
 
                return self.rename(remove=False)
320
 
            else:
321
 
                logger.critical("D-Bus Exception", exc_info=error)
322
 
                self.cleanup()
323
 
                os._exit(1)
 
290
            logger.critical("D-Bus Exception", exc_info=error)
 
291
            self.cleanup()
 
292
            os._exit(1)
 
293
        self.rename_count += 1
324
294
    
325
295
    def remove(self):
326
296
        """Derived from the Avahi example code"""
364
334
            self.rename()
365
335
        elif state == avahi.ENTRY_GROUP_FAILURE:
366
336
            logger.critical("Avahi: Error in group state changed %s",
367
 
                            str(error))
368
 
            raise AvahiGroupError("State changed: {!s}".format(error))
 
337
                            unicode(error))
 
338
            raise AvahiGroupError("State changed: {0!s}"
 
339
                                  .format(error))
369
340
    
370
341
    def cleanup(self):
371
342
        """Derived from the Avahi example code"""
381
352
    def server_state_changed(self, state, error=None):
382
353
        """Derived from the Avahi example code"""
383
354
        logger.debug("Avahi server state change: %i", state)
384
 
        bad_states = {
385
 
            avahi.SERVER_INVALID: "Zeroconf server invalid",
386
 
            avahi.SERVER_REGISTERING: None,
387
 
            avahi.SERVER_COLLISION: "Zeroconf server name collision",
388
 
            avahi.SERVER_FAILURE: "Zeroconf server failure",
389
 
        }
 
355
        bad_states = { avahi.SERVER_INVALID:
 
356
                           "Zeroconf server invalid",
 
357
                       avahi.SERVER_REGISTERING: None,
 
358
                       avahi.SERVER_COLLISION:
 
359
                           "Zeroconf server name collision",
 
360
                       avahi.SERVER_FAILURE:
 
361
                           "Zeroconf server failure" }
390
362
        if state in bad_states:
391
363
            if bad_states[state] is not None:
392
364
                if error is None:
395
367
                    logger.error(bad_states[state] + ": %r", error)
396
368
            self.cleanup()
397
369
        elif state == avahi.SERVER_RUNNING:
398
 
            try:
399
 
                self.add()
400
 
            except dbus.exceptions.DBusException as error:
401
 
                if (error.get_dbus_name()
402
 
                    == "org.freedesktop.Avahi.CollisionError"):
403
 
                    logger.info("Local Zeroconf service name"
404
 
                                " collision.")
405
 
                    return self.rename(remove=False)
406
 
                else:
407
 
                    logger.critical("D-Bus Exception", exc_info=error)
408
 
                    self.cleanup()
409
 
                    os._exit(1)
 
370
            self.add()
410
371
        else:
411
372
            if error is None:
412
373
                logger.debug("Unknown state: %r", state)
422
383
                                    follow_name_owner_changes=True),
423
384
                avahi.DBUS_INTERFACE_SERVER)
424
385
        self.server.connect_to_signal("StateChanged",
425
 
                                      self.server_state_changed)
 
386
                                 self.server_state_changed)
426
387
        self.server_state_changed(self.server.GetState())
427
388
 
428
389
 
429
390
class AvahiServiceToSyslog(AvahiService):
430
 
    def rename(self, *args, **kwargs):
 
391
    def rename(self):
431
392
        """Add the new name to the syslog messages"""
432
 
        ret = AvahiService.rename(self, *args, **kwargs)
433
 
        syslogger.setFormatter(logging.Formatter(
434
 
            'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
435
 
            .format(self.name)))
 
393
        ret = AvahiService.rename(self)
 
394
        syslogger.setFormatter(logging.Formatter
 
395
                               ('Mandos ({0}) [%(process)d]:'
 
396
                                ' %(levelname)s: %(message)s'
 
397
                                .format(self.name)))
436
398
        return ret
437
399
 
438
 
def call_pipe(connection,       # : multiprocessing.Connection
439
 
              func, *args, **kwargs):
440
 
    """This function is meant to be called by multiprocessing.Process
441
 
    
442
 
    This function runs func(*args, **kwargs), and writes the resulting
443
 
    return value on the provided multiprocessing.Connection.
444
 
    """
445
 
    connection.send(func(*args, **kwargs))
446
 
    connection.close()
 
400
 
 
401
def timedelta_to_milliseconds(td):
 
402
    "Convert a datetime.timedelta() to milliseconds"
 
403
    return ((td.days * 24 * 60 * 60 * 1000)
 
404
            + (td.seconds * 1000)
 
405
            + (td.microseconds // 1000))
 
406
 
447
407
 
448
408
class Client(object):
449
409
    """A representation of a client host served by this server.
476
436
    last_checker_status: integer between 0 and 255 reflecting exit
477
437
                         status of last checker. -1 reflects crashed
478
438
                         checker, -2 means no checker completed yet.
479
 
    last_checker_signal: The signal which killed the last checker, if
480
 
                         last_checker_status is -1
481
439
    last_enabled: datetime.datetime(); (UTC) or None
482
440
    name:       string; from the config file, used in log messages and
483
441
                        D-Bus identifiers
496
454
                          "fingerprint", "host", "interval",
497
455
                          "last_approval_request", "last_checked_ok",
498
456
                          "last_enabled", "name", "timeout")
499
 
    client_defaults = {
500
 
        "timeout": "PT5M",
501
 
        "extended_timeout": "PT15M",
502
 
        "interval": "PT2M",
503
 
        "checker": "fping -q -- %%(host)s",
504
 
        "host": "",
505
 
        "approval_delay": "PT0S",
506
 
        "approval_duration": "PT1S",
507
 
        "approved_by_default": "True",
508
 
        "enabled": "True",
509
 
    }
 
457
    client_defaults = { "timeout": "PT5M",
 
458
                        "extended_timeout": "PT15M",
 
459
                        "interval": "PT2M",
 
460
                        "checker": "fping -q -- %%(host)s",
 
461
                        "host": "",
 
462
                        "approval_delay": "PT0S",
 
463
                        "approval_duration": "PT1S",
 
464
                        "approved_by_default": "True",
 
465
                        "enabled": "True",
 
466
                        }
 
467
    
 
468
    def timeout_milliseconds(self):
 
469
        "Return the 'timeout' attribute in milliseconds"
 
470
        return timedelta_to_milliseconds(self.timeout)
 
471
    
 
472
    def extended_timeout_milliseconds(self):
 
473
        "Return the 'extended_timeout' attribute in milliseconds"
 
474
        return timedelta_to_milliseconds(self.extended_timeout)
 
475
    
 
476
    def interval_milliseconds(self):
 
477
        "Return the 'interval' attribute in milliseconds"
 
478
        return timedelta_to_milliseconds(self.interval)
 
479
    
 
480
    def approval_delay_milliseconds(self):
 
481
        return timedelta_to_milliseconds(self.approval_delay)
510
482
    
511
483
    @staticmethod
512
484
    def config_parser(config):
528
500
            client["enabled"] = config.getboolean(client_name,
529
501
                                                  "enabled")
530
502
            
531
 
            # Uppercase and remove spaces from fingerprint for later
532
 
            # comparison purposes with return value from the
533
 
            # fingerprint() function
534
503
            client["fingerprint"] = (section["fingerprint"].upper()
535
504
                                     .replace(" ", ""))
536
505
            if "secret" in section:
541
510
                          "rb") as secfile:
542
511
                    client["secret"] = secfile.read()
543
512
            else:
544
 
                raise TypeError("No secret or secfile for section {}"
 
513
                raise TypeError("No secret or secfile for section {0}"
545
514
                                .format(section))
546
515
            client["timeout"] = string_to_delta(section["timeout"])
547
516
            client["extended_timeout"] = string_to_delta(
564
533
            server_settings = {}
565
534
        self.server_settings = server_settings
566
535
        # adding all client settings
567
 
        for setting, value in settings.items():
 
536
        for setting, value in settings.iteritems():
568
537
            setattr(self, setting, value)
569
538
        
570
539
        if self.enabled:
578
547
            self.expires = None
579
548
        
580
549
        logger.debug("Creating client %r", self.name)
 
550
        # Uppercase and remove spaces from fingerprint for later
 
551
        # comparison purposes with return value from the fingerprint()
 
552
        # function
581
553
        logger.debug("  Fingerprint: %s", self.fingerprint)
582
554
        self.created = settings.get("created",
583
555
                                    datetime.datetime.utcnow())
590
562
        self.current_checker_command = None
591
563
        self.approved = None
592
564
        self.approvals_pending = 0
593
 
        self.changedstate = multiprocessing_manager.Condition(
594
 
            multiprocessing_manager.Lock())
595
 
        self.client_structure = [attr
596
 
                                 for attr in self.__dict__.iterkeys()
 
565
        self.changedstate = (multiprocessing_manager
 
566
                             .Condition(multiprocessing_manager
 
567
                                        .Lock()))
 
568
        self.client_structure = [attr for attr in
 
569
                                 self.__dict__.iterkeys()
597
570
                                 if not attr.startswith("_")]
598
571
        self.client_structure.append("client_structure")
599
572
        
600
 
        for name, t in inspect.getmembers(
601
 
                type(self), lambda obj: isinstance(obj, property)):
 
573
        for name, t in inspect.getmembers(type(self),
 
574
                                          lambda obj:
 
575
                                              isinstance(obj,
 
576
                                                         property)):
602
577
            if not name.startswith("_"):
603
578
                self.client_structure.append(name)
604
579
    
646
621
        # and every interval from then on.
647
622
        if self.checker_initiator_tag is not None:
648
623
            gobject.source_remove(self.checker_initiator_tag)
649
 
        self.checker_initiator_tag = gobject.timeout_add(
650
 
            int(self.interval.total_seconds() * 1000),
651
 
            self.start_checker)
 
624
        self.checker_initiator_tag = (gobject.timeout_add
 
625
                                      (self.interval_milliseconds(),
 
626
                                       self.start_checker))
652
627
        # Schedule a disable() when 'timeout' has passed
653
628
        if self.disable_initiator_tag is not None:
654
629
            gobject.source_remove(self.disable_initiator_tag)
655
 
        self.disable_initiator_tag = gobject.timeout_add(
656
 
            int(self.timeout.total_seconds() * 1000), self.disable)
 
630
        self.disable_initiator_tag = (gobject.timeout_add
 
631
                                   (self.timeout_milliseconds(),
 
632
                                    self.disable))
657
633
        # Also start a new checker *right now*.
658
634
        self.start_checker()
659
635
    
660
 
    def checker_callback(self, source, condition, connection,
661
 
                         command):
 
636
    def checker_callback(self, pid, condition, command):
662
637
        """The checker has completed, so take appropriate actions."""
663
638
        self.checker_callback_tag = None
664
639
        self.checker = None
665
 
        # Read return code from connection (see call_pipe)
666
 
        returncode = connection.recv()
667
 
        connection.close()
668
 
        
669
 
        if returncode >= 0:
670
 
            self.last_checker_status = returncode
671
 
            self.last_checker_signal = None
 
640
        if os.WIFEXITED(condition):
 
641
            self.last_checker_status = os.WEXITSTATUS(condition)
672
642
            if self.last_checker_status == 0:
673
643
                logger.info("Checker for %(name)s succeeded",
674
644
                            vars(self))
675
645
                self.checked_ok()
676
646
            else:
677
 
                logger.info("Checker for %(name)s failed", vars(self))
 
647
                logger.info("Checker for %(name)s failed",
 
648
                            vars(self))
678
649
        else:
679
650
            self.last_checker_status = -1
680
 
            self.last_checker_signal = -returncode
681
651
            logger.warning("Checker for %(name)s crashed?",
682
652
                           vars(self))
683
 
        return False
684
653
    
685
654
    def checked_ok(self):
686
655
        """Assert that the client has been seen, alive and well."""
687
656
        self.last_checked_ok = datetime.datetime.utcnow()
688
657
        self.last_checker_status = 0
689
 
        self.last_checker_signal = None
690
658
        self.bump_timeout()
691
659
    
692
660
    def bump_timeout(self, timeout=None):
697
665
            gobject.source_remove(self.disable_initiator_tag)
698
666
            self.disable_initiator_tag = None
699
667
        if getattr(self, "enabled", False):
700
 
            self.disable_initiator_tag = gobject.timeout_add(
701
 
                int(timeout.total_seconds() * 1000), self.disable)
 
668
            self.disable_initiator_tag = (gobject.timeout_add
 
669
                                          (timedelta_to_milliseconds
 
670
                                           (timeout), self.disable))
702
671
            self.expires = datetime.datetime.utcnow() + timeout
703
672
    
704
673
    def need_approval(self):
718
687
        # than 'timeout' for the client to be disabled, which is as it
719
688
        # should be.
720
689
        
721
 
        if self.checker is not None and not self.checker.is_alive():
722
 
            logger.warning("Checker was not alive; joining")
723
 
            self.checker.join()
724
 
            self.checker = None
 
690
        # If a checker exists, make sure it is not a zombie
 
691
        try:
 
692
            pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
 
693
        except (AttributeError, OSError) as error:
 
694
            if (isinstance(error, OSError)
 
695
                and error.errno != errno.ECHILD):
 
696
                raise error
 
697
        else:
 
698
            if pid:
 
699
                logger.warning("Checker was a zombie")
 
700
                gobject.source_remove(self.checker_callback_tag)
 
701
                self.checker_callback(pid, status,
 
702
                                      self.current_checker_command)
725
703
        # Start a new checker if needed
726
704
        if self.checker is None:
727
705
            # Escape attributes for the shell
728
 
            escaped_attrs = {
729
 
                attr: re.escape(str(getattr(self, attr)))
730
 
                for attr in self.runtime_expansions }
 
706
            escaped_attrs = dict(
 
707
                (attr, re.escape(unicode(getattr(self, attr))))
 
708
                for attr in
 
709
                self.runtime_expansions)
731
710
            try:
732
711
                command = self.checker_command % escaped_attrs
733
712
            except TypeError as error:
734
713
                logger.error('Could not format string "%s"',
735
 
                             self.checker_command,
 
714
                             self.checker_command, exc_info=error)
 
715
                return True # Try again later
 
716
            self.current_checker_command = command
 
717
            try:
 
718
                logger.info("Starting checker %r for %s",
 
719
                            command, self.name)
 
720
                # We don't need to redirect stdout and stderr, since
 
721
                # in normal mode, that is already done by daemon(),
 
722
                # and in debug mode we don't want to.  (Stdin is
 
723
                # always replaced by /dev/null.)
 
724
                # The exception is when not debugging but nevertheless
 
725
                # running in the foreground; use the previously
 
726
                # created wnull.
 
727
                popen_args = {}
 
728
                if (not self.server_settings["debug"]
 
729
                    and self.server_settings["foreground"]):
 
730
                    popen_args.update({"stdout": wnull,
 
731
                                       "stderr": wnull })
 
732
                self.checker = subprocess.Popen(command,
 
733
                                                close_fds=True,
 
734
                                                shell=True, cwd="/",
 
735
                                                **popen_args)
 
736
            except OSError as error:
 
737
                logger.error("Failed to start subprocess",
736
738
                             exc_info=error)
737
 
                return True     # Try again later
738
 
            self.current_checker_command = command
739
 
            logger.info("Starting checker %r for %s", command,
740
 
                        self.name)
741
 
            # We don't need to redirect stdout and stderr, since
742
 
            # in normal mode, that is already done by daemon(),
743
 
            # and in debug mode we don't want to.  (Stdin is
744
 
            # always replaced by /dev/null.)
745
 
            # The exception is when not debugging but nevertheless
746
 
            # running in the foreground; use the previously
747
 
            # created wnull.
748
 
            popen_args = { "close_fds": True,
749
 
                           "shell": True,
750
 
                           "cwd": "/" }
751
 
            if (not self.server_settings["debug"]
752
 
                and self.server_settings["foreground"]):
753
 
                popen_args.update({"stdout": wnull,
754
 
                                   "stderr": wnull })
755
 
            pipe = multiprocessing.Pipe(duplex = False)
756
 
            self.checker = multiprocessing.Process(
757
 
                target = call_pipe,
758
 
                args = (pipe[1], subprocess.call, command),
759
 
                kwargs = popen_args)
760
 
            self.checker.start()
761
 
            self.checker_callback_tag = gobject.io_add_watch(
762
 
                pipe[0].fileno(), gobject.IO_IN,
763
 
                self.checker_callback, pipe[0], command)
 
739
                return True
 
740
            self.checker_callback_tag = (gobject.child_watch_add
 
741
                                         (self.checker.pid,
 
742
                                          self.checker_callback,
 
743
                                          data=command))
 
744
            # The checker may have completed before the gobject
 
745
            # watch was added.  Check for this.
 
746
            try:
 
747
                pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
 
748
            except OSError as error:
 
749
                if error.errno == errno.ECHILD:
 
750
                    # This should never happen
 
751
                    logger.error("Child process vanished",
 
752
                                 exc_info=error)
 
753
                    return True
 
754
                raise
 
755
            if pid:
 
756
                gobject.source_remove(self.checker_callback_tag)
 
757
                self.checker_callback(pid, status, command)
764
758
        # Re-run this periodically if run by gobject.timeout_add
765
759
        return True
766
760
    
772
766
        if getattr(self, "checker", None) is None:
773
767
            return
774
768
        logger.debug("Stopping checker for %(name)s", vars(self))
775
 
        self.checker.terminate()
 
769
        try:
 
770
            self.checker.terminate()
 
771
            #time.sleep(0.5)
 
772
            #if self.checker.poll() is None:
 
773
            #    self.checker.kill()
 
774
        except OSError as error:
 
775
            if error.errno != errno.ESRCH: # No such process
 
776
                raise
776
777
        self.checker = None
777
778
 
778
779
 
779
 
def dbus_service_property(dbus_interface,
780
 
                          signature="v",
781
 
                          access="readwrite",
782
 
                          byte_arrays=False):
 
780
def dbus_service_property(dbus_interface, signature="v",
 
781
                          access="readwrite", byte_arrays=False):
783
782
    """Decorators for marking methods of a DBusObjectWithProperties to
784
783
    become properties on the D-Bus.
785
784
    
794
793
    # "Set" method, so we fail early here:
795
794
    if byte_arrays and signature != "ay":
796
795
        raise ValueError("Byte arrays not supported for non-'ay'"
797
 
                         " signature {!r}".format(signature))
798
 
    
 
796
                         " signature {0!r}".format(signature))
799
797
    def decorator(func):
800
798
        func._dbus_is_property = True
801
799
        func._dbus_interface = dbus_interface
806
804
            func._dbus_name = func._dbus_name[:-14]
807
805
        func._dbus_get_args_options = {'byte_arrays': byte_arrays }
808
806
        return func
809
 
    
810
807
    return decorator
811
808
 
812
809
 
821
818
                "org.freedesktop.DBus.Property.EmitsChangedSignal":
822
819
                    "false"}
823
820
    """
824
 
    
825
821
    def decorator(func):
826
822
        func._dbus_is_interface = True
827
823
        func._dbus_interface = dbus_interface
828
824
        func._dbus_name = dbus_interface
829
825
        return func
830
 
    
831
826
    return decorator
832
827
 
833
828
 
835
830
    """Decorator to annotate D-Bus methods, signals or properties
836
831
    Usage:
837
832
    
838
 
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",
839
 
                       "org.freedesktop.DBus.Property."
840
 
                       "EmitsChangedSignal": "false"})
841
833
    @dbus_service_property("org.example.Interface", signature="b",
842
834
                           access="r")
 
835
    @dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",
 
836
                        "org.freedesktop.DBus.Property."
 
837
                        "EmitsChangedSignal": "false"})
843
838
    def Property_dbus_property(self):
844
839
        return dbus.Boolean(False)
845
840
    """
846
 
    
847
841
    def decorator(func):
848
842
        func._dbus_annotations = annotations
849
843
        return func
850
 
    
851
844
    return decorator
852
845
 
853
846
 
854
847
class DBusPropertyException(dbus.exceptions.DBusException):
855
848
    """A base class for D-Bus property-related exceptions
856
849
    """
857
 
    pass
 
850
    def __unicode__(self):
 
851
        return unicode(str(self))
858
852
 
859
853
 
860
854
class DBusPropertyAccessException(DBusPropertyException):
884
878
        If called like _is_dbus_thing("method") it returns a function
885
879
        suitable for use as predicate to inspect.getmembers().
886
880
        """
887
 
        return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
 
881
        return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),
888
882
                                   False)
889
883
    
890
884
    def _get_all_dbus_things(self, thing):
891
885
        """Returns a generator of (name, attribute) pairs
892
886
        """
893
 
        return ((getattr(athing.__get__(self), "_dbus_name", name),
 
887
        return ((getattr(athing.__get__(self), "_dbus_name",
 
888
                         name),
894
889
                 athing.__get__(self))
895
890
                for cls in self.__class__.__mro__
896
891
                for name, athing in
897
 
                inspect.getmembers(cls, self._is_dbus_thing(thing)))
 
892
                inspect.getmembers(cls,
 
893
                                   self._is_dbus_thing(thing)))
898
894
    
899
895
    def _get_dbus_property(self, interface_name, property_name):
900
896
        """Returns a bound method if one exists which is a D-Bus
901
897
        property with the specified name and interface.
902
898
        """
903
 
        for cls in self.__class__.__mro__:
904
 
            for name, value in inspect.getmembers(
905
 
                    cls, self._is_dbus_thing("property")):
 
899
        for cls in  self.__class__.__mro__:
 
900
            for name, value in (inspect.getmembers
 
901
                                (cls,
 
902
                                 self._is_dbus_thing("property"))):
906
903
                if (value._dbus_name == property_name
907
904
                    and value._dbus_interface == interface_name):
908
905
                    return value.__get__(self)
909
906
        
910
907
        # No such property
911
 
        raise DBusPropertyNotFound("{}:{}.{}".format(
912
 
            self.dbus_object_path, interface_name, property_name))
 
908
        raise DBusPropertyNotFound(self.dbus_object_path + ":"
 
909
                                   + interface_name + "."
 
910
                                   + property_name)
913
911
    
914
 
    @dbus.service.method(dbus.PROPERTIES_IFACE,
915
 
                         in_signature="ss",
 
912
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
916
913
                         out_signature="v")
917
914
    def Get(self, interface_name, property_name):
918
915
        """Standard D-Bus property Get() method, see D-Bus standard.
936
933
            # The byte_arrays option is not supported yet on
937
934
            # signatures other than "ay".
938
935
            if prop._dbus_signature != "ay":
939
 
                raise ValueError("Byte arrays not supported for non-"
940
 
                                 "'ay' signature {!r}"
941
 
                                 .format(prop._dbus_signature))
 
936
                raise ValueError
942
937
            value = dbus.ByteArray(b''.join(chr(byte)
943
938
                                            for byte in value))
944
939
        prop(value)
945
940
    
946
 
    @dbus.service.method(dbus.PROPERTIES_IFACE,
947
 
                         in_signature="s",
 
941
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
948
942
                         out_signature="a{sv}")
949
943
    def GetAll(self, interface_name):
950
944
        """Standard D-Bus property GetAll() method, see D-Bus
965
959
            if not hasattr(value, "variant_level"):
966
960
                properties[name] = value
967
961
                continue
968
 
            properties[name] = type(value)(
969
 
                value, variant_level = value.variant_level + 1)
 
962
            properties[name] = type(value)(value, variant_level=
 
963
                                           value.variant_level+1)
970
964
        return dbus.Dictionary(properties, signature="sv")
971
965
    
972
 
    @dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")
973
 
    def PropertiesChanged(self, interface_name, changed_properties,
974
 
                          invalidated_properties):
975
 
        """Standard D-Bus PropertiesChanged() signal, see D-Bus
976
 
        standard.
977
 
        """
978
 
        pass
979
 
    
980
966
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
981
967
                         out_signature="s",
982
968
                         path_keyword='object_path',
990
976
                                                   connection)
991
977
        try:
992
978
            document = xml.dom.minidom.parseString(xmlstring)
993
 
            
994
979
            def make_tag(document, name, prop):
995
980
                e = document.createElement("property")
996
981
                e.setAttribute("name", name)
997
982
                e.setAttribute("type", prop._dbus_signature)
998
983
                e.setAttribute("access", prop._dbus_access)
999
984
                return e
1000
 
            
1001
985
            for if_tag in document.getElementsByTagName("interface"):
1002
986
                # Add property tags
1003
987
                for tag in (make_tag(document, name, prop)
1015
999
                            if (name == tag.getAttribute("name")
1016
1000
                                and prop._dbus_interface
1017
1001
                                == if_tag.getAttribute("name")):
1018
 
                                annots.update(getattr(
1019
 
                                    prop, "_dbus_annotations", {}))
1020
 
                        for name, value in annots.items():
 
1002
                                annots.update(getattr
 
1003
                                              (prop,
 
1004
                                               "_dbus_annotations",
 
1005
                                               {}))
 
1006
                        for name, value in annots.iteritems():
1021
1007
                            ann_tag = document.createElement(
1022
1008
                                "annotation")
1023
1009
                            ann_tag.setAttribute("name", name)
1026
1012
                # Add interface annotation tags
1027
1013
                for annotation, value in dict(
1028
1014
                    itertools.chain.from_iterable(
1029
 
                        annotations().items()
1030
 
                        for name, annotations
1031
 
                        in self._get_all_dbus_things("interface")
 
1015
                        annotations().iteritems()
 
1016
                        for name, annotations in
 
1017
                        self._get_all_dbus_things("interface")
1032
1018
                        if name == if_tag.getAttribute("name")
1033
 
                        )).items():
 
1019
                        )).iteritems():
1034
1020
                    ann_tag = document.createElement("annotation")
1035
1021
                    ann_tag.setAttribute("name", annotation)
1036
1022
                    ann_tag.setAttribute("value", value)
1063
1049
    """Convert a UTC datetime.datetime() to a D-Bus type."""
1064
1050
    if dt is None:
1065
1051
        return dbus.String("", variant_level = variant_level)
1066
 
    return dbus.String(dt.isoformat(), variant_level=variant_level)
 
1052
    return dbus.String(dt.isoformat(),
 
1053
                       variant_level=variant_level)
1067
1054
 
1068
1055
 
1069
1056
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
1089
1076
    (from DBusObjectWithProperties) and interfaces (from the
1090
1077
    dbus_interface_annotations decorator).
1091
1078
    """
1092
 
    
1093
1079
    def wrapper(cls):
1094
1080
        for orig_interface_name, alt_interface_name in (
1095
 
                alt_interface_names.items()):
 
1081
            alt_interface_names.iteritems()):
1096
1082
            attr = {}
1097
1083
            interface_names = set()
1098
1084
            # Go though all attributes of the class
1100
1086
                # Ignore non-D-Bus attributes, and D-Bus attributes
1101
1087
                # with the wrong interface name
1102
1088
                if (not hasattr(attribute, "_dbus_interface")
1103
 
                    or not attribute._dbus_interface.startswith(
1104
 
                        orig_interface_name)):
 
1089
                    or not attribute._dbus_interface
 
1090
                    .startswith(orig_interface_name)):
1105
1091
                    continue
1106
1092
                # Create an alternate D-Bus interface name based on
1107
1093
                # the current name
1108
 
                alt_interface = attribute._dbus_interface.replace(
1109
 
                    orig_interface_name, alt_interface_name)
 
1094
                alt_interface = (attribute._dbus_interface
 
1095
                                 .replace(orig_interface_name,
 
1096
                                          alt_interface_name))
1110
1097
                interface_names.add(alt_interface)
1111
1098
                # Is this a D-Bus signal?
1112
1099
                if getattr(attribute, "_dbus_is_signal", False):
1113
 
                    if sys.version_info.major == 2:
1114
 
                        # Extract the original non-method undecorated
1115
 
                        # function by black magic
1116
 
                        nonmethod_func = (dict(
 
1100
                    # Extract the original non-method undecorated
 
1101
                    # function by black magic
 
1102
                    nonmethod_func = (dict(
1117
1103
                            zip(attribute.func_code.co_freevars,
1118
 
                                attribute.__closure__))
1119
 
                                          ["func"].cell_contents)
1120
 
                    else:
1121
 
                        nonmethod_func = attribute
 
1104
                                attribute.__closure__))["func"]
 
1105
                                      .cell_contents)
1122
1106
                    # Create a new, but exactly alike, function
1123
1107
                    # object, and decorate it to be a new D-Bus signal
1124
1108
                    # with the alternate D-Bus interface name
1125
 
                    if sys.version_info.major == 2:
1126
 
                        new_function = types.FunctionType(
1127
 
                            nonmethod_func.func_code,
1128
 
                            nonmethod_func.func_globals,
1129
 
                            nonmethod_func.func_name,
1130
 
                            nonmethod_func.func_defaults,
1131
 
                            nonmethod_func.func_closure)
1132
 
                    else:
1133
 
                        new_function = types.FunctionType(
1134
 
                            nonmethod_func.__code__,
1135
 
                            nonmethod_func.__globals__,
1136
 
                            nonmethod_func.__name__,
1137
 
                            nonmethod_func.__defaults__,
1138
 
                            nonmethod_func.__closure__)
1139
 
                    new_function = (dbus.service.signal(
1140
 
                        alt_interface,
1141
 
                        attribute._dbus_signature)(new_function))
 
1109
                    new_function = (dbus.service.signal
 
1110
                                    (alt_interface,
 
1111
                                     attribute._dbus_signature)
 
1112
                                    (types.FunctionType(
 
1113
                                nonmethod_func.func_code,
 
1114
                                nonmethod_func.func_globals,
 
1115
                                nonmethod_func.func_name,
 
1116
                                nonmethod_func.func_defaults,
 
1117
                                nonmethod_func.func_closure)))
1142
1118
                    # Copy annotations, if any
1143
1119
                    try:
1144
 
                        new_function._dbus_annotations = dict(
1145
 
                            attribute._dbus_annotations)
 
1120
                        new_function._dbus_annotations = (
 
1121
                            dict(attribute._dbus_annotations))
1146
1122
                    except AttributeError:
1147
1123
                        pass
1148
1124
                    # Define a creator of a function to call both the
1153
1129
                        """This function is a scope container to pass
1154
1130
                        func1 and func2 to the "call_both" function
1155
1131
                        outside of its arguments"""
1156
 
                        
1157
1132
                        def call_both(*args, **kwargs):
1158
1133
                            """This function will emit two D-Bus
1159
1134
                            signals by calling func1 and func2"""
1160
1135
                            func1(*args, **kwargs)
1161
1136
                            func2(*args, **kwargs)
1162
 
                        
1163
1137
                        return call_both
1164
1138
                    # Create the "call_both" function and add it to
1165
1139
                    # the class
1170
1144
                    # object.  Decorate it to be a new D-Bus method
1171
1145
                    # with the alternate D-Bus interface name.  Add it
1172
1146
                    # to the class.
1173
 
                    attr[attrname] = (
1174
 
                        dbus.service.method(
1175
 
                            alt_interface,
1176
 
                            attribute._dbus_in_signature,
1177
 
                            attribute._dbus_out_signature)
1178
 
                        (types.FunctionType(attribute.func_code,
1179
 
                                            attribute.func_globals,
1180
 
                                            attribute.func_name,
1181
 
                                            attribute.func_defaults,
1182
 
                                            attribute.func_closure)))
 
1147
                    attr[attrname] = (dbus.service.method
 
1148
                                      (alt_interface,
 
1149
                                       attribute._dbus_in_signature,
 
1150
                                       attribute._dbus_out_signature)
 
1151
                                      (types.FunctionType
 
1152
                                       (attribute.func_code,
 
1153
                                        attribute.func_globals,
 
1154
                                        attribute.func_name,
 
1155
                                        attribute.func_defaults,
 
1156
                                        attribute.func_closure)))
1183
1157
                    # Copy annotations, if any
1184
1158
                    try:
1185
 
                        attr[attrname]._dbus_annotations = dict(
1186
 
                            attribute._dbus_annotations)
 
1159
                        attr[attrname]._dbus_annotations = (
 
1160
                            dict(attribute._dbus_annotations))
1187
1161
                    except AttributeError:
1188
1162
                        pass
1189
1163
                # Is this a D-Bus property?
1192
1166
                    # object, and decorate it to be a new D-Bus
1193
1167
                    # property with the alternate D-Bus interface
1194
1168
                    # name.  Add it to the class.
1195
 
                    attr[attrname] = (dbus_service_property(
1196
 
                        alt_interface, attribute._dbus_signature,
1197
 
                        attribute._dbus_access,
1198
 
                        attribute._dbus_get_args_options
1199
 
                        ["byte_arrays"])
1200
 
                                      (types.FunctionType(
1201
 
                                          attribute.func_code,
1202
 
                                          attribute.func_globals,
1203
 
                                          attribute.func_name,
1204
 
                                          attribute.func_defaults,
1205
 
                                          attribute.func_closure)))
 
1169
                    attr[attrname] = (dbus_service_property
 
1170
                                      (alt_interface,
 
1171
                                       attribute._dbus_signature,
 
1172
                                       attribute._dbus_access,
 
1173
                                       attribute
 
1174
                                       ._dbus_get_args_options
 
1175
                                       ["byte_arrays"])
 
1176
                                      (types.FunctionType
 
1177
                                       (attribute.func_code,
 
1178
                                        attribute.func_globals,
 
1179
                                        attribute.func_name,
 
1180
                                        attribute.func_defaults,
 
1181
                                        attribute.func_closure)))
1206
1182
                    # Copy annotations, if any
1207
1183
                    try:
1208
 
                        attr[attrname]._dbus_annotations = dict(
1209
 
                            attribute._dbus_annotations)
 
1184
                        attr[attrname]._dbus_annotations = (
 
1185
                            dict(attribute._dbus_annotations))
1210
1186
                    except AttributeError:
1211
1187
                        pass
1212
1188
                # Is this a D-Bus interface?
1215
1191
                    # object.  Decorate it to be a new D-Bus interface
1216
1192
                    # with the alternate D-Bus interface name.  Add it
1217
1193
                    # to the class.
1218
 
                    attr[attrname] = (
1219
 
                        dbus_interface_annotations(alt_interface)
1220
 
                        (types.FunctionType(attribute.func_code,
1221
 
                                            attribute.func_globals,
1222
 
                                            attribute.func_name,
1223
 
                                            attribute.func_defaults,
1224
 
                                            attribute.func_closure)))
 
1194
                    attr[attrname] = (dbus_interface_annotations
 
1195
                                      (alt_interface)
 
1196
                                      (types.FunctionType
 
1197
                                       (attribute.func_code,
 
1198
                                        attribute.func_globals,
 
1199
                                        attribute.func_name,
 
1200
                                        attribute.func_defaults,
 
1201
                                        attribute.func_closure)))
1225
1202
            if deprecate:
1226
1203
                # Deprecate all alternate interfaces
1227
 
                iname="_AlternateDBusNames_interface_annotation{}"
 
1204
                iname="_AlternateDBusNames_interface_annotation{0}"
1228
1205
                for interface_name in interface_names:
1229
 
                    
1230
1206
                    @dbus_interface_annotations(interface_name)
1231
1207
                    def func(self):
1232
1208
                        return { "org.freedesktop.DBus.Deprecated":
1233
 
                                 "true" }
 
1209
                                     "true" }
1234
1210
                    # Find an unused name
1235
1211
                    for aname in (iname.format(i)
1236
1212
                                  for i in itertools.count()):
1240
1216
            if interface_names:
1241
1217
                # Replace the class with a new subclass of it with
1242
1218
                # methods, signals, etc. as created above.
1243
 
                cls = type(b"{}Alternate".format(cls.__name__),
1244
 
                           (cls, ), attr)
 
1219
                cls = type(b"{0}Alternate".format(cls.__name__),
 
1220
                           (cls,), attr)
1245
1221
        return cls
1246
 
    
1247
1222
    return wrapper
1248
1223
 
1249
1224
 
1250
1225
@alternate_dbus_interfaces({"se.recompile.Mandos":
1251
 
                            "se.bsnet.fukt.Mandos"})
 
1226
                                "se.bsnet.fukt.Mandos"})
1252
1227
class ClientDBus(Client, DBusObjectWithProperties):
1253
1228
    """A Client class using D-Bus
1254
1229
    
1258
1233
    """
1259
1234
    
1260
1235
    runtime_expansions = (Client.runtime_expansions
1261
 
                          + ("dbus_object_path", ))
1262
 
    
1263
 
    _interface = "se.recompile.Mandos.Client"
 
1236
                          + ("dbus_object_path",))
1264
1237
    
1265
1238
    # dbus.service.Object doesn't use super(), so we can't either.
1266
1239
    
1269
1242
        Client.__init__(self, *args, **kwargs)
1270
1243
        # Only now, when this client is initialized, can it show up on
1271
1244
        # the D-Bus
1272
 
        client_object_name = str(self.name).translate(
 
1245
        client_object_name = unicode(self.name).translate(
1273
1246
            {ord("."): ord("_"),
1274
1247
             ord("-"): ord("_")})
1275
 
        self.dbus_object_path = dbus.ObjectPath(
1276
 
            "/clients/" + client_object_name)
 
1248
        self.dbus_object_path = (dbus.ObjectPath
 
1249
                                 ("/clients/" + client_object_name))
1277
1250
        DBusObjectWithProperties.__init__(self, self.bus,
1278
1251
                                          self.dbus_object_path)
1279
1252
    
1280
 
    def notifychangeproperty(transform_func, dbus_name,
1281
 
                             type_func=lambda x: x,
1282
 
                             variant_level=1,
1283
 
                             invalidate_only=False,
1284
 
                             _interface=_interface):
 
1253
    def notifychangeproperty(transform_func,
 
1254
                             dbus_name, type_func=lambda x: x,
 
1255
                             variant_level=1):
1285
1256
        """ Modify a variable so that it's a property which announces
1286
1257
        its changes to DBus.
1287
1258
        
1292
1263
                   to the D-Bus.  Default: no transform
1293
1264
        variant_level: D-Bus variant level.  Default: 1
1294
1265
        """
1295
 
        attrname = "_{}".format(dbus_name)
1296
 
        
 
1266
        attrname = "_{0}".format(dbus_name)
1297
1267
        def setter(self, value):
1298
1268
            if hasattr(self, "dbus_object_path"):
1299
1269
                if (not hasattr(self, attrname) or
1300
1270
                    type_func(getattr(self, attrname, None))
1301
1271
                    != type_func(value)):
1302
 
                    if invalidate_only:
1303
 
                        self.PropertiesChanged(
1304
 
                            _interface, dbus.Dictionary(),
1305
 
                            dbus.Array((dbus_name, )))
1306
 
                    else:
1307
 
                        dbus_value = transform_func(
1308
 
                            type_func(value),
1309
 
                            variant_level = variant_level)
1310
 
                        self.PropertyChanged(dbus.String(dbus_name),
1311
 
                                             dbus_value)
1312
 
                        self.PropertiesChanged(
1313
 
                            _interface,
1314
 
                            dbus.Dictionary({ dbus.String(dbus_name):
1315
 
                                              dbus_value }),
1316
 
                            dbus.Array())
 
1272
                    dbus_value = transform_func(type_func(value),
 
1273
                                                variant_level
 
1274
                                                =variant_level)
 
1275
                    self.PropertyChanged(dbus.String(dbus_name),
 
1276
                                         dbus_value)
1317
1277
            setattr(self, attrname, value)
1318
1278
        
1319
1279
        return property(lambda self: getattr(self, attrname), setter)
1325
1285
    enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1326
1286
    last_enabled = notifychangeproperty(datetime_to_dbus,
1327
1287
                                        "LastEnabled")
1328
 
    checker = notifychangeproperty(
1329
 
        dbus.Boolean, "CheckerRunning",
1330
 
        type_func = lambda checker: checker is not None)
 
1288
    checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",
 
1289
                                   type_func = lambda checker:
 
1290
                                       checker is not None)
1331
1291
    last_checked_ok = notifychangeproperty(datetime_to_dbus,
1332
1292
                                           "LastCheckedOK")
1333
1293
    last_checker_status = notifychangeproperty(dbus.Int16,
1336
1296
        datetime_to_dbus, "LastApprovalRequest")
1337
1297
    approved_by_default = notifychangeproperty(dbus.Boolean,
1338
1298
                                               "ApprovedByDefault")
1339
 
    approval_delay = notifychangeproperty(
1340
 
        dbus.UInt64, "ApprovalDelay",
1341
 
        type_func = lambda td: td.total_seconds() * 1000)
 
1299
    approval_delay = notifychangeproperty(dbus.UInt64,
 
1300
                                          "ApprovalDelay",
 
1301
                                          type_func =
 
1302
                                          timedelta_to_milliseconds)
1342
1303
    approval_duration = notifychangeproperty(
1343
1304
        dbus.UInt64, "ApprovalDuration",
1344
 
        type_func = lambda td: td.total_seconds() * 1000)
 
1305
        type_func = timedelta_to_milliseconds)
1345
1306
    host = notifychangeproperty(dbus.String, "Host")
1346
 
    timeout = notifychangeproperty(
1347
 
        dbus.UInt64, "Timeout",
1348
 
        type_func = lambda td: td.total_seconds() * 1000)
 
1307
    timeout = notifychangeproperty(dbus.UInt64, "Timeout",
 
1308
                                   type_func =
 
1309
                                   timedelta_to_milliseconds)
1349
1310
    extended_timeout = notifychangeproperty(
1350
1311
        dbus.UInt64, "ExtendedTimeout",
1351
 
        type_func = lambda td: td.total_seconds() * 1000)
1352
 
    interval = notifychangeproperty(
1353
 
        dbus.UInt64, "Interval",
1354
 
        type_func = lambda td: td.total_seconds() * 1000)
 
1312
        type_func = timedelta_to_milliseconds)
 
1313
    interval = notifychangeproperty(dbus.UInt64,
 
1314
                                    "Interval",
 
1315
                                    type_func =
 
1316
                                    timedelta_to_milliseconds)
1355
1317
    checker_command = notifychangeproperty(dbus.String, "Checker")
1356
 
    secret = notifychangeproperty(dbus.ByteArray, "Secret",
1357
 
                                  invalidate_only=True)
1358
1318
    
1359
1319
    del notifychangeproperty
1360
1320
    
1367
1327
            DBusObjectWithProperties.__del__(self, *args, **kwargs)
1368
1328
        Client.__del__(self, *args, **kwargs)
1369
1329
    
1370
 
    def checker_callback(self, source, condition,
1371
 
                         connection, command, *args, **kwargs):
1372
 
        ret = Client.checker_callback(self, source, condition,
1373
 
                                      connection, command, *args,
1374
 
                                      **kwargs)
1375
 
        exitstatus = self.last_checker_status
1376
 
        if exitstatus >= 0:
 
1330
    def checker_callback(self, pid, condition, command,
 
1331
                         *args, **kwargs):
 
1332
        self.checker_callback_tag = None
 
1333
        self.checker = None
 
1334
        if os.WIFEXITED(condition):
 
1335
            exitstatus = os.WEXITSTATUS(condition)
1377
1336
            # Emit D-Bus signal
1378
1337
            self.CheckerCompleted(dbus.Int16(exitstatus),
1379
 
                                  dbus.Int64(0),
 
1338
                                  dbus.Int64(condition),
1380
1339
                                  dbus.String(command))
1381
1340
        else:
1382
1341
            # Emit D-Bus signal
1383
1342
            self.CheckerCompleted(dbus.Int16(-1),
1384
 
                                  dbus.Int64(
1385
 
                                      self.last_checker_signal),
 
1343
                                  dbus.Int64(condition),
1386
1344
                                  dbus.String(command))
1387
 
        return ret
 
1345
        
 
1346
        return Client.checker_callback(self, pid, condition, command,
 
1347
                                       *args, **kwargs)
1388
1348
    
1389
1349
    def start_checker(self, *args, **kwargs):
1390
 
        old_checker_pid = getattr(self.checker, "pid", None)
 
1350
        old_checker = self.checker
 
1351
        if self.checker is not None:
 
1352
            old_checker_pid = self.checker.pid
 
1353
        else:
 
1354
            old_checker_pid = None
1391
1355
        r = Client.start_checker(self, *args, **kwargs)
1392
1356
        # Only if new checker process was started
1393
1357
        if (self.checker is not None
1402
1366
    
1403
1367
    def approve(self, value=True):
1404
1368
        self.approved = value
1405
 
        gobject.timeout_add(int(self.approval_duration.total_seconds()
1406
 
                                * 1000), self._reset_approved)
 
1369
        gobject.timeout_add(timedelta_to_milliseconds
 
1370
                            (self.approval_duration),
 
1371
                            self._reset_approved)
1407
1372
        self.send_changedstate()
1408
1373
    
1409
1374
    ## D-Bus methods, signals & properties
 
1375
    _interface = "se.recompile.Mandos.Client"
1410
1376
    
1411
1377
    ## Interfaces
1412
1378
    
 
1379
    @dbus_interface_annotations(_interface)
 
1380
    def _foo(self):
 
1381
        return { "org.freedesktop.DBus.Property.EmitsChangedSignal":
 
1382
                     "false"}
 
1383
    
1413
1384
    ## Signals
1414
1385
    
1415
1386
    # CheckerCompleted - signal
1425
1396
        pass
1426
1397
    
1427
1398
    # PropertyChanged - signal
1428
 
    @dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1429
1399
    @dbus.service.signal(_interface, signature="sv")
1430
1400
    def PropertyChanged(self, property, value):
1431
1401
        "D-Bus signal"
1495
1465
        return dbus.Boolean(bool(self.approvals_pending))
1496
1466
    
1497
1467
    # ApprovedByDefault - property
1498
 
    @dbus_service_property(_interface,
1499
 
                           signature="b",
 
1468
    @dbus_service_property(_interface, signature="b",
1500
1469
                           access="readwrite")
1501
1470
    def ApprovedByDefault_dbus_property(self, value=None):
1502
1471
        if value is None:       # get
1504
1473
        self.approved_by_default = bool(value)
1505
1474
    
1506
1475
    # ApprovalDelay - property
1507
 
    @dbus_service_property(_interface,
1508
 
                           signature="t",
 
1476
    @dbus_service_property(_interface, signature="t",
1509
1477
                           access="readwrite")
1510
1478
    def ApprovalDelay_dbus_property(self, value=None):
1511
1479
        if value is None:       # get
1512
 
            return dbus.UInt64(self.approval_delay.total_seconds()
1513
 
                               * 1000)
 
1480
            return dbus.UInt64(self.approval_delay_milliseconds())
1514
1481
        self.approval_delay = datetime.timedelta(0, 0, 0, value)
1515
1482
    
1516
1483
    # ApprovalDuration - property
1517
 
    @dbus_service_property(_interface,
1518
 
                           signature="t",
 
1484
    @dbus_service_property(_interface, signature="t",
1519
1485
                           access="readwrite")
1520
1486
    def ApprovalDuration_dbus_property(self, value=None):
1521
1487
        if value is None:       # get
1522
 
            return dbus.UInt64(self.approval_duration.total_seconds()
1523
 
                               * 1000)
 
1488
            return dbus.UInt64(timedelta_to_milliseconds(
 
1489
                    self.approval_duration))
1524
1490
        self.approval_duration = datetime.timedelta(0, 0, 0, value)
1525
1491
    
1526
1492
    # Name - property
1534
1500
        return dbus.String(self.fingerprint)
1535
1501
    
1536
1502
    # Host - property
1537
 
    @dbus_service_property(_interface,
1538
 
                           signature="s",
 
1503
    @dbus_service_property(_interface, signature="s",
1539
1504
                           access="readwrite")
1540
1505
    def Host_dbus_property(self, value=None):
1541
1506
        if value is None:       # get
1542
1507
            return dbus.String(self.host)
1543
 
        self.host = str(value)
 
1508
        self.host = unicode(value)
1544
1509
    
1545
1510
    # Created - property
1546
1511
    @dbus_service_property(_interface, signature="s", access="read")
1553
1518
        return datetime_to_dbus(self.last_enabled)
1554
1519
    
1555
1520
    # Enabled - property
1556
 
    @dbus_service_property(_interface,
1557
 
                           signature="b",
 
1521
    @dbus_service_property(_interface, signature="b",
1558
1522
                           access="readwrite")
1559
1523
    def Enabled_dbus_property(self, value=None):
1560
1524
        if value is None:       # get
1565
1529
            self.disable()
1566
1530
    
1567
1531
    # LastCheckedOK - property
1568
 
    @dbus_service_property(_interface,
1569
 
                           signature="s",
 
1532
    @dbus_service_property(_interface, signature="s",
1570
1533
                           access="readwrite")
1571
1534
    def LastCheckedOK_dbus_property(self, value=None):
1572
1535
        if value is not None:
1575
1538
        return datetime_to_dbus(self.last_checked_ok)
1576
1539
    
1577
1540
    # LastCheckerStatus - property
1578
 
    @dbus_service_property(_interface, signature="n", access="read")
 
1541
    @dbus_service_property(_interface, signature="n",
 
1542
                           access="read")
1579
1543
    def LastCheckerStatus_dbus_property(self):
1580
1544
        return dbus.Int16(self.last_checker_status)
1581
1545
    
1590
1554
        return datetime_to_dbus(self.last_approval_request)
1591
1555
    
1592
1556
    # Timeout - property
1593
 
    @dbus_service_property(_interface,
1594
 
                           signature="t",
 
1557
    @dbus_service_property(_interface, signature="t",
1595
1558
                           access="readwrite")
1596
1559
    def Timeout_dbus_property(self, value=None):
1597
1560
        if value is None:       # get
1598
 
            return dbus.UInt64(self.timeout.total_seconds() * 1000)
 
1561
            return dbus.UInt64(self.timeout_milliseconds())
1599
1562
        old_timeout = self.timeout
1600
1563
        self.timeout = datetime.timedelta(0, 0, 0, value)
1601
1564
        # Reschedule disabling
1610
1573
                    is None):
1611
1574
                    return
1612
1575
                gobject.source_remove(self.disable_initiator_tag)
1613
 
                self.disable_initiator_tag = gobject.timeout_add(
1614
 
                    int((self.expires - now).total_seconds() * 1000),
1615
 
                    self.disable)
 
1576
                self.disable_initiator_tag = (
 
1577
                    gobject.timeout_add(
 
1578
                        timedelta_to_milliseconds(self.expires - now),
 
1579
                        self.disable))
1616
1580
    
1617
1581
    # ExtendedTimeout - property
1618
 
    @dbus_service_property(_interface,
1619
 
                           signature="t",
 
1582
    @dbus_service_property(_interface, signature="t",
1620
1583
                           access="readwrite")
1621
1584
    def ExtendedTimeout_dbus_property(self, value=None):
1622
1585
        if value is None:       # get
1623
 
            return dbus.UInt64(self.extended_timeout.total_seconds()
1624
 
                               * 1000)
 
1586
            return dbus.UInt64(self.extended_timeout_milliseconds())
1625
1587
        self.extended_timeout = datetime.timedelta(0, 0, 0, value)
1626
1588
    
1627
1589
    # Interval - property
1628
 
    @dbus_service_property(_interface,
1629
 
                           signature="t",
 
1590
    @dbus_service_property(_interface, signature="t",
1630
1591
                           access="readwrite")
1631
1592
    def Interval_dbus_property(self, value=None):
1632
1593
        if value is None:       # get
1633
 
            return dbus.UInt64(self.interval.total_seconds() * 1000)
 
1594
            return dbus.UInt64(self.interval_milliseconds())
1634
1595
        self.interval = datetime.timedelta(0, 0, 0, value)
1635
1596
        if getattr(self, "checker_initiator_tag", None) is None:
1636
1597
            return
1637
1598
        if self.enabled:
1638
1599
            # Reschedule checker run
1639
1600
            gobject.source_remove(self.checker_initiator_tag)
1640
 
            self.checker_initiator_tag = gobject.timeout_add(
1641
 
                value, self.start_checker)
1642
 
            self.start_checker() # Start one now, too
 
1601
            self.checker_initiator_tag = (gobject.timeout_add
 
1602
                                          (value, self.start_checker))
 
1603
            self.start_checker()    # Start one now, too
1643
1604
    
1644
1605
    # Checker - property
1645
 
    @dbus_service_property(_interface,
1646
 
                           signature="s",
 
1606
    @dbus_service_property(_interface, signature="s",
1647
1607
                           access="readwrite")
1648
1608
    def Checker_dbus_property(self, value=None):
1649
1609
        if value is None:       # get
1650
1610
            return dbus.String(self.checker_command)
1651
 
        self.checker_command = str(value)
 
1611
        self.checker_command = unicode(value)
1652
1612
    
1653
1613
    # CheckerRunning - property
1654
 
    @dbus_service_property(_interface,
1655
 
                           signature="b",
 
1614
    @dbus_service_property(_interface, signature="b",
1656
1615
                           access="readwrite")
1657
1616
    def CheckerRunning_dbus_property(self, value=None):
1658
1617
        if value is None:       # get
1668
1627
        return self.dbus_object_path # is already a dbus.ObjectPath
1669
1628
    
1670
1629
    # Secret = property
1671
 
    @dbus_service_property(_interface,
1672
 
                           signature="ay",
1673
 
                           access="write",
1674
 
                           byte_arrays=True)
 
1630
    @dbus_service_property(_interface, signature="ay",
 
1631
                           access="write", byte_arrays=True)
1675
1632
    def Secret_dbus_property(self, value):
1676
 
        self.secret = bytes(value)
 
1633
        self.secret = str(value)
1677
1634
    
1678
1635
    del _interface
1679
1636
 
1683
1640
        self._pipe = child_pipe
1684
1641
        self._pipe.send(('init', fpr, address))
1685
1642
        if not self._pipe.recv():
1686
 
            raise KeyError(fpr)
 
1643
            raise KeyError()
1687
1644
    
1688
1645
    def __getattribute__(self, name):
1689
1646
        if name == '_pipe':
1693
1650
        if data[0] == 'data':
1694
1651
            return data[1]
1695
1652
        if data[0] == 'function':
1696
 
            
1697
1653
            def func(*args, **kwargs):
1698
1654
                self._pipe.send(('funcall', name, args, kwargs))
1699
1655
                return self._pipe.recv()[1]
1700
 
            
1701
1656
            return func
1702
1657
    
1703
1658
    def __setattr__(self, name, value):
1715
1670
    def handle(self):
1716
1671
        with contextlib.closing(self.server.child_pipe) as child_pipe:
1717
1672
            logger.info("TCP connection from: %s",
1718
 
                        str(self.client_address))
 
1673
                        unicode(self.client_address))
1719
1674
            logger.debug("Pipe FD: %d",
1720
1675
                         self.server.child_pipe.fileno())
1721
1676
            
1722
 
            session = gnutls.connection.ClientSession(
1723
 
                self.request, gnutls.connection .X509Credentials())
 
1677
            session = (gnutls.connection
 
1678
                       .ClientSession(self.request,
 
1679
                                      gnutls.connection
 
1680
                                      .X509Credentials()))
1724
1681
            
1725
1682
            # Note: gnutls.connection.X509Credentials is really a
1726
1683
            # generic GnuTLS certificate credentials object so long as
1735
1692
            priority = self.server.gnutls_priority
1736
1693
            if priority is None:
1737
1694
                priority = "NORMAL"
1738
 
            gnutls.library.functions.gnutls_priority_set_direct(
1739
 
                session._c_object, priority, None)
 
1695
            (gnutls.library.functions
 
1696
             .gnutls_priority_set_direct(session._c_object,
 
1697
                                         priority, None))
1740
1698
            
1741
1699
            # Start communication using the Mandos protocol
1742
1700
            # Get protocol number
1744
1702
            logger.debug("Protocol version: %r", line)
1745
1703
            try:
1746
1704
                if int(line.strip().split()[0]) > 1:
1747
 
                    raise RuntimeError(line)
 
1705
                    raise RuntimeError
1748
1706
            except (ValueError, IndexError, RuntimeError) as error:
1749
1707
                logger.error("Unknown protocol version: %s", error)
1750
1708
                return
1762
1720
            approval_required = False
1763
1721
            try:
1764
1722
                try:
1765
 
                    fpr = self.fingerprint(
1766
 
                        self.peer_certificate(session))
 
1723
                    fpr = self.fingerprint(self.peer_certificate
 
1724
                                           (session))
1767
1725
                except (TypeError,
1768
1726
                        gnutls.errors.GNUTLSError) as error:
1769
1727
                    logger.warning("Bad certificate: %s", error)
1784
1742
                while True:
1785
1743
                    if not client.enabled:
1786
1744
                        logger.info("Client %s is disabled",
1787
 
                                    client.name)
 
1745
                                       client.name)
1788
1746
                        if self.server.use_dbus:
1789
1747
                            # Emit D-Bus signal
1790
1748
                            client.Rejected("Disabled")
1799
1757
                        if self.server.use_dbus:
1800
1758
                            # Emit D-Bus signal
1801
1759
                            client.NeedApproval(
1802
 
                                client.approval_delay.total_seconds()
1803
 
                                * 1000, client.approved_by_default)
 
1760
                                client.approval_delay_milliseconds(),
 
1761
                                client.approved_by_default)
1804
1762
                    else:
1805
1763
                        logger.warning("Client %s was not approved",
1806
1764
                                       client.name)
1812
1770
                    #wait until timeout or approved
1813
1771
                    time = datetime.datetime.now()
1814
1772
                    client.changedstate.acquire()
1815
 
                    client.changedstate.wait(delay.total_seconds())
 
1773
                    client.changedstate.wait(
 
1774
                        float(timedelta_to_milliseconds(delay)
 
1775
                              / 1000))
1816
1776
                    client.changedstate.release()
1817
1777
                    time2 = datetime.datetime.now()
1818
1778
                    if (time2 - time) >= delay:
1837
1797
                        logger.warning("gnutls send failed",
1838
1798
                                       exc_info=error)
1839
1799
                        return
1840
 
                    logger.debug("Sent: %d, remaining: %d", sent,
1841
 
                                 len(client.secret) - (sent_size
1842
 
                                                       + sent))
 
1800
                    logger.debug("Sent: %d, remaining: %d",
 
1801
                                 sent, len(client.secret)
 
1802
                                 - (sent_size + sent))
1843
1803
                    sent_size += sent
1844
1804
                
1845
1805
                logger.info("Sending secret to %s", client.name)
1862
1822
    def peer_certificate(session):
1863
1823
        "Return the peer's OpenPGP certificate as a bytestring"
1864
1824
        # If not an OpenPGP certificate...
1865
 
        if (gnutls.library.functions.gnutls_certificate_type_get(
1866
 
                session._c_object)
 
1825
        if (gnutls.library.functions
 
1826
            .gnutls_certificate_type_get(session._c_object)
1867
1827
            != gnutls.library.constants.GNUTLS_CRT_OPENPGP):
1868
1828
            # ...do the normal thing
1869
1829
            return session.peer_certificate
1883
1843
    def fingerprint(openpgp):
1884
1844
        "Convert an OpenPGP bytestring to a hexdigit fingerprint"
1885
1845
        # New GnuTLS "datum" with the OpenPGP public key
1886
 
        datum = gnutls.library.types.gnutls_datum_t(
1887
 
            ctypes.cast(ctypes.c_char_p(openpgp),
1888
 
                        ctypes.POINTER(ctypes.c_ubyte)),
1889
 
            ctypes.c_uint(len(openpgp)))
 
1846
        datum = (gnutls.library.types
 
1847
                 .gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
 
1848
                                             ctypes.POINTER
 
1849
                                             (ctypes.c_ubyte)),
 
1850
                                 ctypes.c_uint(len(openpgp))))
1890
1851
        # New empty GnuTLS certificate
1891
1852
        crt = gnutls.library.types.gnutls_openpgp_crt_t()
1892
 
        gnutls.library.functions.gnutls_openpgp_crt_init(
1893
 
            ctypes.byref(crt))
 
1853
        (gnutls.library.functions
 
1854
         .gnutls_openpgp_crt_init(ctypes.byref(crt)))
1894
1855
        # Import the OpenPGP public key into the certificate
1895
 
        gnutls.library.functions.gnutls_openpgp_crt_import(
1896
 
            crt, ctypes.byref(datum),
1897
 
            gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
 
1856
        (gnutls.library.functions
 
1857
         .gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
 
1858
                                    gnutls.library.constants
 
1859
                                    .GNUTLS_OPENPGP_FMT_RAW))
1898
1860
        # Verify the self signature in the key
1899
1861
        crtverify = ctypes.c_uint()
1900
 
        gnutls.library.functions.gnutls_openpgp_crt_verify_self(
1901
 
            crt, 0, ctypes.byref(crtverify))
 
1862
        (gnutls.library.functions
 
1863
         .gnutls_openpgp_crt_verify_self(crt, 0,
 
1864
                                         ctypes.byref(crtverify)))
1902
1865
        if crtverify.value != 0:
1903
1866
            gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1904
 
            raise gnutls.errors.CertificateSecurityError(
1905
 
                "Verify failed")
 
1867
            raise (gnutls.errors.CertificateSecurityError
 
1868
                   ("Verify failed"))
1906
1869
        # New buffer for the fingerprint
1907
1870
        buf = ctypes.create_string_buffer(20)
1908
1871
        buf_len = ctypes.c_size_t()
1909
1872
        # Get the fingerprint from the certificate into the buffer
1910
 
        gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint(
1911
 
            crt, ctypes.byref(buf), ctypes.byref(buf_len))
 
1873
        (gnutls.library.functions
 
1874
         .gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
 
1875
                                             ctypes.byref(buf_len)))
1912
1876
        # Deinit the certificate
1913
1877
        gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1914
1878
        # Convert the buffer to a Python bytestring
1920
1884
 
1921
1885
class MultiprocessingMixIn(object):
1922
1886
    """Like socketserver.ThreadingMixIn, but with multiprocessing"""
1923
 
    
1924
1887
    def sub_process_main(self, request, address):
1925
1888
        try:
1926
1889
            self.finish_request(request, address)
1938
1901
 
1939
1902
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
1940
1903
    """ adds a pipe to the MixIn """
1941
 
    
1942
1904
    def process_request(self, request, client_address):
1943
1905
        """Overrides and wraps the original process_request().
1944
1906
        
1953
1915
    
1954
1916
    def add_pipe(self, parent_pipe, proc):
1955
1917
        """Dummy function; override as necessary"""
1956
 
        raise NotImplementedError()
 
1918
        raise NotImplementedError
1957
1919
 
1958
1920
 
1959
1921
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
1965
1927
        interface:      None or a network interface name (string)
1966
1928
        use_ipv6:       Boolean; to use IPv6 or not
1967
1929
    """
1968
 
    
1969
1930
    def __init__(self, server_address, RequestHandlerClass,
1970
 
                 interface=None,
1971
 
                 use_ipv6=True,
1972
 
                 socketfd=None):
 
1931
                 interface=None, use_ipv6=True, socketfd=None):
1973
1932
        """If socketfd is set, use that file descriptor instead of
1974
1933
        creating a new one with socket.socket().
1975
1934
        """
2016
1975
                             self.interface)
2017
1976
            else:
2018
1977
                try:
2019
 
                    self.socket.setsockopt(
2020
 
                        socket.SOL_SOCKET, SO_BINDTODEVICE,
2021
 
                        (self.interface + "\0").encode("utf-8"))
 
1978
                    self.socket.setsockopt(socket.SOL_SOCKET,
 
1979
                                           SO_BINDTODEVICE,
 
1980
                                           str(self.interface + '\0'))
2022
1981
                except socket.error as error:
2023
1982
                    if error.errno == errno.EPERM:
2024
1983
                        logger.error("No permission to bind to"
2042
2001
                self.server_address = (any_address,
2043
2002
                                       self.server_address[1])
2044
2003
            elif not self.server_address[1]:
2045
 
                self.server_address = (self.server_address[0], 0)
 
2004
                self.server_address = (self.server_address[0],
 
2005
                                       0)
2046
2006
#                 if self.interface:
2047
2007
#                     self.server_address = (self.server_address[0],
2048
2008
#                                            0, # port
2062
2022
    
2063
2023
    Assumes a gobject.MainLoop event loop.
2064
2024
    """
2065
 
    
2066
2025
    def __init__(self, server_address, RequestHandlerClass,
2067
 
                 interface=None,
2068
 
                 use_ipv6=True,
2069
 
                 clients=None,
2070
 
                 gnutls_priority=None,
2071
 
                 use_dbus=True,
2072
 
                 socketfd=None):
 
2026
                 interface=None, use_ipv6=True, clients=None,
 
2027
                 gnutls_priority=None, use_dbus=True, socketfd=None):
2073
2028
        self.enabled = False
2074
2029
        self.clients = clients
2075
2030
        if self.clients is None:
2081
2036
                                interface = interface,
2082
2037
                                use_ipv6 = use_ipv6,
2083
2038
                                socketfd = socketfd)
2084
 
    
2085
2039
    def server_activate(self):
2086
2040
        if self.enabled:
2087
2041
            return socketserver.TCPServer.server_activate(self)
2091
2045
    
2092
2046
    def add_pipe(self, parent_pipe, proc):
2093
2047
        # Call "handle_ipc" for both data and EOF events
2094
 
        gobject.io_add_watch(
2095
 
            parent_pipe.fileno(),
2096
 
            gobject.IO_IN | gobject.IO_HUP,
2097
 
            functools.partial(self.handle_ipc,
2098
 
                              parent_pipe = parent_pipe,
2099
 
                              proc = proc))
 
2048
        gobject.io_add_watch(parent_pipe.fileno(),
 
2049
                             gobject.IO_IN | gobject.IO_HUP,
 
2050
                             functools.partial(self.handle_ipc,
 
2051
                                               parent_pipe =
 
2052
                                               parent_pipe,
 
2053
                                               proc = proc))
2100
2054
    
2101
 
    def handle_ipc(self, source, condition,
2102
 
                   parent_pipe=None,
2103
 
                   proc = None,
2104
 
                   client_object=None):
 
2055
    def handle_ipc(self, source, condition, parent_pipe=None,
 
2056
                   proc = None, client_object=None):
2105
2057
        # error, or the other end of multiprocessing.Pipe has closed
2106
2058
        if condition & (gobject.IO_ERR | gobject.IO_HUP):
2107
2059
            # Wait for other process to exit
2130
2082
                parent_pipe.send(False)
2131
2083
                return False
2132
2084
            
2133
 
            gobject.io_add_watch(
2134
 
                parent_pipe.fileno(),
2135
 
                gobject.IO_IN | gobject.IO_HUP,
2136
 
                functools.partial(self.handle_ipc,
2137
 
                                  parent_pipe = parent_pipe,
2138
 
                                  proc = proc,
2139
 
                                  client_object = client))
 
2085
            gobject.io_add_watch(parent_pipe.fileno(),
 
2086
                                 gobject.IO_IN | gobject.IO_HUP,
 
2087
                                 functools.partial(self.handle_ipc,
 
2088
                                                   parent_pipe =
 
2089
                                                   parent_pipe,
 
2090
                                                   proc = proc,
 
2091
                                                   client_object =
 
2092
                                                   client))
2140
2093
            parent_pipe.send(True)
2141
2094
            # remove the old hook in favor of the new above hook on
2142
2095
            # same fileno
2148
2101
            
2149
2102
            parent_pipe.send(('data', getattr(client_object,
2150
2103
                                              funcname)(*args,
2151
 
                                                        **kwargs)))
 
2104
                                                         **kwargs)))
2152
2105
        
2153
2106
        if command == 'getattr':
2154
2107
            attrname = request[1]
2155
 
            if isinstance(client_object.__getattribute__(attrname),
2156
 
                          collections.Callable):
2157
 
                parent_pipe.send(('function', ))
 
2108
            if callable(client_object.__getattribute__(attrname)):
 
2109
                parent_pipe.send(('function',))
2158
2110
            else:
2159
 
                parent_pipe.send((
2160
 
                    'data', client_object.__getattribute__(attrname)))
 
2111
                parent_pipe.send(('data', client_object
 
2112
                                  .__getattribute__(attrname)))
2161
2113
        
2162
2114
        if command == 'setattr':
2163
2115
            attrname = request[1]
2194
2146
    # avoid excessive use of external libraries.
2195
2147
    
2196
2148
    # New type for defining tokens, syntax, and semantics all-in-one
2197
 
    Token = collections.namedtuple("Token", (
2198
 
        "regexp",  # To match token; if "value" is not None, must have
2199
 
                   # a "group" containing digits
2200
 
        "value",   # datetime.timedelta or None
2201
 
        "followers"))           # Tokens valid after this token
 
2149
    Token = collections.namedtuple("Token",
 
2150
                                   ("regexp", # To match token; if
 
2151
                                              # "value" is not None,
 
2152
                                              # must have a "group"
 
2153
                                              # containing digits
 
2154
                                    "value",  # datetime.timedelta or
 
2155
                                              # None
 
2156
                                    "followers")) # Tokens valid after
 
2157
                                                  # this token
2202
2158
    # RFC 3339 "duration" tokens, syntax, and semantics; taken from
2203
2159
    # the "duration" ABNF definition in RFC 3339, Appendix A.
2204
2160
    token_end = Token(re.compile(r"$"), None, frozenset())
2205
2161
    token_second = Token(re.compile(r"(\d+)S"),
2206
2162
                         datetime.timedelta(seconds=1),
2207
 
                         frozenset((token_end, )))
 
2163
                         frozenset((token_end,)))
2208
2164
    token_minute = Token(re.compile(r"(\d+)M"),
2209
2165
                         datetime.timedelta(minutes=1),
2210
2166
                         frozenset((token_second, token_end)))
2226
2182
                       frozenset((token_month, token_end)))
2227
2183
    token_week = Token(re.compile(r"(\d+)W"),
2228
2184
                       datetime.timedelta(weeks=1),
2229
 
                       frozenset((token_end, )))
 
2185
                       frozenset((token_end,)))
2230
2186
    token_duration = Token(re.compile(r"P"), None,
2231
2187
                           frozenset((token_year, token_month,
2232
2188
                                      token_day, token_time,
2233
 
                                      token_week)))
 
2189
                                      token_week))),
2234
2190
    # Define starting values
2235
2191
    value = datetime.timedelta() # Value so far
2236
2192
    found_token = None
2237
 
    followers = frozenset((token_duration, )) # Following valid tokens
 
2193
    followers = frozenset(token_duration,) # Following valid tokens
2238
2194
    s = duration                # String left to parse
2239
2195
    # Loop until end token is found
2240
2196
    while found_token is not token_end:
2257
2213
                break
2258
2214
        else:
2259
2215
            # No currently valid tokens were found
2260
 
            raise ValueError("Invalid RFC 3339 duration: {!r}"
2261
 
                             .format(duration))
 
2216
            raise ValueError("Invalid RFC 3339 duration")
2262
2217
    # End token found
2263
2218
    return value
2264
2219
 
2288
2243
    timevalue = datetime.timedelta(0)
2289
2244
    for s in interval.split():
2290
2245
        try:
2291
 
            suffix = s[-1]
 
2246
            suffix = unicode(s[-1])
2292
2247
            value = int(s[:-1])
2293
2248
            if suffix == "d":
2294
2249
                delta = datetime.timedelta(value)
2301
2256
            elif suffix == "w":
2302
2257
                delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
2303
2258
            else:
2304
 
                raise ValueError("Unknown suffix {!r}".format(suffix))
2305
 
        except IndexError as e:
 
2259
                raise ValueError("Unknown suffix {0!r}"
 
2260
                                 .format(suffix))
 
2261
        except (ValueError, IndexError) as e:
2306
2262
            raise ValueError(*(e.args))
2307
2263
        timevalue += delta
2308
2264
    return timevalue
2324
2280
        null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2325
2281
        if not stat.S_ISCHR(os.fstat(null).st_mode):
2326
2282
            raise OSError(errno.ENODEV,
2327
 
                          "{} not a character device"
 
2283
                          "{0} not a character device"
2328
2284
                          .format(os.devnull))
2329
2285
        os.dup2(null, sys.stdin.fileno())
2330
2286
        os.dup2(null, sys.stdout.fileno())
2340
2296
    
2341
2297
    parser = argparse.ArgumentParser()
2342
2298
    parser.add_argument("-v", "--version", action="version",
2343
 
                        version = "%(prog)s {}".format(version),
 
2299
                        version = "%(prog)s {0}".format(version),
2344
2300
                        help="show version number and exit")
2345
2301
    parser.add_argument("-i", "--interface", metavar="IF",
2346
2302
                        help="Bind to interface IF")
2379
2335
                        help="Directory to save/restore state in")
2380
2336
    parser.add_argument("--foreground", action="store_true",
2381
2337
                        help="Run in foreground", default=None)
2382
 
    parser.add_argument("--no-zeroconf", action="store_false",
2383
 
                        dest="zeroconf", help="Do not use Zeroconf",
2384
 
                        default=None)
2385
2338
    
2386
2339
    options = parser.parse_args()
2387
2340
    
2388
2341
    if options.check:
2389
2342
        import doctest
2390
 
        fail_count, test_count = doctest.testmod()
2391
 
        sys.exit(os.EX_OK if fail_count == 0 else 1)
 
2343
        doctest.testmod()
 
2344
        sys.exit()
2392
2345
    
2393
2346
    # Default values for config file for server-global settings
2394
2347
    server_defaults = { "interface": "",
2396
2349
                        "port": "",
2397
2350
                        "debug": "False",
2398
2351
                        "priority":
2399
 
                        "SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2400
 
                        ":+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",
 
2352
                        "SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",
2401
2353
                        "servicename": "Mandos",
2402
2354
                        "use_dbus": "True",
2403
2355
                        "use_ipv6": "True",
2406
2358
                        "socket": "",
2407
2359
                        "statedir": "/var/lib/mandos",
2408
2360
                        "foreground": "False",
2409
 
                        "zeroconf": "True",
2410
 
                    }
 
2361
                        }
2411
2362
    
2412
2363
    # Parse config file for server-global settings
2413
2364
    server_config = configparser.SafeConfigParser(server_defaults)
2414
2365
    del server_defaults
2415
 
    server_config.read(os.path.join(options.configdir, "mandos.conf"))
 
2366
    server_config.read(os.path.join(options.configdir,
 
2367
                                    "mandos.conf"))
2416
2368
    # Convert the SafeConfigParser object to a dict
2417
2369
    server_settings = server_config.defaults()
2418
2370
    # Use the appropriate methods on the non-string config options
2436
2388
    # Override the settings from the config file with command line
2437
2389
    # options, if set.
2438
2390
    for option in ("interface", "address", "port", "debug",
2439
 
                   "priority", "servicename", "configdir", "use_dbus",
2440
 
                   "use_ipv6", "debuglevel", "restore", "statedir",
2441
 
                   "socket", "foreground", "zeroconf"):
 
2391
                   "priority", "servicename", "configdir",
 
2392
                   "use_dbus", "use_ipv6", "debuglevel", "restore",
 
2393
                   "statedir", "socket", "foreground"):
2442
2394
        value = getattr(options, option)
2443
2395
        if value is not None:
2444
2396
            server_settings[option] = value
2445
2397
    del options
2446
2398
    # Force all strings to be unicode
2447
2399
    for option in server_settings.keys():
2448
 
        if isinstance(server_settings[option], bytes):
2449
 
            server_settings[option] = (server_settings[option]
2450
 
                                       .decode("utf-8"))
 
2400
        if type(server_settings[option]) is str:
 
2401
            server_settings[option] = unicode(server_settings[option])
2451
2402
    # Force all boolean options to be boolean
2452
2403
    for option in ("debug", "use_dbus", "use_ipv6", "restore",
2453
 
                   "foreground", "zeroconf"):
 
2404
                   "foreground"):
2454
2405
        server_settings[option] = bool(server_settings[option])
2455
2406
    # Debug implies foreground
2456
2407
    if server_settings["debug"]:
2459
2410
    
2460
2411
    ##################################################################
2461
2412
    
2462
 
    if (not server_settings["zeroconf"]
2463
 
        and not (server_settings["port"]
2464
 
                 or server_settings["socket"] != "")):
2465
 
        parser.error("Needs port or socket to work without Zeroconf")
2466
 
    
2467
2413
    # For convenience
2468
2414
    debug = server_settings["debug"]
2469
2415
    debuglevel = server_settings["debuglevel"]
2472
2418
    stored_state_path = os.path.join(server_settings["statedir"],
2473
2419
                                     stored_state_file)
2474
2420
    foreground = server_settings["foreground"]
2475
 
    zeroconf = server_settings["zeroconf"]
2476
2421
    
2477
2422
    if debug:
2478
2423
        initlogger(debug, logging.DEBUG)
2484
2429
            initlogger(debug, level)
2485
2430
    
2486
2431
    if server_settings["servicename"] != "Mandos":
2487
 
        syslogger.setFormatter(
2488
 
            logging.Formatter('Mandos ({}) [%(process)d]:'
2489
 
                              ' %(levelname)s: %(message)s'.format(
2490
 
                                  server_settings["servicename"])))
 
2432
        syslogger.setFormatter(logging.Formatter
 
2433
                               ('Mandos ({0}) [%(process)d]:'
 
2434
                                ' %(levelname)s: %(message)s'
 
2435
                                .format(server_settings
 
2436
                                        ["servicename"])))
2491
2437
    
2492
2438
    # Parse config file with clients
2493
2439
    client_config = configparser.SafeConfigParser(Client
2498
2444
    global mandos_dbus_service
2499
2445
    mandos_dbus_service = None
2500
2446
    
2501
 
    socketfd = None
2502
 
    if server_settings["socket"] != "":
2503
 
        socketfd = server_settings["socket"]
2504
 
    tcp_server = MandosServer(
2505
 
        (server_settings["address"], server_settings["port"]),
2506
 
        ClientHandler,
2507
 
        interface=(server_settings["interface"] or None),
2508
 
        use_ipv6=use_ipv6,
2509
 
        gnutls_priority=server_settings["priority"],
2510
 
        use_dbus=use_dbus,
2511
 
        socketfd=socketfd)
 
2447
    tcp_server = MandosServer((server_settings["address"],
 
2448
                               server_settings["port"]),
 
2449
                              ClientHandler,
 
2450
                              interface=(server_settings["interface"]
 
2451
                                         or None),
 
2452
                              use_ipv6=use_ipv6,
 
2453
                              gnutls_priority=
 
2454
                              server_settings["priority"],
 
2455
                              use_dbus=use_dbus,
 
2456
                              socketfd=(server_settings["socket"]
 
2457
                                        or None))
2512
2458
    if not foreground:
2513
2459
        pidfilename = "/run/mandos.pid"
2514
 
        if not os.path.isdir("/run/."):
2515
 
            pidfilename = "/var/run/mandos.pid"
2516
2460
        pidfile = None
2517
2461
        try:
2518
 
            pidfile = codecs.open(pidfilename, "w", encoding="utf-8")
 
2462
            pidfile = open(pidfilename, "w")
2519
2463
        except IOError as e:
2520
2464
            logger.error("Could not open file %r", pidfilename,
2521
2465
                         exc_info=e)
2535
2479
        os.setuid(uid)
2536
2480
    except OSError as error:
2537
2481
        if error.errno != errno.EPERM:
2538
 
            raise
 
2482
            raise error
2539
2483
    
2540
2484
    if debug:
2541
2485
        # Enable all possible GnuTLS debugging
2548
2492
        def debug_gnutls(level, string):
2549
2493
            logger.debug("GnuTLS: %s", string[:-1])
2550
2494
        
2551
 
        gnutls.library.functions.gnutls_global_set_log_function(
2552
 
            debug_gnutls)
 
2495
        (gnutls.library.functions
 
2496
         .gnutls_global_set_log_function(debug_gnutls))
2553
2497
        
2554
2498
        # Redirect stdin so all checkers get /dev/null
2555
2499
        null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2575
2519
    if use_dbus:
2576
2520
        try:
2577
2521
            bus_name = dbus.service.BusName("se.recompile.Mandos",
2578
 
                                            bus,
2579
 
                                            do_not_queue=True)
2580
 
            old_bus_name = dbus.service.BusName(
2581
 
                "se.bsnet.fukt.Mandos", bus,
2582
 
                do_not_queue=True)
2583
 
        except dbus.exceptions.DBusException as e:
 
2522
                                            bus, do_not_queue=True)
 
2523
            old_bus_name = (dbus.service.BusName
 
2524
                            ("se.bsnet.fukt.Mandos", bus,
 
2525
                             do_not_queue=True))
 
2526
        except dbus.exceptions.NameExistsException as e:
2584
2527
            logger.error("Disabling D-Bus:", exc_info=e)
2585
2528
            use_dbus = False
2586
2529
            server_settings["use_dbus"] = False
2587
2530
            tcp_server.use_dbus = False
2588
 
    if zeroconf:
2589
 
        protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2590
 
        service = AvahiServiceToSyslog(
2591
 
            name = server_settings["servicename"],
2592
 
            servicetype = "_mandos._tcp",
2593
 
            protocol = protocol,
2594
 
            bus = bus)
2595
 
        if server_settings["interface"]:
2596
 
            service.interface = if_nametoindex(
2597
 
                server_settings["interface"].encode("utf-8"))
 
2531
    protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
 
2532
    service = AvahiServiceToSyslog(name =
 
2533
                                   server_settings["servicename"],
 
2534
                                   servicetype = "_mandos._tcp",
 
2535
                                   protocol = protocol, bus = bus)
 
2536
    if server_settings["interface"]:
 
2537
        service.interface = (if_nametoindex
 
2538
                             (str(server_settings["interface"])))
2598
2539
    
2599
2540
    global multiprocessing_manager
2600
2541
    multiprocessing_manager = multiprocessing.Manager()
2619
2560
    if server_settings["restore"]:
2620
2561
        try:
2621
2562
            with open(stored_state_path, "rb") as stored_state:
2622
 
                clients_data, old_client_settings = pickle.load(
2623
 
                    stored_state)
 
2563
                clients_data, old_client_settings = (pickle.load
 
2564
                                                     (stored_state))
2624
2565
            os.remove(stored_state_path)
2625
2566
        except IOError as e:
2626
2567
            if e.errno == errno.ENOENT:
2627
 
                logger.warning("Could not load persistent state:"
2628
 
                               " {}".format(os.strerror(e.errno)))
 
2568
                logger.warning("Could not load persistent state: {0}"
 
2569
                                .format(os.strerror(e.errno)))
2629
2570
            else:
2630
2571
                logger.critical("Could not load persistent state:",
2631
2572
                                exc_info=e)
2632
2573
                raise
2633
2574
        except EOFError as e:
2634
2575
            logger.warning("Could not load persistent state: "
2635
 
                           "EOFError:",
2636
 
                           exc_info=e)
 
2576
                           "EOFError:", exc_info=e)
2637
2577
    
2638
2578
    with PGPEngine() as pgp:
2639
 
        for client_name, client in clients_data.items():
 
2579
        for client_name, client in clients_data.iteritems():
2640
2580
            # Skip removed clients
2641
2581
            if client_name not in client_settings:
2642
2582
                continue
2651
2591
                    # For each value in new config, check if it
2652
2592
                    # differs from the old config value (Except for
2653
2593
                    # the "secret" attribute)
2654
 
                    if (name != "secret"
2655
 
                        and (value !=
2656
 
                             old_client_settings[client_name][name])):
 
2594
                    if (name != "secret" and
 
2595
                        value != old_client_settings[client_name]
 
2596
                        [name]):
2657
2597
                        client[name] = value
2658
2598
                except KeyError:
2659
2599
                    pass
2660
2600
            
2661
2601
            # Clients who has passed its expire date can still be
2662
 
            # enabled if its last checker was successful.  A Client
 
2602
            # enabled if its last checker was successful.  Clients
2663
2603
            # whose checker succeeded before we stored its state is
2664
2604
            # assumed to have successfully run all checkers during
2665
2605
            # downtime.
2667
2607
                if datetime.datetime.utcnow() >= client["expires"]:
2668
2608
                    if not client["last_checked_ok"]:
2669
2609
                        logger.warning(
2670
 
                            "disabling client {} - Client never "
2671
 
                            "performed a successful checker".format(
2672
 
                                client_name))
 
2610
                            "disabling client {0} - Client never "
 
2611
                            "performed a successful checker"
 
2612
                            .format(client_name))
2673
2613
                        client["enabled"] = False
2674
2614
                    elif client["last_checker_status"] != 0:
2675
2615
                        logger.warning(
2676
 
                            "disabling client {} - Client last"
2677
 
                            " checker failed with error code"
2678
 
                            " {}".format(
2679
 
                                client_name,
2680
 
                                client["last_checker_status"]))
 
2616
                            "disabling client {0} - Client "
 
2617
                            "last checker failed with error code {1}"
 
2618
                            .format(client_name,
 
2619
                                    client["last_checker_status"]))
2681
2620
                        client["enabled"] = False
2682
2621
                    else:
2683
 
                        client["expires"] = (
2684
 
                            datetime.datetime.utcnow()
2685
 
                            + client["timeout"])
 
2622
                        client["expires"] = (datetime.datetime
 
2623
                                             .utcnow()
 
2624
                                             + client["timeout"])
2686
2625
                        logger.debug("Last checker succeeded,"
2687
 
                                     " keeping {} enabled".format(
2688
 
                                         client_name))
 
2626
                                     " keeping {0} enabled"
 
2627
                                     .format(client_name))
2689
2628
            try:
2690
 
                client["secret"] = pgp.decrypt(
2691
 
                    client["encrypted_secret"],
2692
 
                    client_settings[client_name]["secret"])
 
2629
                client["secret"] = (
 
2630
                    pgp.decrypt(client["encrypted_secret"],
 
2631
                                client_settings[client_name]
 
2632
                                ["secret"]))
2693
2633
            except PGPError:
2694
2634
                # If decryption fails, we use secret from new settings
2695
 
                logger.debug("Failed to decrypt {} old secret".format(
2696
 
                    client_name))
2697
 
                client["secret"] = (client_settings[client_name]
2698
 
                                    ["secret"])
 
2635
                logger.debug("Failed to decrypt {0} old secret"
 
2636
                             .format(client_name))
 
2637
                client["secret"] = (
 
2638
                    client_settings[client_name]["secret"])
2699
2639
    
2700
2640
    # Add/remove clients based on new changes made to config
2701
2641
    for client_name in (set(old_client_settings)
2706
2646
        clients_data[client_name] = client_settings[client_name]
2707
2647
    
2708
2648
    # Create all client objects
2709
 
    for client_name, client in clients_data.items():
 
2649
    for client_name, client in clients_data.iteritems():
2710
2650
        tcp_server.clients[client_name] = client_class(
2711
 
            name = client_name,
2712
 
            settings = client,
 
2651
            name = client_name, settings = client,
2713
2652
            server_settings = server_settings)
2714
2653
    
2715
2654
    if not tcp_server.clients:
2717
2656
    
2718
2657
    if not foreground:
2719
2658
        if pidfile is not None:
2720
 
            pid = os.getpid()
2721
2659
            try:
2722
2660
                with pidfile:
2723
 
                    print(pid, file=pidfile)
 
2661
                    pid = os.getpid()
 
2662
                    pidfile.write(str(pid) + "\n".encode("utf-8"))
2724
2663
            except IOError:
2725
2664
                logger.error("Could not write to file %r with PID %d",
2726
2665
                             pidfilename, pid)
2731
2670
    signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
2732
2671
    
2733
2672
    if use_dbus:
2734
 
        
2735
 
        @alternate_dbus_interfaces(
2736
 
            { "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })
 
2673
        @alternate_dbus_interfaces({"se.recompile.Mandos":
 
2674
                                        "se.bsnet.fukt.Mandos"})
2737
2675
        class MandosDBusService(DBusObjectWithProperties):
2738
2676
            """A D-Bus proxy object"""
2739
 
            
2740
2677
            def __init__(self):
2741
2678
                dbus.service.Object.__init__(self, bus, "/")
2742
 
            
2743
2679
            _interface = "se.recompile.Mandos"
2744
2680
            
2745
2681
            @dbus_interface_annotations(_interface)
2746
2682
            def _foo(self):
2747
 
                return {
2748
 
                    "org.freedesktop.DBus.Property.EmitsChangedSignal":
2749
 
                    "false" }
 
2683
                return { "org.freedesktop.DBus.Property"
 
2684
                         ".EmitsChangedSignal":
 
2685
                             "false"}
2750
2686
            
2751
2687
            @dbus.service.signal(_interface, signature="o")
2752
2688
            def ClientAdded(self, objpath):
2766
2702
            @dbus.service.method(_interface, out_signature="ao")
2767
2703
            def GetAllClients(self):
2768
2704
                "D-Bus method"
2769
 
                return dbus.Array(c.dbus_object_path for c in
 
2705
                return dbus.Array(c.dbus_object_path
 
2706
                                  for c in
2770
2707
                                  tcp_server.clients.itervalues())
2771
2708
            
2772
2709
            @dbus.service.method(_interface,
2774
2711
            def GetAllClientsWithProperties(self):
2775
2712
                "D-Bus method"
2776
2713
                return dbus.Dictionary(
2777
 
                    { c.dbus_object_path: c.GetAll("")
2778
 
                      for c in tcp_server.clients.itervalues() },
 
2714
                    ((c.dbus_object_path, c.GetAll(""))
 
2715
                     for c in tcp_server.clients.itervalues()),
2779
2716
                    signature="oa{sv}")
2780
2717
            
2781
2718
            @dbus.service.method(_interface, in_signature="o")
2798
2735
    
2799
2736
    def cleanup():
2800
2737
        "Cleanup function; run on exit"
2801
 
        if zeroconf:
2802
 
            service.cleanup()
 
2738
        service.cleanup()
2803
2739
        
2804
2740
        multiprocessing.active_children()
2805
2741
        wnull.close()
2819
2755
                
2820
2756
                # A list of attributes that can not be pickled
2821
2757
                # + secret.
2822
 
                exclude = { "bus", "changedstate", "secret",
2823
 
                            "checker", "server_settings" }
2824
 
                for name, typ in inspect.getmembers(dbus.service
2825
 
                                                    .Object):
 
2758
                exclude = set(("bus", "changedstate", "secret",
 
2759
                               "checker", "server_settings"))
 
2760
                for name, typ in (inspect.getmembers
 
2761
                                  (dbus.service.Object)):
2826
2762
                    exclude.add(name)
2827
2763
                
2828
2764
                client_dict["encrypted_secret"] = (client
2835
2771
                del client_settings[client.name]["secret"]
2836
2772
        
2837
2773
        try:
2838
 
            with tempfile.NamedTemporaryFile(
2839
 
                    mode='wb',
2840
 
                    suffix=".pickle",
2841
 
                    prefix='clients-',
2842
 
                    dir=os.path.dirname(stored_state_path),
2843
 
                    delete=False) as stored_state:
 
2774
            with (tempfile.NamedTemporaryFile
 
2775
                  (mode='wb', suffix=".pickle", prefix='clients-',
 
2776
                   dir=os.path.dirname(stored_state_path),
 
2777
                   delete=False)) as stored_state:
2844
2778
                pickle.dump((clients, client_settings), stored_state)
2845
 
                tempname = stored_state.name
 
2779
                tempname=stored_state.name
2846
2780
            os.rename(tempname, stored_state_path)
2847
2781
        except (IOError, OSError) as e:
2848
2782
            if not debug:
2851
2785
                except NameError:
2852
2786
                    pass
2853
2787
            if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
2854
 
                logger.warning("Could not save persistent state: {}"
 
2788
                logger.warning("Could not save persistent state: {0}"
2855
2789
                               .format(os.strerror(e.errno)))
2856
2790
            else:
2857
2791
                logger.warning("Could not save persistent state:",
2858
2792
                               exc_info=e)
2859
 
                raise
 
2793
                raise e
2860
2794
        
2861
2795
        # Delete all clients, and settings from config
2862
2796
        while tcp_server.clients:
2867
2801
            client.disable(quiet=True)
2868
2802
            if use_dbus:
2869
2803
                # Emit D-Bus signal
2870
 
                mandos_dbus_service.ClientRemoved(
2871
 
                    client.dbus_object_path, client.name)
 
2804
                mandos_dbus_service.ClientRemoved(client
 
2805
                                                  .dbus_object_path,
 
2806
                                                  client.name)
2872
2807
        client_settings.clear()
2873
2808
    
2874
2809
    atexit.register(cleanup)
2885
2820
    tcp_server.server_activate()
2886
2821
    
2887
2822
    # Find out what port we got
2888
 
    if zeroconf:
2889
 
        service.port = tcp_server.socket.getsockname()[1]
 
2823
    service.port = tcp_server.socket.getsockname()[1]
2890
2824
    if use_ipv6:
2891
2825
        logger.info("Now listening on address %r, port %d,"
2892
2826
                    " flowinfo %d, scope_id %d",
2898
2832
    #service.interface = tcp_server.socket.getsockname()[3]
2899
2833
    
2900
2834
    try:
2901
 
        if zeroconf:
2902
 
            # From the Avahi example code
2903
 
            try:
2904
 
                service.activate()
2905
 
            except dbus.exceptions.DBusException as error:
2906
 
                logger.critical("D-Bus Exception", exc_info=error)
2907
 
                cleanup()
2908
 
                sys.exit(1)
2909
 
            # End of Avahi example code
 
2835
        # From the Avahi example code
 
2836
        try:
 
2837
            service.activate()
 
2838
        except dbus.exceptions.DBusException as error:
 
2839
            logger.critical("D-Bus Exception", exc_info=error)
 
2840
            cleanup()
 
2841
            sys.exit(1)
 
2842
        # End of Avahi example code
2910
2843
        
2911
2844
        gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
2912
2845
                             lambda *args, **kwargs:
2927
2860
    # Must run before the D-Bus bus name gets deregistered
2928
2861
    cleanup()
2929
2862
 
2930
 
 
2931
2863
if __name__ == '__main__':
2932
2864
    main()