/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos

  • Committer: Teddy Hogeborn
  • Date: 2013-10-26 19:05:21 UTC
  • Revision ID: teddy@recompile.se-20131026190521-giagilisbyciox2h
Fall back to /var/run for pidfile if /run is not a directory.

This is for old (possibly non-Debian) systems which have not migrated
from /var/run to /run yet.

* init.d-mandos (PIDFILE): Fall back to /var/run/mandos.pid if /run is
                           not a directory.
* mandos (pidfilename): - '' -
* mandos.xml (FILES): Document fallback to /var/run/mandos.pid if /run
                      is not a directory.

Reported-by: Nathanael D. Noblet <nathanael@gnat.ca>
Suggested-by: Nathanael D. Noblet <nathanael@gnat.ca>

Show diffs side-by-side

added added

removed removed

Lines of Context:
6
6
# This program is partly derived from an example program for an Avahi
7
7
# service publisher, downloaded from
8
8
# <http://avahi.org/wiki/PythonPublishExample>.  This includes the
9
 
# methods "add" and "remove" in the "AvahiService" class, the
10
 
# "server_state_changed" and "entry_group_state_changed" functions,
11
 
# and some lines in "main".
 
9
# methods "add", "remove", "server_state_changed",
 
10
# "entry_group_state_changed", "cleanup", and "activate" in the
 
11
# "AvahiService" class, and some lines in "main".
12
12
13
13
# Everything else is
14
 
# Copyright © 2007-2008 Teddy Hogeborn & Björn Påhlsson
 
14
# Copyright © 2008-2013 Teddy Hogeborn
 
15
# Copyright © 2008-2013 Björn Påhlsson
15
16
16
17
# This program is free software: you can redistribute it and/or modify
17
18
# it under the terms of the GNU General Public License as published by
24
25
#     GNU General Public License for more details.
25
26
26
27
# You should have received a copy of the GNU General Public License
27
 
# along with this program.  If not, see <http://www.gnu.org/licenses/>.
28
 
29
 
# Contact the authors at <mandos@fukt.bsnet.se>.
30
 
31
 
 
32
 
from __future__ import division
33
 
 
34
 
import SocketServer
 
28
# along with this program.  If not, see
 
29
# <http://www.gnu.org/licenses/>.
 
30
 
31
# Contact the authors at <mandos@recompile.se>.
 
32
 
33
 
 
34
from __future__ import (division, absolute_import, print_function,
 
35
                        unicode_literals)
 
36
 
 
37
from future_builtins import *
 
38
 
 
39
import SocketServer as socketserver
35
40
import socket
36
 
import select
37
 
from optparse import OptionParser
 
41
import argparse
38
42
import datetime
39
43
import errno
40
44
import gnutls.crypto
43
47
import gnutls.library.functions
44
48
import gnutls.library.constants
45
49
import gnutls.library.types
46
 
import ConfigParser
 
50
import ConfigParser as configparser
47
51
import sys
48
52
import re
49
53
import os
50
54
import signal
51
 
from sets import Set
52
55
import subprocess
53
56
import atexit
54
57
import stat
55
58
import logging
56
59
import logging.handlers
 
60
import pwd
 
61
import contextlib
 
62
import struct
 
63
import fcntl
 
64
import functools
 
65
import cPickle as pickle
 
66
import multiprocessing
 
67
import types
 
68
import binascii
 
69
import tempfile
 
70
import itertools
 
71
import collections
57
72
 
58
73
import dbus
 
74
import dbus.service
59
75
import gobject
60
76
import avahi
61
77
from dbus.mainloop.glib import DBusGMainLoop
62
78
import ctypes
63
 
 
64
 
version = "1.0"
65
 
 
66
 
logger = logging.Logger('mandos')
67
 
syslogger = logging.handlers.SysLogHandler\
68
 
            (facility = logging.handlers.SysLogHandler.LOG_DAEMON,
69
 
             address = "/dev/log")
70
 
syslogger.setFormatter(logging.Formatter\
71
 
                        ('Mandos: %(levelname)s: %(message)s'))
72
 
logger.addHandler(syslogger)
73
 
 
74
 
console = logging.StreamHandler()
75
 
console.setFormatter(logging.Formatter('%(name)s: %(levelname)s:'
76
 
                                       ' %(message)s'))
77
 
logger.addHandler(console)
 
79
import ctypes.util
 
80
import xml.dom.minidom
 
81
import inspect
 
82
 
 
83
try:
 
84
    SO_BINDTODEVICE = socket.SO_BINDTODEVICE
 
85
except AttributeError:
 
86
    try:
 
87
        from IN import SO_BINDTODEVICE
 
88
    except ImportError:
 
89
        SO_BINDTODEVICE = None
 
90
 
 
91
version = "1.6.2"
 
92
stored_state_file = "clients.pickle"
 
93
 
 
94
logger = logging.getLogger()
 
95
syslogger = (logging.handlers.SysLogHandler
 
96
             (facility = logging.handlers.SysLogHandler.LOG_DAEMON,
 
97
              address = str("/dev/log")))
 
98
 
 
99
try:
 
100
    if_nametoindex = (ctypes.cdll.LoadLibrary
 
101
                      (ctypes.util.find_library("c"))
 
102
                      .if_nametoindex)
 
103
except (OSError, AttributeError):
 
104
    def if_nametoindex(interface):
 
105
        "Get an interface index the hard way, i.e. using fcntl()"
 
106
        SIOCGIFINDEX = 0x8933  # From /usr/include/linux/sockios.h
 
107
        with contextlib.closing(socket.socket()) as s:
 
108
            ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
 
109
                                struct.pack(str("16s16x"),
 
110
                                            interface))
 
111
        interface_index = struct.unpack(str("I"),
 
112
                                        ifreq[16:20])[0]
 
113
        return interface_index
 
114
 
 
115
 
 
116
def initlogger(debug, level=logging.WARNING):
 
117
    """init logger and add loglevel"""
 
118
    
 
119
    syslogger.setFormatter(logging.Formatter
 
120
                           ('Mandos [%(process)d]: %(levelname)s:'
 
121
                            ' %(message)s'))
 
122
    logger.addHandler(syslogger)
 
123
    
 
124
    if debug:
 
125
        console = logging.StreamHandler()
 
126
        console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
 
127
                                               ' [%(process)d]:'
 
128
                                               ' %(levelname)s:'
 
129
                                               ' %(message)s'))
 
130
        logger.addHandler(console)
 
131
    logger.setLevel(level)
 
132
 
 
133
 
 
134
class PGPError(Exception):
 
135
    """Exception if encryption/decryption fails"""
 
136
    pass
 
137
 
 
138
 
 
139
class PGPEngine(object):
 
140
    """A simple class for OpenPGP symmetric encryption & decryption"""
 
141
    def __init__(self):
 
142
        self.tempdir = tempfile.mkdtemp(prefix="mandos-")
 
143
        self.gnupgargs = ['--batch',
 
144
                          '--home', self.tempdir,
 
145
                          '--force-mdc',
 
146
                          '--quiet',
 
147
                          '--no-use-agent']
 
148
    
 
149
    def __enter__(self):
 
150
        return self
 
151
    
 
152
    def __exit__(self, exc_type, exc_value, traceback):
 
153
        self._cleanup()
 
154
        return False
 
155
    
 
156
    def __del__(self):
 
157
        self._cleanup()
 
158
    
 
159
    def _cleanup(self):
 
160
        if self.tempdir is not None:
 
161
            # Delete contents of tempdir
 
162
            for root, dirs, files in os.walk(self.tempdir,
 
163
                                             topdown = False):
 
164
                for filename in files:
 
165
                    os.remove(os.path.join(root, filename))
 
166
                for dirname in dirs:
 
167
                    os.rmdir(os.path.join(root, dirname))
 
168
            # Remove tempdir
 
169
            os.rmdir(self.tempdir)
 
170
            self.tempdir = None
 
171
    
 
172
    def password_encode(self, password):
 
173
        # Passphrase can not be empty and can not contain newlines or
 
174
        # NUL bytes.  So we prefix it and hex encode it.
 
175
        encoded = b"mandos" + binascii.hexlify(password)
 
176
        if len(encoded) > 2048:
 
177
            # GnuPG can't handle long passwords, so encode differently
 
178
            encoded = (b"mandos" + password.replace(b"\\", b"\\\\")
 
179
                       .replace(b"\n", b"\\n")
 
180
                       .replace(b"\0", b"\\x00"))
 
181
        return encoded
 
182
    
 
183
    def encrypt(self, data, password):
 
184
        passphrase = self.password_encode(password)
 
185
        with tempfile.NamedTemporaryFile(dir=self.tempdir
 
186
                                         ) as passfile:
 
187
            passfile.write(passphrase)
 
188
            passfile.flush()
 
189
            proc = subprocess.Popen(['gpg', '--symmetric',
 
190
                                     '--passphrase-file',
 
191
                                     passfile.name]
 
192
                                    + self.gnupgargs,
 
193
                                    stdin = subprocess.PIPE,
 
194
                                    stdout = subprocess.PIPE,
 
195
                                    stderr = subprocess.PIPE)
 
196
            ciphertext, err = proc.communicate(input = data)
 
197
        if proc.returncode != 0:
 
198
            raise PGPError(err)
 
199
        return ciphertext
 
200
    
 
201
    def decrypt(self, data, password):
 
202
        passphrase = self.password_encode(password)
 
203
        with tempfile.NamedTemporaryFile(dir = self.tempdir
 
204
                                         ) as passfile:
 
205
            passfile.write(passphrase)
 
206
            passfile.flush()
 
207
            proc = subprocess.Popen(['gpg', '--decrypt',
 
208
                                     '--passphrase-file',
 
209
                                     passfile.name]
 
210
                                    + self.gnupgargs,
 
211
                                    stdin = subprocess.PIPE,
 
212
                                    stdout = subprocess.PIPE,
 
213
                                    stderr = subprocess.PIPE)
 
214
            decrypted_plaintext, err = proc.communicate(input
 
215
                                                        = data)
 
216
        if proc.returncode != 0:
 
217
            raise PGPError(err)
 
218
        return decrypted_plaintext
 
219
 
78
220
 
79
221
class AvahiError(Exception):
80
 
    def __init__(self, value):
 
222
    def __init__(self, value, *args, **kwargs):
81
223
        self.value = value
82
 
    def __str__(self):
83
 
        return repr(self.value)
 
224
        super(AvahiError, self).__init__(value, *args, **kwargs)
 
225
    def __unicode__(self):
 
226
        return unicode(repr(self.value))
84
227
 
85
228
class AvahiServiceError(AvahiError):
86
229
    pass
91
234
 
92
235
class AvahiService(object):
93
236
    """An Avahi (Zeroconf) service.
 
237
    
94
238
    Attributes:
95
239
    interface: integer; avahi.IF_UNSPEC or an interface index.
96
240
               Used to optionally bind to the specified interface.
97
241
    name: string; Example: 'Mandos'
98
242
    type: string; Example: '_mandos._tcp'.
99
 
                  See <http://www.dns-sd.org/ServiceTypes.html>
 
243
     See <https://www.iana.org/assignments/service-names-port-numbers>
100
244
    port: integer; what port to announce
101
245
    TXT: list of strings; TXT record for the service
102
246
    domain: string; Domain to publish on, default to .local if empty.
104
248
    max_renames: integer; maximum number of renames
105
249
    rename_count: integer; counter so we only rename after collisions
106
250
                  a sensible number of times
 
251
    group: D-Bus Entry Group
 
252
    server: D-Bus Server
 
253
    bus: dbus.SystemBus()
107
254
    """
 
255
    
108
256
    def __init__(self, interface = avahi.IF_UNSPEC, name = None,
109
 
                 type = None, port = None, TXT = None, domain = "",
110
 
                 host = "", max_renames = 32768):
 
257
                 servicetype = None, port = None, TXT = None,
 
258
                 domain = "", host = "", max_renames = 32768,
 
259
                 protocol = avahi.PROTO_UNSPEC, bus = None):
111
260
        self.interface = interface
112
261
        self.name = name
113
 
        self.type = type
 
262
        self.type = servicetype
114
263
        self.port = port
115
 
        if TXT is None:
116
 
            self.TXT = []
117
 
        else:
118
 
            self.TXT = TXT
 
264
        self.TXT = TXT if TXT is not None else []
119
265
        self.domain = domain
120
266
        self.host = host
121
267
        self.rename_count = 0
 
268
        self.max_renames = max_renames
 
269
        self.protocol = protocol
 
270
        self.group = None       # our entry group
 
271
        self.server = None
 
272
        self.bus = bus
 
273
        self.entry_group_state_changed_match = None
 
274
    
122
275
    def rename(self):
123
276
        """Derived from the Avahi example code"""
124
277
        if self.rename_count >= self.max_renames:
125
 
            logger.critical(u"No suitable service name found after %i"
126
 
                            u" retries, exiting.", rename_count)
 
278
            logger.critical("No suitable Zeroconf service name found"
 
279
                            " after %i retries, exiting.",
 
280
                            self.rename_count)
127
281
            raise AvahiServiceError("Too many renames")
128
 
        name = server.GetAlternativeServiceName(name)
129
 
        logger.error(u"Changing name to %r ...", name)
130
 
        syslogger.setFormatter(logging.Formatter\
131
 
                               ('Mandos (%s): %%(levelname)s:'
132
 
                               ' %%(message)s' % name))
 
282
        self.name = unicode(self.server
 
283
                            .GetAlternativeServiceName(self.name))
 
284
        logger.info("Changing Zeroconf service name to %r ...",
 
285
                    self.name)
133
286
        self.remove()
134
 
        self.add()
 
287
        try:
 
288
            self.add()
 
289
        except dbus.exceptions.DBusException as error:
 
290
            logger.critical("D-Bus Exception", exc_info=error)
 
291
            self.cleanup()
 
292
            os._exit(1)
135
293
        self.rename_count += 1
 
294
    
136
295
    def remove(self):
137
296
        """Derived from the Avahi example code"""
138
 
        if group is not None:
139
 
            group.Reset()
 
297
        if self.entry_group_state_changed_match is not None:
 
298
            self.entry_group_state_changed_match.remove()
 
299
            self.entry_group_state_changed_match = None
 
300
        if self.group is not None:
 
301
            self.group.Reset()
 
302
    
140
303
    def add(self):
141
304
        """Derived from the Avahi example code"""
142
 
        global group
143
 
        if group is None:
144
 
            group = dbus.Interface\
145
 
                    (bus.get_object(avahi.DBUS_NAME,
146
 
                                    server.EntryGroupNew()),
147
 
                     avahi.DBUS_INTERFACE_ENTRY_GROUP)
148
 
            group.connect_to_signal('StateChanged',
149
 
                                    entry_group_state_changed)
150
 
        logger.debug(u"Adding service '%s' of type '%s' ...",
151
 
                     service.name, service.type)
152
 
        group.AddService(
153
 
                self.interface,         # interface
154
 
                avahi.PROTO_INET6,      # protocol
155
 
                dbus.UInt32(0),         # flags
156
 
                self.name, self.type,
157
 
                self.domain, self.host,
158
 
                dbus.UInt16(self.port),
159
 
                avahi.string_array_to_txt_array(self.TXT))
160
 
        group.Commit()
161
 
 
162
 
# From the Avahi example code:
163
 
group = None                            # our entry group
164
 
# End of Avahi example code
 
305
        self.remove()
 
306
        if self.group is None:
 
307
            self.group = dbus.Interface(
 
308
                self.bus.get_object(avahi.DBUS_NAME,
 
309
                                    self.server.EntryGroupNew()),
 
310
                avahi.DBUS_INTERFACE_ENTRY_GROUP)
 
311
        self.entry_group_state_changed_match = (
 
312
            self.group.connect_to_signal(
 
313
                'StateChanged', self.entry_group_state_changed))
 
314
        logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
 
315
                     self.name, self.type)
 
316
        self.group.AddService(
 
317
            self.interface,
 
318
            self.protocol,
 
319
            dbus.UInt32(0),     # flags
 
320
            self.name, self.type,
 
321
            self.domain, self.host,
 
322
            dbus.UInt16(self.port),
 
323
            avahi.string_array_to_txt_array(self.TXT))
 
324
        self.group.Commit()
 
325
    
 
326
    def entry_group_state_changed(self, state, error):
 
327
        """Derived from the Avahi example code"""
 
328
        logger.debug("Avahi entry group state change: %i", state)
 
329
        
 
330
        if state == avahi.ENTRY_GROUP_ESTABLISHED:
 
331
            logger.debug("Zeroconf service established.")
 
332
        elif state == avahi.ENTRY_GROUP_COLLISION:
 
333
            logger.info("Zeroconf service name collision.")
 
334
            self.rename()
 
335
        elif state == avahi.ENTRY_GROUP_FAILURE:
 
336
            logger.critical("Avahi: Error in group state changed %s",
 
337
                            unicode(error))
 
338
            raise AvahiGroupError("State changed: {0!s}"
 
339
                                  .format(error))
 
340
    
 
341
    def cleanup(self):
 
342
        """Derived from the Avahi example code"""
 
343
        if self.group is not None:
 
344
            try:
 
345
                self.group.Free()
 
346
            except (dbus.exceptions.UnknownMethodException,
 
347
                    dbus.exceptions.DBusException):
 
348
                pass
 
349
            self.group = None
 
350
        self.remove()
 
351
    
 
352
    def server_state_changed(self, state, error=None):
 
353
        """Derived from the Avahi example code"""
 
354
        logger.debug("Avahi server state change: %i", state)
 
355
        bad_states = { avahi.SERVER_INVALID:
 
356
                           "Zeroconf server invalid",
 
357
                       avahi.SERVER_REGISTERING: None,
 
358
                       avahi.SERVER_COLLISION:
 
359
                           "Zeroconf server name collision",
 
360
                       avahi.SERVER_FAILURE:
 
361
                           "Zeroconf server failure" }
 
362
        if state in bad_states:
 
363
            if bad_states[state] is not None:
 
364
                if error is None:
 
365
                    logger.error(bad_states[state])
 
366
                else:
 
367
                    logger.error(bad_states[state] + ": %r", error)
 
368
            self.cleanup()
 
369
        elif state == avahi.SERVER_RUNNING:
 
370
            self.add()
 
371
        else:
 
372
            if error is None:
 
373
                logger.debug("Unknown state: %r", state)
 
374
            else:
 
375
                logger.debug("Unknown state: %r: %r", state, error)
 
376
    
 
377
    def activate(self):
 
378
        """Derived from the Avahi example code"""
 
379
        if self.server is None:
 
380
            self.server = dbus.Interface(
 
381
                self.bus.get_object(avahi.DBUS_NAME,
 
382
                                    avahi.DBUS_PATH_SERVER,
 
383
                                    follow_name_owner_changes=True),
 
384
                avahi.DBUS_INTERFACE_SERVER)
 
385
        self.server.connect_to_signal("StateChanged",
 
386
                                 self.server_state_changed)
 
387
        self.server_state_changed(self.server.GetState())
 
388
 
 
389
 
 
390
class AvahiServiceToSyslog(AvahiService):
 
391
    def rename(self):
 
392
        """Add the new name to the syslog messages"""
 
393
        ret = AvahiService.rename(self)
 
394
        syslogger.setFormatter(logging.Formatter
 
395
                               ('Mandos ({0}) [%(process)d]:'
 
396
                                ' %(levelname)s: %(message)s'
 
397
                                .format(self.name)))
 
398
        return ret
 
399
 
 
400
 
 
401
def timedelta_to_milliseconds(td):
 
402
    "Convert a datetime.timedelta() to milliseconds"
 
403
    return ((td.days * 24 * 60 * 60 * 1000)
 
404
            + (td.seconds * 1000)
 
405
            + (td.microseconds // 1000))
165
406
 
166
407
 
167
408
class Client(object):
168
409
    """A representation of a client host served by this server.
 
410
    
169
411
    Attributes:
170
 
    name:      string; from the config file, used in log messages
 
412
    approved:   bool(); 'None' if not yet approved/disapproved
 
413
    approval_delay: datetime.timedelta(); Time to wait for approval
 
414
    approval_duration: datetime.timedelta(); Duration of one approval
 
415
    checker:    subprocess.Popen(); a running checker process used
 
416
                                    to see if the client lives.
 
417
                                    'None' if no process is running.
 
418
    checker_callback_tag: a gobject event source tag, or None
 
419
    checker_command: string; External command which is run to check
 
420
                     if client lives.  %() expansions are done at
 
421
                     runtime with vars(self) as dict, so that for
 
422
                     instance %(name)s can be used in the command.
 
423
    checker_initiator_tag: a gobject event source tag, or None
 
424
    created:    datetime.datetime(); (UTC) object creation
 
425
    client_structure: Object describing what attributes a client has
 
426
                      and is used for storing the client at exit
 
427
    current_checker_command: string; current running checker_command
 
428
    disable_initiator_tag: a gobject event source tag, or None
 
429
    enabled:    bool()
171
430
    fingerprint: string (40 or 32 hexadecimal digits); used to
172
431
                 uniquely identify the client
173
 
    secret:    bytestring; sent verbatim (over TLS) to client
174
 
    host:      string; available for use by the checker command
175
 
    created:   datetime.datetime(); object creation, not client host
176
 
    last_checked_ok: datetime.datetime() or None if not yet checked OK
177
 
    timeout:   datetime.timedelta(); How long from last_checked_ok
178
 
                                     until this client is invalid
179
 
    interval:  datetime.timedelta(); How often to start a new checker
180
 
    stop_hook: If set, called by stop() as stop_hook(self)
181
 
    checker:   subprocess.Popen(); a running checker process used
182
 
                                   to see if the client lives.
183
 
                                   'None' if no process is running.
184
 
    checker_initiator_tag: a gobject event source tag, or None
185
 
    stop_initiator_tag:    - '' -
186
 
    checker_callback_tag:  - '' -
187
 
    checker_command: string; External command which is run to check if
188
 
                     client lives.  %() expansions are done at
189
 
                     runtime with vars(self) as dict, so that for
190
 
                     instance %(name)s can be used in the command.
191
 
    Private attibutes:
192
 
    _timeout: Real variable for 'timeout'
193
 
    _interval: Real variable for 'interval'
194
 
    _timeout_milliseconds: Used when calling gobject.timeout_add()
195
 
    _interval_milliseconds: - '' -
 
432
    host:       string; available for use by the checker command
 
433
    interval:   datetime.timedelta(); How often to start a new checker
 
434
    last_approval_request: datetime.datetime(); (UTC) or None
 
435
    last_checked_ok: datetime.datetime(); (UTC) or None
 
436
    last_checker_status: integer between 0 and 255 reflecting exit
 
437
                         status of last checker. -1 reflects crashed
 
438
                         checker, -2 means no checker completed yet.
 
439
    last_enabled: datetime.datetime(); (UTC) or None
 
440
    name:       string; from the config file, used in log messages and
 
441
                        D-Bus identifiers
 
442
    secret:     bytestring; sent verbatim (over TLS) to client
 
443
    timeout:    datetime.timedelta(); How long from last_checked_ok
 
444
                                      until this client is disabled
 
445
    extended_timeout:   extra long timeout when secret has been sent
 
446
    runtime_expansions: Allowed attributes for runtime expansion.
 
447
    expires:    datetime.datetime(); time (UTC) when a client will be
 
448
                disabled, or None
 
449
    server_settings: The server_settings dict from main()
196
450
    """
197
 
    def _set_timeout(self, timeout):
198
 
        "Setter function for 'timeout' attribute"
199
 
        self._timeout = timeout
200
 
        self._timeout_milliseconds = ((self.timeout.days
201
 
                                       * 24 * 60 * 60 * 1000)
202
 
                                      + (self.timeout.seconds * 1000)
203
 
                                      + (self.timeout.microseconds
204
 
                                         // 1000))
205
 
    timeout = property(lambda self: self._timeout,
206
 
                       _set_timeout)
207
 
    del _set_timeout
208
 
    def _set_interval(self, interval):
209
 
        "Setter function for 'interval' attribute"
210
 
        self._interval = interval
211
 
        self._interval_milliseconds = ((self.interval.days
212
 
                                        * 24 * 60 * 60 * 1000)
213
 
                                       + (self.interval.seconds
214
 
                                          * 1000)
215
 
                                       + (self.interval.microseconds
216
 
                                          // 1000))
217
 
    interval = property(lambda self: self._interval,
218
 
                        _set_interval)
219
 
    del _set_interval
220
 
    def __init__(self, name = None, stop_hook=None, config={}):
221
 
        """Note: the 'checker' key in 'config' sets the
222
 
        'checker_command' attribute and *not* the 'checker'
223
 
        attribute."""
 
451
    
 
452
    runtime_expansions = ("approval_delay", "approval_duration",
 
453
                          "created", "enabled", "expires",
 
454
                          "fingerprint", "host", "interval",
 
455
                          "last_approval_request", "last_checked_ok",
 
456
                          "last_enabled", "name", "timeout")
 
457
    client_defaults = { "timeout": "PT5M",
 
458
                        "extended_timeout": "PT15M",
 
459
                        "interval": "PT2M",
 
460
                        "checker": "fping -q -- %%(host)s",
 
461
                        "host": "",
 
462
                        "approval_delay": "PT0S",
 
463
                        "approval_duration": "PT1S",
 
464
                        "approved_by_default": "True",
 
465
                        "enabled": "True",
 
466
                        }
 
467
    
 
468
    def timeout_milliseconds(self):
 
469
        "Return the 'timeout' attribute in milliseconds"
 
470
        return timedelta_to_milliseconds(self.timeout)
 
471
    
 
472
    def extended_timeout_milliseconds(self):
 
473
        "Return the 'extended_timeout' attribute in milliseconds"
 
474
        return timedelta_to_milliseconds(self.extended_timeout)
 
475
    
 
476
    def interval_milliseconds(self):
 
477
        "Return the 'interval' attribute in milliseconds"
 
478
        return timedelta_to_milliseconds(self.interval)
 
479
    
 
480
    def approval_delay_milliseconds(self):
 
481
        return timedelta_to_milliseconds(self.approval_delay)
 
482
    
 
483
    @staticmethod
 
484
    def config_parser(config):
 
485
        """Construct a new dict of client settings of this form:
 
486
        { client_name: {setting_name: value, ...}, ...}
 
487
        with exceptions for any special settings as defined above.
 
488
        NOTE: Must be a pure function. Must return the same result
 
489
        value given the same arguments.
 
490
        """
 
491
        settings = {}
 
492
        for client_name in config.sections():
 
493
            section = dict(config.items(client_name))
 
494
            client = settings[client_name] = {}
 
495
            
 
496
            client["host"] = section["host"]
 
497
            # Reformat values from string types to Python types
 
498
            client["approved_by_default"] = config.getboolean(
 
499
                client_name, "approved_by_default")
 
500
            client["enabled"] = config.getboolean(client_name,
 
501
                                                  "enabled")
 
502
            
 
503
            client["fingerprint"] = (section["fingerprint"].upper()
 
504
                                     .replace(" ", ""))
 
505
            if "secret" in section:
 
506
                client["secret"] = section["secret"].decode("base64")
 
507
            elif "secfile" in section:
 
508
                with open(os.path.expanduser(os.path.expandvars
 
509
                                             (section["secfile"])),
 
510
                          "rb") as secfile:
 
511
                    client["secret"] = secfile.read()
 
512
            else:
 
513
                raise TypeError("No secret or secfile for section {0}"
 
514
                                .format(section))
 
515
            client["timeout"] = string_to_delta(section["timeout"])
 
516
            client["extended_timeout"] = string_to_delta(
 
517
                section["extended_timeout"])
 
518
            client["interval"] = string_to_delta(section["interval"])
 
519
            client["approval_delay"] = string_to_delta(
 
520
                section["approval_delay"])
 
521
            client["approval_duration"] = string_to_delta(
 
522
                section["approval_duration"])
 
523
            client["checker_command"] = section["checker"]
 
524
            client["last_approval_request"] = None
 
525
            client["last_checked_ok"] = None
 
526
            client["last_checker_status"] = -2
 
527
        
 
528
        return settings
 
529
    
 
530
    def __init__(self, settings, name = None, server_settings=None):
224
531
        self.name = name
225
 
        logger.debug(u"Creating client %r", self.name)
 
532
        if server_settings is None:
 
533
            server_settings = {}
 
534
        self.server_settings = server_settings
 
535
        # adding all client settings
 
536
        for setting, value in settings.iteritems():
 
537
            setattr(self, setting, value)
 
538
        
 
539
        if self.enabled:
 
540
            if not hasattr(self, "last_enabled"):
 
541
                self.last_enabled = datetime.datetime.utcnow()
 
542
            if not hasattr(self, "expires"):
 
543
                self.expires = (datetime.datetime.utcnow()
 
544
                                + self.timeout)
 
545
        else:
 
546
            self.last_enabled = None
 
547
            self.expires = None
 
548
        
 
549
        logger.debug("Creating client %r", self.name)
226
550
        # Uppercase and remove spaces from fingerprint for later
227
551
        # comparison purposes with return value from the fingerprint()
228
552
        # function
229
 
        self.fingerprint = config["fingerprint"].upper()\
230
 
                           .replace(u" ", u"")
231
 
        logger.debug(u"  Fingerprint: %s", self.fingerprint)
232
 
        if "secret" in config:
233
 
            self.secret = config["secret"].decode(u"base64")
234
 
        elif "secfile" in config:
235
 
            sf = open(config["secfile"])
236
 
            self.secret = sf.read()
237
 
            sf.close()
238
 
        else:
239
 
            raise TypeError(u"No secret or secfile for client %s"
240
 
                            % self.name)
241
 
        self.host = config.get("host", "")
242
 
        self.created = datetime.datetime.now()
243
 
        self.last_checked_ok = None
244
 
        self.timeout = string_to_delta(config["timeout"])
245
 
        self.interval = string_to_delta(config["interval"])
246
 
        self.stop_hook = stop_hook
 
553
        logger.debug("  Fingerprint: %s", self.fingerprint)
 
554
        self.created = settings.get("created",
 
555
                                    datetime.datetime.utcnow())
 
556
        
 
557
        # attributes specific for this server instance
247
558
        self.checker = None
248
559
        self.checker_initiator_tag = None
249
 
        self.stop_initiator_tag = None
 
560
        self.disable_initiator_tag = None
250
561
        self.checker_callback_tag = None
251
 
        self.check_command = config["checker"]
252
 
    def start(self):
 
562
        self.current_checker_command = None
 
563
        self.approved = None
 
564
        self.approvals_pending = 0
 
565
        self.changedstate = (multiprocessing_manager
 
566
                             .Condition(multiprocessing_manager
 
567
                                        .Lock()))
 
568
        self.client_structure = [attr for attr in
 
569
                                 self.__dict__.iterkeys()
 
570
                                 if not attr.startswith("_")]
 
571
        self.client_structure.append("client_structure")
 
572
        
 
573
        for name, t in inspect.getmembers(type(self),
 
574
                                          lambda obj:
 
575
                                              isinstance(obj,
 
576
                                                         property)):
 
577
            if not name.startswith("_"):
 
578
                self.client_structure.append(name)
 
579
    
 
580
    # Send notice to process children that client state has changed
 
581
    def send_changedstate(self):
 
582
        with self.changedstate:
 
583
            self.changedstate.notify_all()
 
584
    
 
585
    def enable(self):
253
586
        """Start this client's checker and timeout hooks"""
 
587
        if getattr(self, "enabled", False):
 
588
            # Already enabled
 
589
            return
 
590
        self.expires = datetime.datetime.utcnow() + self.timeout
 
591
        self.enabled = True
 
592
        self.last_enabled = datetime.datetime.utcnow()
 
593
        self.init_checker()
 
594
        self.send_changedstate()
 
595
    
 
596
    def disable(self, quiet=True):
 
597
        """Disable this client."""
 
598
        if not getattr(self, "enabled", False):
 
599
            return False
 
600
        if not quiet:
 
601
            logger.info("Disabling client %s", self.name)
 
602
        if getattr(self, "disable_initiator_tag", None) is not None:
 
603
            gobject.source_remove(self.disable_initiator_tag)
 
604
            self.disable_initiator_tag = None
 
605
        self.expires = None
 
606
        if getattr(self, "checker_initiator_tag", None) is not None:
 
607
            gobject.source_remove(self.checker_initiator_tag)
 
608
            self.checker_initiator_tag = None
 
609
        self.stop_checker()
 
610
        self.enabled = False
 
611
        if not quiet:
 
612
            self.send_changedstate()
 
613
        # Do not run this again if called by a gobject.timeout_add
 
614
        return False
 
615
    
 
616
    def __del__(self):
 
617
        self.disable()
 
618
    
 
619
    def init_checker(self):
254
620
        # Schedule a new checker to be started an 'interval' from now,
255
621
        # and every interval from then on.
256
 
        self.checker_initiator_tag = gobject.timeout_add\
257
 
                                     (self._interval_milliseconds,
258
 
                                      self.start_checker)
 
622
        if self.checker_initiator_tag is not None:
 
623
            gobject.source_remove(self.checker_initiator_tag)
 
624
        self.checker_initiator_tag = (gobject.timeout_add
 
625
                                      (self.interval_milliseconds(),
 
626
                                       self.start_checker))
 
627
        # Schedule a disable() when 'timeout' has passed
 
628
        if self.disable_initiator_tag is not None:
 
629
            gobject.source_remove(self.disable_initiator_tag)
 
630
        self.disable_initiator_tag = (gobject.timeout_add
 
631
                                   (self.timeout_milliseconds(),
 
632
                                    self.disable))
259
633
        # Also start a new checker *right now*.
260
634
        self.start_checker()
261
 
        # Schedule a stop() when 'timeout' has passed
262
 
        self.stop_initiator_tag = gobject.timeout_add\
263
 
                                  (self._timeout_milliseconds,
264
 
                                   self.stop)
265
 
    def stop(self):
266
 
        """Stop this client.
267
 
        The possibility that a client might be restarted is left open,
268
 
        but not currently used."""
269
 
        # If this client doesn't have a secret, it is already stopped.
270
 
        if hasattr(self, "secret") and self.secret:
271
 
            logger.info(u"Stopping client %s", self.name)
272
 
            self.secret = None
273
 
        else:
274
 
            return False
275
 
        if getattr(self, "stop_initiator_tag", False):
276
 
            gobject.source_remove(self.stop_initiator_tag)
277
 
            self.stop_initiator_tag = None
278
 
        if getattr(self, "checker_initiator_tag", False):
279
 
            gobject.source_remove(self.checker_initiator_tag)
280
 
            self.checker_initiator_tag = None
281
 
        self.stop_checker()
282
 
        if self.stop_hook:
283
 
            self.stop_hook(self)
284
 
        # Do not run this again if called by a gobject.timeout_add
285
 
        return False
286
 
    def __del__(self):
287
 
        self.stop_hook = None
288
 
        self.stop()
289
 
    def checker_callback(self, pid, condition):
 
635
    
 
636
    def checker_callback(self, pid, condition, command):
290
637
        """The checker has completed, so take appropriate actions."""
291
 
        now = datetime.datetime.now()
292
638
        self.checker_callback_tag = None
293
639
        self.checker = None
294
 
        if os.WIFEXITED(condition) \
295
 
               and (os.WEXITSTATUS(condition) == 0):
296
 
            logger.info(u"Checker for %(name)s succeeded",
297
 
                        vars(self))
298
 
            self.last_checked_ok = now
299
 
            gobject.source_remove(self.stop_initiator_tag)
300
 
            self.stop_initiator_tag = gobject.timeout_add\
301
 
                                      (self._timeout_milliseconds,
302
 
                                       self.stop)
303
 
        elif not os.WIFEXITED(condition):
304
 
            logger.warning(u"Checker for %(name)s crashed?",
 
640
        if os.WIFEXITED(condition):
 
641
            self.last_checker_status = os.WEXITSTATUS(condition)
 
642
            if self.last_checker_status == 0:
 
643
                logger.info("Checker for %(name)s succeeded",
 
644
                            vars(self))
 
645
                self.checked_ok()
 
646
            else:
 
647
                logger.info("Checker for %(name)s failed",
 
648
                            vars(self))
 
649
        else:
 
650
            self.last_checker_status = -1
 
651
            logger.warning("Checker for %(name)s crashed?",
305
652
                           vars(self))
306
 
        else:
307
 
            logger.info(u"Checker for %(name)s failed",
308
 
                        vars(self))
 
653
    
 
654
    def checked_ok(self):
 
655
        """Assert that the client has been seen, alive and well."""
 
656
        self.last_checked_ok = datetime.datetime.utcnow()
 
657
        self.last_checker_status = 0
 
658
        self.bump_timeout()
 
659
    
 
660
    def bump_timeout(self, timeout=None):
 
661
        """Bump up the timeout for this client."""
 
662
        if timeout is None:
 
663
            timeout = self.timeout
 
664
        if self.disable_initiator_tag is not None:
 
665
            gobject.source_remove(self.disable_initiator_tag)
 
666
            self.disable_initiator_tag = None
 
667
        if getattr(self, "enabled", False):
 
668
            self.disable_initiator_tag = (gobject.timeout_add
 
669
                                          (timedelta_to_milliseconds
 
670
                                           (timeout), self.disable))
 
671
            self.expires = datetime.datetime.utcnow() + timeout
 
672
    
 
673
    def need_approval(self):
 
674
        self.last_approval_request = datetime.datetime.utcnow()
 
675
    
309
676
    def start_checker(self):
310
677
        """Start a new checker subprocess if one is not running.
 
678
        
311
679
        If a checker already exists, leave it running and do
312
680
        nothing."""
313
681
        # The reason for not killing a running checker is that if we
314
 
        # did that, then if a checker (for some reason) started
315
 
        # running slowly and taking more than 'interval' time, the
316
 
        # client would inevitably timeout, since no checker would get
317
 
        # a chance to run to completion.  If we instead leave running
 
682
        # did that, and if a checker (for some reason) started running
 
683
        # slowly and taking more than 'interval' time, then the client
 
684
        # would inevitably timeout, since no checker would get a
 
685
        # chance to run to completion.  If we instead leave running
318
686
        # checkers alone, the checker would have to take more time
319
 
        # than 'timeout' for the client to be declared invalid, which
320
 
        # is as it should be.
 
687
        # than 'timeout' for the client to be disabled, which is as it
 
688
        # should be.
 
689
        
 
690
        # If a checker exists, make sure it is not a zombie
 
691
        try:
 
692
            pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
 
693
        except (AttributeError, OSError) as error:
 
694
            if (isinstance(error, OSError)
 
695
                and error.errno != errno.ECHILD):
 
696
                raise error
 
697
        else:
 
698
            if pid:
 
699
                logger.warning("Checker was a zombie")
 
700
                gobject.source_remove(self.checker_callback_tag)
 
701
                self.checker_callback(pid, status,
 
702
                                      self.current_checker_command)
 
703
        # Start a new checker if needed
321
704
        if self.checker is None:
322
 
            try:
323
 
                # In case check_command has exactly one % operator
324
 
                command = self.check_command % self.host
325
 
            except TypeError:
326
 
                # Escape attributes for the shell
327
 
                escaped_attrs = dict((key, re.escape(str(val)))
328
 
                                     for key, val in
329
 
                                     vars(self).iteritems())
330
 
                try:
331
 
                    command = self.check_command % escaped_attrs
332
 
                except TypeError, error:
333
 
                    logger.error(u'Could not format string "%s":'
334
 
                                 u' %s', self.check_command, error)
335
 
                    return True # Try again later
336
 
            try:
337
 
                logger.info(u"Starting checker %r for %s",
 
705
            # Escape attributes for the shell
 
706
            escaped_attrs = dict(
 
707
                (attr, re.escape(unicode(getattr(self, attr))))
 
708
                for attr in
 
709
                self.runtime_expansions)
 
710
            try:
 
711
                command = self.checker_command % escaped_attrs
 
712
            except TypeError as error:
 
713
                logger.error('Could not format string "%s"',
 
714
                             self.checker_command, exc_info=error)
 
715
                return True # Try again later
 
716
            self.current_checker_command = command
 
717
            try:
 
718
                logger.info("Starting checker %r for %s",
338
719
                            command, self.name)
 
720
                # We don't need to redirect stdout and stderr, since
 
721
                # in normal mode, that is already done by daemon(),
 
722
                # and in debug mode we don't want to.  (Stdin is
 
723
                # always replaced by /dev/null.)
 
724
                # The exception is when not debugging but nevertheless
 
725
                # running in the foreground; use the previously
 
726
                # created wnull.
 
727
                popen_args = {}
 
728
                if (not self.server_settings["debug"]
 
729
                    and self.server_settings["foreground"]):
 
730
                    popen_args.update({"stdout": wnull,
 
731
                                       "stderr": wnull })
339
732
                self.checker = subprocess.Popen(command,
340
733
                                                close_fds=True,
341
 
                                                shell=True, cwd="/")
342
 
                self.checker_callback_tag = gobject.child_watch_add\
343
 
                                            (self.checker.pid,
344
 
                                             self.checker_callback)
345
 
            except subprocess.OSError, error:
346
 
                logger.error(u"Failed to start subprocess: %s",
347
 
                             error)
 
734
                                                shell=True, cwd="/",
 
735
                                                **popen_args)
 
736
            except OSError as error:
 
737
                logger.error("Failed to start subprocess",
 
738
                             exc_info=error)
 
739
                return True
 
740
            self.checker_callback_tag = (gobject.child_watch_add
 
741
                                         (self.checker.pid,
 
742
                                          self.checker_callback,
 
743
                                          data=command))
 
744
            # The checker may have completed before the gobject
 
745
            # watch was added.  Check for this.
 
746
            try:
 
747
                pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
 
748
            except OSError as error:
 
749
                if error.errno == errno.ECHILD:
 
750
                    # This should never happen
 
751
                    logger.error("Child process vanished",
 
752
                                 exc_info=error)
 
753
                    return True
 
754
                raise
 
755
            if pid:
 
756
                gobject.source_remove(self.checker_callback_tag)
 
757
                self.checker_callback(pid, status, command)
348
758
        # Re-run this periodically if run by gobject.timeout_add
349
759
        return True
 
760
    
350
761
    def stop_checker(self):
351
762
        """Force the checker process, if any, to stop."""
352
763
        if self.checker_callback_tag:
354
765
            self.checker_callback_tag = None
355
766
        if getattr(self, "checker", None) is None:
356
767
            return
357
 
        logger.debug(u"Stopping checker for %(name)s", vars(self))
 
768
        logger.debug("Stopping checker for %(name)s", vars(self))
358
769
        try:
359
 
            os.kill(self.checker.pid, signal.SIGTERM)
360
 
            #os.sleep(0.5)
 
770
            self.checker.terminate()
 
771
            #time.sleep(0.5)
361
772
            #if self.checker.poll() is None:
362
 
            #    os.kill(self.checker.pid, signal.SIGKILL)
363
 
        except OSError, error:
 
773
            #    self.checker.kill()
 
774
        except OSError as error:
364
775
            if error.errno != errno.ESRCH: # No such process
365
776
                raise
366
777
        self.checker = None
367
 
    def still_valid(self):
368
 
        """Has the timeout not yet passed for this client?"""
369
 
        now = datetime.datetime.now()
370
 
        if self.last_checked_ok is None:
371
 
            return now < (self.created + self.timeout)
372
 
        else:
373
 
            return now < (self.last_checked_ok + self.timeout)
374
 
 
375
 
 
376
 
def peer_certificate(session):
377
 
    "Return the peer's OpenPGP certificate as a bytestring"
378
 
    # If not an OpenPGP certificate...
379
 
    if gnutls.library.functions.gnutls_certificate_type_get\
380
 
            (session._c_object) \
381
 
           != gnutls.library.constants.GNUTLS_CRT_OPENPGP:
382
 
        # ...do the normal thing
383
 
        return session.peer_certificate
384
 
    list_size = ctypes.c_uint()
385
 
    cert_list = gnutls.library.functions.gnutls_certificate_get_peers\
386
 
        (session._c_object, ctypes.byref(list_size))
387
 
    if list_size.value == 0:
388
 
        return None
389
 
    cert = cert_list[0]
390
 
    return ctypes.string_at(cert.data, cert.size)
391
 
 
392
 
 
393
 
def fingerprint(openpgp):
394
 
    "Convert an OpenPGP bytestring to a hexdigit fingerprint string"
395
 
    # New GnuTLS "datum" with the OpenPGP public key
396
 
    datum = gnutls.library.types.gnutls_datum_t\
397
 
        (ctypes.cast(ctypes.c_char_p(openpgp),
398
 
                     ctypes.POINTER(ctypes.c_ubyte)),
399
 
         ctypes.c_uint(len(openpgp)))
400
 
    # New empty GnuTLS certificate
401
 
    crt = gnutls.library.types.gnutls_openpgp_crt_t()
402
 
    gnutls.library.functions.gnutls_openpgp_crt_init\
403
 
        (ctypes.byref(crt))
404
 
    # Import the OpenPGP public key into the certificate
405
 
    gnutls.library.functions.gnutls_openpgp_crt_import\
406
 
                    (crt, ctypes.byref(datum),
407
 
                     gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
408
 
    # New buffer for the fingerprint
409
 
    buffer = ctypes.create_string_buffer(20)
410
 
    buffer_length = ctypes.c_size_t()
411
 
    # Get the fingerprint from the certificate into the buffer
412
 
    gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint\
413
 
        (crt, ctypes.byref(buffer), ctypes.byref(buffer_length))
414
 
    # Deinit the certificate
415
 
    gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
416
 
    # Convert the buffer to a Python bytestring
417
 
    fpr = ctypes.string_at(buffer, buffer_length.value)
418
 
    # Convert the bytestring to hexadecimal notation
419
 
    hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
420
 
    return hex_fpr
421
 
 
422
 
 
423
 
class tcp_handler(SocketServer.BaseRequestHandler, object):
424
 
    """A TCP request handler class.
425
 
    Instantiated by IPv6_TCPServer for each request to handle it.
 
778
 
 
779
 
 
780
def dbus_service_property(dbus_interface, signature="v",
 
781
                          access="readwrite", byte_arrays=False):
 
782
    """Decorators for marking methods of a DBusObjectWithProperties to
 
783
    become properties on the D-Bus.
 
784
    
 
785
    The decorated method will be called with no arguments by "Get"
 
786
    and with one argument by "Set".
 
787
    
 
788
    The parameters, where they are supported, are the same as
 
789
    dbus.service.method, except there is only "signature", since the
 
790
    type from Get() and the type sent to Set() is the same.
 
791
    """
 
792
    # Encoding deeply encoded byte arrays is not supported yet by the
 
793
    # "Set" method, so we fail early here:
 
794
    if byte_arrays and signature != "ay":
 
795
        raise ValueError("Byte arrays not supported for non-'ay'"
 
796
                         " signature {0!r}".format(signature))
 
797
    def decorator(func):
 
798
        func._dbus_is_property = True
 
799
        func._dbus_interface = dbus_interface
 
800
        func._dbus_signature = signature
 
801
        func._dbus_access = access
 
802
        func._dbus_name = func.__name__
 
803
        if func._dbus_name.endswith("_dbus_property"):
 
804
            func._dbus_name = func._dbus_name[:-14]
 
805
        func._dbus_get_args_options = {'byte_arrays': byte_arrays }
 
806
        return func
 
807
    return decorator
 
808
 
 
809
 
 
810
def dbus_interface_annotations(dbus_interface):
 
811
    """Decorator for marking functions returning interface annotations
 
812
    
 
813
    Usage:
 
814
    
 
815
    @dbus_interface_annotations("org.example.Interface")
 
816
    def _foo(self):  # Function name does not matter
 
817
        return {"org.freedesktop.DBus.Deprecated": "true",
 
818
                "org.freedesktop.DBus.Property.EmitsChangedSignal":
 
819
                    "false"}
 
820
    """
 
821
    def decorator(func):
 
822
        func._dbus_is_interface = True
 
823
        func._dbus_interface = dbus_interface
 
824
        func._dbus_name = dbus_interface
 
825
        return func
 
826
    return decorator
 
827
 
 
828
 
 
829
def dbus_annotations(annotations):
 
830
    """Decorator to annotate D-Bus methods, signals or properties
 
831
    Usage:
 
832
    
 
833
    @dbus_service_property("org.example.Interface", signature="b",
 
834
                           access="r")
 
835
    @dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",
 
836
                        "org.freedesktop.DBus.Property."
 
837
                        "EmitsChangedSignal": "false"})
 
838
    def Property_dbus_property(self):
 
839
        return dbus.Boolean(False)
 
840
    """
 
841
    def decorator(func):
 
842
        func._dbus_annotations = annotations
 
843
        return func
 
844
    return decorator
 
845
 
 
846
 
 
847
class DBusPropertyException(dbus.exceptions.DBusException):
 
848
    """A base class for D-Bus property-related exceptions
 
849
    """
 
850
    def __unicode__(self):
 
851
        return unicode(str(self))
 
852
 
 
853
 
 
854
class DBusPropertyAccessException(DBusPropertyException):
 
855
    """A property's access permissions disallows an operation.
 
856
    """
 
857
    pass
 
858
 
 
859
 
 
860
class DBusPropertyNotFound(DBusPropertyException):
 
861
    """An attempt was made to access a non-existing property.
 
862
    """
 
863
    pass
 
864
 
 
865
 
 
866
class DBusObjectWithProperties(dbus.service.Object):
 
867
    """A D-Bus object with properties.
 
868
    
 
869
    Classes inheriting from this can use the dbus_service_property
 
870
    decorator to expose methods as D-Bus properties.  It exposes the
 
871
    standard Get(), Set(), and GetAll() methods on the D-Bus.
 
872
    """
 
873
    
 
874
    @staticmethod
 
875
    def _is_dbus_thing(thing):
 
876
        """Returns a function testing if an attribute is a D-Bus thing
 
877
        
 
878
        If called like _is_dbus_thing("method") it returns a function
 
879
        suitable for use as predicate to inspect.getmembers().
 
880
        """
 
881
        return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),
 
882
                                   False)
 
883
    
 
884
    def _get_all_dbus_things(self, thing):
 
885
        """Returns a generator of (name, attribute) pairs
 
886
        """
 
887
        return ((getattr(athing.__get__(self), "_dbus_name",
 
888
                         name),
 
889
                 athing.__get__(self))
 
890
                for cls in self.__class__.__mro__
 
891
                for name, athing in
 
892
                inspect.getmembers(cls,
 
893
                                   self._is_dbus_thing(thing)))
 
894
    
 
895
    def _get_dbus_property(self, interface_name, property_name):
 
896
        """Returns a bound method if one exists which is a D-Bus
 
897
        property with the specified name and interface.
 
898
        """
 
899
        for cls in  self.__class__.__mro__:
 
900
            for name, value in (inspect.getmembers
 
901
                                (cls,
 
902
                                 self._is_dbus_thing("property"))):
 
903
                if (value._dbus_name == property_name
 
904
                    and value._dbus_interface == interface_name):
 
905
                    return value.__get__(self)
 
906
        
 
907
        # No such property
 
908
        raise DBusPropertyNotFound(self.dbus_object_path + ":"
 
909
                                   + interface_name + "."
 
910
                                   + property_name)
 
911
    
 
912
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
 
913
                         out_signature="v")
 
914
    def Get(self, interface_name, property_name):
 
915
        """Standard D-Bus property Get() method, see D-Bus standard.
 
916
        """
 
917
        prop = self._get_dbus_property(interface_name, property_name)
 
918
        if prop._dbus_access == "write":
 
919
            raise DBusPropertyAccessException(property_name)
 
920
        value = prop()
 
921
        if not hasattr(value, "variant_level"):
 
922
            return value
 
923
        return type(value)(value, variant_level=value.variant_level+1)
 
924
    
 
925
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
 
926
    def Set(self, interface_name, property_name, value):
 
927
        """Standard D-Bus property Set() method, see D-Bus standard.
 
928
        """
 
929
        prop = self._get_dbus_property(interface_name, property_name)
 
930
        if prop._dbus_access == "read":
 
931
            raise DBusPropertyAccessException(property_name)
 
932
        if prop._dbus_get_args_options["byte_arrays"]:
 
933
            # The byte_arrays option is not supported yet on
 
934
            # signatures other than "ay".
 
935
            if prop._dbus_signature != "ay":
 
936
                raise ValueError
 
937
            value = dbus.ByteArray(b''.join(chr(byte)
 
938
                                            for byte in value))
 
939
        prop(value)
 
940
    
 
941
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
 
942
                         out_signature="a{sv}")
 
943
    def GetAll(self, interface_name):
 
944
        """Standard D-Bus property GetAll() method, see D-Bus
 
945
        standard.
 
946
        
 
947
        Note: Will not include properties with access="write".
 
948
        """
 
949
        properties = {}
 
950
        for name, prop in self._get_all_dbus_things("property"):
 
951
            if (interface_name
 
952
                and interface_name != prop._dbus_interface):
 
953
                # Interface non-empty but did not match
 
954
                continue
 
955
            # Ignore write-only properties
 
956
            if prop._dbus_access == "write":
 
957
                continue
 
958
            value = prop()
 
959
            if not hasattr(value, "variant_level"):
 
960
                properties[name] = value
 
961
                continue
 
962
            properties[name] = type(value)(value, variant_level=
 
963
                                           value.variant_level+1)
 
964
        return dbus.Dictionary(properties, signature="sv")
 
965
    
 
966
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
 
967
                         out_signature="s",
 
968
                         path_keyword='object_path',
 
969
                         connection_keyword='connection')
 
970
    def Introspect(self, object_path, connection):
 
971
        """Overloading of standard D-Bus method.
 
972
        
 
973
        Inserts property tags and interface annotation tags.
 
974
        """
 
975
        xmlstring = dbus.service.Object.Introspect(self, object_path,
 
976
                                                   connection)
 
977
        try:
 
978
            document = xml.dom.minidom.parseString(xmlstring)
 
979
            def make_tag(document, name, prop):
 
980
                e = document.createElement("property")
 
981
                e.setAttribute("name", name)
 
982
                e.setAttribute("type", prop._dbus_signature)
 
983
                e.setAttribute("access", prop._dbus_access)
 
984
                return e
 
985
            for if_tag in document.getElementsByTagName("interface"):
 
986
                # Add property tags
 
987
                for tag in (make_tag(document, name, prop)
 
988
                            for name, prop
 
989
                            in self._get_all_dbus_things("property")
 
990
                            if prop._dbus_interface
 
991
                            == if_tag.getAttribute("name")):
 
992
                    if_tag.appendChild(tag)
 
993
                # Add annotation tags
 
994
                for typ in ("method", "signal", "property"):
 
995
                    for tag in if_tag.getElementsByTagName(typ):
 
996
                        annots = dict()
 
997
                        for name, prop in (self.
 
998
                                           _get_all_dbus_things(typ)):
 
999
                            if (name == tag.getAttribute("name")
 
1000
                                and prop._dbus_interface
 
1001
                                == if_tag.getAttribute("name")):
 
1002
                                annots.update(getattr
 
1003
                                              (prop,
 
1004
                                               "_dbus_annotations",
 
1005
                                               {}))
 
1006
                        for name, value in annots.iteritems():
 
1007
                            ann_tag = document.createElement(
 
1008
                                "annotation")
 
1009
                            ann_tag.setAttribute("name", name)
 
1010
                            ann_tag.setAttribute("value", value)
 
1011
                            tag.appendChild(ann_tag)
 
1012
                # Add interface annotation tags
 
1013
                for annotation, value in dict(
 
1014
                    itertools.chain.from_iterable(
 
1015
                        annotations().iteritems()
 
1016
                        for name, annotations in
 
1017
                        self._get_all_dbus_things("interface")
 
1018
                        if name == if_tag.getAttribute("name")
 
1019
                        )).iteritems():
 
1020
                    ann_tag = document.createElement("annotation")
 
1021
                    ann_tag.setAttribute("name", annotation)
 
1022
                    ann_tag.setAttribute("value", value)
 
1023
                    if_tag.appendChild(ann_tag)
 
1024
                # Add the names to the return values for the
 
1025
                # "org.freedesktop.DBus.Properties" methods
 
1026
                if (if_tag.getAttribute("name")
 
1027
                    == "org.freedesktop.DBus.Properties"):
 
1028
                    for cn in if_tag.getElementsByTagName("method"):
 
1029
                        if cn.getAttribute("name") == "Get":
 
1030
                            for arg in cn.getElementsByTagName("arg"):
 
1031
                                if (arg.getAttribute("direction")
 
1032
                                    == "out"):
 
1033
                                    arg.setAttribute("name", "value")
 
1034
                        elif cn.getAttribute("name") == "GetAll":
 
1035
                            for arg in cn.getElementsByTagName("arg"):
 
1036
                                if (arg.getAttribute("direction")
 
1037
                                    == "out"):
 
1038
                                    arg.setAttribute("name", "props")
 
1039
            xmlstring = document.toxml("utf-8")
 
1040
            document.unlink()
 
1041
        except (AttributeError, xml.dom.DOMException,
 
1042
                xml.parsers.expat.ExpatError) as error:
 
1043
            logger.error("Failed to override Introspection method",
 
1044
                         exc_info=error)
 
1045
        return xmlstring
 
1046
 
 
1047
 
 
1048
def datetime_to_dbus(dt, variant_level=0):
 
1049
    """Convert a UTC datetime.datetime() to a D-Bus type."""
 
1050
    if dt is None:
 
1051
        return dbus.String("", variant_level = variant_level)
 
1052
    return dbus.String(dt.isoformat(),
 
1053
                       variant_level=variant_level)
 
1054
 
 
1055
 
 
1056
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
 
1057
    """A class decorator; applied to a subclass of
 
1058
    dbus.service.Object, it will add alternate D-Bus attributes with
 
1059
    interface names according to the "alt_interface_names" mapping.
 
1060
    Usage:
 
1061
    
 
1062
    @alternate_dbus_interfaces({"org.example.Interface":
 
1063
                                    "net.example.AlternateInterface"})
 
1064
    class SampleDBusObject(dbus.service.Object):
 
1065
        @dbus.service.method("org.example.Interface")
 
1066
        def SampleDBusMethod():
 
1067
            pass
 
1068
    
 
1069
    The above "SampleDBusMethod" on "SampleDBusObject" will be
 
1070
    reachable via two interfaces: "org.example.Interface" and
 
1071
    "net.example.AlternateInterface", the latter of which will have
 
1072
    its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
 
1073
    "true", unless "deprecate" is passed with a False value.
 
1074
    
 
1075
    This works for methods and signals, and also for D-Bus properties
 
1076
    (from DBusObjectWithProperties) and interfaces (from the
 
1077
    dbus_interface_annotations decorator).
 
1078
    """
 
1079
    def wrapper(cls):
 
1080
        for orig_interface_name, alt_interface_name in (
 
1081
            alt_interface_names.iteritems()):
 
1082
            attr = {}
 
1083
            interface_names = set()
 
1084
            # Go though all attributes of the class
 
1085
            for attrname, attribute in inspect.getmembers(cls):
 
1086
                # Ignore non-D-Bus attributes, and D-Bus attributes
 
1087
                # with the wrong interface name
 
1088
                if (not hasattr(attribute, "_dbus_interface")
 
1089
                    or not attribute._dbus_interface
 
1090
                    .startswith(orig_interface_name)):
 
1091
                    continue
 
1092
                # Create an alternate D-Bus interface name based on
 
1093
                # the current name
 
1094
                alt_interface = (attribute._dbus_interface
 
1095
                                 .replace(orig_interface_name,
 
1096
                                          alt_interface_name))
 
1097
                interface_names.add(alt_interface)
 
1098
                # Is this a D-Bus signal?
 
1099
                if getattr(attribute, "_dbus_is_signal", False):
 
1100
                    # Extract the original non-method undecorated
 
1101
                    # function by black magic
 
1102
                    nonmethod_func = (dict(
 
1103
                            zip(attribute.func_code.co_freevars,
 
1104
                                attribute.__closure__))["func"]
 
1105
                                      .cell_contents)
 
1106
                    # Create a new, but exactly alike, function
 
1107
                    # object, and decorate it to be a new D-Bus signal
 
1108
                    # with the alternate D-Bus interface name
 
1109
                    new_function = (dbus.service.signal
 
1110
                                    (alt_interface,
 
1111
                                     attribute._dbus_signature)
 
1112
                                    (types.FunctionType(
 
1113
                                nonmethod_func.func_code,
 
1114
                                nonmethod_func.func_globals,
 
1115
                                nonmethod_func.func_name,
 
1116
                                nonmethod_func.func_defaults,
 
1117
                                nonmethod_func.func_closure)))
 
1118
                    # Copy annotations, if any
 
1119
                    try:
 
1120
                        new_function._dbus_annotations = (
 
1121
                            dict(attribute._dbus_annotations))
 
1122
                    except AttributeError:
 
1123
                        pass
 
1124
                    # Define a creator of a function to call both the
 
1125
                    # original and alternate functions, so both the
 
1126
                    # original and alternate signals gets sent when
 
1127
                    # the function is called
 
1128
                    def fixscope(func1, func2):
 
1129
                        """This function is a scope container to pass
 
1130
                        func1 and func2 to the "call_both" function
 
1131
                        outside of its arguments"""
 
1132
                        def call_both(*args, **kwargs):
 
1133
                            """This function will emit two D-Bus
 
1134
                            signals by calling func1 and func2"""
 
1135
                            func1(*args, **kwargs)
 
1136
                            func2(*args, **kwargs)
 
1137
                        return call_both
 
1138
                    # Create the "call_both" function and add it to
 
1139
                    # the class
 
1140
                    attr[attrname] = fixscope(attribute, new_function)
 
1141
                # Is this a D-Bus method?
 
1142
                elif getattr(attribute, "_dbus_is_method", False):
 
1143
                    # Create a new, but exactly alike, function
 
1144
                    # object.  Decorate it to be a new D-Bus method
 
1145
                    # with the alternate D-Bus interface name.  Add it
 
1146
                    # to the class.
 
1147
                    attr[attrname] = (dbus.service.method
 
1148
                                      (alt_interface,
 
1149
                                       attribute._dbus_in_signature,
 
1150
                                       attribute._dbus_out_signature)
 
1151
                                      (types.FunctionType
 
1152
                                       (attribute.func_code,
 
1153
                                        attribute.func_globals,
 
1154
                                        attribute.func_name,
 
1155
                                        attribute.func_defaults,
 
1156
                                        attribute.func_closure)))
 
1157
                    # Copy annotations, if any
 
1158
                    try:
 
1159
                        attr[attrname]._dbus_annotations = (
 
1160
                            dict(attribute._dbus_annotations))
 
1161
                    except AttributeError:
 
1162
                        pass
 
1163
                # Is this a D-Bus property?
 
1164
                elif getattr(attribute, "_dbus_is_property", False):
 
1165
                    # Create a new, but exactly alike, function
 
1166
                    # object, and decorate it to be a new D-Bus
 
1167
                    # property with the alternate D-Bus interface
 
1168
                    # name.  Add it to the class.
 
1169
                    attr[attrname] = (dbus_service_property
 
1170
                                      (alt_interface,
 
1171
                                       attribute._dbus_signature,
 
1172
                                       attribute._dbus_access,
 
1173
                                       attribute
 
1174
                                       ._dbus_get_args_options
 
1175
                                       ["byte_arrays"])
 
1176
                                      (types.FunctionType
 
1177
                                       (attribute.func_code,
 
1178
                                        attribute.func_globals,
 
1179
                                        attribute.func_name,
 
1180
                                        attribute.func_defaults,
 
1181
                                        attribute.func_closure)))
 
1182
                    # Copy annotations, if any
 
1183
                    try:
 
1184
                        attr[attrname]._dbus_annotations = (
 
1185
                            dict(attribute._dbus_annotations))
 
1186
                    except AttributeError:
 
1187
                        pass
 
1188
                # Is this a D-Bus interface?
 
1189
                elif getattr(attribute, "_dbus_is_interface", False):
 
1190
                    # Create a new, but exactly alike, function
 
1191
                    # object.  Decorate it to be a new D-Bus interface
 
1192
                    # with the alternate D-Bus interface name.  Add it
 
1193
                    # to the class.
 
1194
                    attr[attrname] = (dbus_interface_annotations
 
1195
                                      (alt_interface)
 
1196
                                      (types.FunctionType
 
1197
                                       (attribute.func_code,
 
1198
                                        attribute.func_globals,
 
1199
                                        attribute.func_name,
 
1200
                                        attribute.func_defaults,
 
1201
                                        attribute.func_closure)))
 
1202
            if deprecate:
 
1203
                # Deprecate all alternate interfaces
 
1204
                iname="_AlternateDBusNames_interface_annotation{0}"
 
1205
                for interface_name in interface_names:
 
1206
                    @dbus_interface_annotations(interface_name)
 
1207
                    def func(self):
 
1208
                        return { "org.freedesktop.DBus.Deprecated":
 
1209
                                     "true" }
 
1210
                    # Find an unused name
 
1211
                    for aname in (iname.format(i)
 
1212
                                  for i in itertools.count()):
 
1213
                        if aname not in attr:
 
1214
                            attr[aname] = func
 
1215
                            break
 
1216
            if interface_names:
 
1217
                # Replace the class with a new subclass of it with
 
1218
                # methods, signals, etc. as created above.
 
1219
                cls = type(b"{0}Alternate".format(cls.__name__),
 
1220
                           (cls,), attr)
 
1221
        return cls
 
1222
    return wrapper
 
1223
 
 
1224
 
 
1225
@alternate_dbus_interfaces({"se.recompile.Mandos":
 
1226
                                "se.bsnet.fukt.Mandos"})
 
1227
class ClientDBus(Client, DBusObjectWithProperties):
 
1228
    """A Client class using D-Bus
 
1229
    
 
1230
    Attributes:
 
1231
    dbus_object_path: dbus.ObjectPath
 
1232
    bus: dbus.SystemBus()
 
1233
    """
 
1234
    
 
1235
    runtime_expansions = (Client.runtime_expansions
 
1236
                          + ("dbus_object_path",))
 
1237
    
 
1238
    # dbus.service.Object doesn't use super(), so we can't either.
 
1239
    
 
1240
    def __init__(self, bus = None, *args, **kwargs):
 
1241
        self.bus = bus
 
1242
        Client.__init__(self, *args, **kwargs)
 
1243
        # Only now, when this client is initialized, can it show up on
 
1244
        # the D-Bus
 
1245
        client_object_name = unicode(self.name).translate(
 
1246
            {ord("."): ord("_"),
 
1247
             ord("-"): ord("_")})
 
1248
        self.dbus_object_path = (dbus.ObjectPath
 
1249
                                 ("/clients/" + client_object_name))
 
1250
        DBusObjectWithProperties.__init__(self, self.bus,
 
1251
                                          self.dbus_object_path)
 
1252
    
 
1253
    def notifychangeproperty(transform_func,
 
1254
                             dbus_name, type_func=lambda x: x,
 
1255
                             variant_level=1):
 
1256
        """ Modify a variable so that it's a property which announces
 
1257
        its changes to DBus.
 
1258
        
 
1259
        transform_fun: Function that takes a value and a variant_level
 
1260
                       and transforms it to a D-Bus type.
 
1261
        dbus_name: D-Bus name of the variable
 
1262
        type_func: Function that transform the value before sending it
 
1263
                   to the D-Bus.  Default: no transform
 
1264
        variant_level: D-Bus variant level.  Default: 1
 
1265
        """
 
1266
        attrname = "_{0}".format(dbus_name)
 
1267
        def setter(self, value):
 
1268
            if hasattr(self, "dbus_object_path"):
 
1269
                if (not hasattr(self, attrname) or
 
1270
                    type_func(getattr(self, attrname, None))
 
1271
                    != type_func(value)):
 
1272
                    dbus_value = transform_func(type_func(value),
 
1273
                                                variant_level
 
1274
                                                =variant_level)
 
1275
                    self.PropertyChanged(dbus.String(dbus_name),
 
1276
                                         dbus_value)
 
1277
            setattr(self, attrname, value)
 
1278
        
 
1279
        return property(lambda self: getattr(self, attrname), setter)
 
1280
    
 
1281
    expires = notifychangeproperty(datetime_to_dbus, "Expires")
 
1282
    approvals_pending = notifychangeproperty(dbus.Boolean,
 
1283
                                             "ApprovalPending",
 
1284
                                             type_func = bool)
 
1285
    enabled = notifychangeproperty(dbus.Boolean, "Enabled")
 
1286
    last_enabled = notifychangeproperty(datetime_to_dbus,
 
1287
                                        "LastEnabled")
 
1288
    checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",
 
1289
                                   type_func = lambda checker:
 
1290
                                       checker is not None)
 
1291
    last_checked_ok = notifychangeproperty(datetime_to_dbus,
 
1292
                                           "LastCheckedOK")
 
1293
    last_checker_status = notifychangeproperty(dbus.Int16,
 
1294
                                               "LastCheckerStatus")
 
1295
    last_approval_request = notifychangeproperty(
 
1296
        datetime_to_dbus, "LastApprovalRequest")
 
1297
    approved_by_default = notifychangeproperty(dbus.Boolean,
 
1298
                                               "ApprovedByDefault")
 
1299
    approval_delay = notifychangeproperty(dbus.UInt64,
 
1300
                                          "ApprovalDelay",
 
1301
                                          type_func =
 
1302
                                          timedelta_to_milliseconds)
 
1303
    approval_duration = notifychangeproperty(
 
1304
        dbus.UInt64, "ApprovalDuration",
 
1305
        type_func = timedelta_to_milliseconds)
 
1306
    host = notifychangeproperty(dbus.String, "Host")
 
1307
    timeout = notifychangeproperty(dbus.UInt64, "Timeout",
 
1308
                                   type_func =
 
1309
                                   timedelta_to_milliseconds)
 
1310
    extended_timeout = notifychangeproperty(
 
1311
        dbus.UInt64, "ExtendedTimeout",
 
1312
        type_func = timedelta_to_milliseconds)
 
1313
    interval = notifychangeproperty(dbus.UInt64,
 
1314
                                    "Interval",
 
1315
                                    type_func =
 
1316
                                    timedelta_to_milliseconds)
 
1317
    checker_command = notifychangeproperty(dbus.String, "Checker")
 
1318
    
 
1319
    del notifychangeproperty
 
1320
    
 
1321
    def __del__(self, *args, **kwargs):
 
1322
        try:
 
1323
            self.remove_from_connection()
 
1324
        except LookupError:
 
1325
            pass
 
1326
        if hasattr(DBusObjectWithProperties, "__del__"):
 
1327
            DBusObjectWithProperties.__del__(self, *args, **kwargs)
 
1328
        Client.__del__(self, *args, **kwargs)
 
1329
    
 
1330
    def checker_callback(self, pid, condition, command,
 
1331
                         *args, **kwargs):
 
1332
        self.checker_callback_tag = None
 
1333
        self.checker = None
 
1334
        if os.WIFEXITED(condition):
 
1335
            exitstatus = os.WEXITSTATUS(condition)
 
1336
            # Emit D-Bus signal
 
1337
            self.CheckerCompleted(dbus.Int16(exitstatus),
 
1338
                                  dbus.Int64(condition),
 
1339
                                  dbus.String(command))
 
1340
        else:
 
1341
            # Emit D-Bus signal
 
1342
            self.CheckerCompleted(dbus.Int16(-1),
 
1343
                                  dbus.Int64(condition),
 
1344
                                  dbus.String(command))
 
1345
        
 
1346
        return Client.checker_callback(self, pid, condition, command,
 
1347
                                       *args, **kwargs)
 
1348
    
 
1349
    def start_checker(self, *args, **kwargs):
 
1350
        old_checker = self.checker
 
1351
        if self.checker is not None:
 
1352
            old_checker_pid = self.checker.pid
 
1353
        else:
 
1354
            old_checker_pid = None
 
1355
        r = Client.start_checker(self, *args, **kwargs)
 
1356
        # Only if new checker process was started
 
1357
        if (self.checker is not None
 
1358
            and old_checker_pid != self.checker.pid):
 
1359
            # Emit D-Bus signal
 
1360
            self.CheckerStarted(self.current_checker_command)
 
1361
        return r
 
1362
    
 
1363
    def _reset_approved(self):
 
1364
        self.approved = None
 
1365
        return False
 
1366
    
 
1367
    def approve(self, value=True):
 
1368
        self.approved = value
 
1369
        gobject.timeout_add(timedelta_to_milliseconds
 
1370
                            (self.approval_duration),
 
1371
                            self._reset_approved)
 
1372
        self.send_changedstate()
 
1373
    
 
1374
    ## D-Bus methods, signals & properties
 
1375
    _interface = "se.recompile.Mandos.Client"
 
1376
    
 
1377
    ## Interfaces
 
1378
    
 
1379
    @dbus_interface_annotations(_interface)
 
1380
    def _foo(self):
 
1381
        return { "org.freedesktop.DBus.Property.EmitsChangedSignal":
 
1382
                     "false"}
 
1383
    
 
1384
    ## Signals
 
1385
    
 
1386
    # CheckerCompleted - signal
 
1387
    @dbus.service.signal(_interface, signature="nxs")
 
1388
    def CheckerCompleted(self, exitcode, waitstatus, command):
 
1389
        "D-Bus signal"
 
1390
        pass
 
1391
    
 
1392
    # CheckerStarted - signal
 
1393
    @dbus.service.signal(_interface, signature="s")
 
1394
    def CheckerStarted(self, command):
 
1395
        "D-Bus signal"
 
1396
        pass
 
1397
    
 
1398
    # PropertyChanged - signal
 
1399
    @dbus.service.signal(_interface, signature="sv")
 
1400
    def PropertyChanged(self, property, value):
 
1401
        "D-Bus signal"
 
1402
        pass
 
1403
    
 
1404
    # GotSecret - signal
 
1405
    @dbus.service.signal(_interface)
 
1406
    def GotSecret(self):
 
1407
        """D-Bus signal
 
1408
        Is sent after a successful transfer of secret from the Mandos
 
1409
        server to mandos-client
 
1410
        """
 
1411
        pass
 
1412
    
 
1413
    # Rejected - signal
 
1414
    @dbus.service.signal(_interface, signature="s")
 
1415
    def Rejected(self, reason):
 
1416
        "D-Bus signal"
 
1417
        pass
 
1418
    
 
1419
    # NeedApproval - signal
 
1420
    @dbus.service.signal(_interface, signature="tb")
 
1421
    def NeedApproval(self, timeout, default):
 
1422
        "D-Bus signal"
 
1423
        return self.need_approval()
 
1424
    
 
1425
    ## Methods
 
1426
    
 
1427
    # Approve - method
 
1428
    @dbus.service.method(_interface, in_signature="b")
 
1429
    def Approve(self, value):
 
1430
        self.approve(value)
 
1431
    
 
1432
    # CheckedOK - method
 
1433
    @dbus.service.method(_interface)
 
1434
    def CheckedOK(self):
 
1435
        self.checked_ok()
 
1436
    
 
1437
    # Enable - method
 
1438
    @dbus.service.method(_interface)
 
1439
    def Enable(self):
 
1440
        "D-Bus method"
 
1441
        self.enable()
 
1442
    
 
1443
    # StartChecker - method
 
1444
    @dbus.service.method(_interface)
 
1445
    def StartChecker(self):
 
1446
        "D-Bus method"
 
1447
        self.start_checker()
 
1448
    
 
1449
    # Disable - method
 
1450
    @dbus.service.method(_interface)
 
1451
    def Disable(self):
 
1452
        "D-Bus method"
 
1453
        self.disable()
 
1454
    
 
1455
    # StopChecker - method
 
1456
    @dbus.service.method(_interface)
 
1457
    def StopChecker(self):
 
1458
        self.stop_checker()
 
1459
    
 
1460
    ## Properties
 
1461
    
 
1462
    # ApprovalPending - property
 
1463
    @dbus_service_property(_interface, signature="b", access="read")
 
1464
    def ApprovalPending_dbus_property(self):
 
1465
        return dbus.Boolean(bool(self.approvals_pending))
 
1466
    
 
1467
    # ApprovedByDefault - property
 
1468
    @dbus_service_property(_interface, signature="b",
 
1469
                           access="readwrite")
 
1470
    def ApprovedByDefault_dbus_property(self, value=None):
 
1471
        if value is None:       # get
 
1472
            return dbus.Boolean(self.approved_by_default)
 
1473
        self.approved_by_default = bool(value)
 
1474
    
 
1475
    # ApprovalDelay - property
 
1476
    @dbus_service_property(_interface, signature="t",
 
1477
                           access="readwrite")
 
1478
    def ApprovalDelay_dbus_property(self, value=None):
 
1479
        if value is None:       # get
 
1480
            return dbus.UInt64(self.approval_delay_milliseconds())
 
1481
        self.approval_delay = datetime.timedelta(0, 0, 0, value)
 
1482
    
 
1483
    # ApprovalDuration - property
 
1484
    @dbus_service_property(_interface, signature="t",
 
1485
                           access="readwrite")
 
1486
    def ApprovalDuration_dbus_property(self, value=None):
 
1487
        if value is None:       # get
 
1488
            return dbus.UInt64(timedelta_to_milliseconds(
 
1489
                    self.approval_duration))
 
1490
        self.approval_duration = datetime.timedelta(0, 0, 0, value)
 
1491
    
 
1492
    # Name - property
 
1493
    @dbus_service_property(_interface, signature="s", access="read")
 
1494
    def Name_dbus_property(self):
 
1495
        return dbus.String(self.name)
 
1496
    
 
1497
    # Fingerprint - property
 
1498
    @dbus_service_property(_interface, signature="s", access="read")
 
1499
    def Fingerprint_dbus_property(self):
 
1500
        return dbus.String(self.fingerprint)
 
1501
    
 
1502
    # Host - property
 
1503
    @dbus_service_property(_interface, signature="s",
 
1504
                           access="readwrite")
 
1505
    def Host_dbus_property(self, value=None):
 
1506
        if value is None:       # get
 
1507
            return dbus.String(self.host)
 
1508
        self.host = unicode(value)
 
1509
    
 
1510
    # Created - property
 
1511
    @dbus_service_property(_interface, signature="s", access="read")
 
1512
    def Created_dbus_property(self):
 
1513
        return datetime_to_dbus(self.created)
 
1514
    
 
1515
    # LastEnabled - property
 
1516
    @dbus_service_property(_interface, signature="s", access="read")
 
1517
    def LastEnabled_dbus_property(self):
 
1518
        return datetime_to_dbus(self.last_enabled)
 
1519
    
 
1520
    # Enabled - property
 
1521
    @dbus_service_property(_interface, signature="b",
 
1522
                           access="readwrite")
 
1523
    def Enabled_dbus_property(self, value=None):
 
1524
        if value is None:       # get
 
1525
            return dbus.Boolean(self.enabled)
 
1526
        if value:
 
1527
            self.enable()
 
1528
        else:
 
1529
            self.disable()
 
1530
    
 
1531
    # LastCheckedOK - property
 
1532
    @dbus_service_property(_interface, signature="s",
 
1533
                           access="readwrite")
 
1534
    def LastCheckedOK_dbus_property(self, value=None):
 
1535
        if value is not None:
 
1536
            self.checked_ok()
 
1537
            return
 
1538
        return datetime_to_dbus(self.last_checked_ok)
 
1539
    
 
1540
    # LastCheckerStatus - property
 
1541
    @dbus_service_property(_interface, signature="n",
 
1542
                           access="read")
 
1543
    def LastCheckerStatus_dbus_property(self):
 
1544
        return dbus.Int16(self.last_checker_status)
 
1545
    
 
1546
    # Expires - property
 
1547
    @dbus_service_property(_interface, signature="s", access="read")
 
1548
    def Expires_dbus_property(self):
 
1549
        return datetime_to_dbus(self.expires)
 
1550
    
 
1551
    # LastApprovalRequest - property
 
1552
    @dbus_service_property(_interface, signature="s", access="read")
 
1553
    def LastApprovalRequest_dbus_property(self):
 
1554
        return datetime_to_dbus(self.last_approval_request)
 
1555
    
 
1556
    # Timeout - property
 
1557
    @dbus_service_property(_interface, signature="t",
 
1558
                           access="readwrite")
 
1559
    def Timeout_dbus_property(self, value=None):
 
1560
        if value is None:       # get
 
1561
            return dbus.UInt64(self.timeout_milliseconds())
 
1562
        old_timeout = self.timeout
 
1563
        self.timeout = datetime.timedelta(0, 0, 0, value)
 
1564
        # Reschedule disabling
 
1565
        if self.enabled:
 
1566
            now = datetime.datetime.utcnow()
 
1567
            self.expires += self.timeout - old_timeout
 
1568
            if self.expires <= now:
 
1569
                # The timeout has passed
 
1570
                self.disable()
 
1571
            else:
 
1572
                if (getattr(self, "disable_initiator_tag", None)
 
1573
                    is None):
 
1574
                    return
 
1575
                gobject.source_remove(self.disable_initiator_tag)
 
1576
                self.disable_initiator_tag = (
 
1577
                    gobject.timeout_add(
 
1578
                        timedelta_to_milliseconds(self.expires - now),
 
1579
                        self.disable))
 
1580
    
 
1581
    # ExtendedTimeout - property
 
1582
    @dbus_service_property(_interface, signature="t",
 
1583
                           access="readwrite")
 
1584
    def ExtendedTimeout_dbus_property(self, value=None):
 
1585
        if value is None:       # get
 
1586
            return dbus.UInt64(self.extended_timeout_milliseconds())
 
1587
        self.extended_timeout = datetime.timedelta(0, 0, 0, value)
 
1588
    
 
1589
    # Interval - property
 
1590
    @dbus_service_property(_interface, signature="t",
 
1591
                           access="readwrite")
 
1592
    def Interval_dbus_property(self, value=None):
 
1593
        if value is None:       # get
 
1594
            return dbus.UInt64(self.interval_milliseconds())
 
1595
        self.interval = datetime.timedelta(0, 0, 0, value)
 
1596
        if getattr(self, "checker_initiator_tag", None) is None:
 
1597
            return
 
1598
        if self.enabled:
 
1599
            # Reschedule checker run
 
1600
            gobject.source_remove(self.checker_initiator_tag)
 
1601
            self.checker_initiator_tag = (gobject.timeout_add
 
1602
                                          (value, self.start_checker))
 
1603
            self.start_checker()    # Start one now, too
 
1604
    
 
1605
    # Checker - property
 
1606
    @dbus_service_property(_interface, signature="s",
 
1607
                           access="readwrite")
 
1608
    def Checker_dbus_property(self, value=None):
 
1609
        if value is None:       # get
 
1610
            return dbus.String(self.checker_command)
 
1611
        self.checker_command = unicode(value)
 
1612
    
 
1613
    # CheckerRunning - property
 
1614
    @dbus_service_property(_interface, signature="b",
 
1615
                           access="readwrite")
 
1616
    def CheckerRunning_dbus_property(self, value=None):
 
1617
        if value is None:       # get
 
1618
            return dbus.Boolean(self.checker is not None)
 
1619
        if value:
 
1620
            self.start_checker()
 
1621
        else:
 
1622
            self.stop_checker()
 
1623
    
 
1624
    # ObjectPath - property
 
1625
    @dbus_service_property(_interface, signature="o", access="read")
 
1626
    def ObjectPath_dbus_property(self):
 
1627
        return self.dbus_object_path # is already a dbus.ObjectPath
 
1628
    
 
1629
    # Secret = property
 
1630
    @dbus_service_property(_interface, signature="ay",
 
1631
                           access="write", byte_arrays=True)
 
1632
    def Secret_dbus_property(self, value):
 
1633
        self.secret = str(value)
 
1634
    
 
1635
    del _interface
 
1636
 
 
1637
 
 
1638
class ProxyClient(object):
 
1639
    def __init__(self, child_pipe, fpr, address):
 
1640
        self._pipe = child_pipe
 
1641
        self._pipe.send(('init', fpr, address))
 
1642
        if not self._pipe.recv():
 
1643
            raise KeyError()
 
1644
    
 
1645
    def __getattribute__(self, name):
 
1646
        if name == '_pipe':
 
1647
            return super(ProxyClient, self).__getattribute__(name)
 
1648
        self._pipe.send(('getattr', name))
 
1649
        data = self._pipe.recv()
 
1650
        if data[0] == 'data':
 
1651
            return data[1]
 
1652
        if data[0] == 'function':
 
1653
            def func(*args, **kwargs):
 
1654
                self._pipe.send(('funcall', name, args, kwargs))
 
1655
                return self._pipe.recv()[1]
 
1656
            return func
 
1657
    
 
1658
    def __setattr__(self, name, value):
 
1659
        if name == '_pipe':
 
1660
            return super(ProxyClient, self).__setattr__(name, value)
 
1661
        self._pipe.send(('setattr', name, value))
 
1662
 
 
1663
 
 
1664
class ClientHandler(socketserver.BaseRequestHandler, object):
 
1665
    """A class to handle client connections.
 
1666
    
 
1667
    Instantiated once for each connection to handle it.
426
1668
    Note: This will run in its own forked process."""
427
1669
    
428
1670
    def handle(self):
429
 
        logger.info(u"TCP connection from: %s",
430
 
                     unicode(self.client_address))
431
 
        session = gnutls.connection.ClientSession\
432
 
                  (self.request, gnutls.connection.X509Credentials())
433
 
        
434
 
        line = self.request.makefile().readline()
435
 
        logger.debug(u"Protocol version: %r", line)
436
 
        try:
437
 
            if int(line.strip().split()[0]) > 1:
438
 
                raise RuntimeError
439
 
        except (ValueError, IndexError, RuntimeError), error:
440
 
            logger.error(u"Unknown protocol version: %s", error)
441
 
            return
442
 
        
443
 
        # Note: gnutls.connection.X509Credentials is really a generic
444
 
        # GnuTLS certificate credentials object so long as no X.509
445
 
        # keys are added to it.  Therefore, we can use it here despite
446
 
        # using OpenPGP certificates.
447
 
        
448
 
        #priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
449
 
        #                "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
450
 
        #                "+DHE-DSS"))
451
 
        priority = "NORMAL"             # Fallback default, since this
452
 
                                        # MUST be set.
453
 
        if self.server.settings["priority"]:
454
 
            priority = self.server.settings["priority"]
455
 
        gnutls.library.functions.gnutls_priority_set_direct\
456
 
            (session._c_object, priority, None);
457
 
        
458
 
        try:
459
 
            session.handshake()
460
 
        except gnutls.errors.GNUTLSError, error:
461
 
            logger.warning(u"Handshake failed: %s", error)
462
 
            # Do not run session.bye() here: the session is not
463
 
            # established.  Just abandon the request.
464
 
            return
465
 
        try:
466
 
            fpr = fingerprint(peer_certificate(session))
467
 
        except (TypeError, gnutls.errors.GNUTLSError), error:
468
 
            logger.warning(u"Bad certificate: %s", error)
469
 
            session.bye()
470
 
            return
471
 
        logger.debug(u"Fingerprint: %s", fpr)
472
 
        client = None
473
 
        for c in self.server.clients:
474
 
            if c.fingerprint == fpr:
475
 
                client = c
476
 
                break
477
 
        if not client:
478
 
            logger.warning(u"Client not found for fingerprint: %s",
479
 
                           fpr)
480
 
            session.bye()
481
 
            return
482
 
        # Have to check if client.still_valid(), since it is possible
483
 
        # that the client timed out while establishing the GnuTLS
484
 
        # session.
485
 
        if not client.still_valid():
486
 
            logger.warning(u"Client %(name)s is invalid",
487
 
                           vars(client))
488
 
            session.bye()
489
 
            return
490
 
        sent_size = 0
491
 
        while sent_size < len(client.secret):
492
 
            sent = session.send(client.secret[sent_size:])
493
 
            logger.debug(u"Sent: %d, remaining: %d",
494
 
                         sent, len(client.secret)
495
 
                         - (sent_size + sent))
496
 
            sent_size += sent
497
 
        session.bye()
498
 
 
499
 
 
500
 
class IPv6_TCPServer(SocketServer.ForkingTCPServer, object):
501
 
    """IPv6 TCP server.  Accepts 'None' as address and/or port.
 
1671
        with contextlib.closing(self.server.child_pipe) as child_pipe:
 
1672
            logger.info("TCP connection from: %s",
 
1673
                        unicode(self.client_address))
 
1674
            logger.debug("Pipe FD: %d",
 
1675
                         self.server.child_pipe.fileno())
 
1676
            
 
1677
            session = (gnutls.connection
 
1678
                       .ClientSession(self.request,
 
1679
                                      gnutls.connection
 
1680
                                      .X509Credentials()))
 
1681
            
 
1682
            # Note: gnutls.connection.X509Credentials is really a
 
1683
            # generic GnuTLS certificate credentials object so long as
 
1684
            # no X.509 keys are added to it.  Therefore, we can use it
 
1685
            # here despite using OpenPGP certificates.
 
1686
            
 
1687
            #priority = ':'.join(("NONE", "+VERS-TLS1.1",
 
1688
            #                      "+AES-256-CBC", "+SHA1",
 
1689
            #                      "+COMP-NULL", "+CTYPE-OPENPGP",
 
1690
            #                      "+DHE-DSS"))
 
1691
            # Use a fallback default, since this MUST be set.
 
1692
            priority = self.server.gnutls_priority
 
1693
            if priority is None:
 
1694
                priority = "NORMAL"
 
1695
            (gnutls.library.functions
 
1696
             .gnutls_priority_set_direct(session._c_object,
 
1697
                                         priority, None))
 
1698
            
 
1699
            # Start communication using the Mandos protocol
 
1700
            # Get protocol number
 
1701
            line = self.request.makefile().readline()
 
1702
            logger.debug("Protocol version: %r", line)
 
1703
            try:
 
1704
                if int(line.strip().split()[0]) > 1:
 
1705
                    raise RuntimeError
 
1706
            except (ValueError, IndexError, RuntimeError) as error:
 
1707
                logger.error("Unknown protocol version: %s", error)
 
1708
                return
 
1709
            
 
1710
            # Start GnuTLS connection
 
1711
            try:
 
1712
                session.handshake()
 
1713
            except gnutls.errors.GNUTLSError as error:
 
1714
                logger.warning("Handshake failed: %s", error)
 
1715
                # Do not run session.bye() here: the session is not
 
1716
                # established.  Just abandon the request.
 
1717
                return
 
1718
            logger.debug("Handshake succeeded")
 
1719
            
 
1720
            approval_required = False
 
1721
            try:
 
1722
                try:
 
1723
                    fpr = self.fingerprint(self.peer_certificate
 
1724
                                           (session))
 
1725
                except (TypeError,
 
1726
                        gnutls.errors.GNUTLSError) as error:
 
1727
                    logger.warning("Bad certificate: %s", error)
 
1728
                    return
 
1729
                logger.debug("Fingerprint: %s", fpr)
 
1730
                
 
1731
                try:
 
1732
                    client = ProxyClient(child_pipe, fpr,
 
1733
                                         self.client_address)
 
1734
                except KeyError:
 
1735
                    return
 
1736
                
 
1737
                if client.approval_delay:
 
1738
                    delay = client.approval_delay
 
1739
                    client.approvals_pending += 1
 
1740
                    approval_required = True
 
1741
                
 
1742
                while True:
 
1743
                    if not client.enabled:
 
1744
                        logger.info("Client %s is disabled",
 
1745
                                       client.name)
 
1746
                        if self.server.use_dbus:
 
1747
                            # Emit D-Bus signal
 
1748
                            client.Rejected("Disabled")
 
1749
                        return
 
1750
                    
 
1751
                    if client.approved or not client.approval_delay:
 
1752
                        #We are approved or approval is disabled
 
1753
                        break
 
1754
                    elif client.approved is None:
 
1755
                        logger.info("Client %s needs approval",
 
1756
                                    client.name)
 
1757
                        if self.server.use_dbus:
 
1758
                            # Emit D-Bus signal
 
1759
                            client.NeedApproval(
 
1760
                                client.approval_delay_milliseconds(),
 
1761
                                client.approved_by_default)
 
1762
                    else:
 
1763
                        logger.warning("Client %s was not approved",
 
1764
                                       client.name)
 
1765
                        if self.server.use_dbus:
 
1766
                            # Emit D-Bus signal
 
1767
                            client.Rejected("Denied")
 
1768
                        return
 
1769
                    
 
1770
                    #wait until timeout or approved
 
1771
                    time = datetime.datetime.now()
 
1772
                    client.changedstate.acquire()
 
1773
                    client.changedstate.wait(
 
1774
                        float(timedelta_to_milliseconds(delay)
 
1775
                              / 1000))
 
1776
                    client.changedstate.release()
 
1777
                    time2 = datetime.datetime.now()
 
1778
                    if (time2 - time) >= delay:
 
1779
                        if not client.approved_by_default:
 
1780
                            logger.warning("Client %s timed out while"
 
1781
                                           " waiting for approval",
 
1782
                                           client.name)
 
1783
                            if self.server.use_dbus:
 
1784
                                # Emit D-Bus signal
 
1785
                                client.Rejected("Approval timed out")
 
1786
                            return
 
1787
                        else:
 
1788
                            break
 
1789
                    else:
 
1790
                        delay -= time2 - time
 
1791
                
 
1792
                sent_size = 0
 
1793
                while sent_size < len(client.secret):
 
1794
                    try:
 
1795
                        sent = session.send(client.secret[sent_size:])
 
1796
                    except gnutls.errors.GNUTLSError as error:
 
1797
                        logger.warning("gnutls send failed",
 
1798
                                       exc_info=error)
 
1799
                        return
 
1800
                    logger.debug("Sent: %d, remaining: %d",
 
1801
                                 sent, len(client.secret)
 
1802
                                 - (sent_size + sent))
 
1803
                    sent_size += sent
 
1804
                
 
1805
                logger.info("Sending secret to %s", client.name)
 
1806
                # bump the timeout using extended_timeout
 
1807
                client.bump_timeout(client.extended_timeout)
 
1808
                if self.server.use_dbus:
 
1809
                    # Emit D-Bus signal
 
1810
                    client.GotSecret()
 
1811
            
 
1812
            finally:
 
1813
                if approval_required:
 
1814
                    client.approvals_pending -= 1
 
1815
                try:
 
1816
                    session.bye()
 
1817
                except gnutls.errors.GNUTLSError as error:
 
1818
                    logger.warning("GnuTLS bye failed",
 
1819
                                   exc_info=error)
 
1820
    
 
1821
    @staticmethod
 
1822
    def peer_certificate(session):
 
1823
        "Return the peer's OpenPGP certificate as a bytestring"
 
1824
        # If not an OpenPGP certificate...
 
1825
        if (gnutls.library.functions
 
1826
            .gnutls_certificate_type_get(session._c_object)
 
1827
            != gnutls.library.constants.GNUTLS_CRT_OPENPGP):
 
1828
            # ...do the normal thing
 
1829
            return session.peer_certificate
 
1830
        list_size = ctypes.c_uint(1)
 
1831
        cert_list = (gnutls.library.functions
 
1832
                     .gnutls_certificate_get_peers
 
1833
                     (session._c_object, ctypes.byref(list_size)))
 
1834
        if not bool(cert_list) and list_size.value != 0:
 
1835
            raise gnutls.errors.GNUTLSError("error getting peer"
 
1836
                                            " certificate")
 
1837
        if list_size.value == 0:
 
1838
            return None
 
1839
        cert = cert_list[0]
 
1840
        return ctypes.string_at(cert.data, cert.size)
 
1841
    
 
1842
    @staticmethod
 
1843
    def fingerprint(openpgp):
 
1844
        "Convert an OpenPGP bytestring to a hexdigit fingerprint"
 
1845
        # New GnuTLS "datum" with the OpenPGP public key
 
1846
        datum = (gnutls.library.types
 
1847
                 .gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
 
1848
                                             ctypes.POINTER
 
1849
                                             (ctypes.c_ubyte)),
 
1850
                                 ctypes.c_uint(len(openpgp))))
 
1851
        # New empty GnuTLS certificate
 
1852
        crt = gnutls.library.types.gnutls_openpgp_crt_t()
 
1853
        (gnutls.library.functions
 
1854
         .gnutls_openpgp_crt_init(ctypes.byref(crt)))
 
1855
        # Import the OpenPGP public key into the certificate
 
1856
        (gnutls.library.functions
 
1857
         .gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
 
1858
                                    gnutls.library.constants
 
1859
                                    .GNUTLS_OPENPGP_FMT_RAW))
 
1860
        # Verify the self signature in the key
 
1861
        crtverify = ctypes.c_uint()
 
1862
        (gnutls.library.functions
 
1863
         .gnutls_openpgp_crt_verify_self(crt, 0,
 
1864
                                         ctypes.byref(crtverify)))
 
1865
        if crtverify.value != 0:
 
1866
            gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
 
1867
            raise (gnutls.errors.CertificateSecurityError
 
1868
                   ("Verify failed"))
 
1869
        # New buffer for the fingerprint
 
1870
        buf = ctypes.create_string_buffer(20)
 
1871
        buf_len = ctypes.c_size_t()
 
1872
        # Get the fingerprint from the certificate into the buffer
 
1873
        (gnutls.library.functions
 
1874
         .gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
 
1875
                                             ctypes.byref(buf_len)))
 
1876
        # Deinit the certificate
 
1877
        gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
 
1878
        # Convert the buffer to a Python bytestring
 
1879
        fpr = ctypes.string_at(buf, buf_len.value)
 
1880
        # Convert the bytestring to hexadecimal notation
 
1881
        hex_fpr = binascii.hexlify(fpr).upper()
 
1882
        return hex_fpr
 
1883
 
 
1884
 
 
1885
class MultiprocessingMixIn(object):
 
1886
    """Like socketserver.ThreadingMixIn, but with multiprocessing"""
 
1887
    def sub_process_main(self, request, address):
 
1888
        try:
 
1889
            self.finish_request(request, address)
 
1890
        except Exception:
 
1891
            self.handle_error(request, address)
 
1892
        self.close_request(request)
 
1893
    
 
1894
    def process_request(self, request, address):
 
1895
        """Start a new process to process the request."""
 
1896
        proc = multiprocessing.Process(target = self.sub_process_main,
 
1897
                                       args = (request, address))
 
1898
        proc.start()
 
1899
        return proc
 
1900
 
 
1901
 
 
1902
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
 
1903
    """ adds a pipe to the MixIn """
 
1904
    def process_request(self, request, client_address):
 
1905
        """Overrides and wraps the original process_request().
 
1906
        
 
1907
        This function creates a new pipe in self.pipe
 
1908
        """
 
1909
        parent_pipe, self.child_pipe = multiprocessing.Pipe()
 
1910
        
 
1911
        proc = MultiprocessingMixIn.process_request(self, request,
 
1912
                                                    client_address)
 
1913
        self.child_pipe.close()
 
1914
        self.add_pipe(parent_pipe, proc)
 
1915
    
 
1916
    def add_pipe(self, parent_pipe, proc):
 
1917
        """Dummy function; override as necessary"""
 
1918
        raise NotImplementedError
 
1919
 
 
1920
 
 
1921
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
 
1922
                     socketserver.TCPServer, object):
 
1923
    """IPv6-capable TCP server.  Accepts 'None' as address and/or port
 
1924
    
502
1925
    Attributes:
503
 
        settings:       Server settings
504
 
        clients:        Set() of Client objects
 
1926
        enabled:        Boolean; whether this server is activated yet
 
1927
        interface:      None or a network interface name (string)
 
1928
        use_ipv6:       Boolean; to use IPv6 or not
505
1929
    """
506
 
    address_family = socket.AF_INET6
507
 
    def __init__(self, *args, **kwargs):
508
 
        if "settings" in kwargs:
509
 
            self.settings = kwargs["settings"]
510
 
            del kwargs["settings"]
511
 
        if "clients" in kwargs:
512
 
            self.clients = kwargs["clients"]
513
 
            del kwargs["clients"]
514
 
        return super(type(self), self).__init__(*args, **kwargs)
 
1930
    def __init__(self, server_address, RequestHandlerClass,
 
1931
                 interface=None, use_ipv6=True, socketfd=None):
 
1932
        """If socketfd is set, use that file descriptor instead of
 
1933
        creating a new one with socket.socket().
 
1934
        """
 
1935
        self.interface = interface
 
1936
        if use_ipv6:
 
1937
            self.address_family = socket.AF_INET6
 
1938
        if socketfd is not None:
 
1939
            # Save the file descriptor
 
1940
            self.socketfd = socketfd
 
1941
            # Save the original socket.socket() function
 
1942
            self.socket_socket = socket.socket
 
1943
            # To implement --socket, we monkey patch socket.socket.
 
1944
            # 
 
1945
            # (When socketserver.TCPServer is a new-style class, we
 
1946
            # could make self.socket into a property instead of monkey
 
1947
            # patching socket.socket.)
 
1948
            # 
 
1949
            # Create a one-time-only replacement for socket.socket()
 
1950
            @functools.wraps(socket.socket)
 
1951
            def socket_wrapper(*args, **kwargs):
 
1952
                # Restore original function so subsequent calls are
 
1953
                # not affected.
 
1954
                socket.socket = self.socket_socket
 
1955
                del self.socket_socket
 
1956
                # This time only, return a new socket object from the
 
1957
                # saved file descriptor.
 
1958
                return socket.fromfd(self.socketfd, *args, **kwargs)
 
1959
            # Replace socket.socket() function with wrapper
 
1960
            socket.socket = socket_wrapper
 
1961
        # The socketserver.TCPServer.__init__ will call
 
1962
        # socket.socket(), which might be our replacement,
 
1963
        # socket_wrapper(), if socketfd was set.
 
1964
        socketserver.TCPServer.__init__(self, server_address,
 
1965
                                        RequestHandlerClass)
 
1966
    
515
1967
    def server_bind(self):
516
1968
        """This overrides the normal server_bind() function
517
1969
        to bind to an interface if one was specified, and also NOT to
518
1970
        bind to an address or port if they were not specified."""
519
 
        if self.settings["interface"]:
520
 
            # 25 is from /usr/include/asm-i486/socket.h
521
 
            SO_BINDTODEVICE = getattr(socket, "SO_BINDTODEVICE", 25)
522
 
            try:
523
 
                self.socket.setsockopt(socket.SOL_SOCKET,
524
 
                                       SO_BINDTODEVICE,
525
 
                                       self.settings["interface"])
526
 
            except socket.error, error:
527
 
                if error[0] == errno.EPERM:
528
 
                    logger.error(u"No permission to"
529
 
                                 u" bind to interface %s",
530
 
                                 self.settings["interface"])
531
 
                else:
532
 
                    raise error
 
1971
        if self.interface is not None:
 
1972
            if SO_BINDTODEVICE is None:
 
1973
                logger.error("SO_BINDTODEVICE does not exist;"
 
1974
                             " cannot bind to interface %s",
 
1975
                             self.interface)
 
1976
            else:
 
1977
                try:
 
1978
                    self.socket.setsockopt(socket.SOL_SOCKET,
 
1979
                                           SO_BINDTODEVICE,
 
1980
                                           str(self.interface + '\0'))
 
1981
                except socket.error as error:
 
1982
                    if error.errno == errno.EPERM:
 
1983
                        logger.error("No permission to bind to"
 
1984
                                     " interface %s", self.interface)
 
1985
                    elif error.errno == errno.ENOPROTOOPT:
 
1986
                        logger.error("SO_BINDTODEVICE not available;"
 
1987
                                     " cannot bind to interface %s",
 
1988
                                     self.interface)
 
1989
                    elif error.errno == errno.ENODEV:
 
1990
                        logger.error("Interface %s does not exist,"
 
1991
                                     " cannot bind", self.interface)
 
1992
                    else:
 
1993
                        raise
533
1994
        # Only bind(2) the socket if we really need to.
534
1995
        if self.server_address[0] or self.server_address[1]:
535
1996
            if not self.server_address[0]:
536
 
                in6addr_any = "::"
537
 
                self.server_address = (in6addr_any,
 
1997
                if self.address_family == socket.AF_INET6:
 
1998
                    any_address = "::" # in6addr_any
 
1999
                else:
 
2000
                    any_address = "0.0.0.0" # INADDR_ANY
 
2001
                self.server_address = (any_address,
538
2002
                                       self.server_address[1])
539
2003
            elif not self.server_address[1]:
540
2004
                self.server_address = (self.server_address[0],
541
2005
                                       0)
542
 
#                 if self.settings["interface"]:
 
2006
#                 if self.interface:
543
2007
#                     self.server_address = (self.server_address[0],
544
2008
#                                            0, # port
545
2009
#                                            0, # flowinfo
546
2010
#                                            if_nametoindex
547
 
#                                            (self.settings
548
 
#                                             ["interface"]))
549
 
            return super(type(self), self).server_bind()
 
2011
#                                            (self.interface))
 
2012
            return socketserver.TCPServer.server_bind(self)
 
2013
 
 
2014
 
 
2015
class MandosServer(IPv6_TCPServer):
 
2016
    """Mandos server.
 
2017
    
 
2018
    Attributes:
 
2019
        clients:        set of Client objects
 
2020
        gnutls_priority GnuTLS priority string
 
2021
        use_dbus:       Boolean; to emit D-Bus signals or not
 
2022
    
 
2023
    Assumes a gobject.MainLoop event loop.
 
2024
    """
 
2025
    def __init__(self, server_address, RequestHandlerClass,
 
2026
                 interface=None, use_ipv6=True, clients=None,
 
2027
                 gnutls_priority=None, use_dbus=True, socketfd=None):
 
2028
        self.enabled = False
 
2029
        self.clients = clients
 
2030
        if self.clients is None:
 
2031
            self.clients = {}
 
2032
        self.use_dbus = use_dbus
 
2033
        self.gnutls_priority = gnutls_priority
 
2034
        IPv6_TCPServer.__init__(self, server_address,
 
2035
                                RequestHandlerClass,
 
2036
                                interface = interface,
 
2037
                                use_ipv6 = use_ipv6,
 
2038
                                socketfd = socketfd)
 
2039
    def server_activate(self):
 
2040
        if self.enabled:
 
2041
            return socketserver.TCPServer.server_activate(self)
 
2042
    
 
2043
    def enable(self):
 
2044
        self.enabled = True
 
2045
    
 
2046
    def add_pipe(self, parent_pipe, proc):
 
2047
        # Call "handle_ipc" for both data and EOF events
 
2048
        gobject.io_add_watch(parent_pipe.fileno(),
 
2049
                             gobject.IO_IN | gobject.IO_HUP,
 
2050
                             functools.partial(self.handle_ipc,
 
2051
                                               parent_pipe =
 
2052
                                               parent_pipe,
 
2053
                                               proc = proc))
 
2054
    
 
2055
    def handle_ipc(self, source, condition, parent_pipe=None,
 
2056
                   proc = None, client_object=None):
 
2057
        # error, or the other end of multiprocessing.Pipe has closed
 
2058
        if condition & (gobject.IO_ERR | gobject.IO_HUP):
 
2059
            # Wait for other process to exit
 
2060
            proc.join()
 
2061
            return False
 
2062
        
 
2063
        # Read a request from the child
 
2064
        request = parent_pipe.recv()
 
2065
        command = request[0]
 
2066
        
 
2067
        if command == 'init':
 
2068
            fpr = request[1]
 
2069
            address = request[2]
 
2070
            
 
2071
            for c in self.clients.itervalues():
 
2072
                if c.fingerprint == fpr:
 
2073
                    client = c
 
2074
                    break
 
2075
            else:
 
2076
                logger.info("Client not found for fingerprint: %s, ad"
 
2077
                            "dress: %s", fpr, address)
 
2078
                if self.use_dbus:
 
2079
                    # Emit D-Bus signal
 
2080
                    mandos_dbus_service.ClientNotFound(fpr,
 
2081
                                                       address[0])
 
2082
                parent_pipe.send(False)
 
2083
                return False
 
2084
            
 
2085
            gobject.io_add_watch(parent_pipe.fileno(),
 
2086
                                 gobject.IO_IN | gobject.IO_HUP,
 
2087
                                 functools.partial(self.handle_ipc,
 
2088
                                                   parent_pipe =
 
2089
                                                   parent_pipe,
 
2090
                                                   proc = proc,
 
2091
                                                   client_object =
 
2092
                                                   client))
 
2093
            parent_pipe.send(True)
 
2094
            # remove the old hook in favor of the new above hook on
 
2095
            # same fileno
 
2096
            return False
 
2097
        if command == 'funcall':
 
2098
            funcname = request[1]
 
2099
            args = request[2]
 
2100
            kwargs = request[3]
 
2101
            
 
2102
            parent_pipe.send(('data', getattr(client_object,
 
2103
                                              funcname)(*args,
 
2104
                                                         **kwargs)))
 
2105
        
 
2106
        if command == 'getattr':
 
2107
            attrname = request[1]
 
2108
            if callable(client_object.__getattribute__(attrname)):
 
2109
                parent_pipe.send(('function',))
 
2110
            else:
 
2111
                parent_pipe.send(('data', client_object
 
2112
                                  .__getattribute__(attrname)))
 
2113
        
 
2114
        if command == 'setattr':
 
2115
            attrname = request[1]
 
2116
            value = request[2]
 
2117
            setattr(client_object, attrname, value)
 
2118
        
 
2119
        return True
 
2120
 
 
2121
 
 
2122
def rfc3339_duration_to_delta(duration):
 
2123
    """Parse an RFC 3339 "duration" and return a datetime.timedelta
 
2124
    
 
2125
    >>> rfc3339_duration_to_delta("P7D")
 
2126
    datetime.timedelta(7)
 
2127
    >>> rfc3339_duration_to_delta("PT60S")
 
2128
    datetime.timedelta(0, 60)
 
2129
    >>> rfc3339_duration_to_delta("PT60M")
 
2130
    datetime.timedelta(0, 3600)
 
2131
    >>> rfc3339_duration_to_delta("PT24H")
 
2132
    datetime.timedelta(1)
 
2133
    >>> rfc3339_duration_to_delta("P1W")
 
2134
    datetime.timedelta(7)
 
2135
    >>> rfc3339_duration_to_delta("PT5M30S")
 
2136
    datetime.timedelta(0, 330)
 
2137
    >>> rfc3339_duration_to_delta("P1DT3M20S")
 
2138
    datetime.timedelta(1, 200)
 
2139
    """
 
2140
    
 
2141
    # Parsing an RFC 3339 duration with regular expressions is not
 
2142
    # possible - there would have to be multiple places for the same
 
2143
    # values, like seconds.  The current code, while more esoteric, is
 
2144
    # cleaner without depending on a parsing library.  If Python had a
 
2145
    # built-in library for parsing we would use it, but we'd like to
 
2146
    # avoid excessive use of external libraries.
 
2147
    
 
2148
    # New type for defining tokens, syntax, and semantics all-in-one
 
2149
    Token = collections.namedtuple("Token",
 
2150
                                   ("regexp", # To match token; if
 
2151
                                              # "value" is not None,
 
2152
                                              # must have a "group"
 
2153
                                              # containing digits
 
2154
                                    "value",  # datetime.timedelta or
 
2155
                                              # None
 
2156
                                    "followers")) # Tokens valid after
 
2157
                                                  # this token
 
2158
    # RFC 3339 "duration" tokens, syntax, and semantics; taken from
 
2159
    # the "duration" ABNF definition in RFC 3339, Appendix A.
 
2160
    token_end = Token(re.compile(r"$"), None, frozenset())
 
2161
    token_second = Token(re.compile(r"(\d+)S"),
 
2162
                         datetime.timedelta(seconds=1),
 
2163
                         frozenset((token_end,)))
 
2164
    token_minute = Token(re.compile(r"(\d+)M"),
 
2165
                         datetime.timedelta(minutes=1),
 
2166
                         frozenset((token_second, token_end)))
 
2167
    token_hour = Token(re.compile(r"(\d+)H"),
 
2168
                       datetime.timedelta(hours=1),
 
2169
                       frozenset((token_minute, token_end)))
 
2170
    token_time = Token(re.compile(r"T"),
 
2171
                       None,
 
2172
                       frozenset((token_hour, token_minute,
 
2173
                                  token_second)))
 
2174
    token_day = Token(re.compile(r"(\d+)D"),
 
2175
                      datetime.timedelta(days=1),
 
2176
                      frozenset((token_time, token_end)))
 
2177
    token_month = Token(re.compile(r"(\d+)M"),
 
2178
                        datetime.timedelta(weeks=4),
 
2179
                        frozenset((token_day, token_end)))
 
2180
    token_year = Token(re.compile(r"(\d+)Y"),
 
2181
                       datetime.timedelta(weeks=52),
 
2182
                       frozenset((token_month, token_end)))
 
2183
    token_week = Token(re.compile(r"(\d+)W"),
 
2184
                       datetime.timedelta(weeks=1),
 
2185
                       frozenset((token_end,)))
 
2186
    token_duration = Token(re.compile(r"P"), None,
 
2187
                           frozenset((token_year, token_month,
 
2188
                                      token_day, token_time,
 
2189
                                      token_week))),
 
2190
    # Define starting values
 
2191
    value = datetime.timedelta() # Value so far
 
2192
    found_token = None
 
2193
    followers = frozenset(token_duration,) # Following valid tokens
 
2194
    s = duration                # String left to parse
 
2195
    # Loop until end token is found
 
2196
    while found_token is not token_end:
 
2197
        # Search for any currently valid tokens
 
2198
        for token in followers:
 
2199
            match = token.regexp.match(s)
 
2200
            if match is not None:
 
2201
                # Token found
 
2202
                if token.value is not None:
 
2203
                    # Value found, parse digits
 
2204
                    factor = int(match.group(1), 10)
 
2205
                    # Add to value so far
 
2206
                    value += factor * token.value
 
2207
                # Strip token from string
 
2208
                s = token.regexp.sub("", s, 1)
 
2209
                # Go to found token
 
2210
                found_token = token
 
2211
                # Set valid next tokens
 
2212
                followers = found_token.followers
 
2213
                break
 
2214
        else:
 
2215
            # No currently valid tokens were found
 
2216
            raise ValueError("Invalid RFC 3339 duration")
 
2217
    # End token found
 
2218
    return value
550
2219
 
551
2220
 
552
2221
def string_to_delta(interval):
553
2222
    """Parse a string and return a datetime.timedelta
554
 
 
 
2223
    
555
2224
    >>> string_to_delta('7d')
556
2225
    datetime.timedelta(7)
557
2226
    >>> string_to_delta('60s')
560
2229
    datetime.timedelta(0, 3600)
561
2230
    >>> string_to_delta('24h')
562
2231
    datetime.timedelta(1)
563
 
    >>> string_to_delta(u'1w')
 
2232
    >>> string_to_delta('1w')
564
2233
    datetime.timedelta(7)
 
2234
    >>> string_to_delta('5m 30s')
 
2235
    datetime.timedelta(0, 330)
565
2236
    """
566
 
    try:
567
 
        suffix=unicode(interval[-1])
568
 
        value=int(interval[:-1])
569
 
        if suffix == u"d":
570
 
            delta = datetime.timedelta(value)
571
 
        elif suffix == u"s":
572
 
            delta = datetime.timedelta(0, value)
573
 
        elif suffix == u"m":
574
 
            delta = datetime.timedelta(0, 0, 0, 0, value)
575
 
        elif suffix == u"h":
576
 
            delta = datetime.timedelta(0, 0, 0, 0, 0, value)
577
 
        elif suffix == u"w":
578
 
            delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
579
 
        else:
580
 
            raise ValueError
581
 
    except (ValueError, IndexError):
582
 
        raise ValueError
583
 
    return delta
584
 
 
585
 
 
586
 
def server_state_changed(state):
587
 
    """Derived from the Avahi example code"""
588
 
    if state == avahi.SERVER_COLLISION:
589
 
        logger.error(u"Server name collision")
590
 
        service.remove()
591
 
    elif state == avahi.SERVER_RUNNING:
592
 
        service.add()
593
 
 
594
 
 
595
 
def entry_group_state_changed(state, error):
596
 
    """Derived from the Avahi example code"""
597
 
    logger.debug(u"state change: %i", state)
598
 
    
599
 
    if state == avahi.ENTRY_GROUP_ESTABLISHED:
600
 
        logger.debug(u"Service established.")
601
 
    elif state == avahi.ENTRY_GROUP_COLLISION:
602
 
        logger.warning(u"Service name collision.")
603
 
        service.rename()
604
 
    elif state == avahi.ENTRY_GROUP_FAILURE:
605
 
        logger.critical(u"Error in group state changed %s",
606
 
                        unicode(error))
607
 
        raise AvahiGroupError("State changed: %s", str(error))
608
 
 
609
 
def if_nametoindex(interface):
610
 
    """Call the C function if_nametoindex(), or equivalent"""
611
 
    global if_nametoindex
612
 
    try:
613
 
        if "ctypes.util" not in sys.modules:
614
 
            import ctypes.util
615
 
        if_nametoindex = ctypes.cdll.LoadLibrary\
616
 
            (ctypes.util.find_library("c")).if_nametoindex
617
 
    except (OSError, AttributeError):
618
 
        if "struct" not in sys.modules:
619
 
            import struct
620
 
        if "fcntl" not in sys.modules:
621
 
            import fcntl
622
 
        def if_nametoindex(interface):
623
 
            "Get an interface index the hard way, i.e. using fcntl()"
624
 
            SIOCGIFINDEX = 0x8933  # From /usr/include/linux/sockios.h
625
 
            s = socket.socket()
626
 
            ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
627
 
                                struct.pack("16s16x", interface))
628
 
            s.close()
629
 
            interface_index = struct.unpack("I", ifreq[16:20])[0]
630
 
            return interface_index
631
 
    return if_nametoindex(interface)
 
2237
    
 
2238
    try:
 
2239
        return rfc3339_duration_to_delta(interval)
 
2240
    except ValueError:
 
2241
        pass
 
2242
    
 
2243
    timevalue = datetime.timedelta(0)
 
2244
    for s in interval.split():
 
2245
        try:
 
2246
            suffix = unicode(s[-1])
 
2247
            value = int(s[:-1])
 
2248
            if suffix == "d":
 
2249
                delta = datetime.timedelta(value)
 
2250
            elif suffix == "s":
 
2251
                delta = datetime.timedelta(0, value)
 
2252
            elif suffix == "m":
 
2253
                delta = datetime.timedelta(0, 0, 0, 0, value)
 
2254
            elif suffix == "h":
 
2255
                delta = datetime.timedelta(0, 0, 0, 0, 0, value)
 
2256
            elif suffix == "w":
 
2257
                delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
 
2258
            else:
 
2259
                raise ValueError("Unknown suffix {0!r}"
 
2260
                                 .format(suffix))
 
2261
        except (ValueError, IndexError) as e:
 
2262
            raise ValueError(*(e.args))
 
2263
        timevalue += delta
 
2264
    return timevalue
632
2265
 
633
2266
 
634
2267
def daemon(nochdir = False, noclose = False):
635
2268
    """See daemon(3).  Standard BSD Unix function.
 
2269
    
636
2270
    This should really exist as os.daemon, but it doesn't (yet)."""
637
2271
    if os.fork():
638
2272
        sys.exit()
643
2277
        sys.exit()
644
2278
    if not noclose:
645
2279
        # Close all standard open file descriptors
646
 
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
 
2280
        null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
647
2281
        if not stat.S_ISCHR(os.fstat(null).st_mode):
648
2282
            raise OSError(errno.ENODEV,
649
 
                          "/dev/null not a character device")
 
2283
                          "{0} not a character device"
 
2284
                          .format(os.devnull))
650
2285
        os.dup2(null, sys.stdin.fileno())
651
2286
        os.dup2(null, sys.stdout.fileno())
652
2287
        os.dup2(null, sys.stderr.fileno())
655
2290
 
656
2291
 
657
2292
def main():
658
 
    global main_loop_started
659
 
    main_loop_started = False
660
 
    
661
 
    parser = OptionParser(version = "%%prog %s" % version)
662
 
    parser.add_option("-i", "--interface", type="string",
663
 
                      metavar="IF", help="Bind to interface IF")
664
 
    parser.add_option("-a", "--address", type="string",
665
 
                      help="Address to listen for requests on")
666
 
    parser.add_option("-p", "--port", type="int",
667
 
                      help="Port number to receive requests on")
668
 
    parser.add_option("--check", action="store_true", default=False,
669
 
                      help="Run self-test")
670
 
    parser.add_option("--debug", action="store_true",
671
 
                      help="Debug mode; run in foreground and log to"
672
 
                      " terminal")
673
 
    parser.add_option("--priority", type="string", help="GnuTLS"
674
 
                      " priority string (see GnuTLS documentation)")
675
 
    parser.add_option("--servicename", type="string", metavar="NAME",
676
 
                      help="Zeroconf service name")
677
 
    parser.add_option("--configdir", type="string",
678
 
                      default="/etc/mandos", metavar="DIR",
679
 
                      help="Directory to search for configuration"
680
 
                      " files")
681
 
    (options, args) = parser.parse_args()
 
2293
    
 
2294
    ##################################################################
 
2295
    # Parsing of options, both command line and config file
 
2296
    
 
2297
    parser = argparse.ArgumentParser()
 
2298
    parser.add_argument("-v", "--version", action="version",
 
2299
                        version = "%(prog)s {0}".format(version),
 
2300
                        help="show version number and exit")
 
2301
    parser.add_argument("-i", "--interface", metavar="IF",
 
2302
                        help="Bind to interface IF")
 
2303
    parser.add_argument("-a", "--address",
 
2304
                        help="Address to listen for requests on")
 
2305
    parser.add_argument("-p", "--port", type=int,
 
2306
                        help="Port number to receive requests on")
 
2307
    parser.add_argument("--check", action="store_true",
 
2308
                        help="Run self-test")
 
2309
    parser.add_argument("--debug", action="store_true",
 
2310
                        help="Debug mode; run in foreground and log"
 
2311
                        " to terminal", default=None)
 
2312
    parser.add_argument("--debuglevel", metavar="LEVEL",
 
2313
                        help="Debug level for stdout output")
 
2314
    parser.add_argument("--priority", help="GnuTLS"
 
2315
                        " priority string (see GnuTLS documentation)")
 
2316
    parser.add_argument("--servicename",
 
2317
                        metavar="NAME", help="Zeroconf service name")
 
2318
    parser.add_argument("--configdir",
 
2319
                        default="/etc/mandos", metavar="DIR",
 
2320
                        help="Directory to search for configuration"
 
2321
                        " files")
 
2322
    parser.add_argument("--no-dbus", action="store_false",
 
2323
                        dest="use_dbus", help="Do not provide D-Bus"
 
2324
                        " system bus interface", default=None)
 
2325
    parser.add_argument("--no-ipv6", action="store_false",
 
2326
                        dest="use_ipv6", help="Do not use IPv6",
 
2327
                        default=None)
 
2328
    parser.add_argument("--no-restore", action="store_false",
 
2329
                        dest="restore", help="Do not restore stored"
 
2330
                        " state", default=None)
 
2331
    parser.add_argument("--socket", type=int,
 
2332
                        help="Specify a file descriptor to a network"
 
2333
                        " socket to use instead of creating one")
 
2334
    parser.add_argument("--statedir", metavar="DIR",
 
2335
                        help="Directory to save/restore state in")
 
2336
    parser.add_argument("--foreground", action="store_true",
 
2337
                        help="Run in foreground", default=None)
 
2338
    
 
2339
    options = parser.parse_args()
682
2340
    
683
2341
    if options.check:
684
2342
        import doctest
691
2349
                        "port": "",
692
2350
                        "debug": "False",
693
2351
                        "priority":
694
 
                        "SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
 
2352
                        "SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",
695
2353
                        "servicename": "Mandos",
 
2354
                        "use_dbus": "True",
 
2355
                        "use_ipv6": "True",
 
2356
                        "debuglevel": "",
 
2357
                        "restore": "True",
 
2358
                        "socket": "",
 
2359
                        "statedir": "/var/lib/mandos",
 
2360
                        "foreground": "False",
696
2361
                        }
697
2362
    
698
2363
    # Parse config file for server-global settings
699
 
    server_config = ConfigParser.SafeConfigParser(server_defaults)
 
2364
    server_config = configparser.SafeConfigParser(server_defaults)
700
2365
    del server_defaults
701
 
    server_config.read(os.path.join(options.configdir, "mandos.conf"))
702
 
    server_section = "server"
 
2366
    server_config.read(os.path.join(options.configdir,
 
2367
                                    "mandos.conf"))
703
2368
    # Convert the SafeConfigParser object to a dict
704
 
    server_settings = dict(server_config.items(server_section))
705
 
    # Use getboolean on the boolean config option
706
 
    server_settings["debug"] = server_config.getboolean\
707
 
                               (server_section, "debug")
 
2369
    server_settings = server_config.defaults()
 
2370
    # Use the appropriate methods on the non-string config options
 
2371
    for option in ("debug", "use_dbus", "use_ipv6", "foreground"):
 
2372
        server_settings[option] = server_config.getboolean("DEFAULT",
 
2373
                                                           option)
 
2374
    if server_settings["port"]:
 
2375
        server_settings["port"] = server_config.getint("DEFAULT",
 
2376
                                                       "port")
 
2377
    if server_settings["socket"]:
 
2378
        server_settings["socket"] = server_config.getint("DEFAULT",
 
2379
                                                         "socket")
 
2380
        # Later, stdin will, and stdout and stderr might, be dup'ed
 
2381
        # over with an opened os.devnull.  But we don't want this to
 
2382
        # happen with a supplied network socket.
 
2383
        if 0 <= server_settings["socket"] <= 2:
 
2384
            server_settings["socket"] = os.dup(server_settings
 
2385
                                               ["socket"])
708
2386
    del server_config
709
2387
    
710
2388
    # Override the settings from the config file with command line
711
2389
    # options, if set.
712
2390
    for option in ("interface", "address", "port", "debug",
713
 
                   "priority", "servicename", "configdir"):
 
2391
                   "priority", "servicename", "configdir",
 
2392
                   "use_dbus", "use_ipv6", "debuglevel", "restore",
 
2393
                   "statedir", "socket", "foreground"):
714
2394
        value = getattr(options, option)
715
2395
        if value is not None:
716
2396
            server_settings[option] = value
717
2397
    del options
 
2398
    # Force all strings to be unicode
 
2399
    for option in server_settings.keys():
 
2400
        if type(server_settings[option]) is str:
 
2401
            server_settings[option] = unicode(server_settings[option])
 
2402
    # Force all boolean options to be boolean
 
2403
    for option in ("debug", "use_dbus", "use_ipv6", "restore",
 
2404
                   "foreground"):
 
2405
        server_settings[option] = bool(server_settings[option])
 
2406
    # Debug implies foreground
 
2407
    if server_settings["debug"]:
 
2408
        server_settings["foreground"] = True
718
2409
    # Now we have our good server settings in "server_settings"
719
2410
    
 
2411
    ##################################################################
 
2412
    
 
2413
    # For convenience
720
2414
    debug = server_settings["debug"]
 
2415
    debuglevel = server_settings["debuglevel"]
 
2416
    use_dbus = server_settings["use_dbus"]
 
2417
    use_ipv6 = server_settings["use_ipv6"]
 
2418
    stored_state_path = os.path.join(server_settings["statedir"],
 
2419
                                     stored_state_file)
 
2420
    foreground = server_settings["foreground"]
721
2421
    
722
 
    if not debug:
723
 
        syslogger.setLevel(logging.WARNING)
724
 
        console.setLevel(logging.WARNING)
 
2422
    if debug:
 
2423
        initlogger(debug, logging.DEBUG)
 
2424
    else:
 
2425
        if not debuglevel:
 
2426
            initlogger(debug)
 
2427
        else:
 
2428
            level = getattr(logging, debuglevel.upper())
 
2429
            initlogger(debug, level)
725
2430
    
726
2431
    if server_settings["servicename"] != "Mandos":
727
 
        syslogger.setFormatter(logging.Formatter\
728
 
                               ('Mandos (%s): %%(levelname)s:'
729
 
                                ' %%(message)s'
730
 
                                % server_settings["servicename"]))
 
2432
        syslogger.setFormatter(logging.Formatter
 
2433
                               ('Mandos ({0}) [%(process)d]:'
 
2434
                                ' %(levelname)s: %(message)s'
 
2435
                                .format(server_settings
 
2436
                                        ["servicename"])))
731
2437
    
732
2438
    # Parse config file with clients
733
 
    client_defaults = { "timeout": "1h",
734
 
                        "interval": "5m",
735
 
                        "checker": "fping -q -- %%(host)s",
736
 
                        }
737
 
    client_config = ConfigParser.SafeConfigParser(client_defaults)
 
2439
    client_config = configparser.SafeConfigParser(Client
 
2440
                                                  .client_defaults)
738
2441
    client_config.read(os.path.join(server_settings["configdir"],
739
2442
                                    "clients.conf"))
740
2443
    
741
 
    global service
742
 
    service = AvahiService(name = server_settings["servicename"],
743
 
                           type = "_mandos._tcp", );
744
 
    if server_settings["interface"]:
745
 
        service.interface = if_nametoindex(server_settings["interface"])
 
2444
    global mandos_dbus_service
 
2445
    mandos_dbus_service = None
 
2446
    
 
2447
    tcp_server = MandosServer((server_settings["address"],
 
2448
                               server_settings["port"]),
 
2449
                              ClientHandler,
 
2450
                              interface=(server_settings["interface"]
 
2451
                                         or None),
 
2452
                              use_ipv6=use_ipv6,
 
2453
                              gnutls_priority=
 
2454
                              server_settings["priority"],
 
2455
                              use_dbus=use_dbus,
 
2456
                              socketfd=(server_settings["socket"]
 
2457
                                        or None))
 
2458
    if not foreground:
 
2459
        pidfilename = "/run/mandos.pid"
 
2460
        if not os.path.isdir("/run/."):
 
2461
            pidfilename = "/var/run/mandos.pid"
 
2462
        pidfile = None
 
2463
        try:
 
2464
            pidfile = open(pidfilename, "w")
 
2465
        except IOError as e:
 
2466
            logger.error("Could not open file %r", pidfilename,
 
2467
                         exc_info=e)
 
2468
    
 
2469
    for name in ("_mandos", "mandos", "nobody"):
 
2470
        try:
 
2471
            uid = pwd.getpwnam(name).pw_uid
 
2472
            gid = pwd.getpwnam(name).pw_gid
 
2473
            break
 
2474
        except KeyError:
 
2475
            continue
 
2476
    else:
 
2477
        uid = 65534
 
2478
        gid = 65534
 
2479
    try:
 
2480
        os.setgid(gid)
 
2481
        os.setuid(uid)
 
2482
    except OSError as error:
 
2483
        if error.errno != errno.EPERM:
 
2484
            raise error
 
2485
    
 
2486
    if debug:
 
2487
        # Enable all possible GnuTLS debugging
 
2488
        
 
2489
        # "Use a log level over 10 to enable all debugging options."
 
2490
        # - GnuTLS manual
 
2491
        gnutls.library.functions.gnutls_global_set_log_level(11)
 
2492
        
 
2493
        @gnutls.library.types.gnutls_log_func
 
2494
        def debug_gnutls(level, string):
 
2495
            logger.debug("GnuTLS: %s", string[:-1])
 
2496
        
 
2497
        (gnutls.library.functions
 
2498
         .gnutls_global_set_log_function(debug_gnutls))
 
2499
        
 
2500
        # Redirect stdin so all checkers get /dev/null
 
2501
        null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
 
2502
        os.dup2(null, sys.stdin.fileno())
 
2503
        if null > 2:
 
2504
            os.close(null)
 
2505
    
 
2506
    # Need to fork before connecting to D-Bus
 
2507
    if not foreground:
 
2508
        # Close all input and output, do double fork, etc.
 
2509
        daemon()
 
2510
    
 
2511
    # multiprocessing will use threads, so before we use gobject we
 
2512
    # need to inform gobject that threads will be used.
 
2513
    gobject.threads_init()
746
2514
    
747
2515
    global main_loop
748
 
    global bus
749
 
    global server
750
2516
    # From the Avahi example code
751
 
    DBusGMainLoop(set_as_default=True )
 
2517
    DBusGMainLoop(set_as_default=True)
752
2518
    main_loop = gobject.MainLoop()
753
2519
    bus = dbus.SystemBus()
754
 
    server = dbus.Interface(
755
 
            bus.get_object( avahi.DBUS_NAME, avahi.DBUS_PATH_SERVER ),
756
 
            avahi.DBUS_INTERFACE_SERVER )
757
2520
    # End of Avahi example code
758
 
    
759
 
    clients = Set()
760
 
    def remove_from_clients(client):
761
 
        clients.remove(client)
762
 
        if not clients:
763
 
            logger.critical(u"No clients left, exiting")
764
 
            sys.exit()
765
 
    
766
 
    clients.update(Set(Client(name = section,
767
 
                              stop_hook = remove_from_clients,
768
 
                              config
769
 
                              = dict(client_config.items(section)))
770
 
                       for section in client_config.sections()))
771
 
    if not clients:
772
 
        logger.critical(u"No clients defined")
773
 
        sys.exit(1)
774
 
    
775
 
    if not debug:
776
 
        logger.removeHandler(console)
777
 
        daemon()
778
 
    
779
 
    pidfilename = "/var/run/mandos/mandos.pid"
780
 
    pid = os.getpid()
781
 
    try:
782
 
        pidfile = open(pidfilename, "w")
783
 
        pidfile.write(str(pid) + "\n")
784
 
        pidfile.close()
 
2521
    if use_dbus:
 
2522
        try:
 
2523
            bus_name = dbus.service.BusName("se.recompile.Mandos",
 
2524
                                            bus, do_not_queue=True)
 
2525
            old_bus_name = (dbus.service.BusName
 
2526
                            ("se.bsnet.fukt.Mandos", bus,
 
2527
                             do_not_queue=True))
 
2528
        except dbus.exceptions.NameExistsException as e:
 
2529
            logger.error("Disabling D-Bus:", exc_info=e)
 
2530
            use_dbus = False
 
2531
            server_settings["use_dbus"] = False
 
2532
            tcp_server.use_dbus = False
 
2533
    protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
 
2534
    service = AvahiServiceToSyslog(name =
 
2535
                                   server_settings["servicename"],
 
2536
                                   servicetype = "_mandos._tcp",
 
2537
                                   protocol = protocol, bus = bus)
 
2538
    if server_settings["interface"]:
 
2539
        service.interface = (if_nametoindex
 
2540
                             (str(server_settings["interface"])))
 
2541
    
 
2542
    global multiprocessing_manager
 
2543
    multiprocessing_manager = multiprocessing.Manager()
 
2544
    
 
2545
    client_class = Client
 
2546
    if use_dbus:
 
2547
        client_class = functools.partial(ClientDBus, bus = bus)
 
2548
    
 
2549
    client_settings = Client.config_parser(client_config)
 
2550
    old_client_settings = {}
 
2551
    clients_data = {}
 
2552
    
 
2553
    # This is used to redirect stdout and stderr for checker processes
 
2554
    global wnull
 
2555
    wnull = open(os.devnull, "w") # A writable /dev/null
 
2556
    # Only used if server is running in foreground but not in debug
 
2557
    # mode
 
2558
    if debug or not foreground:
 
2559
        wnull.close()
 
2560
    
 
2561
    # Get client data and settings from last running state.
 
2562
    if server_settings["restore"]:
 
2563
        try:
 
2564
            with open(stored_state_path, "rb") as stored_state:
 
2565
                clients_data, old_client_settings = (pickle.load
 
2566
                                                     (stored_state))
 
2567
            os.remove(stored_state_path)
 
2568
        except IOError as e:
 
2569
            if e.errno == errno.ENOENT:
 
2570
                logger.warning("Could not load persistent state: {0}"
 
2571
                                .format(os.strerror(e.errno)))
 
2572
            else:
 
2573
                logger.critical("Could not load persistent state:",
 
2574
                                exc_info=e)
 
2575
                raise
 
2576
        except EOFError as e:
 
2577
            logger.warning("Could not load persistent state: "
 
2578
                           "EOFError:", exc_info=e)
 
2579
    
 
2580
    with PGPEngine() as pgp:
 
2581
        for client_name, client in clients_data.iteritems():
 
2582
            # Skip removed clients
 
2583
            if client_name not in client_settings:
 
2584
                continue
 
2585
            
 
2586
            # Decide which value to use after restoring saved state.
 
2587
            # We have three different values: Old config file,
 
2588
            # new config file, and saved state.
 
2589
            # New config value takes precedence if it differs from old
 
2590
            # config value, otherwise use saved state.
 
2591
            for name, value in client_settings[client_name].items():
 
2592
                try:
 
2593
                    # For each value in new config, check if it
 
2594
                    # differs from the old config value (Except for
 
2595
                    # the "secret" attribute)
 
2596
                    if (name != "secret" and
 
2597
                        value != old_client_settings[client_name]
 
2598
                        [name]):
 
2599
                        client[name] = value
 
2600
                except KeyError:
 
2601
                    pass
 
2602
            
 
2603
            # Clients who has passed its expire date can still be
 
2604
            # enabled if its last checker was successful.  Clients
 
2605
            # whose checker succeeded before we stored its state is
 
2606
            # assumed to have successfully run all checkers during
 
2607
            # downtime.
 
2608
            if client["enabled"]:
 
2609
                if datetime.datetime.utcnow() >= client["expires"]:
 
2610
                    if not client["last_checked_ok"]:
 
2611
                        logger.warning(
 
2612
                            "disabling client {0} - Client never "
 
2613
                            "performed a successful checker"
 
2614
                            .format(client_name))
 
2615
                        client["enabled"] = False
 
2616
                    elif client["last_checker_status"] != 0:
 
2617
                        logger.warning(
 
2618
                            "disabling client {0} - Client "
 
2619
                            "last checker failed with error code {1}"
 
2620
                            .format(client_name,
 
2621
                                    client["last_checker_status"]))
 
2622
                        client["enabled"] = False
 
2623
                    else:
 
2624
                        client["expires"] = (datetime.datetime
 
2625
                                             .utcnow()
 
2626
                                             + client["timeout"])
 
2627
                        logger.debug("Last checker succeeded,"
 
2628
                                     " keeping {0} enabled"
 
2629
                                     .format(client_name))
 
2630
            try:
 
2631
                client["secret"] = (
 
2632
                    pgp.decrypt(client["encrypted_secret"],
 
2633
                                client_settings[client_name]
 
2634
                                ["secret"]))
 
2635
            except PGPError:
 
2636
                # If decryption fails, we use secret from new settings
 
2637
                logger.debug("Failed to decrypt {0} old secret"
 
2638
                             .format(client_name))
 
2639
                client["secret"] = (
 
2640
                    client_settings[client_name]["secret"])
 
2641
    
 
2642
    # Add/remove clients based on new changes made to config
 
2643
    for client_name in (set(old_client_settings)
 
2644
                        - set(client_settings)):
 
2645
        del clients_data[client_name]
 
2646
    for client_name in (set(client_settings)
 
2647
                        - set(old_client_settings)):
 
2648
        clients_data[client_name] = client_settings[client_name]
 
2649
    
 
2650
    # Create all client objects
 
2651
    for client_name, client in clients_data.iteritems():
 
2652
        tcp_server.clients[client_name] = client_class(
 
2653
            name = client_name, settings = client,
 
2654
            server_settings = server_settings)
 
2655
    
 
2656
    if not tcp_server.clients:
 
2657
        logger.warning("No clients defined")
 
2658
    
 
2659
    if not foreground:
 
2660
        if pidfile is not None:
 
2661
            try:
 
2662
                with pidfile:
 
2663
                    pid = os.getpid()
 
2664
                    pidfile.write(str(pid) + "\n".encode("utf-8"))
 
2665
            except IOError:
 
2666
                logger.error("Could not write to file %r with PID %d",
 
2667
                             pidfilename, pid)
785
2668
        del pidfile
786
 
    except IOError, err:
787
 
        logger.error(u"Could not write %s file with PID %d",
788
 
                     pidfilename, os.getpid())
 
2669
        del pidfilename
 
2670
    
 
2671
    signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
 
2672
    signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
 
2673
    
 
2674
    if use_dbus:
 
2675
        @alternate_dbus_interfaces({"se.recompile.Mandos":
 
2676
                                        "se.bsnet.fukt.Mandos"})
 
2677
        class MandosDBusService(DBusObjectWithProperties):
 
2678
            """A D-Bus proxy object"""
 
2679
            def __init__(self):
 
2680
                dbus.service.Object.__init__(self, bus, "/")
 
2681
            _interface = "se.recompile.Mandos"
 
2682
            
 
2683
            @dbus_interface_annotations(_interface)
 
2684
            def _foo(self):
 
2685
                return { "org.freedesktop.DBus.Property"
 
2686
                         ".EmitsChangedSignal":
 
2687
                             "false"}
 
2688
            
 
2689
            @dbus.service.signal(_interface, signature="o")
 
2690
            def ClientAdded(self, objpath):
 
2691
                "D-Bus signal"
 
2692
                pass
 
2693
            
 
2694
            @dbus.service.signal(_interface, signature="ss")
 
2695
            def ClientNotFound(self, fingerprint, address):
 
2696
                "D-Bus signal"
 
2697
                pass
 
2698
            
 
2699
            @dbus.service.signal(_interface, signature="os")
 
2700
            def ClientRemoved(self, objpath, name):
 
2701
                "D-Bus signal"
 
2702
                pass
 
2703
            
 
2704
            @dbus.service.method(_interface, out_signature="ao")
 
2705
            def GetAllClients(self):
 
2706
                "D-Bus method"
 
2707
                return dbus.Array(c.dbus_object_path
 
2708
                                  for c in
 
2709
                                  tcp_server.clients.itervalues())
 
2710
            
 
2711
            @dbus.service.method(_interface,
 
2712
                                 out_signature="a{oa{sv}}")
 
2713
            def GetAllClientsWithProperties(self):
 
2714
                "D-Bus method"
 
2715
                return dbus.Dictionary(
 
2716
                    ((c.dbus_object_path, c.GetAll(""))
 
2717
                     for c in tcp_server.clients.itervalues()),
 
2718
                    signature="oa{sv}")
 
2719
            
 
2720
            @dbus.service.method(_interface, in_signature="o")
 
2721
            def RemoveClient(self, object_path):
 
2722
                "D-Bus method"
 
2723
                for c in tcp_server.clients.itervalues():
 
2724
                    if c.dbus_object_path == object_path:
 
2725
                        del tcp_server.clients[c.name]
 
2726
                        c.remove_from_connection()
 
2727
                        # Don't signal anything except ClientRemoved
 
2728
                        c.disable(quiet=True)
 
2729
                        # Emit D-Bus signal
 
2730
                        self.ClientRemoved(object_path, c.name)
 
2731
                        return
 
2732
                raise KeyError(object_path)
 
2733
            
 
2734
            del _interface
 
2735
        
 
2736
        mandos_dbus_service = MandosDBusService()
789
2737
    
790
2738
    def cleanup():
791
2739
        "Cleanup function; run on exit"
792
 
        global group
793
 
        # From the Avahi example code
794
 
        if not group is None:
795
 
            group.Free()
796
 
            group = None
797
 
        # End of Avahi example code
798
 
        
799
 
        while clients:
800
 
            client = clients.pop()
801
 
            client.stop_hook = None
802
 
            client.stop()
 
2740
        service.cleanup()
 
2741
        
 
2742
        multiprocessing.active_children()
 
2743
        wnull.close()
 
2744
        if not (tcp_server.clients or client_settings):
 
2745
            return
 
2746
        
 
2747
        # Store client before exiting. Secrets are encrypted with key
 
2748
        # based on what config file has. If config file is
 
2749
        # removed/edited, old secret will thus be unrecovable.
 
2750
        clients = {}
 
2751
        with PGPEngine() as pgp:
 
2752
            for client in tcp_server.clients.itervalues():
 
2753
                key = client_settings[client.name]["secret"]
 
2754
                client.encrypted_secret = pgp.encrypt(client.secret,
 
2755
                                                      key)
 
2756
                client_dict = {}
 
2757
                
 
2758
                # A list of attributes that can not be pickled
 
2759
                # + secret.
 
2760
                exclude = set(("bus", "changedstate", "secret",
 
2761
                               "checker", "server_settings"))
 
2762
                for name, typ in (inspect.getmembers
 
2763
                                  (dbus.service.Object)):
 
2764
                    exclude.add(name)
 
2765
                
 
2766
                client_dict["encrypted_secret"] = (client
 
2767
                                                   .encrypted_secret)
 
2768
                for attr in client.client_structure:
 
2769
                    if attr not in exclude:
 
2770
                        client_dict[attr] = getattr(client, attr)
 
2771
                
 
2772
                clients[client.name] = client_dict
 
2773
                del client_settings[client.name]["secret"]
 
2774
        
 
2775
        try:
 
2776
            with (tempfile.NamedTemporaryFile
 
2777
                  (mode='wb', suffix=".pickle", prefix='clients-',
 
2778
                   dir=os.path.dirname(stored_state_path),
 
2779
                   delete=False)) as stored_state:
 
2780
                pickle.dump((clients, client_settings), stored_state)
 
2781
                tempname=stored_state.name
 
2782
            os.rename(tempname, stored_state_path)
 
2783
        except (IOError, OSError) as e:
 
2784
            if not debug:
 
2785
                try:
 
2786
                    os.remove(tempname)
 
2787
                except NameError:
 
2788
                    pass
 
2789
            if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
 
2790
                logger.warning("Could not save persistent state: {0}"
 
2791
                               .format(os.strerror(e.errno)))
 
2792
            else:
 
2793
                logger.warning("Could not save persistent state:",
 
2794
                               exc_info=e)
 
2795
                raise e
 
2796
        
 
2797
        # Delete all clients, and settings from config
 
2798
        while tcp_server.clients:
 
2799
            name, client = tcp_server.clients.popitem()
 
2800
            if use_dbus:
 
2801
                client.remove_from_connection()
 
2802
            # Don't signal anything except ClientRemoved
 
2803
            client.disable(quiet=True)
 
2804
            if use_dbus:
 
2805
                # Emit D-Bus signal
 
2806
                mandos_dbus_service.ClientRemoved(client
 
2807
                                                  .dbus_object_path,
 
2808
                                                  client.name)
 
2809
        client_settings.clear()
803
2810
    
804
2811
    atexit.register(cleanup)
805
2812
    
806
 
    if not debug:
807
 
        signal.signal(signal.SIGINT, signal.SIG_IGN)
808
 
    signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
809
 
    signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
810
 
    
811
 
    for client in clients:
812
 
        client.start()
813
 
    
814
 
    tcp_server = IPv6_TCPServer((server_settings["address"],
815
 
                                 server_settings["port"]),
816
 
                                tcp_handler,
817
 
                                settings=server_settings,
818
 
                                clients=clients)
 
2813
    for client in tcp_server.clients.itervalues():
 
2814
        if use_dbus:
 
2815
            # Emit D-Bus signal
 
2816
            mandos_dbus_service.ClientAdded(client.dbus_object_path)
 
2817
        # Need to initiate checking of clients
 
2818
        if client.enabled:
 
2819
            client.init_checker()
 
2820
    
 
2821
    tcp_server.enable()
 
2822
    tcp_server.server_activate()
 
2823
    
819
2824
    # Find out what port we got
820
2825
    service.port = tcp_server.socket.getsockname()[1]
821
 
    logger.info(u"Now listening on address %r, port %d, flowinfo %d,"
822
 
                u" scope_id %d" % tcp_server.socket.getsockname())
 
2826
    if use_ipv6:
 
2827
        logger.info("Now listening on address %r, port %d,"
 
2828
                    " flowinfo %d, scope_id %d",
 
2829
                    *tcp_server.socket.getsockname())
 
2830
    else:                       # IPv4
 
2831
        logger.info("Now listening on address %r, port %d",
 
2832
                    *tcp_server.socket.getsockname())
823
2833
    
824
2834
    #service.interface = tcp_server.socket.getsockname()[3]
825
2835
    
826
2836
    try:
827
2837
        # From the Avahi example code
828
 
        server.connect_to_signal("StateChanged", server_state_changed)
829
2838
        try:
830
 
            server_state_changed(server.GetState())
831
 
        except dbus.exceptions.DBusException, error:
832
 
            logger.critical(u"DBusException: %s", error)
 
2839
            service.activate()
 
2840
        except dbus.exceptions.DBusException as error:
 
2841
            logger.critical("D-Bus Exception", exc_info=error)
 
2842
            cleanup()
833
2843
            sys.exit(1)
834
2844
        # End of Avahi example code
835
2845
        
836
2846
        gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
837
2847
                             lambda *args, **kwargs:
838
 
                             tcp_server.handle_request\
839
 
                             (*args[2:], **kwargs) or True)
 
2848
                             (tcp_server.handle_request
 
2849
                              (*args[2:], **kwargs) or True))
840
2850
        
841
 
        logger.debug(u"Starting main loop")
842
 
        main_loop_started = True
 
2851
        logger.debug("Starting main loop")
843
2852
        main_loop.run()
844
 
    except AvahiError, error:
845
 
        logger.critical(u"AvahiError: %s" + unicode(error))
 
2853
    except AvahiError as error:
 
2854
        logger.critical("Avahi Error", exc_info=error)
 
2855
        cleanup()
846
2856
        sys.exit(1)
847
2857
    except KeyboardInterrupt:
848
2858
        if debug:
849
 
            print
 
2859
            print("", file=sys.stderr)
 
2860
        logger.debug("Server received KeyboardInterrupt")
 
2861
    logger.debug("Server exiting")
 
2862
    # Must run before the D-Bus bus name gets deregistered
 
2863
    cleanup()
850
2864
 
851
2865
if __name__ == '__main__':
852
2866
    main()