/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos

  • Committer: Teddy Hogeborn
  • Date: 2014-02-16 02:42:42 UTC
  • Revision ID: teddy@recompile.se-20140216024242-9wiw1nkxgt7ohovj
Fix running of self-tests.

* debian/control (Build-Depends): Add Python dependencies to
                                  successfully run self-tests.
* debian/copyright: GPLv3 now has its own license file - use it.
* debian/watch: Set PGP signature URL.
* mandos (main): Bug fix: When running self-tests, set exit code.
* mandos-ctl (main): Cosmetic fix; use os.EX_OK instead of plain 0.

Show diffs side-by-side

added added

removed removed

Lines of Context:
mandos
1
1
#!/usr/bin/python
2
 
 
3
 
import SocketServer
 
2
# -*- mode: python; coding: utf-8 -*-
 
3
# 
 
4
# Mandos server - give out binary blobs to connecting clients.
 
5
# 
 
6
# This program is partly derived from an example program for an Avahi
 
7
# service publisher, downloaded from
 
8
# <http://avahi.org/wiki/PythonPublishExample>.  This includes the
 
9
# methods "add", "remove", "server_state_changed",
 
10
# "entry_group_state_changed", "cleanup", and "activate" in the
 
11
# "AvahiService" class, and some lines in "main".
 
12
# 
 
13
# Everything else is
 
14
# Copyright © 2008-2014 Teddy Hogeborn
 
15
# Copyright © 2008-2014 Björn Påhlsson
 
16
# 
 
17
# This program is free software: you can redistribute it and/or modify
 
18
# it under the terms of the GNU General Public License as published by
 
19
# the Free Software Foundation, either version 3 of the License, or
 
20
# (at your option) any later version.
 
21
#
 
22
#     This program is distributed in the hope that it will be useful,
 
23
#     but WITHOUT ANY WARRANTY; without even the implied warranty of
 
24
#     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 
25
#     GNU General Public License for more details.
 
26
# 
 
27
# You should have received a copy of the GNU General Public License
 
28
# along with this program.  If not, see
 
29
# <http://www.gnu.org/licenses/>.
 
30
# 
 
31
# Contact the authors at <mandos@recompile.se>.
 
32
# 
 
33
 
 
34
from __future__ import (division, absolute_import, print_function,
 
35
                        unicode_literals)
 
36
 
 
37
from future_builtins import *
 
38
 
 
39
import SocketServer as socketserver
4
40
import socket
5
 
import select
6
 
from optparse import OptionParser
 
41
import argparse
7
42
import datetime
8
43
import errno
9
44
import gnutls.crypto
10
45
import gnutls.connection
11
46
import gnutls.errors
12
 
import ConfigParser
 
47
import gnutls.library.functions
 
48
import gnutls.library.constants
 
49
import gnutls.library.types
 
50
import ConfigParser as configparser
 
51
import sys
 
52
import re
 
53
import os
 
54
import signal
 
55
import subprocess
 
56
import atexit
 
57
import stat
 
58
import logging
 
59
import logging.handlers
 
60
import pwd
 
61
import contextlib
 
62
import struct
 
63
import fcntl
 
64
import functools
 
65
import cPickle as pickle
 
66
import multiprocessing
 
67
import types
 
68
import binascii
 
69
import tempfile
 
70
import itertools
 
71
import collections
 
72
 
 
73
import dbus
 
74
import dbus.service
 
75
import gobject
 
76
import avahi
 
77
from dbus.mainloop.glib import DBusGMainLoop
 
78
import ctypes
 
79
import ctypes.util
 
80
import xml.dom.minidom
 
81
import inspect
 
82
 
 
83
try:
 
84
    SO_BINDTODEVICE = socket.SO_BINDTODEVICE
 
85
except AttributeError:
 
86
    try:
 
87
        from IN import SO_BINDTODEVICE
 
88
    except ImportError:
 
89
        SO_BINDTODEVICE = None
 
90
 
 
91
version = "1.6.3"
 
92
stored_state_file = "clients.pickle"
 
93
 
 
94
logger = logging.getLogger()
 
95
syslogger = (logging.handlers.SysLogHandler
 
96
             (facility = logging.handlers.SysLogHandler.LOG_DAEMON,
 
97
              address = str("/dev/log")))
 
98
 
 
99
try:
 
100
    if_nametoindex = (ctypes.cdll.LoadLibrary
 
101
                      (ctypes.util.find_library("c"))
 
102
                      .if_nametoindex)
 
103
except (OSError, AttributeError):
 
104
    def if_nametoindex(interface):
 
105
        "Get an interface index the hard way, i.e. using fcntl()"
 
106
        SIOCGIFINDEX = 0x8933  # From /usr/include/linux/sockios.h
 
107
        with contextlib.closing(socket.socket()) as s:
 
108
            ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
 
109
                                struct.pack(str("16s16x"),
 
110
                                            interface))
 
111
        interface_index = struct.unpack(str("I"),
 
112
                                        ifreq[16:20])[0]
 
113
        return interface_index
 
114
 
 
115
 
 
116
def initlogger(debug, level=logging.WARNING):
 
117
    """init logger and add loglevel"""
 
118
    
 
119
    syslogger.setFormatter(logging.Formatter
 
120
                           ('Mandos [%(process)d]: %(levelname)s:'
 
121
                            ' %(message)s'))
 
122
    logger.addHandler(syslogger)
 
123
    
 
124
    if debug:
 
125
        console = logging.StreamHandler()
 
126
        console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
 
127
                                               ' [%(process)d]:'
 
128
                                               ' %(levelname)s:'
 
129
                                               ' %(message)s'))
 
130
        logger.addHandler(console)
 
131
    logger.setLevel(level)
 
132
 
 
133
 
 
134
class PGPError(Exception):
 
135
    """Exception if encryption/decryption fails"""
 
136
    pass
 
137
 
 
138
 
 
139
class PGPEngine(object):
 
140
    """A simple class for OpenPGP symmetric encryption & decryption"""
 
141
    def __init__(self):
 
142
        self.tempdir = tempfile.mkdtemp(prefix="mandos-")
 
143
        self.gnupgargs = ['--batch',
 
144
                          '--home', self.tempdir,
 
145
                          '--force-mdc',
 
146
                          '--quiet',
 
147
                          '--no-use-agent']
 
148
    
 
149
    def __enter__(self):
 
150
        return self
 
151
    
 
152
    def __exit__(self, exc_type, exc_value, traceback):
 
153
        self._cleanup()
 
154
        return False
 
155
    
 
156
    def __del__(self):
 
157
        self._cleanup()
 
158
    
 
159
    def _cleanup(self):
 
160
        if self.tempdir is not None:
 
161
            # Delete contents of tempdir
 
162
            for root, dirs, files in os.walk(self.tempdir,
 
163
                                             topdown = False):
 
164
                for filename in files:
 
165
                    os.remove(os.path.join(root, filename))
 
166
                for dirname in dirs:
 
167
                    os.rmdir(os.path.join(root, dirname))
 
168
            # Remove tempdir
 
169
            os.rmdir(self.tempdir)
 
170
            self.tempdir = None
 
171
    
 
172
    def password_encode(self, password):
 
173
        # Passphrase can not be empty and can not contain newlines or
 
174
        # NUL bytes.  So we prefix it and hex encode it.
 
175
        encoded = b"mandos" + binascii.hexlify(password)
 
176
        if len(encoded) > 2048:
 
177
            # GnuPG can't handle long passwords, so encode differently
 
178
            encoded = (b"mandos" + password.replace(b"\\", b"\\\\")
 
179
                       .replace(b"\n", b"\\n")
 
180
                       .replace(b"\0", b"\\x00"))
 
181
        return encoded
 
182
    
 
183
    def encrypt(self, data, password):
 
184
        passphrase = self.password_encode(password)
 
185
        with tempfile.NamedTemporaryFile(dir=self.tempdir
 
186
                                         ) as passfile:
 
187
            passfile.write(passphrase)
 
188
            passfile.flush()
 
189
            proc = subprocess.Popen(['gpg', '--symmetric',
 
190
                                     '--passphrase-file',
 
191
                                     passfile.name]
 
192
                                    + self.gnupgargs,
 
193
                                    stdin = subprocess.PIPE,
 
194
                                    stdout = subprocess.PIPE,
 
195
                                    stderr = subprocess.PIPE)
 
196
            ciphertext, err = proc.communicate(input = data)
 
197
        if proc.returncode != 0:
 
198
            raise PGPError(err)
 
199
        return ciphertext
 
200
    
 
201
    def decrypt(self, data, password):
 
202
        passphrase = self.password_encode(password)
 
203
        with tempfile.NamedTemporaryFile(dir = self.tempdir
 
204
                                         ) as passfile:
 
205
            passfile.write(passphrase)
 
206
            passfile.flush()
 
207
            proc = subprocess.Popen(['gpg', '--decrypt',
 
208
                                     '--passphrase-file',
 
209
                                     passfile.name]
 
210
                                    + self.gnupgargs,
 
211
                                    stdin = subprocess.PIPE,
 
212
                                    stdout = subprocess.PIPE,
 
213
                                    stderr = subprocess.PIPE)
 
214
            decrypted_plaintext, err = proc.communicate(input
 
215
                                                        = data)
 
216
        if proc.returncode != 0:
 
217
            raise PGPError(err)
 
218
        return decrypted_plaintext
 
219
 
 
220
 
 
221
class AvahiError(Exception):
 
222
    def __init__(self, value, *args, **kwargs):
 
223
        self.value = value
 
224
        super(AvahiError, self).__init__(value, *args, **kwargs)
 
225
    def __unicode__(self):
 
226
        return unicode(repr(self.value))
 
227
 
 
228
class AvahiServiceError(AvahiError):
 
229
    pass
 
230
 
 
231
class AvahiGroupError(AvahiError):
 
232
    pass
 
233
 
 
234
 
 
235
class AvahiService(object):
 
236
    """An Avahi (Zeroconf) service.
 
237
    
 
238
    Attributes:
 
239
    interface: integer; avahi.IF_UNSPEC or an interface index.
 
240
               Used to optionally bind to the specified interface.
 
241
    name: string; Example: 'Mandos'
 
242
    type: string; Example: '_mandos._tcp'.
 
243
     See <https://www.iana.org/assignments/service-names-port-numbers>
 
244
    port: integer; what port to announce
 
245
    TXT: list of strings; TXT record for the service
 
246
    domain: string; Domain to publish on, default to .local if empty.
 
247
    host: string; Host to publish records for, default is localhost
 
248
    max_renames: integer; maximum number of renames
 
249
    rename_count: integer; counter so we only rename after collisions
 
250
                  a sensible number of times
 
251
    group: D-Bus Entry Group
 
252
    server: D-Bus Server
 
253
    bus: dbus.SystemBus()
 
254
    """
 
255
    
 
256
    def __init__(self, interface = avahi.IF_UNSPEC, name = None,
 
257
                 servicetype = None, port = None, TXT = None,
 
258
                 domain = "", host = "", max_renames = 32768,
 
259
                 protocol = avahi.PROTO_UNSPEC, bus = None):
 
260
        self.interface = interface
 
261
        self.name = name
 
262
        self.type = servicetype
 
263
        self.port = port
 
264
        self.TXT = TXT if TXT is not None else []
 
265
        self.domain = domain
 
266
        self.host = host
 
267
        self.rename_count = 0
 
268
        self.max_renames = max_renames
 
269
        self.protocol = protocol
 
270
        self.group = None       # our entry group
 
271
        self.server = None
 
272
        self.bus = bus
 
273
        self.entry_group_state_changed_match = None
 
274
    
 
275
    def rename(self):
 
276
        """Derived from the Avahi example code"""
 
277
        if self.rename_count >= self.max_renames:
 
278
            logger.critical("No suitable Zeroconf service name found"
 
279
                            " after %i retries, exiting.",
 
280
                            self.rename_count)
 
281
            raise AvahiServiceError("Too many renames")
 
282
        self.name = unicode(self.server
 
283
                            .GetAlternativeServiceName(self.name))
 
284
        logger.info("Changing Zeroconf service name to %r ...",
 
285
                    self.name)
 
286
        self.remove()
 
287
        try:
 
288
            self.add()
 
289
        except dbus.exceptions.DBusException as error:
 
290
            logger.critical("D-Bus Exception", exc_info=error)
 
291
            self.cleanup()
 
292
            os._exit(1)
 
293
        self.rename_count += 1
 
294
    
 
295
    def remove(self):
 
296
        """Derived from the Avahi example code"""
 
297
        if self.entry_group_state_changed_match is not None:
 
298
            self.entry_group_state_changed_match.remove()
 
299
            self.entry_group_state_changed_match = None
 
300
        if self.group is not None:
 
301
            self.group.Reset()
 
302
    
 
303
    def add(self):
 
304
        """Derived from the Avahi example code"""
 
305
        self.remove()
 
306
        if self.group is None:
 
307
            self.group = dbus.Interface(
 
308
                self.bus.get_object(avahi.DBUS_NAME,
 
309
                                    self.server.EntryGroupNew()),
 
310
                avahi.DBUS_INTERFACE_ENTRY_GROUP)
 
311
        self.entry_group_state_changed_match = (
 
312
            self.group.connect_to_signal(
 
313
                'StateChanged', self.entry_group_state_changed))
 
314
        logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
 
315
                     self.name, self.type)
 
316
        self.group.AddService(
 
317
            self.interface,
 
318
            self.protocol,
 
319
            dbus.UInt32(0),     # flags
 
320
            self.name, self.type,
 
321
            self.domain, self.host,
 
322
            dbus.UInt16(self.port),
 
323
            avahi.string_array_to_txt_array(self.TXT))
 
324
        self.group.Commit()
 
325
    
 
326
    def entry_group_state_changed(self, state, error):
 
327
        """Derived from the Avahi example code"""
 
328
        logger.debug("Avahi entry group state change: %i", state)
 
329
        
 
330
        if state == avahi.ENTRY_GROUP_ESTABLISHED:
 
331
            logger.debug("Zeroconf service established.")
 
332
        elif state == avahi.ENTRY_GROUP_COLLISION:
 
333
            logger.info("Zeroconf service name collision.")
 
334
            self.rename()
 
335
        elif state == avahi.ENTRY_GROUP_FAILURE:
 
336
            logger.critical("Avahi: Error in group state changed %s",
 
337
                            unicode(error))
 
338
            raise AvahiGroupError("State changed: {0!s}"
 
339
                                  .format(error))
 
340
    
 
341
    def cleanup(self):
 
342
        """Derived from the Avahi example code"""
 
343
        if self.group is not None:
 
344
            try:
 
345
                self.group.Free()
 
346
            except (dbus.exceptions.UnknownMethodException,
 
347
                    dbus.exceptions.DBusException):
 
348
                pass
 
349
            self.group = None
 
350
        self.remove()
 
351
    
 
352
    def server_state_changed(self, state, error=None):
 
353
        """Derived from the Avahi example code"""
 
354
        logger.debug("Avahi server state change: %i", state)
 
355
        bad_states = { avahi.SERVER_INVALID:
 
356
                           "Zeroconf server invalid",
 
357
                       avahi.SERVER_REGISTERING: None,
 
358
                       avahi.SERVER_COLLISION:
 
359
                           "Zeroconf server name collision",
 
360
                       avahi.SERVER_FAILURE:
 
361
                           "Zeroconf server failure" }
 
362
        if state in bad_states:
 
363
            if bad_states[state] is not None:
 
364
                if error is None:
 
365
                    logger.error(bad_states[state])
 
366
                else:
 
367
                    logger.error(bad_states[state] + ": %r", error)
 
368
            self.cleanup()
 
369
        elif state == avahi.SERVER_RUNNING:
 
370
            self.add()
 
371
        else:
 
372
            if error is None:
 
373
                logger.debug("Unknown state: %r", state)
 
374
            else:
 
375
                logger.debug("Unknown state: %r: %r", state, error)
 
376
    
 
377
    def activate(self):
 
378
        """Derived from the Avahi example code"""
 
379
        if self.server is None:
 
380
            self.server = dbus.Interface(
 
381
                self.bus.get_object(avahi.DBUS_NAME,
 
382
                                    avahi.DBUS_PATH_SERVER,
 
383
                                    follow_name_owner_changes=True),
 
384
                avahi.DBUS_INTERFACE_SERVER)
 
385
        self.server.connect_to_signal("StateChanged",
 
386
                                 self.server_state_changed)
 
387
        self.server_state_changed(self.server.GetState())
 
388
 
 
389
 
 
390
class AvahiServiceToSyslog(AvahiService):
 
391
    def rename(self):
 
392
        """Add the new name to the syslog messages"""
 
393
        ret = AvahiService.rename(self)
 
394
        syslogger.setFormatter(logging.Formatter
 
395
                               ('Mandos ({0}) [%(process)d]:'
 
396
                                ' %(levelname)s: %(message)s'
 
397
                                .format(self.name)))
 
398
        return ret
 
399
 
 
400
 
 
401
def timedelta_to_milliseconds(td):
 
402
    "Convert a datetime.timedelta() to milliseconds"
 
403
    return ((td.days * 24 * 60 * 60 * 1000)
 
404
            + (td.seconds * 1000)
 
405
            + (td.microseconds // 1000))
 
406
 
13
407
 
14
408
class Client(object):
15
 
    def __init__(self, name=None, dn=None, password=None,
16
 
                 passfile=None, fqdn=None, timeout=None,
17
 
                 interval=-1):
 
409
    """A representation of a client host served by this server.
 
410
    
 
411
    Attributes:
 
412
    approved:   bool(); 'None' if not yet approved/disapproved
 
413
    approval_delay: datetime.timedelta(); Time to wait for approval
 
414
    approval_duration: datetime.timedelta(); Duration of one approval
 
415
    checker:    subprocess.Popen(); a running checker process used
 
416
                                    to see if the client lives.
 
417
                                    'None' if no process is running.
 
418
    checker_callback_tag: a gobject event source tag, or None
 
419
    checker_command: string; External command which is run to check
 
420
                     if client lives.  %() expansions are done at
 
421
                     runtime with vars(self) as dict, so that for
 
422
                     instance %(name)s can be used in the command.
 
423
    checker_initiator_tag: a gobject event source tag, or None
 
424
    created:    datetime.datetime(); (UTC) object creation
 
425
    client_structure: Object describing what attributes a client has
 
426
                      and is used for storing the client at exit
 
427
    current_checker_command: string; current running checker_command
 
428
    disable_initiator_tag: a gobject event source tag, or None
 
429
    enabled:    bool()
 
430
    fingerprint: string (40 or 32 hexadecimal digits); used to
 
431
                 uniquely identify the client
 
432
    host:       string; available for use by the checker command
 
433
    interval:   datetime.timedelta(); How often to start a new checker
 
434
    last_approval_request: datetime.datetime(); (UTC) or None
 
435
    last_checked_ok: datetime.datetime(); (UTC) or None
 
436
    last_checker_status: integer between 0 and 255 reflecting exit
 
437
                         status of last checker. -1 reflects crashed
 
438
                         checker, -2 means no checker completed yet.
 
439
    last_enabled: datetime.datetime(); (UTC) or None
 
440
    name:       string; from the config file, used in log messages and
 
441
                        D-Bus identifiers
 
442
    secret:     bytestring; sent verbatim (over TLS) to client
 
443
    timeout:    datetime.timedelta(); How long from last_checked_ok
 
444
                                      until this client is disabled
 
445
    extended_timeout:   extra long timeout when secret has been sent
 
446
    runtime_expansions: Allowed attributes for runtime expansion.
 
447
    expires:    datetime.datetime(); time (UTC) when a client will be
 
448
                disabled, or None
 
449
    server_settings: The server_settings dict from main()
 
450
    """
 
451
    
 
452
    runtime_expansions = ("approval_delay", "approval_duration",
 
453
                          "created", "enabled", "expires",
 
454
                          "fingerprint", "host", "interval",
 
455
                          "last_approval_request", "last_checked_ok",
 
456
                          "last_enabled", "name", "timeout")
 
457
    client_defaults = { "timeout": "PT5M",
 
458
                        "extended_timeout": "PT15M",
 
459
                        "interval": "PT2M",
 
460
                        "checker": "fping -q -- %%(host)s",
 
461
                        "host": "",
 
462
                        "approval_delay": "PT0S",
 
463
                        "approval_duration": "PT1S",
 
464
                        "approved_by_default": "True",
 
465
                        "enabled": "True",
 
466
                        }
 
467
    
 
468
    def timeout_milliseconds(self):
 
469
        "Return the 'timeout' attribute in milliseconds"
 
470
        return timedelta_to_milliseconds(self.timeout)
 
471
    
 
472
    def extended_timeout_milliseconds(self):
 
473
        "Return the 'extended_timeout' attribute in milliseconds"
 
474
        return timedelta_to_milliseconds(self.extended_timeout)
 
475
    
 
476
    def interval_milliseconds(self):
 
477
        "Return the 'interval' attribute in milliseconds"
 
478
        return timedelta_to_milliseconds(self.interval)
 
479
    
 
480
    def approval_delay_milliseconds(self):
 
481
        return timedelta_to_milliseconds(self.approval_delay)
 
482
    
 
483
    @staticmethod
 
484
    def config_parser(config):
 
485
        """Construct a new dict of client settings of this form:
 
486
        { client_name: {setting_name: value, ...}, ...}
 
487
        with exceptions for any special settings as defined above.
 
488
        NOTE: Must be a pure function. Must return the same result
 
489
        value given the same arguments.
 
490
        """
 
491
        settings = {}
 
492
        for client_name in config.sections():
 
493
            section = dict(config.items(client_name))
 
494
            client = settings[client_name] = {}
 
495
            
 
496
            client["host"] = section["host"]
 
497
            # Reformat values from string types to Python types
 
498
            client["approved_by_default"] = config.getboolean(
 
499
                client_name, "approved_by_default")
 
500
            client["enabled"] = config.getboolean(client_name,
 
501
                                                  "enabled")
 
502
            
 
503
            client["fingerprint"] = (section["fingerprint"].upper()
 
504
                                     .replace(" ", ""))
 
505
            if "secret" in section:
 
506
                client["secret"] = section["secret"].decode("base64")
 
507
            elif "secfile" in section:
 
508
                with open(os.path.expanduser(os.path.expandvars
 
509
                                             (section["secfile"])),
 
510
                          "rb") as secfile:
 
511
                    client["secret"] = secfile.read()
 
512
            else:
 
513
                raise TypeError("No secret or secfile for section {0}"
 
514
                                .format(section))
 
515
            client["timeout"] = string_to_delta(section["timeout"])
 
516
            client["extended_timeout"] = string_to_delta(
 
517
                section["extended_timeout"])
 
518
            client["interval"] = string_to_delta(section["interval"])
 
519
            client["approval_delay"] = string_to_delta(
 
520
                section["approval_delay"])
 
521
            client["approval_duration"] = string_to_delta(
 
522
                section["approval_duration"])
 
523
            client["checker_command"] = section["checker"]
 
524
            client["last_approval_request"] = None
 
525
            client["last_checked_ok"] = None
 
526
            client["last_checker_status"] = -2
 
527
        
 
528
        return settings
 
529
    
 
530
    def __init__(self, settings, name = None, server_settings=None):
18
531
        self.name = name
19
 
        self.dn = dn
20
 
        if password:
21
 
            self.password = password
22
 
        elif passfile:
23
 
            self.password = open(passfile).readall()
24
 
        else:
25
 
            print "No Password or Passfile in client config file"
26
 
            # raise RuntimeError XXX
27
 
            self.password = "gazonk"
28
 
        self.fqdn = fqdn
29
 
        # self.created = ...
30
 
        self.last_seen = None
 
532
        if server_settings is None:
 
533
            server_settings = {}
 
534
        self.server_settings = server_settings
 
535
        # adding all client settings
 
536
        for setting, value in settings.iteritems():
 
537
            setattr(self, setting, value)
 
538
        
 
539
        if self.enabled:
 
540
            if not hasattr(self, "last_enabled"):
 
541
                self.last_enabled = datetime.datetime.utcnow()
 
542
            if not hasattr(self, "expires"):
 
543
                self.expires = (datetime.datetime.utcnow()
 
544
                                + self.timeout)
 
545
        else:
 
546
            self.last_enabled = None
 
547
            self.expires = None
 
548
        
 
549
        logger.debug("Creating client %r", self.name)
 
550
        # Uppercase and remove spaces from fingerprint for later
 
551
        # comparison purposes with return value from the fingerprint()
 
552
        # function
 
553
        logger.debug("  Fingerprint: %s", self.fingerprint)
 
554
        self.created = settings.get("created",
 
555
                                    datetime.datetime.utcnow())
 
556
        
 
557
        # attributes specific for this server instance
 
558
        self.checker = None
 
559
        self.checker_initiator_tag = None
 
560
        self.disable_initiator_tag = None
 
561
        self.checker_callback_tag = None
 
562
        self.current_checker_command = None
 
563
        self.approved = None
 
564
        self.approvals_pending = 0
 
565
        self.changedstate = (multiprocessing_manager
 
566
                             .Condition(multiprocessing_manager
 
567
                                        .Lock()))
 
568
        self.client_structure = [attr for attr in
 
569
                                 self.__dict__.iterkeys()
 
570
                                 if not attr.startswith("_")]
 
571
        self.client_structure.append("client_structure")
 
572
        
 
573
        for name, t in inspect.getmembers(type(self),
 
574
                                          lambda obj:
 
575
                                              isinstance(obj,
 
576
                                                         property)):
 
577
            if not name.startswith("_"):
 
578
                self.client_structure.append(name)
 
579
    
 
580
    # Send notice to process children that client state has changed
 
581
    def send_changedstate(self):
 
582
        with self.changedstate:
 
583
            self.changedstate.notify_all()
 
584
    
 
585
    def enable(self):
 
586
        """Start this client's checker and timeout hooks"""
 
587
        if getattr(self, "enabled", False):
 
588
            # Already enabled
 
589
            return
 
590
        self.expires = datetime.datetime.utcnow() + self.timeout
 
591
        self.enabled = True
 
592
        self.last_enabled = datetime.datetime.utcnow()
 
593
        self.init_checker()
 
594
        self.send_changedstate()
 
595
    
 
596
    def disable(self, quiet=True):
 
597
        """Disable this client."""
 
598
        if not getattr(self, "enabled", False):
 
599
            return False
 
600
        if not quiet:
 
601
            logger.info("Disabling client %s", self.name)
 
602
        if getattr(self, "disable_initiator_tag", None) is not None:
 
603
            gobject.source_remove(self.disable_initiator_tag)
 
604
            self.disable_initiator_tag = None
 
605
        self.expires = None
 
606
        if getattr(self, "checker_initiator_tag", None) is not None:
 
607
            gobject.source_remove(self.checker_initiator_tag)
 
608
            self.checker_initiator_tag = None
 
609
        self.stop_checker()
 
610
        self.enabled = False
 
611
        if not quiet:
 
612
            self.send_changedstate()
 
613
        # Do not run this again if called by a gobject.timeout_add
 
614
        return False
 
615
    
 
616
    def __del__(self):
 
617
        self.disable()
 
618
    
 
619
    def init_checker(self):
 
620
        # Schedule a new checker to be started an 'interval' from now,
 
621
        # and every interval from then on.
 
622
        if self.checker_initiator_tag is not None:
 
623
            gobject.source_remove(self.checker_initiator_tag)
 
624
        self.checker_initiator_tag = (gobject.timeout_add
 
625
                                      (self.interval_milliseconds(),
 
626
                                       self.start_checker))
 
627
        # Schedule a disable() when 'timeout' has passed
 
628
        if self.disable_initiator_tag is not None:
 
629
            gobject.source_remove(self.disable_initiator_tag)
 
630
        self.disable_initiator_tag = (gobject.timeout_add
 
631
                                   (self.timeout_milliseconds(),
 
632
                                    self.disable))
 
633
        # Also start a new checker *right now*.
 
634
        self.start_checker()
 
635
    
 
636
    def checker_callback(self, pid, condition, command):
 
637
        """The checker has completed, so take appropriate actions."""
 
638
        self.checker_callback_tag = None
 
639
        self.checker = None
 
640
        if os.WIFEXITED(condition):
 
641
            self.last_checker_status = os.WEXITSTATUS(condition)
 
642
            if self.last_checker_status == 0:
 
643
                logger.info("Checker for %(name)s succeeded",
 
644
                            vars(self))
 
645
                self.checked_ok()
 
646
            else:
 
647
                logger.info("Checker for %(name)s failed",
 
648
                            vars(self))
 
649
        else:
 
650
            self.last_checker_status = -1
 
651
            logger.warning("Checker for %(name)s crashed?",
 
652
                           vars(self))
 
653
    
 
654
    def checked_ok(self):
 
655
        """Assert that the client has been seen, alive and well."""
 
656
        self.last_checked_ok = datetime.datetime.utcnow()
 
657
        self.last_checker_status = 0
 
658
        self.bump_timeout()
 
659
    
 
660
    def bump_timeout(self, timeout=None):
 
661
        """Bump up the timeout for this client."""
31
662
        if timeout is None:
32
 
            timeout = self.server.options.timeout
33
 
        self.timeout = timeout
34
 
        if interval == -1:
35
 
            interval = self.server.options.interval
36
 
        self.interval = interval
37
 
 
38
 
def server_bind(self):
39
 
    if self.options.interface:
40
 
        if not hasattr(socket, "SO_BINDTODEVICE"):
41
 
            # From /usr/include/asm-i486/socket.h
42
 
            socket.SO_BINDTODEVICE = 25
43
 
        try:
44
 
            self.socket.setsockopt(socket.SOL_SOCKET,
45
 
                                   socket.SO_BINDTODEVICE,
46
 
                                   self.options.interface)
47
 
        except socket.error, error:
48
 
            if error[0] == errno.EPERM:
49
 
                print "Warning: Denied permission to bind to interface", \
50
 
                      self.options.interface
51
 
            else:
52
 
                raise error
53
 
    return super(type(self), self).server_bind()
54
 
 
55
 
 
56
 
def init_with_options(self, *args, **kwargs):
57
 
    if "options" in kwargs:
58
 
        self.options = kwargs["options"]
59
 
        del kwargs["options"]
60
 
    if "clients" in kwargs:
61
 
        self.clients = kwargs["clients"]
62
 
        del kwargs["clients"]
63
 
    if "credentials" in kwargs:
64
 
        self.credentials = kwargs["credentials"]
65
 
        del kwargs["credentials"]
66
 
    return super(type(self), self).__init__(*args, **kwargs)
67
 
 
68
 
 
69
 
class udp_handler(SocketServer.DatagramRequestHandler, object):
70
 
    def handle(self):
71
 
        self.wfile.write("Polo")
72
 
        print "UDP request answered"
73
 
 
74
 
 
75
 
class IPv6_UDPServer(SocketServer.UDPServer, object):
76
 
    __init__ = init_with_options
77
 
    address_family = socket.AF_INET6
78
 
    allow_reuse_address = True
79
 
    server_bind = server_bind
80
 
    def verify_request(self, request, client_address):
81
 
        print "UDP request came"
82
 
        return request[0] == "Marco"
83
 
 
84
 
 
85
 
class tcp_handler(SocketServer.BaseRequestHandler, object):
86
 
    def handle(self):
87
 
        print "TCP request came"
88
 
        print "Request:", self.request
89
 
        print "Client Address:", self.client_address
90
 
        print "Server:", self.server
91
 
        session = gnutls.connection.ServerSession(self.request,
92
 
                                                  self.server.credentials)
93
 
        session.handshake()
94
 
        if session.peer_certificate:
95
 
            print "DN:", session.peer_certificate.subject
96
 
        try:
97
 
            session.verify_peer()
98
 
        except gnutls.errors.CertificateError, error:
99
 
            print "Verify failed", error
100
 
            session.bye()
101
 
            return
102
 
        try:
103
 
            session.send(dict((client.dn, client.password)
104
 
                              for client in self.server.clients)
105
 
                         [session.peer_certificate.subject])
 
663
            timeout = self.timeout
 
664
        if self.disable_initiator_tag is not None:
 
665
            gobject.source_remove(self.disable_initiator_tag)
 
666
            self.disable_initiator_tag = None
 
667
        if getattr(self, "enabled", False):
 
668
            self.disable_initiator_tag = (gobject.timeout_add
 
669
                                          (timedelta_to_milliseconds
 
670
                                           (timeout), self.disable))
 
671
            self.expires = datetime.datetime.utcnow() + timeout
 
672
    
 
673
    def need_approval(self):
 
674
        self.last_approval_request = datetime.datetime.utcnow()
 
675
    
 
676
    def start_checker(self):
 
677
        """Start a new checker subprocess if one is not running.
 
678
        
 
679
        If a checker already exists, leave it running and do
 
680
        nothing."""
 
681
        # The reason for not killing a running checker is that if we
 
682
        # did that, and if a checker (for some reason) started running
 
683
        # slowly and taking more than 'interval' time, then the client
 
684
        # would inevitably timeout, since no checker would get a
 
685
        # chance to run to completion.  If we instead leave running
 
686
        # checkers alone, the checker would have to take more time
 
687
        # than 'timeout' for the client to be disabled, which is as it
 
688
        # should be.
 
689
        
 
690
        # If a checker exists, make sure it is not a zombie
 
691
        try:
 
692
            pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
 
693
        except AttributeError:
 
694
            pass
 
695
        except OSError as error:
 
696
            if error.errno != errno.ECHILD:
 
697
                raise
 
698
        else:
 
699
            if pid:
 
700
                logger.warning("Checker was a zombie")
 
701
                gobject.source_remove(self.checker_callback_tag)
 
702
                self.checker_callback(pid, status,
 
703
                                      self.current_checker_command)
 
704
        # Start a new checker if needed
 
705
        if self.checker is None:
 
706
            # Escape attributes for the shell
 
707
            escaped_attrs = dict(
 
708
                (attr, re.escape(unicode(getattr(self, attr))))
 
709
                for attr in
 
710
                self.runtime_expansions)
 
711
            try:
 
712
                command = self.checker_command % escaped_attrs
 
713
            except TypeError as error:
 
714
                logger.error('Could not format string "%s"',
 
715
                             self.checker_command, exc_info=error)
 
716
                return True # Try again later
 
717
            self.current_checker_command = command
 
718
            try:
 
719
                logger.info("Starting checker %r for %s",
 
720
                            command, self.name)
 
721
                # We don't need to redirect stdout and stderr, since
 
722
                # in normal mode, that is already done by daemon(),
 
723
                # and in debug mode we don't want to.  (Stdin is
 
724
                # always replaced by /dev/null.)
 
725
                # The exception is when not debugging but nevertheless
 
726
                # running in the foreground; use the previously
 
727
                # created wnull.
 
728
                popen_args = {}
 
729
                if (not self.server_settings["debug"]
 
730
                    and self.server_settings["foreground"]):
 
731
                    popen_args.update({"stdout": wnull,
 
732
                                       "stderr": wnull })
 
733
                self.checker = subprocess.Popen(command,
 
734
                                                close_fds=True,
 
735
                                                shell=True, cwd="/",
 
736
                                                **popen_args)
 
737
            except OSError as error:
 
738
                logger.error("Failed to start subprocess",
 
739
                             exc_info=error)
 
740
                return True
 
741
            self.checker_callback_tag = (gobject.child_watch_add
 
742
                                         (self.checker.pid,
 
743
                                          self.checker_callback,
 
744
                                          data=command))
 
745
            # The checker may have completed before the gobject
 
746
            # watch was added.  Check for this.
 
747
            try:
 
748
                pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
 
749
            except OSError as error:
 
750
                if error.errno == errno.ECHILD:
 
751
                    # This should never happen
 
752
                    logger.error("Child process vanished",
 
753
                                 exc_info=error)
 
754
                    return True
 
755
                raise
 
756
            if pid:
 
757
                gobject.source_remove(self.checker_callback_tag)
 
758
                self.checker_callback(pid, status, command)
 
759
        # Re-run this periodically if run by gobject.timeout_add
 
760
        return True
 
761
    
 
762
    def stop_checker(self):
 
763
        """Force the checker process, if any, to stop."""
 
764
        if self.checker_callback_tag:
 
765
            gobject.source_remove(self.checker_callback_tag)
 
766
            self.checker_callback_tag = None
 
767
        if getattr(self, "checker", None) is None:
 
768
            return
 
769
        logger.debug("Stopping checker for %(name)s", vars(self))
 
770
        try:
 
771
            self.checker.terminate()
 
772
            #time.sleep(0.5)
 
773
            #if self.checker.poll() is None:
 
774
            #    self.checker.kill()
 
775
        except OSError as error:
 
776
            if error.errno != errno.ESRCH: # No such process
 
777
                raise
 
778
        self.checker = None
 
779
 
 
780
 
 
781
def dbus_service_property(dbus_interface, signature="v",
 
782
                          access="readwrite", byte_arrays=False):
 
783
    """Decorators for marking methods of a DBusObjectWithProperties to
 
784
    become properties on the D-Bus.
 
785
    
 
786
    The decorated method will be called with no arguments by "Get"
 
787
    and with one argument by "Set".
 
788
    
 
789
    The parameters, where they are supported, are the same as
 
790
    dbus.service.method, except there is only "signature", since the
 
791
    type from Get() and the type sent to Set() is the same.
 
792
    """
 
793
    # Encoding deeply encoded byte arrays is not supported yet by the
 
794
    # "Set" method, so we fail early here:
 
795
    if byte_arrays and signature != "ay":
 
796
        raise ValueError("Byte arrays not supported for non-'ay'"
 
797
                         " signature {0!r}".format(signature))
 
798
    def decorator(func):
 
799
        func._dbus_is_property = True
 
800
        func._dbus_interface = dbus_interface
 
801
        func._dbus_signature = signature
 
802
        func._dbus_access = access
 
803
        func._dbus_name = func.__name__
 
804
        if func._dbus_name.endswith("_dbus_property"):
 
805
            func._dbus_name = func._dbus_name[:-14]
 
806
        func._dbus_get_args_options = {'byte_arrays': byte_arrays }
 
807
        return func
 
808
    return decorator
 
809
 
 
810
 
 
811
def dbus_interface_annotations(dbus_interface):
 
812
    """Decorator for marking functions returning interface annotations
 
813
    
 
814
    Usage:
 
815
    
 
816
    @dbus_interface_annotations("org.example.Interface")
 
817
    def _foo(self):  # Function name does not matter
 
818
        return {"org.freedesktop.DBus.Deprecated": "true",
 
819
                "org.freedesktop.DBus.Property.EmitsChangedSignal":
 
820
                    "false"}
 
821
    """
 
822
    def decorator(func):
 
823
        func._dbus_is_interface = True
 
824
        func._dbus_interface = dbus_interface
 
825
        func._dbus_name = dbus_interface
 
826
        return func
 
827
    return decorator
 
828
 
 
829
 
 
830
def dbus_annotations(annotations):
 
831
    """Decorator to annotate D-Bus methods, signals or properties
 
832
    Usage:
 
833
    
 
834
    @dbus_service_property("org.example.Interface", signature="b",
 
835
                           access="r")
 
836
    @dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",
 
837
                        "org.freedesktop.DBus.Property."
 
838
                        "EmitsChangedSignal": "false"})
 
839
    def Property_dbus_property(self):
 
840
        return dbus.Boolean(False)
 
841
    """
 
842
    def decorator(func):
 
843
        func._dbus_annotations = annotations
 
844
        return func
 
845
    return decorator
 
846
 
 
847
 
 
848
class DBusPropertyException(dbus.exceptions.DBusException):
 
849
    """A base class for D-Bus property-related exceptions
 
850
    """
 
851
    def __unicode__(self):
 
852
        return unicode(str(self))
 
853
 
 
854
 
 
855
class DBusPropertyAccessException(DBusPropertyException):
 
856
    """A property's access permissions disallows an operation.
 
857
    """
 
858
    pass
 
859
 
 
860
 
 
861
class DBusPropertyNotFound(DBusPropertyException):
 
862
    """An attempt was made to access a non-existing property.
 
863
    """
 
864
    pass
 
865
 
 
866
 
 
867
class DBusObjectWithProperties(dbus.service.Object):
 
868
    """A D-Bus object with properties.
 
869
    
 
870
    Classes inheriting from this can use the dbus_service_property
 
871
    decorator to expose methods as D-Bus properties.  It exposes the
 
872
    standard Get(), Set(), and GetAll() methods on the D-Bus.
 
873
    """
 
874
    
 
875
    @staticmethod
 
876
    def _is_dbus_thing(thing):
 
877
        """Returns a function testing if an attribute is a D-Bus thing
 
878
        
 
879
        If called like _is_dbus_thing("method") it returns a function
 
880
        suitable for use as predicate to inspect.getmembers().
 
881
        """
 
882
        return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),
 
883
                                   False)
 
884
    
 
885
    def _get_all_dbus_things(self, thing):
 
886
        """Returns a generator of (name, attribute) pairs
 
887
        """
 
888
        return ((getattr(athing.__get__(self), "_dbus_name",
 
889
                         name),
 
890
                 athing.__get__(self))
 
891
                for cls in self.__class__.__mro__
 
892
                for name, athing in
 
893
                inspect.getmembers(cls,
 
894
                                   self._is_dbus_thing(thing)))
 
895
    
 
896
    def _get_dbus_property(self, interface_name, property_name):
 
897
        """Returns a bound method if one exists which is a D-Bus
 
898
        property with the specified name and interface.
 
899
        """
 
900
        for cls in  self.__class__.__mro__:
 
901
            for name, value in (inspect.getmembers
 
902
                                (cls,
 
903
                                 self._is_dbus_thing("property"))):
 
904
                if (value._dbus_name == property_name
 
905
                    and value._dbus_interface == interface_name):
 
906
                    return value.__get__(self)
 
907
        
 
908
        # No such property
 
909
        raise DBusPropertyNotFound(self.dbus_object_path + ":"
 
910
                                   + interface_name + "."
 
911
                                   + property_name)
 
912
    
 
913
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
 
914
                         out_signature="v")
 
915
    def Get(self, interface_name, property_name):
 
916
        """Standard D-Bus property Get() method, see D-Bus standard.
 
917
        """
 
918
        prop = self._get_dbus_property(interface_name, property_name)
 
919
        if prop._dbus_access == "write":
 
920
            raise DBusPropertyAccessException(property_name)
 
921
        value = prop()
 
922
        if not hasattr(value, "variant_level"):
 
923
            return value
 
924
        return type(value)(value, variant_level=value.variant_level+1)
 
925
    
 
926
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
 
927
    def Set(self, interface_name, property_name, value):
 
928
        """Standard D-Bus property Set() method, see D-Bus standard.
 
929
        """
 
930
        prop = self._get_dbus_property(interface_name, property_name)
 
931
        if prop._dbus_access == "read":
 
932
            raise DBusPropertyAccessException(property_name)
 
933
        if prop._dbus_get_args_options["byte_arrays"]:
 
934
            # The byte_arrays option is not supported yet on
 
935
            # signatures other than "ay".
 
936
            if prop._dbus_signature != "ay":
 
937
                raise ValueError("Byte arrays not supported for non-"
 
938
                                 "'ay' signature {0!r}"
 
939
                                 .format(prop._dbus_signature))
 
940
            value = dbus.ByteArray(b''.join(chr(byte)
 
941
                                            for byte in value))
 
942
        prop(value)
 
943
    
 
944
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
 
945
                         out_signature="a{sv}")
 
946
    def GetAll(self, interface_name):
 
947
        """Standard D-Bus property GetAll() method, see D-Bus
 
948
        standard.
 
949
        
 
950
        Note: Will not include properties with access="write".
 
951
        """
 
952
        properties = {}
 
953
        for name, prop in self._get_all_dbus_things("property"):
 
954
            if (interface_name
 
955
                and interface_name != prop._dbus_interface):
 
956
                # Interface non-empty but did not match
 
957
                continue
 
958
            # Ignore write-only properties
 
959
            if prop._dbus_access == "write":
 
960
                continue
 
961
            value = prop()
 
962
            if not hasattr(value, "variant_level"):
 
963
                properties[name] = value
 
964
                continue
 
965
            properties[name] = type(value)(value, variant_level=
 
966
                                           value.variant_level+1)
 
967
        return dbus.Dictionary(properties, signature="sv")
 
968
    
 
969
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
 
970
                         out_signature="s",
 
971
                         path_keyword='object_path',
 
972
                         connection_keyword='connection')
 
973
    def Introspect(self, object_path, connection):
 
974
        """Overloading of standard D-Bus method.
 
975
        
 
976
        Inserts property tags and interface annotation tags.
 
977
        """
 
978
        xmlstring = dbus.service.Object.Introspect(self, object_path,
 
979
                                                   connection)
 
980
        try:
 
981
            document = xml.dom.minidom.parseString(xmlstring)
 
982
            def make_tag(document, name, prop):
 
983
                e = document.createElement("property")
 
984
                e.setAttribute("name", name)
 
985
                e.setAttribute("type", prop._dbus_signature)
 
986
                e.setAttribute("access", prop._dbus_access)
 
987
                return e
 
988
            for if_tag in document.getElementsByTagName("interface"):
 
989
                # Add property tags
 
990
                for tag in (make_tag(document, name, prop)
 
991
                            for name, prop
 
992
                            in self._get_all_dbus_things("property")
 
993
                            if prop._dbus_interface
 
994
                            == if_tag.getAttribute("name")):
 
995
                    if_tag.appendChild(tag)
 
996
                # Add annotation tags
 
997
                for typ in ("method", "signal", "property"):
 
998
                    for tag in if_tag.getElementsByTagName(typ):
 
999
                        annots = dict()
 
1000
                        for name, prop in (self.
 
1001
                                           _get_all_dbus_things(typ)):
 
1002
                            if (name == tag.getAttribute("name")
 
1003
                                and prop._dbus_interface
 
1004
                                == if_tag.getAttribute("name")):
 
1005
                                annots.update(getattr
 
1006
                                              (prop,
 
1007
                                               "_dbus_annotations",
 
1008
                                               {}))
 
1009
                        for name, value in annots.iteritems():
 
1010
                            ann_tag = document.createElement(
 
1011
                                "annotation")
 
1012
                            ann_tag.setAttribute("name", name)
 
1013
                            ann_tag.setAttribute("value", value)
 
1014
                            tag.appendChild(ann_tag)
 
1015
                # Add interface annotation tags
 
1016
                for annotation, value in dict(
 
1017
                    itertools.chain.from_iterable(
 
1018
                        annotations().iteritems()
 
1019
                        for name, annotations in
 
1020
                        self._get_all_dbus_things("interface")
 
1021
                        if name == if_tag.getAttribute("name")
 
1022
                        )).iteritems():
 
1023
                    ann_tag = document.createElement("annotation")
 
1024
                    ann_tag.setAttribute("name", annotation)
 
1025
                    ann_tag.setAttribute("value", value)
 
1026
                    if_tag.appendChild(ann_tag)
 
1027
                # Add the names to the return values for the
 
1028
                # "org.freedesktop.DBus.Properties" methods
 
1029
                if (if_tag.getAttribute("name")
 
1030
                    == "org.freedesktop.DBus.Properties"):
 
1031
                    for cn in if_tag.getElementsByTagName("method"):
 
1032
                        if cn.getAttribute("name") == "Get":
 
1033
                            for arg in cn.getElementsByTagName("arg"):
 
1034
                                if (arg.getAttribute("direction")
 
1035
                                    == "out"):
 
1036
                                    arg.setAttribute("name", "value")
 
1037
                        elif cn.getAttribute("name") == "GetAll":
 
1038
                            for arg in cn.getElementsByTagName("arg"):
 
1039
                                if (arg.getAttribute("direction")
 
1040
                                    == "out"):
 
1041
                                    arg.setAttribute("name", "props")
 
1042
            xmlstring = document.toxml("utf-8")
 
1043
            document.unlink()
 
1044
        except (AttributeError, xml.dom.DOMException,
 
1045
                xml.parsers.expat.ExpatError) as error:
 
1046
            logger.error("Failed to override Introspection method",
 
1047
                         exc_info=error)
 
1048
        return xmlstring
 
1049
 
 
1050
 
 
1051
def datetime_to_dbus(dt, variant_level=0):
 
1052
    """Convert a UTC datetime.datetime() to a D-Bus type."""
 
1053
    if dt is None:
 
1054
        return dbus.String("", variant_level = variant_level)
 
1055
    return dbus.String(dt.isoformat(),
 
1056
                       variant_level=variant_level)
 
1057
 
 
1058
 
 
1059
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
 
1060
    """A class decorator; applied to a subclass of
 
1061
    dbus.service.Object, it will add alternate D-Bus attributes with
 
1062
    interface names according to the "alt_interface_names" mapping.
 
1063
    Usage:
 
1064
    
 
1065
    @alternate_dbus_interfaces({"org.example.Interface":
 
1066
                                    "net.example.AlternateInterface"})
 
1067
    class SampleDBusObject(dbus.service.Object):
 
1068
        @dbus.service.method("org.example.Interface")
 
1069
        def SampleDBusMethod():
 
1070
            pass
 
1071
    
 
1072
    The above "SampleDBusMethod" on "SampleDBusObject" will be
 
1073
    reachable via two interfaces: "org.example.Interface" and
 
1074
    "net.example.AlternateInterface", the latter of which will have
 
1075
    its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
 
1076
    "true", unless "deprecate" is passed with a False value.
 
1077
    
 
1078
    This works for methods and signals, and also for D-Bus properties
 
1079
    (from DBusObjectWithProperties) and interfaces (from the
 
1080
    dbus_interface_annotations decorator).
 
1081
    """
 
1082
    def wrapper(cls):
 
1083
        for orig_interface_name, alt_interface_name in (
 
1084
            alt_interface_names.iteritems()):
 
1085
            attr = {}
 
1086
            interface_names = set()
 
1087
            # Go though all attributes of the class
 
1088
            for attrname, attribute in inspect.getmembers(cls):
 
1089
                # Ignore non-D-Bus attributes, and D-Bus attributes
 
1090
                # with the wrong interface name
 
1091
                if (not hasattr(attribute, "_dbus_interface")
 
1092
                    or not attribute._dbus_interface
 
1093
                    .startswith(orig_interface_name)):
 
1094
                    continue
 
1095
                # Create an alternate D-Bus interface name based on
 
1096
                # the current name
 
1097
                alt_interface = (attribute._dbus_interface
 
1098
                                 .replace(orig_interface_name,
 
1099
                                          alt_interface_name))
 
1100
                interface_names.add(alt_interface)
 
1101
                # Is this a D-Bus signal?
 
1102
                if getattr(attribute, "_dbus_is_signal", False):
 
1103
                    # Extract the original non-method undecorated
 
1104
                    # function by black magic
 
1105
                    nonmethod_func = (dict(
 
1106
                            zip(attribute.func_code.co_freevars,
 
1107
                                attribute.__closure__))["func"]
 
1108
                                      .cell_contents)
 
1109
                    # Create a new, but exactly alike, function
 
1110
                    # object, and decorate it to be a new D-Bus signal
 
1111
                    # with the alternate D-Bus interface name
 
1112
                    new_function = (dbus.service.signal
 
1113
                                    (alt_interface,
 
1114
                                     attribute._dbus_signature)
 
1115
                                    (types.FunctionType(
 
1116
                                nonmethod_func.func_code,
 
1117
                                nonmethod_func.func_globals,
 
1118
                                nonmethod_func.func_name,
 
1119
                                nonmethod_func.func_defaults,
 
1120
                                nonmethod_func.func_closure)))
 
1121
                    # Copy annotations, if any
 
1122
                    try:
 
1123
                        new_function._dbus_annotations = (
 
1124
                            dict(attribute._dbus_annotations))
 
1125
                    except AttributeError:
 
1126
                        pass
 
1127
                    # Define a creator of a function to call both the
 
1128
                    # original and alternate functions, so both the
 
1129
                    # original and alternate signals gets sent when
 
1130
                    # the function is called
 
1131
                    def fixscope(func1, func2):
 
1132
                        """This function is a scope container to pass
 
1133
                        func1 and func2 to the "call_both" function
 
1134
                        outside of its arguments"""
 
1135
                        def call_both(*args, **kwargs):
 
1136
                            """This function will emit two D-Bus
 
1137
                            signals by calling func1 and func2"""
 
1138
                            func1(*args, **kwargs)
 
1139
                            func2(*args, **kwargs)
 
1140
                        return call_both
 
1141
                    # Create the "call_both" function and add it to
 
1142
                    # the class
 
1143
                    attr[attrname] = fixscope(attribute, new_function)
 
1144
                # Is this a D-Bus method?
 
1145
                elif getattr(attribute, "_dbus_is_method", False):
 
1146
                    # Create a new, but exactly alike, function
 
1147
                    # object.  Decorate it to be a new D-Bus method
 
1148
                    # with the alternate D-Bus interface name.  Add it
 
1149
                    # to the class.
 
1150
                    attr[attrname] = (dbus.service.method
 
1151
                                      (alt_interface,
 
1152
                                       attribute._dbus_in_signature,
 
1153
                                       attribute._dbus_out_signature)
 
1154
                                      (types.FunctionType
 
1155
                                       (attribute.func_code,
 
1156
                                        attribute.func_globals,
 
1157
                                        attribute.func_name,
 
1158
                                        attribute.func_defaults,
 
1159
                                        attribute.func_closure)))
 
1160
                    # Copy annotations, if any
 
1161
                    try:
 
1162
                        attr[attrname]._dbus_annotations = (
 
1163
                            dict(attribute._dbus_annotations))
 
1164
                    except AttributeError:
 
1165
                        pass
 
1166
                # Is this a D-Bus property?
 
1167
                elif getattr(attribute, "_dbus_is_property", False):
 
1168
                    # Create a new, but exactly alike, function
 
1169
                    # object, and decorate it to be a new D-Bus
 
1170
                    # property with the alternate D-Bus interface
 
1171
                    # name.  Add it to the class.
 
1172
                    attr[attrname] = (dbus_service_property
 
1173
                                      (alt_interface,
 
1174
                                       attribute._dbus_signature,
 
1175
                                       attribute._dbus_access,
 
1176
                                       attribute
 
1177
                                       ._dbus_get_args_options
 
1178
                                       ["byte_arrays"])
 
1179
                                      (types.FunctionType
 
1180
                                       (attribute.func_code,
 
1181
                                        attribute.func_globals,
 
1182
                                        attribute.func_name,
 
1183
                                        attribute.func_defaults,
 
1184
                                        attribute.func_closure)))
 
1185
                    # Copy annotations, if any
 
1186
                    try:
 
1187
                        attr[attrname]._dbus_annotations = (
 
1188
                            dict(attribute._dbus_annotations))
 
1189
                    except AttributeError:
 
1190
                        pass
 
1191
                # Is this a D-Bus interface?
 
1192
                elif getattr(attribute, "_dbus_is_interface", False):
 
1193
                    # Create a new, but exactly alike, function
 
1194
                    # object.  Decorate it to be a new D-Bus interface
 
1195
                    # with the alternate D-Bus interface name.  Add it
 
1196
                    # to the class.
 
1197
                    attr[attrname] = (dbus_interface_annotations
 
1198
                                      (alt_interface)
 
1199
                                      (types.FunctionType
 
1200
                                       (attribute.func_code,
 
1201
                                        attribute.func_globals,
 
1202
                                        attribute.func_name,
 
1203
                                        attribute.func_defaults,
 
1204
                                        attribute.func_closure)))
 
1205
            if deprecate:
 
1206
                # Deprecate all alternate interfaces
 
1207
                iname="_AlternateDBusNames_interface_annotation{0}"
 
1208
                for interface_name in interface_names:
 
1209
                    @dbus_interface_annotations(interface_name)
 
1210
                    def func(self):
 
1211
                        return { "org.freedesktop.DBus.Deprecated":
 
1212
                                     "true" }
 
1213
                    # Find an unused name
 
1214
                    for aname in (iname.format(i)
 
1215
                                  for i in itertools.count()):
 
1216
                        if aname not in attr:
 
1217
                            attr[aname] = func
 
1218
                            break
 
1219
            if interface_names:
 
1220
                # Replace the class with a new subclass of it with
 
1221
                # methods, signals, etc. as created above.
 
1222
                cls = type(b"{0}Alternate".format(cls.__name__),
 
1223
                           (cls,), attr)
 
1224
        return cls
 
1225
    return wrapper
 
1226
 
 
1227
 
 
1228
@alternate_dbus_interfaces({"se.recompile.Mandos":
 
1229
                                "se.bsnet.fukt.Mandos"})
 
1230
class ClientDBus(Client, DBusObjectWithProperties):
 
1231
    """A Client class using D-Bus
 
1232
    
 
1233
    Attributes:
 
1234
    dbus_object_path: dbus.ObjectPath
 
1235
    bus: dbus.SystemBus()
 
1236
    """
 
1237
    
 
1238
    runtime_expansions = (Client.runtime_expansions
 
1239
                          + ("dbus_object_path",))
 
1240
    
 
1241
    # dbus.service.Object doesn't use super(), so we can't either.
 
1242
    
 
1243
    def __init__(self, bus = None, *args, **kwargs):
 
1244
        self.bus = bus
 
1245
        Client.__init__(self, *args, **kwargs)
 
1246
        # Only now, when this client is initialized, can it show up on
 
1247
        # the D-Bus
 
1248
        client_object_name = unicode(self.name).translate(
 
1249
            {ord("."): ord("_"),
 
1250
             ord("-"): ord("_")})
 
1251
        self.dbus_object_path = (dbus.ObjectPath
 
1252
                                 ("/clients/" + client_object_name))
 
1253
        DBusObjectWithProperties.__init__(self, self.bus,
 
1254
                                          self.dbus_object_path)
 
1255
    
 
1256
    def notifychangeproperty(transform_func,
 
1257
                             dbus_name, type_func=lambda x: x,
 
1258
                             variant_level=1):
 
1259
        """ Modify a variable so that it's a property which announces
 
1260
        its changes to DBus.
 
1261
        
 
1262
        transform_fun: Function that takes a value and a variant_level
 
1263
                       and transforms it to a D-Bus type.
 
1264
        dbus_name: D-Bus name of the variable
 
1265
        type_func: Function that transform the value before sending it
 
1266
                   to the D-Bus.  Default: no transform
 
1267
        variant_level: D-Bus variant level.  Default: 1
 
1268
        """
 
1269
        attrname = "_{0}".format(dbus_name)
 
1270
        def setter(self, value):
 
1271
            if hasattr(self, "dbus_object_path"):
 
1272
                if (not hasattr(self, attrname) or
 
1273
                    type_func(getattr(self, attrname, None))
 
1274
                    != type_func(value)):
 
1275
                    dbus_value = transform_func(type_func(value),
 
1276
                                                variant_level
 
1277
                                                =variant_level)
 
1278
                    self.PropertyChanged(dbus.String(dbus_name),
 
1279
                                         dbus_value)
 
1280
            setattr(self, attrname, value)
 
1281
        
 
1282
        return property(lambda self: getattr(self, attrname), setter)
 
1283
    
 
1284
    expires = notifychangeproperty(datetime_to_dbus, "Expires")
 
1285
    approvals_pending = notifychangeproperty(dbus.Boolean,
 
1286
                                             "ApprovalPending",
 
1287
                                             type_func = bool)
 
1288
    enabled = notifychangeproperty(dbus.Boolean, "Enabled")
 
1289
    last_enabled = notifychangeproperty(datetime_to_dbus,
 
1290
                                        "LastEnabled")
 
1291
    checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",
 
1292
                                   type_func = lambda checker:
 
1293
                                       checker is not None)
 
1294
    last_checked_ok = notifychangeproperty(datetime_to_dbus,
 
1295
                                           "LastCheckedOK")
 
1296
    last_checker_status = notifychangeproperty(dbus.Int16,
 
1297
                                               "LastCheckerStatus")
 
1298
    last_approval_request = notifychangeproperty(
 
1299
        datetime_to_dbus, "LastApprovalRequest")
 
1300
    approved_by_default = notifychangeproperty(dbus.Boolean,
 
1301
                                               "ApprovedByDefault")
 
1302
    approval_delay = notifychangeproperty(dbus.UInt64,
 
1303
                                          "ApprovalDelay",
 
1304
                                          type_func =
 
1305
                                          timedelta_to_milliseconds)
 
1306
    approval_duration = notifychangeproperty(
 
1307
        dbus.UInt64, "ApprovalDuration",
 
1308
        type_func = timedelta_to_milliseconds)
 
1309
    host = notifychangeproperty(dbus.String, "Host")
 
1310
    timeout = notifychangeproperty(dbus.UInt64, "Timeout",
 
1311
                                   type_func =
 
1312
                                   timedelta_to_milliseconds)
 
1313
    extended_timeout = notifychangeproperty(
 
1314
        dbus.UInt64, "ExtendedTimeout",
 
1315
        type_func = timedelta_to_milliseconds)
 
1316
    interval = notifychangeproperty(dbus.UInt64,
 
1317
                                    "Interval",
 
1318
                                    type_func =
 
1319
                                    timedelta_to_milliseconds)
 
1320
    checker_command = notifychangeproperty(dbus.String, "Checker")
 
1321
    
 
1322
    del notifychangeproperty
 
1323
    
 
1324
    def __del__(self, *args, **kwargs):
 
1325
        try:
 
1326
            self.remove_from_connection()
 
1327
        except LookupError:
 
1328
            pass
 
1329
        if hasattr(DBusObjectWithProperties, "__del__"):
 
1330
            DBusObjectWithProperties.__del__(self, *args, **kwargs)
 
1331
        Client.__del__(self, *args, **kwargs)
 
1332
    
 
1333
    def checker_callback(self, pid, condition, command,
 
1334
                         *args, **kwargs):
 
1335
        self.checker_callback_tag = None
 
1336
        self.checker = None
 
1337
        if os.WIFEXITED(condition):
 
1338
            exitstatus = os.WEXITSTATUS(condition)
 
1339
            # Emit D-Bus signal
 
1340
            self.CheckerCompleted(dbus.Int16(exitstatus),
 
1341
                                  dbus.Int64(condition),
 
1342
                                  dbus.String(command))
 
1343
        else:
 
1344
            # Emit D-Bus signal
 
1345
            self.CheckerCompleted(dbus.Int16(-1),
 
1346
                                  dbus.Int64(condition),
 
1347
                                  dbus.String(command))
 
1348
        
 
1349
        return Client.checker_callback(self, pid, condition, command,
 
1350
                                       *args, **kwargs)
 
1351
    
 
1352
    def start_checker(self, *args, **kwargs):
 
1353
        old_checker = self.checker
 
1354
        if self.checker is not None:
 
1355
            old_checker_pid = self.checker.pid
 
1356
        else:
 
1357
            old_checker_pid = None
 
1358
        r = Client.start_checker(self, *args, **kwargs)
 
1359
        # Only if new checker process was started
 
1360
        if (self.checker is not None
 
1361
            and old_checker_pid != self.checker.pid):
 
1362
            # Emit D-Bus signal
 
1363
            self.CheckerStarted(self.current_checker_command)
 
1364
        return r
 
1365
    
 
1366
    def _reset_approved(self):
 
1367
        self.approved = None
 
1368
        return False
 
1369
    
 
1370
    def approve(self, value=True):
 
1371
        self.approved = value
 
1372
        gobject.timeout_add(timedelta_to_milliseconds
 
1373
                            (self.approval_duration),
 
1374
                            self._reset_approved)
 
1375
        self.send_changedstate()
 
1376
    
 
1377
    ## D-Bus methods, signals & properties
 
1378
    _interface = "se.recompile.Mandos.Client"
 
1379
    
 
1380
    ## Interfaces
 
1381
    
 
1382
    @dbus_interface_annotations(_interface)
 
1383
    def _foo(self):
 
1384
        return { "org.freedesktop.DBus.Property.EmitsChangedSignal":
 
1385
                     "false"}
 
1386
    
 
1387
    ## Signals
 
1388
    
 
1389
    # CheckerCompleted - signal
 
1390
    @dbus.service.signal(_interface, signature="nxs")
 
1391
    def CheckerCompleted(self, exitcode, waitstatus, command):
 
1392
        "D-Bus signal"
 
1393
        pass
 
1394
    
 
1395
    # CheckerStarted - signal
 
1396
    @dbus.service.signal(_interface, signature="s")
 
1397
    def CheckerStarted(self, command):
 
1398
        "D-Bus signal"
 
1399
        pass
 
1400
    
 
1401
    # PropertyChanged - signal
 
1402
    @dbus.service.signal(_interface, signature="sv")
 
1403
    def PropertyChanged(self, property, value):
 
1404
        "D-Bus signal"
 
1405
        pass
 
1406
    
 
1407
    # GotSecret - signal
 
1408
    @dbus.service.signal(_interface)
 
1409
    def GotSecret(self):
 
1410
        """D-Bus signal
 
1411
        Is sent after a successful transfer of secret from the Mandos
 
1412
        server to mandos-client
 
1413
        """
 
1414
        pass
 
1415
    
 
1416
    # Rejected - signal
 
1417
    @dbus.service.signal(_interface, signature="s")
 
1418
    def Rejected(self, reason):
 
1419
        "D-Bus signal"
 
1420
        pass
 
1421
    
 
1422
    # NeedApproval - signal
 
1423
    @dbus.service.signal(_interface, signature="tb")
 
1424
    def NeedApproval(self, timeout, default):
 
1425
        "D-Bus signal"
 
1426
        return self.need_approval()
 
1427
    
 
1428
    ## Methods
 
1429
    
 
1430
    # Approve - method
 
1431
    @dbus.service.method(_interface, in_signature="b")
 
1432
    def Approve(self, value):
 
1433
        self.approve(value)
 
1434
    
 
1435
    # CheckedOK - method
 
1436
    @dbus.service.method(_interface)
 
1437
    def CheckedOK(self):
 
1438
        self.checked_ok()
 
1439
    
 
1440
    # Enable - method
 
1441
    @dbus.service.method(_interface)
 
1442
    def Enable(self):
 
1443
        "D-Bus method"
 
1444
        self.enable()
 
1445
    
 
1446
    # StartChecker - method
 
1447
    @dbus.service.method(_interface)
 
1448
    def StartChecker(self):
 
1449
        "D-Bus method"
 
1450
        self.start_checker()
 
1451
    
 
1452
    # Disable - method
 
1453
    @dbus.service.method(_interface)
 
1454
    def Disable(self):
 
1455
        "D-Bus method"
 
1456
        self.disable()
 
1457
    
 
1458
    # StopChecker - method
 
1459
    @dbus.service.method(_interface)
 
1460
    def StopChecker(self):
 
1461
        self.stop_checker()
 
1462
    
 
1463
    ## Properties
 
1464
    
 
1465
    # ApprovalPending - property
 
1466
    @dbus_service_property(_interface, signature="b", access="read")
 
1467
    def ApprovalPending_dbus_property(self):
 
1468
        return dbus.Boolean(bool(self.approvals_pending))
 
1469
    
 
1470
    # ApprovedByDefault - property
 
1471
    @dbus_service_property(_interface, signature="b",
 
1472
                           access="readwrite")
 
1473
    def ApprovedByDefault_dbus_property(self, value=None):
 
1474
        if value is None:       # get
 
1475
            return dbus.Boolean(self.approved_by_default)
 
1476
        self.approved_by_default = bool(value)
 
1477
    
 
1478
    # ApprovalDelay - property
 
1479
    @dbus_service_property(_interface, signature="t",
 
1480
                           access="readwrite")
 
1481
    def ApprovalDelay_dbus_property(self, value=None):
 
1482
        if value is None:       # get
 
1483
            return dbus.UInt64(self.approval_delay_milliseconds())
 
1484
        self.approval_delay = datetime.timedelta(0, 0, 0, value)
 
1485
    
 
1486
    # ApprovalDuration - property
 
1487
    @dbus_service_property(_interface, signature="t",
 
1488
                           access="readwrite")
 
1489
    def ApprovalDuration_dbus_property(self, value=None):
 
1490
        if value is None:       # get
 
1491
            return dbus.UInt64(timedelta_to_milliseconds(
 
1492
                    self.approval_duration))
 
1493
        self.approval_duration = datetime.timedelta(0, 0, 0, value)
 
1494
    
 
1495
    # Name - property
 
1496
    @dbus_service_property(_interface, signature="s", access="read")
 
1497
    def Name_dbus_property(self):
 
1498
        return dbus.String(self.name)
 
1499
    
 
1500
    # Fingerprint - property
 
1501
    @dbus_service_property(_interface, signature="s", access="read")
 
1502
    def Fingerprint_dbus_property(self):
 
1503
        return dbus.String(self.fingerprint)
 
1504
    
 
1505
    # Host - property
 
1506
    @dbus_service_property(_interface, signature="s",
 
1507
                           access="readwrite")
 
1508
    def Host_dbus_property(self, value=None):
 
1509
        if value is None:       # get
 
1510
            return dbus.String(self.host)
 
1511
        self.host = unicode(value)
 
1512
    
 
1513
    # Created - property
 
1514
    @dbus_service_property(_interface, signature="s", access="read")
 
1515
    def Created_dbus_property(self):
 
1516
        return datetime_to_dbus(self.created)
 
1517
    
 
1518
    # LastEnabled - property
 
1519
    @dbus_service_property(_interface, signature="s", access="read")
 
1520
    def LastEnabled_dbus_property(self):
 
1521
        return datetime_to_dbus(self.last_enabled)
 
1522
    
 
1523
    # Enabled - property
 
1524
    @dbus_service_property(_interface, signature="b",
 
1525
                           access="readwrite")
 
1526
    def Enabled_dbus_property(self, value=None):
 
1527
        if value is None:       # get
 
1528
            return dbus.Boolean(self.enabled)
 
1529
        if value:
 
1530
            self.enable()
 
1531
        else:
 
1532
            self.disable()
 
1533
    
 
1534
    # LastCheckedOK - property
 
1535
    @dbus_service_property(_interface, signature="s",
 
1536
                           access="readwrite")
 
1537
    def LastCheckedOK_dbus_property(self, value=None):
 
1538
        if value is not None:
 
1539
            self.checked_ok()
 
1540
            return
 
1541
        return datetime_to_dbus(self.last_checked_ok)
 
1542
    
 
1543
    # LastCheckerStatus - property
 
1544
    @dbus_service_property(_interface, signature="n",
 
1545
                           access="read")
 
1546
    def LastCheckerStatus_dbus_property(self):
 
1547
        return dbus.Int16(self.last_checker_status)
 
1548
    
 
1549
    # Expires - property
 
1550
    @dbus_service_property(_interface, signature="s", access="read")
 
1551
    def Expires_dbus_property(self):
 
1552
        return datetime_to_dbus(self.expires)
 
1553
    
 
1554
    # LastApprovalRequest - property
 
1555
    @dbus_service_property(_interface, signature="s", access="read")
 
1556
    def LastApprovalRequest_dbus_property(self):
 
1557
        return datetime_to_dbus(self.last_approval_request)
 
1558
    
 
1559
    # Timeout - property
 
1560
    @dbus_service_property(_interface, signature="t",
 
1561
                           access="readwrite")
 
1562
    def Timeout_dbus_property(self, value=None):
 
1563
        if value is None:       # get
 
1564
            return dbus.UInt64(self.timeout_milliseconds())
 
1565
        old_timeout = self.timeout
 
1566
        self.timeout = datetime.timedelta(0, 0, 0, value)
 
1567
        # Reschedule disabling
 
1568
        if self.enabled:
 
1569
            now = datetime.datetime.utcnow()
 
1570
            self.expires += self.timeout - old_timeout
 
1571
            if self.expires <= now:
 
1572
                # The timeout has passed
 
1573
                self.disable()
 
1574
            else:
 
1575
                if (getattr(self, "disable_initiator_tag", None)
 
1576
                    is None):
 
1577
                    return
 
1578
                gobject.source_remove(self.disable_initiator_tag)
 
1579
                self.disable_initiator_tag = (
 
1580
                    gobject.timeout_add(
 
1581
                        timedelta_to_milliseconds(self.expires - now),
 
1582
                        self.disable))
 
1583
    
 
1584
    # ExtendedTimeout - property
 
1585
    @dbus_service_property(_interface, signature="t",
 
1586
                           access="readwrite")
 
1587
    def ExtendedTimeout_dbus_property(self, value=None):
 
1588
        if value is None:       # get
 
1589
            return dbus.UInt64(self.extended_timeout_milliseconds())
 
1590
        self.extended_timeout = datetime.timedelta(0, 0, 0, value)
 
1591
    
 
1592
    # Interval - property
 
1593
    @dbus_service_property(_interface, signature="t",
 
1594
                           access="readwrite")
 
1595
    def Interval_dbus_property(self, value=None):
 
1596
        if value is None:       # get
 
1597
            return dbus.UInt64(self.interval_milliseconds())
 
1598
        self.interval = datetime.timedelta(0, 0, 0, value)
 
1599
        if getattr(self, "checker_initiator_tag", None) is None:
 
1600
            return
 
1601
        if self.enabled:
 
1602
            # Reschedule checker run
 
1603
            gobject.source_remove(self.checker_initiator_tag)
 
1604
            self.checker_initiator_tag = (gobject.timeout_add
 
1605
                                          (value, self.start_checker))
 
1606
            self.start_checker()    # Start one now, too
 
1607
    
 
1608
    # Checker - property
 
1609
    @dbus_service_property(_interface, signature="s",
 
1610
                           access="readwrite")
 
1611
    def Checker_dbus_property(self, value=None):
 
1612
        if value is None:       # get
 
1613
            return dbus.String(self.checker_command)
 
1614
        self.checker_command = unicode(value)
 
1615
    
 
1616
    # CheckerRunning - property
 
1617
    @dbus_service_property(_interface, signature="b",
 
1618
                           access="readwrite")
 
1619
    def CheckerRunning_dbus_property(self, value=None):
 
1620
        if value is None:       # get
 
1621
            return dbus.Boolean(self.checker is not None)
 
1622
        if value:
 
1623
            self.start_checker()
 
1624
        else:
 
1625
            self.stop_checker()
 
1626
    
 
1627
    # ObjectPath - property
 
1628
    @dbus_service_property(_interface, signature="o", access="read")
 
1629
    def ObjectPath_dbus_property(self):
 
1630
        return self.dbus_object_path # is already a dbus.ObjectPath
 
1631
    
 
1632
    # Secret = property
 
1633
    @dbus_service_property(_interface, signature="ay",
 
1634
                           access="write", byte_arrays=True)
 
1635
    def Secret_dbus_property(self, value):
 
1636
        self.secret = str(value)
 
1637
    
 
1638
    del _interface
 
1639
 
 
1640
 
 
1641
class ProxyClient(object):
 
1642
    def __init__(self, child_pipe, fpr, address):
 
1643
        self._pipe = child_pipe
 
1644
        self._pipe.send(('init', fpr, address))
 
1645
        if not self._pipe.recv():
 
1646
            raise KeyError()
 
1647
    
 
1648
    def __getattribute__(self, name):
 
1649
        if name == '_pipe':
 
1650
            return super(ProxyClient, self).__getattribute__(name)
 
1651
        self._pipe.send(('getattr', name))
 
1652
        data = self._pipe.recv()
 
1653
        if data[0] == 'data':
 
1654
            return data[1]
 
1655
        if data[0] == 'function':
 
1656
            def func(*args, **kwargs):
 
1657
                self._pipe.send(('funcall', name, args, kwargs))
 
1658
                return self._pipe.recv()[1]
 
1659
            return func
 
1660
    
 
1661
    def __setattr__(self, name, value):
 
1662
        if name == '_pipe':
 
1663
            return super(ProxyClient, self).__setattr__(name, value)
 
1664
        self._pipe.send(('setattr', name, value))
 
1665
 
 
1666
 
 
1667
class ClientHandler(socketserver.BaseRequestHandler, object):
 
1668
    """A class to handle client connections.
 
1669
    
 
1670
    Instantiated once for each connection to handle it.
 
1671
    Note: This will run in its own forked process."""
 
1672
    
 
1673
    def handle(self):
 
1674
        with contextlib.closing(self.server.child_pipe) as child_pipe:
 
1675
            logger.info("TCP connection from: %s",
 
1676
                        unicode(self.client_address))
 
1677
            logger.debug("Pipe FD: %d",
 
1678
                         self.server.child_pipe.fileno())
 
1679
            
 
1680
            session = (gnutls.connection
 
1681
                       .ClientSession(self.request,
 
1682
                                      gnutls.connection
 
1683
                                      .X509Credentials()))
 
1684
            
 
1685
            # Note: gnutls.connection.X509Credentials is really a
 
1686
            # generic GnuTLS certificate credentials object so long as
 
1687
            # no X.509 keys are added to it.  Therefore, we can use it
 
1688
            # here despite using OpenPGP certificates.
 
1689
            
 
1690
            #priority = ':'.join(("NONE", "+VERS-TLS1.1",
 
1691
            #                      "+AES-256-CBC", "+SHA1",
 
1692
            #                      "+COMP-NULL", "+CTYPE-OPENPGP",
 
1693
            #                      "+DHE-DSS"))
 
1694
            # Use a fallback default, since this MUST be set.
 
1695
            priority = self.server.gnutls_priority
 
1696
            if priority is None:
 
1697
                priority = "NORMAL"
 
1698
            (gnutls.library.functions
 
1699
             .gnutls_priority_set_direct(session._c_object,
 
1700
                                         priority, None))
 
1701
            
 
1702
            # Start communication using the Mandos protocol
 
1703
            # Get protocol number
 
1704
            line = self.request.makefile().readline()
 
1705
            logger.debug("Protocol version: %r", line)
 
1706
            try:
 
1707
                if int(line.strip().split()[0]) > 1:
 
1708
                    raise RuntimeError(line)
 
1709
            except (ValueError, IndexError, RuntimeError) as error:
 
1710
                logger.error("Unknown protocol version: %s", error)
 
1711
                return
 
1712
            
 
1713
            # Start GnuTLS connection
 
1714
            try:
 
1715
                session.handshake()
 
1716
            except gnutls.errors.GNUTLSError as error:
 
1717
                logger.warning("Handshake failed: %s", error)
 
1718
                # Do not run session.bye() here: the session is not
 
1719
                # established.  Just abandon the request.
 
1720
                return
 
1721
            logger.debug("Handshake succeeded")
 
1722
            
 
1723
            approval_required = False
 
1724
            try:
 
1725
                try:
 
1726
                    fpr = self.fingerprint(self.peer_certificate
 
1727
                                           (session))
 
1728
                except (TypeError,
 
1729
                        gnutls.errors.GNUTLSError) as error:
 
1730
                    logger.warning("Bad certificate: %s", error)
 
1731
                    return
 
1732
                logger.debug("Fingerprint: %s", fpr)
 
1733
                
 
1734
                try:
 
1735
                    client = ProxyClient(child_pipe, fpr,
 
1736
                                         self.client_address)
 
1737
                except KeyError:
 
1738
                    return
 
1739
                
 
1740
                if client.approval_delay:
 
1741
                    delay = client.approval_delay
 
1742
                    client.approvals_pending += 1
 
1743
                    approval_required = True
 
1744
                
 
1745
                while True:
 
1746
                    if not client.enabled:
 
1747
                        logger.info("Client %s is disabled",
 
1748
                                       client.name)
 
1749
                        if self.server.use_dbus:
 
1750
                            # Emit D-Bus signal
 
1751
                            client.Rejected("Disabled")
 
1752
                        return
 
1753
                    
 
1754
                    if client.approved or not client.approval_delay:
 
1755
                        #We are approved or approval is disabled
 
1756
                        break
 
1757
                    elif client.approved is None:
 
1758
                        logger.info("Client %s needs approval",
 
1759
                                    client.name)
 
1760
                        if self.server.use_dbus:
 
1761
                            # Emit D-Bus signal
 
1762
                            client.NeedApproval(
 
1763
                                client.approval_delay_milliseconds(),
 
1764
                                client.approved_by_default)
 
1765
                    else:
 
1766
                        logger.warning("Client %s was not approved",
 
1767
                                       client.name)
 
1768
                        if self.server.use_dbus:
 
1769
                            # Emit D-Bus signal
 
1770
                            client.Rejected("Denied")
 
1771
                        return
 
1772
                    
 
1773
                    #wait until timeout or approved
 
1774
                    time = datetime.datetime.now()
 
1775
                    client.changedstate.acquire()
 
1776
                    client.changedstate.wait(
 
1777
                        float(timedelta_to_milliseconds(delay)
 
1778
                              / 1000))
 
1779
                    client.changedstate.release()
 
1780
                    time2 = datetime.datetime.now()
 
1781
                    if (time2 - time) >= delay:
 
1782
                        if not client.approved_by_default:
 
1783
                            logger.warning("Client %s timed out while"
 
1784
                                           " waiting for approval",
 
1785
                                           client.name)
 
1786
                            if self.server.use_dbus:
 
1787
                                # Emit D-Bus signal
 
1788
                                client.Rejected("Approval timed out")
 
1789
                            return
 
1790
                        else:
 
1791
                            break
 
1792
                    else:
 
1793
                        delay -= time2 - time
 
1794
                
 
1795
                sent_size = 0
 
1796
                while sent_size < len(client.secret):
 
1797
                    try:
 
1798
                        sent = session.send(client.secret[sent_size:])
 
1799
                    except gnutls.errors.GNUTLSError as error:
 
1800
                        logger.warning("gnutls send failed",
 
1801
                                       exc_info=error)
 
1802
                        return
 
1803
                    logger.debug("Sent: %d, remaining: %d",
 
1804
                                 sent, len(client.secret)
 
1805
                                 - (sent_size + sent))
 
1806
                    sent_size += sent
 
1807
                
 
1808
                logger.info("Sending secret to %s", client.name)
 
1809
                # bump the timeout using extended_timeout
 
1810
                client.bump_timeout(client.extended_timeout)
 
1811
                if self.server.use_dbus:
 
1812
                    # Emit D-Bus signal
 
1813
                    client.GotSecret()
 
1814
            
 
1815
            finally:
 
1816
                if approval_required:
 
1817
                    client.approvals_pending -= 1
 
1818
                try:
 
1819
                    session.bye()
 
1820
                except gnutls.errors.GNUTLSError as error:
 
1821
                    logger.warning("GnuTLS bye failed",
 
1822
                                   exc_info=error)
 
1823
    
 
1824
    @staticmethod
 
1825
    def peer_certificate(session):
 
1826
        "Return the peer's OpenPGP certificate as a bytestring"
 
1827
        # If not an OpenPGP certificate...
 
1828
        if (gnutls.library.functions
 
1829
            .gnutls_certificate_type_get(session._c_object)
 
1830
            != gnutls.library.constants.GNUTLS_CRT_OPENPGP):
 
1831
            # ...do the normal thing
 
1832
            return session.peer_certificate
 
1833
        list_size = ctypes.c_uint(1)
 
1834
        cert_list = (gnutls.library.functions
 
1835
                     .gnutls_certificate_get_peers
 
1836
                     (session._c_object, ctypes.byref(list_size)))
 
1837
        if not bool(cert_list) and list_size.value != 0:
 
1838
            raise gnutls.errors.GNUTLSError("error getting peer"
 
1839
                                            " certificate")
 
1840
        if list_size.value == 0:
 
1841
            return None
 
1842
        cert = cert_list[0]
 
1843
        return ctypes.string_at(cert.data, cert.size)
 
1844
    
 
1845
    @staticmethod
 
1846
    def fingerprint(openpgp):
 
1847
        "Convert an OpenPGP bytestring to a hexdigit fingerprint"
 
1848
        # New GnuTLS "datum" with the OpenPGP public key
 
1849
        datum = (gnutls.library.types
 
1850
                 .gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
 
1851
                                             ctypes.POINTER
 
1852
                                             (ctypes.c_ubyte)),
 
1853
                                 ctypes.c_uint(len(openpgp))))
 
1854
        # New empty GnuTLS certificate
 
1855
        crt = gnutls.library.types.gnutls_openpgp_crt_t()
 
1856
        (gnutls.library.functions
 
1857
         .gnutls_openpgp_crt_init(ctypes.byref(crt)))
 
1858
        # Import the OpenPGP public key into the certificate
 
1859
        (gnutls.library.functions
 
1860
         .gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
 
1861
                                    gnutls.library.constants
 
1862
                                    .GNUTLS_OPENPGP_FMT_RAW))
 
1863
        # Verify the self signature in the key
 
1864
        crtverify = ctypes.c_uint()
 
1865
        (gnutls.library.functions
 
1866
         .gnutls_openpgp_crt_verify_self(crt, 0,
 
1867
                                         ctypes.byref(crtverify)))
 
1868
        if crtverify.value != 0:
 
1869
            gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
 
1870
            raise (gnutls.errors.CertificateSecurityError
 
1871
                   ("Verify failed"))
 
1872
        # New buffer for the fingerprint
 
1873
        buf = ctypes.create_string_buffer(20)
 
1874
        buf_len = ctypes.c_size_t()
 
1875
        # Get the fingerprint from the certificate into the buffer
 
1876
        (gnutls.library.functions
 
1877
         .gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
 
1878
                                             ctypes.byref(buf_len)))
 
1879
        # Deinit the certificate
 
1880
        gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
 
1881
        # Convert the buffer to a Python bytestring
 
1882
        fpr = ctypes.string_at(buf, buf_len.value)
 
1883
        # Convert the bytestring to hexadecimal notation
 
1884
        hex_fpr = binascii.hexlify(fpr).upper()
 
1885
        return hex_fpr
 
1886
 
 
1887
 
 
1888
class MultiprocessingMixIn(object):
 
1889
    """Like socketserver.ThreadingMixIn, but with multiprocessing"""
 
1890
    def sub_process_main(self, request, address):
 
1891
        try:
 
1892
            self.finish_request(request, address)
 
1893
        except Exception:
 
1894
            self.handle_error(request, address)
 
1895
        self.close_request(request)
 
1896
    
 
1897
    def process_request(self, request, address):
 
1898
        """Start a new process to process the request."""
 
1899
        proc = multiprocessing.Process(target = self.sub_process_main,
 
1900
                                       args = (request, address))
 
1901
        proc.start()
 
1902
        return proc
 
1903
 
 
1904
 
 
1905
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
 
1906
    """ adds a pipe to the MixIn """
 
1907
    def process_request(self, request, client_address):
 
1908
        """Overrides and wraps the original process_request().
 
1909
        
 
1910
        This function creates a new pipe in self.pipe
 
1911
        """
 
1912
        parent_pipe, self.child_pipe = multiprocessing.Pipe()
 
1913
        
 
1914
        proc = MultiprocessingMixIn.process_request(self, request,
 
1915
                                                    client_address)
 
1916
        self.child_pipe.close()
 
1917
        self.add_pipe(parent_pipe, proc)
 
1918
    
 
1919
    def add_pipe(self, parent_pipe, proc):
 
1920
        """Dummy function; override as necessary"""
 
1921
        raise NotImplementedError()
 
1922
 
 
1923
 
 
1924
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
 
1925
                     socketserver.TCPServer, object):
 
1926
    """IPv6-capable TCP server.  Accepts 'None' as address and/or port
 
1927
    
 
1928
    Attributes:
 
1929
        enabled:        Boolean; whether this server is activated yet
 
1930
        interface:      None or a network interface name (string)
 
1931
        use_ipv6:       Boolean; to use IPv6 or not
 
1932
    """
 
1933
    def __init__(self, server_address, RequestHandlerClass,
 
1934
                 interface=None, use_ipv6=True, socketfd=None):
 
1935
        """If socketfd is set, use that file descriptor instead of
 
1936
        creating a new one with socket.socket().
 
1937
        """
 
1938
        self.interface = interface
 
1939
        if use_ipv6:
 
1940
            self.address_family = socket.AF_INET6
 
1941
        if socketfd is not None:
 
1942
            # Save the file descriptor
 
1943
            self.socketfd = socketfd
 
1944
            # Save the original socket.socket() function
 
1945
            self.socket_socket = socket.socket
 
1946
            # To implement --socket, we monkey patch socket.socket.
 
1947
            # 
 
1948
            # (When socketserver.TCPServer is a new-style class, we
 
1949
            # could make self.socket into a property instead of monkey
 
1950
            # patching socket.socket.)
 
1951
            # 
 
1952
            # Create a one-time-only replacement for socket.socket()
 
1953
            @functools.wraps(socket.socket)
 
1954
            def socket_wrapper(*args, **kwargs):
 
1955
                # Restore original function so subsequent calls are
 
1956
                # not affected.
 
1957
                socket.socket = self.socket_socket
 
1958
                del self.socket_socket
 
1959
                # This time only, return a new socket object from the
 
1960
                # saved file descriptor.
 
1961
                return socket.fromfd(self.socketfd, *args, **kwargs)
 
1962
            # Replace socket.socket() function with wrapper
 
1963
            socket.socket = socket_wrapper
 
1964
        # The socketserver.TCPServer.__init__ will call
 
1965
        # socket.socket(), which might be our replacement,
 
1966
        # socket_wrapper(), if socketfd was set.
 
1967
        socketserver.TCPServer.__init__(self, server_address,
 
1968
                                        RequestHandlerClass)
 
1969
    
 
1970
    def server_bind(self):
 
1971
        """This overrides the normal server_bind() function
 
1972
        to bind to an interface if one was specified, and also NOT to
 
1973
        bind to an address or port if they were not specified."""
 
1974
        if self.interface is not None:
 
1975
            if SO_BINDTODEVICE is None:
 
1976
                logger.error("SO_BINDTODEVICE does not exist;"
 
1977
                             " cannot bind to interface %s",
 
1978
                             self.interface)
 
1979
            else:
 
1980
                try:
 
1981
                    self.socket.setsockopt(socket.SOL_SOCKET,
 
1982
                                           SO_BINDTODEVICE,
 
1983
                                           str(self.interface + '\0'))
 
1984
                except socket.error as error:
 
1985
                    if error.errno == errno.EPERM:
 
1986
                        logger.error("No permission to bind to"
 
1987
                                     " interface %s", self.interface)
 
1988
                    elif error.errno == errno.ENOPROTOOPT:
 
1989
                        logger.error("SO_BINDTODEVICE not available;"
 
1990
                                     " cannot bind to interface %s",
 
1991
                                     self.interface)
 
1992
                    elif error.errno == errno.ENODEV:
 
1993
                        logger.error("Interface %s does not exist,"
 
1994
                                     " cannot bind", self.interface)
 
1995
                    else:
 
1996
                        raise
 
1997
        # Only bind(2) the socket if we really need to.
 
1998
        if self.server_address[0] or self.server_address[1]:
 
1999
            if not self.server_address[0]:
 
2000
                if self.address_family == socket.AF_INET6:
 
2001
                    any_address = "::" # in6addr_any
 
2002
                else:
 
2003
                    any_address = "0.0.0.0" # INADDR_ANY
 
2004
                self.server_address = (any_address,
 
2005
                                       self.server_address[1])
 
2006
            elif not self.server_address[1]:
 
2007
                self.server_address = (self.server_address[0],
 
2008
                                       0)
 
2009
#                 if self.interface:
 
2010
#                     self.server_address = (self.server_address[0],
 
2011
#                                            0, # port
 
2012
#                                            0, # flowinfo
 
2013
#                                            if_nametoindex
 
2014
#                                            (self.interface))
 
2015
            return socketserver.TCPServer.server_bind(self)
 
2016
 
 
2017
 
 
2018
class MandosServer(IPv6_TCPServer):
 
2019
    """Mandos server.
 
2020
    
 
2021
    Attributes:
 
2022
        clients:        set of Client objects
 
2023
        gnutls_priority GnuTLS priority string
 
2024
        use_dbus:       Boolean; to emit D-Bus signals or not
 
2025
    
 
2026
    Assumes a gobject.MainLoop event loop.
 
2027
    """
 
2028
    def __init__(self, server_address, RequestHandlerClass,
 
2029
                 interface=None, use_ipv6=True, clients=None,
 
2030
                 gnutls_priority=None, use_dbus=True, socketfd=None):
 
2031
        self.enabled = False
 
2032
        self.clients = clients
 
2033
        if self.clients is None:
 
2034
            self.clients = {}
 
2035
        self.use_dbus = use_dbus
 
2036
        self.gnutls_priority = gnutls_priority
 
2037
        IPv6_TCPServer.__init__(self, server_address,
 
2038
                                RequestHandlerClass,
 
2039
                                interface = interface,
 
2040
                                use_ipv6 = use_ipv6,
 
2041
                                socketfd = socketfd)
 
2042
    def server_activate(self):
 
2043
        if self.enabled:
 
2044
            return socketserver.TCPServer.server_activate(self)
 
2045
    
 
2046
    def enable(self):
 
2047
        self.enabled = True
 
2048
    
 
2049
    def add_pipe(self, parent_pipe, proc):
 
2050
        # Call "handle_ipc" for both data and EOF events
 
2051
        gobject.io_add_watch(parent_pipe.fileno(),
 
2052
                             gobject.IO_IN | gobject.IO_HUP,
 
2053
                             functools.partial(self.handle_ipc,
 
2054
                                               parent_pipe =
 
2055
                                               parent_pipe,
 
2056
                                               proc = proc))
 
2057
    
 
2058
    def handle_ipc(self, source, condition, parent_pipe=None,
 
2059
                   proc = None, client_object=None):
 
2060
        # error, or the other end of multiprocessing.Pipe has closed
 
2061
        if condition & (gobject.IO_ERR | gobject.IO_HUP):
 
2062
            # Wait for other process to exit
 
2063
            proc.join()
 
2064
            return False
 
2065
        
 
2066
        # Read a request from the child
 
2067
        request = parent_pipe.recv()
 
2068
        command = request[0]
 
2069
        
 
2070
        if command == 'init':
 
2071
            fpr = request[1]
 
2072
            address = request[2]
 
2073
            
 
2074
            for c in self.clients.itervalues():
 
2075
                if c.fingerprint == fpr:
 
2076
                    client = c
 
2077
                    break
 
2078
            else:
 
2079
                logger.info("Client not found for fingerprint: %s, ad"
 
2080
                            "dress: %s", fpr, address)
 
2081
                if self.use_dbus:
 
2082
                    # Emit D-Bus signal
 
2083
                    mandos_dbus_service.ClientNotFound(fpr,
 
2084
                                                       address[0])
 
2085
                parent_pipe.send(False)
 
2086
                return False
 
2087
            
 
2088
            gobject.io_add_watch(parent_pipe.fileno(),
 
2089
                                 gobject.IO_IN | gobject.IO_HUP,
 
2090
                                 functools.partial(self.handle_ipc,
 
2091
                                                   parent_pipe =
 
2092
                                                   parent_pipe,
 
2093
                                                   proc = proc,
 
2094
                                                   client_object =
 
2095
                                                   client))
 
2096
            parent_pipe.send(True)
 
2097
            # remove the old hook in favor of the new above hook on
 
2098
            # same fileno
 
2099
            return False
 
2100
        if command == 'funcall':
 
2101
            funcname = request[1]
 
2102
            args = request[2]
 
2103
            kwargs = request[3]
 
2104
            
 
2105
            parent_pipe.send(('data', getattr(client_object,
 
2106
                                              funcname)(*args,
 
2107
                                                         **kwargs)))
 
2108
        
 
2109
        if command == 'getattr':
 
2110
            attrname = request[1]
 
2111
            if callable(client_object.__getattribute__(attrname)):
 
2112
                parent_pipe.send(('function',))
 
2113
            else:
 
2114
                parent_pipe.send(('data', client_object
 
2115
                                  .__getattribute__(attrname)))
 
2116
        
 
2117
        if command == 'setattr':
 
2118
            attrname = request[1]
 
2119
            value = request[2]
 
2120
            setattr(client_object, attrname, value)
 
2121
        
 
2122
        return True
 
2123
 
 
2124
 
 
2125
def rfc3339_duration_to_delta(duration):
 
2126
    """Parse an RFC 3339 "duration" and return a datetime.timedelta
 
2127
    
 
2128
    >>> rfc3339_duration_to_delta("P7D")
 
2129
    datetime.timedelta(7)
 
2130
    >>> rfc3339_duration_to_delta("PT60S")
 
2131
    datetime.timedelta(0, 60)
 
2132
    >>> rfc3339_duration_to_delta("PT60M")
 
2133
    datetime.timedelta(0, 3600)
 
2134
    >>> rfc3339_duration_to_delta("PT24H")
 
2135
    datetime.timedelta(1)
 
2136
    >>> rfc3339_duration_to_delta("P1W")
 
2137
    datetime.timedelta(7)
 
2138
    >>> rfc3339_duration_to_delta("PT5M30S")
 
2139
    datetime.timedelta(0, 330)
 
2140
    >>> rfc3339_duration_to_delta("P1DT3M20S")
 
2141
    datetime.timedelta(1, 200)
 
2142
    """
 
2143
    
 
2144
    # Parsing an RFC 3339 duration with regular expressions is not
 
2145
    # possible - there would have to be multiple places for the same
 
2146
    # values, like seconds.  The current code, while more esoteric, is
 
2147
    # cleaner without depending on a parsing library.  If Python had a
 
2148
    # built-in library for parsing we would use it, but we'd like to
 
2149
    # avoid excessive use of external libraries.
 
2150
    
 
2151
    # New type for defining tokens, syntax, and semantics all-in-one
 
2152
    Token = collections.namedtuple("Token",
 
2153
                                   ("regexp", # To match token; if
 
2154
                                              # "value" is not None,
 
2155
                                              # must have a "group"
 
2156
                                              # containing digits
 
2157
                                    "value",  # datetime.timedelta or
 
2158
                                              # None
 
2159
                                    "followers")) # Tokens valid after
 
2160
                                                  # this token
 
2161
    # RFC 3339 "duration" tokens, syntax, and semantics; taken from
 
2162
    # the "duration" ABNF definition in RFC 3339, Appendix A.
 
2163
    token_end = Token(re.compile(r"$"), None, frozenset())
 
2164
    token_second = Token(re.compile(r"(\d+)S"),
 
2165
                         datetime.timedelta(seconds=1),
 
2166
                         frozenset((token_end,)))
 
2167
    token_minute = Token(re.compile(r"(\d+)M"),
 
2168
                         datetime.timedelta(minutes=1),
 
2169
                         frozenset((token_second, token_end)))
 
2170
    token_hour = Token(re.compile(r"(\d+)H"),
 
2171
                       datetime.timedelta(hours=1),
 
2172
                       frozenset((token_minute, token_end)))
 
2173
    token_time = Token(re.compile(r"T"),
 
2174
                       None,
 
2175
                       frozenset((token_hour, token_minute,
 
2176
                                  token_second)))
 
2177
    token_day = Token(re.compile(r"(\d+)D"),
 
2178
                      datetime.timedelta(days=1),
 
2179
                      frozenset((token_time, token_end)))
 
2180
    token_month = Token(re.compile(r"(\d+)M"),
 
2181
                        datetime.timedelta(weeks=4),
 
2182
                        frozenset((token_day, token_end)))
 
2183
    token_year = Token(re.compile(r"(\d+)Y"),
 
2184
                       datetime.timedelta(weeks=52),
 
2185
                       frozenset((token_month, token_end)))
 
2186
    token_week = Token(re.compile(r"(\d+)W"),
 
2187
                       datetime.timedelta(weeks=1),
 
2188
                       frozenset((token_end,)))
 
2189
    token_duration = Token(re.compile(r"P"), None,
 
2190
                           frozenset((token_year, token_month,
 
2191
                                      token_day, token_time,
 
2192
                                      token_week))),
 
2193
    # Define starting values
 
2194
    value = datetime.timedelta() # Value so far
 
2195
    found_token = None
 
2196
    followers = frozenset(token_duration,) # Following valid tokens
 
2197
    s = duration                # String left to parse
 
2198
    # Loop until end token is found
 
2199
    while found_token is not token_end:
 
2200
        # Search for any currently valid tokens
 
2201
        for token in followers:
 
2202
            match = token.regexp.match(s)
 
2203
            if match is not None:
 
2204
                # Token found
 
2205
                if token.value is not None:
 
2206
                    # Value found, parse digits
 
2207
                    factor = int(match.group(1), 10)
 
2208
                    # Add to value so far
 
2209
                    value += factor * token.value
 
2210
                # Strip token from string
 
2211
                s = token.regexp.sub("", s, 1)
 
2212
                # Go to found token
 
2213
                found_token = token
 
2214
                # Set valid next tokens
 
2215
                followers = found_token.followers
 
2216
                break
 
2217
        else:
 
2218
            # No currently valid tokens were found
 
2219
            raise ValueError("Invalid RFC 3339 duration")
 
2220
    # End token found
 
2221
    return value
 
2222
 
 
2223
 
 
2224
def string_to_delta(interval):
 
2225
    """Parse a string and return a datetime.timedelta
 
2226
    
 
2227
    >>> string_to_delta('7d')
 
2228
    datetime.timedelta(7)
 
2229
    >>> string_to_delta('60s')
 
2230
    datetime.timedelta(0, 60)
 
2231
    >>> string_to_delta('60m')
 
2232
    datetime.timedelta(0, 3600)
 
2233
    >>> string_to_delta('24h')
 
2234
    datetime.timedelta(1)
 
2235
    >>> string_to_delta('1w')
 
2236
    datetime.timedelta(7)
 
2237
    >>> string_to_delta('5m 30s')
 
2238
    datetime.timedelta(0, 330)
 
2239
    """
 
2240
    
 
2241
    try:
 
2242
        return rfc3339_duration_to_delta(interval)
 
2243
    except ValueError:
 
2244
        pass
 
2245
    
 
2246
    timevalue = datetime.timedelta(0)
 
2247
    for s in interval.split():
 
2248
        try:
 
2249
            suffix = unicode(s[-1])
 
2250
            value = int(s[:-1])
 
2251
            if suffix == "d":
 
2252
                delta = datetime.timedelta(value)
 
2253
            elif suffix == "s":
 
2254
                delta = datetime.timedelta(0, value)
 
2255
            elif suffix == "m":
 
2256
                delta = datetime.timedelta(0, 0, 0, 0, value)
 
2257
            elif suffix == "h":
 
2258
                delta = datetime.timedelta(0, 0, 0, 0, 0, value)
 
2259
            elif suffix == "w":
 
2260
                delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
 
2261
            else:
 
2262
                raise ValueError("Unknown suffix {0!r}"
 
2263
                                 .format(suffix))
 
2264
        except IndexError as e:
 
2265
            raise ValueError(*(e.args))
 
2266
        timevalue += delta
 
2267
    return timevalue
 
2268
 
 
2269
 
 
2270
def daemon(nochdir = False, noclose = False):
 
2271
    """See daemon(3).  Standard BSD Unix function.
 
2272
    
 
2273
    This should really exist as os.daemon, but it doesn't (yet)."""
 
2274
    if os.fork():
 
2275
        sys.exit()
 
2276
    os.setsid()
 
2277
    if not nochdir:
 
2278
        os.chdir("/")
 
2279
    if os.fork():
 
2280
        sys.exit()
 
2281
    if not noclose:
 
2282
        # Close all standard open file descriptors
 
2283
        null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
 
2284
        if not stat.S_ISCHR(os.fstat(null).st_mode):
 
2285
            raise OSError(errno.ENODEV,
 
2286
                          "{0} not a character device"
 
2287
                          .format(os.devnull))
 
2288
        os.dup2(null, sys.stdin.fileno())
 
2289
        os.dup2(null, sys.stdout.fileno())
 
2290
        os.dup2(null, sys.stderr.fileno())
 
2291
        if null > 2:
 
2292
            os.close(null)
 
2293
 
 
2294
 
 
2295
def main():
 
2296
    
 
2297
    ##################################################################
 
2298
    # Parsing of options, both command line and config file
 
2299
    
 
2300
    parser = argparse.ArgumentParser()
 
2301
    parser.add_argument("-v", "--version", action="version",
 
2302
                        version = "%(prog)s {0}".format(version),
 
2303
                        help="show version number and exit")
 
2304
    parser.add_argument("-i", "--interface", metavar="IF",
 
2305
                        help="Bind to interface IF")
 
2306
    parser.add_argument("-a", "--address",
 
2307
                        help="Address to listen for requests on")
 
2308
    parser.add_argument("-p", "--port", type=int,
 
2309
                        help="Port number to receive requests on")
 
2310
    parser.add_argument("--check", action="store_true",
 
2311
                        help="Run self-test")
 
2312
    parser.add_argument("--debug", action="store_true",
 
2313
                        help="Debug mode; run in foreground and log"
 
2314
                        " to terminal", default=None)
 
2315
    parser.add_argument("--debuglevel", metavar="LEVEL",
 
2316
                        help="Debug level for stdout output")
 
2317
    parser.add_argument("--priority", help="GnuTLS"
 
2318
                        " priority string (see GnuTLS documentation)")
 
2319
    parser.add_argument("--servicename",
 
2320
                        metavar="NAME", help="Zeroconf service name")
 
2321
    parser.add_argument("--configdir",
 
2322
                        default="/etc/mandos", metavar="DIR",
 
2323
                        help="Directory to search for configuration"
 
2324
                        " files")
 
2325
    parser.add_argument("--no-dbus", action="store_false",
 
2326
                        dest="use_dbus", help="Do not provide D-Bus"
 
2327
                        " system bus interface", default=None)
 
2328
    parser.add_argument("--no-ipv6", action="store_false",
 
2329
                        dest="use_ipv6", help="Do not use IPv6",
 
2330
                        default=None)
 
2331
    parser.add_argument("--no-restore", action="store_false",
 
2332
                        dest="restore", help="Do not restore stored"
 
2333
                        " state", default=None)
 
2334
    parser.add_argument("--socket", type=int,
 
2335
                        help="Specify a file descriptor to a network"
 
2336
                        " socket to use instead of creating one")
 
2337
    parser.add_argument("--statedir", metavar="DIR",
 
2338
                        help="Directory to save/restore state in")
 
2339
    parser.add_argument("--foreground", action="store_true",
 
2340
                        help="Run in foreground", default=None)
 
2341
    
 
2342
    options = parser.parse_args()
 
2343
    
 
2344
    if options.check:
 
2345
        import doctest
 
2346
        fail_count, test_count = doctest.testmod()
 
2347
        sys.exit(os.EX_OK if fail_count == 0 else 1)
 
2348
    
 
2349
    # Default values for config file for server-global settings
 
2350
    server_defaults = { "interface": "",
 
2351
                        "address": "",
 
2352
                        "port": "",
 
2353
                        "debug": "False",
 
2354
                        "priority":
 
2355
                        "SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",
 
2356
                        "servicename": "Mandos",
 
2357
                        "use_dbus": "True",
 
2358
                        "use_ipv6": "True",
 
2359
                        "debuglevel": "",
 
2360
                        "restore": "True",
 
2361
                        "socket": "",
 
2362
                        "statedir": "/var/lib/mandos",
 
2363
                        "foreground": "False",
 
2364
                        }
 
2365
    
 
2366
    # Parse config file for server-global settings
 
2367
    server_config = configparser.SafeConfigParser(server_defaults)
 
2368
    del server_defaults
 
2369
    server_config.read(os.path.join(options.configdir,
 
2370
                                    "mandos.conf"))
 
2371
    # Convert the SafeConfigParser object to a dict
 
2372
    server_settings = server_config.defaults()
 
2373
    # Use the appropriate methods on the non-string config options
 
2374
    for option in ("debug", "use_dbus", "use_ipv6", "foreground"):
 
2375
        server_settings[option] = server_config.getboolean("DEFAULT",
 
2376
                                                           option)
 
2377
    if server_settings["port"]:
 
2378
        server_settings["port"] = server_config.getint("DEFAULT",
 
2379
                                                       "port")
 
2380
    if server_settings["socket"]:
 
2381
        server_settings["socket"] = server_config.getint("DEFAULT",
 
2382
                                                         "socket")
 
2383
        # Later, stdin will, and stdout and stderr might, be dup'ed
 
2384
        # over with an opened os.devnull.  But we don't want this to
 
2385
        # happen with a supplied network socket.
 
2386
        if 0 <= server_settings["socket"] <= 2:
 
2387
            server_settings["socket"] = os.dup(server_settings
 
2388
                                               ["socket"])
 
2389
    del server_config
 
2390
    
 
2391
    # Override the settings from the config file with command line
 
2392
    # options, if set.
 
2393
    for option in ("interface", "address", "port", "debug",
 
2394
                   "priority", "servicename", "configdir",
 
2395
                   "use_dbus", "use_ipv6", "debuglevel", "restore",
 
2396
                   "statedir", "socket", "foreground"):
 
2397
        value = getattr(options, option)
 
2398
        if value is not None:
 
2399
            server_settings[option] = value
 
2400
    del options
 
2401
    # Force all strings to be unicode
 
2402
    for option in server_settings.keys():
 
2403
        if type(server_settings[option]) is str:
 
2404
            server_settings[option] = unicode(server_settings[option])
 
2405
    # Force all boolean options to be boolean
 
2406
    for option in ("debug", "use_dbus", "use_ipv6", "restore",
 
2407
                   "foreground"):
 
2408
        server_settings[option] = bool(server_settings[option])
 
2409
    # Debug implies foreground
 
2410
    if server_settings["debug"]:
 
2411
        server_settings["foreground"] = True
 
2412
    # Now we have our good server settings in "server_settings"
 
2413
    
 
2414
    ##################################################################
 
2415
    
 
2416
    # For convenience
 
2417
    debug = server_settings["debug"]
 
2418
    debuglevel = server_settings["debuglevel"]
 
2419
    use_dbus = server_settings["use_dbus"]
 
2420
    use_ipv6 = server_settings["use_ipv6"]
 
2421
    stored_state_path = os.path.join(server_settings["statedir"],
 
2422
                                     stored_state_file)
 
2423
    foreground = server_settings["foreground"]
 
2424
    
 
2425
    if debug:
 
2426
        initlogger(debug, logging.DEBUG)
 
2427
    else:
 
2428
        if not debuglevel:
 
2429
            initlogger(debug)
 
2430
        else:
 
2431
            level = getattr(logging, debuglevel.upper())
 
2432
            initlogger(debug, level)
 
2433
    
 
2434
    if server_settings["servicename"] != "Mandos":
 
2435
        syslogger.setFormatter(logging.Formatter
 
2436
                               ('Mandos ({0}) [%(process)d]:'
 
2437
                                ' %(levelname)s: %(message)s'
 
2438
                                .format(server_settings
 
2439
                                        ["servicename"])))
 
2440
    
 
2441
    # Parse config file with clients
 
2442
    client_config = configparser.SafeConfigParser(Client
 
2443
                                                  .client_defaults)
 
2444
    client_config.read(os.path.join(server_settings["configdir"],
 
2445
                                    "clients.conf"))
 
2446
    
 
2447
    global mandos_dbus_service
 
2448
    mandos_dbus_service = None
 
2449
    
 
2450
    tcp_server = MandosServer((server_settings["address"],
 
2451
                               server_settings["port"]),
 
2452
                              ClientHandler,
 
2453
                              interface=(server_settings["interface"]
 
2454
                                         or None),
 
2455
                              use_ipv6=use_ipv6,
 
2456
                              gnutls_priority=
 
2457
                              server_settings["priority"],
 
2458
                              use_dbus=use_dbus,
 
2459
                              socketfd=(server_settings["socket"]
 
2460
                                        or None))
 
2461
    if not foreground:
 
2462
        pidfilename = "/run/mandos.pid"
 
2463
        if not os.path.isdir("/run/."):
 
2464
            pidfilename = "/var/run/mandos.pid"
 
2465
        pidfile = None
 
2466
        try:
 
2467
            pidfile = open(pidfilename, "w")
 
2468
        except IOError as e:
 
2469
            logger.error("Could not open file %r", pidfilename,
 
2470
                         exc_info=e)
 
2471
    
 
2472
    for name in ("_mandos", "mandos", "nobody"):
 
2473
        try:
 
2474
            uid = pwd.getpwnam(name).pw_uid
 
2475
            gid = pwd.getpwnam(name).pw_gid
 
2476
            break
106
2477
        except KeyError:
107
 
            session.send("gazonk")
108
 
            # Log maybe? XXX
109
 
        session.bye()
110
 
 
111
 
class IPv6_TCPServer(SocketServer.ForkingTCPServer, object):
112
 
    __init__ = init_with_options
113
 
    address_family = socket.AF_INET6
114
 
    allow_reuse_address = True
115
 
    request_queue_size = 1024
116
 
    server_bind = server_bind
117
 
 
118
 
 
119
 
in6addr_any = "::"
120
 
 
121
 
cred = None
122
 
 
123
 
def main():
124
 
    parser = OptionParser()
125
 
    parser.add_option("-i", "--interface", type="string",
126
 
                      default="eth0", metavar="IF",
127
 
                      help="Interface to bind to")
128
 
    parser.add_option("--cert", type="string", default="cert.pem",
129
 
                      metavar="FILE",
130
 
                      help="Public key certificate to use")
131
 
    parser.add_option("--key", type="string", default="key.pem",
132
 
                      metavar="FILE",
133
 
                      help="Private key to use")
134
 
    parser.add_option("--ca", type="string", default="ca.pem",
135
 
                      metavar="FILE",
136
 
                      help="Certificate Authority certificate to use")
137
 
    parser.add_option("--crl", type="string", default="crl.pem",
138
 
                      metavar="FILE",
139
 
                      help="Certificate Revokation List to use")
140
 
    parser.add_option("-p", "--port", type="int", default=49001,
141
 
                      help="Port number to receive requests on")
142
 
    parser.add_option("--dh", type="int", metavar="BITS",
143
 
                      help="DH group to use")
144
 
    parser.add_option("-t", "--timeout", type="string", # Parsed later
145
 
                      default="15m",
146
 
                      help="Amount of downtime allowed for clients")
147
 
    (options, args) = parser.parse_args()
148
 
    
149
 
    # Parse the time argument
150
 
    try:
151
 
        suffix=options.timeout[-1]
152
 
        value=int(options.timeout[:-1])
153
 
        if suffix == "d":
154
 
            options.timeout = datetime.timedelta(value)
155
 
        elif suffix == "s":
156
 
            options.timeout = datetime.timedelta(0, value)
157
 
        elif suffix == "m":
158
 
            options.timeout = datetime.timedelta(0, 0, 0, 0, value)
159
 
        elif suffix == "h":
160
 
            options.timeout = datetime.timedelta(0, 0, 0, 0, 0, value)
161
 
        elif suffix == "w":
162
 
            options.timeout = datetime.timedelta(0, 0, 0, 0, 0, 0,
163
 
                                                 value)
164
 
        else:
165
 
            raise ValueError
166
 
    except (ValueError, IndexError):
167
 
        parser.error("option --timeout: Unparseable time")
168
 
    
169
 
    cert = gnutls.crypto.X509Certificate(open(options.cert).read())
170
 
    key = gnutls.crypto.X509PrivateKey(open(options.key).read())
171
 
    ca = gnutls.crypto.X509Certificate(open(options.ca).read())
172
 
    crl = gnutls.crypto.X509CRL(open(options.crl).read())
173
 
    cred = gnutls.connection.X509Credentials(cert, key, [ca], [crl])
174
 
    
175
 
    # Parse config file
176
 
    defaults = {}
177
 
    client_config_object = ConfigParser.SafeConfigParser(defaults)
178
 
    client_config_object.read("mandos-clients.conf")
179
 
    clients = [Client(name=section,
180
 
                      **(dict(client_config_object.items(section))))
181
 
               for section in client_config_object.sections()]
182
 
    
183
 
    udp_server = IPv6_UDPServer((in6addr_any, options.port),
184
 
                                udp_handler,
185
 
                                options=options)
186
 
    
187
 
    tcp_server = IPv6_TCPServer((in6addr_any, options.port),
188
 
                                tcp_handler,
189
 
                                options=options,
190
 
                                clients=clients,
191
 
                                credentials=cred)
192
 
    
193
 
    while True:
194
 
        in_, out, err = select.select((udp_server,
195
 
                                       tcp_server), (), ())
196
 
        for server in in_:
197
 
            server.handle_request()
198
 
 
199
 
 
200
 
if __name__ == "__main__":
 
2478
            continue
 
2479
    else:
 
2480
        uid = 65534
 
2481
        gid = 65534
 
2482
    try:
 
2483
        os.setgid(gid)
 
2484
        os.setuid(uid)
 
2485
    except OSError as error:
 
2486
        if error.errno != errno.EPERM:
 
2487
            raise
 
2488
    
 
2489
    if debug:
 
2490
        # Enable all possible GnuTLS debugging
 
2491
        
 
2492
        # "Use a log level over 10 to enable all debugging options."
 
2493
        # - GnuTLS manual
 
2494
        gnutls.library.functions.gnutls_global_set_log_level(11)
 
2495
        
 
2496
        @gnutls.library.types.gnutls_log_func
 
2497
        def debug_gnutls(level, string):
 
2498
            logger.debug("GnuTLS: %s", string[:-1])
 
2499
        
 
2500
        (gnutls.library.functions
 
2501
         .gnutls_global_set_log_function(debug_gnutls))
 
2502
        
 
2503
        # Redirect stdin so all checkers get /dev/null
 
2504
        null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
 
2505
        os.dup2(null, sys.stdin.fileno())
 
2506
        if null > 2:
 
2507
            os.close(null)
 
2508
    
 
2509
    # Need to fork before connecting to D-Bus
 
2510
    if not foreground:
 
2511
        # Close all input and output, do double fork, etc.
 
2512
        daemon()
 
2513
    
 
2514
    # multiprocessing will use threads, so before we use gobject we
 
2515
    # need to inform gobject that threads will be used.
 
2516
    gobject.threads_init()
 
2517
    
 
2518
    global main_loop
 
2519
    # From the Avahi example code
 
2520
    DBusGMainLoop(set_as_default=True)
 
2521
    main_loop = gobject.MainLoop()
 
2522
    bus = dbus.SystemBus()
 
2523
    # End of Avahi example code
 
2524
    if use_dbus:
 
2525
        try:
 
2526
            bus_name = dbus.service.BusName("se.recompile.Mandos",
 
2527
                                            bus, do_not_queue=True)
 
2528
            old_bus_name = (dbus.service.BusName
 
2529
                            ("se.bsnet.fukt.Mandos", bus,
 
2530
                             do_not_queue=True))
 
2531
        except dbus.exceptions.NameExistsException as e:
 
2532
            logger.error("Disabling D-Bus:", exc_info=e)
 
2533
            use_dbus = False
 
2534
            server_settings["use_dbus"] = False
 
2535
            tcp_server.use_dbus = False
 
2536
    protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
 
2537
    service = AvahiServiceToSyslog(name =
 
2538
                                   server_settings["servicename"],
 
2539
                                   servicetype = "_mandos._tcp",
 
2540
                                   protocol = protocol, bus = bus)
 
2541
    if server_settings["interface"]:
 
2542
        service.interface = (if_nametoindex
 
2543
                             (str(server_settings["interface"])))
 
2544
    
 
2545
    global multiprocessing_manager
 
2546
    multiprocessing_manager = multiprocessing.Manager()
 
2547
    
 
2548
    client_class = Client
 
2549
    if use_dbus:
 
2550
        client_class = functools.partial(ClientDBus, bus = bus)
 
2551
    
 
2552
    client_settings = Client.config_parser(client_config)
 
2553
    old_client_settings = {}
 
2554
    clients_data = {}
 
2555
    
 
2556
    # This is used to redirect stdout and stderr for checker processes
 
2557
    global wnull
 
2558
    wnull = open(os.devnull, "w") # A writable /dev/null
 
2559
    # Only used if server is running in foreground but not in debug
 
2560
    # mode
 
2561
    if debug or not foreground:
 
2562
        wnull.close()
 
2563
    
 
2564
    # Get client data and settings from last running state.
 
2565
    if server_settings["restore"]:
 
2566
        try:
 
2567
            with open(stored_state_path, "rb") as stored_state:
 
2568
                clients_data, old_client_settings = (pickle.load
 
2569
                                                     (stored_state))
 
2570
            os.remove(stored_state_path)
 
2571
        except IOError as e:
 
2572
            if e.errno == errno.ENOENT:
 
2573
                logger.warning("Could not load persistent state: {0}"
 
2574
                                .format(os.strerror(e.errno)))
 
2575
            else:
 
2576
                logger.critical("Could not load persistent state:",
 
2577
                                exc_info=e)
 
2578
                raise
 
2579
        except EOFError as e:
 
2580
            logger.warning("Could not load persistent state: "
 
2581
                           "EOFError:", exc_info=e)
 
2582
    
 
2583
    with PGPEngine() as pgp:
 
2584
        for client_name, client in clients_data.iteritems():
 
2585
            # Skip removed clients
 
2586
            if client_name not in client_settings:
 
2587
                continue
 
2588
            
 
2589
            # Decide which value to use after restoring saved state.
 
2590
            # We have three different values: Old config file,
 
2591
            # new config file, and saved state.
 
2592
            # New config value takes precedence if it differs from old
 
2593
            # config value, otherwise use saved state.
 
2594
            for name, value in client_settings[client_name].items():
 
2595
                try:
 
2596
                    # For each value in new config, check if it
 
2597
                    # differs from the old config value (Except for
 
2598
                    # the "secret" attribute)
 
2599
                    if (name != "secret" and
 
2600
                        value != old_client_settings[client_name]
 
2601
                        [name]):
 
2602
                        client[name] = value
 
2603
                except KeyError:
 
2604
                    pass
 
2605
            
 
2606
            # Clients who has passed its expire date can still be
 
2607
            # enabled if its last checker was successful.  Clients
 
2608
            # whose checker succeeded before we stored its state is
 
2609
            # assumed to have successfully run all checkers during
 
2610
            # downtime.
 
2611
            if client["enabled"]:
 
2612
                if datetime.datetime.utcnow() >= client["expires"]:
 
2613
                    if not client["last_checked_ok"]:
 
2614
                        logger.warning(
 
2615
                            "disabling client {0} - Client never "
 
2616
                            "performed a successful checker"
 
2617
                            .format(client_name))
 
2618
                        client["enabled"] = False
 
2619
                    elif client["last_checker_status"] != 0:
 
2620
                        logger.warning(
 
2621
                            "disabling client {0} - Client "
 
2622
                            "last checker failed with error code {1}"
 
2623
                            .format(client_name,
 
2624
                                    client["last_checker_status"]))
 
2625
                        client["enabled"] = False
 
2626
                    else:
 
2627
                        client["expires"] = (datetime.datetime
 
2628
                                             .utcnow()
 
2629
                                             + client["timeout"])
 
2630
                        logger.debug("Last checker succeeded,"
 
2631
                                     " keeping {0} enabled"
 
2632
                                     .format(client_name))
 
2633
            try:
 
2634
                client["secret"] = (
 
2635
                    pgp.decrypt(client["encrypted_secret"],
 
2636
                                client_settings[client_name]
 
2637
                                ["secret"]))
 
2638
            except PGPError:
 
2639
                # If decryption fails, we use secret from new settings
 
2640
                logger.debug("Failed to decrypt {0} old secret"
 
2641
                             .format(client_name))
 
2642
                client["secret"] = (
 
2643
                    client_settings[client_name]["secret"])
 
2644
    
 
2645
    # Add/remove clients based on new changes made to config
 
2646
    for client_name in (set(old_client_settings)
 
2647
                        - set(client_settings)):
 
2648
        del clients_data[client_name]
 
2649
    for client_name in (set(client_settings)
 
2650
                        - set(old_client_settings)):
 
2651
        clients_data[client_name] = client_settings[client_name]
 
2652
    
 
2653
    # Create all client objects
 
2654
    for client_name, client in clients_data.iteritems():
 
2655
        tcp_server.clients[client_name] = client_class(
 
2656
            name = client_name, settings = client,
 
2657
            server_settings = server_settings)
 
2658
    
 
2659
    if not tcp_server.clients:
 
2660
        logger.warning("No clients defined")
 
2661
    
 
2662
    if not foreground:
 
2663
        if pidfile is not None:
 
2664
            try:
 
2665
                with pidfile:
 
2666
                    pid = os.getpid()
 
2667
                    pidfile.write(str(pid) + "\n".encode("utf-8"))
 
2668
            except IOError:
 
2669
                logger.error("Could not write to file %r with PID %d",
 
2670
                             pidfilename, pid)
 
2671
        del pidfile
 
2672
        del pidfilename
 
2673
    
 
2674
    signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
 
2675
    signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
 
2676
    
 
2677
    if use_dbus:
 
2678
        @alternate_dbus_interfaces({"se.recompile.Mandos":
 
2679
                                        "se.bsnet.fukt.Mandos"})
 
2680
        class MandosDBusService(DBusObjectWithProperties):
 
2681
            """A D-Bus proxy object"""
 
2682
            def __init__(self):
 
2683
                dbus.service.Object.__init__(self, bus, "/")
 
2684
            _interface = "se.recompile.Mandos"
 
2685
            
 
2686
            @dbus_interface_annotations(_interface)
 
2687
            def _foo(self):
 
2688
                return { "org.freedesktop.DBus.Property"
 
2689
                         ".EmitsChangedSignal":
 
2690
                             "false"}
 
2691
            
 
2692
            @dbus.service.signal(_interface, signature="o")
 
2693
            def ClientAdded(self, objpath):
 
2694
                "D-Bus signal"
 
2695
                pass
 
2696
            
 
2697
            @dbus.service.signal(_interface, signature="ss")
 
2698
            def ClientNotFound(self, fingerprint, address):
 
2699
                "D-Bus signal"
 
2700
                pass
 
2701
            
 
2702
            @dbus.service.signal(_interface, signature="os")
 
2703
            def ClientRemoved(self, objpath, name):
 
2704
                "D-Bus signal"
 
2705
                pass
 
2706
            
 
2707
            @dbus.service.method(_interface, out_signature="ao")
 
2708
            def GetAllClients(self):
 
2709
                "D-Bus method"
 
2710
                return dbus.Array(c.dbus_object_path
 
2711
                                  for c in
 
2712
                                  tcp_server.clients.itervalues())
 
2713
            
 
2714
            @dbus.service.method(_interface,
 
2715
                                 out_signature="a{oa{sv}}")
 
2716
            def GetAllClientsWithProperties(self):
 
2717
                "D-Bus method"
 
2718
                return dbus.Dictionary(
 
2719
                    ((c.dbus_object_path, c.GetAll(""))
 
2720
                     for c in tcp_server.clients.itervalues()),
 
2721
                    signature="oa{sv}")
 
2722
            
 
2723
            @dbus.service.method(_interface, in_signature="o")
 
2724
            def RemoveClient(self, object_path):
 
2725
                "D-Bus method"
 
2726
                for c in tcp_server.clients.itervalues():
 
2727
                    if c.dbus_object_path == object_path:
 
2728
                        del tcp_server.clients[c.name]
 
2729
                        c.remove_from_connection()
 
2730
                        # Don't signal anything except ClientRemoved
 
2731
                        c.disable(quiet=True)
 
2732
                        # Emit D-Bus signal
 
2733
                        self.ClientRemoved(object_path, c.name)
 
2734
                        return
 
2735
                raise KeyError(object_path)
 
2736
            
 
2737
            del _interface
 
2738
        
 
2739
        mandos_dbus_service = MandosDBusService()
 
2740
    
 
2741
    def cleanup():
 
2742
        "Cleanup function; run on exit"
 
2743
        service.cleanup()
 
2744
        
 
2745
        multiprocessing.active_children()
 
2746
        wnull.close()
 
2747
        if not (tcp_server.clients or client_settings):
 
2748
            return
 
2749
        
 
2750
        # Store client before exiting. Secrets are encrypted with key
 
2751
        # based on what config file has. If config file is
 
2752
        # removed/edited, old secret will thus be unrecovable.
 
2753
        clients = {}
 
2754
        with PGPEngine() as pgp:
 
2755
            for client in tcp_server.clients.itervalues():
 
2756
                key = client_settings[client.name]["secret"]
 
2757
                client.encrypted_secret = pgp.encrypt(client.secret,
 
2758
                                                      key)
 
2759
                client_dict = {}
 
2760
                
 
2761
                # A list of attributes that can not be pickled
 
2762
                # + secret.
 
2763
                exclude = set(("bus", "changedstate", "secret",
 
2764
                               "checker", "server_settings"))
 
2765
                for name, typ in (inspect.getmembers
 
2766
                                  (dbus.service.Object)):
 
2767
                    exclude.add(name)
 
2768
                
 
2769
                client_dict["encrypted_secret"] = (client
 
2770
                                                   .encrypted_secret)
 
2771
                for attr in client.client_structure:
 
2772
                    if attr not in exclude:
 
2773
                        client_dict[attr] = getattr(client, attr)
 
2774
                
 
2775
                clients[client.name] = client_dict
 
2776
                del client_settings[client.name]["secret"]
 
2777
        
 
2778
        try:
 
2779
            with (tempfile.NamedTemporaryFile
 
2780
                  (mode='wb', suffix=".pickle", prefix='clients-',
 
2781
                   dir=os.path.dirname(stored_state_path),
 
2782
                   delete=False)) as stored_state:
 
2783
                pickle.dump((clients, client_settings), stored_state)
 
2784
                tempname=stored_state.name
 
2785
            os.rename(tempname, stored_state_path)
 
2786
        except (IOError, OSError) as e:
 
2787
            if not debug:
 
2788
                try:
 
2789
                    os.remove(tempname)
 
2790
                except NameError:
 
2791
                    pass
 
2792
            if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
 
2793
                logger.warning("Could not save persistent state: {0}"
 
2794
                               .format(os.strerror(e.errno)))
 
2795
            else:
 
2796
                logger.warning("Could not save persistent state:",
 
2797
                               exc_info=e)
 
2798
                raise
 
2799
        
 
2800
        # Delete all clients, and settings from config
 
2801
        while tcp_server.clients:
 
2802
            name, client = tcp_server.clients.popitem()
 
2803
            if use_dbus:
 
2804
                client.remove_from_connection()
 
2805
            # Don't signal anything except ClientRemoved
 
2806
            client.disable(quiet=True)
 
2807
            if use_dbus:
 
2808
                # Emit D-Bus signal
 
2809
                mandos_dbus_service.ClientRemoved(client
 
2810
                                                  .dbus_object_path,
 
2811
                                                  client.name)
 
2812
        client_settings.clear()
 
2813
    
 
2814
    atexit.register(cleanup)
 
2815
    
 
2816
    for client in tcp_server.clients.itervalues():
 
2817
        if use_dbus:
 
2818
            # Emit D-Bus signal
 
2819
            mandos_dbus_service.ClientAdded(client.dbus_object_path)
 
2820
        # Need to initiate checking of clients
 
2821
        if client.enabled:
 
2822
            client.init_checker()
 
2823
    
 
2824
    tcp_server.enable()
 
2825
    tcp_server.server_activate()
 
2826
    
 
2827
    # Find out what port we got
 
2828
    service.port = tcp_server.socket.getsockname()[1]
 
2829
    if use_ipv6:
 
2830
        logger.info("Now listening on address %r, port %d,"
 
2831
                    " flowinfo %d, scope_id %d",
 
2832
                    *tcp_server.socket.getsockname())
 
2833
    else:                       # IPv4
 
2834
        logger.info("Now listening on address %r, port %d",
 
2835
                    *tcp_server.socket.getsockname())
 
2836
    
 
2837
    #service.interface = tcp_server.socket.getsockname()[3]
 
2838
    
 
2839
    try:
 
2840
        # From the Avahi example code
 
2841
        try:
 
2842
            service.activate()
 
2843
        except dbus.exceptions.DBusException as error:
 
2844
            logger.critical("D-Bus Exception", exc_info=error)
 
2845
            cleanup()
 
2846
            sys.exit(1)
 
2847
        # End of Avahi example code
 
2848
        
 
2849
        gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
 
2850
                             lambda *args, **kwargs:
 
2851
                             (tcp_server.handle_request
 
2852
                              (*args[2:], **kwargs) or True))
 
2853
        
 
2854
        logger.debug("Starting main loop")
 
2855
        main_loop.run()
 
2856
    except AvahiError as error:
 
2857
        logger.critical("Avahi Error", exc_info=error)
 
2858
        cleanup()
 
2859
        sys.exit(1)
 
2860
    except KeyboardInterrupt:
 
2861
        if debug:
 
2862
            print("", file=sys.stderr)
 
2863
        logger.debug("Server received KeyboardInterrupt")
 
2864
    logger.debug("Server exiting")
 
2865
    # Must run before the D-Bus bus name gets deregistered
 
2866
    cleanup()
 
2867
 
 
2868
if __name__ == '__main__':
201
2869
    main()
202