/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos

  • Committer: Teddy Hogeborn
  • Date: 2014-02-16 02:42:42 UTC
  • Revision ID: teddy@recompile.se-20140216024242-9wiw1nkxgt7ohovj
Fix running of self-tests.

* debian/control (Build-Depends): Add Python dependencies to
                                  successfully run self-tests.
* debian/copyright: GPLv3 now has its own license file - use it.
* debian/watch: Set PGP signature URL.
* mandos (main): Bug fix: When running self-tests, set exit code.
* mandos-ctl (main): Cosmetic fix; use os.EX_OK instead of plain 0.

Show diffs side-by-side

added added

removed removed

Lines of Context:
11
11
# "AvahiService" class, and some lines in "main".
12
12
13
13
# Everything else is
14
 
# Copyright © 2008-2011 Teddy Hogeborn
15
 
# Copyright © 2008-2011 Björn Påhlsson
 
14
# Copyright © 2008-2014 Teddy Hogeborn
 
15
# Copyright © 2008-2014 Björn Påhlsson
16
16
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
34
34
from __future__ import (division, absolute_import, print_function,
35
35
                        unicode_literals)
36
36
 
 
37
from future_builtins import *
 
38
 
37
39
import SocketServer as socketserver
38
40
import socket
39
41
import argparse
63
65
import cPickle as pickle
64
66
import multiprocessing
65
67
import types
 
68
import binascii
 
69
import tempfile
 
70
import itertools
 
71
import collections
66
72
 
67
73
import dbus
68
74
import dbus.service
82
88
    except ImportError:
83
89
        SO_BINDTODEVICE = None
84
90
 
85
 
 
86
 
version = "1.4.1"
87
 
 
88
 
#logger = logging.getLogger('mandos')
89
 
logger = logging.Logger('mandos')
 
91
version = "1.6.3"
 
92
stored_state_file = "clients.pickle"
 
93
 
 
94
logger = logging.getLogger()
90
95
syslogger = (logging.handlers.SysLogHandler
91
96
             (facility = logging.handlers.SysLogHandler.LOG_DAEMON,
92
97
              address = str("/dev/log")))
93
 
syslogger.setFormatter(logging.Formatter
94
 
                       ('Mandos [%(process)d]: %(levelname)s:'
95
 
                        ' %(message)s'))
96
 
logger.addHandler(syslogger)
97
 
 
98
 
console = logging.StreamHandler()
99
 
console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'
100
 
                                       ' %(levelname)s:'
101
 
                                       ' %(message)s'))
102
 
logger.addHandler(console)
 
98
 
 
99
try:
 
100
    if_nametoindex = (ctypes.cdll.LoadLibrary
 
101
                      (ctypes.util.find_library("c"))
 
102
                      .if_nametoindex)
 
103
except (OSError, AttributeError):
 
104
    def if_nametoindex(interface):
 
105
        "Get an interface index the hard way, i.e. using fcntl()"
 
106
        SIOCGIFINDEX = 0x8933  # From /usr/include/linux/sockios.h
 
107
        with contextlib.closing(socket.socket()) as s:
 
108
            ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
 
109
                                struct.pack(str("16s16x"),
 
110
                                            interface))
 
111
        interface_index = struct.unpack(str("I"),
 
112
                                        ifreq[16:20])[0]
 
113
        return interface_index
 
114
 
 
115
 
 
116
def initlogger(debug, level=logging.WARNING):
 
117
    """init logger and add loglevel"""
 
118
    
 
119
    syslogger.setFormatter(logging.Formatter
 
120
                           ('Mandos [%(process)d]: %(levelname)s:'
 
121
                            ' %(message)s'))
 
122
    logger.addHandler(syslogger)
 
123
    
 
124
    if debug:
 
125
        console = logging.StreamHandler()
 
126
        console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
 
127
                                               ' [%(process)d]:'
 
128
                                               ' %(levelname)s:'
 
129
                                               ' %(message)s'))
 
130
        logger.addHandler(console)
 
131
    logger.setLevel(level)
 
132
 
 
133
 
 
134
class PGPError(Exception):
 
135
    """Exception if encryption/decryption fails"""
 
136
    pass
 
137
 
 
138
 
 
139
class PGPEngine(object):
 
140
    """A simple class for OpenPGP symmetric encryption & decryption"""
 
141
    def __init__(self):
 
142
        self.tempdir = tempfile.mkdtemp(prefix="mandos-")
 
143
        self.gnupgargs = ['--batch',
 
144
                          '--home', self.tempdir,
 
145
                          '--force-mdc',
 
146
                          '--quiet',
 
147
                          '--no-use-agent']
 
148
    
 
149
    def __enter__(self):
 
150
        return self
 
151
    
 
152
    def __exit__(self, exc_type, exc_value, traceback):
 
153
        self._cleanup()
 
154
        return False
 
155
    
 
156
    def __del__(self):
 
157
        self._cleanup()
 
158
    
 
159
    def _cleanup(self):
 
160
        if self.tempdir is not None:
 
161
            # Delete contents of tempdir
 
162
            for root, dirs, files in os.walk(self.tempdir,
 
163
                                             topdown = False):
 
164
                for filename in files:
 
165
                    os.remove(os.path.join(root, filename))
 
166
                for dirname in dirs:
 
167
                    os.rmdir(os.path.join(root, dirname))
 
168
            # Remove tempdir
 
169
            os.rmdir(self.tempdir)
 
170
            self.tempdir = None
 
171
    
 
172
    def password_encode(self, password):
 
173
        # Passphrase can not be empty and can not contain newlines or
 
174
        # NUL bytes.  So we prefix it and hex encode it.
 
175
        encoded = b"mandos" + binascii.hexlify(password)
 
176
        if len(encoded) > 2048:
 
177
            # GnuPG can't handle long passwords, so encode differently
 
178
            encoded = (b"mandos" + password.replace(b"\\", b"\\\\")
 
179
                       .replace(b"\n", b"\\n")
 
180
                       .replace(b"\0", b"\\x00"))
 
181
        return encoded
 
182
    
 
183
    def encrypt(self, data, password):
 
184
        passphrase = self.password_encode(password)
 
185
        with tempfile.NamedTemporaryFile(dir=self.tempdir
 
186
                                         ) as passfile:
 
187
            passfile.write(passphrase)
 
188
            passfile.flush()
 
189
            proc = subprocess.Popen(['gpg', '--symmetric',
 
190
                                     '--passphrase-file',
 
191
                                     passfile.name]
 
192
                                    + self.gnupgargs,
 
193
                                    stdin = subprocess.PIPE,
 
194
                                    stdout = subprocess.PIPE,
 
195
                                    stderr = subprocess.PIPE)
 
196
            ciphertext, err = proc.communicate(input = data)
 
197
        if proc.returncode != 0:
 
198
            raise PGPError(err)
 
199
        return ciphertext
 
200
    
 
201
    def decrypt(self, data, password):
 
202
        passphrase = self.password_encode(password)
 
203
        with tempfile.NamedTemporaryFile(dir = self.tempdir
 
204
                                         ) as passfile:
 
205
            passfile.write(passphrase)
 
206
            passfile.flush()
 
207
            proc = subprocess.Popen(['gpg', '--decrypt',
 
208
                                     '--passphrase-file',
 
209
                                     passfile.name]
 
210
                                    + self.gnupgargs,
 
211
                                    stdin = subprocess.PIPE,
 
212
                                    stdout = subprocess.PIPE,
 
213
                                    stderr = subprocess.PIPE)
 
214
            decrypted_plaintext, err = proc.communicate(input
 
215
                                                        = data)
 
216
        if proc.returncode != 0:
 
217
            raise PGPError(err)
 
218
        return decrypted_plaintext
 
219
 
103
220
 
104
221
class AvahiError(Exception):
105
222
    def __init__(self, value, *args, **kwargs):
123
240
               Used to optionally bind to the specified interface.
124
241
    name: string; Example: 'Mandos'
125
242
    type: string; Example: '_mandos._tcp'.
126
 
                  See <http://www.dns-sd.org/ServiceTypes.html>
 
243
     See <https://www.iana.org/assignments/service-names-port-numbers>
127
244
    port: integer; what port to announce
128
245
    TXT: list of strings; TXT record for the service
129
246
    domain: string; Domain to publish on, default to .local if empty.
135
252
    server: D-Bus Server
136
253
    bus: dbus.SystemBus()
137
254
    """
 
255
    
138
256
    def __init__(self, interface = avahi.IF_UNSPEC, name = None,
139
257
                 servicetype = None, port = None, TXT = None,
140
258
                 domain = "", host = "", max_renames = 32768,
153
271
        self.server = None
154
272
        self.bus = bus
155
273
        self.entry_group_state_changed_match = None
 
274
    
156
275
    def rename(self):
157
276
        """Derived from the Avahi example code"""
158
277
        if self.rename_count >= self.max_renames:
164
283
                            .GetAlternativeServiceName(self.name))
165
284
        logger.info("Changing Zeroconf service name to %r ...",
166
285
                    self.name)
167
 
        syslogger.setFormatter(logging.Formatter
168
 
                               ('Mandos (%s) [%%(process)d]:'
169
 
                                ' %%(levelname)s: %%(message)s'
170
 
                                % self.name))
171
286
        self.remove()
172
287
        try:
173
288
            self.add()
174
289
        except dbus.exceptions.DBusException as error:
175
 
            logger.critical("DBusException: %s", error)
 
290
            logger.critical("D-Bus Exception", exc_info=error)
176
291
            self.cleanup()
177
292
            os._exit(1)
178
293
        self.rename_count += 1
 
294
    
179
295
    def remove(self):
180
296
        """Derived from the Avahi example code"""
181
297
        if self.entry_group_state_changed_match is not None:
183
299
            self.entry_group_state_changed_match = None
184
300
        if self.group is not None:
185
301
            self.group.Reset()
 
302
    
186
303
    def add(self):
187
304
        """Derived from the Avahi example code"""
188
305
        self.remove()
193
310
                avahi.DBUS_INTERFACE_ENTRY_GROUP)
194
311
        self.entry_group_state_changed_match = (
195
312
            self.group.connect_to_signal(
196
 
                'StateChanged', self .entry_group_state_changed))
 
313
                'StateChanged', self.entry_group_state_changed))
197
314
        logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
198
315
                     self.name, self.type)
199
316
        self.group.AddService(
205
322
            dbus.UInt16(self.port),
206
323
            avahi.string_array_to_txt_array(self.TXT))
207
324
        self.group.Commit()
 
325
    
208
326
    def entry_group_state_changed(self, state, error):
209
327
        """Derived from the Avahi example code"""
210
328
        logger.debug("Avahi entry group state change: %i", state)
217
335
        elif state == avahi.ENTRY_GROUP_FAILURE:
218
336
            logger.critical("Avahi: Error in group state changed %s",
219
337
                            unicode(error))
220
 
            raise AvahiGroupError("State changed: %s"
221
 
                                  % unicode(error))
 
338
            raise AvahiGroupError("State changed: {0!s}"
 
339
                                  .format(error))
 
340
    
222
341
    def cleanup(self):
223
342
        """Derived from the Avahi example code"""
224
343
        if self.group is not None:
225
344
            try:
226
345
                self.group.Free()
227
346
            except (dbus.exceptions.UnknownMethodException,
228
 
                    dbus.exceptions.DBusException) as e:
 
347
                    dbus.exceptions.DBusException):
229
348
                pass
230
349
            self.group = None
231
350
        self.remove()
 
351
    
232
352
    def server_state_changed(self, state, error=None):
233
353
        """Derived from the Avahi example code"""
234
354
        logger.debug("Avahi server state change: %i", state)
253
373
                logger.debug("Unknown state: %r", state)
254
374
            else:
255
375
                logger.debug("Unknown state: %r: %r", state, error)
 
376
    
256
377
    def activate(self):
257
378
        """Derived from the Avahi example code"""
258
379
        if self.server is None:
266
387
        self.server_state_changed(self.server.GetState())
267
388
 
268
389
 
269
 
def _timedelta_to_milliseconds(td):
 
390
class AvahiServiceToSyslog(AvahiService):
 
391
    def rename(self):
 
392
        """Add the new name to the syslog messages"""
 
393
        ret = AvahiService.rename(self)
 
394
        syslogger.setFormatter(logging.Formatter
 
395
                               ('Mandos ({0}) [%(process)d]:'
 
396
                                ' %(levelname)s: %(message)s'
 
397
                                .format(self.name)))
 
398
        return ret
 
399
 
 
400
 
 
401
def timedelta_to_milliseconds(td):
270
402
    "Convert a datetime.timedelta() to milliseconds"
271
403
    return ((td.days * 24 * 60 * 60 * 1000)
272
404
            + (td.seconds * 1000)
273
405
            + (td.microseconds // 1000))
274
 
        
 
406
 
 
407
 
275
408
class Client(object):
276
409
    """A representation of a client host served by this server.
277
410
    
278
411
    Attributes:
279
 
    _approved:   bool(); 'None' if not yet approved/disapproved
 
412
    approved:   bool(); 'None' if not yet approved/disapproved
280
413
    approval_delay: datetime.timedelta(); Time to wait for approval
281
414
    approval_duration: datetime.timedelta(); Duration of one approval
282
415
    checker:    subprocess.Popen(); a running checker process used
289
422
                     instance %(name)s can be used in the command.
290
423
    checker_initiator_tag: a gobject event source tag, or None
291
424
    created:    datetime.datetime(); (UTC) object creation
 
425
    client_structure: Object describing what attributes a client has
 
426
                      and is used for storing the client at exit
292
427
    current_checker_command: string; current running checker_command
293
 
    disable_hook:  If set, called by disable() as disable_hook(self)
294
428
    disable_initiator_tag: a gobject event source tag, or None
295
429
    enabled:    bool()
296
430
    fingerprint: string (40 or 32 hexadecimal digits); used to
299
433
    interval:   datetime.timedelta(); How often to start a new checker
300
434
    last_approval_request: datetime.datetime(); (UTC) or None
301
435
    last_checked_ok: datetime.datetime(); (UTC) or None
302
 
    last_enabled: datetime.datetime(); (UTC)
 
436
    last_checker_status: integer between 0 and 255 reflecting exit
 
437
                         status of last checker. -1 reflects crashed
 
438
                         checker, -2 means no checker completed yet.
 
439
    last_enabled: datetime.datetime(); (UTC) or None
303
440
    name:       string; from the config file, used in log messages and
304
441
                        D-Bus identifiers
305
442
    secret:     bytestring; sent verbatim (over TLS) to client
306
443
    timeout:    datetime.timedelta(); How long from last_checked_ok
307
444
                                      until this client is disabled
308
 
    extended_timeout:   extra long timeout when password has been sent
 
445
    extended_timeout:   extra long timeout when secret has been sent
309
446
    runtime_expansions: Allowed attributes for runtime expansion.
310
447
    expires:    datetime.datetime(); time (UTC) when a client will be
311
448
                disabled, or None
 
449
    server_settings: The server_settings dict from main()
312
450
    """
313
451
    
314
452
    runtime_expansions = ("approval_delay", "approval_duration",
315
 
                          "created", "enabled", "fingerprint",
316
 
                          "host", "interval", "last_checked_ok",
 
453
                          "created", "enabled", "expires",
 
454
                          "fingerprint", "host", "interval",
 
455
                          "last_approval_request", "last_checked_ok",
317
456
                          "last_enabled", "name", "timeout")
 
457
    client_defaults = { "timeout": "PT5M",
 
458
                        "extended_timeout": "PT15M",
 
459
                        "interval": "PT2M",
 
460
                        "checker": "fping -q -- %%(host)s",
 
461
                        "host": "",
 
462
                        "approval_delay": "PT0S",
 
463
                        "approval_duration": "PT1S",
 
464
                        "approved_by_default": "True",
 
465
                        "enabled": "True",
 
466
                        }
318
467
    
319
468
    def timeout_milliseconds(self):
320
469
        "Return the 'timeout' attribute in milliseconds"
321
 
        return _timedelta_to_milliseconds(self.timeout)
 
470
        return timedelta_to_milliseconds(self.timeout)
322
471
    
323
472
    def extended_timeout_milliseconds(self):
324
473
        "Return the 'extended_timeout' attribute in milliseconds"
325
 
        return _timedelta_to_milliseconds(self.extended_timeout)
 
474
        return timedelta_to_milliseconds(self.extended_timeout)
326
475
    
327
476
    def interval_milliseconds(self):
328
477
        "Return the 'interval' attribute in milliseconds"
329
 
        return _timedelta_to_milliseconds(self.interval)
 
478
        return timedelta_to_milliseconds(self.interval)
330
479
    
331
480
    def approval_delay_milliseconds(self):
332
 
        return _timedelta_to_milliseconds(self.approval_delay)
333
 
    
334
 
    def __init__(self, name = None, disable_hook=None, config=None):
335
 
        """Note: the 'checker' key in 'config' sets the
336
 
        'checker_command' attribute and *not* the 'checker'
337
 
        attribute."""
 
481
        return timedelta_to_milliseconds(self.approval_delay)
 
482
    
 
483
    @staticmethod
 
484
    def config_parser(config):
 
485
        """Construct a new dict of client settings of this form:
 
486
        { client_name: {setting_name: value, ...}, ...}
 
487
        with exceptions for any special settings as defined above.
 
488
        NOTE: Must be a pure function. Must return the same result
 
489
        value given the same arguments.
 
490
        """
 
491
        settings = {}
 
492
        for client_name in config.sections():
 
493
            section = dict(config.items(client_name))
 
494
            client = settings[client_name] = {}
 
495
            
 
496
            client["host"] = section["host"]
 
497
            # Reformat values from string types to Python types
 
498
            client["approved_by_default"] = config.getboolean(
 
499
                client_name, "approved_by_default")
 
500
            client["enabled"] = config.getboolean(client_name,
 
501
                                                  "enabled")
 
502
            
 
503
            client["fingerprint"] = (section["fingerprint"].upper()
 
504
                                     .replace(" ", ""))
 
505
            if "secret" in section:
 
506
                client["secret"] = section["secret"].decode("base64")
 
507
            elif "secfile" in section:
 
508
                with open(os.path.expanduser(os.path.expandvars
 
509
                                             (section["secfile"])),
 
510
                          "rb") as secfile:
 
511
                    client["secret"] = secfile.read()
 
512
            else:
 
513
                raise TypeError("No secret or secfile for section {0}"
 
514
                                .format(section))
 
515
            client["timeout"] = string_to_delta(section["timeout"])
 
516
            client["extended_timeout"] = string_to_delta(
 
517
                section["extended_timeout"])
 
518
            client["interval"] = string_to_delta(section["interval"])
 
519
            client["approval_delay"] = string_to_delta(
 
520
                section["approval_delay"])
 
521
            client["approval_duration"] = string_to_delta(
 
522
                section["approval_duration"])
 
523
            client["checker_command"] = section["checker"]
 
524
            client["last_approval_request"] = None
 
525
            client["last_checked_ok"] = None
 
526
            client["last_checker_status"] = -2
 
527
        
 
528
        return settings
 
529
    
 
530
    def __init__(self, settings, name = None, server_settings=None):
338
531
        self.name = name
339
 
        if config is None:
340
 
            config = {}
 
532
        if server_settings is None:
 
533
            server_settings = {}
 
534
        self.server_settings = server_settings
 
535
        # adding all client settings
 
536
        for setting, value in settings.iteritems():
 
537
            setattr(self, setting, value)
 
538
        
 
539
        if self.enabled:
 
540
            if not hasattr(self, "last_enabled"):
 
541
                self.last_enabled = datetime.datetime.utcnow()
 
542
            if not hasattr(self, "expires"):
 
543
                self.expires = (datetime.datetime.utcnow()
 
544
                                + self.timeout)
 
545
        else:
 
546
            self.last_enabled = None
 
547
            self.expires = None
 
548
        
341
549
        logger.debug("Creating client %r", self.name)
342
550
        # Uppercase and remove spaces from fingerprint for later
343
551
        # comparison purposes with return value from the fingerprint()
344
552
        # function
345
 
        self.fingerprint = (config["fingerprint"].upper()
346
 
                            .replace(" ", ""))
347
553
        logger.debug("  Fingerprint: %s", self.fingerprint)
348
 
        if "secret" in config:
349
 
            self.secret = config["secret"].decode("base64")
350
 
        elif "secfile" in config:
351
 
            with open(os.path.expanduser(os.path.expandvars
352
 
                                         (config["secfile"])),
353
 
                      "rb") as secfile:
354
 
                self.secret = secfile.read()
355
 
        else:
356
 
            raise TypeError("No secret or secfile for client %s"
357
 
                            % self.name)
358
 
        self.host = config.get("host", "")
359
 
        self.created = datetime.datetime.utcnow()
360
 
        self.enabled = False
361
 
        self.last_approval_request = None
362
 
        self.last_enabled = None
363
 
        self.last_checked_ok = None
364
 
        self.timeout = string_to_delta(config["timeout"])
365
 
        self.extended_timeout = string_to_delta(config
366
 
                                                ["extended_timeout"])
367
 
        self.interval = string_to_delta(config["interval"])
368
 
        self.disable_hook = disable_hook
 
554
        self.created = settings.get("created",
 
555
                                    datetime.datetime.utcnow())
 
556
        
 
557
        # attributes specific for this server instance
369
558
        self.checker = None
370
559
        self.checker_initiator_tag = None
371
560
        self.disable_initiator_tag = None
372
 
        self.expires = None
373
561
        self.checker_callback_tag = None
374
 
        self.checker_command = config["checker"]
375
562
        self.current_checker_command = None
376
 
        self.last_connect = None
377
 
        self._approved = None
378
 
        self.approved_by_default = config.get("approved_by_default",
379
 
                                              True)
 
563
        self.approved = None
380
564
        self.approvals_pending = 0
381
 
        self.approval_delay = string_to_delta(
382
 
            config["approval_delay"])
383
 
        self.approval_duration = string_to_delta(
384
 
            config["approval_duration"])
385
565
        self.changedstate = (multiprocessing_manager
386
566
                             .Condition(multiprocessing_manager
387
567
                                        .Lock()))
 
568
        self.client_structure = [attr for attr in
 
569
                                 self.__dict__.iterkeys()
 
570
                                 if not attr.startswith("_")]
 
571
        self.client_structure.append("client_structure")
 
572
        
 
573
        for name, t in inspect.getmembers(type(self),
 
574
                                          lambda obj:
 
575
                                              isinstance(obj,
 
576
                                                         property)):
 
577
            if not name.startswith("_"):
 
578
                self.client_structure.append(name)
388
579
    
 
580
    # Send notice to process children that client state has changed
389
581
    def send_changedstate(self):
390
 
        self.changedstate.acquire()
391
 
        self.changedstate.notify_all()
392
 
        self.changedstate.release()
 
582
        with self.changedstate:
 
583
            self.changedstate.notify_all()
393
584
    
394
585
    def enable(self):
395
586
        """Start this client's checker and timeout hooks"""
396
587
        if getattr(self, "enabled", False):
397
588
            # Already enabled
398
589
            return
 
590
        self.expires = datetime.datetime.utcnow() + self.timeout
 
591
        self.enabled = True
 
592
        self.last_enabled = datetime.datetime.utcnow()
 
593
        self.init_checker()
399
594
        self.send_changedstate()
 
595
    
 
596
    def disable(self, quiet=True):
 
597
        """Disable this client."""
 
598
        if not getattr(self, "enabled", False):
 
599
            return False
 
600
        if not quiet:
 
601
            logger.info("Disabling client %s", self.name)
 
602
        if getattr(self, "disable_initiator_tag", None) is not None:
 
603
            gobject.source_remove(self.disable_initiator_tag)
 
604
            self.disable_initiator_tag = None
 
605
        self.expires = None
 
606
        if getattr(self, "checker_initiator_tag", None) is not None:
 
607
            gobject.source_remove(self.checker_initiator_tag)
 
608
            self.checker_initiator_tag = None
 
609
        self.stop_checker()
 
610
        self.enabled = False
 
611
        if not quiet:
 
612
            self.send_changedstate()
 
613
        # Do not run this again if called by a gobject.timeout_add
 
614
        return False
 
615
    
 
616
    def __del__(self):
 
617
        self.disable()
 
618
    
 
619
    def init_checker(self):
400
620
        # Schedule a new checker to be started an 'interval' from now,
401
621
        # and every interval from then on.
 
622
        if self.checker_initiator_tag is not None:
 
623
            gobject.source_remove(self.checker_initiator_tag)
402
624
        self.checker_initiator_tag = (gobject.timeout_add
403
625
                                      (self.interval_milliseconds(),
404
626
                                       self.start_checker))
405
627
        # Schedule a disable() when 'timeout' has passed
406
 
        self.expires = datetime.datetime.utcnow() + self.timeout
 
628
        if self.disable_initiator_tag is not None:
 
629
            gobject.source_remove(self.disable_initiator_tag)
407
630
        self.disable_initiator_tag = (gobject.timeout_add
408
631
                                   (self.timeout_milliseconds(),
409
632
                                    self.disable))
410
 
        self.enabled = True
411
 
        self.last_enabled = datetime.datetime.utcnow()
412
633
        # Also start a new checker *right now*.
413
634
        self.start_checker()
414
635
    
415
 
    def disable(self, quiet=True):
416
 
        """Disable this client."""
417
 
        if not getattr(self, "enabled", False):
418
 
            return False
419
 
        if not quiet:
420
 
            self.send_changedstate()
421
 
        if not quiet:
422
 
            logger.info("Disabling client %s", self.name)
423
 
        if getattr(self, "disable_initiator_tag", False):
424
 
            gobject.source_remove(self.disable_initiator_tag)
425
 
            self.disable_initiator_tag = None
426
 
        self.expires = None
427
 
        if getattr(self, "checker_initiator_tag", False):
428
 
            gobject.source_remove(self.checker_initiator_tag)
429
 
            self.checker_initiator_tag = None
430
 
        self.stop_checker()
431
 
        if self.disable_hook:
432
 
            self.disable_hook(self)
433
 
        self.enabled = False
434
 
        # Do not run this again if called by a gobject.timeout_add
435
 
        return False
436
 
    
437
 
    def __del__(self):
438
 
        self.disable_hook = None
439
 
        self.disable()
440
 
    
441
636
    def checker_callback(self, pid, condition, command):
442
637
        """The checker has completed, so take appropriate actions."""
443
638
        self.checker_callback_tag = None
444
639
        self.checker = None
445
640
        if os.WIFEXITED(condition):
446
 
            exitstatus = os.WEXITSTATUS(condition)
447
 
            if exitstatus == 0:
 
641
            self.last_checker_status = os.WEXITSTATUS(condition)
 
642
            if self.last_checker_status == 0:
448
643
                logger.info("Checker for %(name)s succeeded",
449
644
                            vars(self))
450
645
                self.checked_ok()
452
647
                logger.info("Checker for %(name)s failed",
453
648
                            vars(self))
454
649
        else:
 
650
            self.last_checker_status = -1
455
651
            logger.warning("Checker for %(name)s crashed?",
456
652
                           vars(self))
457
653
    
458
 
    def checked_ok(self, timeout=None):
459
 
        """Bump up the timeout for this client.
460
 
        
461
 
        This should only be called when the client has been seen,
462
 
        alive and well.
463
 
        """
 
654
    def checked_ok(self):
 
655
        """Assert that the client has been seen, alive and well."""
 
656
        self.last_checked_ok = datetime.datetime.utcnow()
 
657
        self.last_checker_status = 0
 
658
        self.bump_timeout()
 
659
    
 
660
    def bump_timeout(self, timeout=None):
 
661
        """Bump up the timeout for this client."""
464
662
        if timeout is None:
465
663
            timeout = self.timeout
466
 
        self.last_checked_ok = datetime.datetime.utcnow()
467
664
        if self.disable_initiator_tag is not None:
468
665
            gobject.source_remove(self.disable_initiator_tag)
 
666
            self.disable_initiator_tag = None
469
667
        if getattr(self, "enabled", False):
470
668
            self.disable_initiator_tag = (gobject.timeout_add
471
 
                                          (_timedelta_to_milliseconds
 
669
                                          (timedelta_to_milliseconds
472
670
                                           (timeout), self.disable))
473
671
            self.expires = datetime.datetime.utcnow() + timeout
474
672
    
481
679
        If a checker already exists, leave it running and do
482
680
        nothing."""
483
681
        # The reason for not killing a running checker is that if we
484
 
        # did that, then if a checker (for some reason) started
485
 
        # running slowly and taking more than 'interval' time, the
486
 
        # client would inevitably timeout, since no checker would get
487
 
        # a chance to run to completion.  If we instead leave running
 
682
        # did that, and if a checker (for some reason) started running
 
683
        # slowly and taking more than 'interval' time, then the client
 
684
        # would inevitably timeout, since no checker would get a
 
685
        # chance to run to completion.  If we instead leave running
488
686
        # checkers alone, the checker would have to take more time
489
687
        # than 'timeout' for the client to be disabled, which is as it
490
688
        # should be.
492
690
        # If a checker exists, make sure it is not a zombie
493
691
        try:
494
692
            pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
495
 
        except (AttributeError, OSError) as error:
496
 
            if (isinstance(error, OSError)
497
 
                and error.errno != errno.ECHILD):
498
 
                raise error
 
693
        except AttributeError:
 
694
            pass
 
695
        except OSError as error:
 
696
            if error.errno != errno.ECHILD:
 
697
                raise
499
698
        else:
500
699
            if pid:
501
700
                logger.warning("Checker was a zombie")
504
703
                                      self.current_checker_command)
505
704
        # Start a new checker if needed
506
705
        if self.checker is None:
 
706
            # Escape attributes for the shell
 
707
            escaped_attrs = dict(
 
708
                (attr, re.escape(unicode(getattr(self, attr))))
 
709
                for attr in
 
710
                self.runtime_expansions)
507
711
            try:
508
 
                # In case checker_command has exactly one % operator
509
 
                command = self.checker_command % self.host
510
 
            except TypeError:
511
 
                # Escape attributes for the shell
512
 
                escaped_attrs = dict(
513
 
                    (attr,
514
 
                     re.escape(unicode(str(getattr(self, attr, "")),
515
 
                                       errors=
516
 
                                       'replace')))
517
 
                    for attr in
518
 
                    self.runtime_expansions)
519
 
                
520
 
                try:
521
 
                    command = self.checker_command % escaped_attrs
522
 
                except TypeError as error:
523
 
                    logger.error('Could not format string "%s":'
524
 
                                 ' %s', self.checker_command, error)
525
 
                    return True # Try again later
 
712
                command = self.checker_command % escaped_attrs
 
713
            except TypeError as error:
 
714
                logger.error('Could not format string "%s"',
 
715
                             self.checker_command, exc_info=error)
 
716
                return True # Try again later
526
717
            self.current_checker_command = command
527
718
            try:
528
719
                logger.info("Starting checker %r for %s",
531
722
                # in normal mode, that is already done by daemon(),
532
723
                # and in debug mode we don't want to.  (Stdin is
533
724
                # always replaced by /dev/null.)
 
725
                # The exception is when not debugging but nevertheless
 
726
                # running in the foreground; use the previously
 
727
                # created wnull.
 
728
                popen_args = {}
 
729
                if (not self.server_settings["debug"]
 
730
                    and self.server_settings["foreground"]):
 
731
                    popen_args.update({"stdout": wnull,
 
732
                                       "stderr": wnull })
534
733
                self.checker = subprocess.Popen(command,
535
734
                                                close_fds=True,
536
 
                                                shell=True, cwd="/")
537
 
                self.checker_callback_tag = (gobject.child_watch_add
538
 
                                             (self.checker.pid,
539
 
                                              self.checker_callback,
540
 
                                              data=command))
541
 
                # The checker may have completed before the gobject
542
 
                # watch was added.  Check for this.
 
735
                                                shell=True, cwd="/",
 
736
                                                **popen_args)
 
737
            except OSError as error:
 
738
                logger.error("Failed to start subprocess",
 
739
                             exc_info=error)
 
740
                return True
 
741
            self.checker_callback_tag = (gobject.child_watch_add
 
742
                                         (self.checker.pid,
 
743
                                          self.checker_callback,
 
744
                                          data=command))
 
745
            # The checker may have completed before the gobject
 
746
            # watch was added.  Check for this.
 
747
            try:
543
748
                pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
544
 
                if pid:
545
 
                    gobject.source_remove(self.checker_callback_tag)
546
 
                    self.checker_callback(pid, status, command)
547
749
            except OSError as error:
548
 
                logger.error("Failed to start subprocess: %s",
549
 
                             error)
 
750
                if error.errno == errno.ECHILD:
 
751
                    # This should never happen
 
752
                    logger.error("Child process vanished",
 
753
                                 exc_info=error)
 
754
                    return True
 
755
                raise
 
756
            if pid:
 
757
                gobject.source_remove(self.checker_callback_tag)
 
758
                self.checker_callback(pid, status, command)
550
759
        # Re-run this periodically if run by gobject.timeout_add
551
760
        return True
552
761
    
559
768
            return
560
769
        logger.debug("Stopping checker for %(name)s", vars(self))
561
770
        try:
562
 
            os.kill(self.checker.pid, signal.SIGTERM)
 
771
            self.checker.terminate()
563
772
            #time.sleep(0.5)
564
773
            #if self.checker.poll() is None:
565
 
            #    os.kill(self.checker.pid, signal.SIGKILL)
 
774
            #    self.checker.kill()
566
775
        except OSError as error:
567
776
            if error.errno != errno.ESRCH: # No such process
568
777
                raise
585
794
    # "Set" method, so we fail early here:
586
795
    if byte_arrays and signature != "ay":
587
796
        raise ValueError("Byte arrays not supported for non-'ay'"
588
 
                         " signature %r" % signature)
 
797
                         " signature {0!r}".format(signature))
589
798
    def decorator(func):
590
799
        func._dbus_is_property = True
591
800
        func._dbus_interface = dbus_interface
599
808
    return decorator
600
809
 
601
810
 
 
811
def dbus_interface_annotations(dbus_interface):
 
812
    """Decorator for marking functions returning interface annotations
 
813
    
 
814
    Usage:
 
815
    
 
816
    @dbus_interface_annotations("org.example.Interface")
 
817
    def _foo(self):  # Function name does not matter
 
818
        return {"org.freedesktop.DBus.Deprecated": "true",
 
819
                "org.freedesktop.DBus.Property.EmitsChangedSignal":
 
820
                    "false"}
 
821
    """
 
822
    def decorator(func):
 
823
        func._dbus_is_interface = True
 
824
        func._dbus_interface = dbus_interface
 
825
        func._dbus_name = dbus_interface
 
826
        return func
 
827
    return decorator
 
828
 
 
829
 
 
830
def dbus_annotations(annotations):
 
831
    """Decorator to annotate D-Bus methods, signals or properties
 
832
    Usage:
 
833
    
 
834
    @dbus_service_property("org.example.Interface", signature="b",
 
835
                           access="r")
 
836
    @dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",
 
837
                        "org.freedesktop.DBus.Property."
 
838
                        "EmitsChangedSignal": "false"})
 
839
    def Property_dbus_property(self):
 
840
        return dbus.Boolean(False)
 
841
    """
 
842
    def decorator(func):
 
843
        func._dbus_annotations = annotations
 
844
        return func
 
845
    return decorator
 
846
 
 
847
 
602
848
class DBusPropertyException(dbus.exceptions.DBusException):
603
849
    """A base class for D-Bus property-related exceptions
604
850
    """
627
873
    """
628
874
    
629
875
    @staticmethod
630
 
    def _is_dbus_property(obj):
631
 
        return getattr(obj, "_dbus_is_property", False)
 
876
    def _is_dbus_thing(thing):
 
877
        """Returns a function testing if an attribute is a D-Bus thing
 
878
        
 
879
        If called like _is_dbus_thing("method") it returns a function
 
880
        suitable for use as predicate to inspect.getmembers().
 
881
        """
 
882
        return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),
 
883
                                   False)
632
884
    
633
 
    def _get_all_dbus_properties(self):
 
885
    def _get_all_dbus_things(self, thing):
634
886
        """Returns a generator of (name, attribute) pairs
635
887
        """
636
 
        return ((prop.__get__(self)._dbus_name, prop.__get__(self))
 
888
        return ((getattr(athing.__get__(self), "_dbus_name",
 
889
                         name),
 
890
                 athing.__get__(self))
637
891
                for cls in self.__class__.__mro__
638
 
                for name, prop in
639
 
                inspect.getmembers(cls, self._is_dbus_property))
 
892
                for name, athing in
 
893
                inspect.getmembers(cls,
 
894
                                   self._is_dbus_thing(thing)))
640
895
    
641
896
    def _get_dbus_property(self, interface_name, property_name):
642
897
        """Returns a bound method if one exists which is a D-Bus
644
899
        """
645
900
        for cls in  self.__class__.__mro__:
646
901
            for name, value in (inspect.getmembers
647
 
                                (cls, self._is_dbus_property)):
 
902
                                (cls,
 
903
                                 self._is_dbus_thing("property"))):
648
904
                if (value._dbus_name == property_name
649
905
                    and value._dbus_interface == interface_name):
650
906
                    return value.__get__(self)
678
934
            # The byte_arrays option is not supported yet on
679
935
            # signatures other than "ay".
680
936
            if prop._dbus_signature != "ay":
681
 
                raise ValueError
682
 
            value = dbus.ByteArray(''.join(unichr(byte)
683
 
                                           for byte in value))
 
937
                raise ValueError("Byte arrays not supported for non-"
 
938
                                 "'ay' signature {0!r}"
 
939
                                 .format(prop._dbus_signature))
 
940
            value = dbus.ByteArray(b''.join(chr(byte)
 
941
                                            for byte in value))
684
942
        prop(value)
685
943
    
686
944
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
691
949
        
692
950
        Note: Will not include properties with access="write".
693
951
        """
694
 
        all = {}
695
 
        for name, prop in self._get_all_dbus_properties():
 
952
        properties = {}
 
953
        for name, prop in self._get_all_dbus_things("property"):
696
954
            if (interface_name
697
955
                and interface_name != prop._dbus_interface):
698
956
                # Interface non-empty but did not match
702
960
                continue
703
961
            value = prop()
704
962
            if not hasattr(value, "variant_level"):
705
 
                all[name] = value
 
963
                properties[name] = value
706
964
                continue
707
 
            all[name] = type(value)(value, variant_level=
708
 
                                    value.variant_level+1)
709
 
        return dbus.Dictionary(all, signature="sv")
 
965
            properties[name] = type(value)(value, variant_level=
 
966
                                           value.variant_level+1)
 
967
        return dbus.Dictionary(properties, signature="sv")
710
968
    
711
969
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
712
970
                         out_signature="s",
713
971
                         path_keyword='object_path',
714
972
                         connection_keyword='connection')
715
973
    def Introspect(self, object_path, connection):
716
 
        """Standard D-Bus method, overloaded to insert property tags.
 
974
        """Overloading of standard D-Bus method.
 
975
        
 
976
        Inserts property tags and interface annotation tags.
717
977
        """
718
978
        xmlstring = dbus.service.Object.Introspect(self, object_path,
719
979
                                                   connection)
726
986
                e.setAttribute("access", prop._dbus_access)
727
987
                return e
728
988
            for if_tag in document.getElementsByTagName("interface"):
 
989
                # Add property tags
729
990
                for tag in (make_tag(document, name, prop)
730
991
                            for name, prop
731
 
                            in self._get_all_dbus_properties()
 
992
                            in self._get_all_dbus_things("property")
732
993
                            if prop._dbus_interface
733
994
                            == if_tag.getAttribute("name")):
734
995
                    if_tag.appendChild(tag)
 
996
                # Add annotation tags
 
997
                for typ in ("method", "signal", "property"):
 
998
                    for tag in if_tag.getElementsByTagName(typ):
 
999
                        annots = dict()
 
1000
                        for name, prop in (self.
 
1001
                                           _get_all_dbus_things(typ)):
 
1002
                            if (name == tag.getAttribute("name")
 
1003
                                and prop._dbus_interface
 
1004
                                == if_tag.getAttribute("name")):
 
1005
                                annots.update(getattr
 
1006
                                              (prop,
 
1007
                                               "_dbus_annotations",
 
1008
                                               {}))
 
1009
                        for name, value in annots.iteritems():
 
1010
                            ann_tag = document.createElement(
 
1011
                                "annotation")
 
1012
                            ann_tag.setAttribute("name", name)
 
1013
                            ann_tag.setAttribute("value", value)
 
1014
                            tag.appendChild(ann_tag)
 
1015
                # Add interface annotation tags
 
1016
                for annotation, value in dict(
 
1017
                    itertools.chain.from_iterable(
 
1018
                        annotations().iteritems()
 
1019
                        for name, annotations in
 
1020
                        self._get_all_dbus_things("interface")
 
1021
                        if name == if_tag.getAttribute("name")
 
1022
                        )).iteritems():
 
1023
                    ann_tag = document.createElement("annotation")
 
1024
                    ann_tag.setAttribute("name", annotation)
 
1025
                    ann_tag.setAttribute("value", value)
 
1026
                    if_tag.appendChild(ann_tag)
735
1027
                # Add the names to the return values for the
736
1028
                # "org.freedesktop.DBus.Properties" methods
737
1029
                if (if_tag.getAttribute("name")
752
1044
        except (AttributeError, xml.dom.DOMException,
753
1045
                xml.parsers.expat.ExpatError) as error:
754
1046
            logger.error("Failed to override Introspection method",
755
 
                         error)
 
1047
                         exc_info=error)
756
1048
        return xmlstring
757
1049
 
758
1050
 
759
 
def datetime_to_dbus (dt, variant_level=0):
 
1051
def datetime_to_dbus(dt, variant_level=0):
760
1052
    """Convert a UTC datetime.datetime() to a D-Bus type."""
761
1053
    if dt is None:
762
1054
        return dbus.String("", variant_level = variant_level)
763
1055
    return dbus.String(dt.isoformat(),
764
1056
                       variant_level=variant_level)
765
1057
 
766
 
class AlternateDBusNamesMetaclass(DBusObjectWithProperties
767
 
                                  .__metaclass__):
768
 
    """Applied to an empty subclass of a D-Bus object, this metaclass
769
 
    will add additional D-Bus attributes matching a certain pattern.
 
1058
 
 
1059
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
 
1060
    """A class decorator; applied to a subclass of
 
1061
    dbus.service.Object, it will add alternate D-Bus attributes with
 
1062
    interface names according to the "alt_interface_names" mapping.
 
1063
    Usage:
 
1064
    
 
1065
    @alternate_dbus_interfaces({"org.example.Interface":
 
1066
                                    "net.example.AlternateInterface"})
 
1067
    class SampleDBusObject(dbus.service.Object):
 
1068
        @dbus.service.method("org.example.Interface")
 
1069
        def SampleDBusMethod():
 
1070
            pass
 
1071
    
 
1072
    The above "SampleDBusMethod" on "SampleDBusObject" will be
 
1073
    reachable via two interfaces: "org.example.Interface" and
 
1074
    "net.example.AlternateInterface", the latter of which will have
 
1075
    its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
 
1076
    "true", unless "deprecate" is passed with a False value.
 
1077
    
 
1078
    This works for methods and signals, and also for D-Bus properties
 
1079
    (from DBusObjectWithProperties) and interfaces (from the
 
1080
    dbus_interface_annotations decorator).
770
1081
    """
771
 
    def __new__(mcs, name, bases, attr):
772
 
        # Go through all the base classes which could have D-Bus
773
 
        # methods, signals, or properties in them
774
 
        for base in (b for b in bases
775
 
                     if issubclass(b, dbus.service.Object)):
776
 
            # Go though all attributes of the base class
777
 
            for attrname, attribute in inspect.getmembers(base):
 
1082
    def wrapper(cls):
 
1083
        for orig_interface_name, alt_interface_name in (
 
1084
            alt_interface_names.iteritems()):
 
1085
            attr = {}
 
1086
            interface_names = set()
 
1087
            # Go though all attributes of the class
 
1088
            for attrname, attribute in inspect.getmembers(cls):
778
1089
                # Ignore non-D-Bus attributes, and D-Bus attributes
779
1090
                # with the wrong interface name
780
1091
                if (not hasattr(attribute, "_dbus_interface")
781
1092
                    or not attribute._dbus_interface
782
 
                    .startswith("se.recompile.Mandos")):
 
1093
                    .startswith(orig_interface_name)):
783
1094
                    continue
784
1095
                # Create an alternate D-Bus interface name based on
785
1096
                # the current name
786
1097
                alt_interface = (attribute._dbus_interface
787
 
                                 .replace("se.recompile.Mandos",
788
 
                                          "se.bsnet.fukt.Mandos"))
 
1098
                                 .replace(orig_interface_name,
 
1099
                                          alt_interface_name))
 
1100
                interface_names.add(alt_interface)
789
1101
                # Is this a D-Bus signal?
790
1102
                if getattr(attribute, "_dbus_is_signal", False):
791
 
                    # Extract the original non-method function by
792
 
                    # black magic
 
1103
                    # Extract the original non-method undecorated
 
1104
                    # function by black magic
793
1105
                    nonmethod_func = (dict(
794
1106
                            zip(attribute.func_code.co_freevars,
795
1107
                                attribute.__closure__))["func"]
806
1118
                                nonmethod_func.func_name,
807
1119
                                nonmethod_func.func_defaults,
808
1120
                                nonmethod_func.func_closure)))
 
1121
                    # Copy annotations, if any
 
1122
                    try:
 
1123
                        new_function._dbus_annotations = (
 
1124
                            dict(attribute._dbus_annotations))
 
1125
                    except AttributeError:
 
1126
                        pass
809
1127
                    # Define a creator of a function to call both the
810
 
                    # old and new functions, so both the old and new
811
 
                    # signals gets sent when the function is called
 
1128
                    # original and alternate functions, so both the
 
1129
                    # original and alternate signals gets sent when
 
1130
                    # the function is called
812
1131
                    def fixscope(func1, func2):
813
1132
                        """This function is a scope container to pass
814
1133
                        func1 and func2 to the "call_both" function
821
1140
                        return call_both
822
1141
                    # Create the "call_both" function and add it to
823
1142
                    # the class
824
 
                    attr[attrname] = fixscope(attribute,
825
 
                                              new_function)
 
1143
                    attr[attrname] = fixscope(attribute, new_function)
826
1144
                # Is this a D-Bus method?
827
1145
                elif getattr(attribute, "_dbus_is_method", False):
828
1146
                    # Create a new, but exactly alike, function
839
1157
                                        attribute.func_name,
840
1158
                                        attribute.func_defaults,
841
1159
                                        attribute.func_closure)))
 
1160
                    # Copy annotations, if any
 
1161
                    try:
 
1162
                        attr[attrname]._dbus_annotations = (
 
1163
                            dict(attribute._dbus_annotations))
 
1164
                    except AttributeError:
 
1165
                        pass
842
1166
                # Is this a D-Bus property?
843
1167
                elif getattr(attribute, "_dbus_is_property", False):
844
1168
                    # Create a new, but exactly alike, function
858
1182
                                        attribute.func_name,
859
1183
                                        attribute.func_defaults,
860
1184
                                        attribute.func_closure)))
861
 
        return type.__new__(mcs, name, bases, attr)
862
 
 
 
1185
                    # Copy annotations, if any
 
1186
                    try:
 
1187
                        attr[attrname]._dbus_annotations = (
 
1188
                            dict(attribute._dbus_annotations))
 
1189
                    except AttributeError:
 
1190
                        pass
 
1191
                # Is this a D-Bus interface?
 
1192
                elif getattr(attribute, "_dbus_is_interface", False):
 
1193
                    # Create a new, but exactly alike, function
 
1194
                    # object.  Decorate it to be a new D-Bus interface
 
1195
                    # with the alternate D-Bus interface name.  Add it
 
1196
                    # to the class.
 
1197
                    attr[attrname] = (dbus_interface_annotations
 
1198
                                      (alt_interface)
 
1199
                                      (types.FunctionType
 
1200
                                       (attribute.func_code,
 
1201
                                        attribute.func_globals,
 
1202
                                        attribute.func_name,
 
1203
                                        attribute.func_defaults,
 
1204
                                        attribute.func_closure)))
 
1205
            if deprecate:
 
1206
                # Deprecate all alternate interfaces
 
1207
                iname="_AlternateDBusNames_interface_annotation{0}"
 
1208
                for interface_name in interface_names:
 
1209
                    @dbus_interface_annotations(interface_name)
 
1210
                    def func(self):
 
1211
                        return { "org.freedesktop.DBus.Deprecated":
 
1212
                                     "true" }
 
1213
                    # Find an unused name
 
1214
                    for aname in (iname.format(i)
 
1215
                                  for i in itertools.count()):
 
1216
                        if aname not in attr:
 
1217
                            attr[aname] = func
 
1218
                            break
 
1219
            if interface_names:
 
1220
                # Replace the class with a new subclass of it with
 
1221
                # methods, signals, etc. as created above.
 
1222
                cls = type(b"{0}Alternate".format(cls.__name__),
 
1223
                           (cls,), attr)
 
1224
        return cls
 
1225
    return wrapper
 
1226
 
 
1227
 
 
1228
@alternate_dbus_interfaces({"se.recompile.Mandos":
 
1229
                                "se.bsnet.fukt.Mandos"})
863
1230
class ClientDBus(Client, DBusObjectWithProperties):
864
1231
    """A Client class using D-Bus
865
1232
    
874
1241
    # dbus.service.Object doesn't use super(), so we can't either.
875
1242
    
876
1243
    def __init__(self, bus = None, *args, **kwargs):
877
 
        self._approvals_pending = 0
878
1244
        self.bus = bus
879
1245
        Client.__init__(self, *args, **kwargs)
880
1246
        # Only now, when this client is initialized, can it show up on
886
1252
                                 ("/clients/" + client_object_name))
887
1253
        DBusObjectWithProperties.__init__(self, self.bus,
888
1254
                                          self.dbus_object_path)
889
 
        
 
1255
    
890
1256
    def notifychangeproperty(transform_func,
891
1257
                             dbus_name, type_func=lambda x: x,
892
1258
                             variant_level=1):
893
1259
        """ Modify a variable so that it's a property which announces
894
1260
        its changes to DBus.
895
 
 
 
1261
        
896
1262
        transform_fun: Function that takes a value and a variant_level
897
1263
                       and transforms it to a D-Bus type.
898
1264
        dbus_name: D-Bus name of the variable
915
1281
        
916
1282
        return property(lambda self: getattr(self, attrname), setter)
917
1283
    
918
 
    
919
1284
    expires = notifychangeproperty(datetime_to_dbus, "Expires")
920
1285
    approvals_pending = notifychangeproperty(dbus.Boolean,
921
1286
                                             "ApprovalPending",
928
1293
                                       checker is not None)
929
1294
    last_checked_ok = notifychangeproperty(datetime_to_dbus,
930
1295
                                           "LastCheckedOK")
 
1296
    last_checker_status = notifychangeproperty(dbus.Int16,
 
1297
                                               "LastCheckerStatus")
931
1298
    last_approval_request = notifychangeproperty(
932
1299
        datetime_to_dbus, "LastApprovalRequest")
933
1300
    approved_by_default = notifychangeproperty(dbus.Boolean,
934
1301
                                               "ApprovedByDefault")
935
 
    approval_delay = notifychangeproperty(dbus.UInt16,
 
1302
    approval_delay = notifychangeproperty(dbus.UInt64,
936
1303
                                          "ApprovalDelay",
937
1304
                                          type_func =
938
 
                                          _timedelta_to_milliseconds)
 
1305
                                          timedelta_to_milliseconds)
939
1306
    approval_duration = notifychangeproperty(
940
 
        dbus.UInt16, "ApprovalDuration",
941
 
        type_func = _timedelta_to_milliseconds)
 
1307
        dbus.UInt64, "ApprovalDuration",
 
1308
        type_func = timedelta_to_milliseconds)
942
1309
    host = notifychangeproperty(dbus.String, "Host")
943
 
    timeout = notifychangeproperty(dbus.UInt16, "Timeout",
 
1310
    timeout = notifychangeproperty(dbus.UInt64, "Timeout",
944
1311
                                   type_func =
945
 
                                   _timedelta_to_milliseconds)
 
1312
                                   timedelta_to_milliseconds)
946
1313
    extended_timeout = notifychangeproperty(
947
 
        dbus.UInt16, "ExtendedTimeout",
948
 
        type_func = _timedelta_to_milliseconds)
949
 
    interval = notifychangeproperty(dbus.UInt16,
 
1314
        dbus.UInt64, "ExtendedTimeout",
 
1315
        type_func = timedelta_to_milliseconds)
 
1316
    interval = notifychangeproperty(dbus.UInt64,
950
1317
                                    "Interval",
951
1318
                                    type_func =
952
 
                                    _timedelta_to_milliseconds)
 
1319
                                    timedelta_to_milliseconds)
953
1320
    checker_command = notifychangeproperty(dbus.String, "Checker")
954
1321
    
955
1322
    del notifychangeproperty
997
1364
        return r
998
1365
    
999
1366
    def _reset_approved(self):
1000
 
        self._approved = None
 
1367
        self.approved = None
1001
1368
        return False
1002
1369
    
1003
1370
    def approve(self, value=True):
1004
 
        self.send_changedstate()
1005
 
        self._approved = value
1006
 
        gobject.timeout_add(_timedelta_to_milliseconds
 
1371
        self.approved = value
 
1372
        gobject.timeout_add(timedelta_to_milliseconds
1007
1373
                            (self.approval_duration),
1008
1374
                            self._reset_approved)
1009
 
    
 
1375
        self.send_changedstate()
1010
1376
    
1011
1377
    ## D-Bus methods, signals & properties
1012
1378
    _interface = "se.recompile.Mandos.Client"
1013
1379
    
 
1380
    ## Interfaces
 
1381
    
 
1382
    @dbus_interface_annotations(_interface)
 
1383
    def _foo(self):
 
1384
        return { "org.freedesktop.DBus.Property.EmitsChangedSignal":
 
1385
                     "false"}
 
1386
    
1014
1387
    ## Signals
1015
1388
    
1016
1389
    # CheckerCompleted - signal
1115
1488
                           access="readwrite")
1116
1489
    def ApprovalDuration_dbus_property(self, value=None):
1117
1490
        if value is None:       # get
1118
 
            return dbus.UInt64(_timedelta_to_milliseconds(
 
1491
            return dbus.UInt64(timedelta_to_milliseconds(
1119
1492
                    self.approval_duration))
1120
1493
        self.approval_duration = datetime.timedelta(0, 0, 0, value)
1121
1494
    
1135
1508
    def Host_dbus_property(self, value=None):
1136
1509
        if value is None:       # get
1137
1510
            return dbus.String(self.host)
1138
 
        self.host = value
 
1511
        self.host = unicode(value)
1139
1512
    
1140
1513
    # Created - property
1141
1514
    @dbus_service_property(_interface, signature="s", access="read")
1142
1515
    def Created_dbus_property(self):
1143
 
        return dbus.String(datetime_to_dbus(self.created))
 
1516
        return datetime_to_dbus(self.created)
1144
1517
    
1145
1518
    # LastEnabled - property
1146
1519
    @dbus_service_property(_interface, signature="s", access="read")
1167
1540
            return
1168
1541
        return datetime_to_dbus(self.last_checked_ok)
1169
1542
    
 
1543
    # LastCheckerStatus - property
 
1544
    @dbus_service_property(_interface, signature="n",
 
1545
                           access="read")
 
1546
    def LastCheckerStatus_dbus_property(self):
 
1547
        return dbus.Int16(self.last_checker_status)
 
1548
    
1170
1549
    # Expires - property
1171
1550
    @dbus_service_property(_interface, signature="s", access="read")
1172
1551
    def Expires_dbus_property(self):
1183
1562
    def Timeout_dbus_property(self, value=None):
1184
1563
        if value is None:       # get
1185
1564
            return dbus.UInt64(self.timeout_milliseconds())
 
1565
        old_timeout = self.timeout
1186
1566
        self.timeout = datetime.timedelta(0, 0, 0, value)
1187
 
        if getattr(self, "disable_initiator_tag", None) is None:
1188
 
            return
1189
 
        # Reschedule timeout
1190
 
        gobject.source_remove(self.disable_initiator_tag)
1191
 
        self.disable_initiator_tag = None
1192
 
        self.expires = None
1193
 
        time_to_die = _timedelta_to_milliseconds((self
1194
 
                                                  .last_checked_ok
1195
 
                                                  + self.timeout)
1196
 
                                                 - datetime.datetime
1197
 
                                                 .utcnow())
1198
 
        if time_to_die <= 0:
1199
 
            # The timeout has passed
1200
 
            self.disable()
1201
 
        else:
1202
 
            self.expires = (datetime.datetime.utcnow()
1203
 
                            + datetime.timedelta(milliseconds =
1204
 
                                                 time_to_die))
1205
 
            self.disable_initiator_tag = (gobject.timeout_add
1206
 
                                          (time_to_die, self.disable))
 
1567
        # Reschedule disabling
 
1568
        if self.enabled:
 
1569
            now = datetime.datetime.utcnow()
 
1570
            self.expires += self.timeout - old_timeout
 
1571
            if self.expires <= now:
 
1572
                # The timeout has passed
 
1573
                self.disable()
 
1574
            else:
 
1575
                if (getattr(self, "disable_initiator_tag", None)
 
1576
                    is None):
 
1577
                    return
 
1578
                gobject.source_remove(self.disable_initiator_tag)
 
1579
                self.disable_initiator_tag = (
 
1580
                    gobject.timeout_add(
 
1581
                        timedelta_to_milliseconds(self.expires - now),
 
1582
                        self.disable))
1207
1583
    
1208
1584
    # ExtendedTimeout - property
1209
1585
    @dbus_service_property(_interface, signature="t",
1222
1598
        self.interval = datetime.timedelta(0, 0, 0, value)
1223
1599
        if getattr(self, "checker_initiator_tag", None) is None:
1224
1600
            return
1225
 
        # Reschedule checker run
1226
 
        gobject.source_remove(self.checker_initiator_tag)
1227
 
        self.checker_initiator_tag = (gobject.timeout_add
1228
 
                                      (value, self.start_checker))
1229
 
        self.start_checker()    # Start one now, too
 
1601
        if self.enabled:
 
1602
            # Reschedule checker run
 
1603
            gobject.source_remove(self.checker_initiator_tag)
 
1604
            self.checker_initiator_tag = (gobject.timeout_add
 
1605
                                          (value, self.start_checker))
 
1606
            self.start_checker()    # Start one now, too
1230
1607
    
1231
1608
    # Checker - property
1232
1609
    @dbus_service_property(_interface, signature="s",
1234
1611
    def Checker_dbus_property(self, value=None):
1235
1612
        if value is None:       # get
1236
1613
            return dbus.String(self.checker_command)
1237
 
        self.checker_command = value
 
1614
        self.checker_command = unicode(value)
1238
1615
    
1239
1616
    # CheckerRunning - property
1240
1617
    @dbus_service_property(_interface, signature="b",
1269
1646
            raise KeyError()
1270
1647
    
1271
1648
    def __getattribute__(self, name):
1272
 
        if(name == '_pipe'):
 
1649
        if name == '_pipe':
1273
1650
            return super(ProxyClient, self).__getattribute__(name)
1274
1651
        self._pipe.send(('getattr', name))
1275
1652
        data = self._pipe.recv()
1282
1659
            return func
1283
1660
    
1284
1661
    def __setattr__(self, name, value):
1285
 
        if(name == '_pipe'):
 
1662
        if name == '_pipe':
1286
1663
            return super(ProxyClient, self).__setattr__(name, value)
1287
1664
        self._pipe.send(('setattr', name, value))
1288
1665
 
1289
 
class ClientDBusTransitional(ClientDBus):
1290
 
    __metaclass__ = AlternateDBusNamesMetaclass
1291
1666
 
1292
1667
class ClientHandler(socketserver.BaseRequestHandler, object):
1293
1668
    """A class to handle client connections.
1330
1705
            logger.debug("Protocol version: %r", line)
1331
1706
            try:
1332
1707
                if int(line.strip().split()[0]) > 1:
1333
 
                    raise RuntimeError
 
1708
                    raise RuntimeError(line)
1334
1709
            except (ValueError, IndexError, RuntimeError) as error:
1335
1710
                logger.error("Unknown protocol version: %s", error)
1336
1711
                return
1376
1751
                            client.Rejected("Disabled")
1377
1752
                        return
1378
1753
                    
1379
 
                    if client._approved or not client.approval_delay:
 
1754
                    if client.approved or not client.approval_delay:
1380
1755
                        #We are approved or approval is disabled
1381
1756
                        break
1382
 
                    elif client._approved is None:
 
1757
                    elif client.approved is None:
1383
1758
                        logger.info("Client %s needs approval",
1384
1759
                                    client.name)
1385
1760
                        if self.server.use_dbus:
1398
1773
                    #wait until timeout or approved
1399
1774
                    time = datetime.datetime.now()
1400
1775
                    client.changedstate.acquire()
1401
 
                    (client.changedstate.wait
1402
 
                     (float(client._timedelta_to_milliseconds(delay)
1403
 
                            / 1000)))
 
1776
                    client.changedstate.wait(
 
1777
                        float(timedelta_to_milliseconds(delay)
 
1778
                              / 1000))
1404
1779
                    client.changedstate.release()
1405
1780
                    time2 = datetime.datetime.now()
1406
1781
                    if (time2 - time) >= delay:
1422
1797
                    try:
1423
1798
                        sent = session.send(client.secret[sent_size:])
1424
1799
                    except gnutls.errors.GNUTLSError as error:
1425
 
                        logger.warning("gnutls send failed")
 
1800
                        logger.warning("gnutls send failed",
 
1801
                                       exc_info=error)
1426
1802
                        return
1427
1803
                    logger.debug("Sent: %d, remaining: %d",
1428
1804
                                 sent, len(client.secret)
1431
1807
                
1432
1808
                logger.info("Sending secret to %s", client.name)
1433
1809
                # bump the timeout using extended_timeout
1434
 
                client.checked_ok(client.extended_timeout)
 
1810
                client.bump_timeout(client.extended_timeout)
1435
1811
                if self.server.use_dbus:
1436
1812
                    # Emit D-Bus signal
1437
1813
                    client.GotSecret()
1442
1818
                try:
1443
1819
                    session.bye()
1444
1820
                except gnutls.errors.GNUTLSError as error:
1445
 
                    logger.warning("GnuTLS bye failed")
 
1821
                    logger.warning("GnuTLS bye failed",
 
1822
                                   exc_info=error)
1446
1823
    
1447
1824
    @staticmethod
1448
1825
    def peer_certificate(session):
1504
1881
        # Convert the buffer to a Python bytestring
1505
1882
        fpr = ctypes.string_at(buf, buf_len.value)
1506
1883
        # Convert the bytestring to hexadecimal notation
1507
 
        hex_fpr = ''.join("%02X" % ord(char) for char in fpr)
 
1884
        hex_fpr = binascii.hexlify(fpr).upper()
1508
1885
        return hex_fpr
1509
1886
 
1510
1887
 
1513
1890
    def sub_process_main(self, request, address):
1514
1891
        try:
1515
1892
            self.finish_request(request, address)
1516
 
        except:
 
1893
        except Exception:
1517
1894
            self.handle_error(request, address)
1518
1895
        self.close_request(request)
1519
1896
    
1520
1897
    def process_request(self, request, address):
1521
1898
        """Start a new process to process the request."""
1522
1899
        proc = multiprocessing.Process(target = self.sub_process_main,
1523
 
                                       args = (request,
1524
 
                                               address))
 
1900
                                       args = (request, address))
1525
1901
        proc.start()
1526
1902
        return proc
1527
1903
 
1542
1918
    
1543
1919
    def add_pipe(self, parent_pipe, proc):
1544
1920
        """Dummy function; override as necessary"""
1545
 
        raise NotImplementedError
 
1921
        raise NotImplementedError()
1546
1922
 
1547
1923
 
1548
1924
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
1555
1931
        use_ipv6:       Boolean; to use IPv6 or not
1556
1932
    """
1557
1933
    def __init__(self, server_address, RequestHandlerClass,
1558
 
                 interface=None, use_ipv6=True):
 
1934
                 interface=None, use_ipv6=True, socketfd=None):
 
1935
        """If socketfd is set, use that file descriptor instead of
 
1936
        creating a new one with socket.socket().
 
1937
        """
1559
1938
        self.interface = interface
1560
1939
        if use_ipv6:
1561
1940
            self.address_family = socket.AF_INET6
 
1941
        if socketfd is not None:
 
1942
            # Save the file descriptor
 
1943
            self.socketfd = socketfd
 
1944
            # Save the original socket.socket() function
 
1945
            self.socket_socket = socket.socket
 
1946
            # To implement --socket, we monkey patch socket.socket.
 
1947
            # 
 
1948
            # (When socketserver.TCPServer is a new-style class, we
 
1949
            # could make self.socket into a property instead of monkey
 
1950
            # patching socket.socket.)
 
1951
            # 
 
1952
            # Create a one-time-only replacement for socket.socket()
 
1953
            @functools.wraps(socket.socket)
 
1954
            def socket_wrapper(*args, **kwargs):
 
1955
                # Restore original function so subsequent calls are
 
1956
                # not affected.
 
1957
                socket.socket = self.socket_socket
 
1958
                del self.socket_socket
 
1959
                # This time only, return a new socket object from the
 
1960
                # saved file descriptor.
 
1961
                return socket.fromfd(self.socketfd, *args, **kwargs)
 
1962
            # Replace socket.socket() function with wrapper
 
1963
            socket.socket = socket_wrapper
 
1964
        # The socketserver.TCPServer.__init__ will call
 
1965
        # socket.socket(), which might be our replacement,
 
1966
        # socket_wrapper(), if socketfd was set.
1562
1967
        socketserver.TCPServer.__init__(self, server_address,
1563
1968
                                        RequestHandlerClass)
 
1969
    
1564
1970
    def server_bind(self):
1565
1971
        """This overrides the normal server_bind() function
1566
1972
        to bind to an interface if one was specified, and also NOT to
1574
1980
                try:
1575
1981
                    self.socket.setsockopt(socket.SOL_SOCKET,
1576
1982
                                           SO_BINDTODEVICE,
1577
 
                                           str(self.interface
1578
 
                                               + '\0'))
 
1983
                                           str(self.interface + '\0'))
1579
1984
                except socket.error as error:
1580
 
                    if error[0] == errno.EPERM:
1581
 
                        logger.error("No permission to"
1582
 
                                     " bind to interface %s",
1583
 
                                     self.interface)
1584
 
                    elif error[0] == errno.ENOPROTOOPT:
 
1985
                    if error.errno == errno.EPERM:
 
1986
                        logger.error("No permission to bind to"
 
1987
                                     " interface %s", self.interface)
 
1988
                    elif error.errno == errno.ENOPROTOOPT:
1585
1989
                        logger.error("SO_BINDTODEVICE not available;"
1586
1990
                                     " cannot bind to interface %s",
1587
1991
                                     self.interface)
 
1992
                    elif error.errno == errno.ENODEV:
 
1993
                        logger.error("Interface %s does not exist,"
 
1994
                                     " cannot bind", self.interface)
1588
1995
                    else:
1589
1996
                        raise
1590
1997
        # Only bind(2) the socket if we really need to.
1593
2000
                if self.address_family == socket.AF_INET6:
1594
2001
                    any_address = "::" # in6addr_any
1595
2002
                else:
1596
 
                    any_address = socket.INADDR_ANY
 
2003
                    any_address = "0.0.0.0" # INADDR_ANY
1597
2004
                self.server_address = (any_address,
1598
2005
                                       self.server_address[1])
1599
2006
            elif not self.server_address[1]:
1620
2027
    """
1621
2028
    def __init__(self, server_address, RequestHandlerClass,
1622
2029
                 interface=None, use_ipv6=True, clients=None,
1623
 
                 gnutls_priority=None, use_dbus=True):
 
2030
                 gnutls_priority=None, use_dbus=True, socketfd=None):
1624
2031
        self.enabled = False
1625
2032
        self.clients = clients
1626
2033
        if self.clients is None:
1627
 
            self.clients = set()
 
2034
            self.clients = {}
1628
2035
        self.use_dbus = use_dbus
1629
2036
        self.gnutls_priority = gnutls_priority
1630
2037
        IPv6_TCPServer.__init__(self, server_address,
1631
2038
                                RequestHandlerClass,
1632
2039
                                interface = interface,
1633
 
                                use_ipv6 = use_ipv6)
 
2040
                                use_ipv6 = use_ipv6,
 
2041
                                socketfd = socketfd)
1634
2042
    def server_activate(self):
1635
2043
        if self.enabled:
1636
2044
            return socketserver.TCPServer.server_activate(self)
1649
2057
    
1650
2058
    def handle_ipc(self, source, condition, parent_pipe=None,
1651
2059
                   proc = None, client_object=None):
1652
 
        condition_names = {
1653
 
            gobject.IO_IN: "IN",   # There is data to read.
1654
 
            gobject.IO_OUT: "OUT", # Data can be written (without
1655
 
                                    # blocking).
1656
 
            gobject.IO_PRI: "PRI", # There is urgent data to read.
1657
 
            gobject.IO_ERR: "ERR", # Error condition.
1658
 
            gobject.IO_HUP: "HUP"  # Hung up (the connection has been
1659
 
                                    # broken, usually for pipes and
1660
 
                                    # sockets).
1661
 
            }
1662
 
        conditions_string = ' | '.join(name
1663
 
                                       for cond, name in
1664
 
                                       condition_names.iteritems()
1665
 
                                       if cond & condition)
1666
2060
        # error, or the other end of multiprocessing.Pipe has closed
1667
 
        if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):
 
2061
        if condition & (gobject.IO_ERR | gobject.IO_HUP):
1668
2062
            # Wait for other process to exit
1669
2063
            proc.join()
1670
2064
            return False
1677
2071
            fpr = request[1]
1678
2072
            address = request[2]
1679
2073
            
1680
 
            for c in self.clients:
 
2074
            for c in self.clients.itervalues():
1681
2075
                if c.fingerprint == fpr:
1682
2076
                    client = c
1683
2077
                    break
1728
2122
        return True
1729
2123
 
1730
2124
 
 
2125
def rfc3339_duration_to_delta(duration):
 
2126
    """Parse an RFC 3339 "duration" and return a datetime.timedelta
 
2127
    
 
2128
    >>> rfc3339_duration_to_delta("P7D")
 
2129
    datetime.timedelta(7)
 
2130
    >>> rfc3339_duration_to_delta("PT60S")
 
2131
    datetime.timedelta(0, 60)
 
2132
    >>> rfc3339_duration_to_delta("PT60M")
 
2133
    datetime.timedelta(0, 3600)
 
2134
    >>> rfc3339_duration_to_delta("PT24H")
 
2135
    datetime.timedelta(1)
 
2136
    >>> rfc3339_duration_to_delta("P1W")
 
2137
    datetime.timedelta(7)
 
2138
    >>> rfc3339_duration_to_delta("PT5M30S")
 
2139
    datetime.timedelta(0, 330)
 
2140
    >>> rfc3339_duration_to_delta("P1DT3M20S")
 
2141
    datetime.timedelta(1, 200)
 
2142
    """
 
2143
    
 
2144
    # Parsing an RFC 3339 duration with regular expressions is not
 
2145
    # possible - there would have to be multiple places for the same
 
2146
    # values, like seconds.  The current code, while more esoteric, is
 
2147
    # cleaner without depending on a parsing library.  If Python had a
 
2148
    # built-in library for parsing we would use it, but we'd like to
 
2149
    # avoid excessive use of external libraries.
 
2150
    
 
2151
    # New type for defining tokens, syntax, and semantics all-in-one
 
2152
    Token = collections.namedtuple("Token",
 
2153
                                   ("regexp", # To match token; if
 
2154
                                              # "value" is not None,
 
2155
                                              # must have a "group"
 
2156
                                              # containing digits
 
2157
                                    "value",  # datetime.timedelta or
 
2158
                                              # None
 
2159
                                    "followers")) # Tokens valid after
 
2160
                                                  # this token
 
2161
    # RFC 3339 "duration" tokens, syntax, and semantics; taken from
 
2162
    # the "duration" ABNF definition in RFC 3339, Appendix A.
 
2163
    token_end = Token(re.compile(r"$"), None, frozenset())
 
2164
    token_second = Token(re.compile(r"(\d+)S"),
 
2165
                         datetime.timedelta(seconds=1),
 
2166
                         frozenset((token_end,)))
 
2167
    token_minute = Token(re.compile(r"(\d+)M"),
 
2168
                         datetime.timedelta(minutes=1),
 
2169
                         frozenset((token_second, token_end)))
 
2170
    token_hour = Token(re.compile(r"(\d+)H"),
 
2171
                       datetime.timedelta(hours=1),
 
2172
                       frozenset((token_minute, token_end)))
 
2173
    token_time = Token(re.compile(r"T"),
 
2174
                       None,
 
2175
                       frozenset((token_hour, token_minute,
 
2176
                                  token_second)))
 
2177
    token_day = Token(re.compile(r"(\d+)D"),
 
2178
                      datetime.timedelta(days=1),
 
2179
                      frozenset((token_time, token_end)))
 
2180
    token_month = Token(re.compile(r"(\d+)M"),
 
2181
                        datetime.timedelta(weeks=4),
 
2182
                        frozenset((token_day, token_end)))
 
2183
    token_year = Token(re.compile(r"(\d+)Y"),
 
2184
                       datetime.timedelta(weeks=52),
 
2185
                       frozenset((token_month, token_end)))
 
2186
    token_week = Token(re.compile(r"(\d+)W"),
 
2187
                       datetime.timedelta(weeks=1),
 
2188
                       frozenset((token_end,)))
 
2189
    token_duration = Token(re.compile(r"P"), None,
 
2190
                           frozenset((token_year, token_month,
 
2191
                                      token_day, token_time,
 
2192
                                      token_week))),
 
2193
    # Define starting values
 
2194
    value = datetime.timedelta() # Value so far
 
2195
    found_token = None
 
2196
    followers = frozenset(token_duration,) # Following valid tokens
 
2197
    s = duration                # String left to parse
 
2198
    # Loop until end token is found
 
2199
    while found_token is not token_end:
 
2200
        # Search for any currently valid tokens
 
2201
        for token in followers:
 
2202
            match = token.regexp.match(s)
 
2203
            if match is not None:
 
2204
                # Token found
 
2205
                if token.value is not None:
 
2206
                    # Value found, parse digits
 
2207
                    factor = int(match.group(1), 10)
 
2208
                    # Add to value so far
 
2209
                    value += factor * token.value
 
2210
                # Strip token from string
 
2211
                s = token.regexp.sub("", s, 1)
 
2212
                # Go to found token
 
2213
                found_token = token
 
2214
                # Set valid next tokens
 
2215
                followers = found_token.followers
 
2216
                break
 
2217
        else:
 
2218
            # No currently valid tokens were found
 
2219
            raise ValueError("Invalid RFC 3339 duration")
 
2220
    # End token found
 
2221
    return value
 
2222
 
 
2223
 
1731
2224
def string_to_delta(interval):
1732
2225
    """Parse a string and return a datetime.timedelta
1733
2226
    
1744
2237
    >>> string_to_delta('5m 30s')
1745
2238
    datetime.timedelta(0, 330)
1746
2239
    """
 
2240
    
 
2241
    try:
 
2242
        return rfc3339_duration_to_delta(interval)
 
2243
    except ValueError:
 
2244
        pass
 
2245
    
1747
2246
    timevalue = datetime.timedelta(0)
1748
2247
    for s in interval.split():
1749
2248
        try:
1760
2259
            elif suffix == "w":
1761
2260
                delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
1762
2261
            else:
1763
 
                raise ValueError("Unknown suffix %r" % suffix)
1764
 
        except (ValueError, IndexError) as e:
 
2262
                raise ValueError("Unknown suffix {0!r}"
 
2263
                                 .format(suffix))
 
2264
        except IndexError as e:
1765
2265
            raise ValueError(*(e.args))
1766
2266
        timevalue += delta
1767
2267
    return timevalue
1768
2268
 
1769
2269
 
1770
 
def if_nametoindex(interface):
1771
 
    """Call the C function if_nametoindex(), or equivalent
1772
 
    
1773
 
    Note: This function cannot accept a unicode string."""
1774
 
    global if_nametoindex
1775
 
    try:
1776
 
        if_nametoindex = (ctypes.cdll.LoadLibrary
1777
 
                          (ctypes.util.find_library("c"))
1778
 
                          .if_nametoindex)
1779
 
    except (OSError, AttributeError):
1780
 
        logger.warning("Doing if_nametoindex the hard way")
1781
 
        def if_nametoindex(interface):
1782
 
            "Get an interface index the hard way, i.e. using fcntl()"
1783
 
            SIOCGIFINDEX = 0x8933  # From /usr/include/linux/sockios.h
1784
 
            with contextlib.closing(socket.socket()) as s:
1785
 
                ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
1786
 
                                    struct.pack(str("16s16x"),
1787
 
                                                interface))
1788
 
            interface_index = struct.unpack(str("I"),
1789
 
                                            ifreq[16:20])[0]
1790
 
            return interface_index
1791
 
    return if_nametoindex(interface)
1792
 
 
1793
 
 
1794
2270
def daemon(nochdir = False, noclose = False):
1795
2271
    """See daemon(3).  Standard BSD Unix function.
1796
2272
    
1804
2280
        sys.exit()
1805
2281
    if not noclose:
1806
2282
        # Close all standard open file descriptors
1807
 
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
 
2283
        null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
1808
2284
        if not stat.S_ISCHR(os.fstat(null).st_mode):
1809
2285
            raise OSError(errno.ENODEV,
1810
 
                          "%s not a character device"
1811
 
                          % os.path.devnull)
 
2286
                          "{0} not a character device"
 
2287
                          .format(os.devnull))
1812
2288
        os.dup2(null, sys.stdin.fileno())
1813
2289
        os.dup2(null, sys.stdout.fileno())
1814
2290
        os.dup2(null, sys.stderr.fileno())
1823
2299
    
1824
2300
    parser = argparse.ArgumentParser()
1825
2301
    parser.add_argument("-v", "--version", action="version",
1826
 
                        version = "%%(prog)s %s" % version,
 
2302
                        version = "%(prog)s {0}".format(version),
1827
2303
                        help="show version number and exit")
1828
2304
    parser.add_argument("-i", "--interface", metavar="IF",
1829
2305
                        help="Bind to interface IF")
1835
2311
                        help="Run self-test")
1836
2312
    parser.add_argument("--debug", action="store_true",
1837
2313
                        help="Debug mode; run in foreground and log"
1838
 
                        " to terminal")
 
2314
                        " to terminal", default=None)
1839
2315
    parser.add_argument("--debuglevel", metavar="LEVEL",
1840
2316
                        help="Debug level for stdout output")
1841
2317
    parser.add_argument("--priority", help="GnuTLS"
1848
2324
                        " files")
1849
2325
    parser.add_argument("--no-dbus", action="store_false",
1850
2326
                        dest="use_dbus", help="Do not provide D-Bus"
1851
 
                        " system bus interface")
 
2327
                        " system bus interface", default=None)
1852
2328
    parser.add_argument("--no-ipv6", action="store_false",
1853
 
                        dest="use_ipv6", help="Do not use IPv6")
 
2329
                        dest="use_ipv6", help="Do not use IPv6",
 
2330
                        default=None)
 
2331
    parser.add_argument("--no-restore", action="store_false",
 
2332
                        dest="restore", help="Do not restore stored"
 
2333
                        " state", default=None)
 
2334
    parser.add_argument("--socket", type=int,
 
2335
                        help="Specify a file descriptor to a network"
 
2336
                        " socket to use instead of creating one")
 
2337
    parser.add_argument("--statedir", metavar="DIR",
 
2338
                        help="Directory to save/restore state in")
 
2339
    parser.add_argument("--foreground", action="store_true",
 
2340
                        help="Run in foreground", default=None)
 
2341
    
1854
2342
    options = parser.parse_args()
1855
2343
    
1856
2344
    if options.check:
1857
2345
        import doctest
1858
 
        doctest.testmod()
1859
 
        sys.exit()
 
2346
        fail_count, test_count = doctest.testmod()
 
2347
        sys.exit(os.EX_OK if fail_count == 0 else 1)
1860
2348
    
1861
2349
    # Default values for config file for server-global settings
1862
2350
    server_defaults = { "interface": "",
1864
2352
                        "port": "",
1865
2353
                        "debug": "False",
1866
2354
                        "priority":
1867
 
                        "SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
 
2355
                        "SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",
1868
2356
                        "servicename": "Mandos",
1869
2357
                        "use_dbus": "True",
1870
2358
                        "use_ipv6": "True",
1871
2359
                        "debuglevel": "",
 
2360
                        "restore": "True",
 
2361
                        "socket": "",
 
2362
                        "statedir": "/var/lib/mandos",
 
2363
                        "foreground": "False",
1872
2364
                        }
1873
2365
    
1874
2366
    # Parse config file for server-global settings
1879
2371
    # Convert the SafeConfigParser object to a dict
1880
2372
    server_settings = server_config.defaults()
1881
2373
    # Use the appropriate methods on the non-string config options
1882
 
    for option in ("debug", "use_dbus", "use_ipv6"):
 
2374
    for option in ("debug", "use_dbus", "use_ipv6", "foreground"):
1883
2375
        server_settings[option] = server_config.getboolean("DEFAULT",
1884
2376
                                                           option)
1885
2377
    if server_settings["port"]:
1886
2378
        server_settings["port"] = server_config.getint("DEFAULT",
1887
2379
                                                       "port")
 
2380
    if server_settings["socket"]:
 
2381
        server_settings["socket"] = server_config.getint("DEFAULT",
 
2382
                                                         "socket")
 
2383
        # Later, stdin will, and stdout and stderr might, be dup'ed
 
2384
        # over with an opened os.devnull.  But we don't want this to
 
2385
        # happen with a supplied network socket.
 
2386
        if 0 <= server_settings["socket"] <= 2:
 
2387
            server_settings["socket"] = os.dup(server_settings
 
2388
                                               ["socket"])
1888
2389
    del server_config
1889
2390
    
1890
2391
    # Override the settings from the config file with command line
1891
2392
    # options, if set.
1892
2393
    for option in ("interface", "address", "port", "debug",
1893
2394
                   "priority", "servicename", "configdir",
1894
 
                   "use_dbus", "use_ipv6", "debuglevel"):
 
2395
                   "use_dbus", "use_ipv6", "debuglevel", "restore",
 
2396
                   "statedir", "socket", "foreground"):
1895
2397
        value = getattr(options, option)
1896
2398
        if value is not None:
1897
2399
            server_settings[option] = value
1900
2402
    for option in server_settings.keys():
1901
2403
        if type(server_settings[option]) is str:
1902
2404
            server_settings[option] = unicode(server_settings[option])
 
2405
    # Force all boolean options to be boolean
 
2406
    for option in ("debug", "use_dbus", "use_ipv6", "restore",
 
2407
                   "foreground"):
 
2408
        server_settings[option] = bool(server_settings[option])
 
2409
    # Debug implies foreground
 
2410
    if server_settings["debug"]:
 
2411
        server_settings["foreground"] = True
1903
2412
    # Now we have our good server settings in "server_settings"
1904
2413
    
1905
2414
    ##################################################################
1909
2418
    debuglevel = server_settings["debuglevel"]
1910
2419
    use_dbus = server_settings["use_dbus"]
1911
2420
    use_ipv6 = server_settings["use_ipv6"]
 
2421
    stored_state_path = os.path.join(server_settings["statedir"],
 
2422
                                     stored_state_file)
 
2423
    foreground = server_settings["foreground"]
 
2424
    
 
2425
    if debug:
 
2426
        initlogger(debug, logging.DEBUG)
 
2427
    else:
 
2428
        if not debuglevel:
 
2429
            initlogger(debug)
 
2430
        else:
 
2431
            level = getattr(logging, debuglevel.upper())
 
2432
            initlogger(debug, level)
1912
2433
    
1913
2434
    if server_settings["servicename"] != "Mandos":
1914
2435
        syslogger.setFormatter(logging.Formatter
1915
 
                               ('Mandos (%s) [%%(process)d]:'
1916
 
                                ' %%(levelname)s: %%(message)s'
1917
 
                                % server_settings["servicename"]))
 
2436
                               ('Mandos ({0}) [%(process)d]:'
 
2437
                                ' %(levelname)s: %(message)s'
 
2438
                                .format(server_settings
 
2439
                                        ["servicename"])))
1918
2440
    
1919
2441
    # Parse config file with clients
1920
 
    client_defaults = { "timeout": "5m",
1921
 
                        "extended_timeout": "15m",
1922
 
                        "interval": "2m",
1923
 
                        "checker": "fping -q -- %%(host)s",
1924
 
                        "host": "",
1925
 
                        "approval_delay": "0s",
1926
 
                        "approval_duration": "1s",
1927
 
                        }
1928
 
    client_config = configparser.SafeConfigParser(client_defaults)
 
2442
    client_config = configparser.SafeConfigParser(Client
 
2443
                                                  .client_defaults)
1929
2444
    client_config.read(os.path.join(server_settings["configdir"],
1930
2445
                                    "clients.conf"))
1931
2446
    
1940
2455
                              use_ipv6=use_ipv6,
1941
2456
                              gnutls_priority=
1942
2457
                              server_settings["priority"],
1943
 
                              use_dbus=use_dbus)
1944
 
    if not debug:
1945
 
        pidfilename = "/var/run/mandos.pid"
 
2458
                              use_dbus=use_dbus,
 
2459
                              socketfd=(server_settings["socket"]
 
2460
                                        or None))
 
2461
    if not foreground:
 
2462
        pidfilename = "/run/mandos.pid"
 
2463
        if not os.path.isdir("/run/."):
 
2464
            pidfilename = "/var/run/mandos.pid"
 
2465
        pidfile = None
1946
2466
        try:
1947
2467
            pidfile = open(pidfilename, "w")
1948
 
        except IOError:
1949
 
            logger.error("Could not open file %r", pidfilename)
 
2468
        except IOError as e:
 
2469
            logger.error("Could not open file %r", pidfilename,
 
2470
                         exc_info=e)
1950
2471
    
1951
 
    try:
1952
 
        uid = pwd.getpwnam("_mandos").pw_uid
1953
 
        gid = pwd.getpwnam("_mandos").pw_gid
1954
 
    except KeyError:
 
2472
    for name in ("_mandos", "mandos", "nobody"):
1955
2473
        try:
1956
 
            uid = pwd.getpwnam("mandos").pw_uid
1957
 
            gid = pwd.getpwnam("mandos").pw_gid
 
2474
            uid = pwd.getpwnam(name).pw_uid
 
2475
            gid = pwd.getpwnam(name).pw_gid
 
2476
            break
1958
2477
        except KeyError:
1959
 
            try:
1960
 
                uid = pwd.getpwnam("nobody").pw_uid
1961
 
                gid = pwd.getpwnam("nobody").pw_gid
1962
 
            except KeyError:
1963
 
                uid = 65534
1964
 
                gid = 65534
 
2478
            continue
 
2479
    else:
 
2480
        uid = 65534
 
2481
        gid = 65534
1965
2482
    try:
1966
2483
        os.setgid(gid)
1967
2484
        os.setuid(uid)
1968
2485
    except OSError as error:
1969
 
        if error[0] != errno.EPERM:
1970
 
            raise error
1971
 
    
1972
 
    if not debug and not debuglevel:
1973
 
        syslogger.setLevel(logging.WARNING)
1974
 
        console.setLevel(logging.WARNING)
1975
 
    if debuglevel:
1976
 
        level = getattr(logging, debuglevel.upper())
1977
 
        syslogger.setLevel(level)
1978
 
        console.setLevel(level)
 
2486
        if error.errno != errno.EPERM:
 
2487
            raise
1979
2488
    
1980
2489
    if debug:
1981
2490
        # Enable all possible GnuTLS debugging
1992
2501
         .gnutls_global_set_log_function(debug_gnutls))
1993
2502
        
1994
2503
        # Redirect stdin so all checkers get /dev/null
1995
 
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
 
2504
        null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
1996
2505
        os.dup2(null, sys.stdin.fileno())
1997
2506
        if null > 2:
1998
2507
            os.close(null)
1999
 
    else:
2000
 
        # No console logging
2001
 
        logger.removeHandler(console)
2002
2508
    
2003
2509
    # Need to fork before connecting to D-Bus
2004
 
    if not debug:
 
2510
    if not foreground:
2005
2511
        # Close all input and output, do double fork, etc.
2006
2512
        daemon()
2007
2513
    
 
2514
    # multiprocessing will use threads, so before we use gobject we
 
2515
    # need to inform gobject that threads will be used.
 
2516
    gobject.threads_init()
 
2517
    
2008
2518
    global main_loop
2009
2519
    # From the Avahi example code
2010
 
    DBusGMainLoop(set_as_default=True )
 
2520
    DBusGMainLoop(set_as_default=True)
2011
2521
    main_loop = gobject.MainLoop()
2012
2522
    bus = dbus.SystemBus()
2013
2523
    # End of Avahi example code
2019
2529
                            ("se.bsnet.fukt.Mandos", bus,
2020
2530
                             do_not_queue=True))
2021
2531
        except dbus.exceptions.NameExistsException as e:
2022
 
            logger.error(unicode(e) + ", disabling D-Bus")
 
2532
            logger.error("Disabling D-Bus:", exc_info=e)
2023
2533
            use_dbus = False
2024
2534
            server_settings["use_dbus"] = False
2025
2535
            tcp_server.use_dbus = False
2026
2536
    protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2027
 
    service = AvahiService(name = server_settings["servicename"],
2028
 
                           servicetype = "_mandos._tcp",
2029
 
                           protocol = protocol, bus = bus)
 
2537
    service = AvahiServiceToSyslog(name =
 
2538
                                   server_settings["servicename"],
 
2539
                                   servicetype = "_mandos._tcp",
 
2540
                                   protocol = protocol, bus = bus)
2030
2541
    if server_settings["interface"]:
2031
2542
        service.interface = (if_nametoindex
2032
2543
                             (str(server_settings["interface"])))
2036
2547
    
2037
2548
    client_class = Client
2038
2549
    if use_dbus:
2039
 
        client_class = functools.partial(ClientDBusTransitional,
2040
 
                                         bus = bus)
2041
 
    def client_config_items(config, section):
2042
 
        special_settings = {
2043
 
            "approved_by_default":
2044
 
                lambda: config.getboolean(section,
2045
 
                                          "approved_by_default"),
2046
 
            }
2047
 
        for name, value in config.items(section):
 
2550
        client_class = functools.partial(ClientDBus, bus = bus)
 
2551
    
 
2552
    client_settings = Client.config_parser(client_config)
 
2553
    old_client_settings = {}
 
2554
    clients_data = {}
 
2555
    
 
2556
    # This is used to redirect stdout and stderr for checker processes
 
2557
    global wnull
 
2558
    wnull = open(os.devnull, "w") # A writable /dev/null
 
2559
    # Only used if server is running in foreground but not in debug
 
2560
    # mode
 
2561
    if debug or not foreground:
 
2562
        wnull.close()
 
2563
    
 
2564
    # Get client data and settings from last running state.
 
2565
    if server_settings["restore"]:
 
2566
        try:
 
2567
            with open(stored_state_path, "rb") as stored_state:
 
2568
                clients_data, old_client_settings = (pickle.load
 
2569
                                                     (stored_state))
 
2570
            os.remove(stored_state_path)
 
2571
        except IOError as e:
 
2572
            if e.errno == errno.ENOENT:
 
2573
                logger.warning("Could not load persistent state: {0}"
 
2574
                                .format(os.strerror(e.errno)))
 
2575
            else:
 
2576
                logger.critical("Could not load persistent state:",
 
2577
                                exc_info=e)
 
2578
                raise
 
2579
        except EOFError as e:
 
2580
            logger.warning("Could not load persistent state: "
 
2581
                           "EOFError:", exc_info=e)
 
2582
    
 
2583
    with PGPEngine() as pgp:
 
2584
        for client_name, client in clients_data.iteritems():
 
2585
            # Skip removed clients
 
2586
            if client_name not in client_settings:
 
2587
                continue
 
2588
            
 
2589
            # Decide which value to use after restoring saved state.
 
2590
            # We have three different values: Old config file,
 
2591
            # new config file, and saved state.
 
2592
            # New config value takes precedence if it differs from old
 
2593
            # config value, otherwise use saved state.
 
2594
            for name, value in client_settings[client_name].items():
 
2595
                try:
 
2596
                    # For each value in new config, check if it
 
2597
                    # differs from the old config value (Except for
 
2598
                    # the "secret" attribute)
 
2599
                    if (name != "secret" and
 
2600
                        value != old_client_settings[client_name]
 
2601
                        [name]):
 
2602
                        client[name] = value
 
2603
                except KeyError:
 
2604
                    pass
 
2605
            
 
2606
            # Clients who has passed its expire date can still be
 
2607
            # enabled if its last checker was successful.  Clients
 
2608
            # whose checker succeeded before we stored its state is
 
2609
            # assumed to have successfully run all checkers during
 
2610
            # downtime.
 
2611
            if client["enabled"]:
 
2612
                if datetime.datetime.utcnow() >= client["expires"]:
 
2613
                    if not client["last_checked_ok"]:
 
2614
                        logger.warning(
 
2615
                            "disabling client {0} - Client never "
 
2616
                            "performed a successful checker"
 
2617
                            .format(client_name))
 
2618
                        client["enabled"] = False
 
2619
                    elif client["last_checker_status"] != 0:
 
2620
                        logger.warning(
 
2621
                            "disabling client {0} - Client "
 
2622
                            "last checker failed with error code {1}"
 
2623
                            .format(client_name,
 
2624
                                    client["last_checker_status"]))
 
2625
                        client["enabled"] = False
 
2626
                    else:
 
2627
                        client["expires"] = (datetime.datetime
 
2628
                                             .utcnow()
 
2629
                                             + client["timeout"])
 
2630
                        logger.debug("Last checker succeeded,"
 
2631
                                     " keeping {0} enabled"
 
2632
                                     .format(client_name))
2048
2633
            try:
2049
 
                yield (name, special_settings[name]())
2050
 
            except KeyError:
2051
 
                yield (name, value)
2052
 
    
2053
 
    tcp_server.clients.update(set(
2054
 
            client_class(name = section,
2055
 
                         config= dict(client_config_items(
2056
 
                        client_config, section)))
2057
 
            for section in client_config.sections()))
 
2634
                client["secret"] = (
 
2635
                    pgp.decrypt(client["encrypted_secret"],
 
2636
                                client_settings[client_name]
 
2637
                                ["secret"]))
 
2638
            except PGPError:
 
2639
                # If decryption fails, we use secret from new settings
 
2640
                logger.debug("Failed to decrypt {0} old secret"
 
2641
                             .format(client_name))
 
2642
                client["secret"] = (
 
2643
                    client_settings[client_name]["secret"])
 
2644
    
 
2645
    # Add/remove clients based on new changes made to config
 
2646
    for client_name in (set(old_client_settings)
 
2647
                        - set(client_settings)):
 
2648
        del clients_data[client_name]
 
2649
    for client_name in (set(client_settings)
 
2650
                        - set(old_client_settings)):
 
2651
        clients_data[client_name] = client_settings[client_name]
 
2652
    
 
2653
    # Create all client objects
 
2654
    for client_name, client in clients_data.iteritems():
 
2655
        tcp_server.clients[client_name] = client_class(
 
2656
            name = client_name, settings = client,
 
2657
            server_settings = server_settings)
 
2658
    
2058
2659
    if not tcp_server.clients:
2059
2660
        logger.warning("No clients defined")
2060
 
        
2061
 
    if not debug:
2062
 
        try:
2063
 
            with pidfile:
2064
 
                pid = os.getpid()
2065
 
                pidfile.write(str(pid) + "\n".encode("utf-8"))
2066
 
            del pidfile
2067
 
        except IOError:
2068
 
            logger.error("Could not write to file %r with PID %d",
2069
 
                         pidfilename, pid)
2070
 
        except NameError:
2071
 
            # "pidfile" was never created
2072
 
            pass
 
2661
    
 
2662
    if not foreground:
 
2663
        if pidfile is not None:
 
2664
            try:
 
2665
                with pidfile:
 
2666
                    pid = os.getpid()
 
2667
                    pidfile.write(str(pid) + "\n".encode("utf-8"))
 
2668
            except IOError:
 
2669
                logger.error("Could not write to file %r with PID %d",
 
2670
                             pidfilename, pid)
 
2671
        del pidfile
2073
2672
        del pidfilename
2074
 
        
2075
 
        signal.signal(signal.SIGINT, signal.SIG_IGN)
2076
2673
    
2077
2674
    signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2078
2675
    signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
2079
2676
    
2080
2677
    if use_dbus:
2081
 
        class MandosDBusService(dbus.service.Object):
 
2678
        @alternate_dbus_interfaces({"se.recompile.Mandos":
 
2679
                                        "se.bsnet.fukt.Mandos"})
 
2680
        class MandosDBusService(DBusObjectWithProperties):
2082
2681
            """A D-Bus proxy object"""
2083
2682
            def __init__(self):
2084
2683
                dbus.service.Object.__init__(self, bus, "/")
2085
2684
            _interface = "se.recompile.Mandos"
2086
2685
            
 
2686
            @dbus_interface_annotations(_interface)
 
2687
            def _foo(self):
 
2688
                return { "org.freedesktop.DBus.Property"
 
2689
                         ".EmitsChangedSignal":
 
2690
                             "false"}
 
2691
            
2087
2692
            @dbus.service.signal(_interface, signature="o")
2088
2693
            def ClientAdded(self, objpath):
2089
2694
                "D-Bus signal"
2103
2708
            def GetAllClients(self):
2104
2709
                "D-Bus method"
2105
2710
                return dbus.Array(c.dbus_object_path
2106
 
                                  for c in tcp_server.clients)
 
2711
                                  for c in
 
2712
                                  tcp_server.clients.itervalues())
2107
2713
            
2108
2714
            @dbus.service.method(_interface,
2109
2715
                                 out_signature="a{oa{sv}}")
2111
2717
                "D-Bus method"
2112
2718
                return dbus.Dictionary(
2113
2719
                    ((c.dbus_object_path, c.GetAll(""))
2114
 
                     for c in tcp_server.clients),
 
2720
                     for c in tcp_server.clients.itervalues()),
2115
2721
                    signature="oa{sv}")
2116
2722
            
2117
2723
            @dbus.service.method(_interface, in_signature="o")
2118
2724
            def RemoveClient(self, object_path):
2119
2725
                "D-Bus method"
2120
 
                for c in tcp_server.clients:
 
2726
                for c in tcp_server.clients.itervalues():
2121
2727
                    if c.dbus_object_path == object_path:
2122
 
                        tcp_server.clients.remove(c)
 
2728
                        del tcp_server.clients[c.name]
2123
2729
                        c.remove_from_connection()
2124
2730
                        # Don't signal anything except ClientRemoved
2125
2731
                        c.disable(quiet=True)
2130
2736
            
2131
2737
            del _interface
2132
2738
        
2133
 
        class MandosDBusServiceTransitional(MandosDBusService):
2134
 
            __metaclass__ = AlternateDBusNamesMetaclass
2135
 
        mandos_dbus_service = MandosDBusServiceTransitional()
 
2739
        mandos_dbus_service = MandosDBusService()
2136
2740
    
2137
2741
    def cleanup():
2138
2742
        "Cleanup function; run on exit"
2139
2743
        service.cleanup()
2140
2744
        
2141
2745
        multiprocessing.active_children()
 
2746
        wnull.close()
 
2747
        if not (tcp_server.clients or client_settings):
 
2748
            return
 
2749
        
 
2750
        # Store client before exiting. Secrets are encrypted with key
 
2751
        # based on what config file has. If config file is
 
2752
        # removed/edited, old secret will thus be unrecovable.
 
2753
        clients = {}
 
2754
        with PGPEngine() as pgp:
 
2755
            for client in tcp_server.clients.itervalues():
 
2756
                key = client_settings[client.name]["secret"]
 
2757
                client.encrypted_secret = pgp.encrypt(client.secret,
 
2758
                                                      key)
 
2759
                client_dict = {}
 
2760
                
 
2761
                # A list of attributes that can not be pickled
 
2762
                # + secret.
 
2763
                exclude = set(("bus", "changedstate", "secret",
 
2764
                               "checker", "server_settings"))
 
2765
                for name, typ in (inspect.getmembers
 
2766
                                  (dbus.service.Object)):
 
2767
                    exclude.add(name)
 
2768
                
 
2769
                client_dict["encrypted_secret"] = (client
 
2770
                                                   .encrypted_secret)
 
2771
                for attr in client.client_structure:
 
2772
                    if attr not in exclude:
 
2773
                        client_dict[attr] = getattr(client, attr)
 
2774
                
 
2775
                clients[client.name] = client_dict
 
2776
                del client_settings[client.name]["secret"]
 
2777
        
 
2778
        try:
 
2779
            with (tempfile.NamedTemporaryFile
 
2780
                  (mode='wb', suffix=".pickle", prefix='clients-',
 
2781
                   dir=os.path.dirname(stored_state_path),
 
2782
                   delete=False)) as stored_state:
 
2783
                pickle.dump((clients, client_settings), stored_state)
 
2784
                tempname=stored_state.name
 
2785
            os.rename(tempname, stored_state_path)
 
2786
        except (IOError, OSError) as e:
 
2787
            if not debug:
 
2788
                try:
 
2789
                    os.remove(tempname)
 
2790
                except NameError:
 
2791
                    pass
 
2792
            if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
 
2793
                logger.warning("Could not save persistent state: {0}"
 
2794
                               .format(os.strerror(e.errno)))
 
2795
            else:
 
2796
                logger.warning("Could not save persistent state:",
 
2797
                               exc_info=e)
 
2798
                raise
 
2799
        
 
2800
        # Delete all clients, and settings from config
2142
2801
        while tcp_server.clients:
2143
 
            client = tcp_server.clients.pop()
 
2802
            name, client = tcp_server.clients.popitem()
2144
2803
            if use_dbus:
2145
2804
                client.remove_from_connection()
2146
 
            client.disable_hook = None
2147
2805
            # Don't signal anything except ClientRemoved
2148
2806
            client.disable(quiet=True)
2149
2807
            if use_dbus:
2151
2809
                mandos_dbus_service.ClientRemoved(client
2152
2810
                                                  .dbus_object_path,
2153
2811
                                                  client.name)
 
2812
        client_settings.clear()
2154
2813
    
2155
2814
    atexit.register(cleanup)
2156
2815
    
2157
 
    for client in tcp_server.clients:
 
2816
    for client in tcp_server.clients.itervalues():
2158
2817
        if use_dbus:
2159
2818
            # Emit D-Bus signal
2160
2819
            mandos_dbus_service.ClientAdded(client.dbus_object_path)
2161
 
        client.enable()
 
2820
        # Need to initiate checking of clients
 
2821
        if client.enabled:
 
2822
            client.init_checker()
2162
2823
    
2163
2824
    tcp_server.enable()
2164
2825
    tcp_server.server_activate()
2167
2828
    service.port = tcp_server.socket.getsockname()[1]
2168
2829
    if use_ipv6:
2169
2830
        logger.info("Now listening on address %r, port %d,"
2170
 
                    " flowinfo %d, scope_id %d"
2171
 
                    % tcp_server.socket.getsockname())
 
2831
                    " flowinfo %d, scope_id %d",
 
2832
                    *tcp_server.socket.getsockname())
2172
2833
    else:                       # IPv4
2173
 
        logger.info("Now listening on address %r, port %d"
2174
 
                    % tcp_server.socket.getsockname())
 
2834
        logger.info("Now listening on address %r, port %d",
 
2835
                    *tcp_server.socket.getsockname())
2175
2836
    
2176
2837
    #service.interface = tcp_server.socket.getsockname()[3]
2177
2838
    
2180
2841
        try:
2181
2842
            service.activate()
2182
2843
        except dbus.exceptions.DBusException as error:
2183
 
            logger.critical("DBusException: %s", error)
 
2844
            logger.critical("D-Bus Exception", exc_info=error)
2184
2845
            cleanup()
2185
2846
            sys.exit(1)
2186
2847
        # End of Avahi example code
2193
2854
        logger.debug("Starting main loop")
2194
2855
        main_loop.run()
2195
2856
    except AvahiError as error:
2196
 
        logger.critical("AvahiError: %s", error)
 
2857
        logger.critical("Avahi Error", exc_info=error)
2197
2858
        cleanup()
2198
2859
        sys.exit(1)
2199
2860
    except KeyboardInterrupt:
2204
2865
    # Must run before the D-Bus bus name gets deregistered
2205
2866
    cleanup()
2206
2867
 
2207
 
 
2208
2868
if __name__ == '__main__':
2209
2869
    main()