/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos

  • Committer: Teddy Hogeborn
  • Date: 2014-02-16 02:42:42 UTC
  • Revision ID: teddy@recompile.se-20140216024242-9wiw1nkxgt7ohovj
Fix running of self-tests.

* debian/control (Build-Depends): Add Python dependencies to
                                  successfully run self-tests.
* debian/copyright: GPLv3 now has its own license file - use it.
* debian/watch: Set PGP signature URL.
* mandos (main): Bug fix: When running self-tests, set exit code.
* mandos-ctl (main): Cosmetic fix; use os.EX_OK instead of plain 0.

Show diffs side-by-side

added added

removed removed

Lines of Context:
11
11
# "AvahiService" class, and some lines in "main".
12
12
13
13
# Everything else is
14
 
# Copyright © 2008-2011 Teddy Hogeborn
15
 
# Copyright © 2008-2011 Björn Påhlsson
 
14
# Copyright © 2008-2014 Teddy Hogeborn
 
15
# Copyright © 2008-2014 Björn Påhlsson
16
16
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
34
34
from __future__ import (division, absolute_import, print_function,
35
35
                        unicode_literals)
36
36
 
 
37
from future_builtins import *
 
38
 
37
39
import SocketServer as socketserver
38
40
import socket
39
41
import argparse
63
65
import cPickle as pickle
64
66
import multiprocessing
65
67
import types
 
68
import binascii
 
69
import tempfile
 
70
import itertools
 
71
import collections
66
72
 
67
73
import dbus
68
74
import dbus.service
82
88
    except ImportError:
83
89
        SO_BINDTODEVICE = None
84
90
 
85
 
 
86
 
version = "1.4.0"
87
 
 
88
 
#logger = logging.getLogger('mandos')
89
 
logger = logging.Logger('mandos')
 
91
version = "1.6.3"
 
92
stored_state_file = "clients.pickle"
 
93
 
 
94
logger = logging.getLogger()
90
95
syslogger = (logging.handlers.SysLogHandler
91
96
             (facility = logging.handlers.SysLogHandler.LOG_DAEMON,
92
97
              address = str("/dev/log")))
93
 
syslogger.setFormatter(logging.Formatter
94
 
                       ('Mandos [%(process)d]: %(levelname)s:'
95
 
                        ' %(message)s'))
96
 
logger.addHandler(syslogger)
97
 
 
98
 
console = logging.StreamHandler()
99
 
console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'
100
 
                                       ' %(levelname)s:'
101
 
                                       ' %(message)s'))
102
 
logger.addHandler(console)
 
98
 
 
99
try:
 
100
    if_nametoindex = (ctypes.cdll.LoadLibrary
 
101
                      (ctypes.util.find_library("c"))
 
102
                      .if_nametoindex)
 
103
except (OSError, AttributeError):
 
104
    def if_nametoindex(interface):
 
105
        "Get an interface index the hard way, i.e. using fcntl()"
 
106
        SIOCGIFINDEX = 0x8933  # From /usr/include/linux/sockios.h
 
107
        with contextlib.closing(socket.socket()) as s:
 
108
            ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
 
109
                                struct.pack(str("16s16x"),
 
110
                                            interface))
 
111
        interface_index = struct.unpack(str("I"),
 
112
                                        ifreq[16:20])[0]
 
113
        return interface_index
 
114
 
 
115
 
 
116
def initlogger(debug, level=logging.WARNING):
 
117
    """init logger and add loglevel"""
 
118
    
 
119
    syslogger.setFormatter(logging.Formatter
 
120
                           ('Mandos [%(process)d]: %(levelname)s:'
 
121
                            ' %(message)s'))
 
122
    logger.addHandler(syslogger)
 
123
    
 
124
    if debug:
 
125
        console = logging.StreamHandler()
 
126
        console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
 
127
                                               ' [%(process)d]:'
 
128
                                               ' %(levelname)s:'
 
129
                                               ' %(message)s'))
 
130
        logger.addHandler(console)
 
131
    logger.setLevel(level)
 
132
 
 
133
 
 
134
class PGPError(Exception):
 
135
    """Exception if encryption/decryption fails"""
 
136
    pass
 
137
 
 
138
 
 
139
class PGPEngine(object):
 
140
    """A simple class for OpenPGP symmetric encryption & decryption"""
 
141
    def __init__(self):
 
142
        self.tempdir = tempfile.mkdtemp(prefix="mandos-")
 
143
        self.gnupgargs = ['--batch',
 
144
                          '--home', self.tempdir,
 
145
                          '--force-mdc',
 
146
                          '--quiet',
 
147
                          '--no-use-agent']
 
148
    
 
149
    def __enter__(self):
 
150
        return self
 
151
    
 
152
    def __exit__(self, exc_type, exc_value, traceback):
 
153
        self._cleanup()
 
154
        return False
 
155
    
 
156
    def __del__(self):
 
157
        self._cleanup()
 
158
    
 
159
    def _cleanup(self):
 
160
        if self.tempdir is not None:
 
161
            # Delete contents of tempdir
 
162
            for root, dirs, files in os.walk(self.tempdir,
 
163
                                             topdown = False):
 
164
                for filename in files:
 
165
                    os.remove(os.path.join(root, filename))
 
166
                for dirname in dirs:
 
167
                    os.rmdir(os.path.join(root, dirname))
 
168
            # Remove tempdir
 
169
            os.rmdir(self.tempdir)
 
170
            self.tempdir = None
 
171
    
 
172
    def password_encode(self, password):
 
173
        # Passphrase can not be empty and can not contain newlines or
 
174
        # NUL bytes.  So we prefix it and hex encode it.
 
175
        encoded = b"mandos" + binascii.hexlify(password)
 
176
        if len(encoded) > 2048:
 
177
            # GnuPG can't handle long passwords, so encode differently
 
178
            encoded = (b"mandos" + password.replace(b"\\", b"\\\\")
 
179
                       .replace(b"\n", b"\\n")
 
180
                       .replace(b"\0", b"\\x00"))
 
181
        return encoded
 
182
    
 
183
    def encrypt(self, data, password):
 
184
        passphrase = self.password_encode(password)
 
185
        with tempfile.NamedTemporaryFile(dir=self.tempdir
 
186
                                         ) as passfile:
 
187
            passfile.write(passphrase)
 
188
            passfile.flush()
 
189
            proc = subprocess.Popen(['gpg', '--symmetric',
 
190
                                     '--passphrase-file',
 
191
                                     passfile.name]
 
192
                                    + self.gnupgargs,
 
193
                                    stdin = subprocess.PIPE,
 
194
                                    stdout = subprocess.PIPE,
 
195
                                    stderr = subprocess.PIPE)
 
196
            ciphertext, err = proc.communicate(input = data)
 
197
        if proc.returncode != 0:
 
198
            raise PGPError(err)
 
199
        return ciphertext
 
200
    
 
201
    def decrypt(self, data, password):
 
202
        passphrase = self.password_encode(password)
 
203
        with tempfile.NamedTemporaryFile(dir = self.tempdir
 
204
                                         ) as passfile:
 
205
            passfile.write(passphrase)
 
206
            passfile.flush()
 
207
            proc = subprocess.Popen(['gpg', '--decrypt',
 
208
                                     '--passphrase-file',
 
209
                                     passfile.name]
 
210
                                    + self.gnupgargs,
 
211
                                    stdin = subprocess.PIPE,
 
212
                                    stdout = subprocess.PIPE,
 
213
                                    stderr = subprocess.PIPE)
 
214
            decrypted_plaintext, err = proc.communicate(input
 
215
                                                        = data)
 
216
        if proc.returncode != 0:
 
217
            raise PGPError(err)
 
218
        return decrypted_plaintext
 
219
 
103
220
 
104
221
class AvahiError(Exception):
105
222
    def __init__(self, value, *args, **kwargs):
123
240
               Used to optionally bind to the specified interface.
124
241
    name: string; Example: 'Mandos'
125
242
    type: string; Example: '_mandos._tcp'.
126
 
                  See <http://www.dns-sd.org/ServiceTypes.html>
 
243
     See <https://www.iana.org/assignments/service-names-port-numbers>
127
244
    port: integer; what port to announce
128
245
    TXT: list of strings; TXT record for the service
129
246
    domain: string; Domain to publish on, default to .local if empty.
135
252
    server: D-Bus Server
136
253
    bus: dbus.SystemBus()
137
254
    """
 
255
    
138
256
    def __init__(self, interface = avahi.IF_UNSPEC, name = None,
139
257
                 servicetype = None, port = None, TXT = None,
140
258
                 domain = "", host = "", max_renames = 32768,
153
271
        self.server = None
154
272
        self.bus = bus
155
273
        self.entry_group_state_changed_match = None
 
274
    
156
275
    def rename(self):
157
276
        """Derived from the Avahi example code"""
158
277
        if self.rename_count >= self.max_renames:
164
283
                            .GetAlternativeServiceName(self.name))
165
284
        logger.info("Changing Zeroconf service name to %r ...",
166
285
                    self.name)
167
 
        syslogger.setFormatter(logging.Formatter
168
 
                               ('Mandos (%s) [%%(process)d]:'
169
 
                                ' %%(levelname)s: %%(message)s'
170
 
                                % self.name))
171
286
        self.remove()
172
287
        try:
173
288
            self.add()
174
289
        except dbus.exceptions.DBusException as error:
175
 
            logger.critical("DBusException: %s", error)
 
290
            logger.critical("D-Bus Exception", exc_info=error)
176
291
            self.cleanup()
177
292
            os._exit(1)
178
293
        self.rename_count += 1
 
294
    
179
295
    def remove(self):
180
296
        """Derived from the Avahi example code"""
181
297
        if self.entry_group_state_changed_match is not None:
183
299
            self.entry_group_state_changed_match = None
184
300
        if self.group is not None:
185
301
            self.group.Reset()
 
302
    
186
303
    def add(self):
187
304
        """Derived from the Avahi example code"""
188
305
        self.remove()
193
310
                avahi.DBUS_INTERFACE_ENTRY_GROUP)
194
311
        self.entry_group_state_changed_match = (
195
312
            self.group.connect_to_signal(
196
 
                'StateChanged', self .entry_group_state_changed))
 
313
                'StateChanged', self.entry_group_state_changed))
197
314
        logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
198
315
                     self.name, self.type)
199
316
        self.group.AddService(
205
322
            dbus.UInt16(self.port),
206
323
            avahi.string_array_to_txt_array(self.TXT))
207
324
        self.group.Commit()
 
325
    
208
326
    def entry_group_state_changed(self, state, error):
209
327
        """Derived from the Avahi example code"""
210
328
        logger.debug("Avahi entry group state change: %i", state)
217
335
        elif state == avahi.ENTRY_GROUP_FAILURE:
218
336
            logger.critical("Avahi: Error in group state changed %s",
219
337
                            unicode(error))
220
 
            raise AvahiGroupError("State changed: %s"
221
 
                                  % unicode(error))
 
338
            raise AvahiGroupError("State changed: {0!s}"
 
339
                                  .format(error))
 
340
    
222
341
    def cleanup(self):
223
342
        """Derived from the Avahi example code"""
224
343
        if self.group is not None:
225
344
            try:
226
345
                self.group.Free()
227
346
            except (dbus.exceptions.UnknownMethodException,
228
 
                    dbus.exceptions.DBusException) as e:
 
347
                    dbus.exceptions.DBusException):
229
348
                pass
230
349
            self.group = None
231
350
        self.remove()
 
351
    
232
352
    def server_state_changed(self, state, error=None):
233
353
        """Derived from the Avahi example code"""
234
354
        logger.debug("Avahi server state change: %i", state)
253
373
                logger.debug("Unknown state: %r", state)
254
374
            else:
255
375
                logger.debug("Unknown state: %r: %r", state, error)
 
376
    
256
377
    def activate(self):
257
378
        """Derived from the Avahi example code"""
258
379
        if self.server is None:
266
387
        self.server_state_changed(self.server.GetState())
267
388
 
268
389
 
269
 
def _timedelta_to_milliseconds(td):
 
390
class AvahiServiceToSyslog(AvahiService):
 
391
    def rename(self):
 
392
        """Add the new name to the syslog messages"""
 
393
        ret = AvahiService.rename(self)
 
394
        syslogger.setFormatter(logging.Formatter
 
395
                               ('Mandos ({0}) [%(process)d]:'
 
396
                                ' %(levelname)s: %(message)s'
 
397
                                .format(self.name)))
 
398
        return ret
 
399
 
 
400
 
 
401
def timedelta_to_milliseconds(td):
270
402
    "Convert a datetime.timedelta() to milliseconds"
271
403
    return ((td.days * 24 * 60 * 60 * 1000)
272
404
            + (td.seconds * 1000)
273
405
            + (td.microseconds // 1000))
274
 
        
 
406
 
 
407
 
275
408
class Client(object):
276
409
    """A representation of a client host served by this server.
277
410
    
278
411
    Attributes:
279
 
    _approved:   bool(); 'None' if not yet approved/disapproved
 
412
    approved:   bool(); 'None' if not yet approved/disapproved
280
413
    approval_delay: datetime.timedelta(); Time to wait for approval
281
414
    approval_duration: datetime.timedelta(); Duration of one approval
282
415
    checker:    subprocess.Popen(); a running checker process used
289
422
                     instance %(name)s can be used in the command.
290
423
    checker_initiator_tag: a gobject event source tag, or None
291
424
    created:    datetime.datetime(); (UTC) object creation
 
425
    client_structure: Object describing what attributes a client has
 
426
                      and is used for storing the client at exit
292
427
    current_checker_command: string; current running checker_command
293
 
    disable_hook:  If set, called by disable() as disable_hook(self)
294
428
    disable_initiator_tag: a gobject event source tag, or None
295
429
    enabled:    bool()
296
430
    fingerprint: string (40 or 32 hexadecimal digits); used to
299
433
    interval:   datetime.timedelta(); How often to start a new checker
300
434
    last_approval_request: datetime.datetime(); (UTC) or None
301
435
    last_checked_ok: datetime.datetime(); (UTC) or None
302
 
    last_enabled: datetime.datetime(); (UTC)
 
436
    last_checker_status: integer between 0 and 255 reflecting exit
 
437
                         status of last checker. -1 reflects crashed
 
438
                         checker, -2 means no checker completed yet.
 
439
    last_enabled: datetime.datetime(); (UTC) or None
303
440
    name:       string; from the config file, used in log messages and
304
441
                        D-Bus identifiers
305
442
    secret:     bytestring; sent verbatim (over TLS) to client
306
443
    timeout:    datetime.timedelta(); How long from last_checked_ok
307
444
                                      until this client is disabled
308
 
    extended_timeout:   extra long timeout when password has been sent
 
445
    extended_timeout:   extra long timeout when secret has been sent
309
446
    runtime_expansions: Allowed attributes for runtime expansion.
310
447
    expires:    datetime.datetime(); time (UTC) when a client will be
311
448
                disabled, or None
 
449
    server_settings: The server_settings dict from main()
312
450
    """
313
451
    
314
452
    runtime_expansions = ("approval_delay", "approval_duration",
315
 
                          "created", "enabled", "fingerprint",
316
 
                          "host", "interval", "last_checked_ok",
 
453
                          "created", "enabled", "expires",
 
454
                          "fingerprint", "host", "interval",
 
455
                          "last_approval_request", "last_checked_ok",
317
456
                          "last_enabled", "name", "timeout")
 
457
    client_defaults = { "timeout": "PT5M",
 
458
                        "extended_timeout": "PT15M",
 
459
                        "interval": "PT2M",
 
460
                        "checker": "fping -q -- %%(host)s",
 
461
                        "host": "",
 
462
                        "approval_delay": "PT0S",
 
463
                        "approval_duration": "PT1S",
 
464
                        "approved_by_default": "True",
 
465
                        "enabled": "True",
 
466
                        }
318
467
    
319
468
    def timeout_milliseconds(self):
320
469
        "Return the 'timeout' attribute in milliseconds"
321
 
        return _timedelta_to_milliseconds(self.timeout)
 
470
        return timedelta_to_milliseconds(self.timeout)
322
471
    
323
472
    def extended_timeout_milliseconds(self):
324
473
        "Return the 'extended_timeout' attribute in milliseconds"
325
 
        return _timedelta_to_milliseconds(self.extended_timeout)
 
474
        return timedelta_to_milliseconds(self.extended_timeout)
326
475
    
327
476
    def interval_milliseconds(self):
328
477
        "Return the 'interval' attribute in milliseconds"
329
 
        return _timedelta_to_milliseconds(self.interval)
 
478
        return timedelta_to_milliseconds(self.interval)
330
479
    
331
480
    def approval_delay_milliseconds(self):
332
 
        return _timedelta_to_milliseconds(self.approval_delay)
333
 
    
334
 
    def __init__(self, name = None, disable_hook=None, config=None):
335
 
        """Note: the 'checker' key in 'config' sets the
336
 
        'checker_command' attribute and *not* the 'checker'
337
 
        attribute."""
 
481
        return timedelta_to_milliseconds(self.approval_delay)
 
482
    
 
483
    @staticmethod
 
484
    def config_parser(config):
 
485
        """Construct a new dict of client settings of this form:
 
486
        { client_name: {setting_name: value, ...}, ...}
 
487
        with exceptions for any special settings as defined above.
 
488
        NOTE: Must be a pure function. Must return the same result
 
489
        value given the same arguments.
 
490
        """
 
491
        settings = {}
 
492
        for client_name in config.sections():
 
493
            section = dict(config.items(client_name))
 
494
            client = settings[client_name] = {}
 
495
            
 
496
            client["host"] = section["host"]
 
497
            # Reformat values from string types to Python types
 
498
            client["approved_by_default"] = config.getboolean(
 
499
                client_name, "approved_by_default")
 
500
            client["enabled"] = config.getboolean(client_name,
 
501
                                                  "enabled")
 
502
            
 
503
            client["fingerprint"] = (section["fingerprint"].upper()
 
504
                                     .replace(" ", ""))
 
505
            if "secret" in section:
 
506
                client["secret"] = section["secret"].decode("base64")
 
507
            elif "secfile" in section:
 
508
                with open(os.path.expanduser(os.path.expandvars
 
509
                                             (section["secfile"])),
 
510
                          "rb") as secfile:
 
511
                    client["secret"] = secfile.read()
 
512
            else:
 
513
                raise TypeError("No secret or secfile for section {0}"
 
514
                                .format(section))
 
515
            client["timeout"] = string_to_delta(section["timeout"])
 
516
            client["extended_timeout"] = string_to_delta(
 
517
                section["extended_timeout"])
 
518
            client["interval"] = string_to_delta(section["interval"])
 
519
            client["approval_delay"] = string_to_delta(
 
520
                section["approval_delay"])
 
521
            client["approval_duration"] = string_to_delta(
 
522
                section["approval_duration"])
 
523
            client["checker_command"] = section["checker"]
 
524
            client["last_approval_request"] = None
 
525
            client["last_checked_ok"] = None
 
526
            client["last_checker_status"] = -2
 
527
        
 
528
        return settings
 
529
    
 
530
    def __init__(self, settings, name = None, server_settings=None):
338
531
        self.name = name
339
 
        if config is None:
340
 
            config = {}
 
532
        if server_settings is None:
 
533
            server_settings = {}
 
534
        self.server_settings = server_settings
 
535
        # adding all client settings
 
536
        for setting, value in settings.iteritems():
 
537
            setattr(self, setting, value)
 
538
        
 
539
        if self.enabled:
 
540
            if not hasattr(self, "last_enabled"):
 
541
                self.last_enabled = datetime.datetime.utcnow()
 
542
            if not hasattr(self, "expires"):
 
543
                self.expires = (datetime.datetime.utcnow()
 
544
                                + self.timeout)
 
545
        else:
 
546
            self.last_enabled = None
 
547
            self.expires = None
 
548
        
341
549
        logger.debug("Creating client %r", self.name)
342
550
        # Uppercase and remove spaces from fingerprint for later
343
551
        # comparison purposes with return value from the fingerprint()
344
552
        # function
345
 
        self.fingerprint = (config["fingerprint"].upper()
346
 
                            .replace(" ", ""))
347
553
        logger.debug("  Fingerprint: %s", self.fingerprint)
348
 
        if "secret" in config:
349
 
            self.secret = config["secret"].decode("base64")
350
 
        elif "secfile" in config:
351
 
            with open(os.path.expanduser(os.path.expandvars
352
 
                                         (config["secfile"])),
353
 
                      "rb") as secfile:
354
 
                self.secret = secfile.read()
355
 
        else:
356
 
            raise TypeError("No secret or secfile for client %s"
357
 
                            % self.name)
358
 
        self.host = config.get("host", "")
359
 
        self.created = datetime.datetime.utcnow()
360
 
        self.enabled = False
361
 
        self.last_approval_request = None
362
 
        self.last_enabled = None
363
 
        self.last_checked_ok = None
364
 
        self.timeout = string_to_delta(config["timeout"])
365
 
        self.extended_timeout = string_to_delta(config
366
 
                                                ["extended_timeout"])
367
 
        self.interval = string_to_delta(config["interval"])
368
 
        self.disable_hook = disable_hook
 
554
        self.created = settings.get("created",
 
555
                                    datetime.datetime.utcnow())
 
556
        
 
557
        # attributes specific for this server instance
369
558
        self.checker = None
370
559
        self.checker_initiator_tag = None
371
560
        self.disable_initiator_tag = None
372
 
        self.expires = None
373
561
        self.checker_callback_tag = None
374
 
        self.checker_command = config["checker"]
375
562
        self.current_checker_command = None
376
 
        self.last_connect = None
377
 
        self._approved = None
378
 
        self.approved_by_default = config.get("approved_by_default",
379
 
                                              True)
 
563
        self.approved = None
380
564
        self.approvals_pending = 0
381
 
        self.approval_delay = string_to_delta(
382
 
            config["approval_delay"])
383
 
        self.approval_duration = string_to_delta(
384
 
            config["approval_duration"])
385
565
        self.changedstate = (multiprocessing_manager
386
566
                             .Condition(multiprocessing_manager
387
567
                                        .Lock()))
 
568
        self.client_structure = [attr for attr in
 
569
                                 self.__dict__.iterkeys()
 
570
                                 if not attr.startswith("_")]
 
571
        self.client_structure.append("client_structure")
 
572
        
 
573
        for name, t in inspect.getmembers(type(self),
 
574
                                          lambda obj:
 
575
                                              isinstance(obj,
 
576
                                                         property)):
 
577
            if not name.startswith("_"):
 
578
                self.client_structure.append(name)
388
579
    
 
580
    # Send notice to process children that client state has changed
389
581
    def send_changedstate(self):
390
 
        self.changedstate.acquire()
391
 
        self.changedstate.notify_all()
392
 
        self.changedstate.release()
 
582
        with self.changedstate:
 
583
            self.changedstate.notify_all()
393
584
    
394
585
    def enable(self):
395
586
        """Start this client's checker and timeout hooks"""
396
587
        if getattr(self, "enabled", False):
397
588
            # Already enabled
398
589
            return
 
590
        self.expires = datetime.datetime.utcnow() + self.timeout
 
591
        self.enabled = True
 
592
        self.last_enabled = datetime.datetime.utcnow()
 
593
        self.init_checker()
399
594
        self.send_changedstate()
 
595
    
 
596
    def disable(self, quiet=True):
 
597
        """Disable this client."""
 
598
        if not getattr(self, "enabled", False):
 
599
            return False
 
600
        if not quiet:
 
601
            logger.info("Disabling client %s", self.name)
 
602
        if getattr(self, "disable_initiator_tag", None) is not None:
 
603
            gobject.source_remove(self.disable_initiator_tag)
 
604
            self.disable_initiator_tag = None
 
605
        self.expires = None
 
606
        if getattr(self, "checker_initiator_tag", None) is not None:
 
607
            gobject.source_remove(self.checker_initiator_tag)
 
608
            self.checker_initiator_tag = None
 
609
        self.stop_checker()
 
610
        self.enabled = False
 
611
        if not quiet:
 
612
            self.send_changedstate()
 
613
        # Do not run this again if called by a gobject.timeout_add
 
614
        return False
 
615
    
 
616
    def __del__(self):
 
617
        self.disable()
 
618
    
 
619
    def init_checker(self):
400
620
        # Schedule a new checker to be started an 'interval' from now,
401
621
        # and every interval from then on.
 
622
        if self.checker_initiator_tag is not None:
 
623
            gobject.source_remove(self.checker_initiator_tag)
402
624
        self.checker_initiator_tag = (gobject.timeout_add
403
625
                                      (self.interval_milliseconds(),
404
626
                                       self.start_checker))
405
627
        # Schedule a disable() when 'timeout' has passed
406
 
        self.expires = datetime.datetime.utcnow() + self.timeout
 
628
        if self.disable_initiator_tag is not None:
 
629
            gobject.source_remove(self.disable_initiator_tag)
407
630
        self.disable_initiator_tag = (gobject.timeout_add
408
631
                                   (self.timeout_milliseconds(),
409
632
                                    self.disable))
410
 
        self.enabled = True
411
 
        self.last_enabled = datetime.datetime.utcnow()
412
633
        # Also start a new checker *right now*.
413
634
        self.start_checker()
414
635
    
415
 
    def disable(self, quiet=True):
416
 
        """Disable this client."""
417
 
        if not getattr(self, "enabled", False):
418
 
            return False
419
 
        if not quiet:
420
 
            self.send_changedstate()
421
 
        if not quiet:
422
 
            logger.info("Disabling client %s", self.name)
423
 
        if getattr(self, "disable_initiator_tag", False):
424
 
            gobject.source_remove(self.disable_initiator_tag)
425
 
            self.disable_initiator_tag = None
426
 
        self.expires = None
427
 
        if getattr(self, "checker_initiator_tag", False):
428
 
            gobject.source_remove(self.checker_initiator_tag)
429
 
            self.checker_initiator_tag = None
430
 
        self.stop_checker()
431
 
        if self.disable_hook:
432
 
            self.disable_hook(self)
433
 
        self.enabled = False
434
 
        # Do not run this again if called by a gobject.timeout_add
435
 
        return False
436
 
    
437
 
    def __del__(self):
438
 
        self.disable_hook = None
439
 
        self.disable()
440
 
    
441
636
    def checker_callback(self, pid, condition, command):
442
637
        """The checker has completed, so take appropriate actions."""
443
638
        self.checker_callback_tag = None
444
639
        self.checker = None
445
640
        if os.WIFEXITED(condition):
446
 
            exitstatus = os.WEXITSTATUS(condition)
447
 
            if exitstatus == 0:
 
641
            self.last_checker_status = os.WEXITSTATUS(condition)
 
642
            if self.last_checker_status == 0:
448
643
                logger.info("Checker for %(name)s succeeded",
449
644
                            vars(self))
450
645
                self.checked_ok()
452
647
                logger.info("Checker for %(name)s failed",
453
648
                            vars(self))
454
649
        else:
 
650
            self.last_checker_status = -1
455
651
            logger.warning("Checker for %(name)s crashed?",
456
652
                           vars(self))
457
653
    
458
 
    def checked_ok(self, timeout=None):
459
 
        """Bump up the timeout for this client.
460
 
        
461
 
        This should only be called when the client has been seen,
462
 
        alive and well.
463
 
        """
 
654
    def checked_ok(self):
 
655
        """Assert that the client has been seen, alive and well."""
 
656
        self.last_checked_ok = datetime.datetime.utcnow()
 
657
        self.last_checker_status = 0
 
658
        self.bump_timeout()
 
659
    
 
660
    def bump_timeout(self, timeout=None):
 
661
        """Bump up the timeout for this client."""
464
662
        if timeout is None:
465
663
            timeout = self.timeout
466
 
        self.last_checked_ok = datetime.datetime.utcnow()
467
 
        gobject.source_remove(self.disable_initiator_tag)
468
 
        self.disable_initiator_tag = (gobject.timeout_add
469
 
                                      (_timedelta_to_milliseconds
470
 
                                       (timeout), self.disable))
471
 
        self.expires = datetime.datetime.utcnow() + timeout
 
664
        if self.disable_initiator_tag is not None:
 
665
            gobject.source_remove(self.disable_initiator_tag)
 
666
            self.disable_initiator_tag = None
 
667
        if getattr(self, "enabled", False):
 
668
            self.disable_initiator_tag = (gobject.timeout_add
 
669
                                          (timedelta_to_milliseconds
 
670
                                           (timeout), self.disable))
 
671
            self.expires = datetime.datetime.utcnow() + timeout
472
672
    
473
673
    def need_approval(self):
474
674
        self.last_approval_request = datetime.datetime.utcnow()
479
679
        If a checker already exists, leave it running and do
480
680
        nothing."""
481
681
        # The reason for not killing a running checker is that if we
482
 
        # did that, then if a checker (for some reason) started
483
 
        # running slowly and taking more than 'interval' time, the
484
 
        # client would inevitably timeout, since no checker would get
485
 
        # a chance to run to completion.  If we instead leave running
 
682
        # did that, and if a checker (for some reason) started running
 
683
        # slowly and taking more than 'interval' time, then the client
 
684
        # would inevitably timeout, since no checker would get a
 
685
        # chance to run to completion.  If we instead leave running
486
686
        # checkers alone, the checker would have to take more time
487
687
        # than 'timeout' for the client to be disabled, which is as it
488
688
        # should be.
490
690
        # If a checker exists, make sure it is not a zombie
491
691
        try:
492
692
            pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
493
 
        except (AttributeError, OSError) as error:
494
 
            if (isinstance(error, OSError)
495
 
                and error.errno != errno.ECHILD):
496
 
                raise error
 
693
        except AttributeError:
 
694
            pass
 
695
        except OSError as error:
 
696
            if error.errno != errno.ECHILD:
 
697
                raise
497
698
        else:
498
699
            if pid:
499
700
                logger.warning("Checker was a zombie")
502
703
                                      self.current_checker_command)
503
704
        # Start a new checker if needed
504
705
        if self.checker is None:
 
706
            # Escape attributes for the shell
 
707
            escaped_attrs = dict(
 
708
                (attr, re.escape(unicode(getattr(self, attr))))
 
709
                for attr in
 
710
                self.runtime_expansions)
505
711
            try:
506
 
                # In case checker_command has exactly one % operator
507
 
                command = self.checker_command % self.host
508
 
            except TypeError:
509
 
                # Escape attributes for the shell
510
 
                escaped_attrs = dict(
511
 
                    (attr,
512
 
                     re.escape(unicode(str(getattr(self, attr, "")),
513
 
                                       errors=
514
 
                                       'replace')))
515
 
                    for attr in
516
 
                    self.runtime_expansions)
517
 
                
518
 
                try:
519
 
                    command = self.checker_command % escaped_attrs
520
 
                except TypeError as error:
521
 
                    logger.error('Could not format string "%s":'
522
 
                                 ' %s', self.checker_command, error)
523
 
                    return True # Try again later
 
712
                command = self.checker_command % escaped_attrs
 
713
            except TypeError as error:
 
714
                logger.error('Could not format string "%s"',
 
715
                             self.checker_command, exc_info=error)
 
716
                return True # Try again later
524
717
            self.current_checker_command = command
525
718
            try:
526
719
                logger.info("Starting checker %r for %s",
529
722
                # in normal mode, that is already done by daemon(),
530
723
                # and in debug mode we don't want to.  (Stdin is
531
724
                # always replaced by /dev/null.)
 
725
                # The exception is when not debugging but nevertheless
 
726
                # running in the foreground; use the previously
 
727
                # created wnull.
 
728
                popen_args = {}
 
729
                if (not self.server_settings["debug"]
 
730
                    and self.server_settings["foreground"]):
 
731
                    popen_args.update({"stdout": wnull,
 
732
                                       "stderr": wnull })
532
733
                self.checker = subprocess.Popen(command,
533
734
                                                close_fds=True,
534
 
                                                shell=True, cwd="/")
535
 
                self.checker_callback_tag = (gobject.child_watch_add
536
 
                                             (self.checker.pid,
537
 
                                              self.checker_callback,
538
 
                                              data=command))
539
 
                # The checker may have completed before the gobject
540
 
                # watch was added.  Check for this.
 
735
                                                shell=True, cwd="/",
 
736
                                                **popen_args)
 
737
            except OSError as error:
 
738
                logger.error("Failed to start subprocess",
 
739
                             exc_info=error)
 
740
                return True
 
741
            self.checker_callback_tag = (gobject.child_watch_add
 
742
                                         (self.checker.pid,
 
743
                                          self.checker_callback,
 
744
                                          data=command))
 
745
            # The checker may have completed before the gobject
 
746
            # watch was added.  Check for this.
 
747
            try:
541
748
                pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
542
 
                if pid:
543
 
                    gobject.source_remove(self.checker_callback_tag)
544
 
                    self.checker_callback(pid, status, command)
545
749
            except OSError as error:
546
 
                logger.error("Failed to start subprocess: %s",
547
 
                             error)
 
750
                if error.errno == errno.ECHILD:
 
751
                    # This should never happen
 
752
                    logger.error("Child process vanished",
 
753
                                 exc_info=error)
 
754
                    return True
 
755
                raise
 
756
            if pid:
 
757
                gobject.source_remove(self.checker_callback_tag)
 
758
                self.checker_callback(pid, status, command)
548
759
        # Re-run this periodically if run by gobject.timeout_add
549
760
        return True
550
761
    
557
768
            return
558
769
        logger.debug("Stopping checker for %(name)s", vars(self))
559
770
        try:
560
 
            os.kill(self.checker.pid, signal.SIGTERM)
 
771
            self.checker.terminate()
561
772
            #time.sleep(0.5)
562
773
            #if self.checker.poll() is None:
563
 
            #    os.kill(self.checker.pid, signal.SIGKILL)
 
774
            #    self.checker.kill()
564
775
        except OSError as error:
565
776
            if error.errno != errno.ESRCH: # No such process
566
777
                raise
583
794
    # "Set" method, so we fail early here:
584
795
    if byte_arrays and signature != "ay":
585
796
        raise ValueError("Byte arrays not supported for non-'ay'"
586
 
                         " signature %r" % signature)
 
797
                         " signature {0!r}".format(signature))
587
798
    def decorator(func):
588
799
        func._dbus_is_property = True
589
800
        func._dbus_interface = dbus_interface
597
808
    return decorator
598
809
 
599
810
 
 
811
def dbus_interface_annotations(dbus_interface):
 
812
    """Decorator for marking functions returning interface annotations
 
813
    
 
814
    Usage:
 
815
    
 
816
    @dbus_interface_annotations("org.example.Interface")
 
817
    def _foo(self):  # Function name does not matter
 
818
        return {"org.freedesktop.DBus.Deprecated": "true",
 
819
                "org.freedesktop.DBus.Property.EmitsChangedSignal":
 
820
                    "false"}
 
821
    """
 
822
    def decorator(func):
 
823
        func._dbus_is_interface = True
 
824
        func._dbus_interface = dbus_interface
 
825
        func._dbus_name = dbus_interface
 
826
        return func
 
827
    return decorator
 
828
 
 
829
 
 
830
def dbus_annotations(annotations):
 
831
    """Decorator to annotate D-Bus methods, signals or properties
 
832
    Usage:
 
833
    
 
834
    @dbus_service_property("org.example.Interface", signature="b",
 
835
                           access="r")
 
836
    @dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",
 
837
                        "org.freedesktop.DBus.Property."
 
838
                        "EmitsChangedSignal": "false"})
 
839
    def Property_dbus_property(self):
 
840
        return dbus.Boolean(False)
 
841
    """
 
842
    def decorator(func):
 
843
        func._dbus_annotations = annotations
 
844
        return func
 
845
    return decorator
 
846
 
 
847
 
600
848
class DBusPropertyException(dbus.exceptions.DBusException):
601
849
    """A base class for D-Bus property-related exceptions
602
850
    """
625
873
    """
626
874
    
627
875
    @staticmethod
628
 
    def _is_dbus_property(obj):
629
 
        return getattr(obj, "_dbus_is_property", False)
 
876
    def _is_dbus_thing(thing):
 
877
        """Returns a function testing if an attribute is a D-Bus thing
 
878
        
 
879
        If called like _is_dbus_thing("method") it returns a function
 
880
        suitable for use as predicate to inspect.getmembers().
 
881
        """
 
882
        return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),
 
883
                                   False)
630
884
    
631
 
    def _get_all_dbus_properties(self):
 
885
    def _get_all_dbus_things(self, thing):
632
886
        """Returns a generator of (name, attribute) pairs
633
887
        """
634
 
        return ((prop.__get__(self)._dbus_name, prop.__get__(self))
 
888
        return ((getattr(athing.__get__(self), "_dbus_name",
 
889
                         name),
 
890
                 athing.__get__(self))
635
891
                for cls in self.__class__.__mro__
636
 
                for name, prop in
637
 
                inspect.getmembers(cls, self._is_dbus_property))
 
892
                for name, athing in
 
893
                inspect.getmembers(cls,
 
894
                                   self._is_dbus_thing(thing)))
638
895
    
639
896
    def _get_dbus_property(self, interface_name, property_name):
640
897
        """Returns a bound method if one exists which is a D-Bus
642
899
        """
643
900
        for cls in  self.__class__.__mro__:
644
901
            for name, value in (inspect.getmembers
645
 
                                (cls, self._is_dbus_property)):
 
902
                                (cls,
 
903
                                 self._is_dbus_thing("property"))):
646
904
                if (value._dbus_name == property_name
647
905
                    and value._dbus_interface == interface_name):
648
906
                    return value.__get__(self)
676
934
            # The byte_arrays option is not supported yet on
677
935
            # signatures other than "ay".
678
936
            if prop._dbus_signature != "ay":
679
 
                raise ValueError
680
 
            value = dbus.ByteArray(''.join(unichr(byte)
681
 
                                           for byte in value))
 
937
                raise ValueError("Byte arrays not supported for non-"
 
938
                                 "'ay' signature {0!r}"
 
939
                                 .format(prop._dbus_signature))
 
940
            value = dbus.ByteArray(b''.join(chr(byte)
 
941
                                            for byte in value))
682
942
        prop(value)
683
943
    
684
944
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
689
949
        
690
950
        Note: Will not include properties with access="write".
691
951
        """
692
 
        all = {}
693
 
        for name, prop in self._get_all_dbus_properties():
 
952
        properties = {}
 
953
        for name, prop in self._get_all_dbus_things("property"):
694
954
            if (interface_name
695
955
                and interface_name != prop._dbus_interface):
696
956
                # Interface non-empty but did not match
700
960
                continue
701
961
            value = prop()
702
962
            if not hasattr(value, "variant_level"):
703
 
                all[name] = value
 
963
                properties[name] = value
704
964
                continue
705
 
            all[name] = type(value)(value, variant_level=
706
 
                                    value.variant_level+1)
707
 
        return dbus.Dictionary(all, signature="sv")
 
965
            properties[name] = type(value)(value, variant_level=
 
966
                                           value.variant_level+1)
 
967
        return dbus.Dictionary(properties, signature="sv")
708
968
    
709
969
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
710
970
                         out_signature="s",
711
971
                         path_keyword='object_path',
712
972
                         connection_keyword='connection')
713
973
    def Introspect(self, object_path, connection):
714
 
        """Standard D-Bus method, overloaded to insert property tags.
 
974
        """Overloading of standard D-Bus method.
 
975
        
 
976
        Inserts property tags and interface annotation tags.
715
977
        """
716
978
        xmlstring = dbus.service.Object.Introspect(self, object_path,
717
979
                                                   connection)
724
986
                e.setAttribute("access", prop._dbus_access)
725
987
                return e
726
988
            for if_tag in document.getElementsByTagName("interface"):
 
989
                # Add property tags
727
990
                for tag in (make_tag(document, name, prop)
728
991
                            for name, prop
729
 
                            in self._get_all_dbus_properties()
 
992
                            in self._get_all_dbus_things("property")
730
993
                            if prop._dbus_interface
731
994
                            == if_tag.getAttribute("name")):
732
995
                    if_tag.appendChild(tag)
 
996
                # Add annotation tags
 
997
                for typ in ("method", "signal", "property"):
 
998
                    for tag in if_tag.getElementsByTagName(typ):
 
999
                        annots = dict()
 
1000
                        for name, prop in (self.
 
1001
                                           _get_all_dbus_things(typ)):
 
1002
                            if (name == tag.getAttribute("name")
 
1003
                                and prop._dbus_interface
 
1004
                                == if_tag.getAttribute("name")):
 
1005
                                annots.update(getattr
 
1006
                                              (prop,
 
1007
                                               "_dbus_annotations",
 
1008
                                               {}))
 
1009
                        for name, value in annots.iteritems():
 
1010
                            ann_tag = document.createElement(
 
1011
                                "annotation")
 
1012
                            ann_tag.setAttribute("name", name)
 
1013
                            ann_tag.setAttribute("value", value)
 
1014
                            tag.appendChild(ann_tag)
 
1015
                # Add interface annotation tags
 
1016
                for annotation, value in dict(
 
1017
                    itertools.chain.from_iterable(
 
1018
                        annotations().iteritems()
 
1019
                        for name, annotations in
 
1020
                        self._get_all_dbus_things("interface")
 
1021
                        if name == if_tag.getAttribute("name")
 
1022
                        )).iteritems():
 
1023
                    ann_tag = document.createElement("annotation")
 
1024
                    ann_tag.setAttribute("name", annotation)
 
1025
                    ann_tag.setAttribute("value", value)
 
1026
                    if_tag.appendChild(ann_tag)
733
1027
                # Add the names to the return values for the
734
1028
                # "org.freedesktop.DBus.Properties" methods
735
1029
                if (if_tag.getAttribute("name")
750
1044
        except (AttributeError, xml.dom.DOMException,
751
1045
                xml.parsers.expat.ExpatError) as error:
752
1046
            logger.error("Failed to override Introspection method",
753
 
                         error)
 
1047
                         exc_info=error)
754
1048
        return xmlstring
755
1049
 
756
1050
 
757
 
def datetime_to_dbus (dt, variant_level=0):
 
1051
def datetime_to_dbus(dt, variant_level=0):
758
1052
    """Convert a UTC datetime.datetime() to a D-Bus type."""
759
1053
    if dt is None:
760
1054
        return dbus.String("", variant_level = variant_level)
761
1055
    return dbus.String(dt.isoformat(),
762
1056
                       variant_level=variant_level)
763
1057
 
764
 
class AlternateDBusNamesMetaclass(DBusObjectWithProperties
765
 
                                  .__metaclass__):
766
 
    """Applied to an empty subclass of a D-Bus object, this metaclass
767
 
    will add additional D-Bus attributes matching a certain pattern.
 
1058
 
 
1059
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
 
1060
    """A class decorator; applied to a subclass of
 
1061
    dbus.service.Object, it will add alternate D-Bus attributes with
 
1062
    interface names according to the "alt_interface_names" mapping.
 
1063
    Usage:
 
1064
    
 
1065
    @alternate_dbus_interfaces({"org.example.Interface":
 
1066
                                    "net.example.AlternateInterface"})
 
1067
    class SampleDBusObject(dbus.service.Object):
 
1068
        @dbus.service.method("org.example.Interface")
 
1069
        def SampleDBusMethod():
 
1070
            pass
 
1071
    
 
1072
    The above "SampleDBusMethod" on "SampleDBusObject" will be
 
1073
    reachable via two interfaces: "org.example.Interface" and
 
1074
    "net.example.AlternateInterface", the latter of which will have
 
1075
    its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
 
1076
    "true", unless "deprecate" is passed with a False value.
 
1077
    
 
1078
    This works for methods and signals, and also for D-Bus properties
 
1079
    (from DBusObjectWithProperties) and interfaces (from the
 
1080
    dbus_interface_annotations decorator).
768
1081
    """
769
 
    def __new__(mcs, name, bases, attr):
770
 
        # Go through all the base classes which could have D-Bus
771
 
        # methods, signals, or properties in them
772
 
        for base in (b for b in bases
773
 
                     if issubclass(b, dbus.service.Object)):
774
 
            # Go though all attributes of the base class
775
 
            for attrname, attribute in inspect.getmembers(base):
 
1082
    def wrapper(cls):
 
1083
        for orig_interface_name, alt_interface_name in (
 
1084
            alt_interface_names.iteritems()):
 
1085
            attr = {}
 
1086
            interface_names = set()
 
1087
            # Go though all attributes of the class
 
1088
            for attrname, attribute in inspect.getmembers(cls):
776
1089
                # Ignore non-D-Bus attributes, and D-Bus attributes
777
1090
                # with the wrong interface name
778
1091
                if (not hasattr(attribute, "_dbus_interface")
779
1092
                    or not attribute._dbus_interface
780
 
                    .startswith("se.recompile.Mandos")):
 
1093
                    .startswith(orig_interface_name)):
781
1094
                    continue
782
1095
                # Create an alternate D-Bus interface name based on
783
1096
                # the current name
784
1097
                alt_interface = (attribute._dbus_interface
785
 
                                 .replace("se.recompile.Mandos",
786
 
                                          "se.bsnet.fukt.Mandos"))
 
1098
                                 .replace(orig_interface_name,
 
1099
                                          alt_interface_name))
 
1100
                interface_names.add(alt_interface)
787
1101
                # Is this a D-Bus signal?
788
1102
                if getattr(attribute, "_dbus_is_signal", False):
789
 
                    # Extract the original non-method function by
790
 
                    # black magic
 
1103
                    # Extract the original non-method undecorated
 
1104
                    # function by black magic
791
1105
                    nonmethod_func = (dict(
792
1106
                            zip(attribute.func_code.co_freevars,
793
1107
                                attribute.__closure__))["func"]
804
1118
                                nonmethod_func.func_name,
805
1119
                                nonmethod_func.func_defaults,
806
1120
                                nonmethod_func.func_closure)))
 
1121
                    # Copy annotations, if any
 
1122
                    try:
 
1123
                        new_function._dbus_annotations = (
 
1124
                            dict(attribute._dbus_annotations))
 
1125
                    except AttributeError:
 
1126
                        pass
807
1127
                    # Define a creator of a function to call both the
808
 
                    # old and new functions, so both the old and new
809
 
                    # signals gets sent when the function is called
 
1128
                    # original and alternate functions, so both the
 
1129
                    # original and alternate signals gets sent when
 
1130
                    # the function is called
810
1131
                    def fixscope(func1, func2):
811
1132
                        """This function is a scope container to pass
812
1133
                        func1 and func2 to the "call_both" function
819
1140
                        return call_both
820
1141
                    # Create the "call_both" function and add it to
821
1142
                    # the class
822
 
                    attr[attrname] = fixscope(attribute,
823
 
                                              new_function)
 
1143
                    attr[attrname] = fixscope(attribute, new_function)
824
1144
                # Is this a D-Bus method?
825
1145
                elif getattr(attribute, "_dbus_is_method", False):
826
1146
                    # Create a new, but exactly alike, function
837
1157
                                        attribute.func_name,
838
1158
                                        attribute.func_defaults,
839
1159
                                        attribute.func_closure)))
 
1160
                    # Copy annotations, if any
 
1161
                    try:
 
1162
                        attr[attrname]._dbus_annotations = (
 
1163
                            dict(attribute._dbus_annotations))
 
1164
                    except AttributeError:
 
1165
                        pass
840
1166
                # Is this a D-Bus property?
841
1167
                elif getattr(attribute, "_dbus_is_property", False):
842
1168
                    # Create a new, but exactly alike, function
856
1182
                                        attribute.func_name,
857
1183
                                        attribute.func_defaults,
858
1184
                                        attribute.func_closure)))
859
 
        return type.__new__(mcs, name, bases, attr)
860
 
 
 
1185
                    # Copy annotations, if any
 
1186
                    try:
 
1187
                        attr[attrname]._dbus_annotations = (
 
1188
                            dict(attribute._dbus_annotations))
 
1189
                    except AttributeError:
 
1190
                        pass
 
1191
                # Is this a D-Bus interface?
 
1192
                elif getattr(attribute, "_dbus_is_interface", False):
 
1193
                    # Create a new, but exactly alike, function
 
1194
                    # object.  Decorate it to be a new D-Bus interface
 
1195
                    # with the alternate D-Bus interface name.  Add it
 
1196
                    # to the class.
 
1197
                    attr[attrname] = (dbus_interface_annotations
 
1198
                                      (alt_interface)
 
1199
                                      (types.FunctionType
 
1200
                                       (attribute.func_code,
 
1201
                                        attribute.func_globals,
 
1202
                                        attribute.func_name,
 
1203
                                        attribute.func_defaults,
 
1204
                                        attribute.func_closure)))
 
1205
            if deprecate:
 
1206
                # Deprecate all alternate interfaces
 
1207
                iname="_AlternateDBusNames_interface_annotation{0}"
 
1208
                for interface_name in interface_names:
 
1209
                    @dbus_interface_annotations(interface_name)
 
1210
                    def func(self):
 
1211
                        return { "org.freedesktop.DBus.Deprecated":
 
1212
                                     "true" }
 
1213
                    # Find an unused name
 
1214
                    for aname in (iname.format(i)
 
1215
                                  for i in itertools.count()):
 
1216
                        if aname not in attr:
 
1217
                            attr[aname] = func
 
1218
                            break
 
1219
            if interface_names:
 
1220
                # Replace the class with a new subclass of it with
 
1221
                # methods, signals, etc. as created above.
 
1222
                cls = type(b"{0}Alternate".format(cls.__name__),
 
1223
                           (cls,), attr)
 
1224
        return cls
 
1225
    return wrapper
 
1226
 
 
1227
 
 
1228
@alternate_dbus_interfaces({"se.recompile.Mandos":
 
1229
                                "se.bsnet.fukt.Mandos"})
861
1230
class ClientDBus(Client, DBusObjectWithProperties):
862
1231
    """A Client class using D-Bus
863
1232
    
872
1241
    # dbus.service.Object doesn't use super(), so we can't either.
873
1242
    
874
1243
    def __init__(self, bus = None, *args, **kwargs):
875
 
        self._approvals_pending = 0
876
1244
        self.bus = bus
877
1245
        Client.__init__(self, *args, **kwargs)
878
1246
        # Only now, when this client is initialized, can it show up on
884
1252
                                 ("/clients/" + client_object_name))
885
1253
        DBusObjectWithProperties.__init__(self, self.bus,
886
1254
                                          self.dbus_object_path)
887
 
        
 
1255
    
888
1256
    def notifychangeproperty(transform_func,
889
1257
                             dbus_name, type_func=lambda x: x,
890
1258
                             variant_level=1):
891
1259
        """ Modify a variable so that it's a property which announces
892
1260
        its changes to DBus.
893
 
 
894
 
        transform_fun: Function that takes a value and transforms it
895
 
                       to a D-Bus type.
 
1261
        
 
1262
        transform_fun: Function that takes a value and a variant_level
 
1263
                       and transforms it to a D-Bus type.
896
1264
        dbus_name: D-Bus name of the variable
897
1265
        type_func: Function that transform the value before sending it
898
1266
                   to the D-Bus.  Default: no transform
905
1273
                    type_func(getattr(self, attrname, None))
906
1274
                    != type_func(value)):
907
1275
                    dbus_value = transform_func(type_func(value),
908
 
                                                variant_level)
 
1276
                                                variant_level
 
1277
                                                =variant_level)
909
1278
                    self.PropertyChanged(dbus.String(dbus_name),
910
1279
                                         dbus_value)
911
1280
            setattr(self, attrname, value)
912
1281
        
913
1282
        return property(lambda self: getattr(self, attrname), setter)
914
1283
    
915
 
    
916
1284
    expires = notifychangeproperty(datetime_to_dbus, "Expires")
917
1285
    approvals_pending = notifychangeproperty(dbus.Boolean,
918
1286
                                             "ApprovalPending",
925
1293
                                       checker is not None)
926
1294
    last_checked_ok = notifychangeproperty(datetime_to_dbus,
927
1295
                                           "LastCheckedOK")
 
1296
    last_checker_status = notifychangeproperty(dbus.Int16,
 
1297
                                               "LastCheckerStatus")
928
1298
    last_approval_request = notifychangeproperty(
929
1299
        datetime_to_dbus, "LastApprovalRequest")
930
1300
    approved_by_default = notifychangeproperty(dbus.Boolean,
931
1301
                                               "ApprovedByDefault")
932
 
    approval_delay = notifychangeproperty(dbus.UInt16,
 
1302
    approval_delay = notifychangeproperty(dbus.UInt64,
933
1303
                                          "ApprovalDelay",
934
1304
                                          type_func =
935
 
                                          _timedelta_to_milliseconds)
 
1305
                                          timedelta_to_milliseconds)
936
1306
    approval_duration = notifychangeproperty(
937
 
        dbus.UInt16, "ApprovalDuration",
938
 
        type_func = _timedelta_to_milliseconds)
 
1307
        dbus.UInt64, "ApprovalDuration",
 
1308
        type_func = timedelta_to_milliseconds)
939
1309
    host = notifychangeproperty(dbus.String, "Host")
940
 
    timeout = notifychangeproperty(dbus.UInt16, "Timeout",
 
1310
    timeout = notifychangeproperty(dbus.UInt64, "Timeout",
941
1311
                                   type_func =
942
 
                                   _timedelta_to_milliseconds)
 
1312
                                   timedelta_to_milliseconds)
943
1313
    extended_timeout = notifychangeproperty(
944
 
        dbus.UInt16, "ExtendedTimeout",
945
 
        type_func = _timedelta_to_milliseconds)
946
 
    interval = notifychangeproperty(dbus.UInt16,
 
1314
        dbus.UInt64, "ExtendedTimeout",
 
1315
        type_func = timedelta_to_milliseconds)
 
1316
    interval = notifychangeproperty(dbus.UInt64,
947
1317
                                    "Interval",
948
1318
                                    type_func =
949
 
                                    _timedelta_to_milliseconds)
 
1319
                                    timedelta_to_milliseconds)
950
1320
    checker_command = notifychangeproperty(dbus.String, "Checker")
951
1321
    
952
1322
    del notifychangeproperty
994
1364
        return r
995
1365
    
996
1366
    def _reset_approved(self):
997
 
        self._approved = None
 
1367
        self.approved = None
998
1368
        return False
999
1369
    
1000
1370
    def approve(self, value=True):
1001
 
        self.send_changedstate()
1002
 
        self._approved = value
1003
 
        gobject.timeout_add(_timedelta_to_milliseconds
 
1371
        self.approved = value
 
1372
        gobject.timeout_add(timedelta_to_milliseconds
1004
1373
                            (self.approval_duration),
1005
1374
                            self._reset_approved)
1006
 
    
 
1375
        self.send_changedstate()
1007
1376
    
1008
1377
    ## D-Bus methods, signals & properties
1009
1378
    _interface = "se.recompile.Mandos.Client"
1010
1379
    
 
1380
    ## Interfaces
 
1381
    
 
1382
    @dbus_interface_annotations(_interface)
 
1383
    def _foo(self):
 
1384
        return { "org.freedesktop.DBus.Property.EmitsChangedSignal":
 
1385
                     "false"}
 
1386
    
1011
1387
    ## Signals
1012
1388
    
1013
1389
    # CheckerCompleted - signal
1112
1488
                           access="readwrite")
1113
1489
    def ApprovalDuration_dbus_property(self, value=None):
1114
1490
        if value is None:       # get
1115
 
            return dbus.UInt64(_timedelta_to_milliseconds(
 
1491
            return dbus.UInt64(timedelta_to_milliseconds(
1116
1492
                    self.approval_duration))
1117
1493
        self.approval_duration = datetime.timedelta(0, 0, 0, value)
1118
1494
    
1132
1508
    def Host_dbus_property(self, value=None):
1133
1509
        if value is None:       # get
1134
1510
            return dbus.String(self.host)
1135
 
        self.host = value
 
1511
        self.host = unicode(value)
1136
1512
    
1137
1513
    # Created - property
1138
1514
    @dbus_service_property(_interface, signature="s", access="read")
1139
1515
    def Created_dbus_property(self):
1140
 
        return dbus.String(datetime_to_dbus(self.created))
 
1516
        return datetime_to_dbus(self.created)
1141
1517
    
1142
1518
    # LastEnabled - property
1143
1519
    @dbus_service_property(_interface, signature="s", access="read")
1164
1540
            return
1165
1541
        return datetime_to_dbus(self.last_checked_ok)
1166
1542
    
 
1543
    # LastCheckerStatus - property
 
1544
    @dbus_service_property(_interface, signature="n",
 
1545
                           access="read")
 
1546
    def LastCheckerStatus_dbus_property(self):
 
1547
        return dbus.Int16(self.last_checker_status)
 
1548
    
1167
1549
    # Expires - property
1168
1550
    @dbus_service_property(_interface, signature="s", access="read")
1169
1551
    def Expires_dbus_property(self):
1180
1562
    def Timeout_dbus_property(self, value=None):
1181
1563
        if value is None:       # get
1182
1564
            return dbus.UInt64(self.timeout_milliseconds())
 
1565
        old_timeout = self.timeout
1183
1566
        self.timeout = datetime.timedelta(0, 0, 0, value)
1184
 
        if getattr(self, "disable_initiator_tag", None) is None:
1185
 
            return
1186
 
        # Reschedule timeout
1187
 
        gobject.source_remove(self.disable_initiator_tag)
1188
 
        self.disable_initiator_tag = None
1189
 
        self.expires = None
1190
 
        time_to_die = (self.
1191
 
                       _timedelta_to_milliseconds((self
1192
 
                                                   .last_checked_ok
1193
 
                                                   + self.timeout)
1194
 
                                                  - datetime.datetime
1195
 
                                                  .utcnow()))
1196
 
        if time_to_die <= 0:
1197
 
            # The timeout has passed
1198
 
            self.disable()
1199
 
        else:
1200
 
            self.expires = (datetime.datetime.utcnow()
1201
 
                            + datetime.timedelta(milliseconds =
1202
 
                                                 time_to_die))
1203
 
            self.disable_initiator_tag = (gobject.timeout_add
1204
 
                                          (time_to_die, self.disable))
 
1567
        # Reschedule disabling
 
1568
        if self.enabled:
 
1569
            now = datetime.datetime.utcnow()
 
1570
            self.expires += self.timeout - old_timeout
 
1571
            if self.expires <= now:
 
1572
                # The timeout has passed
 
1573
                self.disable()
 
1574
            else:
 
1575
                if (getattr(self, "disable_initiator_tag", None)
 
1576
                    is None):
 
1577
                    return
 
1578
                gobject.source_remove(self.disable_initiator_tag)
 
1579
                self.disable_initiator_tag = (
 
1580
                    gobject.timeout_add(
 
1581
                        timedelta_to_milliseconds(self.expires - now),
 
1582
                        self.disable))
1205
1583
    
1206
1584
    # ExtendedTimeout - property
1207
1585
    @dbus_service_property(_interface, signature="t",
1220
1598
        self.interval = datetime.timedelta(0, 0, 0, value)
1221
1599
        if getattr(self, "checker_initiator_tag", None) is None:
1222
1600
            return
1223
 
        # Reschedule checker run
1224
 
        gobject.source_remove(self.checker_initiator_tag)
1225
 
        self.checker_initiator_tag = (gobject.timeout_add
1226
 
                                      (value, self.start_checker))
1227
 
        self.start_checker()    # Start one now, too
 
1601
        if self.enabled:
 
1602
            # Reschedule checker run
 
1603
            gobject.source_remove(self.checker_initiator_tag)
 
1604
            self.checker_initiator_tag = (gobject.timeout_add
 
1605
                                          (value, self.start_checker))
 
1606
            self.start_checker()    # Start one now, too
1228
1607
    
1229
1608
    # Checker - property
1230
1609
    @dbus_service_property(_interface, signature="s",
1232
1611
    def Checker_dbus_property(self, value=None):
1233
1612
        if value is None:       # get
1234
1613
            return dbus.String(self.checker_command)
1235
 
        self.checker_command = value
 
1614
        self.checker_command = unicode(value)
1236
1615
    
1237
1616
    # CheckerRunning - property
1238
1617
    @dbus_service_property(_interface, signature="b",
1267
1646
            raise KeyError()
1268
1647
    
1269
1648
    def __getattribute__(self, name):
1270
 
        if(name == '_pipe'):
 
1649
        if name == '_pipe':
1271
1650
            return super(ProxyClient, self).__getattribute__(name)
1272
1651
        self._pipe.send(('getattr', name))
1273
1652
        data = self._pipe.recv()
1280
1659
            return func
1281
1660
    
1282
1661
    def __setattr__(self, name, value):
1283
 
        if(name == '_pipe'):
 
1662
        if name == '_pipe':
1284
1663
            return super(ProxyClient, self).__setattr__(name, value)
1285
1664
        self._pipe.send(('setattr', name, value))
1286
1665
 
1287
 
class ClientDBusTransitional(ClientDBus):
1288
 
    __metaclass__ = AlternateDBusNamesMetaclass
1289
1666
 
1290
1667
class ClientHandler(socketserver.BaseRequestHandler, object):
1291
1668
    """A class to handle client connections.
1328
1705
            logger.debug("Protocol version: %r", line)
1329
1706
            try:
1330
1707
                if int(line.strip().split()[0]) > 1:
1331
 
                    raise RuntimeError
 
1708
                    raise RuntimeError(line)
1332
1709
            except (ValueError, IndexError, RuntimeError) as error:
1333
1710
                logger.error("Unknown protocol version: %s", error)
1334
1711
                return
1374
1751
                            client.Rejected("Disabled")
1375
1752
                        return
1376
1753
                    
1377
 
                    if client._approved or not client.approval_delay:
 
1754
                    if client.approved or not client.approval_delay:
1378
1755
                        #We are approved or approval is disabled
1379
1756
                        break
1380
 
                    elif client._approved is None:
 
1757
                    elif client.approved is None:
1381
1758
                        logger.info("Client %s needs approval",
1382
1759
                                    client.name)
1383
1760
                        if self.server.use_dbus:
1396
1773
                    #wait until timeout or approved
1397
1774
                    time = datetime.datetime.now()
1398
1775
                    client.changedstate.acquire()
1399
 
                    (client.changedstate.wait
1400
 
                     (float(client._timedelta_to_milliseconds(delay)
1401
 
                            / 1000)))
 
1776
                    client.changedstate.wait(
 
1777
                        float(timedelta_to_milliseconds(delay)
 
1778
                              / 1000))
1402
1779
                    client.changedstate.release()
1403
1780
                    time2 = datetime.datetime.now()
1404
1781
                    if (time2 - time) >= delay:
1420
1797
                    try:
1421
1798
                        sent = session.send(client.secret[sent_size:])
1422
1799
                    except gnutls.errors.GNUTLSError as error:
1423
 
                        logger.warning("gnutls send failed")
 
1800
                        logger.warning("gnutls send failed",
 
1801
                                       exc_info=error)
1424
1802
                        return
1425
1803
                    logger.debug("Sent: %d, remaining: %d",
1426
1804
                                 sent, len(client.secret)
1429
1807
                
1430
1808
                logger.info("Sending secret to %s", client.name)
1431
1809
                # bump the timeout using extended_timeout
1432
 
                client.checked_ok(client.extended_timeout)
 
1810
                client.bump_timeout(client.extended_timeout)
1433
1811
                if self.server.use_dbus:
1434
1812
                    # Emit D-Bus signal
1435
1813
                    client.GotSecret()
1440
1818
                try:
1441
1819
                    session.bye()
1442
1820
                except gnutls.errors.GNUTLSError as error:
1443
 
                    logger.warning("GnuTLS bye failed")
 
1821
                    logger.warning("GnuTLS bye failed",
 
1822
                                   exc_info=error)
1444
1823
    
1445
1824
    @staticmethod
1446
1825
    def peer_certificate(session):
1502
1881
        # Convert the buffer to a Python bytestring
1503
1882
        fpr = ctypes.string_at(buf, buf_len.value)
1504
1883
        # Convert the bytestring to hexadecimal notation
1505
 
        hex_fpr = ''.join("%02X" % ord(char) for char in fpr)
 
1884
        hex_fpr = binascii.hexlify(fpr).upper()
1506
1885
        return hex_fpr
1507
1886
 
1508
1887
 
1511
1890
    def sub_process_main(self, request, address):
1512
1891
        try:
1513
1892
            self.finish_request(request, address)
1514
 
        except:
 
1893
        except Exception:
1515
1894
            self.handle_error(request, address)
1516
1895
        self.close_request(request)
1517
1896
    
1518
1897
    def process_request(self, request, address):
1519
1898
        """Start a new process to process the request."""
1520
1899
        proc = multiprocessing.Process(target = self.sub_process_main,
1521
 
                                       args = (request,
1522
 
                                               address))
 
1900
                                       args = (request, address))
1523
1901
        proc.start()
1524
1902
        return proc
1525
1903
 
1540
1918
    
1541
1919
    def add_pipe(self, parent_pipe, proc):
1542
1920
        """Dummy function; override as necessary"""
1543
 
        raise NotImplementedError
 
1921
        raise NotImplementedError()
1544
1922
 
1545
1923
 
1546
1924
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
1553
1931
        use_ipv6:       Boolean; to use IPv6 or not
1554
1932
    """
1555
1933
    def __init__(self, server_address, RequestHandlerClass,
1556
 
                 interface=None, use_ipv6=True):
 
1934
                 interface=None, use_ipv6=True, socketfd=None):
 
1935
        """If socketfd is set, use that file descriptor instead of
 
1936
        creating a new one with socket.socket().
 
1937
        """
1557
1938
        self.interface = interface
1558
1939
        if use_ipv6:
1559
1940
            self.address_family = socket.AF_INET6
 
1941
        if socketfd is not None:
 
1942
            # Save the file descriptor
 
1943
            self.socketfd = socketfd
 
1944
            # Save the original socket.socket() function
 
1945
            self.socket_socket = socket.socket
 
1946
            # To implement --socket, we monkey patch socket.socket.
 
1947
            # 
 
1948
            # (When socketserver.TCPServer is a new-style class, we
 
1949
            # could make self.socket into a property instead of monkey
 
1950
            # patching socket.socket.)
 
1951
            # 
 
1952
            # Create a one-time-only replacement for socket.socket()
 
1953
            @functools.wraps(socket.socket)
 
1954
            def socket_wrapper(*args, **kwargs):
 
1955
                # Restore original function so subsequent calls are
 
1956
                # not affected.
 
1957
                socket.socket = self.socket_socket
 
1958
                del self.socket_socket
 
1959
                # This time only, return a new socket object from the
 
1960
                # saved file descriptor.
 
1961
                return socket.fromfd(self.socketfd, *args, **kwargs)
 
1962
            # Replace socket.socket() function with wrapper
 
1963
            socket.socket = socket_wrapper
 
1964
        # The socketserver.TCPServer.__init__ will call
 
1965
        # socket.socket(), which might be our replacement,
 
1966
        # socket_wrapper(), if socketfd was set.
1560
1967
        socketserver.TCPServer.__init__(self, server_address,
1561
1968
                                        RequestHandlerClass)
 
1969
    
1562
1970
    def server_bind(self):
1563
1971
        """This overrides the normal server_bind() function
1564
1972
        to bind to an interface if one was specified, and also NOT to
1572
1980
                try:
1573
1981
                    self.socket.setsockopt(socket.SOL_SOCKET,
1574
1982
                                           SO_BINDTODEVICE,
1575
 
                                           str(self.interface
1576
 
                                               + '\0'))
 
1983
                                           str(self.interface + '\0'))
1577
1984
                except socket.error as error:
1578
 
                    if error[0] == errno.EPERM:
1579
 
                        logger.error("No permission to"
1580
 
                                     " bind to interface %s",
1581
 
                                     self.interface)
1582
 
                    elif error[0] == errno.ENOPROTOOPT:
 
1985
                    if error.errno == errno.EPERM:
 
1986
                        logger.error("No permission to bind to"
 
1987
                                     " interface %s", self.interface)
 
1988
                    elif error.errno == errno.ENOPROTOOPT:
1583
1989
                        logger.error("SO_BINDTODEVICE not available;"
1584
1990
                                     " cannot bind to interface %s",
1585
1991
                                     self.interface)
 
1992
                    elif error.errno == errno.ENODEV:
 
1993
                        logger.error("Interface %s does not exist,"
 
1994
                                     " cannot bind", self.interface)
1586
1995
                    else:
1587
1996
                        raise
1588
1997
        # Only bind(2) the socket if we really need to.
1591
2000
                if self.address_family == socket.AF_INET6:
1592
2001
                    any_address = "::" # in6addr_any
1593
2002
                else:
1594
 
                    any_address = socket.INADDR_ANY
 
2003
                    any_address = "0.0.0.0" # INADDR_ANY
1595
2004
                self.server_address = (any_address,
1596
2005
                                       self.server_address[1])
1597
2006
            elif not self.server_address[1]:
1618
2027
    """
1619
2028
    def __init__(self, server_address, RequestHandlerClass,
1620
2029
                 interface=None, use_ipv6=True, clients=None,
1621
 
                 gnutls_priority=None, use_dbus=True):
 
2030
                 gnutls_priority=None, use_dbus=True, socketfd=None):
1622
2031
        self.enabled = False
1623
2032
        self.clients = clients
1624
2033
        if self.clients is None:
1625
 
            self.clients = set()
 
2034
            self.clients = {}
1626
2035
        self.use_dbus = use_dbus
1627
2036
        self.gnutls_priority = gnutls_priority
1628
2037
        IPv6_TCPServer.__init__(self, server_address,
1629
2038
                                RequestHandlerClass,
1630
2039
                                interface = interface,
1631
 
                                use_ipv6 = use_ipv6)
 
2040
                                use_ipv6 = use_ipv6,
 
2041
                                socketfd = socketfd)
1632
2042
    def server_activate(self):
1633
2043
        if self.enabled:
1634
2044
            return socketserver.TCPServer.server_activate(self)
1647
2057
    
1648
2058
    def handle_ipc(self, source, condition, parent_pipe=None,
1649
2059
                   proc = None, client_object=None):
1650
 
        condition_names = {
1651
 
            gobject.IO_IN: "IN",   # There is data to read.
1652
 
            gobject.IO_OUT: "OUT", # Data can be written (without
1653
 
                                    # blocking).
1654
 
            gobject.IO_PRI: "PRI", # There is urgent data to read.
1655
 
            gobject.IO_ERR: "ERR", # Error condition.
1656
 
            gobject.IO_HUP: "HUP"  # Hung up (the connection has been
1657
 
                                    # broken, usually for pipes and
1658
 
                                    # sockets).
1659
 
            }
1660
 
        conditions_string = ' | '.join(name
1661
 
                                       for cond, name in
1662
 
                                       condition_names.iteritems()
1663
 
                                       if cond & condition)
1664
2060
        # error, or the other end of multiprocessing.Pipe has closed
1665
 
        if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):
 
2061
        if condition & (gobject.IO_ERR | gobject.IO_HUP):
1666
2062
            # Wait for other process to exit
1667
2063
            proc.join()
1668
2064
            return False
1675
2071
            fpr = request[1]
1676
2072
            address = request[2]
1677
2073
            
1678
 
            for c in self.clients:
 
2074
            for c in self.clients.itervalues():
1679
2075
                if c.fingerprint == fpr:
1680
2076
                    client = c
1681
2077
                    break
1726
2122
        return True
1727
2123
 
1728
2124
 
 
2125
def rfc3339_duration_to_delta(duration):
 
2126
    """Parse an RFC 3339 "duration" and return a datetime.timedelta
 
2127
    
 
2128
    >>> rfc3339_duration_to_delta("P7D")
 
2129
    datetime.timedelta(7)
 
2130
    >>> rfc3339_duration_to_delta("PT60S")
 
2131
    datetime.timedelta(0, 60)
 
2132
    >>> rfc3339_duration_to_delta("PT60M")
 
2133
    datetime.timedelta(0, 3600)
 
2134
    >>> rfc3339_duration_to_delta("PT24H")
 
2135
    datetime.timedelta(1)
 
2136
    >>> rfc3339_duration_to_delta("P1W")
 
2137
    datetime.timedelta(7)
 
2138
    >>> rfc3339_duration_to_delta("PT5M30S")
 
2139
    datetime.timedelta(0, 330)
 
2140
    >>> rfc3339_duration_to_delta("P1DT3M20S")
 
2141
    datetime.timedelta(1, 200)
 
2142
    """
 
2143
    
 
2144
    # Parsing an RFC 3339 duration with regular expressions is not
 
2145
    # possible - there would have to be multiple places for the same
 
2146
    # values, like seconds.  The current code, while more esoteric, is
 
2147
    # cleaner without depending on a parsing library.  If Python had a
 
2148
    # built-in library for parsing we would use it, but we'd like to
 
2149
    # avoid excessive use of external libraries.
 
2150
    
 
2151
    # New type for defining tokens, syntax, and semantics all-in-one
 
2152
    Token = collections.namedtuple("Token",
 
2153
                                   ("regexp", # To match token; if
 
2154
                                              # "value" is not None,
 
2155
                                              # must have a "group"
 
2156
                                              # containing digits
 
2157
                                    "value",  # datetime.timedelta or
 
2158
                                              # None
 
2159
                                    "followers")) # Tokens valid after
 
2160
                                                  # this token
 
2161
    # RFC 3339 "duration" tokens, syntax, and semantics; taken from
 
2162
    # the "duration" ABNF definition in RFC 3339, Appendix A.
 
2163
    token_end = Token(re.compile(r"$"), None, frozenset())
 
2164
    token_second = Token(re.compile(r"(\d+)S"),
 
2165
                         datetime.timedelta(seconds=1),
 
2166
                         frozenset((token_end,)))
 
2167
    token_minute = Token(re.compile(r"(\d+)M"),
 
2168
                         datetime.timedelta(minutes=1),
 
2169
                         frozenset((token_second, token_end)))
 
2170
    token_hour = Token(re.compile(r"(\d+)H"),
 
2171
                       datetime.timedelta(hours=1),
 
2172
                       frozenset((token_minute, token_end)))
 
2173
    token_time = Token(re.compile(r"T"),
 
2174
                       None,
 
2175
                       frozenset((token_hour, token_minute,
 
2176
                                  token_second)))
 
2177
    token_day = Token(re.compile(r"(\d+)D"),
 
2178
                      datetime.timedelta(days=1),
 
2179
                      frozenset((token_time, token_end)))
 
2180
    token_month = Token(re.compile(r"(\d+)M"),
 
2181
                        datetime.timedelta(weeks=4),
 
2182
                        frozenset((token_day, token_end)))
 
2183
    token_year = Token(re.compile(r"(\d+)Y"),
 
2184
                       datetime.timedelta(weeks=52),
 
2185
                       frozenset((token_month, token_end)))
 
2186
    token_week = Token(re.compile(r"(\d+)W"),
 
2187
                       datetime.timedelta(weeks=1),
 
2188
                       frozenset((token_end,)))
 
2189
    token_duration = Token(re.compile(r"P"), None,
 
2190
                           frozenset((token_year, token_month,
 
2191
                                      token_day, token_time,
 
2192
                                      token_week))),
 
2193
    # Define starting values
 
2194
    value = datetime.timedelta() # Value so far
 
2195
    found_token = None
 
2196
    followers = frozenset(token_duration,) # Following valid tokens
 
2197
    s = duration                # String left to parse
 
2198
    # Loop until end token is found
 
2199
    while found_token is not token_end:
 
2200
        # Search for any currently valid tokens
 
2201
        for token in followers:
 
2202
            match = token.regexp.match(s)
 
2203
            if match is not None:
 
2204
                # Token found
 
2205
                if token.value is not None:
 
2206
                    # Value found, parse digits
 
2207
                    factor = int(match.group(1), 10)
 
2208
                    # Add to value so far
 
2209
                    value += factor * token.value
 
2210
                # Strip token from string
 
2211
                s = token.regexp.sub("", s, 1)
 
2212
                # Go to found token
 
2213
                found_token = token
 
2214
                # Set valid next tokens
 
2215
                followers = found_token.followers
 
2216
                break
 
2217
        else:
 
2218
            # No currently valid tokens were found
 
2219
            raise ValueError("Invalid RFC 3339 duration")
 
2220
    # End token found
 
2221
    return value
 
2222
 
 
2223
 
1729
2224
def string_to_delta(interval):
1730
2225
    """Parse a string and return a datetime.timedelta
1731
2226
    
1742
2237
    >>> string_to_delta('5m 30s')
1743
2238
    datetime.timedelta(0, 330)
1744
2239
    """
 
2240
    
 
2241
    try:
 
2242
        return rfc3339_duration_to_delta(interval)
 
2243
    except ValueError:
 
2244
        pass
 
2245
    
1745
2246
    timevalue = datetime.timedelta(0)
1746
2247
    for s in interval.split():
1747
2248
        try:
1758
2259
            elif suffix == "w":
1759
2260
                delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
1760
2261
            else:
1761
 
                raise ValueError("Unknown suffix %r" % suffix)
1762
 
        except (ValueError, IndexError) as e:
 
2262
                raise ValueError("Unknown suffix {0!r}"
 
2263
                                 .format(suffix))
 
2264
        except IndexError as e:
1763
2265
            raise ValueError(*(e.args))
1764
2266
        timevalue += delta
1765
2267
    return timevalue
1766
2268
 
1767
2269
 
1768
 
def if_nametoindex(interface):
1769
 
    """Call the C function if_nametoindex(), or equivalent
1770
 
    
1771
 
    Note: This function cannot accept a unicode string."""
1772
 
    global if_nametoindex
1773
 
    try:
1774
 
        if_nametoindex = (ctypes.cdll.LoadLibrary
1775
 
                          (ctypes.util.find_library("c"))
1776
 
                          .if_nametoindex)
1777
 
    except (OSError, AttributeError):
1778
 
        logger.warning("Doing if_nametoindex the hard way")
1779
 
        def if_nametoindex(interface):
1780
 
            "Get an interface index the hard way, i.e. using fcntl()"
1781
 
            SIOCGIFINDEX = 0x8933  # From /usr/include/linux/sockios.h
1782
 
            with contextlib.closing(socket.socket()) as s:
1783
 
                ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
1784
 
                                    struct.pack(str("16s16x"),
1785
 
                                                interface))
1786
 
            interface_index = struct.unpack(str("I"),
1787
 
                                            ifreq[16:20])[0]
1788
 
            return interface_index
1789
 
    return if_nametoindex(interface)
1790
 
 
1791
 
 
1792
2270
def daemon(nochdir = False, noclose = False):
1793
2271
    """See daemon(3).  Standard BSD Unix function.
1794
2272
    
1802
2280
        sys.exit()
1803
2281
    if not noclose:
1804
2282
        # Close all standard open file descriptors
1805
 
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
 
2283
        null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
1806
2284
        if not stat.S_ISCHR(os.fstat(null).st_mode):
1807
2285
            raise OSError(errno.ENODEV,
1808
 
                          "%s not a character device"
1809
 
                          % os.path.devnull)
 
2286
                          "{0} not a character device"
 
2287
                          .format(os.devnull))
1810
2288
        os.dup2(null, sys.stdin.fileno())
1811
2289
        os.dup2(null, sys.stdout.fileno())
1812
2290
        os.dup2(null, sys.stderr.fileno())
1821
2299
    
1822
2300
    parser = argparse.ArgumentParser()
1823
2301
    parser.add_argument("-v", "--version", action="version",
1824
 
                        version = "%%(prog)s %s" % version,
 
2302
                        version = "%(prog)s {0}".format(version),
1825
2303
                        help="show version number and exit")
1826
2304
    parser.add_argument("-i", "--interface", metavar="IF",
1827
2305
                        help="Bind to interface IF")
1833
2311
                        help="Run self-test")
1834
2312
    parser.add_argument("--debug", action="store_true",
1835
2313
                        help="Debug mode; run in foreground and log"
1836
 
                        " to terminal")
 
2314
                        " to terminal", default=None)
1837
2315
    parser.add_argument("--debuglevel", metavar="LEVEL",
1838
2316
                        help="Debug level for stdout output")
1839
2317
    parser.add_argument("--priority", help="GnuTLS"
1846
2324
                        " files")
1847
2325
    parser.add_argument("--no-dbus", action="store_false",
1848
2326
                        dest="use_dbus", help="Do not provide D-Bus"
1849
 
                        " system bus interface")
 
2327
                        " system bus interface", default=None)
1850
2328
    parser.add_argument("--no-ipv6", action="store_false",
1851
 
                        dest="use_ipv6", help="Do not use IPv6")
 
2329
                        dest="use_ipv6", help="Do not use IPv6",
 
2330
                        default=None)
 
2331
    parser.add_argument("--no-restore", action="store_false",
 
2332
                        dest="restore", help="Do not restore stored"
 
2333
                        " state", default=None)
 
2334
    parser.add_argument("--socket", type=int,
 
2335
                        help="Specify a file descriptor to a network"
 
2336
                        " socket to use instead of creating one")
 
2337
    parser.add_argument("--statedir", metavar="DIR",
 
2338
                        help="Directory to save/restore state in")
 
2339
    parser.add_argument("--foreground", action="store_true",
 
2340
                        help="Run in foreground", default=None)
 
2341
    
1852
2342
    options = parser.parse_args()
1853
2343
    
1854
2344
    if options.check:
1855
2345
        import doctest
1856
 
        doctest.testmod()
1857
 
        sys.exit()
 
2346
        fail_count, test_count = doctest.testmod()
 
2347
        sys.exit(os.EX_OK if fail_count == 0 else 1)
1858
2348
    
1859
2349
    # Default values for config file for server-global settings
1860
2350
    server_defaults = { "interface": "",
1862
2352
                        "port": "",
1863
2353
                        "debug": "False",
1864
2354
                        "priority":
1865
 
                        "SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
 
2355
                        "SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",
1866
2356
                        "servicename": "Mandos",
1867
2357
                        "use_dbus": "True",
1868
2358
                        "use_ipv6": "True",
1869
2359
                        "debuglevel": "",
 
2360
                        "restore": "True",
 
2361
                        "socket": "",
 
2362
                        "statedir": "/var/lib/mandos",
 
2363
                        "foreground": "False",
1870
2364
                        }
1871
2365
    
1872
2366
    # Parse config file for server-global settings
1877
2371
    # Convert the SafeConfigParser object to a dict
1878
2372
    server_settings = server_config.defaults()
1879
2373
    # Use the appropriate methods on the non-string config options
1880
 
    for option in ("debug", "use_dbus", "use_ipv6"):
 
2374
    for option in ("debug", "use_dbus", "use_ipv6", "foreground"):
1881
2375
        server_settings[option] = server_config.getboolean("DEFAULT",
1882
2376
                                                           option)
1883
2377
    if server_settings["port"]:
1884
2378
        server_settings["port"] = server_config.getint("DEFAULT",
1885
2379
                                                       "port")
 
2380
    if server_settings["socket"]:
 
2381
        server_settings["socket"] = server_config.getint("DEFAULT",
 
2382
                                                         "socket")
 
2383
        # Later, stdin will, and stdout and stderr might, be dup'ed
 
2384
        # over with an opened os.devnull.  But we don't want this to
 
2385
        # happen with a supplied network socket.
 
2386
        if 0 <= server_settings["socket"] <= 2:
 
2387
            server_settings["socket"] = os.dup(server_settings
 
2388
                                               ["socket"])
1886
2389
    del server_config
1887
2390
    
1888
2391
    # Override the settings from the config file with command line
1889
2392
    # options, if set.
1890
2393
    for option in ("interface", "address", "port", "debug",
1891
2394
                   "priority", "servicename", "configdir",
1892
 
                   "use_dbus", "use_ipv6", "debuglevel"):
 
2395
                   "use_dbus", "use_ipv6", "debuglevel", "restore",
 
2396
                   "statedir", "socket", "foreground"):
1893
2397
        value = getattr(options, option)
1894
2398
        if value is not None:
1895
2399
            server_settings[option] = value
1898
2402
    for option in server_settings.keys():
1899
2403
        if type(server_settings[option]) is str:
1900
2404
            server_settings[option] = unicode(server_settings[option])
 
2405
    # Force all boolean options to be boolean
 
2406
    for option in ("debug", "use_dbus", "use_ipv6", "restore",
 
2407
                   "foreground"):
 
2408
        server_settings[option] = bool(server_settings[option])
 
2409
    # Debug implies foreground
 
2410
    if server_settings["debug"]:
 
2411
        server_settings["foreground"] = True
1901
2412
    # Now we have our good server settings in "server_settings"
1902
2413
    
1903
2414
    ##################################################################
1907
2418
    debuglevel = server_settings["debuglevel"]
1908
2419
    use_dbus = server_settings["use_dbus"]
1909
2420
    use_ipv6 = server_settings["use_ipv6"]
 
2421
    stored_state_path = os.path.join(server_settings["statedir"],
 
2422
                                     stored_state_file)
 
2423
    foreground = server_settings["foreground"]
 
2424
    
 
2425
    if debug:
 
2426
        initlogger(debug, logging.DEBUG)
 
2427
    else:
 
2428
        if not debuglevel:
 
2429
            initlogger(debug)
 
2430
        else:
 
2431
            level = getattr(logging, debuglevel.upper())
 
2432
            initlogger(debug, level)
1910
2433
    
1911
2434
    if server_settings["servicename"] != "Mandos":
1912
2435
        syslogger.setFormatter(logging.Formatter
1913
 
                               ('Mandos (%s) [%%(process)d]:'
1914
 
                                ' %%(levelname)s: %%(message)s'
1915
 
                                % server_settings["servicename"]))
 
2436
                               ('Mandos ({0}) [%(process)d]:'
 
2437
                                ' %(levelname)s: %(message)s'
 
2438
                                .format(server_settings
 
2439
                                        ["servicename"])))
1916
2440
    
1917
2441
    # Parse config file with clients
1918
 
    client_defaults = { "timeout": "5m",
1919
 
                        "extended_timeout": "15m",
1920
 
                        "interval": "2m",
1921
 
                        "checker": "fping -q -- %%(host)s",
1922
 
                        "host": "",
1923
 
                        "approval_delay": "0s",
1924
 
                        "approval_duration": "1s",
1925
 
                        }
1926
 
    client_config = configparser.SafeConfigParser(client_defaults)
 
2442
    client_config = configparser.SafeConfigParser(Client
 
2443
                                                  .client_defaults)
1927
2444
    client_config.read(os.path.join(server_settings["configdir"],
1928
2445
                                    "clients.conf"))
1929
2446
    
1938
2455
                              use_ipv6=use_ipv6,
1939
2456
                              gnutls_priority=
1940
2457
                              server_settings["priority"],
1941
 
                              use_dbus=use_dbus)
1942
 
    if not debug:
1943
 
        pidfilename = "/var/run/mandos.pid"
 
2458
                              use_dbus=use_dbus,
 
2459
                              socketfd=(server_settings["socket"]
 
2460
                                        or None))
 
2461
    if not foreground:
 
2462
        pidfilename = "/run/mandos.pid"
 
2463
        if not os.path.isdir("/run/."):
 
2464
            pidfilename = "/var/run/mandos.pid"
 
2465
        pidfile = None
1944
2466
        try:
1945
2467
            pidfile = open(pidfilename, "w")
1946
 
        except IOError:
1947
 
            logger.error("Could not open file %r", pidfilename)
 
2468
        except IOError as e:
 
2469
            logger.error("Could not open file %r", pidfilename,
 
2470
                         exc_info=e)
1948
2471
    
1949
 
    try:
1950
 
        uid = pwd.getpwnam("_mandos").pw_uid
1951
 
        gid = pwd.getpwnam("_mandos").pw_gid
1952
 
    except KeyError:
 
2472
    for name in ("_mandos", "mandos", "nobody"):
1953
2473
        try:
1954
 
            uid = pwd.getpwnam("mandos").pw_uid
1955
 
            gid = pwd.getpwnam("mandos").pw_gid
 
2474
            uid = pwd.getpwnam(name).pw_uid
 
2475
            gid = pwd.getpwnam(name).pw_gid
 
2476
            break
1956
2477
        except KeyError:
1957
 
            try:
1958
 
                uid = pwd.getpwnam("nobody").pw_uid
1959
 
                gid = pwd.getpwnam("nobody").pw_gid
1960
 
            except KeyError:
1961
 
                uid = 65534
1962
 
                gid = 65534
 
2478
            continue
 
2479
    else:
 
2480
        uid = 65534
 
2481
        gid = 65534
1963
2482
    try:
1964
2483
        os.setgid(gid)
1965
2484
        os.setuid(uid)
1966
2485
    except OSError as error:
1967
 
        if error[0] != errno.EPERM:
1968
 
            raise error
1969
 
    
1970
 
    if not debug and not debuglevel:
1971
 
        syslogger.setLevel(logging.WARNING)
1972
 
        console.setLevel(logging.WARNING)
1973
 
    if debuglevel:
1974
 
        level = getattr(logging, debuglevel.upper())
1975
 
        syslogger.setLevel(level)
1976
 
        console.setLevel(level)
 
2486
        if error.errno != errno.EPERM:
 
2487
            raise
1977
2488
    
1978
2489
    if debug:
1979
2490
        # Enable all possible GnuTLS debugging
1990
2501
         .gnutls_global_set_log_function(debug_gnutls))
1991
2502
        
1992
2503
        # Redirect stdin so all checkers get /dev/null
1993
 
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
 
2504
        null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
1994
2505
        os.dup2(null, sys.stdin.fileno())
1995
2506
        if null > 2:
1996
2507
            os.close(null)
1997
 
    else:
1998
 
        # No console logging
1999
 
        logger.removeHandler(console)
2000
2508
    
2001
2509
    # Need to fork before connecting to D-Bus
2002
 
    if not debug:
 
2510
    if not foreground:
2003
2511
        # Close all input and output, do double fork, etc.
2004
2512
        daemon()
2005
2513
    
 
2514
    # multiprocessing will use threads, so before we use gobject we
 
2515
    # need to inform gobject that threads will be used.
 
2516
    gobject.threads_init()
 
2517
    
2006
2518
    global main_loop
2007
2519
    # From the Avahi example code
2008
 
    DBusGMainLoop(set_as_default=True )
 
2520
    DBusGMainLoop(set_as_default=True)
2009
2521
    main_loop = gobject.MainLoop()
2010
2522
    bus = dbus.SystemBus()
2011
2523
    # End of Avahi example code
2017
2529
                            ("se.bsnet.fukt.Mandos", bus,
2018
2530
                             do_not_queue=True))
2019
2531
        except dbus.exceptions.NameExistsException as e:
2020
 
            logger.error(unicode(e) + ", disabling D-Bus")
 
2532
            logger.error("Disabling D-Bus:", exc_info=e)
2021
2533
            use_dbus = False
2022
2534
            server_settings["use_dbus"] = False
2023
2535
            tcp_server.use_dbus = False
2024
2536
    protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2025
 
    service = AvahiService(name = server_settings["servicename"],
2026
 
                           servicetype = "_mandos._tcp",
2027
 
                           protocol = protocol, bus = bus)
 
2537
    service = AvahiServiceToSyslog(name =
 
2538
                                   server_settings["servicename"],
 
2539
                                   servicetype = "_mandos._tcp",
 
2540
                                   protocol = protocol, bus = bus)
2028
2541
    if server_settings["interface"]:
2029
2542
        service.interface = (if_nametoindex
2030
2543
                             (str(server_settings["interface"])))
2034
2547
    
2035
2548
    client_class = Client
2036
2549
    if use_dbus:
2037
 
        client_class = functools.partial(ClientDBusTransitional,
2038
 
                                         bus = bus)
2039
 
    def client_config_items(config, section):
2040
 
        special_settings = {
2041
 
            "approved_by_default":
2042
 
                lambda: config.getboolean(section,
2043
 
                                          "approved_by_default"),
2044
 
            }
2045
 
        for name, value in config.items(section):
 
2550
        client_class = functools.partial(ClientDBus, bus = bus)
 
2551
    
 
2552
    client_settings = Client.config_parser(client_config)
 
2553
    old_client_settings = {}
 
2554
    clients_data = {}
 
2555
    
 
2556
    # This is used to redirect stdout and stderr for checker processes
 
2557
    global wnull
 
2558
    wnull = open(os.devnull, "w") # A writable /dev/null
 
2559
    # Only used if server is running in foreground but not in debug
 
2560
    # mode
 
2561
    if debug or not foreground:
 
2562
        wnull.close()
 
2563
    
 
2564
    # Get client data and settings from last running state.
 
2565
    if server_settings["restore"]:
 
2566
        try:
 
2567
            with open(stored_state_path, "rb") as stored_state:
 
2568
                clients_data, old_client_settings = (pickle.load
 
2569
                                                     (stored_state))
 
2570
            os.remove(stored_state_path)
 
2571
        except IOError as e:
 
2572
            if e.errno == errno.ENOENT:
 
2573
                logger.warning("Could not load persistent state: {0}"
 
2574
                                .format(os.strerror(e.errno)))
 
2575
            else:
 
2576
                logger.critical("Could not load persistent state:",
 
2577
                                exc_info=e)
 
2578
                raise
 
2579
        except EOFError as e:
 
2580
            logger.warning("Could not load persistent state: "
 
2581
                           "EOFError:", exc_info=e)
 
2582
    
 
2583
    with PGPEngine() as pgp:
 
2584
        for client_name, client in clients_data.iteritems():
 
2585
            # Skip removed clients
 
2586
            if client_name not in client_settings:
 
2587
                continue
 
2588
            
 
2589
            # Decide which value to use after restoring saved state.
 
2590
            # We have three different values: Old config file,
 
2591
            # new config file, and saved state.
 
2592
            # New config value takes precedence if it differs from old
 
2593
            # config value, otherwise use saved state.
 
2594
            for name, value in client_settings[client_name].items():
 
2595
                try:
 
2596
                    # For each value in new config, check if it
 
2597
                    # differs from the old config value (Except for
 
2598
                    # the "secret" attribute)
 
2599
                    if (name != "secret" and
 
2600
                        value != old_client_settings[client_name]
 
2601
                        [name]):
 
2602
                        client[name] = value
 
2603
                except KeyError:
 
2604
                    pass
 
2605
            
 
2606
            # Clients who has passed its expire date can still be
 
2607
            # enabled if its last checker was successful.  Clients
 
2608
            # whose checker succeeded before we stored its state is
 
2609
            # assumed to have successfully run all checkers during
 
2610
            # downtime.
 
2611
            if client["enabled"]:
 
2612
                if datetime.datetime.utcnow() >= client["expires"]:
 
2613
                    if not client["last_checked_ok"]:
 
2614
                        logger.warning(
 
2615
                            "disabling client {0} - Client never "
 
2616
                            "performed a successful checker"
 
2617
                            .format(client_name))
 
2618
                        client["enabled"] = False
 
2619
                    elif client["last_checker_status"] != 0:
 
2620
                        logger.warning(
 
2621
                            "disabling client {0} - Client "
 
2622
                            "last checker failed with error code {1}"
 
2623
                            .format(client_name,
 
2624
                                    client["last_checker_status"]))
 
2625
                        client["enabled"] = False
 
2626
                    else:
 
2627
                        client["expires"] = (datetime.datetime
 
2628
                                             .utcnow()
 
2629
                                             + client["timeout"])
 
2630
                        logger.debug("Last checker succeeded,"
 
2631
                                     " keeping {0} enabled"
 
2632
                                     .format(client_name))
2046
2633
            try:
2047
 
                yield (name, special_settings[name]())
2048
 
            except KeyError:
2049
 
                yield (name, value)
2050
 
    
2051
 
    tcp_server.clients.update(set(
2052
 
            client_class(name = section,
2053
 
                         config= dict(client_config_items(
2054
 
                        client_config, section)))
2055
 
            for section in client_config.sections()))
 
2634
                client["secret"] = (
 
2635
                    pgp.decrypt(client["encrypted_secret"],
 
2636
                                client_settings[client_name]
 
2637
                                ["secret"]))
 
2638
            except PGPError:
 
2639
                # If decryption fails, we use secret from new settings
 
2640
                logger.debug("Failed to decrypt {0} old secret"
 
2641
                             .format(client_name))
 
2642
                client["secret"] = (
 
2643
                    client_settings[client_name]["secret"])
 
2644
    
 
2645
    # Add/remove clients based on new changes made to config
 
2646
    for client_name in (set(old_client_settings)
 
2647
                        - set(client_settings)):
 
2648
        del clients_data[client_name]
 
2649
    for client_name in (set(client_settings)
 
2650
                        - set(old_client_settings)):
 
2651
        clients_data[client_name] = client_settings[client_name]
 
2652
    
 
2653
    # Create all client objects
 
2654
    for client_name, client in clients_data.iteritems():
 
2655
        tcp_server.clients[client_name] = client_class(
 
2656
            name = client_name, settings = client,
 
2657
            server_settings = server_settings)
 
2658
    
2056
2659
    if not tcp_server.clients:
2057
2660
        logger.warning("No clients defined")
2058
 
        
2059
 
    if not debug:
2060
 
        try:
2061
 
            with pidfile:
2062
 
                pid = os.getpid()
2063
 
                pidfile.write(str(pid) + "\n".encode("utf-8"))
2064
 
            del pidfile
2065
 
        except IOError:
2066
 
            logger.error("Could not write to file %r with PID %d",
2067
 
                         pidfilename, pid)
2068
 
        except NameError:
2069
 
            # "pidfile" was never created
2070
 
            pass
 
2661
    
 
2662
    if not foreground:
 
2663
        if pidfile is not None:
 
2664
            try:
 
2665
                with pidfile:
 
2666
                    pid = os.getpid()
 
2667
                    pidfile.write(str(pid) + "\n".encode("utf-8"))
 
2668
            except IOError:
 
2669
                logger.error("Could not write to file %r with PID %d",
 
2670
                             pidfilename, pid)
 
2671
        del pidfile
2071
2672
        del pidfilename
2072
 
        
2073
 
        signal.signal(signal.SIGINT, signal.SIG_IGN)
2074
2673
    
2075
2674
    signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2076
2675
    signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
2077
2676
    
2078
2677
    if use_dbus:
2079
 
        class MandosDBusService(dbus.service.Object):
 
2678
        @alternate_dbus_interfaces({"se.recompile.Mandos":
 
2679
                                        "se.bsnet.fukt.Mandos"})
 
2680
        class MandosDBusService(DBusObjectWithProperties):
2080
2681
            """A D-Bus proxy object"""
2081
2682
            def __init__(self):
2082
2683
                dbus.service.Object.__init__(self, bus, "/")
2083
2684
            _interface = "se.recompile.Mandos"
2084
2685
            
 
2686
            @dbus_interface_annotations(_interface)
 
2687
            def _foo(self):
 
2688
                return { "org.freedesktop.DBus.Property"
 
2689
                         ".EmitsChangedSignal":
 
2690
                             "false"}
 
2691
            
2085
2692
            @dbus.service.signal(_interface, signature="o")
2086
2693
            def ClientAdded(self, objpath):
2087
2694
                "D-Bus signal"
2101
2708
            def GetAllClients(self):
2102
2709
                "D-Bus method"
2103
2710
                return dbus.Array(c.dbus_object_path
2104
 
                                  for c in tcp_server.clients)
 
2711
                                  for c in
 
2712
                                  tcp_server.clients.itervalues())
2105
2713
            
2106
2714
            @dbus.service.method(_interface,
2107
2715
                                 out_signature="a{oa{sv}}")
2109
2717
                "D-Bus method"
2110
2718
                return dbus.Dictionary(
2111
2719
                    ((c.dbus_object_path, c.GetAll(""))
2112
 
                     for c in tcp_server.clients),
 
2720
                     for c in tcp_server.clients.itervalues()),
2113
2721
                    signature="oa{sv}")
2114
2722
            
2115
2723
            @dbus.service.method(_interface, in_signature="o")
2116
2724
            def RemoveClient(self, object_path):
2117
2725
                "D-Bus method"
2118
 
                for c in tcp_server.clients:
 
2726
                for c in tcp_server.clients.itervalues():
2119
2727
                    if c.dbus_object_path == object_path:
2120
 
                        tcp_server.clients.remove(c)
 
2728
                        del tcp_server.clients[c.name]
2121
2729
                        c.remove_from_connection()
2122
2730
                        # Don't signal anything except ClientRemoved
2123
2731
                        c.disable(quiet=True)
2128
2736
            
2129
2737
            del _interface
2130
2738
        
2131
 
        class MandosDBusServiceTransitional(MandosDBusService):
2132
 
            __metaclass__ = AlternateDBusNamesMetaclass
2133
 
        mandos_dbus_service = MandosDBusServiceTransitional()
 
2739
        mandos_dbus_service = MandosDBusService()
2134
2740
    
2135
2741
    def cleanup():
2136
2742
        "Cleanup function; run on exit"
2137
2743
        service.cleanup()
2138
2744
        
2139
2745
        multiprocessing.active_children()
 
2746
        wnull.close()
 
2747
        if not (tcp_server.clients or client_settings):
 
2748
            return
 
2749
        
 
2750
        # Store client before exiting. Secrets are encrypted with key
 
2751
        # based on what config file has. If config file is
 
2752
        # removed/edited, old secret will thus be unrecovable.
 
2753
        clients = {}
 
2754
        with PGPEngine() as pgp:
 
2755
            for client in tcp_server.clients.itervalues():
 
2756
                key = client_settings[client.name]["secret"]
 
2757
                client.encrypted_secret = pgp.encrypt(client.secret,
 
2758
                                                      key)
 
2759
                client_dict = {}
 
2760
                
 
2761
                # A list of attributes that can not be pickled
 
2762
                # + secret.
 
2763
                exclude = set(("bus", "changedstate", "secret",
 
2764
                               "checker", "server_settings"))
 
2765
                for name, typ in (inspect.getmembers
 
2766
                                  (dbus.service.Object)):
 
2767
                    exclude.add(name)
 
2768
                
 
2769
                client_dict["encrypted_secret"] = (client
 
2770
                                                   .encrypted_secret)
 
2771
                for attr in client.client_structure:
 
2772
                    if attr not in exclude:
 
2773
                        client_dict[attr] = getattr(client, attr)
 
2774
                
 
2775
                clients[client.name] = client_dict
 
2776
                del client_settings[client.name]["secret"]
 
2777
        
 
2778
        try:
 
2779
            with (tempfile.NamedTemporaryFile
 
2780
                  (mode='wb', suffix=".pickle", prefix='clients-',
 
2781
                   dir=os.path.dirname(stored_state_path),
 
2782
                   delete=False)) as stored_state:
 
2783
                pickle.dump((clients, client_settings), stored_state)
 
2784
                tempname=stored_state.name
 
2785
            os.rename(tempname, stored_state_path)
 
2786
        except (IOError, OSError) as e:
 
2787
            if not debug:
 
2788
                try:
 
2789
                    os.remove(tempname)
 
2790
                except NameError:
 
2791
                    pass
 
2792
            if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
 
2793
                logger.warning("Could not save persistent state: {0}"
 
2794
                               .format(os.strerror(e.errno)))
 
2795
            else:
 
2796
                logger.warning("Could not save persistent state:",
 
2797
                               exc_info=e)
 
2798
                raise
 
2799
        
 
2800
        # Delete all clients, and settings from config
2140
2801
        while tcp_server.clients:
2141
 
            client = tcp_server.clients.pop()
 
2802
            name, client = tcp_server.clients.popitem()
2142
2803
            if use_dbus:
2143
2804
                client.remove_from_connection()
2144
 
            client.disable_hook = None
2145
2805
            # Don't signal anything except ClientRemoved
2146
2806
            client.disable(quiet=True)
2147
2807
            if use_dbus:
2149
2809
                mandos_dbus_service.ClientRemoved(client
2150
2810
                                                  .dbus_object_path,
2151
2811
                                                  client.name)
 
2812
        client_settings.clear()
2152
2813
    
2153
2814
    atexit.register(cleanup)
2154
2815
    
2155
 
    for client in tcp_server.clients:
 
2816
    for client in tcp_server.clients.itervalues():
2156
2817
        if use_dbus:
2157
2818
            # Emit D-Bus signal
2158
2819
            mandos_dbus_service.ClientAdded(client.dbus_object_path)
2159
 
        client.enable()
 
2820
        # Need to initiate checking of clients
 
2821
        if client.enabled:
 
2822
            client.init_checker()
2160
2823
    
2161
2824
    tcp_server.enable()
2162
2825
    tcp_server.server_activate()
2165
2828
    service.port = tcp_server.socket.getsockname()[1]
2166
2829
    if use_ipv6:
2167
2830
        logger.info("Now listening on address %r, port %d,"
2168
 
                    " flowinfo %d, scope_id %d"
2169
 
                    % tcp_server.socket.getsockname())
 
2831
                    " flowinfo %d, scope_id %d",
 
2832
                    *tcp_server.socket.getsockname())
2170
2833
    else:                       # IPv4
2171
 
        logger.info("Now listening on address %r, port %d"
2172
 
                    % tcp_server.socket.getsockname())
 
2834
        logger.info("Now listening on address %r, port %d",
 
2835
                    *tcp_server.socket.getsockname())
2173
2836
    
2174
2837
    #service.interface = tcp_server.socket.getsockname()[3]
2175
2838
    
2178
2841
        try:
2179
2842
            service.activate()
2180
2843
        except dbus.exceptions.DBusException as error:
2181
 
            logger.critical("DBusException: %s", error)
 
2844
            logger.critical("D-Bus Exception", exc_info=error)
2182
2845
            cleanup()
2183
2846
            sys.exit(1)
2184
2847
        # End of Avahi example code
2191
2854
        logger.debug("Starting main loop")
2192
2855
        main_loop.run()
2193
2856
    except AvahiError as error:
2194
 
        logger.critical("AvahiError: %s", error)
 
2857
        logger.critical("Avahi Error", exc_info=error)
2195
2858
        cleanup()
2196
2859
        sys.exit(1)
2197
2860
    except KeyboardInterrupt:
2202
2865
    # Must run before the D-Bus bus name gets deregistered
2203
2866
    cleanup()
2204
2867
 
2205
 
 
2206
2868
if __name__ == '__main__':
2207
2869
    main()